@dylanpiercey/work 0.0.221 → 0.0.223

package/dist/{_-MXZhaOD.js → _CpANOzpd.js}

@@ -4,11 +4,22 @@ import { t as require_safe_buffer } from "./_BmSjjJ2E.js";
 import fs from "node:fs";
 import path from "node:path";
 import { execFile, execFileSync } from "node:child_process";
+import fs$1 from "node:fs/promises";
 import os from "node:os";
 import { promisify } from "node:util";
 import { DatabaseSync } from "node:sqlite";
 import { createHash } from "node:crypto";
 //#region src/server/http.ts
+/** Who may frame the app's own responses: the app alone (the review's PDF
+* preview). A page elsewhere that frames it can dress a click on it as a
+* click on something of its own. A route that sends a
+* Content-Security-Policy of its own replaces this one, so it names
+* `FRAME_ANCESTORS` too. */
+var FRAME_ANCESTORS = "frame-ancestors 'self'";
+var FRAME_HEADERS = {
+	"content-security-policy": FRAME_ANCESTORS,
+	"x-frame-options": "SAMEORIGIN"
+};
 /** Error whose `status` the API error-boundary middleware uses for the response. */
 function httpError(status, message) {
 	return Object.assign(new Error(message), { status });
@@ -25,6 +36,96 @@ async function readBody(ctx) {
 	return checked(await ctx.body, "request body");
 }
 //#endregion
+//#region src/server/cache.ts
+/** Keyed stale-while-revalidate cache: a cached value is served immediately
+* (revalidating in the background when older than `ttlMs`); loads are deduped
+* per key, and `refresh` bypasses both the cache and any in-flight load. */
+function swr(ttlMs, load, seed) {
+	const cache = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
+	function start(key, refresh) {
+		const startedAt = Date.now();
+		const promise = load(key, refresh).then((value) => {
+			const existing = cache.get(key);
+			if (!existing || existing.at <= startedAt) cache.set(key, {
+				at: Date.now(),
+				value
+			});
+			return value;
+		}).finally(() => {
+			if (inflight.get(key)?.promise === promise) inflight.delete(key);
+		});
+		inflight.set(key, {
+			promise,
+			refresh
+		});
+		return promise;
+	}
+	const read = (key, refresh = false) => {
+		if (refresh) {
+			const current = inflight.get(key);
+			return current?.refresh ? current.promise : start(key, true);
+		}
+		let cached = cache.get(key);
+		if (!cached && seed) {
+			cached = seed(key);
+			if (cached) cache.set(key, cached);
+		}
+		if (cached) {
+			if (Date.now() - cached.at >= ttlMs && !inflight.has(key)) start(key, false).catch(() => {});
+			return Promise.resolve(cached.value);
+		}
+		return inflight.get(key)?.promise ?? start(key, false);
+	};
+	/** Inject an externally fetched value (e.g. from a batched load). */
+	read.set = (key, value) => {
+		cache.set(key, {
+			at: Date.now(),
+			value
+		});
+	};
+	/** Current cached value, if any — used when a batch update must merge
+	* with a richer per-key load rather than replace it. */
+	read.get = (key) => cache.get(key)?.value;
+	return read;
+}
+/** Serialize async work per key: calls for one key run in submission order,
+* each starting only after the previous settled. The stored tail is the
+* all-settled form, so a rejection neither blocks the next caller nor leaves
+* the entry behind — the map holds only keys with work still in flight. */
+var locks = /* @__PURE__ */ new Map();
+function withLock(key, fn) {
+	const run = (locks.get(key) ?? Promise.resolve()).then(fn);
+	const tail = run.then(() => {}, () => {});
+	locks.set(key, tail);
+	tail.then(() => {
+		if (locks.get(key) === tail) locks.delete(key);
+	});
+	return run;
+}
+/** One load at a time, and a short reuse window: callers join the in-flight
+* load, and a result younger than `ttlMs` is served without one. For an
+* expensive process sweep (lsof, ps, list-panes) whose answer does not
+* change within the window — `ttlMs` of 0 still collapses concurrent
+* callers onto a single spawn. */
+function shared(fn, ttlMs) {
+	let inflight = null;
