hacklab 0.7.2 → 0.7.5

package/README.md

@@ -74,12 +74,27 @@ scan local AI usage → see your rank → pick a username → sign in with GitHu
 - `hacklab logout` — clear your saved session on this machine.
 - `hacklab config <key> <value>` — set config (`cursor-api-key`, `cursor-email`).
   Bare `hacklab config` prints the effective values and where each came from.
-- `hacklab brag [path]` — sync a `.hacklab/project.yaml` to your profile.
+- `hacklab project` — publish the repo you're standing in as a project. No
+  manifest: it reads the git remote, README, and package.json, shows a preview,
+  and publishes on confirm (`--yes` to skip, `--json` for agents). Re-running
+  refreshes the same project (slug derives from the repo name) without losing
+  its publish date or screenshots; if the live site (package.json `homepage` or
+  `--live <url>`) has an `og:image`, that becomes the screenshot. Override any
+  inferred field with `--title`, `--description`, `--live`, `--tags a,b,c`,
+  `--slug`. Manage the set with `hacklab project list` and
+  `hacklab project delete <slug>`.
 - `hacklab org` — hub for company management. If you already own a company, pick
   a field, type the new value, and it saves as you go. If you don't own one yet,
   it offers to claim or create. Subcommands: `hacklab org claim` (take ownership
   of a YC-seeded company you're a member of, or whose domain matches your login
   email) and `hacklab org create` (register a brand-new company from the CLI).
+- `hacklab profile` — view and edit your own profile. Bare `profile` (or
+  `profile view`) shows it; `profile edit` is an org-style autosave editor;
+  `profile set <field> <value>` writes one field (`--clear` unsets, handles like
+  `x mattbratos` become full links); `profile apply profile.yaml` writes many
+  fields in one shot — handy for agents setting up your profile. Fields: `name`,
+  `bio`, `website`, `blog`, `x`, `youtube`, `instagram`, `rss`, `open-to-work`.
+  Add `--json` to `view`/`set`/`apply` for machine-readable output.
 - `hacklab --version` / `hacklab --help`.
 
 ## Cursor usage

package/dist/api-client.d.ts

@@ -0,0 +1,18 @@
+import { type Session } from './session.js';
+/** Print the versioned JSON error envelope and exit 1 (agent mode). */
+export declare function emitJsonError(code: string, message: string): never;
+/** Login gate: returns the session or exits with mode-appropriate copy. */
+export declare function requireSession(json: boolean): Promise<Session>;
+/**
+ * Human-readable message for a non-2xx envelope body. 401 gets the per-backend
+ * re-login hint (an --env mismatch names the exact login command), 429 the
+ * slow-down copy; anything else relays the server's message.
+ */
+export declare function apiErrorMessage(status: number, body: {
+    error?: {
+        message?: string;
+    };
+} | null, session: Session): string;
+/** Read a failed Response's envelope and shape it via apiErrorMessage. */
+export declare function readApiError(res: Response, session: Session): Promise<string>;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,OAAO,EAAoB,MAAM,cAAc,CAAA;AAO1E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAGlE;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EAC7C,OAAO,EAAE,OAAO,GACf,MAAM,CAIR;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAChC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/api-client.js

@@ -0,0 +1,40 @@
+import { loadSession, unauthorizedHint } from './session.js';
+import { dim, error, info } from './ui.js';
+// Shared plumbing for authenticated agent-friendly commands (profile, hacker):
+// one login gate, one JSON error envelope, one reader for the server's
+// {schemaVersion, error} shape — so the 401/429 copy can't drift per command.
+/** Print the versioned JSON error envelope and exit 1 (agent mode). */
+export function emitJsonError(code, message) {
+    console.log(JSON.stringify({ schemaVersion: 1, error: { code, message } }));
+    process.exit(1);
+}
+/** Login gate: returns the session or exits with mode-appropriate copy. */
+export async function requireSession(json) {
+    const session = await loadSession();
+    if (!session) {
+        if (json)
+            emitJsonError('unauthorized', 'not logged in');
+        error('not logged in');
+        info(`run ${dim('hacklab login')} first`);
+        process.exit(1);
+    }
+    return session;
+}
+/**
+ * Human-readable message for a non-2xx envelope body. 401 gets the per-backend
+ * re-login hint (an --env mismatch names the exact login command), 429 the
+ * slow-down copy; anything else relays the server's message.
+ */
+export function apiErrorMessage(status, body, session) {
+    if (status === 401)
+        return unauthorizedHint(session);
+    if (status === 429)
+        return 'slow down. try again in a minute.';
+    return body?.error?.message ?? `request failed (${status})`;
+}
+/** Read a failed Response's envelope and shape it via apiErrorMessage. */
+export async function readApiError(res, session) {
+    const body = (await res.json().catch(() => null));
+    return apiErrorMessage(res.status, body, session);
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgB,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAE1C,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa;IAChD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI;YAAE,aAAa,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;QACxD,KAAK,CAAC,eAAe,CAAC,CAAA;QACtB,IAAI,CAAC,OAAO,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAA6C,EAC7C,OAAgB;IAEhB,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mCAAmC,CAAA;IAC9D,OAAO,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,mBAAmB,MAAM,GAAG,CAAA;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAa,EACb,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAA;IACR,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AACnD,CAAC"}

