terminalhire 0.17.2 → 0.18.1

package/dist/bin/jpi-bounties.js

@@ -921,6 +921,7 @@ async function fetchRepoMeta(owner, name, token, cache) {
       stars: r.stargazers_count ?? 0,
       archived: !!r.archived,
       fork: !!r.fork,
+      private: !!r.private,
       language: r.language ?? null,
       topics: r.topics ?? [],
       contributors
@@ -953,7 +954,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
   const loginLc = login.toLowerCase();
   let items;
   try {
-    const q = encodeURIComponent(`type:pr is:merged author:${login} -user:${login} sort:updated`);
+    const q = encodeURIComponent(`type:pr is:merged is:public author:${login} -user:${login} sort:updated`);
     const res = await ghFetch(
       `/search/issues?q=${q}&per_page=${CANDIDATE_PR_PAGE}`,
       token
@@ -966,6 +967,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
   }
   const byDomain = {};
   let qualifyingTotal = 0;
+  const qualifyingPRs = [];
   for (const item of items) {
     const repo = parseRepoUrl(item.repository_url);
     if (!repo) continue;
@@ -975,13 +977,22 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
     if (isTrivialPRTitle(item.title)) continue;
     const meta = await fetchRepoMeta(repo.owner, repo.name, token, cache);
     if (!meta) continue;
+    if (meta.private) continue;
     if (meta.archived || meta.fork) continue;
     if (meta.stars < gates.minStars) continue;
     if (meta.contributors !== void 0 && meta.contributors < gates.minContributors) continue;
     qualifyingTotal += 1;
     const mergedAt = item.pull_request?.merged_at ?? item.closed_at ?? item.created_at;
     const rawDomains = [meta.language ?? "", ...meta.topics].filter(Boolean);
-    for (const d of new Set(normalize(rawDomains))) {
+    const domainTags = [...new Set(normalize(rawDomains))];
+    qualifyingPRs.push({
+      url: item.html_url,
+      title: item.title,
+      repo: `${repo.owner}/${repo.name}`,
+      domains: domainTags,
+      mergedAt
+    });
+    for (const d of domainTags) {
       const b = byDomain[d] ?? (byDomain[d] = { mergedPRs: 0, distinctOrgs: 0, lastMergedAt: mergedAt, orgs: /* @__PURE__ */ new Set() });
       b.mergedPRs += 1;
       b.orgs.add(ownerLc);
@@ -996,7 +1007,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
       lastMergedAt: b.lastMergedAt
     };
   }
-  return { status: "ok", byDomain: finalDomains, qualifyingTotal, computedAt };
+  return { status: "ok", byDomain: finalDomains, qualifyingTotal, qualifyingPRs, computedAt };
 }
 async function computeAcceptanceCredential(login, token, cache = /* @__PURE__ */ new Map()) {
   if (!token) return emptyCredential("no-token");
@@ -1807,6 +1818,19 @@ var init_concurrency = __esm({
   }
 });
 
