crewly 1.5.8 → 1.5.9

package/config/skills/_common/lib.sh

@@ -7,6 +7,53 @@
 # Base URL for the Crewly backend API
 CREWLY_API_URL="${CREWLY_API_URL:-http://localhost:8787}"
 
+# -----------------------------------------------------------------------------
+# read_json_input [arg]
+#
+# Reads JSON input from either:
+#   1. The provided command-line argument ($1)
+#   2. A file path prefixed with @ (e.g. @/tmp/input.json)
+#   3. Standard input (stdin) — for piped or heredoc usage
+#
+# This solves Gemini CLI's run_shell_command escaping issues (#292, #293):
+# special characters in JSON (parentheses, quotes, newlines) are mangled
+# when passed as shell arguments. Piping via stdin bypasses shell parsing.
+#
+# Usage in skill scripts:
+#   INPUT=$(read_json_input "${1:-}")
+# -----------------------------------------------------------------------------
+read_json_input() {
+  local arg="${1:-}"
+
+  # Option 1: Direct argument provided (non-empty)
+  if [ -n "$arg" ]; then
+    # Support @filepath syntax: read JSON from file
+    if [[ "$arg" == @* ]]; then
+      local filepath="${arg:1}"
+      if [ -f "$filepath" ]; then
+        cat "$filepath"
+      else
+        echo '{}' >&2
+        echo "File not found: $filepath" >&2
+        return 1
+      fi
+    else
+      printf '%s' "$arg"
+    fi
+    return 0
+  fi
+
+  # Option 2: Read from stdin (pipe or heredoc)
+  if [ ! -t 0 ]; then
+    cat
+    return 0
+  fi
+
+  # Option 3: No input available
+  echo ''
+  return 0
+}
+
 # -----------------------------------------------------------------------------
 # api_call METHOD endpoint [json_body]
 #

package/config/skills/agent/core/accept-task/execute.sh

@@ -4,15 +4,15 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"dev-1\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"dev-1\"}' or echo '{...}' | execute.sh"
 
-SESSION_NAME=$(echo "$INPUT" | jq -r '.sessionName // empty')
+SESSION_NAME=$(printf '%s' "$INPUT" | jq -r '.sessionName // empty')
 require_param "sessionName" "$SESSION_NAME"
 
-TEAM_MEMBER_ID=$(echo "$INPUT" | jq -r '.teamMemberId // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
-TASK_GROUP=$(echo "$INPUT" | jq -r '.taskGroup // empty')
+TEAM_MEMBER_ID=$(printf '%s' "$INPUT" | jq -r '.teamMemberId // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
+TASK_GROUP=$(printf '%s' "$INPUT" | jq -r '.taskGroup // empty')
 
 BODY=$(jq -n \
   --arg sessionName "$SESSION_NAME" \

package/config/skills/agent/core/get-my-context/execute.sh

@@ -4,12 +4,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"agentRole\":\"developer\",\"projectPath\":\"/projects/app\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"agentRole\":\"developer\",\"projectPath\":\"...\"}' or echo '{...}' | execute.sh"
 
-AGENT_ID=$(echo "$INPUT" | jq -r '.agentId // empty')
-AGENT_ROLE=$(echo "$INPUT" | jq -r '.agentRole // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
+AGENT_ID=$(printf '%s' "$INPUT" | jq -r '.agentId // empty')
+AGENT_ROLE=$(printf '%s' "$INPUT" | jq -r '.agentRole // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
 require_param "agentId" "$AGENT_ID"
 require_param "agentRole" "$AGENT_ROLE"
 require_param "projectPath" "$PROJECT_PATH"

package/config/skills/agent/core/get-my-tasks/execute.sh

@@ -4,11 +4,11 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"crewly-product-sam-xxxx\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"...\",\"projectPath\":\"...\"}' or echo '{...}' | execute.sh"
 
-SESSION_NAME=$(echo "$INPUT" | jq -r '.sessionName // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
+SESSION_NAME=$(printf '%s' "$INPUT" | jq -r '.sessionName // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
 require_param "sessionName" "$SESSION_NAME"
 require_param "projectPath" "$PROJECT_PATH"
 

package/config/skills/agent/core/recall/execute.sh

@@ -4,16 +4,16 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"context\":\"authentication patterns\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"context\":\"...\"}' or echo '{...}' | execute.sh"
 
