noah-code 0.4.1__tar.gz → 0.5.0__tar.gz

{noah_code-0.4.1 → noah_code-0.5.0}/.github/workflows/ci.yml

@@ -109,8 +109,6 @@ jobs:
             runner: ubuntu-24.04-arm
           - name: macOS arm64
             runner: macos-15
-          - name: macOS x86_64
-            runner: macos-15-intel
     steps:
       - name: Check out source
         uses: actions/checkout@v7

{noah_code-0.4.1 → noah_code-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: noah-code
-Version: 0.4.1
+Version: 0.5.0
 Summary: Noah Code terminal coding agent, built on NVIDIA OO Agents (NOOA)
 Project-URL: Homepage, https://github.com/skundu42/noah-code
 Project-URL: Documentation, https://github.com/skundu42/noah-code#readme
@@ -170,11 +170,17 @@ Type `/` to search the full command and configuration reference. The most common
 | Drag, then `Cmd+C` / `Ctrl+Shift+C` | Select and copy TUI text |
 | `Ctrl+Shift+C` with no selection | Copy the latest Noah reply |
 | `Ctrl+G` | Open the searchable skills picker |
+| `Ctrl+L` | Open the model picker |
+| `Ctrl+R` | Search and recall a prior prompt |
+| `Ctrl+T` | Expand or collapse live tool output |
+| `Shift+Tab` | Open the reasoning-effort picker |
+| `Alt+Up` | Recall the newest queued prompt for editing |
 | `Ctrl+]` | Return to live transcript output |
 | `Tab` | Switch between build and plan mode |
 | `F2` | Open execution activity |
 | `F3` | Open paginated conversation history |
 | `F4` | Open the live agent, terminal, and job ledger |
+| `Shift+F7` | Focus or leave the scrollable context rail |
 | `/model` | Configure a provider or switch the session model |
 | `/theme` | Choose Atom One Dark, Noah Ocean, Graphite, or High Contrast |
 | `/diff` | Review staged and unstaged changes |
@@ -188,6 +194,8 @@ On wide terminals, the side rail prioritizes the active operation, delegated age
 terminals, Git branch and change counts, session, model usage, update state, and plan. Git status is refreshed in the background at turn
 boundaries, so the animated working state stays responsive. The main pane remains centered on the
 large Noah wordmark until the first prompt, then becomes the conversation and execution timeline.
+The composer footer keeps contextual keys and compact token, cache, and cost telemetry visible at
+every terminal width where they fit.
 
 ## Sessions and crash recovery
 

{noah_code-0.4.1 → noah_code-0.5.0}/README.md

@@ -125,11 +125,17 @@ Type `/` to search the full command and configuration reference. The most common
 | Drag, then `Cmd+C` / `Ctrl+Shift+C` | Select and copy TUI text |
 | `Ctrl+Shift+C` with no selection | Copy the latest Noah reply |
 | `Ctrl+G` | Open the searchable skills picker |
+| `Ctrl+L` | Open the model picker |
+| `Ctrl+R` | Search and recall a prior prompt |
+| `Ctrl+T` | Expand or collapse live tool output |
+| `Shift+Tab` | Open the reasoning-effort picker |
+| `Alt+Up` | Recall the newest queued prompt for editing |
 | `Ctrl+]` | Return to live transcript output |
 | `Tab` | Switch between build and plan mode |
 | `F2` | Open execution activity |
 | `F3` | Open paginated conversation history |
 | `F4` | Open the live agent, terminal, and job ledger |
+| `Shift+F7` | Focus or leave the scrollable context rail |
 | `/model` | Configure a provider or switch the session model |
 | `/theme` | Choose Atom One Dark, Noah Ocean, Graphite, or High Contrast |
 | `/diff` | Review staged and unstaged changes |
@@ -143,6 +149,8 @@ On wide terminals, the side rail prioritizes the active operation, delegated age
 terminals, Git branch and change counts, session, model usage, update state, and plan. Git status is refreshed in the background at turn
 boundaries, so the animated working state stays responsive. The main pane remains centered on the
 large Noah wordmark until the first prompt, then becomes the conversation and execution timeline.
+The composer footer keeps contextual keys and compact token, cache, and cost telemetry visible at
+every terminal width where they fit.
 