+// ../../packages/core/src/feeds/effort.ts
+function effortFromAmount(amount) {
+  if (amount == null) return void 0;
+  if (amount <= 500) return "small";
+  if (amount <= 2e3) return "medium";
+  return "large";
+}
+var init_effort = __esm({
+  "../../packages/core/src/feeds/effort.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/feeds/github-bounties.ts
 function authHeaders() {
   const token = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"];
@@ -1829,12 +1853,6 @@ function parseAmountUSD(text) {
   if (!Number.isFinite(n) || n <= 0 || n > 1e6) return void 0;
   return Math.round(n);
 }
-function effortFromAmount(amount) {
-  if (amount == null) return void 0;
-  if (amount <= 500) return "small";
-  if (amount <= 2e3) return "medium";
-  return "large";
-}
 function labelNames(issue) {
   return (issue.labels ?? []).map((l) => typeof l === "string" ? l : l.name ?? "").filter(Boolean);
 }
@@ -2082,6 +2100,7 @@ var init_github_bounties = __esm({
     init_bounty_gate();
     init_http();
     init_concurrency();
+    init_effort();
     GITHUB_API = "https://api.github.com";
     BOUNTY_LABEL_RE = /bounty|reward|funded|💎|💰/i;
     SEARCH_QUERIES = [
@@ -2133,12 +2152,6 @@ var init_github_bounties = __esm({
 function tokenize3(text) {
   return text.toLowerCase().replace(/[^a-z0-9.\-+#]/g, " ").split(/\s+/).filter((w) => w.length > 1);
 }
-function effortFromAmount2(usd) {
-  if (usd == null) return void 0;
-  if (usd < 150) return "small";
-  if (usd < 750) return "medium";
-  return "large";
-}
 function priceToUSD(p) {
   if (!p || typeof p.value !== "number") return void 0;
   if (p.unit === "USD_CENT") return Math.round(p.value) / 100;
@@ -2161,6 +2174,7 @@ var init_opire = __esm({
     init_bounty_gate();
     init_github_bounties();
     init_http();
+    init_effort();
     OPIRE_REWARDS_URL = "https://api.opire.dev/rewards";
     MIN_USD = 25;
     MAX_USD = 25e3;
@@ -2197,7 +2211,7 @@ var init_opire = __esm({
           const tags = normalize([...r.programmingLanguages ?? [], ...tokenize3(title)]);
           const bounty = {
             amountUSD,
-            estimatedEffort: effortFromAmount2(amountUSD),
+            estimatedEffort: effortFromAmount(amountUSD),
             bountySource: "opire",
             claimUrl: r.url,
             repoFullName
@@ -6544,6 +6558,7 @@ __export(src_exports, {
   isBounty: () => isBounty,
   isContribution: () => isContribution,
   isOverIntroLimit: () => isOverIntroLimit,
+  isTrivialPRTitle: () => isTrivialPRTitle,
   joinLabels: () => joinLabels,
   labelFor: () => labelFor,
   lever: () => lever,
@@ -6600,9 +6615,9 @@ var init_keytar = __esm({
   }
 });
 
-// node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node
+// node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node
 var require_keytar = __commonJS({
-  "node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+  "node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node"(exports, module) {
     "use strict";
     init_keytar();
     try {
@@ -6928,6 +6943,37 @@ function updateIndexCache(patch) {
   return entry;
 }
 
+// bin/sanitize.js
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(CONTROL_CHARS, "");
+}
+function safeHttpUrl(url) {
+  if (url == null) return null;
+  const raw = String(url);
+  CONTROL_CHARS.lastIndex = 0;
+  if (CONTROL_CHARS.test(raw)) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.href;
+}
+function linkTitle(title, url) {
+  const safeTitle = sanitizeText(title);
+  const href = safeHttpUrl(url);
+  const isTTY = process.stdout.isTTY;
+  const noColor = process.env["NO_COLOR"] !== void 0;
+  if (isTTY && !noColor && href) {
+    return `\x1B]8;;${href}\x1B\\${safeTitle}\x1B]8;;\x1B\\`;
+  }
+  return href ? `${safeTitle} (${href})` : safeTitle;
+}
+
 // bin/jpi-bounties.js
 var TERMINALHIRE_DIR3 = process.env.TERMINALHIRE_DIR || join4(homedir3(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join4(TERMINALHIRE_DIR3, "index-cache.json");
@@ -6974,12 +7020,6 @@ function formatAmount(b) {
   return b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
 }
 var EFFORT_LABEL = { small: "small (~\xBD day)", medium: "medium (~1 day)", large: "large (multi-day)" };
-function linkTitle(title, url) {
-  const isTTY = process.stdout.isTTY;
-  const noColor = process.env["NO_COLOR"] !== void 0;
-  if (isTTY && !noColor && url) return `\x1B]8;;${url}\x1B\\${title}\x1B]8;;\x1B\\`;
-  return url ? `${title} (${url})` : title;
-}
 function printBounty(i, job, score, reason, matchedTags) {
   const b = job.bounty ?? {};
   const stars = b.repoStars != null ? ` \xB7 ${b.repoStars}\u2605` : "";
@@ -6990,11 +7030,11 @@ function printBounty(i, job, score, reason, matchedTags) {
   const ref = opportunityShortToken(job.id);
   console.log(`
 ${i + 1}. ${linkTitle(job.title, job.url)} [${ref}]`);
-  console.log(`   ${formatAmount(b)}${effort} \xB7 ${b.repoFullName ?? job.company}${stars}${scoreStr}${contend}`);
+  console.log(`   ${formatAmount(b)}${effort} \xB7 ${sanitizeText(b.repoFullName ?? job.company)}${stars}${scoreStr}${contend}`);
   if (reason) console.log(`   ${reason}`);
   if (matchedTags && matchedTags.length) console.log(`   Tags matched: ${matchedTags.slice(0, 5).join(", ")}`);
   console.log(`   id: ${job.id}`);
-  console.log(`   Claim: ${b.claimUrl ?? job.url}`);
+  console.log(`   Claim: ${sanitizeText(b.claimUrl ?? job.url)}`);
   console.log(`   \u2192 terminalhire claim ${ref}`);
 }
 async function run() {
@@ -7050,7 +7090,7 @@ Enter a number to open a bounty's claim page, or press Enter to exit: `);
     console.log(
       `
 Open this to claim/work the bounty (you go straight to the source \u2014 we never touch payment):
-  ${chosen.bounty?.claimUrl ?? chosen.url}`
+  ${sanitizeText(chosen.bounty?.claimUrl ?? chosen.url)}`
     );
   } catch (err) {
     console.error("terminalhire bounties error:", err.message ?? err);

