@tekmidian/pai 1.0.0 → 1.0.2

package/dist/hooks/supervision-banner.mjs

@@ -7998,6 +7998,13 @@ var init_scratch = __esm({
   }
 });
 
+// src/config/atomic-file.ts
+var init_atomic_file = __esm({
+  "src/config/atomic-file.ts"() {
+    "use strict";
+  }
+});
+
 // src/utils/fmt-age.ts
 var init_fmt_age = __esm({
   "src/utils/fmt-age.ts"() {
@@ -8009,6 +8016,7 @@ var init_fmt_age = __esm({
 var init_pending = __esm({
   "src/workers/pending.ts"() {
     "use strict";
+    init_atomic_file();
     init_status();
     init_paths();
     init_worktree();
@@ -8080,6 +8088,7 @@ var init_tree = __esm({
 var init_endreason = __esm({
   "src/workers/endreason.ts"() {
     "use strict";
+    init_atomic_file();
     init_paths();
     init_ledger();
     init_status();

package/dist/hooks/sync-todo-to-md.mjs

@@ -7370,42 +7370,149 @@ function isWorkerSession(env = process.env) {
 }
 
 // src/hooks/ts/post-tool-use/sync-todo-to-md.ts
-import { writeFileSync as writeFileSync2, existsSync as existsSync5, readFileSync as readFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname4 } from "path";
+
+// src/hooks/ts/lib/todo-sync.ts
+import { writeFileSync, renameSync, unlinkSync } from "fs";
+import { dirname, join, basename } from "path";
+var MANAGED_HEADING = /^## Current Session[ \t]*$/;
+var FOOTER = /(\n---[ \t\r\n]*)?(\n\*Last updated:[^\n]*\*[ \t\r\n]*)?$/;
+function formatSessionTodos(todos) {
+  const inProgress = todos.filter((t) => t.status === "in_progress");
+  const pending = todos.filter((t) => t.status === "pending");
+  const completed = todos.filter((t) => t.status === "completed");
+  let content = "";
+  if (inProgress.length > 0) {
+    content += `### In Progress
+
+`;
+    for (const todo of inProgress) {
+      content += `- [ ] **${todo.content}** _(${todo.activeForm})_
+`;
+    }
+    content += "\n";
+  }
+  if (pending.length > 0) {
+    content += `### Pending
+
+`;
+    for (const todo of pending) {
+      content += `- [ ] ${todo.content}
+`;
+    }
+    content += "\n";
+  }
+  if (completed.length > 0) {
+    content += `### Completed
+
+`;
+    for (const todo of completed) {
+      content += `- [x] ${todo.content}
+`;
+    }
+    content += "\n";
+  }
+  if (todos.length === 0) {
+    content += `_(No active session tasks)_
+
+`;
+  }
+  return content;
+}
+function splitSections(content) {
+  const starts = [];
+  let offset = 0;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("## ")) starts.push(offset);
+    offset += line.length + 1;
+  }
+  if (starts.length === 0) return { preamble: content, sections: [] };
+  const sections = starts.map((s, i) => content.slice(s, starts[i + 1] ?? content.length));
+  return { preamble: content.slice(0, starts[0]), sections };
+}
+function buildTodoContent(todos, existingContent, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  const body = existingContent.replace(FOOTER, "");
+  const managed = `## Current Session
+
+${formatSessionTodos(todos)}`;
+  const { preamble, sections } = splitSections(body);
+  let out;
+  const idx = sections.findIndex((s) => MANAGED_HEADING.test(s.split("\n", 1)[0]));
+  if (idx >= 0) {
+    const old = sections[idx];
+    const trailing = old.slice(old.trimEnd().length);
+    const replaced = sections.slice();
+    replaced[idx] = managed.trimEnd() + (idx < sections.length - 1 ? trailing.length > 1 ? trailing : "\n\n" : "\n");
+    out = preamble + replaced.join("");
+  } else if (body.trim() === "") {
+    out = `# TODO
+
+${managed}`;
+  } else {
+    const titleEnd = /^# [^\n]*\n\n?/.exec(preamble);
+    const head = titleEnd ? preamble.slice(0, titleEnd[0].length) : "";
+    const rest = preamble.slice(head.length);
+    out = head + managed + rest + sections.join("");
+  }
+  if (!out.endsWith("\n")) out += "\n";
+  return `${out}
+---
+
+*Last updated: ${now}*
+`;
+}
+function fixMalformedHeadings(content) {
+  return content.replace(/^---#/gm, "#");
+}
+function writeFileAtomic(path, data) {
+  const tmp = join(dirname(path), `.${basename(path)}.${process.pid}.tmp`);
+  try {
+    writeFileSync(tmp, data);
+    renameSync(tmp, path);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
 
