fix: validate paste markers by ID to prevent false positives

- hasActivePasteMarkers now checks validIds map, not just regex match
- deletePasteMarkerBackward/Forward only atomically delete real paste markers
- renderBufferWithCursor and renderFocusedText only highlight markers with valid IDs
- PASTE_MARKER_REGEX requires line/char suffix (no bare [paste #N])
- Fix empty buffer cursor rendering in renderFocusedText regression
- All render/test call sites updated to pass pastesRef.current

Author: jeoor

src/ui/PromptInput.tsx

@@ -188,7 +188,7 @@ export const PromptInput = React.memo(function PromptInput({
   const showMenu = slashMenu.length > 0;
   const promptHistoryKey = React.useMemo(() => promptHistory.join("\0"), [promptHistory]);
   const hasRunningProcess = runningProcesses && runningProcesses.size > 0;
-  const hasCollapsedMarkers = hasActivePasteMarkers(buffer.text);
+  const hasCollapsedMarkers = hasActivePasteMarkers(buffer.text, pastesRef.current);
   const hasExpandedRegions = expandedRegionsRef.current.size > 0;
   const processOrPasteHint = hasRunningProcess
     ? " · ctrl+o view output"
@@ -431,12 +431,12 @@ export const PromptInput = React.memo(function PromptInput({
       }
 
       if (key.delete) {
-        updateBuffer((s) => deletePasteMarkerForward(s) ?? deleteForward(s));
+        updateBuffer((s) => deletePasteMarkerForward(s, pastesRef.current) ?? deleteForward(s));
         return;
       }
 
       if (key.backspace) {
-        updateBuffer((s) => deletePasteMarkerBackward(s) ?? backspace(s));
+        updateBuffer((s) => deletePasteMarkerBackward(s, pastesRef.current) ?? backspace(s));
         return;
       }
 
@@ -872,7 +872,7 @@ export const PromptInput = React.memo(function PromptInput({
         borderDimColor
       >
         <PromptPrefixLine busy={busy} />
-        <Text>{renderBufferWithCursor(buffer, !disabled && hasTerminalFocus, placeholder)}</Text>
+        <Text>{renderBufferWithCursor(buffer, !disabled && hasTerminalFocus, placeholder, pastesRef.current)}</Text>
         {inlineHint ? <Text dimColor>{inlineHint}</Text> : null}
       </Box>
       <RawModelDropdown
@@ -986,9 +986,15 @@ export function getPromptReturnKeyAction(key: Pick<InputKey, "return" | "shift"
   return "submit";
 }
 
-export function renderBufferWithCursor(state: PromptBufferState, isFocused: boolean, placeholder?: string): string {
+export function renderBufferWithCursor(
+  state: PromptBufferState,
+  isFocused: boolean,
+  placeholder?: string,
+  validPastes?: Map<number, string>
+): string {
   const text = state.text || "";
   const cursor = Math.max(0, Math.min(state.cursor, text.length));
+  const validIds = validPastes ?? new Map<number, string>();
 
   if (text.length === 0 && placeholder) {
     if (!isFocused) {
@@ -997,26 +1003,27 @@ export function renderBufferWithCursor(state: PromptBufferState, isFocused: bool
     return renderCursorCell(" ") + chalk.dim(` ${placeholder}`);
   }
 
+  if (text.length === 0) {
+    return isFocused ? renderCursorCell(" ") : "";
+  }
+
   if (!isFocused) {
-    return highlightPasteMarkersInText(text);
+    return highlightPasteMarkersInText(text, validIds);
   }
 
-  // Focused: scan through the text, highlight paste markers, and insert
-  // the cursor cell at the correct position. This approach handles the
-  // case where the cursor sits at the start of (or inside) a paste marker.
-  return renderFocusedText(text, cursor);
+  return renderFocusedText(text, cursor, validIds);
 }
 
-/** Highlight paste markers in a plain string (no cursor). */
-function highlightPasteMarkersInText(s: string): string {
+function highlightPasteMarkersInText(s: string, validIds: Map<number, string>): string {
   if (!s.includes("[paste #")) return s;
   PASTE_MARKER_REGEX.lastIndex = 0;
   let result = "";
   let pos = 0;
   let match: RegExpExecArray | null;
   while ((match = PASTE_MARKER_REGEX.exec(s)) !== null) {
     result += s.slice(pos, match.index);
-    result += chalk.yellow(match[0]);
+    const id = Number.parseInt(match[1]!, 10);
+    result += validIds.has(id) ? chalk.yellow(match[0]) : match[0];
     pos = match.index + match[0].length;
   }
   result += s.slice(pos);
@@ -1029,7 +1036,7 @@ function highlightPasteMarkersInText(s: string): string {
  * anywhere (including inside or at the boundary of a paste marker) and the
  * marker will still be highlighted correctly.
  */
-function renderFocusedText(text: string, cursor: number): string {
+function renderFocusedText(text: string, cursor: number, validIds: Map<number, string>): string {
   let result = "";
   let pos = 0;
   PASTE_MARKER_REGEX.lastIndex = 0;
@@ -1038,14 +1045,15 @@ function renderFocusedText(text: string, cursor: number): string {
   while ((match = PASTE_MARKER_REGEX.exec(text)) !== null) {
     const markerStart = match.index;
     const markerEnd = match.index + match[0].length;
+    const id = Number.parseInt(match[1]!, 10);
+    const isReal = validIds.has(id);
 
