@haystackeditor/cli 0.15.30 → 0.16.0

package/dist/utils/design-verifier-history.js

@@ -0,0 +1,79 @@
+const outcomes = ['healthy', 'degraded', 'invalid', 'failed', 'unknown'];
+export function isDesignVerifierHistoryReport(value, expected) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const report = value;
+    if (report.version !== 'dv-cli-history-v1' || report.owner !== expected.owner ||
+        report.repo !== expected.repo || report.limit !== expected.limit ||
+        !Number.isSafeInteger(report.retentionDays) || report.retentionDays <= 0 ||
+        !Array.isArray(report.runs) || report.runs.length > report.limit || !report.summary)
+        return false;
+    const seen = new Set();
+    const counts = { healthy: 0, degraded: 0, invalid: 0, failed: 0, unknown: 0 };
+    const blockers = new Map();
+    for (const run of report.runs) {
+        if (!run || !Number.isSafeInteger(run.pr) || run.pr < 1 || typeof run.runId !== 'string')
+            return false;
+        const prefix = `${expected.owner}--${expected.repo}--${run.pr}--`;
+        if (!run.runId.startsWith(prefix) ||
+            !/^[0-9a-f]{12}(?:--attempt-[1-9]\d*)?$/.test(run.runId.slice(prefix.length)) ||
+            seen.has(run.runId) || !outcomes.includes(run.outcome) ||
+            !['succeeded', 'failed', 'failed-stale'].includes(run.status) ||
+            (run.outcome === 'failed') !== (run.status !== 'succeeded') ||
+            typeof run.createdAt !== 'string' || !Number.isFinite(Date.parse(run.createdAt)) ||
+            (run.finishedAt !== null && (typeof run.finishedAt !== 'string' || !Number.isFinite(Date.parse(run.finishedAt)))) ||
+            (run.baseSha !== null && typeof run.baseSha !== 'string') ||
+            (run.headSha !== null && typeof run.headSha !== 'string') ||
+            (run.admitted !== null && (!Number.isSafeInteger(run.admitted) || run.admitted < 0)) ||
+            !Array.isArray(run.losses) || run.losses.some(loss => !loss || typeof loss.code !== 'string' || !loss.code || typeof loss.owner !== 'string' ||
+            !loss.owner || !['degraded', 'invalid'].includes(loss.impact) ||
+            !Number.isSafeInteger(loss.count) || loss.count < 1))
+            return false;
+        if (['healthy', 'degraded'].includes(run.outcome) && (run.admitted === null || run.admitted === 0))
+            return false;
+        seen.add(run.runId);
+        counts[run.outcome]++;
+        for (const code of new Set(run.losses.map(loss => loss.code))) {
+            blockers.set(code, (blockers.get(code) || 0) + 1);
+        }
+    }
+    const summary = report.summary;
+    const usableRate = report.runs.length ? (counts.healthy + counts.degraded) / report.runs.length : null;
+    if (summary.total !== report.runs.length || summary.usableRate !== usableRate ||
+        outcomes.some(outcome => summary[outcome] !== counts[outcome]) ||
+        !Array.isArray(summary.topBlockers) || summary.topBlockers.length !== blockers.size)
+        return false;
+    const seenBlockers = new Set();
+    return summary.topBlockers.every(blocker => {
+        if (!blocker || seenBlockers.has(blocker.code) || blockers.get(blocker.code) !== blocker.affectedRuns)
+            return false;
+        seenBlockers.add(blocker.code);
+        return true;
+    });
+}
+function terminalSafe(value) {
+    return Array.from(value).filter(character => {
+        const point = character.codePointAt(0);
+        return point >= 32 && !(point >= 127 && point <= 159);
+    }).join('');
+}
+export function formatDesignVerifierHistory(report) {
+    const { summary } = report;
+    const lines = [`Execution history for ${terminalSafe(report.owner)}/${terminalSafe(report.repo)}`,
+        `Latest ${summary.total} recorded terminal attempts within ${report.retentionDays} days (limit ${report.limit}).`];
+    if (summary.total === 0) {
+        lines.push('No recorded attempts in this window. History starts when recording is deployed.');
+        return lines.join('\n');
+    }
+    lines.push(`Usable evidence: ${Math.round(summary.usableRate * 100)}% of attempts (${summary.healthy + summary.degraded}/${summary.total}).`, `Fully healthy: ${summary.healthy}; partially degraded: ${summary.degraded}; invalid: ${summary.invalid}; failed: ${summary.failed}; unknown: ${summary.unknown}.`, 'Usable includes partial evidence from degraded attempts. This measures execution reliability, not bug-detection accuracy.', '');
+    for (const run of report.runs) {
+        lines.push(`${run.finishedAt || run.createdAt}  PR #${run.pr}  ${run.outcome}  ${run.admitted ?? '?'} admitted cases`, `  ${run.runId}`);
+    }
+    if (summary.topBlockers.length) {
+        lines.push('', 'Most frequent blockers (attempts affected):');
+        for (const blocker of summary.topBlockers.slice(0, 5)) {
+            lines.push(`  ${terminalSafe(blocker.code)}: ${blocker.affectedRuns}`);
+        }
+    }
+    return lines.join('\n');
+}

