@costrict/csc 4.2.22 → 4.2.24

package/dist/cli.js

@@ -66713,8 +66713,8 @@ function getClientVersion() {
   if (cached)
     return cached;
   try {
-    if ("4.2.22") {
-      cached = "4.2.22";
+    if ("4.2.24") {
+      cached = "4.2.24";
       return cached;
     }
   } catch {}
@@ -90538,17 +90538,20 @@ __export(exports_windowsPaths, {
 });
 import { existsSync as existsSync4 } from "fs";
 import * as pathWin32 from "path/win32";
-function isWslBash(candidatePath) {
+function isNonGitBash(candidatePath) {
   const lower = candidatePath.toLowerCase();
-  return lower.endsWith("\\bash.exe") && (lower.includes("\\windows\\system32\\") || lower.includes("\\windows\\syswow64\\"));
+  if (!lower.endsWith("\\bash.exe")) {
+    return false;
+  }
+  return lower.includes("\\windows\\system32\\") || lower.includes("\\windows\\syswow64\\") || lower.includes("\\windowsapps\\") || lower.includes("\\cygwin\\") || lower.includes("\\cygwin64\\");
 }
 function findExecutableWithDeps(executable, deps) {
   try {
     const paths2 = deps.execCommand(`where.exe ${executable}`).split(/\r?\n/u).map((candidate) => candidate.trim()).filter(Boolean);
     const cwd2 = pathWin32.resolve(deps.cwdFn()).toLowerCase();
     for (const candidatePath of paths2) {
-      if (executable === "bash" && isWslBash(candidatePath)) {
-        logForDebugging(`Skipping WSL bash launcher (incompatible with Windows paths): ${candidatePath}`);
+      if (executable === "bash" && isNonGitBash(candidatePath)) {
+        logForDebugging(`Skipping non-Git bash launcher (incompatible with Windows paths): ${candidatePath}`);
         continue;
       }
       const candidateDirectory = pathWin32.dirname(pathWin32.resolve(candidatePath)).toLowerCase();
@@ -90580,10 +90583,6 @@ function findGitBashPathOrNullWithDeps(deps = DEFAULT_DEPS) {
   if (envOverride) {
     return deps.checkExists(envOverride) ? envOverride : null;
   }
-  const bashPath = findExecutableWithDeps("bash", deps);
-  if (bashPath && deps.checkExists(bashPath)) {
-    return bashPath;
-  }
   const gitPath = findExecutableWithDeps("git", deps);
   if (gitPath) {
     const candidates = [
@@ -90591,11 +90590,20 @@ function findGitBashPathOrNullWithDeps(deps = DEFAULT_DEPS) {
       pathWin32.join(gitPath, "..", "..", "usr", "bin", "bash.exe"),
       pathWin32.join(gitPath, "..", "bash.exe")
     ];
-    const derivedPath = candidates.find(deps.checkExists);
+    const derivedPath = candidates.find((candidate) => {
+      if (isNonGitBash(candidate)) {
+        return false;
+      }
+      return deps.checkExists(candidate);
+    });
     if (derivedPath) {
       return derivedPath;
     }
   }
+  const bashPath = findExecutableWithDeps("bash", deps);
+  if (bashPath && deps.checkExists(bashPath)) {
+    return bashPath;
+  }
   return findCommonGitBashPath(deps.checkExists, deps.userProfile);
 }
 function setShellIfWindows() {
@@ -220495,7 +220503,7 @@ async function fetchCoStrictModels(baseUrl, accessToken) {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
-        "User-Agent": `csc/${"4.2.22"}`
+        "User-Agent": `csc/${"4.2.24"}`
       },
       signal: controller.signal
     });
@@ -222532,7 +222540,7 @@ var init_auth7 = __esm(() => {
 
 // src/utils/userAgent.ts
 function getClaudeCodeUserAgent() {
-  return `costrict/${"4.2.22"}`;
+  return `costrict/${"4.2.24"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -222554,7 +222562,7 @@ function getUserAgent() {
   const clientApp = process.env.CLAUDE_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `csc/${"4.2.22"}`;
+  return `csc/${"4.2.24"}`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -222568,7 +222576,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `csc/${"4.2.22"}${suffix}`;
+  return `csc/${"4.2.24"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `Claude-User (${getClaudeCodeUserAgent()}; +https://support.anthropic.com/)`;
@@ -222688,7 +222696,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "4.2.22",
+      appVersion: "4.2.24",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -233736,7 +233744,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "4.2.22".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "4.2.24".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -233776,9 +233784,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "4.2.22",