package/dist/card.d.ts

@@ -0,0 +1,66 @@
+export type HackerCardData = {
+    handle: string;
+    displayName: string | null;
+    bio: string | null;
+    joinedAt: string;
+    claimedAt: string | null;
+    level: number;
+    tokensTotal: number;
+    tokens30d: number;
+    estimatedCost: number;
+    rank: number | null;
+    topModels30d: {
+        model: string;
+        tokens: number;
+        pct: number;
+    }[];
+    currentStreak: number;
+    longestStreak: number;
+    activeDays30: number;
+    activity30: number[];
+    counts: {
+        projects: number;
+        essays: number;
+        drops: number;
+        followers: number;
+    };
+    recent: {
+        projects: {
+            title: string;
+            description: string | null;
+        }[];
+        essays: {
+            title: string;
+            publishedAt: string | null;
+        }[];
+        drops: {
+            text: string;
+            createdAt: string;
+        }[];
+    };
+    links: {
+        profile: string;
+        website: string | null;
+        github: string | null;
+        x: string | null;
+    };
+    openToWork: boolean;
+};
+export type RenderCardOptions = {
+    /** Terminal columns. Clamped to [MIN_WIDTH, DESIGN_WIDTH]. */
+    columns?: number;
+    now?: Date;
+};
+/**
+ * Render the full one-screen card as an array of lines (caller joins with \n).
+ * Pure: no I/O, deterministic given `now`. Every user-supplied string is passed
+ * through stripControl before it reaches the terminal.
+ */
+export declare function renderCard(card: HackerCardData, opts?: RenderCardOptions): string[];
+/**
+ * The compact in-chat card (`/who`): 4 lines, no rules, no sparkline. Same
+ * strip discipline. Returned as separate lines so the chat renderer can push
+ * them as one Entry per row (preserving the one-row-per-entry invariant).
+ */
+export declare function renderCompact(card: HackerCardData): string[];
+//# sourceMappingURL=card.d.ts.map

package/dist/card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC9D,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E,MAAM,EAAE;QACN,QAAQ,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,EAAE,CAAA;QACzD,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,EAAE,CAAA;QACvD,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC7C,CAAA;IACD,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACjB,CAAA;IACD,UAAU,EAAE,OAAO,CAAA;CACpB,CAAA;AAQD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,CAAA;AAyFD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,iBAAsB,GAC3B,MAAM,EAAE,CAiHV;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAY5D"}