 ## Sessions and crash recovery
 

{noah_code-0.4.1 → noah_code-0.5.0}/docs/interactive-reference.md

@@ -9,7 +9,12 @@
 | `Tab` | Toggle `build`/`plan` mode; accept the highlighted slash option while suggestions are open |
 | `Ctrl+P` | Open the command palette |
 | `Ctrl+G` | Open the searchable skills picker |
+| `Ctrl+L` | Open the model picker |
 | `Ctrl+O` | Open the session picker |
+| `Ctrl+R` | Search prior prompts and recall one into the composer |
+| `Ctrl+T` | Expand or collapse live tool output |
+| `Alt+Up` | Recall the newest queued prompt into the composer |
+| `Shift+Tab` | Open the reasoning-effort picker |
 | `Ctrl+N` | Start a new session |
 | `Ctrl+C` | Cancel the active turn and clear queued follow-ups; press twice while idle to quit |
 | `Ctrl+Q` | Quit |
@@ -17,6 +22,7 @@
 | `F2` | Open recent activity and full captured output |
 | `F3` | Open paginated persisted conversation history |
 | `F4` | Open the live work ledger for agents, terminals, and background jobs |
+| `Shift+F7` | Focus or leave the context rail on wide terminals |
 | `Ctrl+]` | Return to live transcript output and clear the new-output counter |
 
 At an approval prompt, press `1` to approve once, `2` to remember the approval for the current
@@ -29,16 +35,29 @@ branch and staged/modified/new counts, session, model usage, and up to six open
 Narrow terminals retain the transcript, live activity, suggestions, and composer without the rail.
 Terminals 25 rows high or shorter use compact spacing.
 
+The line below the composer keeps the active keyboard guidance on the left and, when space permits,
+session input/output tokens, cache hit rate, and estimated cost on the right. This telemetry remains
+available even when the wide context rail is hidden.
+
+Live tool output stays in a compact two-line drawer so long commands do not push the conversation
+away. Press `Ctrl+T` to expand the drawer in place; `F2` retains the complete output after the tool
+finishes. The drawer replaces the animated working banner while a visible tool is active, avoiding
+duplicate status lines; the banner returns between tools.
+
 Type `/` in the composer to open the inline command list; the list remains visible and filters
 continuously. Use `Up`/`Down` to highlight a command, `Enter` or `Tab` to complete it, and `Esc` to
 close the list. Press `Enter` again to run the completed command. Typing `/config` expands the list
 to every resolved configuration path and its current redacted value.
 
+Press `Ctrl+R` to search prompts already shown in the current session. Choosing one loads it into
+the composer without sending it; pressing `Esc` keeps the current draft unchanged.
+
 Until a session has its first user prompt, the main pane keeps the large Noah wordmark centered. Startup,
 repository changes, model, mode, usage, and update state live in the context rail on wide
-terminals. Git status is collected in a background worker at startup and turn boundaries; the
-animated Noah path updates only the working banner and live activity. Existing sessions with user history restore
-their transcript normally.
+terminals. The rail scrolls when its sections exceed the available rows; press `Shift+F7`, then use
+arrows, Page Up/Down, Home, or End without leaving the keyboard. Git status is collected in a
+background worker at startup and turn boundaries; the animated Noah path updates only the working
+banner and live activity. Existing sessions with user history restore their transcript normally.
 
