vibebusiness 1.2.49 → 1.2.53

package/dist/scripts/heartbeat.js

@@ -9406,7 +9406,11 @@ var RestAPIAdapter = class {
         this.headers[key] = this.interpolateEnvVars(value);
       }
     }
-    this.fieldMapping = config.field_mapping || {};
+    const raw = config.field_mapping || {};
+    this.fieldMapping = {};
+    for (const [k, v2] of Object.entries(raw)) {
+      if (typeof v2 === "string") this.fieldMapping[k] = v2;
+    }
     this.transforms = config.transforms || {};
   }
   /**
@@ -9496,7 +9500,7 @@ var ManualAdapter = class {
 };
 
 // src/lib/kpi-adapters/posthog.ts
-var PostHogAdapter = class {
+var PostHogAdapter = class _PostHogAdapter {
   id;
   type = "posthog";
   fieldMapping;
@@ -9508,7 +9512,8 @@ var PostHogAdapter = class {
     this.fieldMapping = config.field_mapping || {};
     const hostEnv = config.config?.url_env || "POSTHOG_API_HOST";
     const projectEnv = config.config?.project_id_env || "POSTHOG_PROJECT_ID";
-    this.host = process.env[hostEnv] || process.env["NEXT_PUBLIC_POSTHOG_HOST"] || "https://us.i.posthog.com";
+    const rawHost = process.env[hostEnv] || process.env["NEXT_PUBLIC_POSTHOG_HOST"] || "https://us.posthog.com";
+    this.host = rawHost.replace("://us.i.posthog.com", "://us.posthog.com");
     this.projectId = process.env[projectEnv] || "";
     this.apiKey = process.env["POSTHOG_PERSONAL_API_KEY"] || "";
     if (!this.apiKey) {
@@ -9527,26 +9532,32 @@ var PostHogAdapter = class {
     const metadata = {};
     const end = endDate || (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const start = startDate || new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3).toISOString().split("T")[0];
-    const eventNames = Array.from(new Set(Object.values(this.fieldMapping)));
-    if (eventNames.length === 0) {
+    const queryMap = /* @__PURE__ */ new Map();
+    for (const [kpiId, mapping] of Object.entries(this.fieldMapping)) {
+      const query = _PostHogAdapter.normalizeMapping(mapping);
+      const key = _PostHogAdapter.queryCacheKey(query);
+      const entry = queryMap.get(key);
+      if (entry) {
+        entry.kpiIds.push(kpiId);
+      } else {
+        queryMap.set(key, { query, kpiIds: [kpiId] });
+      }
+    }
+    if (queryMap.size === 0) {
       return { values, metadata, fetched_at: (/* @__PURE__ */ new Date()).toISOString() };
     }
-    for (const eventName of eventNames) {
+    for (const [key, { query, kpiIds }] of Array.from(queryMap.entries())) {
       try {
-        const count = await this.fetchEventCount(eventName, start, end);
-        metadata[eventName] = { count, start, end };
-        for (const [kpiId, mappedEvent] of Object.entries(this.fieldMapping)) {
-          if (mappedEvent === eventName) {
-            values[kpiId] = count;
-          }
+        const count = await this.fetchEventCount(query.event, start, end, query.properties);
+        metadata[key] = { count, start, end, event: query.event, properties: query.properties };
+        for (const kpiId of kpiIds) {
+          values[kpiId] = count;
         }
       } catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
-        console.warn(`PostHog: failed to fetch "${eventName}": ${msg}`);
-        for (const [kpiId, mappedEvent] of Object.entries(this.fieldMapping)) {
-          if (mappedEvent === eventName) {
-            values[kpiId] = null;
-          }
+        console.warn(`PostHog: failed to fetch "${key}": ${msg}`);
+        for (const kpiId of kpiIds) {
+          values[kpiId] = null;
         }
       }
     }
@@ -9556,6 +9567,21 @@ var PostHogAdapter = class {
       fetched_at: (/* @__PURE__ */ new Date()).toISOString()
     };
   }
+  /** Normalize a field_mapping value (string or object) into an EventQuery. */
+  static normalizeMapping(mapping) {
+    if (typeof mapping === "string") {
+      return { event: mapping };
+    }
+    return { event: mapping.event, properties: mapping.properties };
+  }
+  /** Stable cache key for deduplicating identical queries. */
+  static queryCacheKey(query) {
+    if (!query.properties || Object.keys(query.properties).length === 0) {
+      return query.event;
+    }
+    const sortedProps = Object.entries(query.properties).sort(([a], [b]) => a.localeCompare(b));
+    return `${query.event}[${sortedProps.map(([k, v2]) => `${k}=${v2}`).join(",")}]`;
+  }
   async healthCheck() {
     try {
       const res = await fetch(`${this.host}/api/projects/${this.projectId}/`, {
@@ -9569,21 +9595,29 @@ var PostHogAdapter = class {
     }
   }
   /**
-   * Fetch total event count from PostHog Trends API for a given date range.
+   * Fetch total event count from PostHog HogQL Query API for a given date range.
+   * Optionally filters by event properties (e.g. { command: "init" }).
    */
-  async fetchEventCount(eventName, dateFrom, dateTo) {
-    const url = `${this.host}/api/projects/${this.projectId}/insights/trend/`;
+  async fetchEventCount(eventName, dateFrom, dateTo, properties) {
+    const url = `${this.host}/api/projects/${this.projectId}/query/`;
+    const conditions = [
+      `event = '${eventName.replace(/'/g, "\\'")}'`,
+      `timestamp >= toDate('${dateFrom}')`,
+      `timestamp <= toDate('${dateTo}') + INTERVAL 1 DAY`
+    ];
+    if (properties) {
+      for (const [key, value] of Object.entries(properties)) {
+        const safeKey = key.replace(/'/g, "\\'");
+        const safeVal = value.replace(/'/g, "\\'");
+        conditions.push(`properties['${safeKey}'] = '${safeVal}'`);
+      }
+    }
+    const hogql = `SELECT count() AS cnt FROM events WHERE ${conditions.join(" AND ")}`;
     const body = {
-      events: [
-        {
-          id: eventName,
-          math: "total",
-          type: "events"
-        }
-      ],
-      date_from: dateFrom,
-      date_to: dateTo,
-      display: "ActionsLineGraph"
+      query: {
+        kind: "HogQLQuery",
+        query: hogql
+      }
     };
     const res = await fetch(url, {
       method: "POST",
@@ -9597,9 +9631,7 @@ var PostHogAdapter = class {
       throw new Error(`PostHog API returned ${res.status}: ${await res.text()}`);
     }
     const data = await res.json();
-    const result = data?.result?.[0];
-    if (!result) return 0;
-    return result.count ?? result.aggregated_value ?? 0;
+    return data?.results?.[0]?.[0] ?? 0;
   }
 };
 
