Guard the @-mention lookup against a shell disposed mid-flight

Quitting while an @-mention filesystem lookup is in flight let the
resolved promise write suggestions into a torn-down shell, touching
the freed renderer/TextBuffer. Check shell.disposed after each await
in openAtMentionSuggestions and bail before any further write.

Author: TheGreatAxios

src/tui-opentui/mention-popup.test.ts

@@ -123,6 +123,39 @@ describe("@ popup narrows as you type", () => {
     })
   })
 
+  test("quitting mid-lookup does not write into the disposed shell", async () => {
+    await withTestRenderer(
+      async (h) => {
+        const shell = createAppShell(h.renderer, {
+          terminal: { columns: 80, rows: 24 },
+          wireKeys: false,
+          run: "idle",
+        })
+        let resolveLookup: (entries: readonly string[]) => void = () => {}
+        setMentionSuggestionSource(
+          shell,
+          () =>
+            new Promise<readonly string[]>((resolve) => {
+              resolveLookup = resolve
+            }),
+        )
+
+        shell.prompt.value = "read @"
+        shell.prompt.cursorOffset = shell.prompt.value.length
+        const pending = openAtMentionSuggestions(shell)
+
+        // The operator quits before the filesystem lookup answers.
+        shell.dispose()
+        resolveLookup(["AGENTS.md", "README.md"])
+
+        await expect(pending).resolves.toBe(false)
+        expect(shell.overlayKind).toBeNull()
+        expect(isMentionPopupOpen(shell)).toBe(false)
+      },
+      { width: 80, height: 24 },
+    )
+  })
+
   test("no match closes the popup and leaves the typed text", async () => {
     await withShell(async (shell) => {
       await openAt(shell, "@")

src/tui-opentui/shell.ts

@@ -3931,11 +3931,15 @@ export async function openAtMentionSuggestions(shell: AppShell): Promise<boolean
     await source(token.dir),
     token.fragment,
   )
+  // Quitting mid-lookup tears down the renderer/TextBuffer this function
+  // writes into below; a resolved-but-stale lookup must not touch them.
+  if (shell.disposed) return false
   // The source caps how many entries it returns per directory, so a large
   // directory can cap out before the interior match appears. Asking it to do
   // its own prefix filter puts that cap after the narrowing instead of before.
   if (suggestions.length === 0 && token.fragment.length > 0) {
     suggestions = await source(at.prefix)
+    if (shell.disposed) return false
   }
   if (mentionGenerations.get(shell) !== generation) return false