package/dist/card.js

@@ -0,0 +1,151 @@
+import { getTitle } from './belt.js';
+import { formatTokens } from './scanners/util.js';
+import { dim, displayWidth, mint, padEndTo, rankColor, stripControl, truncateToWidth, white, } from './ui.js';
+const DESIGN_WIDTH = 68;
+const MIN_WIDTH = 45; // below this the fixed 30d row can't fit; wrapping is accepted
+/** 8 log-scaled buckets for the 30-day sparkline. Zero renders dim, lit cells mint. */
+const SPARK = ['▁', '▂', '▃', '▄', '▅', '▆', '▇', '█'];
+function resolveWidth(columns) {
+    const cols = columns ?? DESIGN_WIDTH;
+    return Math.max(MIN_WIDTH, Math.min(DESIGN_WIDTH, cols));
+}
+/** ISO string → `YYYY-MM-DD`. */
+function ymd(iso) {
+    return iso.slice(0, 10);
+}
+function ageDays(iso, now) {
+    return Math.max(0, Math.floor((now.getTime() - Date.parse(iso)) / 86_400_000));
+}
+/** A left segment and a right segment on one line, right-aligned to `width`. */
+function justify(width, leftColored, rightColored) {
+    const gap = Math.max(1, width - displayWidth(leftColored) - displayWidth(rightColored));
+    return leftColored + ' '.repeat(gap) + rightColored;
+}
+function rule(width) {
+    return dim('─'.repeat(width));
+}
+/** `████ L32 SHINOBI` — coloured band + dim romaji rank. Belt derived from level. */
+function beltBadge(level) {
+    const band = rankColor(level, '████');
+    const label = dim(` L${level} ${getTitle(level).toUpperCase()}`);
+    return band + label;
+}
+function sparkline(values) {
+    const max = Math.max(0, ...values);
+    const denom = Math.log2(max + 1);
+    return values
+        .map((v) => {
+        if (v <= 0)
+            return dim('▁');
+        const frac = denom > 0 ? Math.log2(v + 1) / denom : 0;
+        const idx = Math.min(SPARK.length - 1, Math.max(0, Math.round(frac * (SPARK.length - 1))));
+        return mint(SPARK[idx] ?? '█');
+    })
+        .join('');
+}
+/** A `label   value` row; the label is dim, the value plain, truncated to width. */
+function labelled(width, label, value) {
+    const head = dim(padEndTo(label, 8)); // "joined  ", "streak  ", …
+    const budget = width - displayWidth(head);
+    return head + truncateToWidth(value, budget);
+}
+/** A recent-list section: `HEADER N` then rows, or `HEADER 0   nothing yet`. */
+function section(width, label, total, rows) {
+    if (total === 0)
+        return [dim(`${label} 0   nothing yet`)];
+    return [`${label} ${total}`, ...rows.map((r) => truncateToWidth(r, width))];
+}
+/**
+ * Projects/essays row-budget rule: ≤3 rows below the header. When more than 3
+ * exist, show 2 items + `+N more`; otherwise show them all.
+ */
+function recentRows(total, items, row) {
+    if (total > 3) {
+        return [...items.slice(0, 2).map(row), `  +${total - 2} more`];
+    }
+    return items.map(row);
+}
+/**
+ * Render the full one-screen card as an array of lines (caller joins with \n).
+ * Pure: no I/O, deterministic given `now`. Every user-supplied string is passed
+ * through stripControl before it reaches the terminal.
+ */
+export function renderCard(card, opts = {}) {
+    const width = resolveWidth(opts.columns);
+    const now = opts.now ?? new Date();
+    const lines = [];
+    // Line 1 — identity + belt.
+    const name = card.displayName ? ` · ${stripControl(card.displayName)}` : '';
+    const identity = white(truncateToWidth(`${stripControl(card.handle)}${name}`, width - displayWidth(beltBadge(card.level)) - 1));
+    lines.push(justify(width, identity, beltBadge(card.level)));
+    // Line 2 — bio (left) + open-to-work dot (right). Skipped when both absent.
+    const bio = card.bio
+        ? truncateToWidth(stripControl(card.bio), width - 16)
+        : '';
+    const otw = card.openToWork ? `${mint('●')} open to work` : '';
+    if (bio || otw)
+        lines.push(justify(width, bio, otw));
+    lines.push(rule(width));
+    // Identity block.
+    const claimed = card.claimedAt
+        ? `claimed ${ymd(card.claimedAt)}`
+        : 'not claimed yet';
+    const rank = card.rank != null ? `      rank #${card.rank}` : '';
+    lines.push(labelled(width, 'joined', `${ymd(card.joinedAt)} (${ageDays(card.joinedAt, now)}d)   ${claimed}${rank}`));
+    // Activity block, with the two null-state collapses.
+    if (card.tokensTotal === 0) {
+        lines.push(dim('no activity yet. run hacklab sync to bank the proof.'));
+    }
+    else {
+        lines.push(labelled(width, 'streak', `${card.currentStreak}d current · ${card.longestStreak}d longest      active ${card.activeDays30}/30d`));
+        const cost = `$${Math.round(card.estimatedCost).toLocaleString('en-US')} est. cost`;
+        lines.push(labelled(width, 'tokens', `${formatTokens(card.tokensTotal)} burned · ${formatTokens(card.tokens30d)} last 30d · ${cost}`));
+        // Models + sparkline collapse when there's no 30-day activity.
+        if (card.tokens30d > 0) {
+            const models = card.topModels30d
+                .slice(0, 2)
+                .map((m) => `${m.model} ${m.pct}%`)
+                .join(' · ');
+            if (models)
+                lines.push(labelled(width, 'models', models));
+            lines.push(dim(padEndTo('30d', 8)) + sparkline(card.activity30));
+        }
+    }
+    lines.push(rule(width));
+    // Recent work.
+    lines.push(...section(width, 'PROJECTS', card.counts.projects, recentRows(card.counts.projects, card.recent.projects, (p) => `  ${padEndTo(truncateToWidth(stripControl(p.title), 16), 16)} ${stripControl(p.description ?? '')}`)));
+    lines.push(...section(width, 'ESSAYS', card.counts.essays, recentRows(card.counts.essays, card.recent.essays, (e) => `  ${e.publishedAt ? ymd(e.publishedAt) : '        '}  ${stripControl(e.title)}`)));
+    // Drops: 1 item, no "+N more"; the count lives in the header.
+    if (card.counts.drops === 0) {
+        lines.push(dim('DROPS 0   nothing yet'));
+    }
+    else {
+        const last = card.recent.drops[0];
+        lines.push(`DROPS ${card.counts.drops}${last ? ` · last ${ymd(last.createdAt)}` : ''}`);
+        if (last) {
+            lines.push(truncateToWidth(`  "${stripControl(last.text)}"`, width));
+        }
+    }
+    lines.push(rule(width));
+    lines.push(dim(`--json for the full payload · hacklab.so/${card.handle}`));
+    return lines;
+}
+/**
+ * The compact in-chat card (`/who`): 4 lines, no rules, no sparkline. Same
+ * strip discipline. Returned as separate lines so the chat renderer can push
+ * them as one Entry per row (preserving the one-row-per-entry invariant).
+ */
+export function renderCompact(card) {
+    const name = card.displayName ? ` · ${stripControl(card.displayName)}` : '';
+    const otw = card.openToWork ? ` · ${mint('●')} open to work` : '';
+    const joined = card.claimedAt
+        ? `joined ${ageDays(card.claimedAt, new Date())}d ago`
+        : 'not claimed yet';
+    return [
+        `${white(stripControl(card.handle))}${name} · ${beltBadge(card.level)}${otw}`,
+        `${formatTokens(card.tokensTotal)} tokens · ${formatTokens(card.tokens30d)}/30d · ${card.currentStreak}d streak · ${joined}`,
+        `${card.counts.projects} projects · ${card.counts.essays} essays · ${card.counts.drops} drops`,
+        dim(`hacklab.so/${card.handle}`),
+    ];
+}
+//# sourceMappingURL=card.js.map

