toolcraft 0.0.24 → 0.0.26

package/dist/cli.js

@@ -9,6 +9,7 @@ import { invokeWithHumanInLoop } from "./human-in-loop/index.js";
 import { resolveMcpProxies } from "./mcp-proxy.js";
 import { getExpectedNumberDescription, isValidNumberSchemaValue } from "./number-schema.js";
 import { findEntrypointPackageMetadata } from "./package-metadata.js";
+import { redactHttpBody, redactHttpHeaderValue } from "./redaction.js";
 import { renderResult } from "./renderer.js";
 import { renderSourceSnippet } from "./source-snippet.js";
 import { enableSourceMaps, formatDebugStack } from "./stack-trim.js";
@@ -2586,17 +2587,18 @@ function formatGraphQLErrorEnvelopeBody(body) {
         .join("\n\n");
 }
 function formatHttpErrorBody(body) {
-    if (typeof body === "string") {
-        return body;
+    const redactedBody = redactHttpBody(body);
+    if (typeof redactedBody === "string") {
+        return redactedBody;
     }
-    if (isProblemDetailsLike(body)) {
-        return formatProblemDetailsBody(body);
+    if (isProblemDetailsLike(redactedBody)) {
+        return formatProblemDetailsBody(redactedBody);
     }
-    if (isGraphQLErrorEnvelopeLike(body)) {
-        return formatGraphQLErrorEnvelopeBody(body);
+    if (isGraphQLErrorEnvelopeLike(redactedBody)) {
+        return formatGraphQLErrorEnvelopeBody(redactedBody);
     }
-    const serialized = JSON.stringify(body, null, 2);
-    return serialized === undefined ? String(body) : serialized;
+    const serialized = JSON.stringify(redactedBody, null, 2);
+    return serialized === undefined ? String(redactedBody) : serialized;
 }
 function indentHttpErrorBlock(value) {
     return value
@@ -2605,7 +2607,7 @@ function indentHttpErrorBlock(value) {
         .join("\n");
 }
 function formatHttpHeaderValue(name, value) {
-    return name.toLowerCase() === "authorization" ? "Bearer ****" : value;
+    return redactHttpHeaderValue(name, value);
 }
 function formatHttpErrorHeaders(headers) {
     return Object.entries(headers).map(([name, value]) => `  ${name}: ${formatHttpHeaderValue(name, value)}`);

package/dist/error-report.js

@@ -6,9 +6,9 @@ import { CommanderError } from "commander";
 import { ApprovalDeclinedError } from "./human-in-loop/types.js";
 import { findProjectRoot } from "./mcp-proxy.js";
 import { findPackageMetadata } from "./package-metadata.js";
+import { isSensitiveName, redactHttpBody, redactHttpHeaderValue } from "./redaction.js";
 import { UserError } from "./user-error.js";
 const ERROR_REPORTS_ENV = "TOOLCRAFT_ERROR_REPORTS";
-const DEFAULT_SENSITIVE_NAMES = ["password", "token", "apikey", "secret"];
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -116,10 +116,6 @@ function redactValue(value) {
     }
     return `<set, ${value.length} chars>`;
 }
-function isSensitiveName(name) {
-    const normalized = name.toLowerCase();
-    return DEFAULT_SENSITIVE_NAMES.some((candidate) => normalized.includes(candidate));
-}
 function schemaSecretValue(schema) {
     const unwrapped = unwrapOptional(schema);
     if (unwrapped.kind === "string" || unwrapped.kind === "number") {
@@ -208,8 +204,14 @@ function stableJson(value) {
     return JSON.stringify(value, null, 2) ?? "undefined";
 }
 function redactStructuredErrorField(name, value) {
-    if (typeof value === "string" && name.toLowerCase() === "authorization") {
-        return "Bearer ****";
+    if (typeof value === "string") {
+        const redactedHeaderValue = redactHttpHeaderValue(name, value);
+        if (redactedHeaderValue !== value) {
+            return redactedHeaderValue;
+        }
+        if (isSensitiveName(name)) {
+            return "<redacted>";
+        }
     }
     if (Array.isArray(value)) {
         return value.map((entry) => redactStructuredErrorField(name, entry));
@@ -254,7 +256,7 @@ function formatStackChain(error) {
     return lines.join("\n");
 }
 function formatHeaderValue(name, value) {
-    return name.toLowerCase() === "authorization" ? "Bearer ****" : value;
+    return redactHttpHeaderValue(name, value);
 }
 function formatHeaders(headers) {
     return Object.entries(headers)
@@ -262,10 +264,11 @@ function formatHeaders(headers) {
         .join("\n");
 }
 function formatBody(body) {
-    if (typeof body === "string") {
-        return body;
+    const redactedBody = redactHttpBody(body);
+    if (typeof redactedBody === "string") {
+        return redactedBody;
     }
-    return stableJson(body);
+    return stableJson(redactedBody);
 }
 function formatHttpTranscript(error) {
     const requestLines = [

