exonous 0.0.0-stage → 2.10.4

package/assets/machine/hooks/lib/paths.cjs

@@ -0,0 +1,99 @@
+'use strict';
+
+// Self-contained: copied to ~/.claude/exonous/hooks/lib/, node builtins only.
+const crypto = require('crypto');
+const fs = require('fs');
+const { homedir, devNull } = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+function home() {
+  return process.env.EXONOUS_HOME || homedir();
+}
+
+function claudeDir() {
+  return path.join(home(), '.claude');
+}
+
+function cursorDir() {
+  return path.join(home(), '.cursor');
+}
+
+function exoDir() {
+  return path.join(claudeDir(), 'exonous');
+}
+
+function stateDir() {
+  return path.join(exoDir(), 'state');
+}
+
+/** EXONOUS_HOME set and resolving somewhere other than the OS home. */
+function redirectedHome(env = process.env) {
+  if (!env.EXONOUS_HOME) return false;
+  try {
+    return fs.realpathSync(env.EXONOUS_HOME) !== fs.realpathSync(homedir());
+  } catch {
+    return true;
+  }
+}
+
+/** Test-only overrides (release source, pm shims) need EXONOUS_TEST=1 and a redirected home. */
+const testMode = (env = process.env) => env.EXONOUS_TEST === '1' && redirectedHome(env);
+
+/** Effective uid (tests may stub it in test mode); null where uids do not exist (Windows). */
+function currentUid(env = process.env) {
+  if (testMode(env) && /^\d+$/.test(env.EXONOUS_TEST_UID || '')) return Number(env.EXONOUS_TEST_UID);
+  return typeof process.getuid === 'function' ? process.getuid() : null;
+}
+
+/** Uid owning target when it differs from ours, else null: a root session must not leave root-owned files in a user's home. */
+function foreignOwner(target, env = process.env) {
+  const uid = currentUid(env);
+  if (uid === null) return null;
+  try {
+    const owner = fs.statSync(target).uid;
+    return owner === uid ? null : owner;
+  } catch {
+    return null;
+  }
+}
+
+/** Env for git calls in a repo under review: repo config must not run commands (fsmonitor, hooks). */
+function gitEnv(base = process.env) {
+  const env = { ...base, GIT_TERMINAL_PROMPT: '0' };
+  let n = Number.parseInt(env.GIT_CONFIG_COUNT || '0', 10);
+  if (!Number.isInteger(n) || n < 0) n = 0;
+  for (const [key, value] of [['core.fsmonitor', 'false'], ['core.hooksPath', devNull]]) {
+    env[`GIT_CONFIG_KEY_${n}`] = key;
+    env[`GIT_CONFIG_VALUE_${n}`] = value;
+    n += 1;
+  }
+  env.GIT_CONFIG_COUNT = String(n);
+  return env;
+}
+
+/** Read-only git query in cwd with the hardened env; null on failure. */
+function gitOut(cwd, args) {
+  try {
+    return execFileSync('git', ['--no-optional-locks', ...args], { cwd, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 15000 });
+  } catch {
+    return null;
+  }
+}
+
+/** Real path of the git toplevel containing cwd; throws outside a repo. */
+function repoRoot(cwd) {
+  let out;
+  try {
+    out = execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    throw new Error(`not inside a git repository: ${cwd}`);
+  }
+  return fs.realpathSync(out);
+}
+
+function repoKey(cwd) {
+  return crypto.createHash('sha1').update(repoRoot(cwd)).digest('hex');
+}
+
+module.exports = { home, claudeDir, cursorDir, exoDir, stateDir, redirectedHome, testMode, currentUid, foreignOwner, gitEnv, gitOut, repoRoot, repoKey };

