terminalhire 0.42.1 → 0.42.2

package/dist/bin/claim-push-bg.js

@@ -167,7 +167,7 @@ function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -305,7 +305,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
+var TERMINALHIRE_DIR3, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -361,6 +361,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });

package/dist/bin/jpi-bounties.js

@@ -11339,7 +11339,7 @@ function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -11477,7 +11477,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -11533,6 +11533,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -11748,17 +11749,38 @@ var init_founder_paid_badge = __esm({
 
 // bin/jpi-bounties.js
 init_src();
-init_cache_store();
 import { readFileSync as readFileSync7 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir7 } from "os";
 import { createInterface } from "readline";
 
+// ../../packages/core/src/payout-split.ts
+var PLATFORM_TAKE_BPS = 1e3;
+function platformFeeCents(totalCents) {
+  return Math.ceil(totalCents * PLATFORM_TAKE_BPS / 1e4);
+}
+function developerShareCents(totalCents) {
+  return totalCents - platformFeeCents(totalCents);
+}
+function formatCents(cents) {
+  return cents % 100 === 0 ? `$${cents / 100}` : `$${(cents / 100).toFixed(2)}`;
+}
+
+// bin/jpi-bounties.js
+init_cache_store();
+
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function safeHttpUrl(url) {
   if (url == null) return null;
@@ -11831,13 +11853,33 @@ function prompt(question) {
   });
 }
 function formatAmount(b) {
-  return b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
+  return formatUsd(b.amountUSD);
 }
 var EFFORT_LABEL = {
   small: "small (~\xBD day)",
   medium: "medium (~1 day)",
   large: "large (multi-day)"
 };
+function founderClaimBlurb(amountUSD, paidWork) {
+  if (paidWork === false) {
+    return "Claim it from here \u2014 this posting records a credential for the work, not a payment. Take it for the credential, not the money.";
+  }
+  if (paidWork !== true) {
+    return "Claim it from here \u2014 this listing is missing its payment status, so it is not safe to say whether the work pays. Try `terminalhire refresh`; if it is still missing, do not count on being paid for this one.";
+  }
+  let share = "";
+  if (typeof amountUSD === "number" && Number.isFinite(amountUSD) && amountUSD > 0) {
+    share = ` You'd receive ${formatCents(developerShareCents(Math.round(amountUSD * 100)))} of the ${formatCents(Math.round(amountUSD * 100))} posted; terminalhire keeps 10%.`;
+  }
+  return `Claim it from here \u2014 the founder pays through terminalhire rather than off-platform, and their acceptance is what triggers your payout.${share}`;
+}
+function founderClaimBlock(job) {
+  const ref = opportunityShortToken(job.id);
+  return `
+${founderClaimBlurb(job.bounty?.amountUSD, job.bounty?.paidWork)}
+  terminalhire claim ${ref}
+  ${sanitizeText(job.bounty?.claimUrl ?? job.url)}`;
+}
 function printBounty(i, job, score, reason, matchedTags, claimedIds = /* @__PURE__ */ new Set(), continuityNote = null) {
   const b = job.bounty ?? {};
   const stars = b.repoStars != null ? ` \xB7 ${b.repoStars}\u2605` : "";
@@ -11980,7 +12022,9 @@ async function run() {
           const rows = founderRows2(surface, "bounties");
           console.log("\n\u26A1 Your TerminalHire postings\n");
           if (!rows.length) {
-            console.log("  No current posting data. Run `terminalhire refresh`, or lead with work:");
+            console.log(
+              "  No current posting data. Run `terminalhire refresh`, or lead with work:"
+            );
             console.log("  terminalhire config set lead dev\n");
           } else {
             rows.forEach((row, index) => {
@@ -11989,7 +12033,9 @@ async function run() {
               );
             });
             console.log("\n  Review and act: https://terminalhire.com/dashboard?tab=postings");
-            console.log("  Lead with developer bounties instead: terminalhire config set lead dev\n");
+            console.log(
+              "  Lead with developer bounties instead: terminalhire config set lead dev\n"
+            );
           }
           return;
         }
@@ -12064,6 +12110,10 @@ Enter a number to open a bounty's claim page, or press Enter to exit: `
     const idx = parseInt(pick, 10) - 1;
     if (Number.isNaN(idx) || idx < 0 || idx >= shown.length) return;
     const chosen = shown[idx];
+    if (chosen.bounty?.bountySource === "founder") {
+      console.log(founderClaimBlock(chosen));
+      return;
+    }
     console.log(
       `
 Open this to claim/work the bounty (you go straight to the source \u2014 we never touch payment):
@@ -12079,6 +12129,8 @@ export {
   classifyEmptyStatus,
   continuityNoteForRow,
   filterPaidVisibility,
+  founderClaimBlock,
+  founderClaimBlurb,
   getBounties,
   isPinnedFounderBounty,
   printBounty,