package/dist/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EACL,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,eAAe,EACf,KAAK,GACN,MAAM,SAAS,CAAA;AA2ChB,MAAM,YAAY,GAAG,EAAE,CAAA;AACvB,MAAM,SAAS,GAAG,EAAE,CAAA,CAAC,+DAA+D;AAEpF,uFAAuF;AACvF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAQtD,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,IAAI,GAAG,OAAO,IAAI,YAAY,CAAA;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,iCAAiC;AACjC,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,GAAS;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CACd,KAAa,EACb,WAAmB,EACnB,YAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAC/D,CAAA;IACD,OAAO,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAA;AACrD,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAChE,OAAO,IAAI,GAAG,KAAK,CAAA;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,MAAgB;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAChC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,KAAK,CAAC,MAAM,GAAG,CAAC,EAChB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CACnD,CAAA;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,4BAA4B;IACjE,MAAM,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACzC,OAAO,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CACd,KAAa,EACb,KAAa,EACb,KAAa,EACb,IAAc;IAEd,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAA;IACzD,OAAO,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,KAAa,EACb,KAAU,EACV,GAAwB;IAExB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAoB,EACpB,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IAClC,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,4BAA4B;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,MAAM,QAAQ,GAAG,KAAK,CACpB,eAAe,CACb,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EACrC,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAChD,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAE3D,4EAA4E;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;QAClB,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACrD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,GAAG,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAEvB,kBAAkB;IAClB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS;QAC5B,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAClC,CAAC,CAAC,iBAAiB,CAAA;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,KAAK,CAAC,IAAI,CACR,QAAQ,CACN,KAAK,EACL,QAAQ,EACR,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,OAAO,GAAG,IAAI,EAAE,CAC9E,CACF,CAAA;IAED,qDAAqD;IACrD,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAA;IACzE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,QAAQ,CACN,KAAK,EACL,QAAQ,EACR,GAAG,IAAI,CAAC,aAAa,eAAe,IAAI,CAAC,aAAa,yBAAyB,IAAI,CAAC,YAAY,MAAM,CACvG,CACF,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,CAAA;QACnF,KAAK,CAAC,IAAI,CACR,QAAQ,CACN,KAAK,EACL,QAAQ,EACR,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAChG,CACF,CAAA;QACD,+DAA+D;QAC/D,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY;iBAC7B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;iBAClC,IAAI,CAAC,KAAK,CAAC,CAAA;YACd,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAEvB,eAAe;IACf,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CACR,KAAK,EACL,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,UAAU,CACR,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CACvG,CACF,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CACR,KAAK,EACL,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,UAAU,CACR,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CACnF,CACF,CACF,CAAA;IACD,8DAA8D;IAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjC,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,CAAA;QACD,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACvB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAE1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS;QAC3B,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO;QACtD,CAAC,CAAC,iBAAiB,CAAA;IACrB,OAAO;QACL,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE;QAC7E,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,aAAa,cAAc,MAAM,EAAE;QAC5H,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,eAAe,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC9F,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;KACjC,CAAA;AACH,CAAC"}

