terminalhire 0.41.0 → 0.41.2

package/dist/bin/claim-push-bg.js

@@ -166,8 +166,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -289,7 +305,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -345,6 +361,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-bounties.js

@@ -11338,8 +11338,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -11461,7 +11477,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -11517,6 +11533,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-claim.js

@@ -10638,8 +10638,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -10761,7 +10777,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -10817,6 +10833,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -26056,6 +26073,13 @@ function openInBrowser(url) {
   }
 }
 
+// bin/sanitize.js
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(CONTROL_CHARS, "");
+}
+
 // src/policy-acks.ts
 init_state_dir();
 import { lstatSync, readFileSync as readFileSync2, writeFileSync } from "fs";
@@ -26979,7 +27003,10 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  return a != null ? "$" + a.toLocaleString() : "$\u2014";
+  if (a == null) return "$\u2014";
+  if (typeof a === "string" && a.trim() === "") return "$\u2014";
+  const n = typeof a === "number" ? a : Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -28307,35 +28334,62 @@ async function ensureForkExists(repoFullName, ghUser) {
   if (!isFork) throw new Error(`fork ${forkFullName} created but could not be verified as a fork`);
   return forkFullName;
 }
+function shouldStatePending(claim, approvalsChecked) {
+  return Boolean(claim?.approval) && claim.approval.state === "pending" && Boolean(approvalsChecked);
+}
+function startableRow(c) {
+  const bits = [fmtClaimAmount(c), sanitizeText(c.title)];
+  if (c.repoFullName) bits.push(sanitizeText(c.repoFullName));
+  return bits.join(" \xB7 ");
+}
+async function pickStartableClaim(claims, { prompt = ask, isTTY = process.stdin.isTTY } = {}) {
+  const active = claims.listClaims({ active: true });
+  const { approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, active);
+  const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
+  if (startable.length === 0) {
+    console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
+    return null;
+  }
+  const interactive = Boolean(isTTY);
+  console.log(`
+${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
+`);
+  const width = String(startable.length).length;
+  startable.forEach((c, i) => {
+    console.log(`  ${String(i + 1).padStart(width)}) ${startableRow(c)}`);
+    if (!interactive) console.log(`     terminalhire claim start ${c.id}`);
+  });
+  if (!interactive) {
+    console.log("\nRun the command under the one you want to start.");
+    return null;
+  }
+  const answer = await prompt(`
+Which one? (1-${startable.length}, or q to quit) `);
+  if (answer === "" || /^q(uit)?$/i.test(answer)) return null;
+  const n = Number.parseInt(answer, 10);
+  if (!/^\d+$/.test(answer) || !Number.isInteger(n) || n < 1 || n > startable.length) {
+    console.log(`
+Nothing started \u2014 '${answer}' is not one of 1-${startable.length}.`);
+    return null;
+  }
+  return { id: startable[n - 1].id, approvalsChecked, approvalsUnavailable };
+}
 async function cmdStart(id, flags = {}) {
   const claims = await Promise.resolve().then(() => (init_claims(), claims_exports));
+  let approvalsChecked = false;
+  let approvalsUnavailable = false;
   if (!id) {
-    let list = claims.listClaims({ active: true });
-    await syncFounderApprovals(claims, list);
-    const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
-    if (startable.length === 0) {
-      console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
-      return;
-    }
-    console.log(
-      `
-${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
-`
-    );
-    for (const c of startable) {
-      console.log(`  ${c.title}`);
-      console.log(`    terminalhire claim start ${c.id}`);
-    }
-    console.log("\nRun the command under the one you want to start.");
-    return;
+    const picked = await pickStartableClaim(claims);
+    if (!picked) return;
+    ({ id, approvalsChecked, approvalsUnavailable } = picked);
   }
   let claim = claims.findClaim(id);
   if (!claim) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending") {
-    await syncFounderApprovals(claims, [claim]);
+  if (claim.approval?.state === "pending" && !approvalsChecked) {
+    ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }
   if (claim.worktreePath) {
@@ -28356,19 +28410,18 @@ When it's done:  terminalhire claim submit ${id}`);
   }
   if (claim.approval) {
     console.log(`
-${claim.title}`);
-    if (claim.approval.state === "pending") {
+${sanitizeText(claim.title)}`);
+    console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
+    console.log("  work slice is delivered through terminalhire, and your patch goes back the");
+    console.log("  same way.");
+    if (shouldStatePending(claim, approvalsChecked)) {
+      console.log("\n  Access is pending \u2014 the founder has not approved your claim yet.");
+    } else if (approvalsUnavailable) {
       console.log(
-        "\n  Access is pending \u2014 this approval-only posting needs the founder to approve"
+        "\n  Terminalhire could not check approvals right now; local state was preserved.\n  The next step below still works \u2014 it asks the server directly."
       );
-      console.log("  your claim before any work can be delivered. No fork was attempted: founder");
-      console.log("  postings are never forked or cloned; once approved, your work slice is");
-      console.log("  delivered through terminalhire.");
-    } else {
-      console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
-      console.log("  work slice is delivered through terminalhire, and your patch goes back the");
-      console.log("  same way.");
     }
+    printNextSteps([claim]);
     return;
   }
   if (flags.here) {
@@ -28618,10 +28671,10 @@ var CLAIM_EVENT_LABEL = {
   rejected: "the founder rejected"
 };
 var LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
-var CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+var CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
 function terminalSafeLines(raw) {
   if (typeof raw !== "string" || raw === "") return [];
-  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS, ""));
+  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS3, ""));
 }
 function terminalSafeInline(raw) {
   return terminalSafeLines(raw).join(" ");
@@ -30066,6 +30119,7 @@ export {
   normalizeIntent,
   pickBodySource,
   pickExistingPr,
+  pickStartableClaim,
   printNextSteps,
   readCredentialDisposition,
   renderClaimHistory,
@@ -30081,6 +30135,7 @@ export {
   selectCompetingPrs,
   selectPushRemote,
   shouldRequestAssignment,
+  shouldStatePending,
   sliceWorkDirFor,
   stakeDecision,
   startBranchFor,