package/assets/machine/hooks/lib/payload.cjs

@@ -0,0 +1,81 @@
+'use strict';
+
+// Per-tool hook stdin → { command, cwd }, and per-tool deny/allow output. Node builtins only.
+const ADAPTERS = ['claude', 'cursor', 'gemini', 'codex', 'windsurf', 'copilot', 'opencode'];
+const SAFE_WORD = /^[A-Za-z0-9_/.,:=@%+-]+$/;
+
+const isObject = (v) => Boolean(v) && typeof v === 'object' && !Array.isArray(v);
+
+function shellQuote(word) {
+  const text = String(word);
+  return SAFE_WORD.test(text) ? text : `'${text.replace(/'/g, `'"'"'`)}'`;
+}
+
+function asCommand(value) {
+  if (typeof value === 'string') return value;
+  if (Array.isArray(value) && value.length && value.every((w) => typeof w === 'string')) return value.map(shellQuote).join(' ');
+  return null;
+}
+
+function toolArgs(input) {
+  if (isObject(input.toolArgs)) return input.toolArgs;
+  if (typeof input.toolArgs !== 'string') return null;
+  try {
+    const parsed = JSON.parse(input.toolArgs);
+    return isObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// Shapes are tried in order for every adapter, so a tool that changes its payload still gets gated.
+function extractCommand(input) {
+  const sources = [input.tool_input, input.tool_info && { command: input.tool_info.command_line }, input, input.args, toolArgs(input)];
+  for (const source of sources) {
+    if (!isObject(source)) continue;
+    const command = asCommand(source.command);
+    if (command !== null) return command;
+  }
+  return null;
+}
+
+function extractCwd(input) {
+  const options = [input.tool_info && input.tool_info.cwd, input.cwd, Array.isArray(input.workspace_roots) ? input.workspace_roots[0] : null];
+  return options.find((c) => typeof c === 'string' && c) || process.cwd();
+}
+
+/** @returns {{ command: string, cwd: string } | null} null = not a shell call or unreadable: let it through. */
+function parse(adapter, raw) {
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isObject(input)) return null;
+  const command = extractCommand(input);
+  return command === null ? null : { command, cwd: extractCwd(input) };
+}
+
+/** @returns {{ code: number, stdout: string, stderr: string }} */
+function deny(adapter, reason) {
+  if (adapter === 'cursor') {
+    return { code: 2, stdout: JSON.stringify({ permission: 'deny', user_message: reason, agent_message: reason }), stderr: `${reason}\n` };
+  }
+  if (adapter === 'copilot') {
+    const decision = { permissionDecision: 'deny', permissionDecisionReason: reason };
+    return { code: 0, stdout: JSON.stringify({ ...decision, hookSpecificOutput: { hookEventName: 'PreToolUse', ...decision } }), stderr: '' };
+  }
+  return { code: 2, stdout: '', stderr: `${reason}\n` };
+}
+
+/** Warnings reach Claude's model as additionalContext; other tools get them on stderr. */
+function allow(adapter, warnings = []) {
+  const text = warnings.join('\n');
+  if (adapter === 'claude' && text) {
+    return { code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: text } }), stderr: '' };
+  }
+  return { code: 0, stdout: adapter === 'cursor' ? JSON.stringify({ permission: 'allow' }) : '', stderr: text ? `${text}\n` : '' };
+}
+
+module.exports = { ADAPTERS, parse, deny, allow, shellQuote };

