@sayknow-cli/utils 0.7.17 → 0.7.20

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/utils",
-	"version": "0.7.17",
+	"version": "0.7.20",
 	"description": "Shared utilities for pi packages",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -31,7 +31,7 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@sayknow-cli/natives": "0.7.17",
+		"@sayknow-cli/natives": "0.7.20",
 		"beautiful-mermaid": "^1.1.3",
 		"handlebars": "^4.7.9",
 		"winston": "^3.19.0",

package/src/async.ts

@@ -5,6 +5,8 @@
  */
 export function withTimeout<T>(promise: Promise<T>, ms: number, message: string, signal?: AbortSignal): Promise<T> {
 	if (signal?.aborted) {
+		// The operation has already started, even when cancellation wins immediately.
+		void promise.catch(() => {});
 		const reason = signal.reason instanceof Error ? signal.reason : new Error("Aborted");
 		return Promise.reject(reason);
 	}

package/src/env.ts

@@ -309,17 +309,24 @@ function resolveLiveCredentialEnvValue(name: string): string | undefined {
  * control socket directory and the session-root registry. The harness reads both
  * from the process environment after this module loads, so a project `.env` must
  * not point either at a path the repository controls.
+ * `HINDSIGHT_API_URL` selects the Hindsight server. Project settings already
+ * cannot redirect that host. The client reads this process environment, so a
+ * project `.env` value is removed here and is not copied back. A launching-shell
+ * value that differs from the project declaration is kept, including loopback.
  */
 const PROJECT_DENIED_ENV_NAMES = [
 	"NODE_TLS_REJECT_UNAUTHORIZED",
 	"SKC_HARNESS_SOCKET_DIR",
 	"SKC_HARNESS_ROOT_REGISTRY_DIR",
+	"HINDSIGHT_API_URL",
 ] as const;
 
 // Bun may have loaded cwd/.env before JS runs. Drop a value the project declares
 // (same provenance rule as the credential snapshot) and never copy it below.
 // Removing `NODE_TLS_REJECT_UNAUTHORIZED` restores verification: Bun reads that
-// switch per TLS connection. The same drop covers the harness directory names.
+// switch per TLS connection. The same drop covers the harness directory names
+// and `HINDSIGHT_API_URL`, so a later spawn that inherits this environment
+// cannot see the rejected project value.
 // A quoted escape is dynamic even when the line parser did not store a value.
 for (const name of PROJECT_DENIED_ENV_NAMES) {
 	const key = canonicalEnvKey(name);

package/src/prompt.ts

@@ -139,7 +139,8 @@ export function format(content: string, options: PromptFormatOptions = {}): stri
 	const topLevelTags: string[] = [];
 
 	for (let i = 0; i < lines.length; i++) {
-		let line = lines[i].trimEnd();
+		// 끝의 일반 공백만 자른다. 탭은 요약 안 코드(Makefile, 들여쓴 블록)에 의미가 있어 보존한다.
+		let line = lines[i].replace(/ +$/, "");
 		let trimmedStart = line.trimStart();
 		if (trimmedStart.startsWith("```") || trimmedStart.startsWith("~~~")) {
 			inCodeBlock = !inCodeBlock;