@warren-dean/code-kit 0.6.0 → 0.8.0

package/hooks/lib/journal.mjs

@@ -0,0 +1,224 @@
+// The journal (docs/specs/15-decisions-and-journal.md, JOURNAL-1): the build's lineage in plain
+// sentences, oldest first: what the person asked for, the decisions that shaped it, the specification,
+// the rules being switched on, each story handed out, sent back and merged, each approval and who gave
+// it, and each milestone finished. Read from git and the project's own records, so it's the same for
+// every session and survives a restart.
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { APPROVAL_LOG } from './rules.mjs';
+import { sendBacks } from './reviews.mjs';
+import { storyTimes } from './timeline.mjs';
+
+const gitIn =
+  (root) =>
+  (...args) => {
+    try {
+      return execFileSync('git', ['-C', root, ...args], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        maxBuffer: 32 * 1024 * 1024,
+      }).trim();
+    } catch {
+      return '';
+    }
+  };
+
+/** When a file was first committed, in ms, or null. */
+const addedAt = (git, file) => {
+  const t = git('log', '--diff-filter=A', '--format=%ct', '--', file)
+    .split('\n')
+    .filter(Boolean)
+    .at(-1);
+  return t ? Number(t) * 1000 : null;
+};
+
+/** The brief's title and its problem, in a sentence or two: what the person asked for. */
+export function briefRequest(text) {
+  const title = text.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? null;
+  const section = (name) => {
+    const m = text.match(
+      new RegExp(`^##\\s+${name}\\s*\\n([\\s\\S]*?)(?=^##\\s|$(?![\\s\\S]))`, 'm'),
+    );
+    return m ? m[1].trim() : '';
+  };
+  const firstParagraph = (s) =>
+    s
+      .split(/\n\s*\n/)[0]
+      .replace(/\s+/g, ' ')
+      .trim();
+  const problem = firstParagraph(section('Problem')) || firstParagraph(section('Outcome'));
+  return { title, problem: problem || null };
+}
+
+/** The brief's decision log: [{ date, decision, why }], from its `## Decision log` table. */
+export function briefDecisions(text) {
+  const m = text.match(/^##\s+Decision log\s*\n([\s\S]*?)(?=^##\s|$(?![\s\S]))/m);
+  if (!m) return [];
+  return m[1]
+    .split('\n')
+    .filter((l) => /^\|/.test(l) && !/^\|\s*-/.test(l) && !/^\|\s*Date\s*\|/i.test(l))
+    .map((l) => l.split('|').map((c) => c.trim()))
+    .map((c) => ({ date: c[1], decision: c[2], why: c[3] ?? '' }))
+    .filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d.date) && d.decision);
+}
+
+/** Who gave an approval, from the reason its log entry carries: the person, or the lead within limits. */
+export function approverOf(entry) {
+  const reason = String(entry.reason ?? '');
+  if (/approved by the lead within the delegated rules/.test(reason)) return 'lead';
+  if (entry.approval === 'lead') return 'lead';
+  return 'person';
+}
+
+/** The words an approval's name stands for: "dep-pdfjs-dist" → "adding the package pdfjs-dist". */
+export function approvalWords(name) {
+  if (name.startsWith('dep-')) return `adding the package ${name.slice(4)}`;
+  if (name === 'dependency') return 'adding a new package';
+  if (name === 'kit') return "a change to code-kit's own rules or agents";
+  if (name === 'merge') return 'a merge';
+  return `a change to the protected ${name.replace(/-/g, ' ')}`;
+}
+
+/** The person's own words, without the note the hooks add about how it was given. */
+const ownWords = (reason) =>
+  String(reason ?? '')
+    .replace(
+      /\s*\((given in chat, recorded by the lead|approved in the [\w ]+ pane|approved by the lead within the delegated rules[^)]*)\)\s*$/,
+      '',
+    )
+    .trim();
+
+/**
+ * JOURNAL-1: the events, oldest first: [{ at, kind, text, story? }]. Kinds: request, decision, spec,
+ * setup, dispatch, sentBack, merge, approval, milestone. `status` is buildStatus's; `base` the branch
+ * stories merge into; `docs` the config's docs (brief beside the specs).
+ */
+export function journal(root, status, base, docs = {}) {
+  const git = gitIn(root);
+  const events = [];
+  const at = (iso) => (iso ? Date.parse(`${iso}T12:00:00Z`) : null);
+  // What the person asked for, and the decisions the brief records.
+  const briefPath = ['docs/brief.md', docs.specs ? join(docs.specs, '..', 'brief.md') : null]
+    .filter(Boolean)
+    .find((p) => existsSync(join(root, p)));
+  if (briefPath) {
+    const text = readFileSync(join(root, briefPath), 'utf8');
+    const { title, problem } = briefRequest(text);
+    const when = addedAt(git, briefPath);
+    if (title || problem)
+      events.push({
+        at: when,
+        kind: 'request',
+        text: `You asked for ${title ? `“${title}”` : 'a build'}${problem ? `: ${problem}` : ''}`,