@@ -9613,7 +9645,11 @@ var WaitlistFileAdapter = class {
   fieldMapping;
   constructor(config) {
     this.id = config.id;
-    this.fieldMapping = config.field_mapping || {};
+    const raw = config.field_mapping || {};
+    this.fieldMapping = {};
+    for (const [k, v2] of Object.entries(raw)) {
+      if (typeof v2 === "string") this.fieldMapping[k] = v2;
+    }
     const relativePath = config.config?.path || "website/data/waitlist.json";
     this.filePath = path.isAbsolute(relativePath) ? relativePath : path.resolve(process.cwd(), relativePath);
   }
@@ -30597,6 +30633,17 @@ var fs17 = __toESM(require("fs"));
 var import_child_process6 = require("child_process");
 var fs16 = __toESM(require("fs"));
 var path11 = __toESM(require("path"));
+var CREDENTIALS_DIR = path11.join(process.env.HOME || "", ".vibebusiness");
+var CREDENTIALS_FILE = path11.join(CREDENTIALS_DIR, "credentials.json");
+function loadCredentials2() {
+  try {
+    if (fs16.existsSync(CREDENTIALS_FILE)) {
+      return JSON.parse(fs16.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    }
+  } catch {
+  }
+  return {};
+}
 function detectClaudeCLI(customPath) {
   const claudeBin = customPath || "claude";
   try {
@@ -30629,13 +30676,27 @@ function detectClaudeCLI(customPath) {
 }
 function detectBYOKKeys() {
   if (process.env.ANTHROPIC_API_KEY) {
-    return { provider: "anthropic-api", key: process.env.ANTHROPIC_API_KEY };
+    return { provider: "anthropic-api", key: process.env.ANTHROPIC_API_KEY, source: "env" };
   }
   if (process.env.OPENAI_API_KEY) {
-    return { provider: "openai-api", key: process.env.OPENAI_API_KEY };
+    return { provider: "openai-api", key: process.env.OPENAI_API_KEY, source: "env" };
   }
   if (process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY) {
-    return { provider: "google-api", key: process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY };
+    return { provider: "google-api", key: process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY, source: "env" };
+  }
+  const creds = loadCredentials2();
+  if (creds.ANTHROPIC_API_KEY) {
+    process.env.ANTHROPIC_API_KEY = creds.ANTHROPIC_API_KEY;
+    return { provider: "anthropic-api", key: creds.ANTHROPIC_API_KEY, source: "credentials" };
+  }
+  if (creds.OPENAI_API_KEY) {
+    process.env.OPENAI_API_KEY = creds.OPENAI_API_KEY;
+    return { provider: "openai-api", key: creds.OPENAI_API_KEY, source: "credentials" };
+  }
+  if (creds.GOOGLE_API_KEY || creds.GEMINI_API_KEY) {
+    const key = creds.GOOGLE_API_KEY || creds.GEMINI_API_KEY;
+    process.env.GOOGLE_API_KEY = key;
+    return { provider: "google-api", key, source: "credentials" };
   }
   return null;
 }
@@ -30684,6 +30745,9 @@ function invokeClaudeCLI(options, claudePath) {
   if (options.model) {
     args2.push("--model", options.model);
   }
+  if (options.jsonSchema) {
+    args2.push("--output-format", "json", "--json-schema", JSON.stringify(options.jsonSchema));
+  }
   if (options.claudeFlags) {
     args2.push(...options.claudeFlags);
   }
@@ -30752,7 +30816,18 @@ async function invokeAnthropicAPI(options) {
     };
   }
   try {
-    const model = options.model || "claude-sonnet-4-5-20250929";
+    const model = options.model || "claude-sonnet-4-6";
+    let prompt = options.prompt;
+    if (options.jsonSchema) {
+      prompt += `
+
+IMPORTANT: Respond with valid JSON matching this schema:
+${JSON.stringify(options.jsonSchema, null, 2)}
+
+Output ONLY the JSON object, no markdown code blocks or other text.`;
+    } else if (options.expectJson) {
+      prompt += "\n\nIMPORTANT: Respond with valid JSON only. No markdown code blocks or other text.";
+    }
     const response = await fetch("https://api.anthropic.com/v1/messages", {
       method: "POST",
       headers: {
@@ -30763,7 +30838,7 @@ async function invokeAnthropicAPI(options) {
       body: JSON.stringify({
         model,
         max_tokens: 16384,
-        messages: [{ role: "user", content: options.prompt }]
+        messages: [{ role: "user", content: prompt }]
       }),
       signal: AbortSignal.timeout(options.timeoutMs || 3e5)
     });
@@ -30817,6 +30892,27 @@ async function invokeAI(options) {
       };
   }
 }
+function requireClaudeCLI(feature) {
+  const cli = detectClaudeCLI();
+  if (cli.found) {
+    return cli.path;
+  }
+  const featureLabel = feature ? ` (${feature})` : "";
+  const byok = detectBYOKKeys();
+  if (byok) {
+    throw new Error(
+      `This feature${featureLabel} requires Claude Code CLI for file and tool access.
+Your API key is detected and works for reasoning tasks (heartbeat, idea evaluation),
+but codebase analysis and implementation need the full CLI.
+Install it with: npm install -g @anthropic-ai/claude-code`
+    );
+  }
+  throw new Error(
+    `No AI provider found${featureLabel}.
+Install Claude Code CLI: npm install -g @anthropic-ai/claude-code
+Or set an API key: export ANTHROPIC_API_KEY=sk-ant-...`
+  );
+}
 
 // scripts/lib/social/ai-content-generator.ts
 function readJsonSafe2(filePath, fallback) {
@@ -30878,6 +30974,8 @@ CONTEXT: ${opts.context}
 HISTORICAL PERFORMANCE:
 ${formatPastPerformance(opts.pastPerformance ?? [])}
 
+IMPORTANT: Only reference facts and numbers from the CONTEXT above. Never fabricate personal history, timelines, or metrics not provided.
+
 Generate ONE tweet (max 280 characters). Focus on being genuinely interesting, not salesy.
 
 Respond in this exact JSON format (no markdown, no code blocks):
@@ -30929,6 +31027,7 @@ RULES:
 - Number threads (1/, 2/, etc.) only if it helps clarity
 - Include #buildinpublic in the first or last tweet only
 - Make each tweet stand alone \u2014 people may see any tweet in isolation
+- IMPORTANT: Only reference facts and numbers from the CONTEXT above. Never fabricate personal history, timelines, or metrics not provided.
 