package/dist/bin/jpi-claim.js

@@ -10639,7 +10639,7 @@ function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -10777,7 +10777,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR2, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -10833,6 +10833,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -26151,10 +26152,17 @@ function openInBrowser(url) {
 }
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 
 // src/policy-acks.ts
@@ -27081,10 +27089,7 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  if (a == null) return "$\u2014";
-  if (typeof a === "string" && a.trim() === "") return "$\u2014";
-  const n = typeof a === "number" ? a : Number(a);
-  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+  return formatUsd(a);
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -27225,8 +27230,15 @@ async function resolveBounty(arg) {
   return {
     bountyId,
     indexNativeId,
-    title,
-    repoFullName,
+    // DEFANGED HERE, at the one place every tier of this resolver converges.
+    // `claims.ts` cleans what comes OUT of the local store, which covers every later
+    // read — but this object is printed (the preview card, the record card) and
+    // handed to `recordClaim` BEFORE any store exists for it, so on a claim's first
+    // use the store boundary has not run yet. `repoFullName` also goes on to be
+    // interpolated into GitHub API URLs from here. Found by a cross-model review of
+    // TERM-380; the store fix alone left this path open.
+    title: sanitizeText(title),
+    repoFullName: repoFullName == null ? repoFullName : sanitizeText(repoFullName),
     issueUrl,
     amountUSD,
     source,
@@ -28466,7 +28478,7 @@ async function cmdStart(id, flags = {}) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending" && !approvalsChecked) {
+  if (claim.approval?.state === "pending") {
     ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }

package/dist/bin/jpi-contribute.js

@@ -3618,7 +3618,7 @@ function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -3756,7 +3756,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR7, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -3812,6 +3812,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -3896,10 +3897,11 @@ function isContributeEnabled() {
 init_state_dir();
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
 }
 function safeHttpUrl(url) {
   if (url == null) return null;

package/dist/bin/jpi-devs.js

@@ -11053,10 +11053,11 @@ function excludeOwnCard(results, ownLogin) {
 }
 
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
 }
 function safeHttpUrl(url) {
   if (url == null) return null;

package/dist/bin/jpi-dispatch.js

@@ -12831,7 +12831,13 @@ var init_cache_store = __esm({
 // bin/sanitize.js
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function safeHttpUrl(url) {
   if (url == null) return null;
@@ -12857,10 +12863,11 @@ function linkTitle(title, url) {
   }
   return href ? `${safeTitle} (${href})` : safeTitle;
 }
-var CONTROL_CHARS;
+var WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_sanitize = __esm({
   "bin/sanitize.js"() {
     "use strict";
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -13578,7 +13585,7 @@ function buildTipsDetailed(topMatches, baseUrl, max = 8, opts = {}) {
       const token = jobShortToken(String(m.id));
       const url = `${base}/j/${token}`;
       if (source === "bounty") {
-        const money = m.amountUSD != null ? `$${Number(m.amountUSD).toLocaleString()}` : "$\u2014";
+        const money = formatUsd(m.amountUSD);
         const repo = m.repo || companyRaw;
         out.push(`\u{1F48E} ${money} \xB7 ${title} \xB7 ${repo} \xB7 ${pct2}% \u2014 ${url}`);
       } else if (source === "contribute") {
@@ -13648,6 +13655,7 @@ var init_spinner_render = __esm({
     init_spinner_verbs();
     init_spinner_seen();
     init_spinner_io();
+    init_sanitize();
     init_src();
   }
 });
@@ -14853,6 +14861,24 @@ var init_jpi_project = __esm({
   }
 });
 
