Native Markdown/text experience: reader, lightweight editor and optional providers #402

Goal

Design and deliver an NMSh-native Markdown/text reading experience, then optionally a small, safe text editor and a unified registry of external viewer/editor providers. Keep normal shell commands (vim, nvim, less, bat, glow, micro, etc.) untouched. The native viewer should make files, documentation, logs and completed command output comfortable to inspect without requiring another tool; external editors remain first-class.

This issue is a phased cross-feature tracker / design gate, distinct from the focused read-only #397 and existing integration audit #366. It does not authorize an editor implementation in the current post-v0.20 onboarding branch. #397 owns viewer implementation specifics; #366 owns integration audit/optional handoffs. Use this issue for UX/architecture, cross-phase decisions and native editing once separately approved.

Confirmed NMSh baseline

• src/markdown/{blocks,inline,highlight,render}.ts already renders NMSh-owned and some untrusted Markdown into theme-aware ANSI rows, with sanitization, bounded parsing and safe link treatment. Audit coverage/CommonMark expectations and reuse this engine before introducing a second renderer.
• /open path[:line[:col]] already bridges source references to host editors. Native transcript navigation, search, Copy, output folding, activity histories and HistoryViewport already exist; reuse them where appropriate.
• /tools includes Glow in the curated catalog; external less, bat, editors and other host integrations remain supported.
• Existing scope links: #397 Native /view, #366 editor/pager providers, #168 Markdown help (closed), #335 semantic keymap.

External open-source references (audit features AND licenses first)

Never import code verbatim merely because a project is open source. Record exact revision, attribution and redistribution implications for any code reuse.

Phase 0: baseline and design gate

• Read the current renderer, parser, pager, source-opening and queue/transcript ownership code; document existing coverage, limitations and the genuine UX gaps.
• Show clear production-renderer concepts for Markdown, plaintext, source code, a diff, 450-line output and a 10,000-line log, at narrow/standard/wide widths.
• Make one document/read-only viewing abstraction; no new authoritative PTY output buffer or duplicate transcript journal.
• Specify memory/IO budgets suitable for an 8 GB Mac; streaming/virtualization for large files, bounded decoding, follow mode only by explicit request.
• Define focus ownership and keyboard rules, viewer/editor accessibility, resize, mouse, alternate-screen/fullscreen handoffs, permissions and data-security boundaries.

Phase 1: native viewer (owned by #397)

• Proposed /view file.md, /view file.log, /view chooser, Actions → View output; auto-detect Markdown only for explicit file/doc metadata, with easy Rendered / Source toggle and raw text always available.
• Readable headings, code blocks with existing syntax roles, GFM lists/tasks/tables, quotes, horizontal rules and safe hyperlink actions; distinguish unsupported Markdown syntax rather than silently mangling it.
• Navigation: Up/Down, PageUp/Down, Home/End, g go to line, / search, wrap/horizontal-scroll mode, line numbers, marks where useful, copy selection/code/full source, active path/position/status.
• Reuse current theme (including future Expand bundled theme catalog: Ayu, Kanagawa, Everforest, Flexoki, Material & more #401 families), NO_COLOR, Safe glyph, 16/256/truecolor fallback. No giant autoplay demo or intrusive chrome.
• Files, stdin/pipes and completed outputs have explicit source/retention limits. Arbitrary shell output is never implicitly Markdown. The raw bytes remain authoritative for Copy/export/exit codes/history.
• Never execute inspected contents, follow suspicious links automatically, transmit file contents, mutate files merely to preview, or circumvent OS permissions. Safely handle symlink traversal, control/OSC escapes, unicode/bidi, binaries, huge lines and truncated output.

Phase 2: provider experience (coordinated with #366)

• Add one consistent View / Edit with… action and explicit provider choice. Native viewer is the preferred read-only experience where supported; keep less, Glow, bat, ov, and host editors selectable and absent-dependency-safe.
• Editors default to respecting user $VISUAL/$EDITOR or explicit saved choice; the native editor is opt-in until it passes a separate review. Never auto-install a provider or override shell aliases.
• Example proposed intents, not already shipped: /view --provider glow README.md, /edit --provider nvim note.md, /edit note.md. Define/validate actual CLI syntax and supported provider capabilities before implementation.
• External TUI provider runs through existing PTY/passthrough and returns correctly after exit; GUI editor through existing reviewed open integration. Never intercept normal vim file, less file or nvim file commands.
• Resolve filesystem paths/line/column arguments with explicit argv, no shell-string interpolation; support whitespace/unicode, working directory and return focus/terminal modes after failures.

Phase 3: native small text editor (requires separate implementation approval)

• Decide if a native editor adds enough everyday value beyond Native read-only /view: files, logs, output and document previews #397 and existing external editors; if so start only with single-file plain-text/Markdown note edits, source/rendered preview, familiar shortcuts and explicit open/save.
• Core behavior: insert/delete, select, undo/redo, find/replace, Ctrl+S, dirty state, unsaved-exit prompt, line endings/encoding preservation and safe atomic saves with conflict detection; no automatic modification of source files.
• Avoid an IDE, LSP, project-wide editing, multi-cursor, embedded shell, plugin ecosystem or full Vim emulation. Esc/focus/input ownership cannot steal keys from the normal shell.
• Binary/huge/read-only/permission-restricted files refuse editing clearly and offer read-only or external fallback; backups/collision/permissions/symlinks are explicitly defined and tested.
• Reuse the existing shared input editor primitives where they truly apply, without coupling shell command history to document editing.

Verification and deliverables

• Test-first implementation slices with exact regression evidence, malformed/untrusted Markdown and hostile text tests, enormous files, invalid UTF-8, symlink races, clipboard privacy, atomic-save failures, undo correctness and safe PTY handoff.
• Production renderer captures at 32/50/80/132 columns, NO_COLOR and glyph fallbacks, responsive layout and light/dark themes.
• Physical Ghostty and Terminal.app validation, Linux portability and benchmarks for large files and memory usage.
• Update relevant docs/README and provide a clear native-vs-external feature/capability matrix.
• Keep work on an isolated future feature branch; all scratch/cache/build/test artifacts on the verified external T7, fail closed. No merge, tag, version bump or release without explicit maintainer approval.
• Coordinate with Native read-only /view: files, logs, output and document previews #397 and Workflow integrations: external editors, search, preview tools and shell utilities #366 instead of duplicating owners or building a second UI/runtime stack.

No part of this issue should interrupt the ongoing onboarding physical-QA redesign or the current queue/history bugfix.