 Respond in this exact JSON format (no markdown, no code blocks):
 {
@@ -30992,6 +31091,113 @@ Respond in this exact JSON format (no markdown, no code blocks):
     };
   }
 }
+async function generateWeekPlan(opts) {
+  const positioning = opts.positioning ?? readJsonSafe2(POSITIONING_FILE, null);
+  const today = /* @__PURE__ */ new Date();
+  const dayOfWeek = today.getDay();
+  const daysUntilMonday = dayOfWeek === 0 ? 1 : dayOfWeek === 1 ? 0 : 8 - dayOfWeek;
+  const monday = new Date(today);
+  monday.setDate(today.getDate() + daysUntilMonday);
+  const weekDates = [];
+  const dayNames = ["monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"];
+  for (let i = 0; i < 7; i++) {
+    const d2 = new Date(monday);
+    d2.setDate(monday.getDate() + i);
+    weekDates.push({ day: dayNames[i], date: d2.toISOString().split("T")[0] });
+  }
+  const prompt = `You are a social media strategist for a developer-focused indie hacker audience on X/Twitter.
+
+${ALGORITHM_KNOWLEDGE}
+
+${HOOK_PATTERNS}
+
+PRODUCT CONTEXT:
+- Product: ${positioning?.current?.tagline ?? "VibeBusiness"}
+- Value prop: ${positioning?.current?.value_proposition ?? "AI-powered business automation"}
+- Target audience: ${positioning?.current?.target_audience?.primary ?? "Indie hackers and solo founders"}
+
+CURRENT GOALS:
+${opts.goalsContext || "No specific goals set."}
+
+RECENTLY SHIPPED:
+${opts.recentShips || "No recent ships."}
+
+KPI HIGHLIGHTS:
+${opts.kpiHighlights || "No KPI data yet."}
+
+HISTORICAL PERFORMANCE:
+${formatPastPerformance(opts.pastPerformance ?? [])}
+
+WEEK DATES:
+${weekDates.map((d2) => `${d2.day}: ${d2.date}`).join("\n")}
+
+CRITICAL \u2014 FACTUAL ACCURACY:
+- ONLY reference facts, numbers, timelines, and events explicitly present in the context above.
+- NEVER fabricate personal history, backstory, or timeline details (e.g., "6 months ago I...", "I was stuck for X months").
+- NEVER invent metrics, user counts, or milestones that aren't in the KPI HIGHLIGHTS or RECENTLY SHIPPED sections.
+- If the context doesn't provide enough detail for a story hook, use a different hook pattern (question, contrarian, list-tease) instead of inventing a narrative.
+- It's better to write a shorter, honest tweet than a longer, fabricated one.
+
+Plan a full week of content (Monday-Sunday). Rules:
+- 5 content days (Mon-Fri) + 2 rest days (Sat-Sun)
+- Include 1-2 threads per week (threads get 200-300% more reach)
+- Mix content types: ship, viral, thread, milestone, insight, question
+- Align content with current goals (especially behind-schedule ones)
+- Use diverse hook patterns \u2014 don't repeat the same hook type consecutively
+- Write FULL tweet text for each content day (max 280 chars for single tweets)
+- For threads, provide all tweet texts (5-7 tweets each, max 280 chars per tweet)
+- Each rest day should have type "rest" with empty content
+
+Respond in this exact JSON format (no markdown, no code blocks):
+{
+  "days": [
+    {
+      "day": "monday",
+      "date": "YYYY-MM-DD",
+      "type": "thread",
+      "topic": "topic description",
+      "content": "First tweet / hook text",
+      "thread_tweets": ["tweet 1", "tweet 2", "..."],
+      "hook_type": "story",
+      "rationale": "Why this content on this day"
+    },
+    {
+      "day": "tuesday",
+      "date": "YYYY-MM-DD",
+      "type": "viral",
+      "topic": "ship",
+      "content": "Full tweet text here",
+      "hook_type": "bold-claim",
+      "rationale": "Why this content on this day"
+    }
+  ],
+  "strategy_summary": "One paragraph explaining the week's strategy"
+}`;
+  const result = await invokeAI({ prompt, model: "sonnet" });
+  try {
+    const parsed = JSON.parse(extractJson(result.output));
+    for (const day of parsed.days) {
+      if (day.type === "rest") continue;
+      if (day.content && day.content.length > 280) {
+        day.content = day.content.slice(0, 277).trimEnd() + "...";
+      }
+      if (day.thread_tweets) {
+        day.thread_tweets = day.thread_tweets.map(
+          (t) => t.length > 280 ? t.slice(0, 277).trimEnd() + "..." : t
+        );
+      }
+    }
+    return {
+      days: parsed.days || [],
+      strategy_summary: parsed.strategy_summary || ""
+    };
+  } catch {
+    return {
+      days: [],
+      strategy_summary: "AI failed to generate a valid week plan."
+    };
+  }
+}
 function extractJson(text) {
   const codeBlockMatch = text.match(/```(?:json)?\s*([\s\S]*?)```/);
   if (codeBlockMatch) return codeBlockMatch[1].trim();
@@ -31078,6 +31284,7 @@ function createDraft(state, text, source, sourceRef, mediaPaths = null) {
 }
 var SOCIAL_PREFIXES = [
   "social-setup-x",
+  "social-plan-week",
   "social-draft-ship-visual",
   "social-draft-ship",
   "social-draft-update",
@@ -31098,6 +31305,9 @@ async function executeSocialTask(taskId, description, _businessContext) {
     if (taskId === "social-setup-x") {
       return await executeSetupX();
     }
+    if (taskId === "social-plan-week") {
+      return await executePlanWeek();
+    }
     if (taskId === "social-draft-ship-visual") {
       return executeDraftShipVisual();
     }
@@ -31161,6 +31371,10 @@ function readSocialFreshness() {
     bestEngagementRate = best.engagement_rate;
   }
   const threadCount = state.drafts.filter((d2) => d2.is_thread && d2.status === "published").length;
+  const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  const scheduledDraftCount = state.drafts.filter(
+    (d2) => d2.status === "draft" && d2.scheduled_date && d2.scheduled_date >= today
+  ).length;
   return {
     configured: state.credentials_valid,
     credentials_valid: state.credentials_valid,
@@ -31172,7 +31386,8 @@ function readSocialFreshness() {
     avg_engagement_rate: avgEngagementRate,
     best_tweet_id: bestTweetId,
     best_engagement_rate: bestEngagementRate,
-    thread_count: threadCount
+    thread_count: threadCount,
+    scheduled_draft_count: scheduledDraftCount
   };
 }
 async function executeSetupX() {
@@ -31417,6 +31632,117 @@ async function executeDraftThread(topic, description) {
     ].join("\n")
   };
 }
+async function executePlanWeek() {
+  const state = loadState3();
+  const pastPerformance = collectEngagementHistory(state);
+  let positioning = null;
+  try {
+    if (fs18.existsSync(POSITIONING_FILE)) {
+      positioning = JSON.parse(fs18.readFileSync(POSITIONING_FILE, "utf-8"));
+    }
+  } catch {
+  }
+  let goalsContext = "";
+  try {
+    if (fs18.existsSync(GOALS_FILE)) {
+      const { goals } = JSON.parse(fs18.readFileSync(GOALS_FILE, "utf-8"));
+      const relevant = goals.filter((g2) => g2.status === "on_track" || g2.status === "at_risk" || g2.status === "behind").map((g2) => {
+        const progress = g2.current_value != null && g2.target_value ? `${Math.round(g2.current_value / g2.target_value * 100)}%` : "unknown";
+        return `- ${g2.title} (${g2.status}, ${progress} complete, deadline: ${g2.deadline})`;
+      });
+      goalsContext = relevant.length > 0 ? relevant.join("\n") : "No active goals.";
+    }
+  } catch {
+  }
+  let recentShips = "";
+  try {
+    if (fs18.existsSync(IDEAS_FILE)) {
+      const { ideas } = JSON.parse(fs18.readFileSync(IDEAS_FILE, "utf-8"));
+      const twoWeeksAgo = new Date(Date.now() - 14 * 24 * 60 * 60 * 1e3).toISOString();
+      const shipped = ideas.filter((i) => i.stage === "shipped" && i.updated_at > twoWeeksAgo).map((i) => `- ${i.title} (shipped ${i.updated_at.split("T")[0]})`);
+      recentShips = shipped.length > 0 ? shipped.join("\n") : "No recent ships.";
+    }
+  } catch {
+  }
+  let kpiHighlights = "";
+  try {
+    if (fs18.existsSync(GOALS_FILE)) {
+      const { goals } = JSON.parse(fs18.readFileSync(GOALS_FILE, "utf-8"));
+      const highlights = [];
+      for (const goal of goals) {
+        for (const kpi of goal.kpis) {
+          if (kpi.current_value != null && kpi.target_value != null) {
+            const pct = Math.round(kpi.current_value / kpi.target_value * 100);
+            highlights.push(`- ${kpi.name}: ${kpi.current_value}/${kpi.target_value} ${kpi.unit} (${pct}%)`);
+          }
+        }
+      }
+      kpiHighlights = highlights.length > 0 ? highlights.join("\n") : "No KPI data.";
+    }
+  } catch {
+  }
+  const plan = await generateWeekPlan({
+    positioning,
+    pastPerformance,
+    goalsContext,
+    recentShips,
+    kpiHighlights
+  });
+  if (plan.days.length === 0) {
+    return { success: false, output: "AI failed to generate a weekly content plan." };
+  }
+  const createdDrafts = [];
+  for (const day of plan.days) {
+    if (day.type === "rest" || !day.content) continue;
+    if (day.type === "thread" && day.thread_tweets && day.thread_tweets.length > 0) {
+      const draft = {
+        id: `draft-${v4_default().slice(0, 8)}`,
+        text: day.thread_tweets[0],
+        source: "thread",
+        source_ref: null,
+        status: "draft",
+        created_at: (/* @__PURE__ */ new Date()).toISOString(),
+        published_at: null,
+        tweet_id: null,
+        tweet_url: null,
+        is_thread: true,
+        thread_tweets: day.thread_tweets,
+        scheduled_date: day.date
+      };
+      state.drafts.push(draft);
+      createdDrafts.push({ day: day.day, date: day.date, type: "thread", id: draft.id });
+    } else {
+      const source = ["ship", "milestone", "update", "digest", "insight"].includes(day.topic) ? day.topic : "insight";
+      const draft = createDraft(state, day.content, source, null);
+      draft.scheduled_date = day.date;
+      createdDrafts.push({ day: day.day, date: day.date, type: day.type, id: draft.id });
+    }
+  }
+  saveState3(state);
+  const monday = plan.days.find((d2) => d2.day === "monday")?.date ?? "";
+  const sunday = plan.days.find((d2) => d2.day === "sunday")?.date ?? "";
+  const dateRange = monday && sunday ? `${formatDateShort(monday)} - ${formatDateShort(sunday)}` : "This Week";
+  const lines = [`Weekly Content Plan (${dateRange})`, ""];
+  for (const day of plan.days) {
+    const dayLabel = day.day.charAt(0).toUpperCase() + day.day.slice(1, 3);
+    if (day.type === "rest") {
+      lines.push(`${dayLabel}  --  Rest`);
+    } else {
+      const threadInfo = day.type === "thread" && day.thread_tweets ? ` (${day.thread_tweets.length} tweets)` : "";
+      const preview = day.content.length > 60 ? `"${day.content.slice(0, 57)}..."` : `"${day.content}"`;
+      lines.push(`${dayLabel}  [${day.type}] ${preview}${threadInfo}`);
+      lines.push(`       Hook: ${day.hook_type} | ${day.rationale}`);
+    }
+  }
+  lines.push("");
+  lines.push(`${createdDrafts.length} drafts created. Review and edit at: vibebusiness start -> /social`);
+  return { success: true, output: lines.join("\n") };
+}
+function formatDateShort(isoDate) {
+  const d2 = /* @__PURE__ */ new Date(isoDate + "T00:00:00");
+  const months = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+  return `${months[d2.getMonth()]} ${d2.getDate()}`;
+}
 async function executeTrackMetrics() {
   const state = loadState3();
   const credentials = loadCredentials();
@@ -31539,6 +31865,7 @@ async function executeCheckStatus3() {
     }
   }
   lines.push(`  Pending drafts: ${freshness.draft_count}`);
+  lines.push(`  Scheduled drafts: ${freshness.scheduled_draft_count}`);
   lines.push(`  Post streak: ${freshness.post_streak_days} day(s)`);
   lines.push(`  Total posts: ${freshness.total_posts}`);
   lines.push(`  Threads published: ${freshness.thread_count}`);
@@ -32516,9 +32843,9 @@ function cleanGitState(workspacePath) {
     }
   }
 }
-function exec2(cmd, cwd, timeoutMs) {
+function execGit(args2, cwd, timeoutMs) {
   try {
-    return (0, import_child_process9.execSync)(cmd, {
+    return (0, import_child_process9.execFileSync)("git", args2, {
       cwd,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -32526,11 +32853,58 @@ function exec2(cmd, cwd, timeoutMs) {
     }).trim();
   } catch (error) {
     const execError = error;
-    throw new Error(`Command failed: ${cmd}
-${execError.stderr || execError.message}`);
+    const stderr = typeof execError.stderr === "string" ? execError.stderr : execError.stderr?.toString() ?? "";
+    throw new Error(`git ${args2[0]} failed: ${stderr || execError.message}`);
   }
 }
 