+      version: "4.2.24",
       versionBase: getVersionBase(),
-      buildTime: "2026-08-03T04:18:00.311Z",
+      buildTime: "2026-08-04T09:20:56.936Z",
       deploymentEnvironment: env4.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -234449,7 +234457,7 @@ function initialize1PEventLogging() {
   const platform3 = getPlatform();
   const attributes = {
     [import_semantic_conventions2.ATTR_SERVICE_NAME]: "claude-code",
-    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "4.2.22"
+    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "4.2.24"
   };
   if (platform3 === "wsl") {
     const wslVersion = getWslVersion();
@@ -234476,7 +234484,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "4.2.22");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "4.2.24");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -434494,7 +434502,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "4.2.22";
+    attributes["app.version"] = "4.2.24";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -468014,7 +468022,7 @@ function initLangfuse() {
       flushInterval: parseInt(process.env.LANGFUSE_FLUSH_INTERVAL ?? "10", 10),
       mask: maskFn,
       environment: process.env.LANGFUSE_TRACING_ENVIRONMENT ?? "development",
-      release: "4.2.22",
+      release: "4.2.24",
       exportMode: process.env.LANGFUSE_EXPORT_MODE ?? "batched",
       timeout: parseInt(process.env.LANGFUSE_TIMEOUT ?? "5", 10)
     });
@@ -499914,7 +499922,7 @@ function initSentry() {
   }
   init3({
     dsn,
-    release: typeof MACRO !== "undefined" ? "4.2.22" : undefined,
+    release: typeof MACRO !== "undefined" ? "4.2.24" : undefined,
     environment: typeof BUILD_ENV !== "undefined" ? BUILD_ENV : "production",
     maxBreadcrumbs: 20,
     sampleRate: 1,
@@ -527811,7 +527819,7 @@ async function initializeBetaTracing(resource) {
   });
   logs.setGlobalLoggerProvider(loggerProvider);
   setLoggerProvider(loggerProvider);
-  const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.22");
+  const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.24");
   setEventLogger(eventLogger);
   process.on("beforeExit", async () => {
     await loggerProvider?.forceFlush();
@@ -527851,7 +527859,7 @@ async function initializeTelemetry() {
   const platform5 = getPlatform();
   const baseAttributes = {
     [import_semantic_conventions29.ATTR_SERVICE_NAME]: "claude-code",
-    [import_semantic_conventions29.ATTR_SERVICE_VERSION]: "4.2.22"
+    [import_semantic_conventions29.ATTR_SERVICE_VERSION]: "4.2.24"
   };
   if (platform5 === "wsl") {
     const wslVersion = getWslVersion();
@@ -527896,7 +527904,7 @@ async function initializeTelemetry() {
       } catch {}
     };
     registerCleanup(shutdownTelemetry2);
-    return meterProvider2.getMeter("com.anthropic.claude_code", "4.2.22");
+    return meterProvider2.getMeter("com.anthropic.claude_code", "4.2.24");
   }
   const meterProvider = new import_sdk_metrics2.MeterProvider({
     resource,
@@ -527916,7 +527924,7 @@ async function initializeTelemetry() {
       });
       logs.setGlobalLoggerProvider(loggerProvider);
       setLoggerProvider(loggerProvider);
-      const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.22");
+      const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.24");
       setEventLogger(eventLogger);
       logForDebugging("[3P telemetry] Event logger set successfully");
       process.on("beforeExit", async () => {
@@ -527978,7 +527986,7 @@ Current timeout: ${timeoutMs}ms
     }
   };
   registerCleanup(shutdownTelemetry);
-  return meterProvider.getMeter("com.anthropic.claude_code", "4.2.22");
+  return meterProvider.getMeter("com.anthropic.claude_code", "4.2.24");
 }
 async function flushTelemetry() {
   const meterProvider = getMeterProvider();
@@ -529037,7 +529045,7 @@ async function installGlobalPackage(specificVersion) {
     logError3(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "4.2.22"
+      currentVersion: "4.2.24"
     });
     return { status: "in_progress" };
   }
@@ -529046,7 +529054,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env4.isRunningWithBun() && env4.isNpmFromWindowsPath()) {
       logError3(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "4.2.22"
+        currentVersion: "4.2.24"
       });