 // src/hooks/ts/lib/project-utils/paths.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, linkSync, copyFileSync as copyFileSync2 } from "fs";
-import { join as join3, basename } from "path";
+import { join as join4, basename as basename2 } from "path";
 
 // src/hooks/ts/lib/pai-paths.ts
 import { homedir as homedir2 } from "os";
-import { resolve, join as join2 } from "path";
+import { resolve, join as join3 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 
 // src/config/pai-home.ts
-import { existsSync, mkdirSync, readFileSync, copyFileSync, renameSync, readdirSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, copyFileSync, renameSync as renameSync2, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, dirname } from "node:path";
+import { join as join2, dirname as dirname2 } from "node:path";
 function legacyPaiHomeDir() {
-  return join(homedir(), ".claude", "pai");
+  return join2(homedir(), ".claude", "pai");
 }
 function claudeHomeDir() {
-  return process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || join2(homedir(), ".claude");
 }
 function legacyConfigDir() {
-  return join(homedir(), ".config", "pai");
+  return join2(homedir(), ".config", "pai");
 }
 function defaultPaiHomeDir() {
-  return join(homedir(), ".pai");
+  return join2(homedir(), ".pai");
 }
 function paiHomeDir() {
   if (process.env.PAI_HOME) return process.env.PAI_HOME;
   const fresh = defaultPaiHomeDir();
   const legacy = legacyPaiHomeDir();
-  if (!existsSync(join(fresh, "config.yaml")) && existsSync(join(legacy, "config.yaml"))) return legacy;
+  if (!existsSync(join2(fresh, "config.yaml")) && existsSync(join2(legacy, "config.yaml"))) return legacy;
   return fresh;
 }
 function paiHomePath(...segments) {
-  return join(paiHomeDir(), ...segments);
+  return join2(paiHomeDir(), ...segments);
 }
 var noticesPrinted = /* @__PURE__ */ new Set();
 function resolvePaiFile(newPath, oldCandidates, migrateHint) {
@@ -7500,32 +7607,32 @@ function resolveAdapterDir() {
   return defaultAdapterDir();
 }
 var ADAPTER_DIR = resolveAdapterDir();
-var HOOKS_DIR = join2(ADAPTER_DIR, "Hooks");
-var SKILLS_DIR = join2(ADAPTER_DIR, "skills");
-var AGENTS_DIR = join2(ADAPTER_DIR, "agents");
-var COMMANDS_DIR = join2(ADAPTER_DIR, "commands");
+var HOOKS_DIR = join3(ADAPTER_DIR, "Hooks");
+var SKILLS_DIR = join3(ADAPTER_DIR, "skills");
+var AGENTS_DIR = join3(ADAPTER_DIR, "agents");
+var COMMANDS_DIR = join3(ADAPTER_DIR, "commands");
 