+// scripts/lib/shell-safe.ts
+var SAFE_BRANCH_RE = /^[a-zA-Z0-9._\-/]+$/;
+function truncate(s, max2 = 100) {
+  return s.length > max2 ? s.slice(0, max2) + "..." : s;
+}
+var _rejectionCounts = { branch: 0, repo: 0, commitMsg: 0 };
+function recordRejection(type) {
+  _rejectionCounts[type]++;
+  console.warn(`[shell-safe] Rejection recorded: type=${type} total=${_rejectionCounts[type]}`);
+}
+function getRejectionCounts() {
+  try {
+    return { ..._rejectionCounts };
+  } catch {
+    return { branch: 0, repo: 0, commitMsg: 0 };
+  }
+}
+function resetRejectionCounts() {
+  _rejectionCounts.branch = 0;
+  _rejectionCounts.repo = 0;
+  _rejectionCounts.commitMsg = 0;
+}
+function validateBranchName(name) {
+  if (!name || name.trim() === "") {
+    console.warn("[shell-safe] validateBranchName: rejecting empty branch name");
+    recordRejection("branch");
+    throw new Error("Branch name cannot be empty");
+  }
+  if (!SAFE_BRANCH_RE.test(name)) {
+    console.warn(`[shell-safe] Rejected branch name: ${truncate(name)}`);
+    recordRejection("branch");
+    throw new Error(
+      `Invalid branch name: "${truncate(name)}" \u2014 only alphanumerics, dots, dashes, underscores, and slashes are allowed`
+    );
+  }
+  return name;
+}
+function sanitizeForCommitMessage(msg) {
+  const original = msg;
+  let sanitized = msg.replace(/"/g, "\u201C\u201D"[0]).replace(/`/g, "\u2018").replace(/\$\(/g, "(").replace(/\$/g, "").replace(/\\/g, "/").replace(/!/g, "").replace(/[\n\r]/g, " ").trim();
+  if (sanitized !== original) {
+    console.warn(`[shell-safe] sanitizeForCommitMessage modified input: ${truncate(original)}`);
+    recordRejection("commitMsg");
+  }
+  return sanitized;
+}
+
 // scripts/lib/worktree.ts
 function getWorktreePaths(workspaceDir, repoName) {
   return {
@@ -32540,17 +32914,17 @@ function getWorktreePaths(workspaceDir, repoName) {
 }
 function syncBaseClone(baseClonePath, defaultBranch) {
   cleanGitState(baseClonePath);
-  exec2("git fetch origin", baseClonePath, 3e4);
-  exec2(`git checkout ${defaultBranch}`, baseClonePath);
-  exec2(`git reset --hard origin/${defaultBranch}`, baseClonePath);
+  execGit(["fetch", "origin"], baseClonePath, 3e4);
+  execGit(["checkout", validateBranchName(defaultBranch)], baseClonePath);
+  execGit(["reset", "--hard", `origin/${validateBranchName(defaultBranch)}`], baseClonePath);
 }
 function ensureIdeaBranch(baseClonePath, branchName, defaultBranch) {
   try {
-    exec2(`git rev-parse --verify ${branchName}`, baseClonePath);
+    execGit(["rev-parse", "--verify", validateBranchName(branchName)], baseClonePath);
   } catch {
-    exec2(`git checkout ${defaultBranch}`, baseClonePath);
-    exec2(`git checkout -b ${branchName}`, baseClonePath);
-    exec2(`git checkout ${defaultBranch}`, baseClonePath);
+    execGit(["checkout", validateBranchName(defaultBranch)], baseClonePath);
+    execGit(["checkout", "-b", validateBranchName(branchName)], baseClonePath);
+    execGit(["checkout", validateBranchName(defaultBranch)], baseClonePath);
   }
 }
 function createWorktree(baseClonePath, worktreeContainerDir, ideaBranch, groupIndex) {
@@ -32561,17 +32935,17 @@ function createWorktree(baseClonePath, worktreeContainerDir, ideaBranch, groupIn
   const worktreePath = path20.join(worktreeContainerDir, `${ideaBranch}-g${groupIndex}`);
   if (fs25.existsSync(worktreePath)) {
     try {
-      exec2(`git worktree remove --force "${worktreePath}"`, baseClonePath, 1e4);
+      execGit(["worktree", "remove", "--force", worktreePath], baseClonePath, 1e4);
     } catch {
       fs25.rmSync(worktreePath, { recursive: true, force: true });
     }
   }
   try {
-    exec2(`git branch -D "${tempBranch}"`, baseClonePath);
+    execGit(["branch", "-D", tempBranch], baseClonePath);
   } catch {
   }
-  exec2(
-    `git worktree add -b "${tempBranch}" "${worktreePath}" "${ideaBranch}"`,
+  execGit(
+    ["worktree", "add", "-b", tempBranch, worktreePath, ideaBranch],
     baseClonePath,
     15e3
   );
@@ -32580,13 +32954,13 @@ function createWorktree(baseClonePath, worktreeContainerDir, ideaBranch, groupIn
 function mergeWorktreeIntoIdeaBranch(baseClonePath, ideaBranch, tempBranch) {
   try {
     cleanGitState(baseClonePath);
-    exec2(`git checkout "${ideaBranch}"`, baseClonePath);
-    exec2(`git merge "${tempBranch}" --no-edit`, baseClonePath, 3e4);
+    execGit(["checkout", ideaBranch], baseClonePath);
+    execGit(["merge", tempBranch, "--no-edit"], baseClonePath, 3e4);
     return true;
   } catch (error) {
     console.log(`[worktree] Merge failed for ${tempBranch} into ${ideaBranch}: ${error.message}`);
     try {
-      exec2("git merge --abort", baseClonePath);
+      execGit(["merge", "--abort"], baseClonePath);
     } catch {
     }
     return false;
@@ -32594,7 +32968,7 @@ function mergeWorktreeIntoIdeaBranch(baseClonePath, ideaBranch, tempBranch) {
 }
 function removeWorktree(baseClonePath, worktreePath, tempBranch) {
   try {
-    exec2(`git worktree remove --force "${worktreePath}"`, baseClonePath, 1e4);
+    execGit(["worktree", "remove", "--force", worktreePath], baseClonePath, 1e4);
   } catch {
     try {
       fs25.rmSync(worktreePath, { recursive: true, force: true });
@@ -32602,7 +32976,7 @@ function removeWorktree(baseClonePath, worktreePath, tempBranch) {
     }
   }
   try {
-    exec2(`git branch -D "${tempBranch}"`, baseClonePath);
+    execGit(["branch", "-D", tempBranch], baseClonePath);
   } catch {
   }
 }
@@ -32622,7 +32996,7 @@ function cleanupIdeaWorktrees(baseClonePath, worktreeContainerDir, ideaBranch) {
     }
   }
   try {
-    exec2("git worktree prune", baseClonePath, 1e4);
+    execGit(["worktree", "prune"], baseClonePath, 1e4);
   } catch {
   }
   try {
@@ -34127,6 +34501,7 @@ These tasks generate tweet drafts for the founder's build-in-public journey.
 
