Summary

Two related fixes for the TUI markdown renderer, both rooted in "what shouldn't be markdown".

1. Intraword underscores stay literal

Md's INLINE_RE matched _..._ and __...__ with no word-boundary guard, so paths and snake_case identifiers rendered mid-italic/bold. Example: browser_screenshot_ecc1c3feab.png showed _screenshot_ italicized mid-path.

Gated _ / __ emphasis with (?<!\w) / (?!\w) on both the render regex and the table-width stripInlineMarkup. * / ** intentionally keep intraword behavior — that's CommonMark-legal and rarely wrong in practice.

2. Protocol sentinels get clean handling

The agent emits MEDIA:<path> to tell the gateway to deliver a file, and [[audio_as_voice]] to request voice-message delivery. The gateway strips both (_clean_for_display in stream_consumer.py), but the TUI was passing them through markdown — which is where the original bug showed up.

At the Md layer:

• MEDIA:<path> on its own line → ▸ <path> (dim triangle, amber underlined, literal path) wrapped in Link for OSC 8 hyperlink support (absolute paths get file:// so modern terminals make them clickable).
• [[audio_as_voice]] → dropped; it has no meaning in TUI.

Mid-prose MEDIA: tokens (rare) are intentionally left untouched and rely on the intraword-underscore guard to stay literal.

Test plan

• npm test in ui-tui/ — 109/109 passing, 7 new cases in markdown.test.ts.
• tsc --noEmit clean.
• eslint clean on touched files.

Before

browser_screenshot_ecc1c3feab.png   → browser<i>screenshot</i>ecc1c3feab.png
MEDIA:/tmp/x.png                    → rendered as prose
[[audio_as_voice]]                  → rendered as prose

After

browser_screenshot_ecc1c3feab.png   → literal
MEDIA:/tmp/x.png                    → ▸ /tmp/x.png  (clickable, no markdown)
[[audio_as_voice]]                  → hidden
_italic_ / __bold__                 → still work
snake_case_var / foo__bar__baz      → literal

Why not generic path-detection?

Punting on speculative "detect anything code-like and skip markdown" — heuristic explosion, false positives on prose (use the /api/users endpoint rendering monospaced), and the real offender was the CommonMark intraword rule plus two well-defined protocol sentinels. Targeted beats clever.