+      });
+    // The decisions were made while the brief was written: they follow the request, in the log's order.
+    briefDecisions(text).forEach((d, n) =>
+      events.push({
+        at: (when ?? at(d.date)) + n + 1,
+        kind: 'decision',
+        text: `Decided: ${d.decision}${d.why ? `, because ${d.why.replace(/\.$/, '').replace(/^./, (c) => c.toLowerCase())}` : ''}.`,
+      }),
+    );
+  }
+  // The specification and the plan.
+  const reqs = status.requirements.filter((r) => !r.removed).length;
+  const milestones = [...new Set(status.stories.map((s) => s.milestone).filter(Boolean))];
+  if (docs.plan && status.stories.length)
+    events.push({
+      at: addedAt(git, docs.plan),
+      kind: 'spec',
+      text: `The specification was written: ${reqs} requirement${reqs === 1 ? '' : 's'}, split into ${status.stories.length} stor${status.stories.length === 1 ? 'y' : 'ies'}${milestones.length ? ` across ${milestones.length} milestone${milestones.length === 1 ? '' : 's'}` : ''}.`,
+    });
+  const switchedOn = addedAt(git, '.claude/code-kit.json');
+  if (switchedOn)
+    events.push({
+      at: switchedOn,
+      kind: 'setup',
+      text: "code-kit's rules were switched on, as you approved them.",
+    });
+  // Each story: handed out, sent back, merged.
+  const times = storyTimes(root, status.stories, base);
+  const byId = new Map(status.stories.map((s) => [s.id, s]));
+  const backs = sendBacks(root);
+  for (const t of times) {
+    const s = byId.get(t.id);
+    const name = `${t.id} ${s?.title ?? ''}`.trim();
+    const reqText = s?.requirements?.length ? ` (${s.requirements.join(', ')})` : '';
+    if (t.started)
+      events.push({
+        at: t.started,
+        kind: 'dispatch',
+        story: t.id,
+        text:
+          t.lane === 'lead'
+            ? `The lead started ${name}${reqText} itself.`
+            : `${name}${reqText} was handed to the ${t.lane} lane.`,
+      });
+    for (const b of backs.filter((x) => x.branch === t.branch))
+      events.push({
+        at: Date.parse(b.at),
+        kind: 'sentBack',
+        story: t.id,
+        text:
+          t.lane === 'lead'
+            ? `${t.id} needed more work from the lead${b.reason ? `: ${b.reason}` : '.'}`
+            : `The lead sent ${t.id} back to the ${t.lane} lane${b.reason ? `: ${b.reason}` : '.'}`,
+      });
+    if (t.merged)
+      events.push({
+        at: t.merged,
+        kind: 'merge',
+        story: t.id,
+        text: `${name} was merged into ${base}.`,
+      });
+  }
+  // Approvals on the base, once each (one approval can log several files), and who gave them.
+  const seen = new Set();
+  for (const line of git('show', `${base}:${APPROVAL_LOG}`).split('\n').filter(Boolean)) {
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!e.approval || e.approval === 'lead') continue;
+    const key = `${e.approval}|${e.grantedAt ?? e.at}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const who = approverOf(e);
+    const words = ownWords(e.reason);
+    events.push({
+      at: Date.parse(e.grantedAt ?? e.at),
+      kind: 'approval',
+      who,
+      text:
+        who === 'lead'
+          ? `The lead approved ${approvalWords(e.approval)}, within the limits you set${words ? `: ${words}` : '.'}`
+          : `You approved ${approvalWords(e.approval)}${words ? `: “${words}”` : '.'}`,
+    });
+  }
+  // Milestones finished: when the last of their stories merged.
+  for (const m of milestones) {
+    const mine = status.stories.filter((s) => s.milestone === m);
+    if (!mine.every((s) => s.state === 'done')) continue;
+    const last = Math.max(...mine.map((s) => times.find((t) => t.id === s.id)?.merged ?? 0));
+    if (last)
+      events.push({
+        at: last + 1,
+        kind: 'milestone',
+        text: `${m} was finished: all ${mine.length} of its stories merged.`,
+      });
+  }
+  // The request, its decisions, the spec and the switch-on come first, whatever the commits' times: work
+  // can start on a branch before the brief that asked for it is committed.
+  const ORDER = ['request', 'decision', 'spec', 'setup'];
+  const opening = events.filter((e) => ORDER.includes(e.kind));
+  const rest = events.filter((e) => !ORDER.includes(e.kind) && e.at);
+  const firstWork = rest.length ? Math.min(...rest.map((e) => e.at)) : Infinity;
+  const opened = opening
+    .filter((e) => e.at)
+    .sort((a, b) => ORDER.indexOf(a.kind) - ORDER.indexOf(b.kind) || a.at - b.at)
+    .map((e, n, all) => ({ ...e, at: Math.min(e.at, firstWork - (all.length - n)) }));
+  return [...opened, ...rest.sort((a, b) => a.at - b.at)];
+}