package/dist/bin/jpi-chat-read.js

@@ -559,6 +559,13 @@ var init_concurrency = __esm({
   }
 });
 
+// ../../packages/core/src/feeds/effort.ts
+var init_effort = __esm({
+  "../../packages/core/src/feeds/effort.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/feeds/github-bounties.ts
 var init_github_bounties = __esm({
   "../../packages/core/src/feeds/github-bounties.ts"() {
@@ -568,6 +575,7 @@ var init_github_bounties = __esm({
     init_bounty_gate();
     init_http();
     init_concurrency();
+    init_effort();
   }
 });
 
@@ -579,6 +587,7 @@ var init_opire = __esm({
     init_bounty_gate();
     init_github_bounties();
     init_http();
+    init_effort();
   }
 });
 
@@ -3925,9 +3934,9 @@ var init_keytar = __esm({
   }
 });
 
-// node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node
+// node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node
 var require_keytar = __commonJS({
-  "node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+  "node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node"(exports, module) {
     "use strict";
     init_keytar();
     try {

package/dist/bin/jpi-chat.js

@@ -576,6 +576,13 @@ var init_concurrency = __esm({
   }
 });
 
+// ../../packages/core/src/feeds/effort.ts
+var init_effort = __esm({
+  "../../packages/core/src/feeds/effort.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/feeds/github-bounties.ts
 var init_github_bounties = __esm({
   "../../packages/core/src/feeds/github-bounties.ts"() {
@@ -585,6 +592,7 @@ var init_github_bounties = __esm({
     init_bounty_gate();
     init_http();
     init_concurrency();
+    init_effort();
   }
 });
 
@@ -596,6 +604,7 @@ var init_opire = __esm({
     init_bounty_gate();
     init_github_bounties();
     init_http();
+    init_effort();
   }
 });
 
@@ -3953,9 +3962,9 @@ var init_keytar = __esm({
   }
 });
 
-// node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node
+// node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node
 var require_keytar = __commonJS({
-  "node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+  "node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node"(exports, module) {
     "use strict";
     init_keytar();
     try {

package/dist/bin/jpi-contribute.js

@@ -894,6 +894,13 @@ var init_concurrency = __esm({
   }
 });
 
+// ../../packages/core/src/feeds/effort.ts
+var init_effort = __esm({
+  "../../packages/core/src/feeds/effort.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/feeds/github-bounties.ts
 var init_github_bounties = __esm({
   "../../packages/core/src/feeds/github-bounties.ts"() {
@@ -903,6 +910,7 @@ var init_github_bounties = __esm({
     init_bounty_gate();
     init_http();
     init_concurrency();
+    init_effort();
   }
 });
 