 Task prefixes:
 - "social-setup-x" \u2192 Validate X API credentials from .env, save username
+- "social-plan-week" \u2192 Generate a 7-day content calendar with AI-optimized drafts (5 content days + 2 rest)
 - "social-draft-ship-visual" \u2192 Generate a "just shipped" tweet WITH ship card image or video attached
 - "social-draft-ship" \u2192 Generate a "just shipped" tweet (text only, no media)
 - "social-draft-update" \u2192 Generate a product update draft from positioning data
@@ -34150,6 +34525,7 @@ When to recommend social tasks:
 7. If social.total_posts > 0 AND social.avg_engagement_rate == null \u2192 suggest "social-track-metrics" to start tracking
 8. If social.thread_count == 0 AND social.total_posts >= 3 \u2192 suggest "social-draft-thread-{relevant-topic}" (threads get 200-300% more reach)
 9. Prefer AI-generated drafts (social-draft-viral-*) over template drafts (social-draft-ship/update/milestone) for higher engagement
+10. If social.scheduled_draft_count == 0 AND social.configured == true \u2192 suggest "social-plan-week" to plan next week's content calendar
 
 PROMO COPY TASKS:
 The "promo_copy" field shows positioning-driven copy generation status.
@@ -34262,117 +34638,58 @@ Respond with JSON only (no markdown code blocks, just raw JSON):
 
