fix(tui): keep retry off cancel queue and sanitize lists

/retry and alt+r queued during cancelling, bypassing the enter
guard. Management drawer lists and the model catalog painted
raw wire fields.

Co-authored-by: admin <admin@21no.de>

Author: cursoragent

internal/tui/input.go

@@ -347,6 +347,9 @@ func (m *Model) retryLast() tea.Cmd {
 		return m.transientNoteCmd("nothing to retry yet — send a prompt first")
 	}
 	if m.busy {
+		if m.status == "cancelling" {
+			return m.transientNoteCmd("cancelling — retry stays off the queue")
+		}
 		m.queue = append(m.queue, m.lastPrompt)
 		return m.transientNoteCmd("retry queued — it sends when the turn ends")
 	}

internal/tui/mgmt.go

@@ -452,7 +452,7 @@ func (m *Model) memRowsRender(w int) []string {
 	th := m.th
 	rows := make([]string, 0, len(m.memRows))
 	for i, r := range m.memRows {
-		label := r.text
+		label := collapse(r.text)
 		detail := "  fact · " + r.kind
 		if r.kind == "episode" {
 			detail = "  ⏳ pending episode · " + shortID(r.sessionID)
@@ -482,11 +482,12 @@ func (m *Model) skillRowsRender(w int) []string {
 		if s.Untrusted {
 			badges += "  ⚠ untrusted"
 		}
-		detail := fmt.Sprintf("  ×%d · %s", s.UsageCount, s.Source) + badges
+		detail := fmt.Sprintf("  ×%d · %s", s.UsageCount, collapse(s.Source)) + badges
 		budget := w - 2 - lipgloss.Width(detail)
-		prefix, lab := "  ", th.acItem.Render(truncate(s.Name, budget))
+		name := collapse(s.Name)
+		prefix, lab := "  ", th.acItem.Render(truncate(name, budget))
 		if i == m.panelSel {
-			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(s.Name, budget))
+			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(name, budget))
 		}
 		rows = append(rows, prefix+lab+th.acDetail.Render(detail))
 		// A dim description line under each name: the list stays scannable
@@ -502,14 +503,16 @@ func (m *Model) toolRowsRender(w int) []string {
 	th := m.th
 	rows := make([]string, 0, len(m.toolRows))
 	for i, r := range m.toolRows {
-		detail := "  " + r.dim
+		dim := collapse(r.dim)
+		text := collapse(r.text)
+		detail := "  " + dim
 		if r.kind == "mcp" {
-			detail = "  mcp · " + r.dim
+			detail = "  mcp · " + dim
 		}
 		budget := w - 2 - lipgloss.Width(detail)
-		prefix, lab := "  ", th.acItem.Render(truncate(r.text, budget))
+		prefix, lab := "  ", th.acItem.Render(truncate(text, budget))
 		if i == m.panelSel {
-			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(r.text, budget))
+			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(text, budget))
 		}
 		rows = append(rows, prefix+lab+th.acDetail.Render(detail))
 	}
@@ -520,14 +523,15 @@ func (m *Model) cfgRowsRender(w int) []string {
 	th := m.th
 	rows := make([]string, 0, len(m.cfgRows))
 	for i, r := range m.cfgRows {
-		detail := "  " + r.v
+		k := collapse(r.k)
+		detail := "  " + collapse(r.v)
 		if r.kind == "conn" {
 			detail += "  · d kicks"
 		}
 		budget := w - 2 - lipgloss.Width(detail)
-		prefix, lab := "  ", th.acItem.Render(truncate(r.k, budget))
+		prefix, lab := "  ", th.acItem.Render(truncate(k, budget))
 		if i == m.panelSel {
-			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(r.k, budget))
+			prefix, lab = th.acSel.Render("› "), th.acSel.Render(truncate(k, budget))
 		}
 		rows = append(rows, prefix+lab+th.acDetail.Render(detail))
 	}
@@ -597,7 +601,7 @@ func (m *Model) agentRowsRender(w int) []string {
 	th := m.th
 	rows := make([]string, 0, len(m.agentsReg))
 	for i, e := range m.agentsReg {
-		goal := e.Goal
+		goal := collapse(e.Goal)
 		if goal == "" {
 			goal = "(no goal recorded)"
 		}
@@ -609,9 +613,9 @@ func (m *Model) agentRowsRender(w int) []string {
 		}
 		var detail string
 		if e.Phase == "finished" {
-			detail = fmt.Sprintf("  %s · %d it · %s tok", e.Status, e.Iterations, human(e.TokensUsed))
+			detail = fmt.Sprintf("  %s · %d it · %s tok", collapse(e.Status), e.Iterations, human(e.TokensUsed))
 		} else {
-			tool := e.LastTool
+			tool := collapse(e.LastTool)
 			if tool == "" && e.Step > 0 {
 				tool = fmt.Sprintf("step %d", e.Step)
 			}