package/hooks/lib/loop-state.mjs

@@ -0,0 +1,26 @@
+// Whether the person has paused the lead loop (spec 05, LOOP-6), kept beside the merge queue so other
+// tools sharing the project can hold their own background work while it's paused. The mod records it
+// through the CLI; a session that starts begins unpaused.
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { projectWorktrees } from './rules.mjs';
+
+export const LOOP_FILE = '.claude/state/loop.json';
+
+const loopFile = (root) => join(projectWorktrees(root)[0] ?? root, LOOP_FILE);
+
+/** { paused, at }: not paused when nothing was recorded. */
+export function readLoop(root) {
+  try {
+    const state = JSON.parse(readFileSync(loopFile(root), 'utf8'));
+    return { paused: state?.paused === true, at: state?.at ?? null };
+  } catch {
+    return { paused: false, at: null };
+  }
+}
+
+export function writeLoop(root, paused, now = Date.now()) {
+  const file = loopFile(root);
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify({ paused, at: new Date(now).toISOString() })}\n`);
+}

package/hooks/lib/next.mjs

@@ -4,8 +4,9 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join, posix } from 'node:path';
-import { loadConfig } from './config.mjs';
+import { loadConfig, mergeDelegation } from './config.mjs';
 import { buildStatus, readStories, LEAD } from './plan.mjs';
+import { readQueue, waiting } from './queue.mjs';
 
 export const DRAFT_FILE = '.claude/code-kit.draft.json';
 export const BRIEF_STATES = ['framed', 'explored', 'scoped', 'specified', 'planned', 'ready'];
@@ -52,7 +53,8 @@ const hasMarkdown = (dir) => {
 
 /**
  * { step, why, args, then, attention }. `step` is a skill (spec-design, init, check, dispatch,
- * review), `wait` (lanes are building) or `done`. `base(config)` resolves the branch lanes merge into.
+ * review), `merge` (the head of the merge queue, where the lead merges), `wait` (lanes are
+ * building) or `done`. `base(config)` resolves the branch lanes merge into.
  */
 export function nextStep(root, base) {
   const attention = [];
@@ -149,7 +151,12 @@ export function nextStep(root, base) {
       `The plan's status lines are out of date for ${status.drift.map((d) => d.story).join(', ')}.`,
     );
 