package/dist/bin/jpi-contribute.js

@@ -3617,8 +3617,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -3740,7 +3756,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -3796,6 +3812,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-dispatch.js

@@ -15181,8 +15181,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -15304,7 +15320,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR11, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR11, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -15360,6 +15376,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -30909,6 +30926,7 @@ __export(jpi_claim_exports, {
   normalizeIntent: () => normalizeIntent,
   pickBodySource: () => pickBodySource,
   pickExistingPr: () => pickExistingPr,
+  pickStartableClaim: () => pickStartableClaim,
   printNextSteps: () => printNextSteps,
   readCredentialDisposition: () => readCredentialDisposition,
   renderClaimHistory: () => renderClaimHistory,
@@ -30924,6 +30942,7 @@ __export(jpi_claim_exports, {
   selectCompetingPrs: () => selectCompetingPrs,
   selectPushRemote: () => selectPushRemote,
   shouldRequestAssignment: () => shouldRequestAssignment,
+  shouldStatePending: () => shouldStatePending,
   sliceWorkDirFor: () => sliceWorkDirFor,
   stakeDecision: () => stakeDecision,
   startBranchFor: () => startBranchFor,
@@ -31583,7 +31602,10 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  return a != null ? "$" + a.toLocaleString() : "$\u2014";
+  if (a == null) return "$\u2014";
+  if (typeof a === "string" && a.trim() === "") return "$\u2014";
+  const n = typeof a === "number" ? a : Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -32890,35 +32912,62 @@ async function ensureForkExists(repoFullName, ghUser) {
   if (!isFork) throw new Error(`fork ${forkFullName} created but could not be verified as a fork`);
   return forkFullName;
 }
+function shouldStatePending(claim, approvalsChecked) {
+  return Boolean(claim?.approval) && claim.approval.state === "pending" && Boolean(approvalsChecked);
+}
+function startableRow(c) {
+  const bits = [fmtClaimAmount(c), sanitizeText(c.title)];
+  if (c.repoFullName) bits.push(sanitizeText(c.repoFullName));
+  return bits.join(" \xB7 ");
+}
+async function pickStartableClaim(claims, { prompt: prompt5 = ask, isTTY = process.stdin.isTTY } = {}) {
+  const active = claims.listClaims({ active: true });
+  const { approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, active);
+  const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
+  if (startable.length === 0) {
+    console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
+    return null;
+  }
+  const interactive = Boolean(isTTY);
+  console.log(`
+${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
+`);
+  const width = String(startable.length).length;
+  startable.forEach((c, i) => {
+    console.log(`  ${String(i + 1).padStart(width)}) ${startableRow(c)}`);
+    if (!interactive) console.log(`     terminalhire claim start ${c.id}`);
+  });
+  if (!interactive) {
+    console.log("\nRun the command under the one you want to start.");
+    return null;
+  }
+  const answer = await prompt5(`
+Which one? (1-${startable.length}, or q to quit) `);
+  if (answer === "" || /^q(uit)?$/i.test(answer)) return null;
+  const n = Number.parseInt(answer, 10);
+  if (!/^\d+$/.test(answer) || !Number.isInteger(n) || n < 1 || n > startable.length) {
+    console.log(`
+Nothing started \u2014 '${answer}' is not one of 1-${startable.length}.`);
+    return null;
+  }
+  return { id: startable[n - 1].id, approvalsChecked, approvalsUnavailable };
+}
 async function cmdStart(id, flags = {}) {
   const claims = await Promise.resolve().then(() => (init_claims(), claims_exports));
+  let approvalsChecked = false;
+  let approvalsUnavailable = false;