package/assets/machine/hooks/lib/pr-template-validate.cjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+'use strict';
+
+// Required titles come from the resolved PR template; the size cap is fixed.
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { resolveTemplate } = require('./template.cjs');
+const { gitEnv } = require('./paths.cjs');
+
+const MAX_CHANGED_FILES = 30;
+
+function normalize(text) {
+  return text.normalize('NFC').toLowerCase();
+}
+
+function missingSections(text, sections) {
+  const haystack = normalize(text || '');
+  return sections.filter((section) => !haystack.includes(normalize(section)));
+}
+
+/** @param {{ path: string | null, sections: string[] }} [template] */
+function validateBodyContent(content, template = resolveTemplate()) {
+  const missing = missingSections(content, template.sections);
+  if (missing.length === 0) return { ok: true };
+  return {
+    ok: false,
+    reason: `PR body is missing: ${missing.join(', ')}. Follow ${template.path} — all ${template.sections.length} titles must appear (write N/A under a section that does not apply).`,
+  };
+}
+
+function validateBodyFile(filePath, cwd = process.cwd(), template = resolveTemplate(cwd)) {
+  const resolved = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+  if (!fs.existsSync(resolved)) {
+    return { ok: false, reason: `PR body file not found: ${filePath}.` };
+  }
+  return validateBodyContent(fs.readFileSync(resolved, 'utf8'), template);
+}
+
+function git(cwd, ...args) {
+  return execFileSync('git', args, { cwd, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+}
+
+// Pure moves (R100) cost no review, so only content changes count toward the size cap.
+function countContentChanges(nameStatus) {
+  return nameStatus.split('\n').filter((line) => line && !line.startsWith('R100')).length;
+}
+
+// Unknown base or missing refs → null; size gate must never block on git trouble.
+function countChangedFiles({ base: givenBase, head: givenHead }, cwd) {
+  try {
+    const base = givenBase || git(cwd, 'symbolic-ref', '--short', 'refs/remotes/origin/HEAD').replace(/^origin\//, '');
+    const head = givenHead || 'HEAD';
+    const headRef = head === 'HEAD' ? head : `origin/${head.replace(/^[^:]+:/, '')}`;
+    const out = git(cwd, 'diff', '--name-status', '-M100%', `origin/${base}...${headRef}`);
+    return countContentChanges(out);
+  } catch {
+    return null;
+  }
+}
+
+/** Last value given for each gh pr create option that matters here. */
+function prFields(parsed) {
+  const last = (name) => {
+    const opt = parsed.opts.filter((o) => o.name === name).pop();
+    return opt ? opt.value : null;
+  };
+  return { body: last('body'), bodyFile: last('body-file'), base: last('base'), head: last('head') };
+}
+
+/** @param {{ body: string | null, bodyFile: string | null, base: string | null, head: string | null }} fields */
+function validatePrCreate(fields, cwd = process.cwd()) {
+  const changed = countChangedFiles(fields, cwd);
+  if (changed !== null && changed > MAX_CHANGED_FILES) {
+    return {
+      ok: false,
+      reason: `PR has ${changed} changed files (max ${MAX_CHANGED_FILES}). Split it into smaller PRs, each with one cohesive goal (stack them if they depend on each other).`,
+    };
+  }
+  const template = resolveTemplate(cwd);
+  if (fields.bodyFile === '-') return { ok: false, reason: 'A PR body read from stdin cannot be checked; write it to a file and pass --body-file.' };
+  if (fields.bodyFile) return validateBodyFile(fields.bodyFile, cwd, template);
+  return validateBodyContent(fields.body || '', template);
+}
+
+function validateGhPrCreateCommand(command, cwd = process.cwd()) {
+  const { analyze } = require('./shell.cjs');
+  const { parseOptions, GH_PR_CREATE } = require('./cli-options.cjs');
+  const call = command ? analyze(command, cwd).calls.find((c) => c.kind === 'pr') : null;
+  if (!call) return { ok: false, reason: 'Not a gh pr create command.' };
+  const parsed = parseOptions(call.args, GH_PR_CREATE);
+  if (parsed.error) return { ok: false, reason: `Cannot read the gh pr create options: ${parsed.error}.` };
+  return validatePrCreate(prFields(parsed), call.cwd);
+}
+
+module.exports = {
+  MAX_CHANGED_FILES,
+  validateBodyContent,
+  validateBodyFile,
+  validateGhPrCreateCommand,
+  validatePrCreate,
+  prFields,
+};

package/assets/machine/hooks/lib/release.cjs

@@ -0,0 +1,58 @@
+'use strict';
+
+// Self-contained: copied to ~/.claude/exonous/hooks/lib/, node builtins only.
+const { execFileSync } = require('child_process');
+const { testMode } = require('./paths.cjs');
+
+const RELEASE_REF = /^v(\d+)\.(\d+)\.(\d+)$/;
+
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
+  return 0;
+}
+
+const releaseSource = (url) => (testMode() && process.env.EXONOUS_RELEASE_SOURCE) || url;
+
+/**
+ * Every vX.Y.Z tag on the source, oldest first; sha is the commit (annotated tags are peeled).
+ * @param {string} url
+ * @returns {{ version: string, parts: number[], sha: string }[]}
+ */
+function listReleases(url) {
+  const source = releaseSource(url);
+  const out = execFileSync('git', ['ls-remote', '--tags', '--', source, 'v*'], {
+    encoding: 'utf8',
+    timeout: 30000,
+    stdio: ['ignore', 'pipe', 'ignore'],
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+  });
+  const tags = new Map();
+  for (const line of out.split('\n')) {
+    const [sha, ref = ''] = line.split('\t');
+    const name = ref.replace(/^refs\/tags\//, '');
+    const peeled = name.endsWith('^{}');
+    const tag = peeled ? name.slice(0, -3) : name;
+    if (!RELEASE_REF.test(tag) || !sha) continue;
+    // ^{} is the commit an annotated tag points to; a lightweight tag has none and is the commit itself.
+    if (peeled || !tags.has(tag)) tags.set(tag, sha);
+  }
+  return [...tags]
+    .map(([tag, sha]) => {
+      const m = RELEASE_REF.exec(tag);
+      return { sha, parts: [Number(m[1]), Number(m[2]), Number(m[3])] };
+    })
+    .sort((a, b) => compareVersions(a.parts, b.parts))
+    .map((r) => ({ version: r.parts.join('.'), parts: r.parts, sha: r.sha }));
+}
+
+/**
+ * @param {string} url
+ * @param {{ major?: number }} [options]
+ * @returns {{ version: string, sha: string } | null}
+ */
+function latestRelease(url, { major } = {}) {
+  const top = listReleases(url).filter((r) => major === undefined || r.parts[0] === major).pop();
+  return top ? { version: top.version, sha: top.sha } : null;
+}
+
+module.exports = { RELEASE_REF, compareVersions, releaseSource, listReleases, latestRelease };