+// ../../packages/core/src/payout-split.ts
+function platformFeeCents(totalCents) {
+  return Math.ceil(totalCents * PLATFORM_TAKE_BPS / 1e4);
+}
+function developerShareCents(totalCents) {
+  return totalCents - platformFeeCents(totalCents);
+}
+function formatCents(cents) {
+  return cents % 100 === 0 ? `$${cents / 100}` : `$${(cents / 100).toFixed(2)}`;
+}
+var PLATFORM_TAKE_BPS;
+var init_payout_split = __esm({
+  "../../packages/core/src/payout-split.ts"() {
+    "use strict";
+    PLATFORM_TAKE_BPS = 1e3;
+  }
+});
+
 // bin/founder-pin.js
 function isPinnedFounderBounty(j) {
   return j?.bounty?.bountySource === "founder" && j?.bounty?.claimable === true;
@@ -15182,7 +15208,7 @@ function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -15320,7 +15346,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR11, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR11, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -15376,6 +15402,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -15424,6 +15451,8 @@ __export(jpi_bounties_exports, {
   classifyEmptyStatus: () => classifyEmptyStatus,
   continuityNoteForRow: () => continuityNoteForRow,
   filterPaidVisibility: () => filterPaidVisibility,
+  founderClaimBlock: () => founderClaimBlock,
+  founderClaimBlurb: () => founderClaimBlurb,
   getBounties: () => getBounties,
   isPinnedFounderBounty: () => isPinnedFounderBounty,
   printBounty: () => printBounty,
@@ -15465,7 +15494,27 @@ function prompt3(question) {
   });
 }
 function formatAmount(b) {
-  return b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
+  return formatUsd(b.amountUSD);
+}
+function founderClaimBlurb(amountUSD, paidWork) {
+  if (paidWork === false) {
+    return "Claim it from here \u2014 this posting records a credential for the work, not a payment. Take it for the credential, not the money.";
+  }
+  if (paidWork !== true) {
+    return "Claim it from here \u2014 this listing is missing its payment status, so it is not safe to say whether the work pays. Try `terminalhire refresh`; if it is still missing, do not count on being paid for this one.";
+  }
+  let share = "";
+  if (typeof amountUSD === "number" && Number.isFinite(amountUSD) && amountUSD > 0) {
+    share = ` You'd receive ${formatCents(developerShareCents(Math.round(amountUSD * 100)))} of the ${formatCents(Math.round(amountUSD * 100))} posted; terminalhire keeps 10%.`;
+  }
+  return `Claim it from here \u2014 the founder pays through terminalhire rather than off-platform, and their acceptance is what triggers your payout.${share}`;
+}
+function founderClaimBlock(job) {
+  const ref = opportunityShortToken(job.id);
+  return `
+${founderClaimBlurb(job.bounty?.amountUSD, job.bounty?.paidWork)}
+  terminalhire claim ${ref}
+  ${sanitizeText(job.bounty?.claimUrl ?? job.url)}`;
 }
 function printBounty(i, job, score, reason, matchedTags, claimedIds = /* @__PURE__ */ new Set(), continuityNote = null) {
   const b = job.bounty ?? {};
@@ -15609,7 +15658,9 @@ async function run5() {
           const rows = founderRows2(surface, "bounties");
           console.log("\n\u26A1 Your TerminalHire postings\n");
           if (!rows.length) {
-            console.log("  No current posting data. Run `terminalhire refresh`, or lead with work:");
+            console.log(
+              "  No current posting data. Run `terminalhire refresh`, or lead with work:"
+            );
             console.log("  terminalhire config set lead dev\n");
           } else {
             rows.forEach((row, index) => {
@@ -15618,7 +15669,9 @@ async function run5() {
               );
             });
             console.log("\n  Review and act: https://terminalhire.com/dashboard?tab=postings");
-            console.log("  Lead with developer bounties instead: terminalhire config set lead dev\n");
+            console.log(
+              "  Lead with developer bounties instead: terminalhire config set lead dev\n"
+            );
           }
           return;
         }
@@ -15693,6 +15746,10 @@ Enter a number to open a bounty's claim page, or press Enter to exit: `
     const idx = parseInt(pick2, 10) - 1;
     if (Number.isNaN(idx) || idx < 0 || idx >= shown.length) return;
     const chosen = shown[idx];
+    if (chosen.bounty?.bountySource === "founder") {
+      console.log(founderClaimBlock(chosen));
+      return;
+    }
     console.log(
       `
 Open this to claim/work the bounty (you go straight to the source \u2014 we never touch payment):
@@ -15708,6 +15765,7 @@ var init_jpi_bounties = __esm({
   "bin/jpi-bounties.js"() {
     "use strict";
     init_src();
+    init_payout_split();
     init_cache_store();
     init_sanitize();
     init_founder_pin();
@@ -31679,10 +31737,7 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  if (a == null) return "$\u2014";
-  if (typeof a === "string" && a.trim() === "") return "$\u2014";
-  const n = typeof a === "number" ? a : Number(a);
-  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+  return formatUsd(a);
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -31821,8 +31876,15 @@ async function resolveBounty(arg) {
   return {
     bountyId,
     indexNativeId,
-    title,
-    repoFullName,
+    // DEFANGED HERE, at the one place every tier of this resolver converges.
+    // `claims.ts` cleans what comes OUT of the local store, which covers every later
+    // read — but this object is printed (the preview card, the record card) and
+    // handed to `recordClaim` BEFORE any store exists for it, so on a claim's first
+    // use the store boundary has not run yet. `repoFullName` also goes on to be
+    // interpolated into GitHub API URLs from here. Found by a cross-model review of
+    // TERM-380; the store fix alone left this path open.
+    title: sanitizeText(title),
+    repoFullName: repoFullName == null ? repoFullName : sanitizeText(repoFullName),
     issueUrl,
     amountUSD,
     source,
@@ -33043,7 +33105,7 @@ async function cmdStart(id, flags = {}) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending" && !approvalsChecked) {
+  if (claim.approval?.state === "pending") {
     ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }
@@ -39891,7 +39953,12 @@ function substrMatch(query, candidate) {
   if (query === "") return true;
   return candidate.toLowerCase().includes(query.toLowerCase());
 }
-function runHubTui({ input = process.stdin, output = process.stdout, signals, deps = {} } = {}) {
+function runHubTui({
+  input = process.stdin,
+  output = process.stdout,
+  signals,
+  deps = {}
+} = {}) {
   const {
     listClaims: _listClaims = listClaims,
     acceptedPRRate: _acceptedPRRate = acceptedPRRate,