+	let last = null;
+	return () => {
+		if (last && Date.now() - last.at < ttlMs) return Promise.resolve(last.value);
+		if (!inflight) inflight = fn().then((value) => {
+			last = {
+				at: Date.now(),
+				value
+			};
+			return value;
+		}).finally(() => {
+			inflight = null;
+		});
+		return inflight;
+	};
+}
+//#endregion
 //#region lib/setup/listen.mjs
 /** Addresses that mean every interface. */
 var EVERY = /* @__PURE__ */ new Set([
@@ -66,8 +167,9 @@ var config = {
 	appPort: Number(process.env.WORK_APP_PORT || 7171),
 	/** How a workspace port is named in a hostname the app proxies
 	* (server/port-proxy.ts): `sub` is `3000.work.example.com`, `dash` is
-	* `3000-work.example.com`. The server accepts both; this only picks
-	* which one the port chips link to. `dash` stays one label under the
+	* `3000-work.example.com`. The port chips link to this one; the server
+	* takes `sub` either way, and `dash` only when it is picked
+	* (server/access.ts `dashPortName`). `dash` stays one label under the
 	* zone, which is what a free Cloudflare certificate covers. */
 	portHosts: process.env.WORK_PORT_HOSTS === "dash" ? "dash" : "sub",
 	/** The address the server listens on: this machine only, unless set
@@ -92,6 +194,11 @@ function list(value) {
 	return (value || "").split(",").map((s) => s.trim()).filter(Boolean);
 }
 fs.mkdirSync(config.dataDir, { recursive: true });
+try {
+	fs.chmodSync(config.dataDir, 448);
+} catch (err) {
+	console.warn(`[work] could not make ${config.dataDir} private: ${err.message}`);
+}
 //#endregion
 //#region src/server/exec.ts
 /** Dedicated tmux server so we never touch another multiplexer's or the
@@ -131,21 +238,25 @@ var GIT_NETWORK_MS = {
 	push: 3e5,
 	"ls-remote": 6e4
 };
-/** Never let git wait on a terminal it doesn't have — a missing credential
-* fails with a message instead of hanging the clone forever. Optional
-* locks are off because most of what runs here is a background probe (the
-* review's stamp poll, Files, the language servers' change feed): a
-* `git status` refreshing the index holds `index.lock`, and an agent's
-* `git commit` or rebase step landing in that moment fails on it. */
+/** What every git process work starts runs with, `extra` on top: `git`
+* below, and the diff's streaming reads, which spawn their own. Never let
+* git wait on a terminal it doesn't have — a missing credential fails with
+* a message instead of hanging the clone forever. Optional locks are off
+* because most of what runs here is a background probe (the review's
+* stamp poll, Files, the language servers' change feed): a `git status`
+* refreshing the index holds `index.lock`, and an agent's `git commit` or
+* rebase step landing in that moment fails on it. */
+var gitEnv = (extra) => ({
+	...process.env,
+	GIT_TERMINAL_PROMPT: "0",
+	GIT_OPTIONAL_LOCKS: "0",
+	...extra
+});
 var git = async (args, cwd) => {
 	const verb = args.find((a) => !a.startsWith("-")) ?? "";
 	const timeoutMs = GIT_NETWORK_MS[verb];
 	try {
-		return await run$1("git", args, cwd, {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0",
-			GIT_OPTIONAL_LOCKS: "0"
-		}, timeoutMs ? { timeoutMs } : void 0);
+		return await run$1("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
 	} catch (err) {
 		if (timeoutMs && err.killed) throw new Error(`git ${verb} timed out after ${Math.round(timeoutMs / 1e3)}s`);
 		throw err;
@@ -229,6 +340,7 @@ function get(sql, ...params) {
 function workspacePath(id) {
 	return get("SELECT path FROM workspaces WHERE id = ?", id)?.path;
 }
+var fresh = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
 var freshReview = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'review_comments'").get();
 db.exec(`
   PRAGMA journal_mode = WAL;
@@ -290,8 +402,7 @@ db.exec(`
   );
 
   -- Viewed marks (server/viewed.ts): a file of a branch, and its change
-  -- as it was when marked. Keep in sync with scripts/migrate.mjs, which
-  -- creates it too.