@@ -914,6 +922,7 @@ var init_opire = __esm({
     init_bounty_gate();
     init_github_bounties();
     init_http();
+    init_effort();
   }
 });
 
@@ -1242,9 +1251,9 @@ var init_keytar = __esm({
   }
 });
 
-// node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node
+// node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node
 var require_keytar = __commonJS({
-  "node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+  "node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node"(exports, module) {
     "use strict";
     init_keytar();
     try {
@@ -1608,6 +1617,37 @@ function isContributeEnabled() {
   return readConfig().contributeEnabled === true;
 }
 
+// bin/sanitize.js
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(CONTROL_CHARS, "");
+}
+function safeHttpUrl(url) {
+  if (url == null) return null;
+  const raw = String(url);
+  CONTROL_CHARS.lastIndex = 0;
+  if (CONTROL_CHARS.test(raw)) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.href;
+}
+function linkTitle(title, url) {
+  const safeTitle = sanitizeText(title);
+  const href = safeHttpUrl(url);
+  const isTTY = process.stdout.isTTY;
+  const noColor = process.env["NO_COLOR"] !== void 0;
+  if (isTTY && !noColor && href) {
+    return `\x1B]8;;${href}\x1B\\${safeTitle}\x1B]8;;\x1B\\`;
+  }
+  return href ? `${safeTitle} (${href})` : safeTitle;
+}
+
 // bin/jpi-contribute.js
 var TERMINALHIRE_DIR4 = process.env.TERMINALHIRE_DIR || join5(homedir4(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join5(TERMINALHIRE_DIR4, "index-cache.json");
@@ -1709,19 +1749,13 @@ function displayLanguage(job) {
   const tag = (job.tags ?? []).find((t) => LANGUAGES.has(String(t).toLowerCase()));
   return tag ?? "\u2014";
 }
-function linkTitle(title, url) {
-  const isTTY = process.stdout.isTTY;
-  const noColor = process.env["NO_COLOR"] !== void 0;
-  if (isTTY && !noColor && url) return `\x1B]8;;${url}\x1B\\${title}\x1B]8;;\x1B\\`;
-  return url ? `${title} (${url})` : title;
-}
 function renderRow(i, result) {
   const job = result.job;
   const c = job.contribution ?? {};
-  const repo = c.repoFullName ?? job.company ?? "";
+  const repo = sanitizeText(c.repoFullName ?? job.company ?? "");
   const num = c.issueNumber != null ? `#${c.issueNumber}` : "";
-  const label = c.labels && c.labels.length ? c.labels[0] : "\u2014";
-  const lang = displayLanguage(job);
+  const label = c.labels && c.labels.length ? sanitizeText(c.labels[0]) : "\u2014";
+  const lang = sanitizeText(displayLanguage(job));
   const scorePct = `match ${Math.round((result.score ?? 0) * 100)}%`;
   const ref = opportunityShortToken(job.id);
   const line1 = `${i + 1}. ${linkTitle(job.title, c.issueUrl ?? job.url)} [${ref}]`;