package/dist/commands/chat.d.ts

@@ -8,9 +8,29 @@ type RenderableMessage = {
     content: string;
     senderLevel?: number | null;
 };
-export declare function stripControl(s: string): string;
 export declare function formatLine(m: RenderableMessage, now?: Date): string;
 export declare function formatPendingLine(handle: string, content: string, tag: string, at?: string, now?: Date): string;
+export type LineIntent = {
+    kind: 'empty';
+} | {
+    kind: 'command';
+    cmd: string;
+    args: string[];
+} | {
+    kind: 'message';
+    content: string;
+};
+/**
+ * Decide what a typed line means. A single leading slash is a local command and
+ * never posts. A DOUBLED leading slash is how you post a message that starts with
+ * a slash: it posts (and displays) verbatim, both slashes intact. Nothing is
+ * stripped, so the optimistic placeholder, the POST body, and the server echo all
+ * agree (reconcile-by-content) — and the server can reject single-leading-slash
+ * content (a stale client posting a command it doesn't know is local) without
+ * catching the doubled form. Pure + exported so these semantics are unit-tested
+ * without driving readline.
+ */
+export declare function parseLine(input: string): LineIntent;
 export declare function chat(args: string[]): Promise<void>;
 export {};
 //# sourceMappingURL=chat.d.ts.map

package/dist/commands/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,KAAK,OAAO,EAAE,MAAM,eAAe,CAAA;AA+CxE,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,MAAM,CAExD;AAqED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CASxD;AAKD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,GAAG,GAAE,IAAiB,GACrB,MAAM,CAKR;AAED,KAAK,iBAAiB,GAAG;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAA;AAKD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,wBAAgB,UAAU,CACxB,CAAC,EAAE,iBAAiB,EACpB,GAAG,GAAE,IAAiB,GACrB,MAAM,CAQR;AAQD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,EAAE,GAAE,MAAiC,EACrC,GAAG,GAAE,IAAiB,GACrB,MAAM,CAIR;AA6bD,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBAkCxC"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,OAAO,EAAE,MAAM,eAAe,CAAA;AAgDxE,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,MAAM,CAExD;AAqED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CASxD;AAKD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,GAAG,GAAE,IAAiB,GACrB,MAAM,CAKR;AAED,KAAK,iBAAiB,GAAG;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAA;AAED,wBAAgB,UAAU,CACxB,CAAC,EAAE,iBAAiB,EACpB,GAAG,GAAE,IAAiB,GACrB,MAAM,CAQR;AAQD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,EAAE,GAAE,MAAiC,EACrC,GAAG,GAAE,IAAiB,GACrB,MAAM,CAIR;AA8MD,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAExC;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CASnD;AA4UD,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBAkCxC"}