+  -- as it was when marked.
   CREATE TABLE IF NOT EXISTS review_marks (
     workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
     worktree TEXT NOT NULL,
@@ -313,6 +424,7 @@ ensureColumn("review_comments", "snippet", "TEXT");
 ensureColumn("workspaces", "materialized", "INTEGER NOT NULL DEFAULT 1");
 ensureColumn("workspaces", "origin_branch", "TEXT");
 ensureColumn("workspaces", "imported_at", "TEXT");
+if (fresh) db.exec("PRAGMA user_version = 1");
 //#endregion
 //#region src/client/pref-change.ts
 /** The stored text after `change`, or null when nothing is left. A value
@@ -476,10 +588,13 @@ var agents_default = [
 ];
 //#endregion
 //#region lib/setup/catalog.mjs
-/** Machine tools. `required` ones gate readiness; the rest are the utilities
-* agents reach for constantly (search, JSON, HTTP, process tools). Static
-* binaries via mise, except the system packages the installer provides
-* (git, tmux). */
+/** Machine tools. `required` ones gate readiness; the rest are what agents
+* reach for on any project, and what work's own features run on — measured
+* over agents' shell commands, `rg` is a fifth of Codex's (Claude Code
+* bundles its own) and `jq` common to both, where the terminal niceties
+* once listed here (fd, delta, fzf, bottom, hyperfine, ast-grep) went all
+* but unused. `work setup` installs every one. Static binaries via mise,
+* except the system packages the installer provides (git, tmux). */
 var TOOLS = [
 	{
 		id: "git",
@@ -521,12 +636,6 @@ var TOOLS = [
 		bin: "rg",
 		mise: "ripgrep"
 	},
-	{
-		id: "fd",
-		label: "fd",
-		bin: "fd",
-		mise: "fd"
-	},
 	{
 		id: "jq",
 		label: "jq",
@@ -534,46 +643,104 @@ var TOOLS = [
 		mise: "jq"
 	},
 	{
-		id: "delta",
-		label: "delta",
-		bin: "delta",
-		mise: "delta"
+		id: "skills",
+		label: "skills CLI",
+		bin: "skills",
+		mise: "npm:skills"
+	}
+];
+/** A project's own tools: recommended only where a workspace's repo says it
+* uses one — a file at its root (`files`), or package.json's
+* `packageManager` naming it — and never installed by `work setup`, which
+* cannot know the projects (Settings offers them, as Languages offers a
+* language's server). A tool every project of a kind needs, not one that
+* project happens to use: the rest belong to the repo's own `mise.toml`. */
+var PROJECT_TOOLS = [
+	{
+		id: "pnpm",
+		label: "pnpm",
+		bin: "pnpm",
+		mise: "pnpm",
+		files: ["pnpm-lock.yaml", "pnpm-workspace.yaml"],
+		packageManager: "pnpm"
 	},
 	{
-		id: "ast-grep",
-		label: "ast-grep",
-		bin: "ast-grep",
-		mise: "ast-grep"
+		id: "yarn",
+		label: "Yarn",
+		bin: "yarn",
+		mise: "yarn",
+		files: ["yarn.lock", ".yarnrc.yml"],
+		packageManager: "yarn"
 	},
 	{
-		id: "hyperfine",
-		label: "hyperfine",
-		bin: "hyperfine",
-		mise: "hyperfine"
+		id: "bun",
+		label: "Bun",
+		bin: "bun",
+		mise: "bun",
+		files: [
+			"bun.lock",
+			"bun.lockb",
+			"bunfig.toml"
+		],
+		packageManager: "bun"
 	},
 	{
-		id: "fzf",
-		label: "fzf",
-		bin: "fzf",
-		mise: "fzf"
+		id: "deno",
+		label: "Deno",
+		bin: "deno",
+		mise: "deno",
+		files: [
+			"deno.json",
+			"deno.jsonc",
+			"deno.lock"
+		]
 	},
 	{
-		id: "bottom",
-		label: "bottom",
-		bin: "btm",
-		mise: "bottom"
+		id: "uv",
+		label: "uv",
+		bin: "uv",
+		mise: "uv",
+		files: [
+			"uv.lock",
+			"pyproject.toml",
+			"requirements.txt"
+		]
 	},
 	{
-		id: "pnpm",
-		label: "pnpm",
-		bin: "pnpm",
-		mise: "pnpm"
+		id: "go",
+		label: "Go",
+		bin: "go",
+		mise: "go",
+		files: ["go.mod", "go.work"]
 	},
 	{
-		id: "skills",
-		label: "skills CLI",
-		bin: "skills",
-		mise: "npm:skills"
+		id: "rust",
+		label: "Rust",
+		bin: "cargo",
+		mise: "rust",
+		files: [
+			"Cargo.toml",
+			"rust-toolchain.toml",
+			"rust-toolchain"
+		]
+	},
+	{
+		id: "just",
+		label: "just",
+		bin: "just",