@@ -40054,20 +40121,50 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
           acked = false;
         }
         if (!acked) {
-          inboxState = { loaded: true, loading: false, status: "disclosure", items: null, message: null };
+          inboxState = {
+            loaded: true,
+            loading: false,
+            status: "disclosure",
+            items: null,
+            message: null
+          };
           return;
         }
         inboxState = { ...inboxState, loading: true };
         _buildInboxItems().then((built) => {
           if (built.status === "ok") {
-            inboxState = { loaded: true, loading: false, status: "ok", items: built.items, message: null };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: "ok",
+              items: built.items,
+              message: null
+            };
           } else if (built.status === "error") {
-            inboxState = { loaded: true, loading: false, status: "error", items: null, message: built.message || "could not load inbox" };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: "error",
+              items: null,
+              message: built.message || "could not load inbox"
+            };
           } else {
-            inboxState = { loaded: true, loading: false, status: built.status, items: null, message: null };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: built.status,
+              items: null,
+              message: null
+            };
           }
         }).catch((e) => {
-          inboxState = { loaded: true, loading: false, status: "error", items: null, message: errMsg(e) };
+          inboxState = {
+            loaded: true,
+            loading: false,
+            status: "error",
+            items: null,
+            message: errMsg(e)
+          };
         }).finally(() => repaint());
         return;
       }
@@ -40101,7 +40198,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
     function inboxRows(st) {
       switch (st.status) {
         case "disclosure":
-          return ["Messaging disclosure not yet acknowledged \u2014 run `terminalhire inbox` once to review it and enable messages."];
+          return [
+            "Messaging disclosure not yet acknowledged \u2014 run `terminalhire inbox` once to review it and enable messages."
+          ];
         case "not-linked":
           return ["Not linked \u2014 run `terminalhire link` to connect your web session."];
         case "expired":
@@ -40144,11 +40243,13 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         case "empty":
           return ["No bounties available right now. Check back through the day."];
         case "demoted":
-          return ["Paid bounties paused \u2014 run `bounties --priced` to view them. Try Contribute or Jobs."];
+          return [
+            "Paid bounties paused \u2014 run `bounties --priced` to view them. Try Contribute or Jobs."
+          ];
         case "ok":
           return result.bounties.map((job) => {
             const b = job.bounty || {};
-            const amt = b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
+            const amt = formatUsd(b.amountUSD);
             const repo = sanitizeLine(b.repoFullName || job.company);
             const prs = b.competingOpenPRs;
             const contend = prs != null && prs > 0 ? ` \xB7 \u26A0 ${prs} in flight` : "";
@@ -40203,7 +40304,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
             if (it.note) rows.push(`    note: ${sanitizeLine(it.note)}`);
             if (it.contact) rows.push(`    contact: ${sanitizeLine(it.contact)}`);
             else if (it.role === "incoming" && it.status === "pending") {
-              rows.push(`    \u2192 accept: terminalhire intro --accept @${sanitizeLine(it.counterpartyLogin)}`);
+              rows.push(
+                `    \u2192 accept: terminalhire intro --accept @${sanitizeLine(it.counterpartyLogin)}`
+              );
             }
           }
           return rows;
@@ -40290,7 +40393,8 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
       if (name === "Claims") {
         if (!claimsState.loaded) return ["Loading\u2026"];
         if (claimsState.error) return ["Could not read claims \u2014 " + claimsState.error];
-        if (!claimsState.rows.length) return ["No claims yet \u2014 run `terminalhire claim <url>` to start one."];
+        if (!claimsState.rows.length)
+          return ["No claims yet \u2014 run `terminalhire claim <url>` to start one."];
         return claimsState.rows.map(formatClaimRow);
       }
       if (name === "Profile") {
@@ -40320,8 +40424,10 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         const st = listState[name];
         if (st.loaded && !st.error && st.result && st.result.status === "ok") {
           if (name === "Jobs") return `${st.result.ranked.length} roles matching your profile`;
-          if (name === "Bounties") return `${st.result.bounties.length} bounties you could knock out`;
-          if (name === "Devs") return `${st.result.results.length} matches in the builder directory`;
+          if (name === "Bounties")
+            return `${st.result.bounties.length} bounties you could knock out`;
+          if (name === "Devs")
+            return `${st.result.results.length} matches in the builder directory`;
         }
         return name;
       }
@@ -40351,7 +40457,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         const row = startRow + i;
         if (row < 0 || row >= rows) continue;
         const t = TH_GLYPH.length <= 1 ? 0 : i / (TH_GLYPH.length - 1);
-        drawText(buf, cols, row, startCol, TH_GLYPH[i], { fg: gradientFg(BRAND_GRADIENT, t, level) });
+        drawText(buf, cols, row, startCol, TH_GLYPH[i], {
+          fg: gradientFg(BRAND_GRADIENT, t, level)
+        });
       }
       const hint = "press any key to continue";
       const hintRow = Math.min(rows - 1, startRow + TH_GLYPH.length + 1);
@@ -40805,6 +40913,7 @@ var init_jpi_hub = __esm({
   "bin/jpi-hub.js"() {
     "use strict";
     init_tui_core();
+    init_sanitize();
     init_claims();
     init_profile();
     init_config();
@@ -40842,7 +40951,15 @@ var init_jpi_hub = __esm({
     ];
     BRAND_GRADIENT = ["#9d8fff", "#7c6af7", "#5b4fcf"];
     DEFAULT_SPLASH_MS = 900;
-    STATE_LEVEL = { abandoned: 0, claimed: 2, working: 3, "in-review": 4, ready: 5, submitted: 6, merged: 7 };
+    STATE_LEVEL = {
+      abandoned: 0,
+      claimed: 2,
+      working: 3,
+      "in-review": 4,
+      ready: 5,
+      submitted: 6,
+      merged: 7
+    };
     SPARK_LEVELS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
   }
 });

