Version / branch / commit
Audited on main at 903e3d13 (2026-08-23).
Problem
Live dictation anchors its region on the full composer text but later compares and slices only the prefix before regionStart. When the caret is inside existing text, the external-delete adjustment can make regionStart negative. The next partial transcript slices []rune(text)[:regionStart] and panics.
Reproduction
- Put
hello world in the composer.
- Move the caret to column 5, after
hello.
- Start live dictation and receive successive partial updates.
The first update can compute anchor = "hello world", prefix = "hello", and delta = 6, moving regionStart from 5 to -1. A subsequent partial slices with the negative index.
Expected behavior
Dictation updates remain bounded to a valid composer range regardless of caret position or concurrent typing/deletion.
Actual behavior
A negative slice index panics the TUI process and can lose the in-flight run.
Relevant code
internal/tui/dictation_stream.go:103,115,120-132
This is related to #936's voice-mode/typing collision but distinct: #936 concerns swallowed spaces and stray transcription, while this issue is a negative-index process crash.
Suggested fix
Clamp and validate regionStart and regionEnd before every read and slice, then add a regression test with the caret in the middle of existing text and at least two partial updates.
Version / branch / commit
Audited on
mainat903e3d13(2026-08-23).Problem
Live dictation anchors its region on the full composer text but later compares and slices only the prefix before
regionStart. When the caret is inside existing text, the external-delete adjustment can makeregionStartnegative. The next partial transcript slices[]rune(text)[:regionStart]and panics.Reproduction
hello worldin the composer.hello.The first update can compute
anchor = "hello world",prefix = "hello", anddelta = 6, movingregionStartfrom 5 to -1. A subsequent partial slices with the negative index.Expected behavior
Dictation updates remain bounded to a valid composer range regardless of caret position or concurrent typing/deletion.
Actual behavior
A negative slice index panics the TUI process and can lose the in-flight run.
Relevant code
internal/tui/dictation_stream.go:103,115,120-132This is related to #936's voice-mode/typing collision but distinct: #936 concerns swallowed spaces and stray transcription, while this issue is a negative-index process crash.
Suggested fix
Clamp and validate
regionStartandregionEndbefore every read and slice, then add a regression test with the caret in the middle of existing text and at least two partial updates.