package/dist/utils/git.js

@@ -3,10 +3,11 @@
  *
  * Provides functions for git operations: branch management, push, remote parsing.
  */
-import { execFileSync, execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { isHeadlessToken } from './auth.js';
 // Re-export findGitRoot from hooks for consistency
 export { findGitRoot } from './hooks.js';
 // ============================================================================
@@ -17,7 +18,7 @@ export { findGitRoot } from './hooks.js';
  */
 export function getCurrentBranch() {
     try {
-        return execSync('git rev-parse --abbrev-ref HEAD', {
+        return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -33,17 +34,25 @@ export function getCurrentBranch() {
  */
 export function getDefaultBranch() {
     try {
-        // Try to get from remote HEAD
-        const remoteHead = execSync('git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || echo ""', {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        // Try to get from remote HEAD. `git symbolic-ref` exits non-zero when
+        // origin/HEAD is unset, which is normal for many clones; treat that as
+        // "no remote HEAD" and move on to the branch listing below.
+        let remoteHead = '';
+        try {
+            remoteHead = execFileSync('git', ['symbolic-ref', 'refs/remotes/origin/HEAD'], {
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            }).trim();
+        }
+        catch {
+            remoteHead = '';
+        }
         if (remoteHead) {
             // refs/remotes/origin/main -> main
             return remoteHead.replace('refs/remotes/origin/', '');
         }
         // Fallback: check if main or master exists
-        const branches = execSync('git branch -r', {
+        const branches = execFileSync('git', ['branch', '-r'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -62,7 +71,7 @@ export function getDefaultBranch() {
  */
 export function hasUncommittedChanges() {
     try {
-        const status = execSync('git status --porcelain', {
+        const status = execFileSync('git', ['status', '--porcelain'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -76,17 +85,24 @@ export function hasUncommittedChanges() {
  * Check if current branch has unpushed commits
  */
 export function hasUnpushedCommits() {
+    let currentBranch;
     try {
-        const currentBranch = getCurrentBranch();
-        const unpushed = execSync(`git log origin/${currentBranch}..HEAD --oneline 2>/dev/null || echo ""`, {
+        currentBranch = getCurrentBranch();
+    }
+    catch {
+        // Branch may not have an upstream, assume there are commits to push
+        return true;
+    }
+    try {
+        const unpushed = execFileSync('git', ['log', '--oneline', '--end-of-options', `origin/${currentBranch}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
         return unpushed.length > 0;
     }
     catch {
-        // Branch may not have an upstream, assume there are commits to push
-        return true;
+        // No origin/<branch> yet: same result the old `|| echo ""` produced.
+        return false;
     }
 }
 /**
@@ -106,7 +122,7 @@ export function getBranchInfo() {
  */
 export function createBranch(branchName) {
     try {
-        execSync(`git checkout -b "${branchName}"`, {
+        execFileSync('git', ['checkout', '-b', branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -124,7 +140,7 @@ export function createBranch(branchName) {
  */
 export function branchExists(branchName) {
     try {
-        execSync(`git rev-parse --verify "${branchName}" 2>/dev/null`, {
+        execFileSync('git', ['rev-parse', '--verify', '--quiet', '--end-of-options', branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -139,7 +155,7 @@ export function branchExists(branchName) {
  */
 export function remoteBranchExists(remoteName, branchName) {
     try {
-        execSync(`git ls-remote --heads ${remoteName} ${branchName}`, {
+        execFileSync('git', ['ls-remote', '--heads', '--', remoteName, branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -153,8 +169,14 @@ export function remoteBranchExists(remoteName, branchName) {
  * Checkout an existing branch
  */
 export function checkoutBranch(branchName) {
+    // `git checkout` does not honour `--end-of-options` (git 2.39 reads it as a
+    // pathspec), so a leading dash is refused here and the trailing `--` keeps
+    // the name from being read as a path. Git never creates a ref starting with '-'.
+    if (branchName.startsWith('-')) {
+        throw new Error(`Failed to checkout branch: invalid branch name "${branchName}"`);
+    }
     try {
-        execSync(`git checkout "${branchName}"`, {
+        execFileSync('git', ['checkout', branchName, '--'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -164,6 +186,8 @@ export function checkoutBranch(branchName) {
         throw new Error(`Failed to checkout branch: ${message}`);
     }
 }
+/** One-line failure for a push attempted with a Haystack headless token. */
+export const HEADLESS_PUSH_ERROR = 'Pushing a branch needs a GitHub credential, and a Haystack headless token (hsk_live_) cannot push: run `haystack login`, then retry.';
 /**
  * Push current branch to remote with upstream tracking.