   if (!id) {
-    let list = claims.listClaims({ active: true });
-    await syncFounderApprovals(claims, list);
-    const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
-    if (startable.length === 0) {
-      console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
-      return;
-    }
-    console.log(
-      `
-${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
-`
-    );
-    for (const c of startable) {
-      console.log(`  ${c.title}`);
-      console.log(`    terminalhire claim start ${c.id}`);
-    }
-    console.log("\nRun the command under the one you want to start.");
-    return;
+    const picked = await pickStartableClaim(claims);
+    if (!picked) return;
+    ({ id, approvalsChecked, approvalsUnavailable } = picked);
   }
   let claim = claims.findClaim(id);
   if (!claim) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending") {
-    await syncFounderApprovals(claims, [claim]);
+  if (claim.approval?.state === "pending" && !approvalsChecked) {
+    ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }
   if (claim.worktreePath) {
@@ -32939,19 +32988,18 @@ When it's done:  terminalhire claim submit ${id}`);
   }
   if (claim.approval) {
     console.log(`
-${claim.title}`);
-    if (claim.approval.state === "pending") {
+${sanitizeText(claim.title)}`);
+    console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
+    console.log("  work slice is delivered through terminalhire, and your patch goes back the");
+    console.log("  same way.");
+    if (shouldStatePending(claim, approvalsChecked)) {
+      console.log("\n  Access is pending \u2014 the founder has not approved your claim yet.");
+    } else if (approvalsUnavailable) {
       console.log(
-        "\n  Access is pending \u2014 this approval-only posting needs the founder to approve"
+        "\n  Terminalhire could not check approvals right now; local state was preserved.\n  The next step below still works \u2014 it asks the server directly."
       );
-      console.log("  your claim before any work can be delivered. No fork was attempted: founder");
-      console.log("  postings are never forked or cloned; once approved, your work slice is");
-      console.log("  delivered through terminalhire.");
-    } else {
-      console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
-      console.log("  work slice is delivered through terminalhire, and your patch goes back the");
-      console.log("  same way.");
     }
+    printNextSteps([claim]);
     return;
   }
   if (flags.here) {
@@ -33189,7 +33237,7 @@ function renderRunView(run32, message) {
 }
 function terminalSafeLines(raw) {
   if (typeof raw !== "string" || raw === "") return [];
-  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS2, ""));
+  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS3, ""));
 }
 function terminalSafeInline(raw) {
   return terminalSafeLines(raw).join(" ");
@@ -34593,12 +34641,13 @@ async function run7() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE3, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE3, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
     init_src();
     init_open_url();
+    init_sanitize();
     init_policy_acks();
     init_claims();
     init_state_dir();
@@ -34661,7 +34710,7 @@ var init_jpi_claim = __esm({
       rejected: "the founder rejected"
     };
     LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
-    CONTROL_CHARS2 = /[\u0000-\u001F\u007F-\u009F]/g;
+    CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
   }
 });
 

package/dist/bin/jpi-hub.js

@@ -538,8 +538,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -661,7 +677,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -717,6 +733,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-mcp.js