+		mise: "just",
+		files: [
+			"justfile",
+			"Justfile",
+			".justfile"
+		]
+	},
+	{
+		id: "task",
+		label: "Task",
+		bin: "task",
+		mise: "task",
+		files: ["Taskfile.yml", "Taskfile.yaml"]
 	}
 ];
 /** Coding agent CLIs — one folder each under src/agents/, whose meta.json is
@@ -585,7 +752,19 @@ var TOOLS = [
 var AGENTS$1 = agents_default;
 var DEFAULT_GITHUB_HOST = "github.com";
 function toolById(id) {
-	return TOOLS.find((t) => t.id === id) || null;
+	return TOOLS.find((t) => t.id === id) || PROJECT_TOOLS.find((t) => t.id === id) || null;
+}
+/** A version that is only a version (`latest`, `lts`, `22`, `1.2.3-rc.1`),
+* not one of mise's forms that build from a git ref or point at a path
+* (`ref:`, `path:`, `prefix:`). */
+var PLAIN_VERSION = /^(?!-)[\w.+-]+$/;
+/** Whether a mise pin is one of the tools above, as they install, at a
+* plain version: what a restore takes without asking. Any other name —
+* a registry tool the catalog does not list, a backend (`npm:`, `ubi:`,
+* `github:`, `cargo:`, `go:`, `pipx:` …), a URL — installs and runs
+* whatever it names, so a restore takes it only when it is named. */
+function catalogPin(name, version) {
+	return [...TOOLS, ...PROJECT_TOOLS].some((t) => t.mise === name) && PLAIN_VERSION.test(version);
 }
 function agentById(id) {
 	return AGENTS$1.find((a) => a.id === id) || null;
@@ -656,8 +835,9 @@ function setupDirs() {
 	};
 	return dirsFor.dirs;
 }
-/** `~/…` for anything under the home directory — every path here is for
-* display (Settings rows, `work doctor`), never re-used to exec. */
+/** `~/…` for anything under the home directory — every path given it is
+* for display (Settings rows, `work doctor`, a language server's
+* definition outside every checkout), never re-used to exec. */
 function tilde(p) {
 	if (!p) return p;
 	return p === home ? "~" : p.startsWith(home + path.sep) ? "~" + p.slice(home.length) : p;
@@ -1051,96 +1231,6 @@ function preferredAgent(enabled = enabledAgents()) {
 	return enabled[0] || "shell";
 }
 //#endregion
-//#region src/server/cache.ts
-/** Keyed stale-while-revalidate cache: a cached value is served immediately
-* (revalidating in the background when older than `ttlMs`); loads are deduped
-* per key, and `refresh` bypasses both the cache and any in-flight load. */
-function swr(ttlMs, load, seed) {
-	const cache = /* @__PURE__ */ new Map();
-	const inflight = /* @__PURE__ */ new Map();
-	function start(key, refresh) {
-		const startedAt = Date.now();
-		const promise = load(key, refresh).then((value) => {
-			const existing = cache.get(key);
-			if (!existing || existing.at <= startedAt) cache.set(key, {
-				at: Date.now(),
-				value
-			});
-			return value;
-		}).finally(() => {
-			if (inflight.get(key)?.promise === promise) inflight.delete(key);
-		});
-		inflight.set(key, {
-			promise,
-			refresh
-		});
-		return promise;
-	}
-	const read = (key, refresh = false) => {
-		if (refresh) {
-			const current = inflight.get(key);
-			return current?.refresh ? current.promise : start(key, true);
-		}
-		let cached = cache.get(key);
-		if (!cached && seed) {
-			cached = seed(key);
-			if (cached) cache.set(key, cached);
-		}
-		if (cached) {
-			if (Date.now() - cached.at >= ttlMs && !inflight.has(key)) start(key, false).catch(() => {});
-			return Promise.resolve(cached.value);
-		}
-		return inflight.get(key)?.promise ?? start(key, false);
-	};
-	/** Inject an externally fetched value (e.g. from a batched load). */
-	read.set = (key, value) => {
-		cache.set(key, {
-			at: Date.now(),
-			value
-		});
-	};
-	/** Current cached value, if any — used when a batch update must merge
-	* with a richer per-key load rather than replace it. */
-	read.get = (key) => cache.get(key)?.value;
-	return read;
-}
-/** Serialize async work per key: calls for one key run in submission order,