       return {
         status: "install_failed",
@@ -529592,7 +529600,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version9 = typeof MACRO !== "undefined" ? "4.2.22" : "unknown";
+  const version9 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -567779,7 +567787,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client10 = new Client3({
       name: "claude-code",
       title: "CoStrict",
-      version: "4.2.22",
+      version: "4.2.24",
       description: "CoStrict agentic coding tool",
       websiteUrl: PRODUCT_URL
     }, {
@@ -568150,7 +568158,7 @@ var init_client18 = __esm(() => {
       const client10 = new Client3({
         name: "claude-code",
         title: "CoStrict",
-        version: "4.2.22",
+        version: "4.2.24",
         description: "CoStrict agentic coding tool",
         websiteUrl: PRODUCT_URL
       }, {
@@ -569540,7 +569548,7 @@ function getInstallationEnv() {
   return;
 }
 function getClaudeCodeVersion() {
-  return "4.2.22";
+  return "4.2.24";
 }
 async function getInstalledVSCodeExtensionVersion(command4) {
   const { stdout } = await execFileNoThrow2(command4, ["--list-extensions", "--show-versions"], {
@@ -570904,8 +570912,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version10, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version10} to ${maxVersion}`);
-      if (gte2("4.2.22", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"4.2.22"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte2("4.2.24", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"4.2.24"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime2,
           max_version: maxVersion,
@@ -570916,7 +570924,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version10 = maxVersion;
     }
   }
-  if (!forceReinstall && version10 === "4.2.22" && await versionIsAvailable(version10) && await isPossibleClaudeBinary(executablePath)) {
+  if (!forceReinstall && version10 === "4.2.24" && await versionIsAvailable(version10) && await isPossibleClaudeBinary(executablePath)) {
     logForDebugging(`Found ${version10} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime2,
@@ -708984,7 +708992,7 @@ function Feedback({
       platform: env4.platform,
       gitRepo: envInfo.isGit,
       terminal: env4.terminal,
-      version: "4.2.22",
+      version: "4.2.24",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -709167,7 +709175,7 @@ function Feedback({
                       ", ",
                       env4.terminal,
                       ", v",
-                      "4.2.22"
+                      "4.2.24"
                     ]
                   })
                 ]
@@ -709264,7 +709272,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env4.platform}
 ` + `- Terminal: ${env4.terminal}
-` + `- Version: ${"4.2.22"}
+` + `- Version: ${"4.2.24"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -711503,7 +711511,7 @@ function buildPrimarySection() {
     children: t("settings.status.renameHint")
   });
   return [
-    { label: t("settings.status.version"), value: "4.2.22" },
+    { label: t("settings.status.version"), value: "4.2.24" },
     { label: t("settings.status.sessionName"), value: nameValue },
     { label: t("settings.status.sessionId"), value: sessionId },
     { label: t("settings.status.cwd"), value: getCwd() },
@@ -714361,7 +714369,7 @@ function Config({
         }
       })
     }) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_runtime191.jsx(ChannelDowngradeDialog, {
-      currentVersion: "4.2.22",
+      currentVersion: "4.2.24",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -714373,7 +714381,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "4.2.22";
+          newSettings.minimumVersion = "4.2.24";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev) => ({
@@ -719842,7 +719850,7 @@ function HelpV2({ onClose, commands: commands11 }) {
       color: "professionalBlue",
       children: [
         /* @__PURE__ */ jsx_runtime218.jsx(Tabs, {
-          title: process.env.USER_TYPE === "sf" ? "/help" : `CoStrict v${"4.2.22"}`,
+          title: process.env.USER_TYPE === "sf" ? "/help" : `CoStrict v${"4.2.24"}`,
           color: "professionalBlue",
           defaultTab: "general",
           children: tabs
@@ -742843,7 +742851,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.22") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.24") {