 Drag across transcript, activity, diff, or history text to select it. `Cmd+C` on macOS or
 `Ctrl+Shift+C` in other terminals copies the selection; when there is no selection, the same
@@ -59,6 +78,8 @@ While Noah is working, the composer stays open. `Enter` queues the current text
 a second turn. Chrome shows `queued · n`. When the in-flight `handle()` returns (`DONE`,
 `NEED_INPUT`, or `WAIT`), the host injects the next item in the same journaled turn — one persist
 and one checkpoint for the whole steered run. `/undo` therefore reverts every follow-up together.
+Press `Alt+Up` with an empty composer to pull the newest queued prompt and its attachments back for
+editing.
 
 The queue holds at most 100 items. A 101st `Enter` drops the oldest and status-prints
 `steer dropped oldest`. `@path` mentions and `/attach` paths expand when the item is injected, not

noah_code-0.5.0/docs/releases/v0.5.0.md

@@ -0,0 +1,64 @@
+# Noah Code v0.5.0
+
+This release improves task completion, terminal interaction, and bounded resource use. It includes
+the unreleased prompt recall, model shortcuts, scrollable context rail, and composer usage telemetry.
+
+## More reliable task completion
+
+- Token-limited model replies no longer report a partial answer as successfully completed. The
+  runtime retries within its existing limits and reports failure if the model cannot continue.
+- Subagents wait for their background jobs and resume the task instead of closing their tools
+  early. Requests for user input remain visible even after result summarization.
+- Session deadlines now bound asynchronous model requests, queued provider calls, and background
+  waits. Provider requests receive the remaining timeout as well.
+- Resumed sessions honor newer mode, model, and reasoning choices over older checkpoints and agent
+  snapshots. Resuming another worktree loads its configuration while preserving explicit CLI
+  overrides. Failed one-shot startup releases its host resources; repeated cleanup preserves the
+  saved undo journal.
+
+## Smoother terminal UX
+
+- Search previous prompts, recall queued prompts for editing, and use direct model and reasoning
+  shortcuts. The context rail scrolls and the composer shows compact usage telemetry.
+- Transcript refreshes preserve your reading position. Switching sessions clears stale activity,
+  buffered output, and unread indicators.
+- Cancelling keeps the interface busy until cleanup finishes, preventing overlapping turns and
+  session changes during teardown.
+- File mentions support quoted paths, prioritize matching directories, and preserve nested image
+  paths when pasted. Text and image attachments share the same file-count limit.
+- Console output renders literal tool/error text safely and preserves shell output chunk boundaries.
+- Console resume preserves the saved model; `-h` and slash commands pasted with whitespace work.
+
+## Safer edits and execution
+
+- Stale edit anchors cannot overwrite newly changed content, even after a file has been reread.
+- Read-only shell calls enforce workspace permissions and retain their stdin and timeout options.
+  Generated code cannot invoke the internal trusted-command bypass.
+- Attachment paths resolve symlinks before containment checks, preventing outside-workspace reads.
+- Background launches serialize capacity and name checks. Split terminal completion markers and
+  oversized log events no longer break completion or stall pagination.
+- Invalid process deadlines fail before execution. Log storage failures preserve bounded in-memory
+  output, keep pipes draining, and do not prevent process cleanup.
+
+## Less context and file I/O
+
+- Subagent results obey their character budget, preserve the end of the findings, and bound the
+  input sent for distillation.
+- Text attachment reads stop at their inline limit. Managed output ranges stream only as far as
+  the requested lines, avoiding whole-file allocation.
+- Repeated glob patterns reuse compiled translations, with bracket pattern support.
+- Runtime database connections close after each transaction, preventing connection accumulation
+  during long-running sessions.
+- The existing prompt-size, cache-prefix stability, and helper-context scorecards remain release
+  checks. No new runtime dependencies were added by these fixes.
+
+## Upgrade
+
+```bash
+noah update
+```
+
+Validation uses deterministic provider responses and headless terminal tests; live provider billing
+and end-to-end model quality are not benchmarked by this release.
+
+**Full changelog:** https://github.com/skundu42/noah-code/compare/v0.4.1...v0.5.0

{noah_code-0.4.1 → noah_code-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "noah-code"
-version = "0.4.1"
+version = "0.5.0"
 description = "Noah Code terminal coding agent, built on NVIDIA OO Agents (NOOA)"
 readme = "README.md"
 requires-python = ">=3.12,<3.14"

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/__init__.py

@@ -1,3 +1,3 @@
 """Noah Code: terminal coding agent on NVIDIA OO Agents."""
 