-  const ids = (state) => status.stories.filter((s) => s.state === state).map((s) => s.id);
+  // A branch already in the merge queue has passed its review: it isn't reviewed again.
+  const queued = waiting(readQueue(root)).map((e) => e.branch);
+  const ids = (state) =>
+    status.stories
+      .filter((s) => s.state === state && !(state === 'review' && queued.includes(s.branch)))
+      .map((s) => s.id);
   const [review, building, blocked, fixes] = ['review', 'in progress', 'blocked', 'sent back'].map(
     ids,
   );
@@ -168,6 +175,25 @@ export function nextStep(root, base) {
     attention.push(
       `${unbuildable.join(', ')} can't be dispatched until the plan's gaps are fixed.`,
     );
+  // The merge queue (spec 09): branches the lead's review passed. Under autonomy, where the base's
+  // committed rules delegate merges, the lead merges the head first, so dependents see it; otherwise
+  // the person does, and always the first merge, which brings code-kit's rules onto the base.
+  const delegation = queued.length ? mergeDelegation(root, config) : { delegated: false };
+  const leadMerges = delegation.delegated && config.harness.autonomy === 'autonomous';
+  if (queued.length && delegation.first)
+    attention.push(
+      `${queued[0]} passed review and is next to merge. ${delegation.into} has no code-kit config committed yet, so this first merge, which brings the rules onto it, is the person's (code-kit queue merge --person, or Merge in the code-kit band); after it, the lead merges.`,
+    );
+  else if (queued.length && !leadMerges)
+    attention.push(
+      `${queued.join(', ')} passed review and ${queued.length === 1 ? 'waits' : 'wait'} for the person to merge (code-kit queue merge --person, or Merge in the code-kit band).`,
+    );
+  if (queued.length && leadMerges)
+    return result(
+      'merge',
+      `${queued[0]} passed review and is next in the merge queue${queued.length > 1 ? ` (then ${queued.slice(1).join(', ')})` : ''}.`,
+      { args: queued[0] },
+    );
   const then = [];
   // A sent-back story goes back to its lane with the review's findings, before new work starts.
   const toDispatch = [...fixes, ...ready];
@@ -211,6 +237,11 @@ export function nextStep(root, base) {
       'spec-design',
       `${blocked.join(', ')} wait on stories that can't finish: the plan has a dependency cycle or a missing story.`,
     );
+  if (queued.length)
+    return result(
+      'wait',
+      `${queued.join(', ')} ${queued.length === 1 ? 'waits' : 'wait'} to be merged.`,
+    );
   return result(
     'done',
     `All ${status.stories.length} stories are done; spec-design plans the next milestone or feature.`,

package/hooks/lib/plan.mjs

@@ -47,12 +47,18 @@ const field = (lines, name) =>
     .find(Boolean)?.[1]
     .trim() ?? '';
 
-/** Every story in the plan: [{ id, title, lane, requirements, dependsOn, status }]. */
+/**
+ * Every story in the plan: [{ id, title, lane, requirements, dependsOn, status, milestone }]. A story's
+ * milestone is the `## ` heading above it ("Milestone 5: Your own key"), or null.
+ */
 export function readStories(root, planPath) {
   const stories = [];
   for (const file of markdownFiles(root, planPath)) {
     const lines = readFileSync(join(root, file), 'utf8').split('\n');
+    let milestone = null;
     lines.forEach((line, i) => {
+      const heading = line.match(/^##\s+(.+?)\s*$/);
+      if (heading) milestone = heading[1];
       const m = line.match(STORY_HEADING);
       if (!m) return;
       const end = lines.findIndex((l, j) => j > i && /^#{1,3}\s/.test(l));
@@ -67,6 +73,7 @@ export function readStories(root, planPath) {
         noRequirements: /^none\b/i.test(field(body, 'Requirements')),
         dependsOn: [...field(body, 'Depends on').matchAll(/\bST-\d+\b/g)].map((r) => r[0]),
         status: STATES.includes(status) ? status : 'todo',
+        milestone,
       });
     });
   }
@@ -221,3 +228,32 @@ export function buildStatus(root, config, base, files) {
     .map((s) => ({ story: s.id, plan: s.status, actual: s.state }));
   return { stories, requirements: byRequirement, problems, drift };
 }
+
+/**
+ * The rows of a spec-check report's table (skills/spec-check): [{ requirement, status, where, note }],
+ * the first column's requirement id, the status as written (done, partial, missing or conflicts).
+ */
+export function specCheckRows(text) {
+  const lines = String(text).split('\n');
+  const head = lines.findIndex((l) => /^\s*\|\s*Requirement\s*\|/i.test(l));
+  if (head < 0) return [];
+  const rows = [];
+  for (const line of lines.slice(head + 1)) {
+    if (!/^\s*\|/.test(line)) break;
+    const cells = line
+      .trim()
+      .replace(/^\||\|$/g, '')
+      .split('|')
+      .map((c) => c.trim());
+    if (cells.every((c) => /^:?-+:?$/.test(c) || c === '')) continue;
+    const [requirement = '', status = '', where = '', note = ''] = cells;
+    rows.push({
+      requirement: requirement.match(REQUIREMENT_ID)?.[0] ?? requirement,
+      status: status.toLowerCase(),
+      where,
+      note,
+    });
+  }
+  return rows;
+}
+const REQUIREMENT_ID = /\b[A-Z][A-Z0-9]*-\d+\b/;