package/assets/machine/hooks/lib/repo.cjs

@@ -0,0 +1,138 @@
+'use strict';
+
+// Self-contained: copied to ~/.claude/exonous/hooks/lib/, node builtins only. Repo mode = the machine runs from a copy in <repo>/node_modules.
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { gitOut } = require('./paths.cjs');
+
+const DEPS = ['exonous', '@tron/claude-config'];
+const LOCKFILES = { npm: ['package-lock.json'], pnpm: ['pnpm-lock.yaml'], bun: ['bun.lock', 'bun.lockb'] };
+const RELEASE_REF = /^v\d+\.\d+\.\d+$/;
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** @returns {{ name: string, spec: string, field: string } | null} the exonous entry of the repo's package.json */
+function readDep(root) {
+  const pkg = readJson(path.join(root, 'package.json')) || {};
+  for (const field of ['devDependencies', 'dependencies']) {
+    for (const name of DEPS) {
+      const spec = (pkg[field] || {})[name];
+      if (typeof spec === 'string' && spec) return { name, spec, field };
+    }
+  }
+  return null;
+}
+
+/**
+ * The git repo whose node_modules holds this package copy and declares it, or null (global copies, dev checkouts).
+ * pnpm, yarn and bun keep global packages under a package.json of their own; only a git work tree is a repo.
+ */
+function repoOf(packageRoot) {
+  if (!packageRoot) return null;
+  let real = packageRoot;
+  try {
+    real = fs.realpathSync(packageRoot);
+  } catch {
+    // keep the given path
+  }
+  const parts = real.split(path.sep);
+  const i = parts.indexOf('node_modules');
+  if (i <= 0) return null;
+  const root = parts.slice(0, i).join(path.sep) || path.sep;
+  if (!readDep(root)) return null;
+  return (gitOut(root, ['rev-parse', '--is-inside-work-tree']) || '').trim() === 'true' ? root : null;
+}
+
+/** A global install recorded in install.json whose package still exists: it takes precedence over any repo copy. */
+function globalPrevails(info) {
+  const root = info && info.packageRoot;
+  return typeof root === 'string' && fs.existsSync(path.join(root, 'package.json')) && !repoOf(root);
+}
+
+/** Repo pm: `packageManager` field, then the lockfile; npm when nothing says otherwise. */
+function repoPm(root) {
+  const field = /^(npm|pnpm|bun)@/.exec(String((readJson(path.join(root, 'package.json')) || {}).packageManager || ''));
+  const byLock = Object.entries(LOCKFILES).find(([, files]) => files.some((f) => fs.existsSync(path.join(root, f))));
+  const pm = (field && field[1]) || (byLock && byLock[0]) || 'npm';
+  return { pm, lockfiles: LOCKFILES[pm].filter((f) => fs.existsSync(path.join(root, f))) };
+}
+
+function splitSpec(spec) {
+  const at = spec.indexOf('#');
+  return at === -1 ? { base: spec, ref: '' } : { base: spec.slice(0, at), ref: spec.slice(at + 1) };
+}
+
+// Background updates run code from the source: only the canonical repo and its quanthub mirror qualify.
+const SOURCES = ['zaqueu-1/exonous', 'quanthubbr/tron-claude-config'];
+
+/** The release source of a GitHub spec base (`owner/repo`, `github:`, https, ssh, git+…), or null for anything else. */
+function remoteUrl(base) {
+  const m = /^(?:github:|(?:git\+)?(?:https:\/\/|ssh:\/\/git@|git@)github\.com[/:])?([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/i.exec(base);
+  const slug = m && SOURCES.find((s) => s === m[1].toLowerCase());
+  return slug ? `https://github.com/${slug}.git` : null;
+}
+
+/**
+ * Where a repo-mode machine install follows releases: the source and ref of the repo's own dependency spec.
+ * @returns {{ root: string, dep: { name: string, spec: string, field: string }, base: string, ref: string, url: string | null } | null}
+ */
+function repoSource(info) {
+  const root = repoOf(info && info.packageRoot);
+  const dep = root && readDep(root);
+  if (!dep) return null;
+  const { base, ref } = splitSpec(dep.spec);
+  return { root, dep, base, ref, url: remoteUrl(base) };
+}
+
+const pinned = (ref) => Boolean(ref) && !RELEASE_REF.test(ref);
+
+// win32 needs a shell for .cmd shims: the pm name is fixed and every arg is a literal.
+function pmRun(pm, args, cwd) {
+  const win = process.platform === 'win32';
+  return execFileSync(pm, args, {
+    cwd, encoding: 'utf8', timeout: 10 * 60 * 1000, stdio: ['ignore', 'pipe', 'pipe'], shell: win, windowsHide: true,
+    env: { ...process.env, npm_config_ignore_scripts: 'true' },
+  });
+}
+
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/** Rewrites only the spec string of the dependency, keeping the file's formatting. */
+function writeSpec(root, name, from, to) {
+  const file = path.join(root, 'package.json');
+  const text = fs.readFileSync(file, 'utf8');
+  const entry = new RegExp(`(${escape(JSON.stringify(name))}\\s*:\\s*)${escape(JSON.stringify(from))}`);
+  if (!entry.test(text)) throw new Error(`could not find ${name} in ${file}`);
+  fs.writeFileSync(file, text.replace(entry, (_, head) => `${head}${JSON.stringify(to)}`));
+}
+
+/**
+ * Moves the repo's dependency to the release tag and reinstalls with the repo's pm, scripts disabled.
+ * Refuses while package.json or the lockfile has uncommitted changes: the bump must be the only change there.
+ * @returns {string} the package root of the new copy
+ */
+function bumpRepo(source, version) {
+  const { root, dep, base } = source;
+  const { pm, lockfiles } = repoPm(root);
+  const dirty = gitOut(root, ['status', '--porcelain', '--', 'package.json', ...lockfiles]);
+  if (dirty === null) throw new Error(`git could not read the status of ${root}`);
+  if (dirty.trim()) throw new Error(`${root}: package.json or its lockfile has uncommitted changes — commit them, then run \`exonous update\``);
+  const target = `${base}#v${version}`;
+  writeSpec(root, dep.name, dep.spec, target);
+  try {
+    pmRun(pm, pm === 'npm' ? ['install', '--ignore-scripts', '--no-audit', '--no-fund'] : ['install', '--ignore-scripts'], root);
+  } catch (err) {
+    writeSpec(root, dep.name, target, dep.spec);
+    throw err;
+  }
+  return path.join(root, 'node_modules', ...dep.name.split('/'));
+}
+
+module.exports = { DEPS, LOCKFILES, readDep, repoOf, globalPrevails, repoPm, splitSpec, remoteUrl, repoSource, pinned, bumpRepo };