-__version__ = "0.4.1"
+__version__ = "0.5.0"

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/agent.py

@@ -8,6 +8,7 @@ import platform
 import site
 import sys
 import sysconfig
+import threading
 import types
 from collections.abc import Iterator
 from contextlib import contextmanager, suppress
@@ -126,7 +127,6 @@ class _PermissionSandboxedExecutor(SandboxedExecutor):
             ("ws", "read_output"),
             ("ws", "replace"),
             ("ws", "run"),
-            ("ws", "run_trusted_readonly"),
             ("ws", "search"),
             ("ws", "write"),
             ("ws", "write_file"),
@@ -196,6 +196,8 @@ def _spawn_safe_local_agent(agent: Any) -> Any:
 
 
 _OMIT = object()
+# ``spawnv_passfds`` is process-global; patch and restore it as one critical section.
+_SPAWN_PASSFDS_LOCK = threading.RLock()
 
 
 def _pipe_picklable(value: Any) -> bool:
@@ -246,28 +248,29 @@ def _unique_spawn_passfds() -> Iterator[None]:
     import multiprocessing.util as util
     import os
 
-    original = util.spawnv_passfds
-
-    def _inherit_fds(passfds: Any) -> tuple[int, ...]:
-        kept: list[int] = []
-        for fd in sorted({int(fd) for fd in passfds}):
-            if fd < 0:
-                continue
-            try:
-                os.fstat(fd)
-            except OSError:
-                continue
-            kept.append(fd)
-        return tuple(kept)
-
-    def _spawnv(path: Any, args: Any, passfds: Any) -> Any:
-        return original(path, args, _inherit_fds(passfds))
-
-    util.spawnv_passfds = _spawnv
-    try:
-        yield
-    finally:
-        util.spawnv_passfds = original
+    with _SPAWN_PASSFDS_LOCK:
+        original = util.spawnv_passfds
+
+        def _inherit_fds(passfds: Any) -> tuple[int, ...]:
+            kept: list[int] = []
+            for fd in sorted({int(fd) for fd in passfds}):
+                if fd < 0:
+                    continue
+                try:
+                    os.fstat(fd)
+                except OSError:
+                    continue
+                kept.append(fd)
+            return tuple(kept)
+
+        def _spawnv(path: Any, args: Any, passfds: Any) -> Any:
+            return original(path, args, _inherit_fds(passfds))
+
+        util.spawnv_passfds = _spawnv
+        try:
+            yield
+        finally:
+            util.spawnv_passfds = original
 
 
 class _MacOSPermissionSandboxedExecutor(_PermissionSandboxedExecutor):
@@ -386,8 +389,9 @@ _NOAH_CODEACT_INSTRUCTIONS = """## Noah CodeAct
 
 Work through tool calls; plain assistant prose cannot run code or end a turn.
 Use `execute_python(code)` for work and `return_result(...)` to finish. Python
-cell state persists. Parameters and `self` are preloaded; call async `self.*`
-tools with `await`. `self.message(text)` is synchronous—never await it.
+cell state persists. Parameters and `self` are preloaded. Every `self.ws.*`
+call is async: always `await` it before iterating or accessing the result.
+`self.message(text)` is synchronous—never await it.
 