package/hooks/lib/queue.mjs

@@ -0,0 +1,75 @@
+// The merge queue (docs/specs/09-merge-queue.md): branches that passed the lead's review, merged one at
+// a time in the order they passed, each verified against the base as it is then. Kept in the main
+// checkout, beside the requests and reviews, so every worktree and a restarted session see the same.
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { projectWorktrees } from './rules.mjs';
+
+export const QUEUE_FILE = '.claude/state/merge-queue.json';
+/** Merged and sent-back entries kept for the pane, newest last. */
+const DONE_KEPT = 20;
+
+const queueFile = (root) => join(projectWorktrees(root)[0] ?? root, QUEUE_FILE);
+
+/** The queue's entries: [{ branch, passed, state, at?, reason? }], waiting ones in merge order. */
+export function readQueue(root) {
+  try {
+    const entries = JSON.parse(readFileSync(queueFile(root), 'utf8'));
+    return Array.isArray(entries) ? entries.filter((e) => e && typeof e.branch === 'string') : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeQueue(root, entries) {
+  const done = entries.filter((e) => !['waiting', 'merging'].includes(e.state));
+  const kept = [
+    ...done.slice(-DONE_KEPT),
+    ...entries.filter((e) => ['waiting', 'merging'].includes(e.state)),
+  ];
+  const file = queueFile(root);
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(kept, null, 2)}\n`);
+}
+
+/** The branches still to merge, in order (MQ-1). */
+export const waiting = (entries) => entries.filter((e) => ['waiting', 'merging'].includes(e.state));
+
+/** Adds a branch the lead's review passed, at the back; a branch already waiting keeps its place. */
+export function enqueue(root, branch, now = Date.now()) {
+  const entries = readQueue(root);
+  if (waiting(entries).some((e) => e.branch === branch)) return false;
+  writeQueue(root, [
+    ...entries.filter((e) => e.branch !== branch),
+    { branch, passed: new Date(now).toISOString(), state: 'waiting' },
+  ]);
+  return true;
+}
+
+/** Takes a waiting branch out of the queue. */
+export function dequeue(root, branch) {
+  const entries = readQueue(root);
+  if (!waiting(entries).some((e) => e.branch === branch)) return false;
+  writeQueue(
+    root,
+    entries.filter((e) => !(e.branch === branch && ['waiting', 'merging'].includes(e.state))),
+  );
+  return true;
+}
+
+/** Sets a waiting branch's state: merging, merged, sent back (with why), or waiting again. */
+export function settle(root, branch, state, reason = null, now = Date.now()) {
+  const entries = readQueue(root).map((e) =>
+    e.branch === branch && ['waiting', 'merging'].includes(e.state)
+      ? { ...e, state, at: new Date(now).toISOString(), ...(reason ? { reason } : {}) }
+      : e,
+  );
+  // Merged and sent-back entries move behind the waiting ones' history, in the order they settled.
+  const settled = entries.filter((e) => e.branch === branch && e.state === state);
+  writeQueue(root, [...entries.filter((e) => !settled.includes(e)), ...settled]);
+}
+
+/** The branch merged last, for a send-back's reason ("conflicts with main after web/st-4"). */
+export function lastMerged(entries) {
+  return [...entries].reverse().find((e) => e.state === 'merged')?.branch ?? null;
+}