-AGENT_ID=$(echo "$INPUT" | jq -r '.agentId // empty')
-CONTEXT=$(echo "$INPUT" | jq -r '.context // empty')
+AGENT_ID=$(printf '%s' "$INPUT" | jq -r '.agentId // empty')
+CONTEXT=$(printf '%s' "$INPUT" | jq -r '.context // empty')
 require_param "agentId" "$AGENT_ID"
 require_param "context" "$CONTEXT"
 
 # Build body with required and optional fields
-BODY=$(echo "$INPUT" | jq '{
+BODY=$(printf '%s' "$INPUT" | jq '{
   agentId: .agentId,
   context: .context
 } +

package/config/skills/agent/core/record-learning/execute.sh

@@ -4,20 +4,20 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"agentRole\":\"developer\",\"projectPath\":\"/projects/app\",\"learning\":\"Jest mock resets are needed between tests\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"agentRole\":\"developer\",\"projectPath\":\"...\",\"learning\":\"...\"}' or echo '{...}' | execute.sh"
 
-AGENT_ID=$(echo "$INPUT" | jq -r '.agentId // empty')
-AGENT_ROLE=$(echo "$INPUT" | jq -r '.agentRole // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
-LEARNING=$(echo "$INPUT" | jq -r '.learning // empty')
+AGENT_ID=$(printf '%s' "$INPUT" | jq -r '.agentId // empty')
+AGENT_ROLE=$(printf '%s' "$INPUT" | jq -r '.agentRole // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
+LEARNING=$(printf '%s' "$INPUT" | jq -r '.learning // empty')
 require_param "agentId" "$AGENT_ID"
 require_param "agentRole" "$AGENT_ROLE"
 require_param "projectPath" "$PROJECT_PATH"
 require_param "learning" "$LEARNING"
 
 # Build body with required and optional fields
-BODY=$(echo "$INPUT" | jq '{
+BODY=$(printf '%s' "$INPUT" | jq '{
   agentId: .agentId,
   agentRole: .agentRole,
   projectPath: .projectPath,

package/config/skills/agent/core/register-self/execute.sh

@@ -4,18 +4,18 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"role\":\"developer\",\"sessionName\":\"dev-1\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"role\":\"developer\",\"sessionName\":\"dev-1\"}' or echo '{...}' | execute.sh"
 
 # Accept both canonical (role/sessionName) and legacy (agentRole/agentId) parameter names
-ROLE=$(echo "$INPUT" | jq -r '.role // .agentRole // empty')
-SESSION_NAME=$(echo "$INPUT" | jq -r '.sessionName // .agentId // empty')
+ROLE=$(printf '%s' "$INPUT" | jq -r '.role // .agentRole // empty')
+SESSION_NAME=$(printf '%s' "$INPUT" | jq -r '.sessionName // .agentId // empty')
 require_param "role" "$ROLE"
 require_param "sessionName" "$SESSION_NAME"
 
 # Optional: claudeSessionId for resume support
-CLAUDE_SESSION_ID=$(echo "$INPUT" | jq -r '.claudeSessionId // empty')
-TEAM_MEMBER_ID=$(echo "$INPUT" | jq -r '.teamMemberId // empty')
+CLAUDE_SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.claudeSessionId // empty')
+TEAM_MEMBER_ID=$(printf '%s' "$INPUT" | jq -r '.teamMemberId // empty')
 
 BODY=$(jq -n \
   --arg role "$ROLE" \

package/config/skills/agent/core/remember/execute.sh

@@ -4,26 +4,26 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"content\":\"The auth module uses JWT\",\"category\":\"architecture\",\"scope\":\"project\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"agentId\":\"dev-1\",\"content\":\"...\",\"category\":\"...\",\"scope\":\"...\"}' or echo '{...}' | execute.sh"
 
-AGENT_ID=$(echo "$INPUT" | jq -r '.agentId // empty')
-CONTENT=$(echo "$INPUT" | jq -r '.content // empty')
-CATEGORY=$(echo "$INPUT" | jq -r '.category // empty')
-SCOPE=$(echo "$INPUT" | jq -r '.scope // empty')
+AGENT_ID=$(printf '%s' "$INPUT" | jq -r '.agentId // empty')
+CONTENT=$(printf '%s' "$INPUT" | jq -r '.content // empty')
+CATEGORY=$(printf '%s' "$INPUT" | jq -r '.category // empty')
+SCOPE=$(printf '%s' "$INPUT" | jq -r '.scope // empty')
 require_param "agentId" "$AGENT_ID"
 require_param "content" "$CONTENT"
 require_param "category" "$CATEGORY"
 require_param "scope" "$SCOPE"
 