@@ -10977,6 +10977,19 @@ var init_open_url = __esm({
   }
 });
 
+// bin/sanitize.js
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(CONTROL_CHARS, "");
+}
+var CONTROL_CHARS;
+var init_sanitize = __esm({
+  "bin/sanitize.js"() {
+    "use strict";
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+  }
+});
+
 // src/policy-acks.ts
 var policy_acks_exports = {};
 __export(policy_acks_exports, {
@@ -11127,8 +11140,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -11250,7 +11279,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -11306,6 +11335,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -26374,6 +26404,7 @@ __export(jpi_claim_exports, {
   normalizeIntent: () => normalizeIntent,
   pickBodySource: () => pickBodySource,
   pickExistingPr: () => pickExistingPr,
+  pickStartableClaim: () => pickStartableClaim,
   printNextSteps: () => printNextSteps,
   readCredentialDisposition: () => readCredentialDisposition,
   renderClaimHistory: () => renderClaimHistory,
@@ -26389,6 +26420,7 @@ __export(jpi_claim_exports, {
   selectCompetingPrs: () => selectCompetingPrs,
   selectPushRemote: () => selectPushRemote,
   shouldRequestAssignment: () => shouldRequestAssignment,
+  shouldStatePending: () => shouldStatePending,
   sliceWorkDirFor: () => sliceWorkDirFor,
   stakeDecision: () => stakeDecision,
   startBranchFor: () => startBranchFor,
@@ -27048,7 +27080,10 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  return a != null ? "$" + a.toLocaleString() : "$\u2014";
+  if (a == null) return "$\u2014";
+  if (typeof a === "string" && a.trim() === "") return "$\u2014";
+  const n = typeof a === "number" ? a : Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -28355,35 +28390,62 @@ async function ensureForkExists(repoFullName, ghUser) {
   if (!isFork) throw new Error(`fork ${forkFullName} created but could not be verified as a fork`);
   return forkFullName;
 }
+function shouldStatePending(claim, approvalsChecked) {
+  return Boolean(claim?.approval) && claim.approval.state === "pending" && Boolean(approvalsChecked);
+}
+function startableRow(c) {
+  const bits = [fmtClaimAmount(c), sanitizeText(c.title)];
+  if (c.repoFullName) bits.push(sanitizeText(c.repoFullName));
+  return bits.join(" \xB7 ");
+}
+async function pickStartableClaim(claims, { prompt = ask, isTTY = process.stdin.isTTY } = {}) {
+  const active = claims.listClaims({ active: true });
+  const { approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, active);
+  const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
+  if (startable.length === 0) {
+    console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
+    return null;
+  }
+  const interactive = Boolean(isTTY);
+  console.log(`
+${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
+`);
+  const width = String(startable.length).length;
+  startable.forEach((c, i) => {
+    console.log(`  ${String(i + 1).padStart(width)}) ${startableRow(c)}`);
+    if (!interactive) console.log(`     terminalhire claim start ${c.id}`);
+  });
+  if (!interactive) {
+    console.log("\nRun the command under the one you want to start.");
+    return null;
+  }
+  const answer = await prompt(`
+Which one? (1-${startable.length}, or q to quit) `);
+  if (answer === "" || /^q(uit)?$/i.test(answer)) return null;
+  const n = Number.parseInt(answer, 10);
+  if (!/^\d+$/.test(answer) || !Number.isInteger(n) || n < 1 || n > startable.length) {
+    console.log(`
+Nothing started \u2014 '${answer}' is not one of 1-${startable.length}.`);
+    return null;
+  }
+  return { id: startable[n - 1].id, approvalsChecked, approvalsUnavailable };
+}
 async function cmdStart(id, flags = {}) {
   const claims = await Promise.resolve().then(() => (init_claims(), claims_exports));
+  let approvalsChecked = false;
+  let approvalsUnavailable = false;
   if (!id) {
-    let list = claims.listClaims({ active: true });
-    await syncFounderApprovals(claims, list);
-    const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
-    if (startable.length === 0) {
-      console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
-      return;
-    }
-    console.log(
-      `
-${startable.length} claim${startable.length === 1 ? "" : "s"} ready to start:
-`
-    );
-    for (const c of startable) {
-      console.log(`  ${c.title}`);
-      console.log(`    terminalhire claim start ${c.id}`);
-    }
-    console.log("\nRun the command under the one you want to start.");
-    return;
+    const picked = await pickStartableClaim(claims);
+    if (!picked) return;