 If there's nothing urgent, set next_action to null and new_todos to an empty array.
 Focus on actionable, specific recommendations. Be concise.`;
-  return new Promise((resolve2, reject) => {
-    const startTime = Date.now();
-    const promptSize = prompt.length;
-    log(`Running Claude reasoning (prompt: ${promptSize} chars)...`);
-    const reasoningSchema = JSON.stringify({
-      type: "object",
-      properties: {
-        analysis: { type: "string" },
-        critical_issue: { type: ["string", "null"] },
-        next_action: {
-          type: ["object", "null"],
+  const startTime = Date.now();
+  const promptSize = prompt.length;
+  log(`Running Claude reasoning (prompt: ${promptSize} chars)...`);
+  const reasoningSchema = {
+    type: "object",
+    properties: {
+      analysis: { type: "string" },
+      critical_issue: { type: ["string", "null"] },
+      next_action: {
+        type: ["object", "null"],
+        properties: {
+          task_id: { type: "string" },
+          description: { type: "string" },
+          autonomous: { type: "boolean" }
+        },
+        required: ["task_id", "description", "autonomous"]
+      },
+      new_todos: {
+        type: "array",
+        items: {
+          type: "object",
           properties: {
-            task_id: { type: "string" },
+            id: { type: "string" },
             description: { type: "string" },
-            autonomous: { type: "boolean" }
+            priority: { type: "string" }
           },
-          required: ["task_id", "description", "autonomous"]
-        },
-        new_todos: {
-          type: "array",
-          items: {
-            type: "object",
-            properties: {
-              id: { type: "string" },
-              description: { type: "string" },
-              priority: { type: "string" }
-            },
-            required: ["id", "description", "priority"]
-          }
-        },
-        learnings: { type: "array", items: { type: "string" } }
-      },
-      required: ["analysis", "next_action"]
-    });
-    const claude = (0, import_child_process10.spawn)("claude", [
-      "--print",
-      "--output-format",
-      "json",
-      "--json-schema",
-      reasoningSchema
-    ], {
-      cwd: ROOT_DIR,
-      env: process.env,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    log(`  Claude process started (PID: ${claude.pid})`);
-    claude.stdin.write(prompt);
-    claude.stdin.end();
-    log(`  Prompt sent via stdin (with --output-format json + --json-schema)`);
-    let output = "";
-    let errorOutput = "";
-    let isResolved = false;
-    const progressInterval = setInterval(() => {
-      if (!isResolved) {
-        const elapsed = Math.round((Date.now() - startTime) / 1e3);
-        log(`  ...Claude thinking (${elapsed}s elapsed)`);
-      }
-    }, 1e4);
-    const timeout = setTimeout(() => {
-      if (!isResolved) {
-        isResolved = true;
-        clearInterval(progressInterval);
-        claude.kill("SIGTERM");
-        const elapsed = Math.round((Date.now() - startTime) / 1e3);
-        log(`Claude reasoning timed out after ${elapsed}s`);
-        resolve2(null);
-      }
-    }, TIMEOUT_MS);
-    claude.stdout.on("data", (data) => {
-      const chunk = data.toString();
-      output += chunk;
-      if (output.length === chunk.length) {
-        log(`  Claude is responding...`);
-      }
-    });
-    claude.stderr.on("data", (data) => {
-      const text = data.toString();
-      errorOutput += text;
-      if (text.trim()) {
-        log(`  [Claude stderr]: ${text.trim().substring(0, 200)}`);
-      }
-    });
-    claude.on("close", (code) => {
-      if (isResolved) return;
-      isResolved = true;
-      clearInterval(progressInterval);
-      clearTimeout(timeout);
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
-      if (code === 0) {
-        const result = parseCliJsonOutput(output, "Reasoning");
-        if (result) {
-          log(`Claude completed in ${elapsed}s: ${result.analysis}`);
-          resolve2(result);
-        } else {
-          log(`Claude completed in ${elapsed}s but no valid JSON found`);
-          resolve2(null);
+          required: ["id", "description", "priority"]
         }
-      } else {
-        log(`Claude exited with code ${code} after ${elapsed}s: ${errorOutput}`);
-        resolve2(null);
-      }
-    });
-    claude.on("error", (error) => {
-      if (isResolved) return;
-      isResolved = true;
-      clearInterval(progressInterval);
-      clearTimeout(timeout);
-      log(`Claude spawn error: ${error.message}`);
-      resolve2(null);
-    });
+      },
+      learnings: { type: "array", items: { type: "string" } }
+    },
+    required: ["analysis", "next_action"]
+  };
+  const aiResult = await invokeAI({
+    prompt,
+    cwd: ROOT_DIR,
+    timeoutMs: TIMEOUT_MS,
+    useStdin: true,
+    jsonSchema: reasoningSchema
   });
+  const elapsed = Math.round((Date.now() - startTime) / 1e3);
+  if (aiResult.error) {
+    log(`Claude reasoning failed after ${elapsed}s: ${aiResult.error}`);
+    return null;
+  }
+  const result = aiResult.provider === "claude-cli" ? parseCliJsonOutput(aiResult.output, "Reasoning") : robustJsonParse(aiResult.output, "Reasoning");
+  if (result) {
+    log(`Claude completed in ${elapsed}s (${aiResult.provider}): ${result.analysis}`);
+  } else {
+    log(`Claude completed in ${elapsed}s but no valid JSON found`);
+  }
+  return result;
 }
 function addTasksToTodo(tasks) {
   if (tasks.length === 0) return;
@@ -35005,98 +35322,63 @@ Respond with JSON only (no markdown code blocks, just raw JSON):
     }
   ]
 }`;
-  return new Promise((resolve2) => {
-    const TIMEOUT_MS = config.autonomy?.max_sub_task_timeout_ms || 6e5;
-    log(`Decomposing idea into sub-tasks via Claude reasoning (timeout: ${Math.round(TIMEOUT_MS / 1e3)}s)...`);
-    const startTime = Date.now();
-    const decompSchema = JSON.stringify({
-      type: "object",
-      properties: {
-        sub_tasks: {
-          type: "array",
-          items: {
-            type: "object",
-            properties: {
-              id: { type: "string" },
-              title: { type: "string" },
-              description: { type: "string" },
-              files_to_modify: { type: "array", items: { type: "string" } },
-              observability: { type: "string" }
-            },
-            required: ["id", "title", "description", "files_to_modify"]
-          }
-        }
-      },
-      required: ["sub_tasks"]
-    });
-    const claude = (0, import_child_process10.spawn)("claude", [
-      "--print",
-      "--output-format",
-      "json",
-      "--json-schema",
-      decompSchema
-    ], {
-      cwd: ROOT_DIR,
-      env: process.env,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    claude.stdin.write(prompt);
-    claude.stdin.end();
-    let output = "";
-    let isResolved = false;
-    const progressInterval = setInterval(() => {
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
-      log(`  ...Decomposing (${elapsed}s elapsed, ${output.length} chars received)`);
-    }, 15e3);
-    const timeout = setTimeout(() => {
-      if (!isResolved) {
-        isResolved = true;
-        clearInterval(progressInterval);
-        claude.kill("SIGTERM");
-        const elapsed = Math.round((Date.now() - startTime) / 1e3);
-        log(`Decomposition timed out after ${elapsed}s (limit: ${Math.round(TIMEOUT_MS / 1e3)}s)`);
-        resolve2([]);
-      }
-    }, TIMEOUT_MS);
-    claude.stdout.on("data", (data) => {
-      output += data.toString();
-    });
-    claude.on("close", (code) => {
-      if (isResolved) return;
-      isResolved = true;
-      clearTimeout(timeout);
-      clearInterval(progressInterval);
-      if (code === 0 && output.trim().length > 0) {
-        const parsed = parseCliJsonOutput(output, "Decomposition");
-        if (parsed?.sub_tasks?.length) {
-          const subTasks = parsed.sub_tasks.slice(0, maxSubTasks).map((st, i) => ({
-            id: st.id || `st-${String(i + 1).padStart(3, "0")}`,
-            title: st.title,
-            description: st.description,
-            files_to_modify: st.files_to_modify || [],
-            observability: st.observability || void 0,
-            status: "pending",
-            started_at: null,
-            completed_at: null,
-            error_message: null,
-            commit_hash: null
-          }));
-          log(`Decomposed into ${subTasks.length} sub-tasks`);
-          resolve2(subTasks);
-          return;
+  const TIMEOUT_MS = config.autonomy?.max_sub_task_timeout_ms || 6e5;
+  log(`Decomposing idea into sub-tasks via Claude reasoning (timeout: ${Math.round(TIMEOUT_MS / 1e3)}s)...`);
+  const startTime = Date.now();
+  const decompSchema = {
+    type: "object",
+    properties: {
+      sub_tasks: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            title: { type: "string" },
+            description: { type: "string" },
+            files_to_modify: { type: "array", items: { type: "string" } },
+            observability: { type: "string" }
+          },
+          required: ["id", "title", "description", "files_to_modify"]
         }
       }
-      resolve2([]);
-    });
-    claude.on("error", () => {