package/dist/commands/chat.js

@@ -1,6 +1,8 @@
 import readline from 'node:readline';
+import { renderCompact } from '../card.js';
+import { captureEvent } from '../posthog.js';
 import { loadSession, resolveAppUrl } from '../session.js';
-import { bold, dim, error, green, info, rankColor, red, success, } from '../ui.js';
+import { bold, dim, error, green, info, rankColor, red, stripControl, success, } from '../ui.js';
 // The chat command is CLI-first: every subcommand takes --json so an AI agent
 // can drive the channel and DMs programmatically, while the default output is a
 // human-readable terminal view. Thin wrappers over the /api/chat/* routes.
@@ -95,13 +97,6 @@ export function formatTimestamp(when, now = new Date()) {
     const prefix = datePrefix(d, now);
     return prefix ? `${prefix} ${time}` : time;
 }
-// Strip C0 control characters + DEL from untrusted message content before
-// printing it to the terminal. Without this, a hacker could embed ANSI escape
-// sequences in a message to clear/garble or hijack any viewer's terminal.
-export function stripControl(s) {
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching control chars to remove them
-    return s.replace(/[\x00-\x1f\x7f]/g, '');
-}
 export function formatLine(m, now = new Date()) {
     const lvl = m.senderLevel != null ? dim(` lv${m.senderLevel}`) : '';
     // Colour the author's handle in their belt/rank colour (see rankColor).
@@ -173,6 +168,9 @@ async function chatPost(words, json) {
         return;
     }
     success('posted.');
+    await captureEvent(session.handle, 'cli_chat_message_posted', {
+        content_length: content.length,
+    });
 }
 async function chatHistory(args, json) {
     const before = flagValue(args, '--before');
@@ -217,10 +215,13 @@ async function chatDms(json) {
     }
     for (const c of data.conversations) {
         const unread = c.unread_count > 0 ? ` ${green(`(${c.unread_count} new)`)}` : '';
+        // Both the partner handle and the last-message preview are untrusted user
+        // input wrapped in ANSI before printing — strip control chars so a crafted
+        // handle or DM body can't inject escape sequences into the viewer's terminal.
         const preview = c.last_message_content
-            ? dim(` — ${c.last_message_content}`)
+            ? dim(` — ${stripControl(c.last_message_content)}`)
             : '';
-        console.log(`${bold(`@${c.partner_handle}`)}${unread}${preview}`);
+        console.log(`${bold(`@${stripControl(c.partner_handle)}`)}${unread}${preview}`);
     }
 }
 async function chatDm(args, json) {
@@ -251,6 +252,9 @@ async function chatDm(args, json) {
             return;
         }
         success(`sent to @${handle}.`);
+        await captureEvent(session.handle, 'cli_dm_sent', {
+            content_length: message.length,
+        });
         return;
     }
     const res = await fetch(base, {
@@ -294,6 +298,28 @@ async function chatFlag(args, json) {
     }
     success('flagged for review.');
 }
+/**
+ * Decide what a typed line means. A single leading slash is a local command and
+ * never posts. A DOUBLED leading slash is how you post a message that starts with
+ * a slash: it posts (and displays) verbatim, both slashes intact. Nothing is
+ * stripped, so the optimistic placeholder, the POST body, and the server echo all
+ * agree (reconcile-by-content) — and the server can reject single-leading-slash
+ * content (a stale client posting a command it doesn't know is local) without
+ * catching the doubled form. Pure + exported so these semantics are unit-tested
+ * without driving readline.
+ */
+export function parseLine(input) {
+    const content = input.trim();
+    if (!content)
+        return { kind: 'empty' };
+    if (content.startsWith('//'))
+        return { kind: 'message', content };
+    if (content.startsWith('/')) {
+        const [cmd, ...args] = content.slice(1).trim().split(/\s+/);
+        return { kind: 'command', cmd: cmd ?? '', args };
+    }
+    return { kind: 'message', content };
+}
 // Interactive live channel: short-poll the public tail and print new messages
 // above a readline prompt; press enter to post. CLI-first design means this is a
 // thin loop over the same endpoints the agent subcommands use.
@@ -318,6 +344,8 @@ async function chatLive() {
     function renderEntry(e, now) {
         if (e.kind === 'msg')
             return formatLine(e.m, now);
+        if (e.kind === 'text')
+            return e.text;
         const tag = e.failed ? red(`[failed: ${e.failed}]`) : dim('[sending]');
         return formatPendingLine(myHandle ?? 'you', e.content, tag, e.at, now);
     }
@@ -340,6 +368,61 @@ async function chatLive() {
         process.stdout.write(`${renderEntry(e, new Date())}\n`);