package/assets/machine/hooks/lib/sanitize.cjs

@@ -0,0 +1,37 @@
+'use strict';
+
+// Secret scrubber for captured session text: nothing reaches the vault without passing here. Node builtins only.
+const PATTERNS = [
+  [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|$)/g, 'private_key'],
+  [/\bbearer\s+[A-Za-z0-9._\-+/=]{16,}/gi, 'bearer_token'],
+  [/\bsk-[A-Za-z0-9_-]{16,}/g, 'api_key'],
+  [/\b(?:sk|rk)_live_[A-Za-z0-9_-]{16,}/g, 'stripe_key'],
+  [/\bgh[pousr]_[A-Za-z0-9]{20,}/g, 'github_token'],
+  [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, 'github_token'],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, 'aws_key'],
+  [/\bAIza[A-Za-z0-9_-]{30,}/g, 'google_api_key'],
+  [/\b1\/\/[0-9A-Za-z_-]{20,}/g, 'google_oauth'],
+  [/\bEAA[A-Za-z0-9]{20,}/g, 'meta_token'],
+  [/\b\d{6,10}:AA[A-Za-z0-9_-]{30,}\b/g, 'telegram_token'],
+  [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, 'slack_token'],
+  [/\bxapp-[A-Za-z0-9-]{10,}/g, 'slack_token'],
+  [/\beyJ[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, 'jwt'],
+  [/\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:/\s]+:[^@\s]+@[^\s]+/g, 'url_credentials'],
+  [/\b[A-Za-z0-9_-]*(?:authorization|password|passwd|secret|token|api[_-]?key)["']?\s*[:=]\s*["']?[^\s"',;]{6,}/gi, 'credential'],
+];
+// Terminal escapes, NUL, bidi overrides and zero-width chars: not secrets, but they hide text or break markdown.
+const STRIP = /\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)|[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/g;
+
+function sanitize(text) {
+  let out = String(text ?? '').replace(STRIP, '');
+  for (const [pattern, label] of PATTERNS) out = out.replace(pattern, `(redacted:${label})`);
+  return out;
+}
+
+/** Sanitized, single-line, at most max chars. */
+function line(text, max = 160) {
+  const flat = sanitize(text).replace(/\s+/g, ' ').trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+
+module.exports = { sanitize, line };