  *
@@ -178,11 +202,15 @@ export function checkoutBranch(branchName) {
  */
 export function pushBranch(remoteName, branchName, auth) {
     if (auth) {
+        if (isHeadlessToken(auth.token)) {
+            // Never hand a Haystack token to github.com as a git password.
+            throw new Error(HEADLESS_PUSH_ERROR);
+        }
         pushBranchWithToken(remoteName, branchName, auth.token);
         return;
     }
     try {
-        execSync(`git push -u ${remoteName} "${branchName}"`, {
+        execFileSync('git', ['push', '-u', '--end-of-options', remoteName, branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -214,14 +242,17 @@ function pushBranchWithToken(remoteName, branchName, token) {
         // means the user's configured url/pushurl/credential-helper settings
         // are untouched — sidesteps precedence and multi-value edge cases
         // around `remote.<name>.url` vs `remote.<name>.pushurl`.
-        execSync(`git -c credential.helper= push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+        execFileSync('git', ['-c', 'credential.helper=', 'push', '--end-of-options', pushUrl, `HEAD:refs/heads/${branchName}`], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
         // Pushing to a raw URL doesn't update refs/remotes/<name>/<branch>. Seed
         // it from the server's authoritative state with a targeted fetch — this
         // reflects any server-side rewrite or hook side effects, not a fabricated
         // pre-push SHA. Then set upstream tracking to the named remote.
         try {
-            execSync(`git -c credential.helper= fetch "${pushUrl}" "refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
-            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+            execFileSync('git', [
+                '-c', 'credential.helper=', 'fetch', '--end-of-options', pushUrl,
+                `refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}`,
+            ], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+            execFileSync('git', ['branch', `--set-upstream-to=${remoteName}/${branchName}`, '--end-of-options', branchName], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
         }
         catch (err) {
             // Non-fatal: push succeeded; upstream tracking is a convenience.
@@ -272,7 +303,7 @@ export class UnsupportedRemoteUrlError extends Error {
  */
 export function parseRemoteUrl(remoteName = 'origin') {
     try {
-        const url = execSync(`git remote get-url ${remoteName}`, {
+        const url = execFileSync('git', ['remote', 'get-url', '--', remoteName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -320,7 +351,7 @@ export function parseRemoteUrl(remoteName = 'origin') {
  */
 export function getLastCommitMessage() {
     try {
-        return execSync('git log -1 --format=%s', {
+        return execFileSync('git', ['log', '-1', '--format=%s'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -336,7 +367,7 @@ export function getLastCommitMessage() {
  */
 export function getLastCommitSha() {
     try {
-        return execSync('git rev-parse --short HEAD', {
+        return execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -352,13 +383,13 @@ export function getLastCommitSha() {
 export function getCommitMessagesSinceBase(baseBranch) {
     try {
         // Use origin/<base> to compare against remote base branch
-        const mergeBase = execSync(`git merge-base origin/${baseBranch} HEAD`, {
+        const mergeBase = execFileSync('git', ['merge-base', '--end-of-options', `origin/${baseBranch}`, 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
         if (!mergeBase)
             return '';
-        return execSync(`git log ${mergeBase}..HEAD --format=%B --reverse`, {
+        return execFileSync('git', ['log', '--format=%B', '--reverse', '--end-of-options', `${mergeBase}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -366,7 +397,7 @@ export function getCommitMessagesSinceBase(baseBranch) {
     catch {
         // Fallback: try just the last commit's full message
         try {
-            return execSync('git log -1 --format=%B', {
+            return execFileSync('git', ['log', '-1', '--format=%B'], {
                 encoding: 'utf-8',
                 stdio: ['pipe', 'pipe', 'pipe'],
             }).trim();
@@ -461,7 +492,7 @@ export function resolveDiffBaseRef(baseBranch, options = {}) {
     // if <base> was rewound on the remote).
     let fetched = false;
     try {
-        execFileSync('git', ['fetch', 'origin', `+refs/heads/${baseBranch}:${remoteRef}`], {
+        execFileSync('git', ['fetch', '--end-of-options', 'origin', `+refs/heads/${baseBranch}:${remoteRef}`], {
             ...gitCommandOptions(options),
             env: options.timeoutMs
                 ? { ...process.env, GIT_TERMINAL_PROMPT: '0' }
@@ -496,7 +527,7 @@ export function resolveDiffBaseRef(baseBranch, options = {}) {
  */
 export function getCommitsAhead(baseBranch) {
     try {
-        const output = execSync(`git rev-list --count ${baseBranch}..HEAD`, {
+        const output = execFileSync('git', ['rev-list', '--count', '--end-of-options', `${baseBranch}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();