 # #187: Auto-inject projectPath from CREWLY_PROJECT_PATH env var when not provided
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
 if [ -z "$PROJECT_PATH" ] && [ -n "${CREWLY_PROJECT_PATH:-}" ]; then
-  INPUT=$(echo "$INPUT" | jq --arg pp "$CREWLY_PROJECT_PATH" '. + {projectPath: $pp}')
+  INPUT=$(printf '%s' "$INPUT" | jq --arg pp "$CREWLY_PROJECT_PATH" '. + {projectPath: $pp}')
 fi
 
 # Build body with required and optional fields
-BODY=$(echo "$INPUT" | jq '{
+BODY=$(printf '%s' "$INPUT" | jq '{
   agentId: .agentId,
   content: .content,
   category: .category,

package/config/skills/agent/core/report-status/execute.sh

@@ -4,23 +4,23 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"dev-1\",\"status\":\"done\",\"summary\":\"Finished implementing auth module\",\"taskPath\":\"/path/to/task.md\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"dev-1\",\"status\":\"done\",\"summary\":\"...\"}' or echo '{...}' | execute.sh"
 
-SESSION_NAME=$(echo "$INPUT" | jq -r '.sessionName // empty')
-STATUS=$(echo "$INPUT" | jq -r '.status // empty')
-SUMMARY=$(echo "$INPUT" | jq -r '.summary // empty')
-TASK_PATH=$(echo "$INPUT" | jq -r '.taskPath // empty')
+SESSION_NAME=$(printf '%s' "$INPUT" | jq -r '.sessionName // empty')
+STATUS=$(printf '%s' "$INPUT" | jq -r '.status // empty')
+SUMMARY=$(printf '%s' "$INPUT" | jq -r '.summary // empty')
+TASK_PATH=$(printf '%s' "$INPUT" | jq -r '.taskPath // empty')
 require_param "sessionName" "$SESSION_NAME"
 require_param "status" "$STATUS"
 require_param "summary" "$SUMMARY"
 
 # Optional structured StatusReport fields (for hierarchical workflows)
-TASK_ID=$(echo "$INPUT" | jq -r '.taskId // empty')
-PROGRESS=$(echo "$INPUT" | jq -r '.progress // empty')
-ARTIFACTS=$(echo "$INPUT" | jq -c '.artifacts // empty')
-BLOCKERS=$(echo "$INPUT" | jq -c '.blockers // empty')
-USE_STRUCTURED=$(echo "$INPUT" | jq -r '.structured // "false"')
+TASK_ID=$(printf '%s' "$INPUT" | jq -r '.taskId // empty')
+PROGRESS=$(printf '%s' "$INPUT" | jq -r '.progress // empty')
+ARTIFACTS=$(printf '%s' "$INPUT" | jq -c '.artifacts // empty')
+BLOCKERS=$(printf '%s' "$INPUT" | jq -c '.blockers // empty')
+USE_STRUCTURED=$(printf '%s' "$INPUT" | jq -r '.structured // "false"')
 
 # Map simple status strings to InProgressTaskStatus values
 map_status_to_state() {
@@ -93,6 +93,6 @@ fi
 # Use [COMPLETED] prefix so recall can distinguish completed tasks from other patterns.
 # This prevents PM from re-delegating tasks that were already done.
 if [ "$STATUS" = "done" ] && [ -n "$SUMMARY" ]; then
-  PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
+  PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
   auto_remember "$SESSION_NAME" "[COMPLETED] Task completed by ${SESSION_NAME}: ${SUMMARY}" "decision" "project" "$PROJECT_PATH"
 fi

package/config/skills/agent/core/send-message/execute.sh

@@ -1,15 +1,16 @@
 #!/bin/bash
-# Send a direct message to another agent's terminal session
+# Send a direct message to another agent's terminal session.
+# Supports: argument, stdin pipe, or @filepath for JSON input (#292, #293).
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"agent-session\",\"message\":\"Can you review my PR?\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"agent-session\",\"message\":\"...\"}' or echo '{...}' | execute.sh"
 
