terminalhire 0.41.1 → 0.41.3

package/dist/bin/claim-push-bg.js

@@ -166,8 +166,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -289,7 +305,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -345,6 +361,8 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 

package/dist/bin/jpi-bounties.js

@@ -11338,8 +11338,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -11461,7 +11477,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -11517,6 +11533,8 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -11738,10 +11756,17 @@ import { homedir as homedir7 } from "os";
 import { createInterface } from "readline";
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function safeHttpUrl(url) {
   if (url == null) return null;
@@ -11814,7 +11839,7 @@ function prompt(question) {
   });
 }
 function formatAmount(b) {
-  return b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
+  return formatUsd(b.amountUSD);
 }
 var EFFORT_LABEL = {
   small: "small (~\xBD day)",
@@ -11963,7 +11988,9 @@ async function run() {
           const rows = founderRows2(surface, "bounties");
           console.log("\n\u26A1 Your TerminalHire postings\n");
           if (!rows.length) {
-            console.log("  No current posting data. Run `terminalhire refresh`, or lead with work:");
+            console.log(
+              "  No current posting data. Run `terminalhire refresh`, or lead with work:"
+            );
             console.log("  terminalhire config set lead dev\n");
           } else {
             rows.forEach((row, index) => {
@@ -11972,7 +11999,9 @@ async function run() {
               );
             });
             console.log("\n  Review and act: https://terminalhire.com/dashboard?tab=postings");
-            console.log("  Lead with developer bounties instead: terminalhire config set lead dev\n");
+            console.log(
+              "  Lead with developer bounties instead: terminalhire config set lead dev\n"
+            );
           }
           return;
         }

package/dist/bin/jpi-claim.js

@@ -10638,8 +10638,24 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -10761,7 +10777,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -10817,6 +10833,8 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -26057,10 +26075,17 @@ function openInBrowser(url) {
 }
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 
 // src/policy-acks.ts
@@ -26986,7 +27011,7 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  return a != null ? "$" + a.toLocaleString() : "$\u2014";
+  return formatUsd(a);
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -27127,8 +27152,15 @@ async function resolveBounty(arg) {
   return {
     bountyId,
     indexNativeId,
-    title,
-    repoFullName,
+    // DEFANGED HERE, at the one place every tier of this resolver converges.
+    // `claims.ts` cleans what comes OUT of the local store, which covers every later
+    // read — but this object is printed (the preview card, the record card) and
+    // handed to `recordClaim` BEFORE any store exists for it, so on a claim's first
+    // use the store boundary has not run yet. `repoFullName` also goes on to be
+    // interpolated into GitHub API URLs from here. Found by a cross-model review of
+    // TERM-380; the store fix alone left this path open.
+    title: sanitizeText(title),
+    repoFullName: repoFullName == null ? repoFullName : sanitizeText(repoFullName),
     issueUrl,
     amountUSD,
     source,
@@ -28324,7 +28356,7 @@ function startableRow(c) {
 }
 async function pickStartableClaim(claims, { prompt = ask, isTTY = process.stdin.isTTY } = {}) {
   const active = claims.listClaims({ active: true });
-  await syncFounderApprovals(claims, active);
+  const { approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, active);
   const startable = claims.listClaims({ active: true }).filter((c) => c.state === "claimed");
   if (startable.length === 0) {
     console.log("No claims ready to start. Claim one first:  terminalhire claim <ref>");
@@ -28352,23 +28384,24 @@ Which one? (1-${startable.length}, or q to quit) `);
 Nothing started \u2014 '${answer}' is not one of 1-${startable.length}.`);
     return null;
   }
-  return startable[n - 1].id;
+  return { id: startable[n - 1].id, approvalsChecked, approvalsUnavailable };
 }
 async function cmdStart(id, flags = {}) {
   const claims = await Promise.resolve().then(() => (init_claims(), claims_exports));
+  let approvalsChecked = false;
+  let approvalsUnavailable = false;
   if (!id) {
     const picked = await pickStartableClaim(claims);
     if (!picked) return;
-    id = picked;
+    ({ id, approvalsChecked, approvalsUnavailable } = picked);
   }
   let claim = claims.findClaim(id);
   if (!claim) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  let approvalsChecked = false;
   if (claim.approval?.state === "pending") {
-    ({ approvalsChecked } = await syncFounderApprovals(claims, [claim]));
+    ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }
   if (claim.worktreePath) {
@@ -28395,6 +28428,10 @@ ${sanitizeText(claim.title)}`);
     console.log("  same way.");
     if (shouldStatePending(claim, approvalsChecked)) {
       console.log("\n  Access is pending \u2014 the founder has not approved your claim yet.");
+    } else if (approvalsUnavailable) {
+      console.log(
+        "\n  Terminalhire could not check approvals right now; local state was preserved.\n  The next step below still works \u2014 it asks the server directly."
+      );
     }
     printNextSteps([claim]);
     return;
@@ -28646,10 +28683,10 @@ var CLAIM_EVENT_LABEL = {
   rejected: "the founder rejected"
 };
 var LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
-var CONTROL_CHARS2 = /[\u0000-\u001F\u007F-\u009F]/g;
+var CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
 function terminalSafeLines(raw) {
   if (typeof raw !== "string" || raw === "") return [];
-  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS2, ""));
+  return raw.split(LINE_BREAKS).map((l) => l.replace(CONTROL_CHARS3, ""));
 }
 function terminalSafeInline(raw) {
   return terminalSafeLines(raw).join(" ");

package/dist/bin/jpi-contribute.js

@@ -3617,8 +3617,24 @@ function nextPolledState(from, observed) {
 function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function defangText(s) {
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
 function normalizeClaim(c) {
-  return { ...c, kind: c.kind ?? "bounty", policy: c.policy ?? null };
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
 }
 function readClaims() {
   try {
@@ -3740,7 +3756,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS;
+var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -3796,6 +3812,8 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
+    CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
 
@@ -3879,10 +3897,11 @@ function isContributeEnabled() {
 init_state_dir();
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
 }
 function safeHttpUrl(url) {
   if (url == null) return null;

package/dist/bin/jpi-devs.js

@@ -11053,10 +11053,11 @@ function excludeOwnCard(results, ownLogin) {
 }
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
 }
 function safeHttpUrl(url) {
   if (url == null) return null;