package/dist/utils/github-api.js

@@ -3,7 +3,7 @@
  *
  * Provides functions for creating PRs, managing labels, etc.
  */
-import { resolveAuthContext } from './auth.js';
+import { isHeadlessToken, resolveAuthContext } from './auth.js';
 import { trackError } from './telemetry.js';
 const GITHUB_API_BASE = 'https://api.github.com';
 // OAuth App Policy fallback. Orgs can restrict our OAuth app, which makes the
@@ -22,6 +22,13 @@ const GITHUB_PROXY_BASE = 'https://haystackeditor.com/api/github';
  * `x-ratelimit-remaining: 0` and the proxy can't help with those, so we don't
  * retry them.
  */
+/**
+ * REST base URL for a token. Haystack headless tokens (hsk_live_*) only work
+ * through the Haystack proxy and must never reach api.github.com.
+ */
+export function githubRestBaseFor(token) {
+    return isHeadlessToken(token) ? GITHUB_PROXY_BASE : GITHUB_API_BASE;
+}
 function isOAuthPolicyForbidden(response) {
     return response.status === 403 && response.headers.get('x-ratelimit-remaining') !== '0';
 }
@@ -75,6 +82,12 @@ async function githubApiRequest(method, path, token, body) {
         },
         body: body ? JSON.stringify(body) : undefined,
     };
+    // A Haystack headless token (hsk_live_*) is not a GitHub credential: sending
+    // it to api.github.com would leak it to GitHub and fail anyway. Only the
+    // Haystack proxy understands it (it resolves an App installation token).
+    if (isHeadlessToken(token)) {
+        return fetch(`${GITHUB_PROXY_BASE}${path}`, init);
+    }
     const direct = await fetch(`${GITHUB_API_BASE}${path}`, init);
     if (!isOAuthPolicyForbidden(direct))
         return direct;