     // 1. Non-marker segment before this marker.
     result += renderTextSegmentWithCursor(text, pos, markerStart, cursor, false);
     pos = markerStart;
 
-    // 2. Marker segment — highlighted with chalk.yellow.
-    //    The cursor may fall inside it.
-    result += renderTextSegmentWithCursor(text, pos, markerEnd, cursor, true);
+    // 2. Marker segment — highlighted only if it corresponds to a real paste.
+    result += renderTextSegmentWithCursor(text, pos, markerEnd, cursor, isReal);
     pos = markerEnd;
   }
 

src/ui/promptBuffer.ts

@@ -177,7 +177,7 @@ export function getCurrentSlashToken(state: PromptBufferState): string | null {
  * marker is inserted instead of the full content. The actual content is stored in a
  * Map and expanded back before submission.
  */
-export const PASTE_MARKER_REGEX = /\[paste #(\d+)( (\+?\d+ lines|\d+ chars))?\]/g;
+export const PASTE_MARKER_REGEX = /\[paste #(\d+) (\+?\d+ lines|\d+ chars)\]/g;
 
 /**
  * Find the paste marker that ends exactly at `state.cursor`, if any.
@@ -214,9 +214,16 @@ export function findPasteMarkerAt(state: PromptBufferState): { start: number; en
  * If the cursor is immediately after a paste marker, delete the entire marker
  * (atomic backspace). Returns the new state, or `state` unchanged if no marker.
  */
-export function deletePasteMarkerBackward(state: PromptBufferState): PromptBufferState | null {
+export function deletePasteMarkerBackward(
+  state: PromptBufferState,
+  validIds: Map<number, unknown>
+): PromptBufferState | null {
   const marker = findPasteMarkerBefore(state);
   if (!marker) return null;
+  // Only delete if this is a real paste marker (ID in validIds).
+  PASTE_MARKER_REGEX.lastIndex = 0;
+  const m = PASTE_MARKER_REGEX.exec(state.text.slice(marker.start, marker.end));
+  if (!m || !validIds.has(Number.parseInt(m[1]!, 10))) return null;
   const text = state.text.slice(0, marker.start) + state.text.slice(marker.end);
   return { text, cursor: marker.start };
 }
@@ -225,9 +232,16 @@ export function deletePasteMarkerBackward(state: PromptBufferState): PromptBuffe
  * If the cursor is at the start of a paste marker, delete the entire marker
  * (atomic forward delete). Returns the new state, or `state` unchanged if no marker.
  */
-export function deletePasteMarkerForward(state: PromptBufferState): PromptBufferState | null {
+export function deletePasteMarkerForward(
+  state: PromptBufferState,
+  validIds: Map<number, unknown>
+): PromptBufferState | null {
   const marker = findPasteMarkerAt(state);
   if (!marker) return null;
+  // Only delete if this is a real paste marker (ID in validIds).
+  PASTE_MARKER_REGEX.lastIndex = 0;
+  const m = PASTE_MARKER_REGEX.exec(state.text.slice(marker.start, marker.end));
+  if (!m || !validIds.has(Number.parseInt(m[1]!, 10))) return null;
   const text = state.text.slice(0, marker.start) + state.text.slice(marker.end);
   return { text, cursor: marker.start };
 }
@@ -252,7 +266,7 @@ export function expandPasteMarkers(text: string, pastes: Map<number, string>): s
   if (pastes.size === 0) return text;
   let result = text;
   for (const [pasteId, pasteContent] of pastes) {
-    const markerRegex = new RegExp(`\\[paste #${pasteId}( (\\+?\\d+ lines|\\d+ chars))?\\]`, "g");
+    const markerRegex = new RegExp(`\\[paste #${pasteId} (\\+?\\d+ lines|\\d+ chars)\\]`, "g");
     result = result.replace(markerRegex, () => cleanPasteContent(pasteContent));
   }
   return result;
@@ -278,11 +292,18 @@ export function findPasteMarkerContaining(state: PromptBufferState): { start: nu
 }
 
 /**
- * Check whether the given text contains any paste markers.
+ * Check whether the text contains real paste markers (IDs present in validIds).
  */
-export function hasActivePasteMarkers(text: string): boolean {
+export function hasActivePasteMarkers(text: string, validIds: Map<number, unknown>): boolean {
+  if (!text.includes("[paste #")) return false;
   PASTE_MARKER_REGEX.lastIndex = 0;
-  return PASTE_MARKER_REGEX.test(text);
+  let match: RegExpExecArray | null;
+  while ((match = PASTE_MARKER_REGEX.exec(text)) !== null) {
+    if (validIds.has(Number.parseInt(match[1]!, 10))) {
+      return true;
+    }
+  }
+  return false;
 }
 
 function locate(state: PromptBufferState): {