package/dist/bin/jpi-hub.js

@@ -380,6 +380,19 @@ var init_tui_core = __esm({
   }
 });
 
+// bin/sanitize.js
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+var init_sanitize = __esm({
+  "bin/sanitize.js"() {
+    "use strict";
+  }
+});
+
 // src/state-dir.ts
 import { closeSync, constants, fchmodSync, fstatSync, mkdirSync, openSync } from "fs";
 function warnStateDirOnce(dir, message) {
@@ -539,7 +552,7 @@ function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -677,7 +690,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
+var TERMINALHIRE_DIR, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -733,6 +746,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -12649,6 +12663,7 @@ var init_intro2 = __esm({
 
 // bin/jpi-hub.js
 init_tui_core();
+init_sanitize();
 init_claims();
 init_profile();
 init_config();
@@ -12685,6 +12700,7 @@ var BAK_FILE = `${STATUS_FILE}.bak`;
 
 // bin/jpi-jobs.js
 init_cache_store();
+init_sanitize();
 var __dirname = fileURLToPath2(new URL(".", import.meta.url));
 var TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join16(homedir13(), ".terminalhire");
 var INDEX_CACHE_FILE3 = join16(TERMINALHIRE_DIR11, "index-cache.json");
@@ -12771,11 +12787,12 @@ async function getJobMatches({ quiet = false, offline = false } = {}) {
 
 // bin/jpi-bounties.js
 init_src();
-init_cache_store();
 import { readFileSync as readFileSync15 } from "fs";
 import { join as join18 } from "path";
 import { homedir as homedir15 } from "os";
 import { createInterface as createInterface3 } from "readline";
+init_cache_store();
+init_sanitize();
 init_founder_pin();
 var TERMINALHIRE_DIR13 = process.env.TERMINALHIRE_DIR || join18(homedir15(), ".terminalhire");
 var INDEX_CACHE_FILE4 = join18(TERMINALHIRE_DIR13, "index-cache.json");
@@ -12970,6 +12987,9 @@ function excludeOwnCard(results, ownLogin) {
   });
 }
 