package/dist/utils/haystack-api.js

@@ -13,10 +13,13 @@ export function haystackApiUrl(path) {
  */
 export class HaystackApiError extends Error {
     status;
-    constructor(status, message) {
+    /** The server's stable `error` code when the body carried one. */
+    code;
+    constructor(status, message, code = null) {
         super(message);
         this.name = 'HaystackApiError';
         this.status = status;
+        this.code = code;
     }
     get isAuthError() {
         return this.status === 401 || this.status === 403;
@@ -29,7 +32,17 @@ function headers(token, extra) {
     result.set('User-Agent', 'Haystack-CLI');
     return result;
 }
-/** Extract the server's own message if the body is JSON; truncate raw bodies. */
+/**
+ * The server returns this `error` code (HTTP 403) when the authenticated
+ * account has no paid subscription, so the CLI can say so instead of
+ * reporting a missing resource or a repository permission problem.
+ */
+export const SUBSCRIPTION_REQUIRED_CODE = 'subscription_required';
+export const SUBSCRIPTION_REQUIRED_MESSAGE = 'This account has no active Haystack subscription. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
+/**
+ * Extract the server's own message (and its `error` code) if the body is
+ * JSON; truncate raw bodies.
+ */
 async function serverMessage(response) {
     let text;
     try {
@@ -39,17 +52,20 @@ async function serverMessage(response) {
         // A transport failure while reading the error body is itself signal —
         // say so instead of reporting it as "no detail" (the status-based
         // classification in classifyHttpError stands either way).
-        return `error body unreadable: ${err instanceof Error ? err.message : String(err)}`;
+        return { detail: `error body unreadable: ${err instanceof Error ? err.message : String(err)}`, code: null };
     }
     if (!text)
-        return null;
+        return { detail: null, code: null };
     try {
         const parsed = JSON.parse(text);
-        return parsed.message ?? parsed.error ?? null;
+        return {
+            detail: parsed.message ?? parsed.error ?? null,
+            code: typeof parsed.error === 'string' ? parsed.error : null,
+        };
     }
     catch {
         // Not JSON (HTML error page, plain text) — never dump a full raw body.
-        return text.slice(0, 200);
+        return { detail: text.slice(0, 200), code: null };
     }
 }
 /**
@@ -57,8 +73,11 @@ async function serverMessage(response) {
  * class it failed with, and the next command to run.
  */
 export async function classifyHttpError(response, context) {
-    const detail = await serverMessage(response);
+    const { detail, code } = await serverMessage(response);
     const suffix = detail ? ` (${detail})` : '';
+    if (response.status === 403 && code === SUBSCRIPTION_REQUIRED_CODE) {
+        return new HaystackApiError(403, SUBSCRIPTION_REQUIRED_MESSAGE, code);
+    }
     if (response.status === 401) {
         return new HaystackApiError(401, `${context}: authentication failed${suffix}. Run \`haystack login\` to re-authenticate.`);
     }