-* each starting only after the previous settled. The stored tail is the
-* all-settled form, so a rejection neither blocks the next caller nor leaves
-* the entry behind — the map holds only keys with work still in flight. */
-var locks = /* @__PURE__ */ new Map();
-function withLock(key, fn) {
-	const run = (locks.get(key) ?? Promise.resolve()).then(fn);
-	const tail = run.then(() => {}, () => {});
-	locks.set(key, tail);
-	tail.then(() => {
-		if (locks.get(key) === tail) locks.delete(key);
-	});
-	return run;
-}
-/** One load at a time, and a short reuse window: callers join the in-flight
-* load, and a result younger than `ttlMs` is served without one. For an
-* expensive process sweep (lsof, ps, list-panes) whose answer does not
-* change within the window — `ttlMs` of 0 still collapses concurrent
-* callers onto a single spawn. */
-function shared(fn, ttlMs) {
-	let inflight = null;
-	let last = null;
-	return () => {
-		if (last && Date.now() - last.at < ttlMs) return Promise.resolve(last.value);
-		if (!inflight) inflight = fn().then((value) => {
-			last = {
-				at: Date.now(),
-				value
-			};
-			return value;
-		}).finally(() => {
-			inflight = null;
-		});
-		return inflight;
-	};
-}
-//#endregion
 //#region src/server/events.ts
 var listeners$1 = /* @__PURE__ */ new Set();
 function publish(type, data) {
@@ -1164,7 +1254,7 @@ function subscribe(listener) {
 	listeners$1.add(listener);
 	return () => listeners$1.delete(listener);
 }
-/** Connected SSE clients — lets background watchers idle when no one
+/** Connected events-bus clients — lets background watchers idle when no one
 * is listening. */
 function subscriberCount() {
 	return listeners$1.size;
@@ -7122,7 +7212,7 @@ var background = /* @__PURE__ */ new Map();
 /** A turn's end is pushed once it has stayed ended this long. Stop fires
 * again each time something sends the agent back to work (a stop hook
 * that continues it, a goal loop, background subagents reporting in), and
-* each of those ends was a "Finished" on the phone while it carried on. */
+* each of those ends would be a "Finished" on the phone while it carries on. */
 var DONE_SETTLE_MS = 3e3;
 var listeners = /* @__PURE__ */ new Set();
 /** Called on every phase transition (the status snapshot drops itself). */
@@ -7295,7 +7385,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_BkCP7ACo.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_LF2Fo5WE.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -7705,10 +7795,10 @@ async function fetchUsage$3(account) {
 var PROFILE_TTL_MS = 36e5;
 var profiles = /* @__PURE__ */ new Map();
 /** The account's plan as Anthropic has it now. `.claude.json` holds what
-* Claude Code saw at sign-in, and it only asks again on a new login, so an
-* upgrade (Max 5x → 20x) kept reading as the old plan until then. Asked
-* with the same token as the usage; the cached plan stands in when it
-* cannot be. */
+* Claude Code saw at sign-in, and it only asks again on a new login, so
+* from it alone an upgrade (Max 5x → 20x) reads as the old plan until
+* then. Asked with the same token as the usage; the cached plan stands in
+* when it cannot be. */
 async function livePlan(account) {
 	const hit = profiles.get(account.dir);
 	if (hit && Date.now() - hit.at < PROFILE_TTL_MS) return hit.plan;
@@ -8609,6 +8699,47 @@ var cursor = {
 	usage: () => cursorRow().then((row) => [row])
 };
 //#endregion
+//#region src/server/paths.ts
+/** Whether `target` is `root` or somewhere under it, by name alone. Both
+* are normalised first, so `..` and a trailing slash count as the
+* filesystem would count them, and the separator after `root` is the
+* whole point: a sibling `…/work-2` is not in `…/work`. A relative
+* `target` is in nothing — an empty one is a process cwd that could not
