@claude-flow/cli 3.7.0-alpha.39 → 3.7.0-alpha.40
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -148,8 +148,12 @@ const handlers = {
|
|
|
148
148
|
},
|
|
149
149
|
|
|
150
150
|
'pre-bash': () => {
|
|
151
|
-
// Basic command safety check — prefer stdin command data from Claude Code
|
|
152
|
-
|
|
151
|
+
// Basic command safety check — prefer stdin command data from Claude Code.
|
|
152
|
+
// String() wrap is belt-and-suspenders for #2017: even if a future regression
|
|
153
|
+
// re-binds `prompt` or `hookInput.command` to a non-string, `.toLowerCase()`
|
|
154
|
+
// can no longer throw a TypeError that the global try/catch would swallow
|
|
155
|
+
// (silently exiting 0 and letting the dangerous command through).
|
|
156
|
+
const cmd = String(hookInput.command || toolInput.command || prompt || '').toLowerCase();
|
|
153
157
|
const dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:'];
|
|
154
158
|
for (const d of dangerous) {
|
|
155
159
|
if (cmd.includes(d)) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@claude-flow/cli",
|
|
3
|
-
"version": "3.7.0-alpha.
|
|
3
|
+
"version": "3.7.0-alpha.40",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
|
|
6
6
|
"main": "dist/src/index.js",
|