package/dist/utils/hooks.js

@@ -6,6 +6,7 @@ import { existsSync } from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
+import { assertNoSymlinkOnPath } from './safe-write.js';
 // ============================================================================
 // Constants
 // ============================================================================
@@ -48,22 +49,54 @@ export function getAssetsDir() {
 export async function copyHookFiles(hooksDir) {
     const assetsDir = getAssetsDir();
     const scriptsDir = path.join(assetsDir, 'scripts');
+    // Every destination is checked against the repository root: copyFile and
+    // chmod follow symlinks, so a committed `hooks/pre-commit -> ~/.zshrc`
+    // would otherwise be overwritten and made executable.
+    const repoRoot = path.dirname(hooksDir);
     // Ensure hooks directory exists
+    assertNoSymlinkOnPath(repoRoot, hooksDir);
     await fs.mkdir(hooksDir, { recursive: true });
     // Copy shell scripts (strip .sh extension, set executable)
     for (const hook of HOOK_SCRIPTS) {
         const src = path.join(scriptsDir, `${hook}.sh`);
         const dest = path.join(hooksDir, hook);
+        assertNoSymlinkOnPath(repoRoot, dest);
         await fs.copyFile(src, dest);
         await fs.chmod(dest, 0o755);
     }
     // Copy agent-context module
-    await copyDirRecursive(path.join(assetsDir, 'agent-context'), path.join(hooksDir, 'agent-context'));
+    await copyDirRecursive(repoRoot, path.join(assetsDir, 'agent-context'), path.join(hooksDir, 'agent-context'));
     // Copy truncation-checker module
-    await copyDirRecursive(path.join(assetsDir, 'truncation-checker'), path.join(hooksDir, 'truncation-checker'));
+    await copyDirRecursive(repoRoot, path.join(assetsDir, 'truncation-checker'), path.join(hooksDir, 'truncation-checker'));
     // Copy hooks package.json
-    await fs.copyFile(path.join(assetsDir, 'package.json'), path.join(hooksDir, 'package.json'));
-    await fs.copyFile(path.join(assetsDir, 'package-lock.json'), path.join(hooksDir, 'package-lock.json'));
+    for (const manifest of ['package.json', 'package-lock.json']) {
+        const dest = path.join(hooksDir, manifest);
+        assertNoSymlinkOnPath(repoRoot, dest);
+        await fs.copyFile(path.join(assetsDir, manifest), dest);
+    }
+}
+/** Every file `copyHookFiles` writes: its bundled source and its path inside hooks/. */
+export async function listHookInstallFiles() {
+    const assetsDir = getAssetsDir();
+    const files = HOOK_SCRIPTS.map(hook => ({
+        src: path.join(assetsDir, 'scripts', `${hook}.sh`),
+        rel: hook,
+    }));
+    const walk = async (dir, rel) => {
+        for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+            const childRel = path.posix.join(rel, entry.name);
+            if (entry.isDirectory())
+                await walk(path.join(dir, entry.name), childRel);
+            else
+                files.push({ src: path.join(dir, entry.name), rel: childRel });
+        }
+    };
+    await walk(path.join(assetsDir, 'agent-context'), 'agent-context');
+    await walk(path.join(assetsDir, 'truncation-checker'), 'truncation-checker');
+    for (const manifest of ['package.json', 'package-lock.json']) {
+        files.push({ src: path.join(assetsDir, manifest), rel: manifest });
+    }
+    return files;
 }
 /** Install npm dependencies in the hooks directory */
 export async function installHookDeps(hooksDir) {
@@ -76,6 +109,8 @@ export async function installHookDeps(hooksDir) {
 /** Copy LLM rules template if none exists */
 export async function copyLlmRulesTemplate(repoRoot) {
     const dest = path.join(repoRoot, 'LLM_RULES.md');
+    // existsSync follows symlinks, so a dangling link reads as absent.
+    assertNoSymlinkOnPath(repoRoot, dest);
     if (existsSync(dest))
         return false;
     const src = path.join(getAssetsDir(), 'llm-rules-template.md');
@@ -85,16 +120,18 @@ export async function copyLlmRulesTemplate(repoRoot) {
 // ============================================================================
 // Helpers
 // ============================================================================
-async function copyDirRecursive(src, dest) {
+async function copyDirRecursive(repoRoot, src, dest) {
+    assertNoSymlinkOnPath(repoRoot, dest);
     await fs.mkdir(dest, { recursive: true });
     const entries = await fs.readdir(src, { withFileTypes: true });
     for (const entry of entries) {
         const srcPath = path.join(src, entry.name);
         const destPath = path.join(dest, entry.name);
         if (entry.isDirectory()) {
-            await copyDirRecursive(srcPath, destPath);
+            await copyDirRecursive(repoRoot, srcPath, destPath);
         }
         else {
+            assertNoSymlinkOnPath(repoRoot, destPath);
             await fs.copyFile(srcPath, destPath);
         }
     }