 # Accept both "to" and "sessionName" for compatibility (#231)
-TO=$(echo "$INPUT" | jq -r '.to // .sessionName // empty')
-MESSAGE=$(echo "$INPUT" | jq -r '.message // empty')
+TO=$(printf '%s' "$INPUT" | jq -r '.to // .sessionName // empty')
+MESSAGE=$(printf '%s' "$INPUT" | jq -r '.message // empty')
 require_param "to (or sessionName)" "$TO"
 require_param "message" "$MESSAGE"
 

package/config/skills/orchestrator/delegate-task/execute.sh

@@ -6,19 +6,19 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"agent-session\",\"task\":\"implement feature X\",\"priority\":\"high\",\"projectPath\":\"/path/to/project\",\"monitor\":{\"idleEvent\":true,\"fallbackCheckMinutes\":5}}'"
-
-TO=$(echo "$INPUT" | jq -r '.to // empty')
-TASK=$(echo "$INPUT" | jq -r '.task // empty')
-PRIORITY=$(echo "$INPUT" | jq -r '.priority // "normal"')
-CONTEXT=$(echo "$INPUT" | jq -r '.context // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"agent-session\",\"task\":\"...\"}' or echo '{...}' | execute.sh"
+
+TO=$(printf '%s' "$INPUT" | jq -r '.to // empty')
+TASK=$(printf '%s' "$INPUT" | jq -r '.task // empty')
+PRIORITY=$(printf '%s' "$INPUT" | jq -r '.priority // "normal"')
+CONTEXT=$(printf '%s' "$INPUT" | jq -r '.context // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
 # #150: Task type classification — 'technical' tasks can bypass PM routing
-TASK_TYPE=$(echo "$INPUT" | jq -r '.taskType // "general"')
+TASK_TYPE=$(printf '%s' "$INPUT" | jq -r '.taskType // "general"')
 # #180: Cross-team validation
-TEAM_ID=$(echo "$INPUT" | jq -r '.teamId // empty')
-FORCE_CROSS_TEAM=$(echo "$INPUT" | jq -r '.forceCrossTeam // "false"')
+TEAM_ID=$(printf '%s' "$INPUT" | jq -r '.teamId // empty')
+FORCE_CROSS_TEAM=$(printf '%s' "$INPUT" | jq -r '.forceCrossTeam // "false"')
 require_param "to" "$TO"
 require_param "task" "$TASK"
 
@@ -47,18 +47,18 @@ if [ "$TASK_TYPE" = "technical" ] && [ -n "$TEAM_ID" ]; then
 fi
 
 # Structured message parameters (for hierarchical teams)
-TITLE=$(echo "$INPUT" | jq -r '.title // empty')
-PARENT_TASK_ID=$(echo "$INPUT" | jq -r '.parentTaskId // empty')
-EXPECTED_ARTIFACTS=$(echo "$INPUT" | jq -c '.expectedArtifacts // empty')
-CONTEXT_FILES=$(echo "$INPUT" | jq -c '.contextFiles // empty')
-DEADLINE_HINT=$(echo "$INPUT" | jq -r '.deadlineHint // empty')
-USE_STRUCTURED=$(echo "$INPUT" | jq -r '.structured // "false"')
+TITLE=$(printf '%s' "$INPUT" | jq -r '.title // empty')
+PARENT_TASK_ID=$(printf '%s' "$INPUT" | jq -r '.parentTaskId // empty')
+EXPECTED_ARTIFACTS=$(printf '%s' "$INPUT" | jq -c '.expectedArtifacts // empty')
+CONTEXT_FILES=$(printf '%s' "$INPUT" | jq -c '.contextFiles // empty')
+DEADLINE_HINT=$(printf '%s' "$INPUT" | jq -r '.deadlineHint // empty')
+USE_STRUCTURED=$(printf '%s' "$INPUT" | jq -r '.structured // "false"')
 
 # Monitor parameters — enabled by default to ensure proactive progress notifications.
 # Use explicit null-check so that `false` / `0` are respected as opt-out values,
 # while omitted fields default to enabled (idleEvent=true, fallbackCheckMinutes=5).
-MONITOR_IDLE=$(echo "$INPUT" | jq -r 'if .monitor.idleEvent == null then true else .monitor.idleEvent end')
-MONITOR_FALLBACK_MINUTES=$(echo "$INPUT" | jq -r 'if .monitor.fallbackCheckMinutes == null then 5 else .monitor.fallbackCheckMinutes end')
+MONITOR_IDLE=$(printf '%s' "$INPUT" | jq -r 'if .monitor.idleEvent == null then true else .monitor.idleEvent end')
+MONITOR_FALLBACK_MINUTES=$(printf '%s' "$INPUT" | jq -r 'if .monitor.fallbackCheckMinutes == null then 5 else .monitor.fallbackCheckMinutes end')
 