+// bin/jpi-devs.js
+init_sanitize();
+
 // bin/match-slots.js
 var ROTATE_WINDOW_MS = 5 * 60 * 1e3;
 var ROLE_HEAD_ROTATE_MS = 60 * 60 * 1e3;
@@ -13081,7 +13101,15 @@ var TH_GLYPH = [
 ];
 var BRAND_GRADIENT = ["#9d8fff", "#7c6af7", "#5b4fcf"];
 var DEFAULT_SPLASH_MS = 900;
-var STATE_LEVEL = { abandoned: 0, claimed: 2, working: 3, "in-review": 4, ready: 5, submitted: 6, merged: 7 };
+var STATE_LEVEL = {
+  abandoned: 0,
+  claimed: 2,
+  working: 3,
+  "in-review": 4,
+  ready: 5,
+  submitted: 6,
+  merged: 7
+};
 var SPARK_LEVELS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
 function sparkline(rows) {
   if (!rows || !rows.length) return "";
@@ -13103,7 +13131,12 @@ function substrMatch(query, candidate) {
   if (query === "") return true;
   return candidate.toLowerCase().includes(query.toLowerCase());
 }
-function runHubTui({ input = process.stdin, output = process.stdout, signals, deps = {} } = {}) {
+function runHubTui({
+  input = process.stdin,
+  output = process.stdout,
+  signals,
+  deps = {}
+} = {}) {
   const {
     listClaims: _listClaims = listClaims,
     acceptedPRRate: _acceptedPRRate = acceptedPRRate,
@@ -13266,20 +13299,50 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
           acked = false;
         }
         if (!acked) {
-          inboxState = { loaded: true, loading: false, status: "disclosure", items: null, message: null };
+          inboxState = {
+            loaded: true,
+            loading: false,
+            status: "disclosure",
+            items: null,
+            message: null
+          };
           return;
         }
         inboxState = { ...inboxState, loading: true };
         _buildInboxItems().then((built) => {
           if (built.status === "ok") {
-            inboxState = { loaded: true, loading: false, status: "ok", items: built.items, message: null };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: "ok",
+              items: built.items,
+              message: null
+            };
           } else if (built.status === "error") {
-            inboxState = { loaded: true, loading: false, status: "error", items: null, message: built.message || "could not load inbox" };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: "error",
+              items: null,
+              message: built.message || "could not load inbox"
+            };
           } else {
-            inboxState = { loaded: true, loading: false, status: built.status, items: null, message: null };
+            inboxState = {
+              loaded: true,
+              loading: false,
+              status: built.status,
+              items: null,
+              message: null
+            };
           }
         }).catch((e) => {
-          inboxState = { loaded: true, loading: false, status: "error", items: null, message: errMsg(e) };
+          inboxState = {
+            loaded: true,
+            loading: false,
+            status: "error",
+            items: null,
+            message: errMsg(e)
+          };
         }).finally(() => repaint());
         return;
       }
@@ -13313,7 +13376,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
     function inboxRows(st) {
       switch (st.status) {
         case "disclosure":
-          return ["Messaging disclosure not yet acknowledged \u2014 run `terminalhire inbox` once to review it and enable messages."];
+          return [
+            "Messaging disclosure not yet acknowledged \u2014 run `terminalhire inbox` once to review it and enable messages."
+          ];
         case "not-linked":
           return ["Not linked \u2014 run `terminalhire link` to connect your web session."];
         case "expired":
@@ -13356,11 +13421,13 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         case "empty":
           return ["No bounties available right now. Check back through the day."];
         case "demoted":
-          return ["Paid bounties paused \u2014 run `bounties --priced` to view them. Try Contribute or Jobs."];
+          return [
+            "Paid bounties paused \u2014 run `bounties --priced` to view them. Try Contribute or Jobs."
+          ];
         case "ok":
           return result.bounties.map((job) => {
             const b = job.bounty || {};
-            const amt = b.amountUSD != null ? "$" + b.amountUSD.toLocaleString() : "$\u2014";
+            const amt = formatUsd(b.amountUSD);
             const repo = sanitizeLine(b.repoFullName || job.company);
             const prs = b.competingOpenPRs;
             const contend = prs != null && prs > 0 ? ` \xB7 \u26A0 ${prs} in flight` : "";
@@ -13415,7 +13482,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
             if (it.note) rows.push(`    note: ${sanitizeLine(it.note)}`);
             if (it.contact) rows.push(`    contact: ${sanitizeLine(it.contact)}`);
             else if (it.role === "incoming" && it.status === "pending") {
-              rows.push(`    \u2192 accept: terminalhire intro --accept @${sanitizeLine(it.counterpartyLogin)}`);
+              rows.push(
+                `    \u2192 accept: terminalhire intro --accept @${sanitizeLine(it.counterpartyLogin)}`
+              );
             }
           }
           return rows;
@@ -13502,7 +13571,8 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
       if (name === "Claims") {
         if (!claimsState.loaded) return ["Loading\u2026"];
         if (claimsState.error) return ["Could not read claims \u2014 " + claimsState.error];
-        if (!claimsState.rows.length) return ["No claims yet \u2014 run `terminalhire claim <url>` to start one."];
+        if (!claimsState.rows.length)
+          return ["No claims yet \u2014 run `terminalhire claim <url>` to start one."];
         return claimsState.rows.map(formatClaimRow);
       }
       if (name === "Profile") {
@@ -13532,8 +13602,10 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         const st = listState[name];
         if (st.loaded && !st.error && st.result && st.result.status === "ok") {
           if (name === "Jobs") return `${st.result.ranked.length} roles matching your profile`;
-          if (name === "Bounties") return `${st.result.bounties.length} bounties you could knock out`;
-          if (name === "Devs") return `${st.result.results.length} matches in the builder directory`;
+          if (name === "Bounties")
+            return `${st.result.bounties.length} bounties you could knock out`;
+          if (name === "Devs")
+            return `${st.result.results.length} matches in the builder directory`;
         }
         return name;
       }
@@ -13563,7 +13635,9 @@ function runHubTui({ input = process.stdin, output = process.stdout, signals, de
         const row = startRow + i;
         if (row < 0 || row >= rows) continue;
         const t = TH_GLYPH.length <= 1 ? 0 : i / (TH_GLYPH.length - 1);
-        drawText(buf, cols, row, startCol, TH_GLYPH[i], { fg: gradientFg(BRAND_GRADIENT, t, level) });
+        drawText(buf, cols, row, startCol, TH_GLYPH[i], {
+          fg: gradientFg(BRAND_GRADIENT, t, level)
+        });
       }
       const hint = "press any key to continue";
       const hintRow = Math.min(rows - 1, startRow + TH_GLYPH.length + 1);

package/dist/bin/jpi-jobs.js

@@ -10578,6 +10578,50 @@ var init_cache_store = __esm({
   }
 });
 
+// bin/sanitize.js
+function sanitizeText(s) {
+  if (s == null) return "";
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+function safeHttpUrl(url) {
+  if (url == null) return null;
+  const raw = String(url);
+  CONTROL_CHARS.lastIndex = 0;
+  if (CONTROL_CHARS.test(raw)) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.href;
+}
+function linkTitle(title, url) {
+  const safeTitle = sanitizeText(title);
+  const href = safeHttpUrl(url);
+  const isTTY = process.stdout.isTTY;
+  const noColor = process.env["NO_COLOR"] !== void 0;
+  if (isTTY && !noColor && href) {
+    return `\x1B]8;;${href}\x1B\\${safeTitle}\x1B]8;;\x1B\\`;
+  }
+  return href ? `${safeTitle} (${href})` : safeTitle;
+}
+var WHITESPACE_CONTROLS, CONTROL_CHARS;
+var init_sanitize = __esm({
+  "bin/sanitize.js"() {
+    "use strict";
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
+    CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+  }
+});
+
 // bin/spinner-io.js
 import {
   readFileSync as readFileSync4,
@@ -11291,7 +11335,7 @@ function buildTipsDetailed(topMatches, baseUrl, max = 8, opts = {}) {
       const token = jobShortToken(String(m.id));
       const url = `${base}/j/${token}`;
       if (source === "bounty") {
-        const money = m.amountUSD != null ? `$${Number(m.amountUSD).toLocaleString()}` : "$\u2014";
+        const money = formatUsd(m.amountUSD);
         const repo = m.repo || companyRaw;
         out.push(`\u{1F48E} ${money} \xB7 ${title} \xB7 ${repo} \xB7 ${pct}% \u2014 ${url}`);
       } else if (source === "contribute") {
@@ -11361,6 +11405,7 @@ var init_spinner_render = __esm({
     init_spinner_verbs();
     init_spinner_seen();
     init_spinner_io();
+    init_sanitize();
     init_src();
   }
 });
@@ -12297,39 +12342,7 @@ function markClicked(id) {
 