package/dist/utils/prompter.js

@@ -17,7 +17,7 @@
  * redirects `console.*` to stderr so stdout carries only NDJSON.
  */
 import chalk from 'chalk';
-import inquirer from 'inquirer';
+import { Separator, checkbox, confirm } from '@inquirer/prompts';
 import * as readline from 'node:readline';
 import { readFileSync } from 'node:fs';
 function isSeparator(c) {
@@ -44,6 +44,27 @@ export function loadAnswersFile(path) {
 // ---------------------------------------------------------------------------
 // TTY (human) prompter
 // ---------------------------------------------------------------------------
+/**
+ * Await an @inquirer/prompts prompt, keeping the Ctrl+C behaviour the CLI had
+ * under inquirer 9: that version answered Ctrl+C by re-sending SIGINT to the
+ * process (which terminates it) and never settled the prompt. @inquirer/prompts
+ * instead rejects with an ExitPromptError, which would surface as an uncaught
+ * error with a stack trace, so translate it back.
+ */
+export async function runPrompt(prompt) {
+    try {
+        return await prompt;
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'ExitPromptError') {
+            process.kill(process.pid, 'SIGINT');
+            console.log('');
+            return new Promise(() => { });
+        }
+        throw err;
+    }
+}
+// ---------------------------------------------------------------------------
 class TtyPrompter {
     answers;
     interactive = true;
@@ -56,19 +77,13 @@ class TtyPrompter {
     async confirm(q) {
         if (q.id in this.answers)
             return toBool(this.answers[q.id]);
-        const { value } = await inquirer.prompt([
-            { type: 'confirm', name: 'value', message: q.message, default: q.default ?? true },
-        ]);
-        return value;
+        return runPrompt(confirm({ message: q.message, default: q.default ?? true }));
     }
     async multiselect(q) {
         if (q.id in this.answers)
             return asArray(this.answers[q.id], q.id);
-        const choices = q.choices.map((c) => isSeparator(c) ? new inquirer.Separator(c.separator) : { name: c.name, value: c.value, checked: c.checked });
-        const { value } = await inquirer.prompt([
-            { type: 'checkbox', name: 'value', message: q.message, choices: choices, pageSize: 20 },
-        ]);
-        return value;
+        const choices = q.choices.map((c) => isSeparator(c) ? new Separator(c.separator) : { name: c.name, value: c.value, checked: c.checked });
+        return runPrompt(checkbox({ message: q.message, choices, pageSize: 20 }));
     }
     async action(q) {
         if (this.answers[q.id] === 'skip')

package/dist/utils/safe-write.js

@@ -0,0 +1,31 @@
+import { lstatSync } from 'fs';
+import { isAbsolute, join, relative, sep } from 'path';
+/**
+ * Refuses a write whose target, or any directory between `root` and it, is a
+ * symlink. A repository can commit `AGENTS.md -> ~/.zshrc`; following it would
+ * make an install command edit a file outside the repository. Mirrors the
+ * per-component checks in `skills.ts`. Missing components are fine: the caller
+ * creates them, and a component that does not exist cannot be a symlink.
+ */
+export function assertNoSymlinkOnPath(root, target) {
+    const rel = relative(root, target);
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
+        throw new Error(`Refusing to write ${target}: it is not inside ${root}.`);
+    }
+    let current = root;
+    for (const component of rel.split(sep)) {
+        current = join(current, component);
+        let isSymlink;
+        try {
+            isSymlink = lstatSync(current).isSymbolicLink();
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (isSymlink) {
+            throw new Error(`Refusing to write ${target}: ${current} is a symlink.`);
+        }
+    }
+}