-      if (!isResolved) {
-        isResolved = true;
-        clearTimeout(timeout);
-        clearInterval(progressInterval);
-        resolve2([]);
-      }
-    });
+    },
+    required: ["sub_tasks"]
+  };
+  const aiResult = await invokeAI({
+    prompt,
+    cwd: ROOT_DIR,
+    timeoutMs: TIMEOUT_MS,
+    useStdin: true,
+    jsonSchema: decompSchema
   });
+  const elapsed = Math.round((Date.now() - startTime) / 1e3);
+  if (aiResult.error) {
+    log(`Decomposition failed after ${elapsed}s: ${aiResult.error}`);
+    return [];
+  }
+  if (!aiResult.output.trim()) {
+    log(`Decomposition returned empty output after ${elapsed}s`);
+    return [];
+  }
+  const parsed = aiResult.provider === "claude-cli" ? parseCliJsonOutput(aiResult.output, "Decomposition") : robustJsonParse(aiResult.output, "Decomposition");
+  if (parsed?.sub_tasks?.length) {
+    const subTasks = parsed.sub_tasks.slice(0, maxSubTasks).map((st, i) => ({
+      id: st.id || `st-${String(i + 1).padStart(3, "0")}`,
+      title: st.title,
+      description: st.description,
+      files_to_modify: st.files_to_modify || [],
+      observability: st.observability || void 0,
+      status: "pending",
+      started_at: null,
+      completed_at: null,
+      error_message: null,
+      commit_hash: null
+    }));
+    log(`Decomposed into ${subTasks.length} sub-tasks`);
+    return subTasks;
+  }
+  return [];
 }
 function deferIdeaWithComment(ideaId, reason) {
   const ideasData = loadJson(IDEAS_FILE, { ideas: [] });
@@ -35446,12 +35728,12 @@ async function executeAutonomousImplementation(ideaId) {
         if (branchName2) {
           try {
             log(`Auto-merging branch ${branchName2} into ${defaultBranch2}...`);
-            (0, import_child_process10.execSync)(`git checkout ${defaultBranch2}`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
-            (0, import_child_process10.execSync)(`git merge ${branchName2} --squash --no-edit`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
-            (0, import_child_process10.execSync)(`git commit -m "feat: ${idea.title} (auto-merged from ${branchName2})"`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+            (0, import_child_process10.execFileSync)("git", ["checkout", validateBranchName(defaultBranch2)], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+            (0, import_child_process10.execFileSync)("git", ["merge", validateBranchName(branchName2), "--squash", "--no-edit"], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+            (0, import_child_process10.execFileSync)("git", ["commit", "-m", `feat: ${sanitizeForCommitMessage(idea.title)} (auto-merged from ${validateBranchName(branchName2)})`], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
             log(`Successfully merged ${branchName2} into ${defaultBranch2}`);
             try {
-              (0, import_child_process10.execSync)(`git branch -d ${branchName2}`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+              (0, import_child_process10.execFileSync)("git", ["branch", "-d", validateBranchName(branchName2)], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
               log(`Deleted branch ${branchName2}`);
             } catch {
               log(`Could not delete branch ${branchName2} (may need force delete)`);
@@ -35476,8 +35758,8 @@ async function executeAutonomousImplementation(ideaId) {
           } catch (mergeError) {
             log(`Auto-merge failed (likely conflicts): ${mergeError instanceof Error ? mergeError.message : "Unknown"}`);
             try {
-              (0, import_child_process10.execSync)(`git merge --abort`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
-              (0, import_child_process10.execSync)(`git checkout ${branchName2}`, { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+              (0, import_child_process10.execFileSync)("git", ["merge", "--abort"], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
+              (0, import_child_process10.execFileSync)("git", ["checkout", validateBranchName(branchName2)], { cwd: workspacePath, encoding: "utf-8", stdio: "pipe" });
             } catch {
             }
             log(`Left idea ${ideaId} in testing stage for manual merge`);
@@ -35640,6 +35922,12 @@ async function executeSuggestEpics() {
   }
 }
 async function executeMetaTask(taskId, description, businessContext, options) {
+  try {
+    requireClaudeCLI("meta-task execution");
+  } catch (err2) {
+    log(`Meta-task skipped: ${err2.message}`);
+    return false;
+  }
   const failureCount = options?.failureCount || 0;
   log(`Executing meta-task via Claude Code: ${taskId} (attempt ${failureCount + 1})`);
   const allowedFiles = [
@@ -35912,6 +36200,12 @@ Return a JSON array of ideas:
 Only output the JSON array, no other text.`;
 }
 async function executeGoalGapResearch(goalId) {
+  try {
+    requireClaudeCLI("goal-gap research");
+  } catch (err2) {
+    log(`Goal-gap research skipped: ${err2.message}`);
+    return false;
+  }
   log(`Executing goal-gap research for ${goalId}...`);
   const goalsData = loadJson(GOALS_FILE, { goals: [] });
   const goal = goalsData.goals.find((g2) => g2.id === goalId);
@@ -36176,49 +36470,23 @@ async function executeShippedEvaluation(ideaId) {
   const liveKPIs = await fetchLiveKPIs();
   const prompt = buildEvaluationPrompt(idea, goal, liveKPIs, daysShipped);
   const TIMEOUT_MS = 12e4;
-  const result = await new Promise((resolve2) => {
-    const claude = (0, import_child_process10.spawn)("claude", ["--print"], {
-      cwd: ROOT_DIR,
-      env: process.env,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    claude.stdin.write(prompt);
-    claude.stdin.end();
-    let output = "";
-    let isResolved = false;
-    const timeout = setTimeout(() => {
-      if (!isResolved) {
-        isResolved = true;
-        claude.kill("SIGTERM");
-        log("Evaluation timed out");
-        resolve2(null);
-      }
-    }, TIMEOUT_MS);
-    claude.stdout.on("data", (data) => {
-      output += data.toString();
-    });
-    claude.on("close", (code) => {
-      if (isResolved) return;
-      isResolved = true;
-      clearTimeout(timeout);
-      if (code === 0 && output.trim()) {
-        const parsed = robustJsonParse(output, "Evaluation");
-        if (parsed) {
-          log(`Evaluation complete: status=${parsed.status}, confidence=${parsed.confidence}`);
-          resolve2(parsed);
-          return;
-        }
-      }
-      resolve2(null);
-    });
-    claude.on("error", () => {
-      if (!isResolved) {
-        isResolved = true;
-        clearTimeout(timeout);
-        resolve2(null);
-      }
-    });
+  const aiResult = await invokeAI({
+    prompt,
+    cwd: ROOT_DIR,
+    timeoutMs: TIMEOUT_MS,
+    useStdin: true,
+    expectJson: true
   });
+  let result = null;
+  if (!aiResult.error && aiResult.output.trim()) {
+    const parsed = robustJsonParse(aiResult.output, "Evaluation");
+    if (parsed) {
+      log(`Evaluation complete (${aiResult.provider}): status=${parsed.status}, confidence=${parsed.confidence}`);
+      result = parsed;
+    }
+  } else if (aiResult.error) {
+    log(`Evaluation failed: ${aiResult.error}`);
+  }
   if (!result) {
     log(`Evaluation failed for ${ideaId}`);
     return false;
@@ -36570,6 +36838,14 @@ Respond with JSON only:
   return tasks;
 }
 async function executeSingleResearchTask(task) {
+  try {
+    requireClaudeCLI("research task");
+  } catch (err2) {
+    task.status = "failed";
+    task.error_message = err2.message;
+    task.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+    return task;
+  }
   const TIMEOUT_MS = 3e5;
   log(`  Starting research task: ${task.type} - ${task.topic}`);
   task.status = "running";
@@ -36685,30 +36961,21 @@ Respond with JSON only:
   "recommendation": "proceed|revise|reject",
   "recommendation_reasoning": "Why this recommendation"
 }`;
-  return new Promise((resolve2) => {
-    const claude = (0, import_child_process10.spawn)("claude", ["--print"], {
-      cwd: ROOT_DIR,
-      env: process.env,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    claude.stdin.write(prompt);
-    claude.stdin.end();
-    let output = "";
-    const timeout = setTimeout(() => {
-      claude.kill("SIGTERM");
-      research.summary = findingsSummary;
-      research.recommendation = "revise";
-      resolve2();
-    }, TIMEOUT_MS);
-    claude.stdout.on("data", (data) => {
-      output += data.toString();
-    });
-    claude.on("close", (code) => {
-      clearTimeout(timeout);
-      if (code === 0 && output.trim()) {
-        const parsed = robustJsonParse(output, "ResearchAggregation");
-        if (parsed) {
-          research.summary = `**Executive Summary:** ${parsed.executive_summary}
+  const aiResult = await invokeAI({
+    prompt,
+    cwd: ROOT_DIR,
+    timeoutMs: TIMEOUT_MS,
+    useStdin: true,
+    expectJson: true
+  });
+  if (aiResult.error || !aiResult.output.trim()) {
+    research.summary = findingsSummary;
+    research.recommendation = "revise";
+    return;
+  }
+  const parsed = robustJsonParse(aiResult.output, "ResearchAggregation");
+  if (parsed) {
+    research.summary = `**Executive Summary:** ${parsed.executive_summary}
 