         process.stdout.write(rl.getPrompt() + inProgress);
     }
+    // Append a local one-row line (slash-command output). Goes through appendEntry
+    // as a `text` entry, so it counts as exactly one log row.
+    function appendText(text) {
+        appendEntry({ kind: 'text', text });
+    }
+    const SLASH_HELP = [
+        dim('/who <handle>   look up a hacker'),
+        dim('/help           this list'),
+        dim('//<text>        post a message that starts with a slash (shown as //)'),
+        dim('(dm someone with `hacklab chat dm <handle> <message>`)'),
+    ];
+    // Dispatch a `/command`. Runs locally, never posts. Async commands (/who)
+    // append their rows when the fetch lands — the prompt was already restored by
+    // the caller, so the user keeps typing while the lookup is in flight.
+    async function handleSlash(cmd, args) {
+        if (cmd === 'who')
+            return whoLookup(args[0]);
+        if (cmd === 'help') {
+            for (const line of SLASH_HELP)
+                appendText(line);
+            return;
+        }
+        appendText(dim(`unknown command: /${stripControl(cmd)}. try /help`));
+    }
+    // `/who <handle>` — the compact card, appended one row per line. Prints
+    // nothing while the fetch is in flight (no placeholder to rewrite).
+    async function whoLookup(rawHandle) {
+        const handle = rawHandle?.replace(/^@/, '');
+        if (!handle) {
+            appendText(dim('usage: /who <handle>'));
+            return;
+        }
+        const safe = stripControl(handle);
+        try {
+            const res = await fetch(`${base}/api/hackers/${encodeURIComponent(handle)}?src=chat`, { headers: { Authorization: `Bearer ${session.token}` } });
+            if (res.status === 404) {
+                appendText(dim(`no hacker named "${safe}"`));
+                return;
+            }
+            if (!res.ok) {
+                appendText(dim(`could not look up ${safe} (${res.status})`));
+                return;
+            }
+            const data = (await res.json());
+            if (!data.hacker) {
+                appendText(dim(`no hacker named "${safe}"`));
+                return;
+            }
+            for (const line of renderCompact(data.hacker))
+                appendText(line);
+        }
+        catch {
+            appendText(dim('could not reach hacklab'));
+        }
+    }
     // Rewrite an entry's existing line in place (it must still be on screen), then
     // restore the prompt + in-progress input. Used to swap an optimistic
     // placeholder for the confirmed (or failed) message with no second line.
@@ -435,8 +518,8 @@ async function chatLive() {
     await poll();
     const timer = setInterval(poll, 1500);
     rl.on('line', async (input) => {
-        const content = input.trim();
-        if (!content) {
+        const intent = parseLine(input);
+        if (intent.kind === 'empty') {
             rl.prompt();
             return;
         }
@@ -449,12 +532,24 @@ async function chatLive() {
         readline.moveCursor(process.stdout, 0, -echoRows);
         readline.cursorTo(process.stdout, 0);
         readline.clearScreenDown(process.stdout);
+        // A local command never posts. Restore the prompt first, then let the
+        // (possibly async) command append its rows via appendEntry — one row per
+        // entry, so rowsUpOf stays correct even mid optimistic-send.
+        if (intent.kind === 'command') {
+            rl.prompt();
+            void handleSlash(intent.cmd, intent.args);
+            return;
+        }
+        // parseLine already stripped the escaping slash from a `//` message, so the
+        // placeholder and the POST body agree — the poll reconciles optimistic sends
+        // by exact content match, and a mismatch sticks the placeholder on [sending].
+        const postContent = intent.content;
         // Faded placeholder, one row above the freshly drawn prompt. Written inline
         // (not via appendEntry) so we can hand control back with rl.prompt(), which
         // keeps readline's cursor model correct for the next keystroke.
         const placeholder = {
             kind: 'pending',
-            content,
+            content: postContent,
             at: new Date().toISOString(),
         };
         log.push(placeholder);
@@ -467,7 +562,7 @@ async function chatLive() {
                     'Content-Type': 'application/json',
                     Authorization: `Bearer ${session.token}`,
                 },
-                body: JSON.stringify({ content }),
+                body: JSON.stringify({ content: postContent }),
             });
             if (!res.ok) {
                 failPending(placeholder, await readError(res));