perf: replace sed subprocess with bash-native SQL literal escaping (local send/inbox/history/watch path)

scripts/check-inbox.sh

@@ -238,7 +238,7 @@ for team in "${TEAM_LIST[@]}"; do
              replace(replace(json_extract(value,'\$.body'), char(10), '\n'), char(9), '\t') || char(31) ||
              json_extract(value,'\$.at') || char(31) ||
              json_extract(value,'\$.id')
-      FROM json_each('$(printf '%s' "$_arr" | sed "s/'/''/g")');
+      FROM json_each('${_arr//\'/\'\'}');
     "
   )
   _rc=$?

scripts/drivers/storage/sqlite.sh

@@ -23,7 +23,7 @@ _sqlite_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
 # than held in a driver-wide variable: these run inside command substitutions,
 # where an assignment made by a caller would not be visible anyway.
 _sqlite_db() { agmsg_db_path "$1"; }
-_sqlite_lit() { printf '%s' "$1" | sed "s/'/''/g"; }
+_sqlite_lit() { local s="$1" q="'"; printf '%s' "${s//$q/$q$q}"; }
 
 # Run a record-returning query: strip CR but PRESERVE the sqlite exit status
 # (pipefail), so a backend failure surfaces as a non-zero return instead of

scripts/history.sh

@@ -44,7 +44,7 @@ ROWS=$(agmsg_sqlite ':memory:' "
          replace(replace(json_extract(value,'\$.body'), char(10), '\n'), char(9), '\t') || char(31) ||
          json_extract(value,'\$.at') || char(31) ||
          json_extract(value,'\$.id')
-  FROM json_each('$(printf '%s' "$_arr" | sed "s/'/''/g")');
+  FROM json_each('${_arr//\'/\'\'}');
 ")
 
 # Read-state for the ●(unread)/○(read) marker (G2(c)): read-state is
@@ -62,7 +62,7 @@ while IFS= read -r r; do
   [ -n "$u" ] || continue
   uarr="[$(printf '%s' "$u" | paste -sd, -)]"
   ids=$(agmsg_sqlite ':memory:' "
-    SELECT json_extract(value,'\$.id') FROM json_each('$(printf '%s' "$uarr" | sed "s/'/''/g")');
+    SELECT json_extract(value,'\$.id') FROM json_each('${uarr//\'/\'\'}');
   ")
   UNREAD_IDS+="$ids"$'\n'
 done <<< "$RECIPIENTS"

scripts/inbox.sh

@@ -48,7 +48,7 @@ ROWS=$(agmsg_sqlite ':memory:' "
          replace(replace(json_extract(value,'\$.body'), char(10), '\n'), char(9), '\t') || char(31) ||
          json_extract(value,'\$.at') || char(31) ||
          json_extract(value,'\$.id')
-  FROM json_each('$(printf '%s' "$_arr" | sed "s/'/''/g")');
+  FROM json_each('${_arr//\'/\'\'}');
 ")
 
 COUNT=$(printf '%s\n' "$ROWS" | wc -l | tr -d ' ')

scripts/lib/sqlpath.sh

@@ -29,7 +29,7 @@ agmsg_sql_readfile_path() {
   if command -v cygpath >/dev/null 2>&1; then
     path=$(cygpath -w "$path" 2>/dev/null || printf '%s' "$path")
   fi
-  printf '%s' "$path" | sed "s/'/''/g"
+  printf '%s' "${path//\'/\'\'}"
 }
 
 # True when sqlite can actually open <path>.

scripts/send.sh

@@ -47,7 +47,7 @@ if [ "$FORCE" -ne 1 ]; then
     fi
     local cfg_sql name_sql found roster
     cfg_sql=$(agmsg_sql_readfile_path "$TEAM_CONFIG")
-    name_sql=$(printf '%s' "$name" | sed "s/'/''/g")
+    name_sql="${name//\'/\'\'}"
     found=$(agmsg_sqlite_mem "
       WITH raw(json) AS (SELECT CAST(readfile('$cfg_sql') AS TEXT)),
       cfg(json) AS (SELECT CASE WHEN json_valid(json) THEN json END FROM raw)

scripts/watch.sh

@@ -702,7 +702,7 @@ while true; do
              COALESCE(json_extract(value,'\$.to'),'') || char(31) ||
              replace(replace(replace(COALESCE(json_extract(value,'\$.body'),''), char(13), ''), char(10), '\\n'), char(9), '\t') || char(31) ||
              COALESCE(json_extract(value,'\$.cursor'),'')
-      FROM json_each('$(printf '%s' "$_arr" | sed "s/'/''/g")');
+      FROM json_each('${_arr//\'/\'\'}');
     " 2>/dev/null || true)"
 
     FINAL_CURSOR=""