 **Key Insights:**
 ${parsed.key_insights.map((i) => `- ${i}`).join("\n")}
@@ -36717,25 +36984,12 @@ ${parsed.key_insights.map((i) => `- ${i}`).join("\n")}
 ${parsed.risks_identified?.map((r) => `- ${r}`).join("\n") || "None identified"}
 
 **Reasoning:** ${parsed.recommendation_reasoning}`;
-          research.recommendation = parsed.recommendation;
-          log(`Research aggregation complete: ${research.recommendation}`);
-        } else {
-          research.summary = findingsSummary;
-          research.recommendation = "revise";
-        }
-      } else {
-        research.summary = findingsSummary;
-        research.recommendation = "revise";
-      }
-      resolve2();
-    });
-    claude.on("error", () => {
-      clearTimeout(timeout);
-      research.summary = findingsSummary;
-      research.recommendation = "revise";
-      resolve2();
-    });
-  });
+    research.recommendation = parsed.recommendation;
+    log(`Research aggregation complete (${aiResult.provider}): ${research.recommendation}`);
+  } else {
+    research.summary = findingsSummary;
+    research.recommendation = "revise";
+  }
 }
 async function executeIdeaResearch(ideaId, config, businessContext) {
   log(`Executing parallel research for idea: ${ideaId}`);
@@ -37004,6 +37258,20 @@ function generateStatusContent(state, alerts, nextTask, reasoning, systemHealth)
 ## System Health
 
 ${systemHealth.recovery_actions.map((a) => `- ${a}`).join("\n")}
+` : "";
+  const rejections = (() => {
+    try {
+      return getRejectionCounts();
+    } catch {
+      return { branch: 0, repo: 0, commitMsg: 0 };
+    }
+  })();
+  const hasRejections = rejections.branch > 0 || rejections.repo > 0 || rejections.commitMsg > 0;
+  const securitySection = hasRejections ? `
+## Security
+
+- Shell input rejections: {branch: ${rejections.branch}, repo: ${rejections.repo}, commitMsg: ${rejections.commitMsg}}
+- \u26A0\uFE0F Non-zero rejections detected \u2014 investigate source of malformed input
 ` : "";
   const analysisSection = reasoning ? `**Analysis:** ${reasoning.analysis}
 
@@ -37052,7 +37320,7 @@ ${pendingRows}
 ## Alerts
 
 ${alertsSection}
-${healthSection}
+${healthSection}${securitySection}
 ## Recent Activity
 
 | Date | Event |
@@ -37067,6 +37335,7 @@ ${activityRows}
 async function runSingleHeartbeat(beatNumber = 1) {
   const startTime = Date.now();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  resetRejectionCounts();
   capturedLogs = [];
   isCapturingLogs = true;
   try {