+    ({ id, approvalsChecked, approvalsUnavailable } = picked);
   }
   let claim = claims.findClaim(id);
   if (!claim) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending") {
-    await syncFounderApprovals(claims, [claim]);
+  if (claim.approval?.state === "pending" && !approvalsChecked) {
+    ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }
   if (claim.worktreePath) {
@@ -28404,19 +28466,18 @@ When it's done:  terminalhire claim submit ${id}`);
   }
   if (claim.approval) {
     console.log(`
-${claim.title}`);
-    if (claim.approval.state === "pending") {
+${sanitizeText(claim.title)}`);
+    console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
+    console.log("  work slice is delivered through terminalhire, and your patch goes back the");
+    console.log("  same way.");
+    if (shouldStatePending(claim, approvalsChecked)) {
+      console.log("\n  Access is pending \u2014 the founder has not approved your claim yet.");
+    } else if (approvalsUnavailable) {
       console.log(
-        "\n  Access is pending \u2014 this approval-only posting needs the founder to approve"
+        "\n  Terminalhire could not check approvals right now; local state was preserved.\n  The next step below still works \u2014 it asks the server directly."
       );
-      console.log("  your claim before any work can be delivered. No fork was attempted: founder");
-      console.log("  postings are never forked or cloned; once approved, your work slice is");
-      console.log("  delivered through terminalhire.");
-    } else {
-      console.log("\n  No fork was attempted \u2014 founder postings are never forked or cloned. Your");
-      console.log("  work slice is delivered through terminalhire, and your patch goes back the");
-      console.log("  same way.");
     }
+    printNextSteps([claim]);
     return;
   }
   if (flags.here) {
@@ -28654,7 +28715,7 @@ function renderRunView(run3, message) {
 }
 function terminalSafeLines(raw) {
   if (typeof raw !== "string" || raw === "") return [];
-  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS, ""));
+  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS3, ""));
 }
 function terminalSafeInline(raw) {
   return terminalSafeLines(raw).join(" ");
@@ -30058,12 +30119,13 @@ async function run() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE2, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS;
+var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE2, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
     init_src();
     init_open_url();
+    init_sanitize();
     init_policy_acks();
     init_claims();
     init_state_dir();
@@ -30126,7 +30188,7 @@ var init_jpi_claim = __esm({
       rejected: "the founder rejected"
     };
     LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
-    CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+    CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
   }
 });
 

package/dist/bin/jpi-refresh.js

@@ -12562,8 +12562,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -12685,7 +12701,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR8, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR8, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -12741,6 +12757,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-repo.js

@@ -1909,8 +1909,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -2032,7 +2048,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR4, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR4, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -2088,6 +2104,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-statusline.js

@@ -92,7 +92,7 @@ function render() {
     const founderOpen = founderOpenCount(entry);
     const stale = sessionStale(entry) && unread === 0 && incoming === 0;
     const segments = [];
-    if (approved > 0) segments.push(`\u2705 ${approved} approved \u2014 run: th claim list`);
+    if (approved > 0) segments.push(`\u2705 ${approved} approved \u2014 run: th claim start`);
     if (founderNeedsYou > 0) {
       segments.push(
         `\u{1F9ED} ${founderNeedsYou} claim${founderNeedsYou === 1 ? "" : "s"} await your decision \u2014 run: th bounties`

package/dist/src/claims.js

@@ -161,8 +161,25 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function defangText(s) {
+  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Local-first job matching for developers — ambient job matches in the Claude Code spinner. Your profile never leaves your machine.",
   "repository": {
     "type": "git",