 // src/hooks/ts/lib/project-utils/paths.ts
-var PROJECTS_DIR = join3(ADAPTER_DIR, "projects");
+var PROJECTS_DIR = join4(ADAPTER_DIR, "projects");
 function encodePath(path) {
   return path.replace(/\//g, "-").replace(/\./g, "-").replace(/ /g, "-");
 }
 function getProjectDir(cwd) {
   const encoded = encodePath(cwd);
-  return join3(PROJECTS_DIR, encoded);
+  return join4(PROJECTS_DIR, encoded);
 }
 function getNotesDir(cwd) {
-  return join3(getProjectDir(cwd), "Notes");
+  return join4(getProjectDir(cwd), "Notes");
 }
 function findNotesDir(cwd) {
-  const cwdBasename = basename(cwd).toLowerCase();
+  const cwdBasename = basename2(cwd).toLowerCase();
   if (cwdBasename === "notes" && existsSync3(cwd)) {
     return { path: cwd, isLocal: true };
   }
   const localPaths = [
-    join3(cwd, "Notes"),
-    join3(cwd, "notes"),
-    join3(cwd, ".claude", "Notes")
+    join4(cwd, "Notes"),
+    join4(cwd, "notes"),
+    join4(cwd, ".claude", "Notes")
   ];
   for (const path of localPaths) {
     if (existsSync3(path)) {
@@ -7536,20 +7643,20 @@ function findNotesDir(cwd) {
 }
 function findTodoPath(cwd) {
   const localPaths = [
-    join3(cwd, "TODO.md"),
-    join3(cwd, "notes", "TODO.md"),
-    join3(cwd, "Notes", "TODO.md"),
-    join3(cwd, ".claude", "TODO.md")
+    join4(cwd, "TODO.md"),
+    join4(cwd, "notes", "TODO.md"),
+    join4(cwd, "Notes", "TODO.md"),
+    join4(cwd, ".claude", "TODO.md")
   ];
   for (const path of localPaths) {
     if (existsSync3(path)) return path;
   }
-  return join3(getNotesDir(cwd), "TODO.md");
+  return join4(getNotesDir(cwd), "TODO.md");
 }
 
 // src/hooks/ts/lib/project-utils/session-notes.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync3, writeFileSync, renameSync as renameSync2 } from "fs";
-import { join as join4, basename as basename2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync as renameSync3 } from "fs";
+import { join as join5, basename as basename3 } from "path";
 function getCurrentNotePath(notesDir) {
   if (!existsSync4(notesDir)) return null;
   const findLatestIn = (dir) => {
@@ -7560,18 +7667,18 @@ function getCurrentNotePath(notesDir) {
       return numA - numB;
     });
     if (files.length === 0) return null;
-    return join4(dir, files[files.length - 1]);
+    return join5(dir, files[files.length - 1]);
   };
   const now = /* @__PURE__ */ new Date();
   const year = String(now.getFullYear());
   const month = String(now.getMonth() + 1).padStart(2, "0");
-  const currentMonthDir = join4(notesDir, year, month);
+  const currentMonthDir = join5(notesDir, year, month);
   const found = findLatestIn(currentMonthDir);
   if (found) return found;
   const prevDate = new Date(now.getFullYear(), now.getMonth() - 1, 1);
   const prevYear = String(prevDate.getFullYear());
   const prevMonth = String(prevDate.getMonth() + 1).padStart(2, "0");
-  const prevMonthDir = join4(notesDir, prevYear, prevMonth);
+  const prevMonthDir = join5(notesDir, prevYear, prevMonth);
   const prevFound = findLatestIn(prevMonthDir);
   if (prevFound) return prevFound;
   return findLatestIn(notesDir);
@@ -7608,8 +7715,8 @@ function addWorkToSessionNote(notePath, workItems, sectionTitle) {
       content = content.substring(0, nextStepsIndex) + workText + "\n" + content.substring(nextStepsIndex);
     }
   }
-  writeFileSync(notePath, content);
-  console.error(`Added ${workItems.length} work item(s) to: ${basename2(notePath)}`);
+  writeFileSync2(notePath, content);
+  console.error(`Added ${workItems.length} work item(s) to: ${basename3(notePath)}`);
 }
 
 // src/session/forge-sink.ts
@@ -7619,7 +7726,7 @@ var import_yaml4 = __toESM(require_dist(), 1);
 var PREAMBLE_MAX_BYTES = 16 * 1024;
 
 // src/daemon/config.ts
-import { join as join5, dirname as dirname2, basename as basename3 } from "node:path";
+import { join as join6, dirname as dirname3, basename as basename4 } from "node:path";
 
 // src/config/shipped-defaults.ts
 var import_yaml3 = __toESM(require_dist(), 1);
@@ -7632,93 +7739,20 @@ var import_yaml = __toESM(require_dist(), 1);
 