   if (process.env.USER_TYPE === "sf") {
     const changelog = "";
     if (changelog) {
@@ -742870,7 +742878,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.22")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "4.2.22") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "4.2.24") {
   if (process.env.USER_TYPE === "sf") {
     const changelog = "";
     if (changelog) {
@@ -745383,7 +745391,7 @@ function isNotLoggedIn() {
   return true;
 }
 function getLogoDisplayData() {
-  const version10 = process.env.DEMO_VERSION ?? "4.2.22";
+  const version10 = process.env.DEMO_VERSION ?? "4.2.24";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/claude" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -745961,7 +745969,7 @@ var init_MatrixMessageLine = __esm(() => {
 // src/components/matrix-tactical/MatrixWelcome.tsx
 import { basename as basename47 } from "path";
 function MatrixWelcome({
-  version: version10 = "4.2.22",
+  version: version10 = "4.2.24",
   projectName,
   cwd: cwd2,
   modelDisplayName,
@@ -746596,13 +746604,13 @@ function LogoV2() {
   const { hasReleaseNotes } = checkForReleaseNotesSync(config13.lastReleaseNotesSeen);
   import_react167.useEffect(() => {
     const currentConfig = getGlobalConfig();
-    if (currentConfig.lastReleaseNotesSeen === "4.2.22") {
+    if (currentConfig.lastReleaseNotesSeen === "4.2.24") {
       return;
     }
     saveGlobalConfig((current2) => {
-      if (current2.lastReleaseNotesSeen === "4.2.22")
+      if (current2.lastReleaseNotesSeen === "4.2.24")
         return current2;
-      return { ...current2, lastReleaseNotesSeen: "4.2.22" };
+      return { ...current2, lastReleaseNotesSeen: "4.2.24" };
     });
     if (showOnboarding) {
       incrementProjectOnboardingSeenCount();
@@ -769132,7 +769140,7 @@ async function captureMemoryDiagnostics(trigger, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "4.2.22"
+    ccVersion: "4.2.24"
   };
 }
 async function performHeapDump(trigger = "manual", dumpNumber = 0) {
@@ -769248,7 +769256,7 @@ var init_mock_limits = __esm(() => {
 var call55 = async () => {
   return {
     type: "text",
-    value: `${"4.2.22"} (built ${"2026-08-03T04:18:00.311Z"})`
+    value: `${"4.2.24"} (built ${"2026-08-04T09:20:56.936Z"})`
   };
 }, version10, version_default;
 var init_version2 = __esm(() => {
@@ -776495,6 +776503,34 @@ function agentsDir() {
 function commandsDir() {
   return path54.join(getClaudeConfigHomeDir(), "commands");
 }
+function assertSafeSlug(slug) {
+  if (!slug || typeof slug !== "string") {
+    throw new Error("Invalid favorite slug: empty or non-string");
+  }
+  if (slug.includes("/") || slug.includes("\\") || slug.includes("\x00") || slug === "." || slug === ".." || slug.startsWith(".") || slug.startsWith(" ") || slug.endsWith(" ") || !SAFE_SLUG_RE.test(slug)) {
+    throw new Error(`Invalid favorite slug: ${slug}`);
+  }
+}
+function resolveFavoritePath(baseDir, slug) {
+  assertSafeSlug(slug);
+  const resolvedBase = path54.resolve(baseDir);
+  const resolvedTarget = path54.resolve(path54.join(resolvedBase, slug));
+  const rel = path54.relative(resolvedBase, resolvedTarget);
+  if (rel === "" || rel.startsWith("..") || path54.isAbsolute(rel)) {
+    throw new Error(`Path traversal detected for favorite slug: ${slug}`);
+  }
+  return resolvedTarget;
+}
+function resolveFavoriteFilePath(baseDir, slug, suffix) {
+  assertSafeSlug(slug);
+  const resolvedBase = path54.resolve(baseDir);
+  const resolvedTarget = path54.resolve(path54.join(resolvedBase, `${slug}${suffix}`));
+  const rel = path54.relative(resolvedBase, resolvedTarget);
+  if (rel.startsWith("..") || path54.isAbsolute(rel)) {
+    throw new Error(`Path traversal detected for favorite slug: ${slug}`);
+  }
+  return resolvedTarget;
+}
 async function readState() {
   try {
     const text2 = await readFile76(favoriteStatePath(), "utf-8");
@@ -776589,11 +776625,18 @@ function parseFavoriteListItem(data) {
   const localType = STORE_TYPE_MAP[storeType];
   if (!localType)
     return;
+  const slug = String(data.slug ?? data.id);
+  try {
+    assertSafeSlug(slug);
+  } catch {
+    logForDebugging(`[favorite] skipping candidate with unsafe slug: ${slug}`);
+    return;
+  }