+* be read, not the root. A symlink under `root` can still lead out: what
+* is read through one wants `realInside`. */
+function inside(target, root) {
+	if (!path.isAbsolute(target)) return false;
+	const top = path.resolve(root);
+	const full = path.resolve(target);
+	return full === top || full.startsWith(top.endsWith(path.sep) ? top : top + path.sep);
+}
+/** Where `file` — named from `root`, as git and the pages name a
+* checkout's files, or absolute — really leads through every symlink,
+* when that is still `root` or under it; null when it leads out or is not
+* there. The check by name alone lets a symlink in a repo, which a branch
+* can add, point a read at any file on the machine. */
+async function realInside(file, root) {
+	const full = path.resolve(root, file);
+	if (!inside(full, root)) return null;
+	try {
+		const [top, real] = await Promise.all([fs$1.realpath(root), fs$1.realpath(full)]);
+		return inside(real, top) ? real : null;
+	} catch {
+		return null;
+	}
+}
+/** `realInside` for a caller that cannot wait. */
+function realInsideSync(file, root) {
+	const full = path.resolve(root, file);
+	if (!inside(full, root)) return null;
+	try {
+		const real = fs.realpathSync(full);
+		return inside(real, fs.realpathSync(root)) ? real : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/agents/grok/usage.ts
 var AUTH = path.join(HOME, ".grok", "auth.json");
 var LOG = path.join(HOME, ".grok", "logs", "unified.jsonl");
@@ -8781,7 +8912,7 @@ function scratch() {
 			return os.tmpdir();
 		}
 	})();
-	return hookFile().startsWith(tmp + path.sep);
+	return inside(hookFile(), tmp);
 }
 /** Whether Grok's hook registry names work's hook file — without it Grok
 * reports nothing and the screen has to speak for it. Read from disk, not
@@ -9309,10 +9440,10 @@ function tmuxWasStarted(id) {
 function clearTmuxStarted(id) {
 	tmuxStarted.delete(id);
 }
-/** SSE payload: session rows + live tmux/hook state so clients don't refetch.
-* Coalesced per workspace: a turn boundary lands as a burst of phase
-* transitions (hook, then scrape), and each one cost a list-panes spawn
-* and a broadcast for a list that came out the same. */
+/** Events-bus payload: session rows + live tmux/hook state so clients
+* don't refetch. Coalesced per workspace: a turn boundary lands as a burst
+* of phase transitions (hook, then scrape), and each one cost a list-panes
+* spawn and a broadcast for a list that came out the same. */
 var EMIT_DEBOUNCE_MS = 50;
 var pendingEmits = /* @__PURE__ */ new Map();
 function notifySessionsChanged(workspaceId) {
@@ -9339,8 +9470,14 @@ async function emitSessionsChanged(workspaceId) {
 async function killWorkspaceSessions(workspaceId) {
 	for (const session of listSessions(workspaceId)) await killSession(session.id);
 }
+/** Control characters a paste never means: C0 but tab and line breaks,
+* ESC, DEL and C1. The text can quote a reviewed file, which is repo
+* content, and an ESC in it can end the bracketed paste early on a tmux
+* that passes one through, typing the rest into the pane as keys. */
+var PASTE_UNSAFE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g;
 /** Type text into a session's tmux (bracketed paste + Enter), creating it if needed. */
-async function sendToSession(id, text, size) {
+async function sendToSession(id, raw, size) {
+	const text = raw.replace(PASTE_UNSAFE, "");
 	const session = getSession(id);
 	if (!session) throw new Error("unknown session");
 	const wsPath = workspacePath(session.workspace_id);
@@ -9518,68 +9655,71 @@ async function ensureTmuxServer() {
 	], os.homedir()).catch(() => {});
 }
 /** Full tmux command (options + new-session) for creating/attaching a
-* session's tmux; `mode` is "-d" (create detached) or "-A" (attach-or-create). */
+* session's tmux; `mode` is "-d" (create detached) or "-A" (attach-or-create).