 // src/daemon/config.ts
 var NEW_CONFIG_FILE = paiHomePath("config.json");
-var oldConfigFile = () => join5(claudeHomeDir(), "pai.json");
-var legacyConfigFile = () => join5(legacyConfigDir(), "config.json");
+var oldConfigFile = () => join6(claudeHomeDir(), "pai.json");
+var legacyConfigFile = () => join6(legacyConfigDir(), "config.json");
 function paiConfigFilePath() {
   const override = process.env.PAI_CONFIG_FILE;
   if (override) return override;
   return resolvePaiFile(NEW_CONFIG_FILE, [oldConfigFile(), legacyConfigFile()], "pai config migrate");
 }
 var CONFIG_FILE = paiConfigFilePath();
-var CONFIG_DIR = dirname2(CONFIG_FILE);
+var CONFIG_DIR = dirname3(CONFIG_FILE);
 
 // src/session/checkpoint-block.ts
 var AUTHORED_GRACE_MS = 60 * 60 * 1e3;
 
 // src/hooks/ts/post-tool-use/sync-todo-to-md.ts
-function formatSessionTodos(todos) {
-  const inProgress = todos.filter((t) => t.status === "in_progress");
-  const pending = todos.filter((t) => t.status === "pending");
-  const completed = todos.filter((t) => t.status === "completed");
-  let content = "";
-  if (inProgress.length > 0) {
-    content += `### In Progress
-
-`;
-    for (const todo of inProgress) {
-      content += `- [ ] **${todo.content}** _(${todo.activeForm})_
-`;
-    }
-    content += "\n";
-  }
-  if (pending.length > 0) {
-    content += `### Pending
-
-`;
-    for (const todo of pending) {
-      content += `- [ ] ${todo.content}
-`;
-    }
-    content += "\n";
-  }
-  if (completed.length > 0) {
-    content += `### Completed
-
-`;
-    for (const todo of completed) {
-      content += `- [x] ${todo.content}
-`;
-    }
-    content += "\n";
-  }
-  if (todos.length === 0) {
-    content += `_(No active session tasks)_
-
-`;
-  }
-  return content;
-}
-function extractPreservedSections(content) {
-  let preserved = "";
-  const sectionRegex = /\n(## (?!Current Session)[^\n]+[\s\S]*?)(?=\n## |\n---\n+\*Last updated|$)/g;
-  const matches = content.matchAll(sectionRegex);
-  for (const match of matches) {
-    preserved += match[1];
-  }
-  return preserved;
-}
-function fixMalformedHeadings(content) {
-  return content.replace(/^---#/gm, "#");
-}
-function buildTodoContent(todos, existingContent) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const preserved = extractPreservedSections(existingContent);
-  let content = `# TODO
-
-## Current Session
-
-${formatSessionTodos(todos)}`;
-  if (preserved.trim()) {
-    content += preserved;
-  }
-  content = content.replace(/(\n---\s*)*(\n\*Last updated:.*\*\s*)*$/, "");
-  content += `
----
-
-*Last updated: ${now}*
-`;
-  return content;
-}
 async function main() {
   if (isWorkerSession()) return;
   try {
@@ -7743,7 +7777,7 @@ async function main() {
     const cwd = hookInput.cwd || process.cwd();
     const todoPath = findTodoPath(cwd);
     if (!existsSync5(todoPath)) {
-      const parentDir = todoPath.replace(/\/[^/]+$/, "");
+      const parentDir = dirname4(todoPath);
       mkdirSync4(parentDir, { recursive: true });
       console.error(`Creating TODO.md at ${todoPath}`);
     }
@@ -7754,7 +7788,7 @@ async function main() {
     }
     let newContent = buildTodoContent(todos, existingContent);
     newContent = fixMalformedHeadings(newContent);
-    writeFileSync2(todoPath, newContent);
+    writeFileAtomic(todoPath, newContent);
     const stats = {
       inProgress: todos.filter((t) => t.status === "in_progress").length,
       pending: todos.filter((t) => t.status === "pending").length,

package/dist/hooks/worker-edit-repair.mjs

@@ -9119,8 +9119,9 @@ function computeSimilarity(s1, s2) {
       break;
     }
   }
+  const overlapCap = minLength - prefixLength;
   const totalLength = Math.max(s1.length, s2.length);
-  return totalLength > 0 ? (prefixLength + suffixLength) / totalLength : 0;
+  return (prefixLength + Math.min(suffixLength, overlapCap)) / totalLength;
 }
 