   const favorited = typeof data.favorited === "boolean" ? data.favorited : data.favorited === "true" || data.favorited === 1;
   logForDebugging(`[favorite] name=${data.name} score=${data.score} experienceScore=${data.experienceScore} favoriteCount=${data.favoriteCount} createdBy=${data.createdBy} fields=[${Object.keys(data).join(",")}]`);
   return {
     id: String(data.id),
-    slug: String(data.slug ?? data.id),
+    slug,
     name: String(data.name ?? data.slug ?? data.id),
     description: String(data.description ?? ""),
     itemType: localType,
@@ -776623,9 +776666,11 @@ async function getRemoteItem(id) {
   if (!localType) {
     throw new Error(`Unsupported item type: ${storeType} (${String(data.slug ?? id)})`);
   }
+  const slug = String(data.slug);
+  assertSafeSlug(slug);
   return {
     id: String(data.id),
-    slug: String(data.slug),
+    slug,
     name: String(data.name),
     description: String(data.description ?? ""),
     itemType: localType,
@@ -776693,7 +776738,7 @@ function deriveStatus(state3, activeSkillSlugs, activeAgentNames, activeCommandN
 }
 async function persistInstalledItem(item) {
   const typeRoot = favoriteTypeRoot(item.itemType);
-  const dir = path54.join(typeRoot, item.slug);
+  const dir = resolveFavoritePath(typeRoot, item.slug);
   const itemJson = JSON.stringify({
     id: item.id,
     slug: item.slug,
@@ -776871,7 +776916,7 @@ async function copyDir2(src, dest) {
 async function addItemToConfig(item, localPath) {
   switch (item.itemType) {
     case "skill": {
-      const destDir = path54.join(skillsDir(), item.slug);
+      const destDir = resolveFavoritePath(skillsDir(), item.slug);
       const fingerprint = await readBundleFingerprint(localPath);
       await replaceDirectoryAtomically(destDir, (stagingDir) => copyDir2(localPath, stagingDir), fingerprint === null ? {} : { fingerprint });
       clearCommandsCache();
@@ -776894,7 +776939,7 @@ async function addItemToConfig(item, localPath) {
       }));
       const agentDestDir = agentsDir();
       await mkdir62(agentDestDir, { recursive: true });
-      await copyFile10(mdPath, path54.join(agentDestDir, `${item.slug}.md`));
+      await copyFile10(mdPath, resolveFavoriteFilePath(agentDestDir, item.slug, ".md"));
       clearAgentDefinitionsCache();
       break;
     }
@@ -776914,7 +776959,7 @@ async function addItemToConfig(item, localPath) {
       }));
       const commandDestDir = commandsDir();
       await mkdir62(commandDestDir, { recursive: true });
-      await copyFile10(mdPath, path54.join(commandDestDir, `${item.slug}.md`));
+      await copyFile10(mdPath, resolveFavoriteFilePath(commandDestDir, item.slug, ".md"));
       clearCommandsCache();
       skillChangeDetector.notify();
       break;
@@ -776943,7 +776988,7 @@ Supported formats: opencode native, VS Code / Claude Desktop style, or simplifie
 async function removeItemFromConfig(itemType, slug, _localPath) {
   switch (itemType) {
     case "skill": {
-      const destDir = path54.join(skillsDir(), slug);
+      const destDir = resolveFavoritePath(skillsDir(), slug);
       await withTargetDirLock(destDir, () => rm16(destDir, { recursive: true, force: true }));
       clearCommandsCache();
       skillChangeDetector.notify();
@@ -776955,7 +777000,9 @@ async function removeItemFromConfig(itemType, slug, _localPath) {
         delete agents2[slug];
         return { ...cfg, agents: agents2 };
       });
-      await rm16(path54.join(agentsDir(), `${slug}.md`), { force: true });
+      await rm16(resolveFavoriteFilePath(agentsDir(), slug, ".md"), {
+        force: true
+      });
       clearAgentDefinitionsCache();
       break;
     }
@@ -776965,7 +777012,9 @@ async function removeItemFromConfig(itemType, slug, _localPath) {
         delete commands11[slug];
         return { ...cfg, commands: commands11 };
       });
-      await rm16(path54.join(commandsDir(), `${slug}.md`), { force: true });
+      await rm16(resolveFavoriteFilePath(commandsDir(), slug, ".md"), {
+        force: true
+      });
       clearCommandsCache();
       skillChangeDetector.notify();
       break;
@@ -777227,7 +777276,8 @@ function hasUpdate(item, localVersion) {
 async function updateFavoriteItem(slugOrId) {
   const installed = await ensureInstalled(slugOrId);
   const remote = await getRemoteItem(installed.id);