 ### Tools
 
@@ -396,9 +400,10 @@ tools with `await`. `self.message(text)` is synchronous—never await it.
   three arguments; two-argument calls are invalid. Prefer one atomic
   `self.ws.apply_patch(changes)` for a
   coherent batch; `self.ws.apply_unified_diff` accepts git-style hunks.
-- Common shapes: `ws.search(pattern, path=".", paths=None, regex=True)` returns
-  iterable Matches plus `.stdout`; `ws.read(path, lines=None)` returns a Match
-  with `.text`/`.content`; `ws.list(pattern="**/*", path=".")` returns paths.
+- Common shapes: `await ws.search(pattern, path=".", paths=None, regex=True)`
+  returns iterable Matches plus `.stdout`; `await ws.read(path, lines=None)`
+  returns text with `.text`/`.content`; `lines=60` reads the first 60 lines;
+  `await ws.list(pattern="**/*", path=".")` returns paths.
 - Run commands with `await self.ws.run(command)` and inspect
   returncode/stdout/stderr. `read_only=True` skips approval only for commands
   the engine recognizes as read-only (Git inspection, search, listing, text

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/budget.py

@@ -83,6 +83,11 @@ class BudgetGuard:
         wall_elapsed = max(time.time() - self._started_wall, 0.0)
         return max(monotonic_elapsed, wall_elapsed)
 
+    def remaining_seconds(self) -> float | None:
+        if self._config.max_seconds is None:
+            return None
+        return max(self._config.max_seconds - self.elapsed_seconds(), 0.0)
+
     def add_usage(
         self,
         *,
@@ -257,28 +262,50 @@ class BudgetedLLM:
         if self._prefix_observer is not None:
             self._prefix_observer.observe_prefix(messages, route=route)
 
+    def _limit_timeout(self, kwargs: dict[str, Any]) -> None:
+        remaining = self._guard.remaining_seconds()
+        if remaining is not None:
+            configured_timeout = kwargs.get("timeout")
+            kwargs["timeout"] = (
+                min(configured_timeout, remaining)
+                if isinstance(configured_timeout, int | float)
+                else remaining
+            )
+
     async def acall(self, messages: list[dict], tools=None, output_model=None, **kwargs) -> Any:
         # Active caps serialize reservations across parent and subagent routes;
         # without this lane, concurrent calls can all pass the same preflight.
-        async with self._guard._async_provider_lock:
-            self._guard.enforce()
-            self._observe_prefix(messages, route=kwargs.get("prompt_cache_key"))
-            response = await self._inner.acall(
-                messages, tools=tools, output_model=output_model, **kwargs
-            )
-            prompt, completion, cost = _usage_from_response(response)
-            self._guard.add_usage(
-                prompt_tokens=prompt,
-                completion_tokens=completion,
-                cost_usd=cost,
-            )
+        self._guard.enforce()
+        try:
+            async with asyncio.timeout(self._guard.remaining_seconds()):
+                async with self._guard._async_provider_lock:
+                    self._guard.enforce()
+                    self._observe_prefix(messages, route=kwargs.get("prompt_cache_key"))
+                    # NOOA shields LiteLLM's provider task from cancellation.
+                    # Bound its own request timeout as well as our outer wait.
+                    self._limit_timeout(kwargs)
+                    response = await self._inner.acall(
+                        messages, tools=tools, output_model=output_model, **kwargs
+                    )
+                    prompt, completion, cost = _usage_from_response(response)
+                    self._guard.add_usage(
+                        prompt_tokens=prompt,
+                        completion_tokens=completion,
+                        cost_usd=cost,
+                    )
+                    self._guard.enforce()
+                    return response
+        except TimeoutError:
+            # Preserve a provider's own timeout unless the session deadline
+            # expired. A session timeout must surface as a sticky budget stop.
             self._guard.enforce()
-            return response
+            raise
 
     def call(self, messages: list[dict], tools=None, output_model=None, **kwargs) -> Any:
         with self._guard._provider_lock:
             self._guard.enforce()
             self._observe_prefix(messages, route=kwargs.get("prompt_cache_key"))
+            self._limit_timeout(kwargs)
             response = self._inner.call(
                 messages, tools=tools, output_model=output_model, **kwargs
             )