internal/tui/panels.go

@@ -622,12 +622,13 @@ type modelEntry struct {
 func (m *Model) modelEntries() []modelEntry {
 	out := make([]modelEntry, 0, len(m.models))
 	for _, md := range m.models {
-		e := modelEntry{id: md.ID, label: md.ID, current: md.Current}
+		id := collapse(md.ID)
+		e := modelEntry{id: id, label: id, current: md.Current}
 		if md.MaxContext > 0 {
 			e.detail = fmt.Sprintf("%s ctx", humanCtx(md.MaxContext))
 		}
 		if md.Description != "" {
-			e.detail = strings.TrimSpace(md.Description + "  " + e.detail)
+			e.detail = strings.TrimSpace(collapse(md.Description) + "  " + e.detail)
 		}
 		out = append(out, e)
 	}

internal/tui/promptflow_test.go

@@ -701,3 +701,33 @@ func TestCancelApprovalDoesNotClobberCancelling(t *testing.T) {
 		}
 	})
 }
+
+// /retry and alt+r still queue while cancelling — they skip submit()'s
+// enter guard and retryLast only checks busy.
+func TestRetryDuringCancelDoesNotQueue(t *testing.T) {
+	m := newTestModel()
+	busyTurn(m)
+	m.sessionID = "s1"
+	m.lastPrompt = "first"
+	m.queue = []string{"held"}
+	m.cancelRun()
+	if m.status != "cancelling" {
+		t.Fatalf("precondition: status = %q", m.status)
+	}
+
+	m.retryLast()
+	if len(m.queue) != 0 {
+		t.Fatalf("retryLast while cancelling queued: %v", m.queue)
+	}
+
+	m.Update(key("alt+r"))
+	if len(m.queue) != 0 {
+		t.Fatalf("alt+r while cancelling queued: %v", m.queue)
+	}
+
+	m.ta.SetValue("/retry")
+	m.submit()
+	if len(m.queue) != 0 {
+		t.Fatalf("/retry while cancelling queued: %v", m.queue)
+	}
+}

internal/tui/w1_hardening_test.go

@@ -264,6 +264,73 @@ func TestEngineNoticesCollapseNewlines(t *testing.T) {
 	}
 }
 
+// Management drawer list rows paint API/wire strings. CSI in a skill name,
+// fact, MCP command, or agent goal must not reach the terminal.
+func TestMgmtListRowsSanitizeWireFields(t *testing.T) {
+	const payload = "\x1b[2J"
+	hasCSI := func(rows []string) bool {
+		return strings.Contains(strings.Join(rows, "\n"), payload)
+	}
+
+	t.Run("skills", func(t *testing.T) {
+		m := newTestModel()
+		m.skills = []client.Skill{{Name: "x" + payload + "evil", Source: "y" + payload}}
+		if hasCSI(m.skillRowsRender(80)) {
+			t.Error("skill list leaked CSI")
+		}
+	})
+	t.Run("memory", func(t *testing.T) {
+		m := newTestModel()
+		m.memRows = []memRow{{kind: "user", text: "x" + payload + "evil"}}
+		if hasCSI(m.memRowsRender(80)) {
+			t.Error("memory list leaked CSI")
+		}
+	})
+	t.Run("tools", func(t *testing.T) {
+		m := newTestModel()
+		m.toolRows = []toolRow{{kind: "mcp", text: "x" + payload, dim: "y" + payload}}
+		if hasCSI(m.toolRowsRender(80)) {
+			t.Error("tools list leaked CSI")
+		}
+	})
+	t.Run("config", func(t *testing.T) {
+		m := newTestModel()
+		m.cfgRows = []cfgRow{{kind: "cfg", k: "x" + payload, v: "y" + payload}}
+		if hasCSI(m.cfgRowsRender(80)) {
+			t.Error("config list leaked CSI")
+		}
+	})
+	t.Run("agents", func(t *testing.T) {
+		m := newTestModel()
+		m.agentsReg = []client.SubagentEntry{{Goal: "x" + payload, LastTool: "y" + payload, Phase: "running"}}
+		if hasCSI(m.agentRowsRender(80)) {
+			t.Error("agents list leaked CSI")
+		}
+	})
+}
+
+// The models picker and palette still paint catalog ID/description raw
+// (v1.4.5 only collapsed the header / applyModelChoice store).
+func TestModelCatalogSanitizesPickerAndPalette(t *testing.T) {
+	const payload = "\x1b[2J"
+	m := newTestModel()
+	m.models = []client.ModelInfo{{ID: "x" + payload + "evil", Description: "y" + payload}}
+
+	if strings.Contains(strings.Join(m.modelRows(80), "\n"), payload) {
+		t.Error("model picker leaked CSI")
+	}
+
+	m.togglePalette()
+	for _, e := range m.pal.all {
+		if e.kind != "model" {
+			continue
+		}
+		if strings.Contains(e.title, payload) {
+			t.Errorf("palette model title leaked CSI: %q", e.title)
+		}
+	}
+}
+
 // The conversation is the click/scroll hit-test source of truth: a line that
 // physically wraps desyncs every index below it. Every emitted line must fit
 // the viewport.