 // src/hooks/ts/lib/render-decision.ts

package/dist/hooks/worker-guard.mjs

@@ -9051,16 +9051,23 @@ function resolveToken() {
   }
   return process.env.FORGE_TOKEN || process.env.AIBROKER_FORGE_TOKEN || void 0;
 }
-var curlHttp = (method, url, token, body, timeoutMs) => {
-  const cfg = [
-    `url = "${url}"`,
-    `request = "${method}"`,
-    `header = "Authorization: token ${token}"`,
+function curlQuote(v) {
+  if (/[\r\n]/.test(v)) throw new ForgeError("refusing newline in curl config value");
+  return v.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function buildCurlConfig(method, url, token, timeoutMs) {
+  return [
+    `url = "${curlQuote(url)}"`,
+    `request = "${curlQuote(method)}"`,
+    `header = "Authorization: token ${curlQuote(token)}"`,
     `header = "Content-Type: application/json"`,
     `max-time = ${Math.max(0.5, timeoutMs / 1e3)}`,
     `silent`,
     `write-out = "\\n%{http_code}"`
   ].join("\n");
+}
+var curlHttp = (method, url, token, body, timeoutMs) => {
+  const cfg = buildCurlConfig(method, url, token, timeoutMs);
   const argv = body !== void 0 ? ["-K", "-", "--data-raw", body] : ["-K", "-"];
   const r = spawnSync("curl", argv, { input: cfg, encoding: "utf8", timeout: timeoutMs + 500, maxBuffer: 16 * 1024 * 1024 });
   if (r.error || r.status !== 0) throw new ForgeError(`curl failed (${r.error?.message ?? `exit ${r.status}`})`);
@@ -9321,9 +9328,9 @@ function currentWorkerId(env = process.env, logDir) {
 
 // src/hooks/ts/pre-tool-use/worker-guard.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, join as join16 } from "node:path";
+import { dirname as dirname9, join as join16 } from "node:path";
 
 // src/hooks/ts/lib/render-decision.ts
 var GUARD_MARKER = "PAI guard: ";
@@ -11094,7 +11101,24 @@ function recordToolError(logDir, rec, now = Date.now()) {
 
 // src/workers/loop-stop.ts
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync17, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+
+// src/config/atomic-file.ts
+import { mkdirSync as mkdirSync7, renameSync as renameSync5, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname as dirname8 } from "node:path";
+function writeFileAtomic(path, text) {
+  mkdirSync7(dirname8(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync6(tmp, text, "utf8");
+    renameSync5(tmp, path);
+  } catch (e) {
+    rmSync3(tmp, { force: true });
+    throw e;
+  }
+}
+
+// src/workers/loop-stop.ts
 import { join as join15 } from "node:path";
 
 // src/workers/endreason.ts
@@ -11107,7 +11131,7 @@ function appendStopEvent(logDir, id, stop) {
 }
 