 # Resolve Crewly root from this script path:
 # config/skills/orchestrator/delegate-task/execute.sh -> project root

package/config/skills/orchestrator/send-message/execute.sh

@@ -1,15 +1,16 @@
 #!/bin/bash
-# Send a message to an agent's terminal session
+# Send a message to an agent's terminal session.
+# Supports: argument, stdin pipe, or @filepath for JSON input (#292, #293).
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"agent-session\",\"message\":\"hello\"}'"
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"sessionName\":\"agent-session\",\"message\":\"hello\"}' or echo '{...}' | execute.sh"
 
-SESSION_NAME=$(echo "$INPUT" | jq -r '.sessionName // empty')
-MESSAGE=$(echo "$INPUT" | jq -r '.message // empty')
-FORCE=$(echo "$INPUT" | jq -r '.force // empty')
+SESSION_NAME=$(printf '%s' "$INPUT" | jq -r '.sessionName // empty')
+MESSAGE=$(printf '%s' "$INPUT" | jq -r '.message // empty')
+FORCE=$(printf '%s' "$INPUT" | jq -r '.force // empty')
 require_param "sessionName" "$SESSION_NAME"
 require_param "message" "$MESSAGE"
 

package/config/skills/team-leader/delegate-task/execute.sh

@@ -6,17 +6,17 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../_common/lib.sh"
 
-INPUT="${1:-}"
-[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"worker-session\",\"task\":\"implement feature X\",\"priority\":\"high\",\"teamId\":\"team-123\",\"tlMemberId\":\"tl-member-id\",\"projectPath\":\"/path/to/project\"}'"
-
-TO=$(echo "$INPUT" | jq -r '.to // empty')
-TASK=$(echo "$INPUT" | jq -r '.task // empty')
-PRIORITY=$(echo "$INPUT" | jq -r '.priority // "normal"')
-CONTEXT=$(echo "$INPUT" | jq -r '.context // empty')
-PROJECT_PATH=$(echo "$INPUT" | jq -r '.projectPath // empty')
-TEAM_ID=$(echo "$INPUT" | jq -r '.teamId // empty')
-TL_MEMBER_ID=$(echo "$INPUT" | jq -r '.tlMemberId // empty')
-FROM_SESSION=$(echo "$INPUT" | jq -r '.fromSession // empty')
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"to\":\"worker-session\",\"task\":\"...\"}' or echo '{...}' | execute.sh"
+
+TO=$(printf '%s' "$INPUT" | jq -r '.to // empty')
+TASK=$(printf '%s' "$INPUT" | jq -r '.task // empty')
+PRIORITY=$(printf '%s' "$INPUT" | jq -r '.priority // "normal"')
+CONTEXT=$(printf '%s' "$INPUT" | jq -r '.context // empty')
+PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
+TEAM_ID=$(printf '%s' "$INPUT" | jq -r '.teamId // empty')
+TL_MEMBER_ID=$(printf '%s' "$INPUT" | jq -r '.tlMemberId // empty')
+FROM_SESSION=$(printf '%s' "$INPUT" | jq -r '.fromSession // empty')
 require_param "to" "$TO"
 require_param "task" "$TASK"
 
@@ -93,8 +93,8 @@ if [ -n "$PROJECT_PATH" ]; then
 fi
 
 # Set up idle event subscription for TL monitoring
-MONITOR_IDLE=$(echo "$INPUT" | jq -r 'if .monitor.idleEvent == null then true else .monitor.idleEvent end')
-MONITOR_FALLBACK_MINUTES=$(echo "$INPUT" | jq -r 'if .monitor.fallbackCheckMinutes == null then 5 else .monitor.fallbackCheckMinutes end')
+MONITOR_IDLE=$(printf '%s' "$INPUT" | jq -r 'if .monitor.idleEvent == null then true else .monitor.idleEvent end')
+MONITOR_FALLBACK_MINUTES=$(printf '%s' "$INPUT" | jq -r 'if .monitor.fallbackCheckMinutes == null then 5 else .monitor.fallbackCheckMinutes end')
 