+* Every `set-option` is `-q`: one failed command drops the rest of a `;`
+* chain, new-session included, and a tmux older than an option
+* (`fill-character`, `extended-keys-format`) rejects its name. */
 function newSessionArgs(session, wsPath, mode, initialPrompt, size) {
 	return [
 		"start-server",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"status",
 		"off",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"mouse",
 		"on",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"history-limit",
 		"5000",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"fill-character",
 		" ",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"set-clipboard",
 		"on",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"focus-events",
 		"on",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"extended-keys",
 		"on",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"extended-keys-format",
 		"csi-u",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[100]",
 		"*:hyperlinks",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[101]",
 		"*:clipboard",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[102]",
 		"*:sync:RGB",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[103]",
 		"*:sixel",
 		";",
@@ -9770,4 +9910,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { publish as $, noteBackground as A, toolById as At, agentLabel as B, tmux as Bt, readHookPayload as C, miseVersions as Ct, clearAgentPhase as D, TOOLS as Dt, agentPhase as E, DEFAULT_GITHUB_HOST as Et, setSessionViewers as F, workspacePath as Ft, manifest as G, ACCENT_RE as H, checked as Ht, settleQuietWorking as I, TMUX_SOCKET as It, deleteSubscription as J, normalizeAccent as K, agentBadge as L, gh as Lt, onPhaseChange as M, all as Mt, setAgentPhase as N, db as Nt, hookPhase as O, agentById as Ot, setScrapedPhase as P, get as Pt, validSubscription as Q, agentFamily as R, git as Rt, AGENTS as S, miseInstalls as St, blankRow as T, which as Tt, getInstance as U, httpError as Ut, agentMeta as V, config as Vt, iconSvg as W, readBody as Wt, saveSubscription as X, pushPublicKey as Y, sendPush as Z, renameSession as _, setPref as _t, ensureTmuxServer as a, withLock as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, publishJson as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, swr as it, noteUserAnswered as j, applyPrefChange as jt, hookReportedAt as k, agentLabel$1 as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, subscriberCount as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, setInstance as q, createSession as r, shared as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, subscribe as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, agentFromCommand as z, run$1 as zt };
+export { saveSubscription as $, readBody as $t, clearAgentPhase as A, agentById as At, agentBadge as B, gh as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, DEFAULT_GITHUB_HOST as Dt, realInside as E, which as Et, onPhaseChange as F, all as Ft, ACCENT_RE as G, config as Gt, agentFromCommand as H, gitEnv as Ht, setAgentPhase as I, db as It, manifest as J, withLock as Jt, getInstance as K, shared as Kt, setScrapedPhase as L, get as Lt, hookReportedAt as M, catalogPin as Mt, noteBackground as N, toolById as Nt, blankRow as O, PROJECT_TOOLS as Ot, noteUserAnswered as P, applyPrefChange as Pt, pushPublicKey as Q, httpError as Qt, setSessionViewers as R, workspacePath as Rt, AGENTS as S, miseInstalls as St, inside as T, tilde as Tt, agentLabel as U, run$1 as Ut, agentFamily as V, git as Vt, agentMeta as W, tmux as Wt, setInstance as X, FRAME_HEADERS as Xt, normalizeAccent as Y, FRAME_ANCESTORS as Yt, deleteSubscription as Z, checked as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentLabel$1 as jt, agentPhase as k, TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, swr as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, TMUX_SOCKET as zt };