package/dist/redaction.d.ts

@@ -0,0 +1,4 @@
+export declare function isSensitiveName(name: string): boolean;
+export declare function redactSecretLikeFields(value: unknown, name?: string): unknown;
+export declare function redactHttpBody(body: unknown): unknown;
+export declare function redactHttpHeaderValue(name: string, value: string): string;

package/dist/redaction.js

@@ -0,0 +1,70 @@
+const REDACTED_VALUE = "<redacted>";
+const SENSITIVE_NAME_PARTS = ["password", "token", "apikey", "secret"];
+const AUTHORIZATION_HEADER_NAMES = new Set(["authorization", "proxyauthorization"]);
+const SECRET_HEADER_NAMES = new Set(["cookie", "setcookie"]);
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+export function isSensitiveName(name) {
+    const normalized = normalizeName(name);
+    return SENSITIVE_NAME_PARTS.some((candidate) => normalized.includes(candidate));
+}
+function redactSecretLikeFieldsValue(value, name, seen) {
+    if (name.length > 0 && isSensitiveName(name)) {
+        return REDACTED_VALUE;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value)) {
+            return "[Circular]";
+        }
+        seen.add(value);
+        return value.map((entry) => redactSecretLikeFieldsValue(entry, name, seen));
+    }
+    if (isPlainObject(value)) {
+        if (seen.has(value)) {
+            return "[Circular]";
+        }
+        seen.add(value);
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            redactSecretLikeFieldsValue(entry, key, seen)
+        ]));
+    }
+    return value;
+}
+export function redactSecretLikeFields(value, name = "") {
+    return redactSecretLikeFieldsValue(value, name, new WeakSet());
+}
+function parseJsonObjectOrArray(value) {
+    const trimmed = value.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(trimmed);
+        return isPlainObject(parsed) || Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function redactHttpBody(body) {
+    if (typeof body === "string") {
+        const parsed = parseJsonObjectOrArray(body);
+        return parsed === undefined ? body : redactSecretLikeFields(parsed);
+    }
+    return redactSecretLikeFields(body);
+}
+export function redactHttpHeaderValue(name, value) {
+    const normalized = normalizeName(name);
+    if (AUTHORIZATION_HEADER_NAMES.has(normalized)) {
+        return "Bearer ****";
+    }
+    if (SECRET_HEADER_NAMES.has(normalized) || isSensitiveName(name)) {
+        return REDACTED_VALUE;
+    }
+    return value;
+}