package/dist/bin/jpi-devs.js

@@ -921,6 +921,7 @@ async function fetchRepoMeta(owner, name, token, cache) {
       stars: r.stargazers_count ?? 0,
       archived: !!r.archived,
       fork: !!r.fork,
+      private: !!r.private,
       language: r.language ?? null,
       topics: r.topics ?? [],
       contributors
@@ -953,7 +954,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
   const loginLc = login.toLowerCase();
   let items;
   try {
-    const q = encodeURIComponent(`type:pr is:merged author:${login} -user:${login} sort:updated`);
+    const q = encodeURIComponent(`type:pr is:merged is:public author:${login} -user:${login} sort:updated`);
     const res = await ghFetch(
       `/search/issues?q=${q}&per_page=${CANDIDATE_PR_PAGE}`,
       token
@@ -966,6 +967,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
   }
   const byDomain = {};
   let qualifyingTotal = 0;
+  const qualifyingPRs = [];
   for (const item of items) {
     const repo = parseRepoUrl(item.repository_url);
     if (!repo) continue;
@@ -975,13 +977,22 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
     if (isTrivialPRTitle(item.title)) continue;
     const meta = await fetchRepoMeta(repo.owner, repo.name, token, cache);
     if (!meta) continue;
+    if (meta.private) continue;
     if (meta.archived || meta.fork) continue;
     if (meta.stars < gates.minStars) continue;
     if (meta.contributors !== void 0 && meta.contributors < gates.minContributors) continue;
     qualifyingTotal += 1;
     const mergedAt = item.pull_request?.merged_at ?? item.closed_at ?? item.created_at;
     const rawDomains = [meta.language ?? "", ...meta.topics].filter(Boolean);
-    for (const d of new Set(normalize(rawDomains))) {
+    const domainTags = [...new Set(normalize(rawDomains))];
+    qualifyingPRs.push({
+      url: item.html_url,
+      title: item.title,
+      repo: `${repo.owner}/${repo.name}`,
+      domains: domainTags,
+      mergedAt
+    });
+    for (const d of domainTags) {
       const b = byDomain[d] ?? (byDomain[d] = { mergedPRs: 0, distinctOrgs: 0, lastMergedAt: mergedAt, orgs: /* @__PURE__ */ new Set() });
       b.mergedPRs += 1;
       b.orgs.add(ownerLc);
@@ -996,7 +1007,7 @@ async function computeAcceptanceFromSearch(login, token, ownedOrgs, cache, gates
       lastMergedAt: b.lastMergedAt
     };
   }
-  return { status: "ok", byDomain: finalDomains, qualifyingTotal, computedAt };
+  return { status: "ok", byDomain: finalDomains, qualifyingTotal, qualifyingPRs, computedAt };
 }
 async function computeAcceptanceCredential(login, token, cache = /* @__PURE__ */ new Map()) {
   if (!token) return emptyCredential("no-token");
@@ -1807,6 +1818,19 @@ var init_concurrency = __esm({
   }
 });
 
+// ../../packages/core/src/feeds/effort.ts
+function effortFromAmount(amount) {
+  if (amount == null) return void 0;
+  if (amount <= 500) return "small";
+  if (amount <= 2e3) return "medium";
+  return "large";
+}
+var init_effort = __esm({
+  "../../packages/core/src/feeds/effort.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/feeds/github-bounties.ts
 function authHeaders() {
   const token = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"];
@@ -1829,12 +1853,6 @@ function parseAmountUSD(text) {
   if (!Number.isFinite(n) || n <= 0 || n > 1e6) return void 0;
   return Math.round(n);
 }
-function effortFromAmount(amount) {
-  if (amount == null) return void 0;
-  if (amount <= 500) return "small";
-  if (amount <= 2e3) return "medium";
-  return "large";
-}
 function labelNames(issue) {
   return (issue.labels ?? []).map((l) => typeof l === "string" ? l : l.name ?? "").filter(Boolean);
 }
@@ -2082,6 +2100,7 @@ var init_github_bounties = __esm({
     init_bounty_gate();
     init_http();
     init_concurrency();
+    init_effort();
     GITHUB_API = "https://api.github.com";
     BOUNTY_LABEL_RE = /bounty|reward|funded|💎|💰/i;
     SEARCH_QUERIES = [
@@ -2133,12 +2152,6 @@ var init_github_bounties = __esm({
 function tokenize3(text) {
   return text.toLowerCase().replace(/[^a-z0-9.\-+#]/g, " ").split(/\s+/).filter((w) => w.length > 1);
 }
-function effortFromAmount2(usd) {
-  if (usd == null) return void 0;
-  if (usd < 150) return "small";
-  if (usd < 750) return "medium";
-  return "large";
-}
 function priceToUSD(p) {
   if (!p || typeof p.value !== "number") return void 0;
   if (p.unit === "USD_CENT") return Math.round(p.value) / 100;
@@ -2161,6 +2174,7 @@ var init_opire = __esm({
     init_bounty_gate();
     init_github_bounties();
     init_http();
+    init_effort();
     OPIRE_REWARDS_URL = "https://api.opire.dev/rewards";
     MIN_USD = 25;
     MAX_USD = 25e3;
@@ -2197,7 +2211,7 @@ var init_opire = __esm({
           const tags = normalize([...r.programmingLanguages ?? [], ...tokenize3(title)]);
           const bounty = {
             amountUSD,
-            estimatedEffort: effortFromAmount2(amountUSD),
+            estimatedEffort: effortFromAmount(amountUSD),
             bountySource: "opire",
             claimUrl: r.url,
             repoFullName
@@ -6544,6 +6558,7 @@ __export(src_exports, {
   isBounty: () => isBounty,
   isContribution: () => isContribution,
   isOverIntroLimit: () => isOverIntroLimit,
+  isTrivialPRTitle: () => isTrivialPRTitle,
   joinLabels: () => joinLabels,
   labelFor: () => labelFor,
   lever: () => lever,
@@ -6600,9 +6615,9 @@ var init_keytar = __esm({
   }
 });
 
