From c6adef84147065f52f821bd2ab85a4063432a8aa Mon Sep 17 00:00:00 2001
From: Tai Groot <tai@taigrr.com>
Date: Wed, 8 Jul 2026 06:33:37 +0000
Subject: [PATCH] fix(prompts): escape prompt args during substitution

---
 lua/neocrush/prompts.lua |  4 +++-
 tests/prompts_spec.lua   | 49 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 50 insertions(+), 3 deletions(-)

diff --git a/lua/neocrush/prompts.lua b/lua/neocrush/prompts.lua
index cc85d7a..71519b4 100644
--- a/lua/neocrush/prompts.lua
+++ b/lua/neocrush/prompts.lua
@@ -83,7 +83,9 @@ function M.execute(name, args)
   if args and args ~= '' then
     -- Substitute %s with arguments, or append if no %s
     if template:find '%%s' then
-      text = template:gsub('%%s', args)
+      text = template:gsub('%%s', function()
+        return args
+      end)
     else
       text = template .. ' ' .. args
     end
diff --git a/tests/prompts_spec.lua b/tests/prompts_spec.lua
index 7d49630..4e5e1ad 100644
--- a/tests/prompts_spec.lua
+++ b/tests/prompts_spec.lua
@@ -106,8 +106,53 @@ describe('neocrush.prompts', function()
   end)
 
   describe('execute', function()
-    -- Note: execute() calls terminal functions which we can't easily test
-    -- without mocking. Test the error case for unknown prompts.
+    it('should substitute prompt arguments', function()
+      prompts.register {
+        Review = 'review PR #%s',
+      }
+      local sent
+      local original_send = prompts.send
+      prompts.send = function(text)
+        sent = text
+      end
+
+      prompts.execute('Review', '12')
+
+      prompts.send = original_send
+      eq('review PR #12', sent)
+    end)
+
+    it('should substitute prompt arguments containing percent signs', function()
+      prompts.register {
+        Note = 'summarize %s',
+      }
+      local sent
+      local original_send = prompts.send
+      prompts.send = function(text)
+        sent = text
+      end
+
+      prompts.execute('Note', '50% done')
+
+      prompts.send = original_send
+      eq('summarize 50% done', sent)
+    end)
+
+    it('should append arguments when template has no placeholder', function()
+      prompts.register {
+        Simple = 'explain',
+      }
+      local sent
+      local original_send = prompts.send
+      prompts.send = function(text)
+        sent = text
+      end
+
+      prompts.execute('Simple', 'this code')
+
+      prompts.send = original_send
+      eq('explain this code', sent)
+    end)
 
     it('should error for unknown prompt', function()
       local notified = false