 COLLECTED_SCHEDULE_IDS="[]"
 COLLECTED_SUBSCRIPTION_IDS="[]"

package/dist/backend/backend/src/controllers/monitoring/terminal.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/monitoring/terminal.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAa5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAW9C;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BrF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C9E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA0J/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFlF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFhF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwD5E;AAiCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwNjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8D/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFjG"}
+{"version":3,"file":"terminal.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/monitoring/terminal.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAa5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiC9C;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BrF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C9E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA4J/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFlF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFhF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwD5E;AAiCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAyNjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8D/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFjG"}

package/dist/backend/backend/src/controllers/monitoring/terminal.controller.js

@@ -18,6 +18,26 @@ import { readFile } from 'fs/promises';
 import { PtySessionBackend } from '../../services/session/pty/pty-session-backend.js';
 import { InProcessLogBuffer } from '../../services/agent/crewly-agent/in-process-log-buffer.js';
 import { ADAPTIVE_HEARTBEAT_DEFAULTS } from '../../services/agent/adaptive-heartbeat.service.js';
+/**
+ * Bracketed paste mode markers.
+ * Wrapping terminal input in these markers tells TUI applications (Gemini CLI,
+ * Codex CLI, etc.) to treat the content as pasted text rather than typed input.
+ * This prevents special shell characters like (), $, `, etc. from triggering
+ * shell mode or being interpreted as key sequences (#293).
+ */
+const BRACKETED_PASTE_START = '\x1b[200~';
+const BRACKETED_PASTE_END = '\x1b[201~';
+/**
+ * Wrap a message in bracketed paste mode markers for safe delivery to TUI terminals.
+ * This ensures parentheses, quotes, dollar signs, and other shell metacharacters
+ * are treated as literal text by the receiving terminal application (#292, #293).
+ *
+ * @param text - The raw message text
+ * @returns The text wrapped in bracketed paste markers
+ */
+function wrapInBracketedPaste(text) {
+    return `${BRACKETED_PASTE_START}${text}${BRACKETED_PASTE_END}`;
+}
 /** Logger instance for terminal controller */
 const logger = LoggerService.getInstance().createComponentLogger('TerminalController');
 /**
@@ -316,8 +336,10 @@ export async function writeToSession(req, res) {
                     });
                 }
             }
-            // Two-step write: text first, then Enter separately
-            session.write(dataStr);
+            // Two-step write: text first (wrapped in bracketed paste), then Enter separately.
+            // Bracketed paste markers prevent TUI runtimes from interpreting special
+            // characters like (), $, ` as shell commands (#293).
+            session.write(wrapInBracketedPaste(dataStr));
             // Scale delay based on message length for TUI paste processing
             const enterDelay = Math.min(1000 + Math.ceil(dataStr.length / 10), 5000);
             await new Promise(resolve => setTimeout(resolve, enterDelay));
@@ -766,12 +788,13 @@ export async function deliverMessage(req, res) {
                 return;
             }
             // For TUI runtimes (Gemini CLI, Codex CLI), use two-step write:
-            // text first, then Enter separately. Bundling message+\r in a single
-            // write causes the \r to be consumed by bracketed paste mode (#130).
+            // text first (in bracketed paste mode), then Enter separately.
+            // Bracketed paste markers prevent TUI runtimes from interpreting
+            // special characters like (), $, ` as shell commands (#130, #293).
             const isTuiRuntime = resolvedRuntimeType &&
                 resolvedRuntimeType !== RUNTIME_TYPES.CLAUDE_CODE;
             if (isTuiRuntime) {
-                session.write(message);
+                session.write(wrapInBracketedPaste(message));
                 const enterDelay = Math.min(1000 + Math.ceil(message.length / 10), 5000);
                 await new Promise(resolve => setTimeout(resolve, enterDelay));
                 session.write('\r');
@@ -781,7 +804,7 @@ export async function deliverMessage(req, res) {
             else {
                 // Claude Code also benefits from two-step write: bundling message+\r
                 // in a single write can be swallowed by bracketed paste mode.
-                session.write(message);
+                session.write(wrapInBracketedPaste(message));
                 const ccEnterDelay = Math.min(1000 + Math.ceil(message.length / 10), 5000);
                 await new Promise(resolve => setTimeout(resolve, ccEnterDelay));
                 session.write('\r');