package/node_modules/@poe-code/config-mutations/dist/execution/apply-mutation.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { renderTemplate } from "@poe-code/design-system";
 import { getConfigFormat, detectFormat } from "../formats/index.js";
+import { cloneConfigObject, setConfigEntry } from "../formats/object.js";
 import { resolvePath } from "./path-utils.js";
 import { isNotFound, readFileIfExists, pathExists, createTimestamp } from "../fs-utils.js";
 // ============================================================================
@@ -120,7 +121,7 @@ function pruneKeysByPrefix(table, prefix) {
     const result = {};
     for (const [key, value] of Object.entries(table)) {
         if (!key.startsWith(prefix)) {
-            result[key] = value;
+            setConfigEntry(result, key, value);
         }
     }
     return result;
@@ -129,25 +130,44 @@ function isConfigObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function mergeWithPruneByPrefix(base, patch, pruneByPrefix) {
-    const result = { ...base };
+    const result = cloneConfigObject(base);
     const prefixMap = pruneByPrefix ?? {};
     for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined) {
+            continue;
+        }
         const current = result[key];
         const prefix = prefixMap[key];
         if (isConfigObject(current) && isConfigObject(value)) {
             if (prefix) {
                 const pruned = pruneKeysByPrefix(current, prefix);
-                result[key] = { ...pruned, ...value };
+                setConfigEntry(result, key, mergePrunedConfigObject(pruned, value));
             }
             else {
-                result[key] = mergeWithPruneByPrefix(current, value, prefixMap);
+                setConfigEntry(result, key, mergeWithPruneByPrefix(current, value, prefixMap));
             }
             continue;
         }
-        result[key] = value;
+        setConfigEntry(result, key, value);
     }
     return result;
 }
+function mergePrunedConfigObject(base, patch) {
+    const result = cloneConfigObject(base);
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined) {
+            continue;
+        }
+        setConfigEntry(result, key, value);
+    }
+    return result;
+}
+function serializeConfigUpdate(format, rawContent, current, next) {
+    if (rawContent !== null && format.serializeUpdate) {
+        return format.serializeUpdate(rawContent, current, next);
+    }
+    return format.serialize(next);
+}
 // ============================================================================
 // Apply Mutation
 // ============================================================================
@@ -480,6 +500,7 @@ async function applyConfigMerge(mutation, context, options) {
     }
     const format = getConfigFormat(formatName);
     const rawContent = await readFileIfExists(context.fs, targetPath);
+    let preserveContent = rawContent;
     let current;
     try {
         current = rawContent === null ? {} : format.parse(rawContent);
@@ -490,9 +511,10 @@ async function applyConfigMerge(mutation, context, options) {
             await backupInvalidDocument(context, targetPath, rawContent);
         }
         current = {};
+        preserveContent = null;
     }
     const value = resolveValue(mutation.value, options);
-    // Use mergeWithPruneByPrefix for TOML files with pruneByPrefix option
+    // Keep prefix pruning on the same proto-safe object-write path as normal merges.
     let merged;
     if (mutation.pruneByPrefix) {
         merged = mergeWithPruneByPrefix(current, value, mutation.pruneByPrefix);
@@ -500,7 +522,7 @@ async function applyConfigMerge(mutation, context, options) {
     else {
         merged = format.merge(current, value);
     }
-    const serialized = format.serialize(merged);
+    const serialized = serializeConfigUpdate(format, preserveContent, current, merged);
     const changed = serialized !== rawContent;
     if (changed && !context.dryRun) {
         await writeAtomically(context, targetPath, serialized);
@@ -570,7 +592,7 @@ async function applyConfigPrune(mutation, context, options) {
             details
         };
     }
-    const serialized = format.serialize(result);
+    const serialized = serializeConfigUpdate(format, rawContent, current, result);
     if (!context.dryRun) {
         await writeAtomically(context, targetPath, serialized);
     }
@@ -593,6 +615,7 @@ async function applyConfigTransform(mutation, context, options) {
     }
     const format = getConfigFormat(formatName);
     const rawContent = await readFileIfExists(context.fs, targetPath);
+    let preserveContent = rawContent;
     let current;
     try {
         current = rawContent === null ? {} : format.parse(rawContent);
@@ -602,6 +625,7 @@ async function applyConfigTransform(mutation, context, options) {
             await backupInvalidDocument(context, targetPath, rawContent);
         }
         current = {};
+        preserveContent = null;
     }
     const { content: transformed, changed } = mutation.transform(current, options);
     if (!changed) {
@@ -626,7 +650,7 @@ async function applyConfigTransform(mutation, context, options) {
             details
         };
     }
-    const serialized = format.serialize(transformed);
+    const serialized = serializeConfigUpdate(format, preserveContent, current, transformed);
     if (!context.dryRun) {
         await writeAtomically(context, targetPath, serialized);
     }

package/node_modules/@poe-code/config-mutations/dist/formats/json.d.ts

@@ -27,5 +27,6 @@ declare function mergePreservingComments(content: string, patch: ConfigObject):
  * @returns The modified JSON content with comments preserved
  */
 declare function removeAtPath(content: string, path: (string | number)[]): string;
-export { detectIndent, modifyAtPath, mergePreservingComments, removeAtPath };
+declare function serializeUpdate(content: string, current: ConfigObject, next: ConfigObject): string;
+export { detectIndent, modifyAtPath, mergePreservingComments, removeAtPath, serializeUpdate };
 export declare const jsonFormat: ConfigFormat;