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/cli.py

@@ -146,7 +146,7 @@ def _configure_first_run_model(model_override: str | None) -> str | None:
         return selected
 
 
-@click.command("noah-code")
+@click.command("noah-code", context_settings={"help_option_names": ["-h", "--help"]})
 @click.version_option(__version__, prog_name="noah-code")
 @click.argument("path", required=False, type=click.Path())
 @click.option("--continue", "continue_session", is_flag=True, help="Resume latest session")
@@ -856,6 +856,7 @@ async def _prepare(
     store = SessionStore(config.session_dir)
 
     meta = None
+    launch_root = workspace.root
     try:
         if session_id:
             meta = store.load_meta(session_id)
@@ -866,11 +867,18 @@ async def _prepare(
                 click.echo("error: no prior session for this workspace", err=True)
                 return None, EXIT_CONFIG
             workspace = store.workspace_for_resume(meta, workspace)
-        if meta is not None and (model is not None or reasoning_effort is not None):
+        if workspace.root != launch_root:
+            config = load_config(
+                workspace.root,
+                cli_overrides={**overrides, "session_dir": store.session_dir},
+            )
+        if meta is not None and any(value is not None for value in (model, reasoning_effort, mode)):
             if model is not None:
                 meta.model = config.model
             if reasoning_effort is not None:
                 meta.reasoning_effort = config.reasoning_effort
+            if mode is not None:
+                meta.mode = config.mode
             store.save_meta(meta)
     except SessionError as exc:
         click.echo(f"error: {exc}", err=True)
@@ -894,7 +902,7 @@ async def _interactive(
     unsafe_inprocess_code_execution: bool,
 ) -> int:
     first_run = user_default_model() is None
-    if first_run and (model is not None or use_console):
+    if first_run and (model is not None or (use_console and not (continue_session or session_id))):
         try:
             model = _configure_first_run_model(model)
         except (OSError, ValueError) as exc:
@@ -922,7 +930,7 @@ async def _interactive(
         return code
     workspace, config, store, meta = prepared
     use_tui = config.ui.frontend == "tui" and not use_console
-    if first_run and model is None and not use_tui:
+    if first_run and model is None and not use_tui and meta is None:
         try:
             model = _configure_first_run_model(model)
         except (OSError, ValueError) as exc:
@@ -1038,6 +1046,9 @@ async def _run_session(
 
         click.echo(f"error: {safe_error_message(exc)}", err=True)
         return EXIT_AGENT
+    finally:
+        # Startup can fail before run_once reaches its own cleanup block.
+        await host.close()
 
 
 def main(argv: list[str] | None = None) -> None:

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/commands.py

@@ -324,7 +324,5 @@ def parse_slash(text: str) -> tuple[str, str] | None:
     body = stripped[1:]
     if not body:
         return None
-    if " " in body:
-        name, rest = body.split(" ", 1)
-        return name.lower(), rest.strip()
-    return body.lower(), ""
+    parts = body.split(maxsplit=1)
+    return parts[0].lower(), parts[1].strip() if len(parts) > 1 else ""

{noah_code-0.4.1 → noah_code-0.5.0}/src/noah_code/composer.py

@@ -20,7 +20,7 @@ IMAGE_TYPES = {
     ".bmp": "image/bmp",
 }
 
-_MENTION = re.compile(r"(?<![\w/])@([A-Za-z0-9_./-]+)")
+_MENTION = re.compile(r'(?<![\w/])@(?:"([^"\r\n]+)"|([A-Za-z0-9_./-]+))')
 _MAX_INLINE_CHARS = 8_000
 _MAX_FILES = 8
 