-// node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node
+// node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node
 var require_keytar = __commonJS({
-  "node-file:/private/tmp/claude-501/-Users-ericgang-job-placement-inline/3ffac25b-ca95-4a86-9e17-a4cf326551de/scratchpad/rel2/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+  "node-file:/Users/ericgang/job-placement-inline/node_modules/keytar/build/Release/keytar.node"(exports, module) {
     "use strict";
     init_keytar();
     try {
@@ -6974,6 +6989,37 @@ function excludeOwnCard(results, ownLogin) {
   });
 }
 
+// bin/sanitize.js
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(CONTROL_CHARS, "");
+}
+function safeHttpUrl(url) {
+  if (url == null) return null;
+  const raw = String(url);
+  CONTROL_CHARS.lastIndex = 0;
+  if (CONTROL_CHARS.test(raw)) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.href;
+}
+function linkTitle(title, url) {
+  const safeTitle = sanitizeText(title);
+  const href = safeHttpUrl(url);
+  const isTTY = process.stdout.isTTY;
+  const noColor = process.env["NO_COLOR"] !== void 0;
+  if (isTTY && !noColor && href) {
+    return `\x1B]8;;${href}\x1B\\${safeTitle}\x1B]8;;\x1B\\`;
+  }
+  return href ? `${safeTitle} (${href})` : safeTitle;
+}
+
 // bin/jpi-devs.js
 var API_URL2 = process.env["TERMINALHIRE_API_URL"] ?? process.env["JPI_API_URL"] ?? "https://terminalhire.com";
 var DEFAULT_LIMIT = 10;
@@ -6995,24 +7041,18 @@ function credentialUrl(job) {
   const u = job.url ?? "";
   return u.startsWith("http") ? u : `${API_URL2}${u}`;
 }
-function linkTitle(title, url) {
-  const isTTY = process.stdout.isTTY;
-  const noColor = process.env["NO_COLOR"] !== void 0;
-  if (isTTY && !noColor && url) return `\x1B]8;;${url}\x1B\\${title}\x1B]8;;\x1B\\`;
-  return url ? `${title} (${url})` : title;
-}
 function printCard(i, result) {
   const { job, score, matchedTags, reason } = result;
   const url = credentialUrl(job);
   const kind = job.source === "project" ? "project" : "developer";
-  const byline = job.source === "project" ? ` \xB7 by @${job.company}` : "";
+  const byline = job.source === "project" ? ` \xB7 by @${sanitizeText(job.company)}` : "";
   const scoreStr = score > 0 ? ` \xB7 match ${Math.round(score * 100)}%` : "";
   console.log(`
 ${i + 1}. ${linkTitle(job.title, url)} \u2014 ${kind}${byline}${scoreStr}`);
   console.log(`   id: ${job.id}`);
   if (reason) console.log(`   ${reason}`);
   if (matchedTags && matchedTags.length) console.log(`   Tags matched: ${matchedTags.slice(0, 5).join(", ")}`);
-  console.log(`   Profile: ${url}`);
+  console.log(`   Profile: ${sanitizeText(url)}`);
 }
 async function run() {
   try {