package/node_modules/@poe-code/config-mutations/dist/formats/json.js

@@ -48,6 +48,9 @@ function merge(base, patch) {
     }
     return result;
 }
+function configValuesEqual(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
 function prune(obj, shape) {
     let changed = false;
     const result = cloneConfigObject(obj);
@@ -116,14 +119,8 @@ function modifyAtPath(content, path, value) {
  * @returns The modified JSON content with comments preserved
  */
 function mergePreservingComments(content, patch) {
-    let result = content || "{}";
-    for (const [key, value] of Object.entries(patch)) {
-        if (value === undefined) {
-            continue;
-        }
-        result = modifyAtPath(result, [key], value);
-    }
-    return result;
+    const current = parse(content);
+    return serializeUpdate(content || "{}", current, merge(current, patch));
 }
 /**
  * Remove a key from JSON content while preserving comments and formatting.
@@ -135,10 +132,40 @@ function mergePreservingComments(content, patch) {
 function removeAtPath(content, path) {
     return modifyAtPath(content, path, undefined);
 }
-export { detectIndent, modifyAtPath, mergePreservingComments, removeAtPath };
+function serializeUpdate(content, current, next) {
+    let result = content || "{}";
+    result = applyObjectUpdate(result, [], current, next);
+    if (!result.endsWith("\n")) {
+        result += "\n";
+    }
+    return result;
+}
+function applyObjectUpdate(content, path, current, next) {
+    let result = content;
+    for (const key of Object.keys(current)) {
+        if (!hasConfigEntry(next, key)) {
+            result = removeAtPath(result, [...path, key]);
+        }
+    }
+    for (const [key, nextValue] of Object.entries(next)) {
+        const nextPath = [...path, key];
+        const hasCurrent = hasConfigEntry(current, key);
+        const currentValue = hasCurrent ? current[key] : undefined;
+        if (hasCurrent && isConfigObject(currentValue) && isConfigObject(nextValue)) {
+            result = applyObjectUpdate(result, nextPath, currentValue, nextValue);
+            continue;
+        }
+        if (!hasCurrent || !configValuesEqual(currentValue, nextValue)) {
+            result = modifyAtPath(result, nextPath, nextValue);
+        }
+    }
+    return result;
+}
+export { detectIndent, modifyAtPath, mergePreservingComments, removeAtPath, serializeUpdate };
 export const jsonFormat = {
     parse,
     serialize,
+    serializeUpdate,
     merge,
     prune
 };

package/node_modules/@poe-code/config-mutations/dist/types.d.ts

@@ -35,6 +35,8 @@ export interface ConfigFormat {
     parse(content: string): ConfigObject;
     /** Serialize object to string (with consistent formatting) */
     serialize(obj: ConfigObject): string;
+    /** Serialize an update against original content while preserving comments when possible */
+    serializeUpdate?(content: string, current: ConfigObject, next: ConfigObject): string;
     /** Deep merge patch into base, returning new object */
     merge(base: ConfigObject, patch: ConfigObject): ConfigObject;
     /** Remove keys matching shape from object, returning new object */

package/node_modules/@poe-code/design-system/dist/components/browser.js

@@ -10,7 +10,7 @@ function browserCommand(url, platform) {
         return { command: "open", args: [url] };
     }
     if (platform === "win32") {
-        return { command: "cmd", args: ["/c", "start", "", url] };
+        return { command: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
     }
     return { command: "xdg-open", args: [url] };
 }

package/node_modules/@poe-code/design-system/dist/explorer/actions.js

@@ -32,7 +32,7 @@ function currentDetailItem(state) {
     return state.detail.items?.[state.detail.cursor];
 }
 function selectedRows(state, fallback) {
-    if (state.selected.size === 0) {
+    if (!state.multiSelect || state.selected.size === 0) {
         return fallback.id === "" ? [] : [fallback];
     }
     return state.rows.filter((row) => state.selected.has(row.id));

package/node_modules/@poe-code/design-system/dist/explorer/keymap.js

@@ -45,14 +45,24 @@ const baseBuiltinCommands = [
     "extendSelectionDown"
 ];
 const reorderCommands = ["reorderUp", "reorderDown"];
+const selectionCommands = new Set([
+    "toggleSelect",
+    "selectAll",
+    "clearSelection",
+    "extendSelectionUp",
+    "extendSelectionDown"
+]);
 const reservedActionIds = new Set(["quit"]);
 export function resolveBindings(config, defaults = {}) {
-    const commands = config.reorder === undefined
+    const baseCommands = config.reorder === undefined
         ? baseBuiltinCommands
         : [
             ...baseBuiltinCommands.filter((command) => command !== "extendSelectionUp" && command !== "extendSelectionDown"),
             ...reorderCommands
         ];
+    const commands = config.multiSelect === false
+        ? baseCommands.filter((command) => !selectionCommands.has(command))
+        : baseCommands;
     const commandBindings = new Map();
     const flatBindings = new Map();
     const targetKeys = new Map();