package/hooks/lib/reviews.mjs

@@ -37,3 +37,21 @@ export function sentBack(root) {
   }
   return found;
 }
+
+/** Every send-back recorded, oldest first: [{ at, branch, sha, reason }]. */
+export function sendBacks(root) {
+  let lines = [];
+  try {
+    lines = readFileSync(reviewsFile(root), 'utf8').split('\n').filter(Boolean);
+  } catch {
+    return [];
+  }
+  return lines.flatMap((line) => {
+    try {
+      const r = JSON.parse(line);
+      return r.verdict === 'sent back' && r.branch ? [r] : [];
+    } catch {
+      return [];
+    }
+  });
+}

package/hooks/lib/rules.mjs

@@ -2,7 +2,8 @@
 //
 // Actors:
 // - a lane agent (its agent_type is a lane's "agent") writes only that lane's paths;
-// - any other subagent (research, planning, review) is read-only;
+// - any other subagent (research, planning, review) is read-only, but for the paths any actor may write
+//   (a card or a decision it records, code-kit's own state);
 // - the main session in a worktree with a .lane file acts as that lane (a person running a lane);
 // - the main session otherwise is the lead, who writes the lead's paths and delegates the rest.
 // Protected paths are recorded in the approval log whenever they are committed; only the lead may
@@ -219,8 +220,9 @@ function ownedPaths(actor, config) {
 
 /** Whether `rel` is the actor's own to write: its paths, or the paths any actor may write. */
 export function owns(actor, rel, config) {
-  if (actor.kind === 'readonly') return false;
+  // The paths any actor may write are a read-only agent's too: a card or a decision it records.
   if (matchesAny(rel, config.anyActor)) return true;
+  if (actor.kind === 'readonly') return false;
   const excluded = actor.kind === 'lane' ? config.lanes[actor.lane]?.exclude : [];
   return matchesAny(rel, ownedPaths(actor, config)) && !matchesAny(rel, excluded);
 }
@@ -408,8 +410,10 @@ export function protectedEntry(rel, config) {
   return config.protected.find((p) => globToRegExp(p.glob).test(rel));
 }
 
+/** Files that may hold secrets. An env file's template (`.env.example`, `.env.local.sample`) names
+ * the variables without their values, so it's committed like any other file. */
 export const SECRETS = (rel) =>
-  /(^|\/)\.env(\.|$)/.test(rel) ||
+  (/(^|\/)\.env(\.|$)/.test(rel) && !/\.(example|sample|template|dist)$/.test(rel)) ||
   /(^|\/)secrets?\//.test(rel) ||
   /\.(pem|p8|p12|keystore|jks)$/.test(rel);
 
@@ -436,8 +440,8 @@ export function writeProblem(actor, rel, root, config) {
     recordRequest(root, actor, guarded.approval, rel, guarded.why);
     return `${rel} is ${guarded.why} and needs a person's approval. Ask the lead (a person) to run\n${approvalHowTo(guarded.approval, actor, root, undefined, config)}`;
   }
-  if (actor.kind === 'readonly') return `${actor.label} is read-only; it may not write ${rel}.`;
   if (matchesAny(rel, config.anyActor)) return null;
+  if (actor.kind === 'readonly') return `${actor.label} is read-only; it may not write ${rel}.`;
   if (!owns(actor, rel, config)) return ownershipProblem(actor, rel, config);
   const specs = actor.kind === 'lane' && config.docs?.specs;
   return (specs && specCheckProblem(rel, root)) || screenProblem(rel, root, config);

package/hooks/lib/shell.mjs

@@ -33,7 +33,7 @@ export function maskQuotes(text) {
       } else if (c === quote) {
         quote = null;
         out += c;
-      } else out += c === '\n' ? '\n' : '_';
+      } else out += '_'; // a newline inside quotes too: it ends no command
     } else if (c === '\\' && i + 1 < text.length) {
       out += '__';
       i++;