 // bin/jpi-jobs.js
 init_cache_store();
-
-// bin/sanitize.js
-var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
-function sanitizeText(s) {
-  if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
-}
-function safeHttpUrl(url) {
-  if (url == null) return null;
-  const raw = String(url);
-  CONTROL_CHARS.lastIndex = 0;
-  if (CONTROL_CHARS.test(raw)) return null;
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-  return parsed.href;
-}
-function linkTitle(title, url) {
-  const safeTitle = sanitizeText(title);
-  const href = safeHttpUrl(url);
-  const isTTY = process.stdout.isTTY;
-  const noColor = process.env["NO_COLOR"] !== void 0;
-  if (isTTY && !noColor && href) {
-    return `\x1B]8;;${href}\x1B\\${safeTitle}\x1B]8;;\x1B\\`;
-  }
-  return href ? `${safeTitle} (${href})` : safeTitle;
-}
-
-// bin/jpi-jobs.js
+init_sanitize();
 var __dirname2 = fileURLToPath3(new URL(".", import.meta.url));
 var TERMINALHIRE_DIR6 = process.env.TERMINALHIRE_DIR || join14(homedir9(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join14(TERMINALHIRE_DIR6, "index-cache.json");

package/dist/bin/jpi-mcp.js

@@ -10980,12 +10980,19 @@ var init_open_url = __esm({
 // bin/sanitize.js
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
 }
-var CONTROL_CHARS;
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+var WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_sanitize = __esm({
   "bin/sanitize.js"() {
     "use strict";
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -11141,7 +11148,7 @@ function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS2, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS2, " ").replace(CONTROL_CHARS2, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -11279,7 +11286,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS2;
+var TERMINALHIRE_DIR5, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS2, CONTROL_CHARS2;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -11335,6 +11342,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS2 = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS2 = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });
@@ -27157,10 +27165,7 @@ async function pollPR(prUrl) {
   }
 }
 function fmtAmount(a) {
-  if (a == null) return "$\u2014";
-  if (typeof a === "string" && a.trim() === "") return "$\u2014";
-  const n = typeof a === "number" ? a : Number(a);
-  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+  return formatUsd(a);
 }
 function fmtClaimAmount(c) {
   return c.kind === "contribution" ? "contribution" : fmtAmount(c.amountUSD);
@@ -27299,8 +27304,15 @@ async function resolveBounty(arg) {
   return {
     bountyId,
     indexNativeId,
-    title,
-    repoFullName,
+    // DEFANGED HERE, at the one place every tier of this resolver converges.
+    // `claims.ts` cleans what comes OUT of the local store, which covers every later
+    // read — but this object is printed (the preview card, the record card) and
+    // handed to `recordClaim` BEFORE any store exists for it, so on a claim's first
+    // use the store boundary has not run yet. `repoFullName` also goes on to be
+    // interpolated into GitHub API URLs from here. Found by a cross-model review of
+    // TERM-380; the store fix alone left this path open.
+    title: sanitizeText(title),
+    repoFullName: repoFullName == null ? repoFullName : sanitizeText(repoFullName),
     issueUrl,
     amountUSD,
     source,
@@ -28521,7 +28533,7 @@ async function cmdStart(id, flags = {}) {
     console.error(`terminalhire claim: no claim with id '${id}'.`);
     process.exit(1);
   }
-  if (claim.approval?.state === "pending" && !approvalsChecked) {
+  if (claim.approval?.state === "pending") {
     ({ approvalsChecked, approvalsUnavailable } = await syncFounderApprovals(claims, [claim]));
     claim = claims.findClaim(id);
   }

package/dist/bin/jpi-refresh.js

@@ -12236,6 +12236,19 @@ var init_spinner_verbs = __esm({
   }
 });
 