package/node_modules/@poe-code/design-system/dist/explorer/reducer.js

@@ -101,6 +101,9 @@ function stepKey(state, key, runtimeHandles) {
     if (isBackspace(key)) {
         return updateFilter(state, state.filter.slice(0, -1));
     }
+    if (!state.multiSelect && isSelectionSpace(key)) {
+        return mark(state, 0);
+    }
     if (isPrintable(key)) {
         return updateFilter(state, `${state.filter}${key.ch}`);
     }
@@ -170,7 +173,7 @@ function resize(state, cols, rows) {
         return mark(state, 0);
     }
     return {
-        state: { ...state, size, layout, dirty: REGION_ALL },
+        state: clampDetailScroll({ ...state, size, layout, dirty: REGION_ALL }),
         effects: NO_EFFECTS
     };
 }
@@ -186,7 +189,7 @@ function rowsLoaded(state, rows) {
     const filtered = matches.map((match) => match.index);
     const matchPositions = createMatchPositions(matches);
     const cursor = clamp(state.cursor, 0, Math.max(0, filtered.length - 1));
-    const selected = pruneSelection(state.selected, rows);
+    const selected = state.multiSelect ? pruneSelection(state.selected, rows) : new Set();
     const detail = resetDetailForCursor(state, rows, filtered, cursor);
     const modal = modalStillValid(state.modal, rows);
     if (state.modal?.kind === "confirm" && modal === null) {
@@ -239,8 +242,9 @@ function detailItemRendered(state, rowId, token, itemIndex, content) {
         return mark(state, 0);
     }
     const items = state.detail.items.map((item, index) => index === itemIndex ? { ...item, renderedContent: content } : item);
+    const detail = { ...state.detail, items };
     return {
-        state: { ...state, detail: { ...state.detail, items }, dirty: REGION_DETAIL },
+        state: clampDetailScroll({ ...state, detail, dirty: REGION_DETAIL }),
         effects: NO_EFFECTS
     };
 }
@@ -400,6 +404,9 @@ function confirmKey(state, runtimeHandles) {
     return dispatchPrimary(state, runtimeHandles);
 }
 function toggleSelect(state) {
+    if (!state.multiSelect) {
+        return mark(state, 0);
+    }
     const row = currentRow(state);
     if (row === undefined) {
         return mark(state, 0);
@@ -414,6 +421,9 @@ function toggleSelect(state) {
     return selectionChanged(state, selected);
 }
 function selectAll(state) {
+    if (!state.multiSelect) {
+        return mark(state, 0);
+    }
     const selected = new Set(state.selected);
     for (const index of state.filtered) {
         const row = state.rows[index];
@@ -430,13 +440,14 @@ function clearSelection(state) {
     return selectionChanged(state, new Set());
 }
 function selectionChanged(state, selected) {
-    if (setsEqual(state.selected, selected)) {
+    const normalized = state.multiSelect ? selected : new Set();
+    if (setsEqual(state.selected, normalized)) {
         return mark(state, 0);
     }
     const next = {
         ...state,
-        selected,
-        actionState: recomputeActionState({ ...state, selected }),
+        selected: normalized,
+        actionState: recomputeActionState({ ...state, selected: normalized }),
         dirty: REGION_LIST | REGION_FOOTER
     };
     return { state: next, effects: NO_EFFECTS };
@@ -445,7 +456,7 @@ function detailScroll(state, delta) {
     if (state.focused !== "detail") {
         return mark(state, 0);
     }
-    const scroll = Math.max(0, state.detail.scroll + delta);
+    const scroll = clamp(state.detail.scroll + delta, 0, maxDetailScroll(state));
     if (scroll === state.detail.scroll) {
         return mark(state, 0);
     }
@@ -454,7 +465,49 @@ function detailScroll(state, delta) {
         effects: NO_EFFECTS
     };
 }
+function clampDetailScroll(state) {
+    const scroll = clamp(state.detail.scroll, 0, maxDetailScroll(state));
+    if (scroll === state.detail.scroll) {
+        return state;
+    }
+    return { ...state, detail: { ...state.detail, scroll } };
+}
+function maxDetailScroll(state) {
+    const items = state.detail.items;
+    if (items === null || items.length === 0) {
+        return 0;
+    }
+    if (items.length === 1 && items[0]?.title === undefined) {
+        const visibleHeight = detailBodyHeight(state);
+        if (visibleHeight <= 0) {
+            return 0;
+        }
+        return Math.max(0, detailContentLineCount(items[0]) - visibleHeight);
+    }
+    return Math.max(0, items.length - 1);
+}
+function detailContentLineCount(item) {
+    return (item.renderedContent ?? "").split("\n").length;
+}
+function detailBodyHeight(state) {
+    if (state.layout === "too-narrow" || state.layout === "narrow-list-only") {
+        return 0;
+    }
+    const rows = normalizeSize(state.size.rows);
+    const footerHeight = rows > 0 ? Math.min(1, rows) : 0;
+    const headerHeight = Math.min(3, Math.max(0, rows - footerHeight));
+    const contentHeight = Math.max(0, rows - headerHeight - footerHeight);
+    if (state.layout === "narrow-vertical") {
+        const listHeight = Math.ceil(contentHeight / 2);
+        const detailHeight = contentHeight - listHeight;
+        return Math.max(0, detailHeight - 1);
+    }
+    return contentHeight;
+}
 function extendSelection(state, delta) {
+    if (!state.multiSelect) {
+        return moveCursor(state, delta);
+    }
     const moved = moveCursor(state, delta);
     const row = currentRow(moved.state);
     if (row === undefined) {
@@ -646,7 +699,7 @@ function actionSource(state, action) {
     return state.actionState.get(action.id)?.source ?? "row";
 }
 function selectedRows(state) {
-    if (state.selected.size === 0) {
+    if (!state.multiSelect || state.selected.size === 0) {
         const row = currentRow(state);
         return row === undefined ? [] : [row];
     }
@@ -718,6 +771,9 @@ function isPrintable(key) {
 function isBackspace(key) {
     return key.name === "backspace" || key.name === "delete";
 }
+function isSelectionSpace(key) {
+    return key.name === "space" || key.ch === " ";
+}
 function isConfirmYes(key) {
     return key.ch === "y" || key.ch === "Y";
 }