 // src/builds/queue.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync3, rmdirSync, statSync as statSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync6, rmSync as rmSync4, rmdirSync, statSync as statSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join14 } from "node:path";
 var defaultDeps = () => ({
   isAlive: (pid) => {
@@ -11135,7 +11159,7 @@ var ticketFile = (dir, id) => join14(ticketsDir(dir), `${id}.json`);
 function breakStaleMutex(m, staleMs = 5e3) {
   const guard = `${m}.break`;
   try {
-    mkdirSync7(guard);
+    mkdirSync8(guard);
   } catch {
     try {
       if (Date.now() - statSync5(guard).mtimeMs > staleMs) rmdirSync(guard);
@@ -11154,12 +11178,12 @@ function breakStaleMutex(m, staleMs = 5e3) {
   }
 }
 async function withMutex(dir, fn) {
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   const m = join14(dir, "mutex");
   const t0 = Date.now();
   for (; ; ) {
     try {
-      mkdirSync7(m);
+      mkdirSync8(m);
       break;
     } catch {
       breakStaleMutex(m);
@@ -11203,7 +11227,7 @@ async function releaseBuildsOf(dir, worker, d = {}) {
     const mine = readTickets(dir).filter((t) => t.worker === worker);
     for (const t of mine) {
       killTicket(t, deps, true);
-      rmSync3(ticketFile(dir, t.id), { force: true });
+      rmSync4(ticketFile(dir, t.id), { force: true });
     }
     return mine.map((t) => t.id);
   });
@@ -11232,7 +11256,7 @@ function requestLoopStop(logDir, id, reason, deps = {}) {
   const { kill = (pid, sig) => process.kill(pid, sig), claudePid = defaultClaudePid } = deps;
   try {
     const m = { ts: (/* @__PURE__ */ new Date()).toISOString(), reason };
-    writeFileSync7(loopStopMarkerPath(logDir, id), JSON.stringify(m));
+    writeFileAtomic(loopStopMarkerPath(logDir, id), JSON.stringify(m));
   } catch {
   }
   appendStopEvent(logDir, id, { killed_by: "loop-guard", forced: false, reason });
@@ -11267,7 +11291,7 @@ function buildContext(cwd) {
     home: homedir3(),
     worktreeRoot,
     inWorktree,
-    mainCheckout: inWorktree && common ? dirname8(common) : null,
+    mainCheckout: inWorktree && common ? dirname9(common) : null,
     sharedCheckout: () => {
       let logDir = null;
       try {
@@ -11278,7 +11302,7 @@ function buildContext(cwd) {
     },
     testScript: () => {
       try {
-        const pkg = JSON.parse(readFileSync18(join16(worktreeRoot ?? cwd, "package.json"), "utf8"));
+        const pkg = JSON.parse(readFileSync17(join16(worktreeRoot ?? cwd, "package.json"), "utf8"));
         return typeof pkg?.scripts?.test === "string" ? pkg.scripts.test : null;
       } catch {
         return null;

package/dist/hooks/worker-note.mjs

@@ -9043,16 +9043,23 @@ function resolveToken() {
   }
   return process.env.FORGE_TOKEN || process.env.AIBROKER_FORGE_TOKEN || void 0;
 }
-var curlHttp = (method, url, token, body, timeoutMs) => {
-  const cfg = [
-    `url = "${url}"`,
-    `request = "${method}"`,
-    `header = "Authorization: token ${token}"`,
+function curlQuote(v) {
+  if (/[\r\n]/.test(v)) throw new ForgeError("refusing newline in curl config value");
+  return v.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function buildCurlConfig(method, url, token, timeoutMs) {
+  return [
+    `url = "${curlQuote(url)}"`,
+    `request = "${curlQuote(method)}"`,
+    `header = "Authorization: token ${curlQuote(token)}"`,
     `header = "Content-Type: application/json"`,
     `max-time = ${Math.max(0.5, timeoutMs / 1e3)}`,
     `silent`,
     `write-out = "\\n%{http_code}"`
   ].join("\n");
+}
+var curlHttp = (method, url, token, body, timeoutMs) => {
+  const cfg = buildCurlConfig(method, url, token, timeoutMs);
   const argv = body !== void 0 ? ["-K", "-", "--data-raw", body] : ["-K", "-"];
   const r = spawnSync("curl", argv, { input: cfg, encoding: "utf8", timeout: timeoutMs + 500, maxBuffer: 16 * 1024 * 1024 });
   if (r.error || r.status !== 0) throw new ForgeError(`curl failed (${r.error?.message ?? `exit ${r.status}`})`);

package/dist/hooks/worker-path-repair.mjs

@@ -294,7 +294,7 @@ function cdReason(command, cwd) {
     if (existsSync2(target)) continue;
     const fixed = repairValue(target, cwd, true, existsSync2);
     if (!fixed) continue;
-    const next = command.replace(target, fixed);
+    const next = command.replace(target, () => fixed);
     return `Wrong path in cd: ${target}. You are already in your worktree ${cwd}; drop the cd. Corrected command: ${next}`;
   }
   return null;