+// bin/sanitize.js
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+var init_sanitize = __esm({
+  "bin/sanitize.js"() {
+    "use strict";
+  }
+});
+
 // bin/spinner-render.js
 function interleaveBySource(topMatches) {
   if (!Array.isArray(topMatches) || topMatches.length === 0) return topMatches;
@@ -12317,7 +12330,7 @@ function buildTipsDetailed(topMatches, baseUrl, max = 8, opts = {}) {
       const token = jobShortToken(String(m.id));
       const url = `${base}/j/${token}`;
       if (source === "bounty") {
-        const money = m.amountUSD != null ? `$${Number(m.amountUSD).toLocaleString()}` : "$\u2014";
+        const money = formatUsd(m.amountUSD);
         const repo = m.repo || companyRaw;
         out.push(`\u{1F48E} ${money} \xB7 ${title} \xB7 ${repo} \xB7 ${pct}% \u2014 ${url}`);
       } else if (source === "contribute") {
@@ -12387,6 +12400,7 @@ var init_spinner_render = __esm({
     init_spinner_verbs();
     init_spinner_seen();
     init_spinner_io();
+    init_sanitize();
     init_src();
   }
 });
@@ -12563,7 +12577,7 @@ function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -12701,7 +12715,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR8, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
+var TERMINALHIRE_DIR8, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS2, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -12757,6 +12771,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });

package/dist/bin/jpi-repo.js

@@ -1910,7 +1910,7 @@ function nowISO2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;
@@ -2048,7 +2048,7 @@ function acceptedPRRate(claims = readClaims()) {
   const merged = claims.filter((c) => c.state === "merged").length;
   return { merged, total, rate: total === 0 ? 0 : merged / total };
 }
-var TERMINALHIRE_DIR4, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, CONTROL_CHARS;
+var TERMINALHIRE_DIR4, CLAIMS_FILE, LOCK_DIR, LOCK_STALE_MS, LOCK_RETRY_MS, LOCK_TIMEOUT_MS, CLAIM_STATES, PUSHED_CLAIM_FIELDS, TERMINAL_STATES, POLL_TRANSITIONS, WHITESPACE_CONTROLS, CONTROL_CHARS;
 var init_claims = __esm({
   "src/claims.ts"() {
     "use strict";
@@ -2104,6 +2104,7 @@ var init_claims = __esm({
       ]),
       submitted: /* @__PURE__ */ new Set(["claimed", "working", "in-review", "ready"])
     };
+    WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
     CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
   }
 });

package/dist/bin/sanitize.js

@@ -1,8 +1,15 @@
 // bin/sanitize.js
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function sanitizeText(s) {
   if (s == null) return "";
-  return String(s).replace(CONTROL_CHARS, "");
+  return String(s).replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "");
+}
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
 }
 function safeHttpUrl(url) {
   if (url == null) return null;
@@ -29,6 +36,7 @@ function linkTitle(title, url) {
   return href ? `${safeTitle} (${href})` : safeTitle;
 }
 export {
+  formatUsd,
   linkTitle,
   safeHttpUrl,
   sanitizeText

package/dist/bin/spinner-render.js

@@ -607,6 +607,14 @@ function clearSpinnerTips() {
   return { cleared: true };
 }
 
+// bin/sanitize.js
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+
 // ../../packages/core/src/vocab/graph.data.ts
 var VOCAB_NODES = [
   // ── Languages ─────────────────────────────────────────────────────────────
@@ -1404,7 +1412,7 @@ function buildTipsDetailed(topMatches, baseUrl, max = 8, opts = {}) {
       const token = jobShortToken(String(m.id));
       const url = `${base}/j/${token}`;
       if (source === "bounty") {
-        const money = m.amountUSD != null ? `$${Number(m.amountUSD).toLocaleString()}` : "$\u2014";
+        const money = formatUsd(m.amountUSD);
         const repo = m.repo || companyRaw;
         out.push(`\u{1F48E} ${money} \xB7 ${title} \xB7 ${repo} \xB7 ${pct}% \u2014 ${url}`);
       } else if (source === "contribute") {

package/dist/bin/spinner.js

@@ -635,6 +635,14 @@ function buildSpinnerPool(topMatches, max = 6, opts = {}) {
   return withStale(pool);
 }
 
+// bin/sanitize.js
+function formatUsd(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? "$" + a.toLocaleString() : "$\u2014";
+  if (typeof a !== "string" || a.trim() === "") return "$\u2014";
+  const n = Number(a);
+  return Number.isFinite(n) ? "$" + n.toLocaleString() : "$\u2014";
+}
+
 // ../../packages/core/src/vocab/graph.data.ts
 var VOCAB_NODES = [
   // ── Languages ─────────────────────────────────────────────────────────────
@@ -1432,7 +1440,7 @@ function buildTipsDetailed(topMatches, baseUrl, max = 8, opts = {}) {
       const token = jobShortToken(String(m.id));
       const url = `${base}/j/${token}`;
       if (source === "bounty") {
-        const money = m.amountUSD != null ? `$${Number(m.amountUSD).toLocaleString()}` : "$\u2014";
+        const money = formatUsd(m.amountUSD);
         const repo = m.repo || companyRaw;
         out.push(`\u{1F48E} ${money} \xB7 ${title} \xB7 ${repo} \xB7 ${pct}% \u2014 ${url}`);
       } else if (source === "contribute") {

package/dist/src/claims.js

@@ -161,9 +161,10 @@ function nextPolledState(from, observed) {
 function nowISO() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
 var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 function defangText(s) {
-  return typeof s === "string" ? s.replace(CONTROL_CHARS, "") : s;
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
 }
 function finiteAmount(a) {
   if (typeof a === "number") return Number.isFinite(a) ? a : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.42.1",
+  "version": "0.42.2",
   "description": "Local-first job matching for developers — ambient job matches in the Claude Code spinner. Your profile never leaves your machine.",
   "repository": {
     "type": "git",