package/node_modules/@poe-code/design-system/dist/explorer/render/detail.js

@@ -1,4 +1,5 @@
 import { getExplorerStyles } from "../theme.js";
+import { fitToWidth } from "./text.js";
 export function renderDetail(state, screen, layout) {
     const rect = layout.detail;
     const styles = getExplorerStyles();
@@ -35,7 +36,8 @@ function renderDetailBody(state, screen, rect, row) {
 function renderListMode(state, screen, rect, items, row) {
     const styles = getExplorerStyles();
     let y = 0;
-    for (let index = state.detail.scroll; index < items.length && y < rect.height; index += 1) {
+    const start = clamp(state.detail.scroll, 0, Math.max(0, items.length - 1));
+    for (let index = start; index < items.length && y < rect.height; index += 1) {
         const item = items[index];
         const cursor = index === state.detail.cursor;
         const title = item.title ?? item.id;
@@ -60,7 +62,9 @@ function renderListMode(state, screen, rect, items, row) {
     }
 }
 function renderBlob(screen, rect, text, scroll) {
-    const lines = text.split("\n").slice(scroll);
+    const allLines = text.split("\n");
+    const start = clamp(scroll, 0, Math.max(0, allLines.length - rect.height));
+    const lines = allLines.slice(start);
     for (let row = 0; row < rect.height; row += 1) {
         writeLine(screen, rect, row, lines[row] ?? "");
     }
@@ -86,14 +90,8 @@ function writeLine(screen, rect, row, text, style = {}) {
     if (row < 0 || row >= rect.height) {
         return;
     }
-    screen.put(rect.x, rect.y + row, fit(text, rect.width), style);
+    screen.put(rect.x, rect.y + row, fitToWidth(text, rect.width, rect.x), style);
 }
-function fit(text, width) {
-    if (width <= 0) {
-        return "";
-    }
-    if (text.length <= width) {
-        return text;
-    }
-    return width <= 1 ? text.slice(0, width) : `${text.slice(0, width - 1)}…`;
+function clamp(value, min, max) {
+    return Math.min(max, Math.max(min, value));
 }