@@ -57,6 +57,8 @@ def _workspace_files(root: Path) -> list[Path]:
             path = Path(dirpath) / filename
             if not path.is_file() or is_secret_path(path):
                 continue
+            if path.is_symlink() and _resolve(root, str(path)) is None:
+                continue
             files.append(path)
     files.sort()
     _suggestion_cache[root] = (now, files)
@@ -67,25 +69,32 @@ def mention_suggestions(workspace: Path, prefix: str, *, limit: int = 8) -> list
     """Return workspace-relative paths matching a live ``@`` prefix."""
 
     raw = prefix.strip()
-    if not raw.startswith("@"):
+    if not raw.startswith("@") or limit <= 0:
         return []
-    query = raw[1:].lstrip("./")
+    query = raw[1:].removeprefix('"').removeprefix("./")
     if not query:
         return []
     root = workspace.resolve()
-    matches: list[str] = []
+    starts: list[str] = []
+    rest: list[str] = []
     for path in _workspace_files(root):
         try:
             relative = path.relative_to(root).as_posix()
         except ValueError:
             continue
-        if relative.startswith(query) or Path(relative).name.startswith(Path(query).name):
-            matches.append(relative)
-        if len(matches) >= limit:
+        if relative.startswith(query):
+            starts.append(relative)
+        elif len(rest) < limit and Path(relative).name.startswith(Path(query).name):
+            rest.append(relative)
+        if len(starts) >= limit:
             break
-    starts = [item for item in matches if item.startswith(query)]
-    rest = [item for item in matches if item not in starts]
-    return starts + rest
+    return (starts + rest)[:limit]
+
+
+def mention_text(path: str) -> str:
+    """Quote workspace paths that contain spaces or non-ASCII characters."""
+
+    return f"@{path}" if re.fullmatch(r"[A-Za-z0-9_./-]+", path) else f'@"{path}"'
 
 
 def expand_turn(
@@ -97,7 +106,7 @@ def expand_turn(
     """Inline ``@path`` text files and attach mentioned images via ``nooa.Image``."""
 
     root = workspace.resolve()
-    mentioned = [match.group(1) for match in _MENTION.finditer(text)]
+    mentioned = [match.group(1) or match.group(2) for match in _MENTION.finditer(text)]
     extras = [Path(path) for path in attach_paths or []]
     sections: list[str] = []
     images: list[Any] = []
@@ -105,6 +114,8 @@ def expand_turn(
     seen: set[str] = set()
 
     for raw in [*mentioned, *[str(path) for path in extras]]:
+        if len(paths) >= _MAX_FILES:
+            break
         resolved = _resolve(root, raw)
         if resolved is None:
             continue
@@ -121,12 +132,11 @@ def expand_turn(
             images.append(Image.from_file(resolved))
             sections.append(f"Attached image `{relative}`. Call `show(image)` on pending media.")
             continue
-        body = resolved.read_text(errors="replace")
+        with resolved.open(encoding="utf-8", errors="replace") as handle:
+            body = handle.read(_MAX_INLINE_CHARS + 1)
         if len(body) > _MAX_INLINE_CHARS:
             body = body[:_MAX_INLINE_CHARS] + "\n...(truncated)..."
         sections.append(f"### {relative}\n```\n{body}\n```")
-        if len(sections) >= _MAX_FILES:
-            break
 
     if not sections:
         return ExpandedTurn(text=text)
@@ -136,12 +146,12 @@ def expand_turn(
 
 def _resolve(root: Path, raw: str) -> Path | None:
     candidate = Path(raw).expanduser()
-    path = candidate if candidate.is_absolute() else (root / raw).resolve()
     try:
+        path = (candidate if candidate.is_absolute() else root / candidate).resolve()
         path.relative_to(root)
-    except ValueError:
+    except (OSError, RuntimeError, ValueError):
         return None
-    if not path.is_file() or is_secret_path(path):
+    if not path.is_file() or is_secret_path(candidate) or is_secret_path(path):
         return None
     return path