-  const backupDir = path54.join(path54.dirname(installed.localPath), ".backup", installed.slug, new Date().toISOString().replace(/[:.]/gu, "-"));
+  const backupBase = path54.join(path54.dirname(installed.localPath), ".backup");
+  const backupDir = path54.join(resolveFavoritePath(backupBase, installed.slug), new Date().toISOString().replace(/[:.]/gu, "-"));
   await copyDir2(installed.localPath, backupDir);
   await persistInstalledItem(remote);
   if (installed.lifecycle === "active") {
@@ -777311,7 +777361,7 @@ async function batchUpdateFavoriteItems(slugs) {
   }
   return { updated, errors: errors14 };
 }
-var FAVORITE_PAGE_SIZE = 20, FAVORITE_MAX_PAGES = 20, FAVORITE_LIST_CACHE_TTL_MS = 30000, _listFavoriteItemsCache = null, STORE_TYPE_MAP, LOCAL_TO_STORE_TYPE, FETCH_TIMEOUT_MS7 = 15000, RemoteListHttpError, _untypedListUnsupported = false, SUPPORTED_MCP_TYPES;
+var FAVORITE_PAGE_SIZE = 20, FAVORITE_MAX_PAGES = 20, FAVORITE_LIST_CACHE_TTL_MS = 30000, _listFavoriteItemsCache = null, STORE_TYPE_MAP, LOCAL_TO_STORE_TYPE, SAFE_SLUG_RE, FETCH_TIMEOUT_MS7 = 15000, RemoteListHttpError, _untypedListUnsupported = false, SUPPORTED_MCP_TYPES;
 var init_favorite = __esm(() => {
   init_fetch2();
   init_auth();
@@ -777337,6 +777387,7 @@ var init_favorite = __esm(() => {
     command: "command",
     mcp: "mcp"
   };
+  SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+$/u;
   RemoteListHttpError = class RemoteListHttpError extends Error {
     status;
     constructor(status2, message2) {
@@ -783838,7 +783889,8 @@ async function generateUltracodeWorkflow(request3, context41) {
         maxRetries: 1,
         thinking: false,
         querySource: "workflow",
-        signal: context41.abortController.signal
+        signal: context41.abortController.signal,
+        stream: true
       });
       const workflow = prepareGeneratedUltracodeWorkflow(extractGeneratedWorkflow(response3), request3);
       validateGeneratedUltracodeWorkflow(workflow, request3);
@@ -787171,7 +787223,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version11 = typeof MACRO !== "undefined" ? "4.2.22" : "unknown";
+  const version11 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h8) => h8.sessionCount > 0).map((h8) => h8.name);
   const facets_summary = {
     total: facets.size,
@@ -791621,7 +791673,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION11 = typeof MACRO !== "undefined" ? "4.2.22" : "unknown";
+  VERSION11 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN2 = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -792962,7 +793014,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes24(16).toString("hex");
-    return join204(getCostrictTempDir(), "bundled-skills", "4.2.22", nonce);
+    return join204(getCostrictTempDir(), "bundled-skills", "4.2.24", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -799232,7 +799284,7 @@ function computeFingerprint(messageText, version11) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "4.2.22");
+  return computeFingerprint(firstMessageText, "4.2.24");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -799642,7 +799694,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-08-03T04:18:00.311Z").getTime();
+  const buildTime = new Date("2026-08-04T09:20:56.936Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -804898,7 +804950,10 @@ function buildMessages(system, messages) {
   }
   for (const msg of messages) {
     if (typeof msg.content === "string") {
-      result.push({ role: msg.role, content: msg.content });
+      result.push({
+        role: msg.role,
+        content: msg.content
+      });
     } else {
       const text2 = msg.content.filter((b9) => b9.type === "text").map((b9) => b9.text).join(`
 `);
@@ -804908,9 +804963,21 @@ function buildMessages(system, messages) {
   return result;
 }
 async function sideQueryOpenAICompat(opts, client10, resolvedModel, providerTag) {
-  const { system, messages, max_tokens = 1024, signal, temperature, stop_sequences, querySource } = opts;
-  logForDebugging(`[${providerTag} sideQuery] querySource=${querySource}, model=${resolvedModel}`);
+  const {
+    system,
+    messages,
+    max_tokens = 1024,
+    signal,
+    temperature,
+    stop_sequences,
+    querySource,
+    stream: stream6
+  } = opts;
+  logForDebugging(`[${providerTag} sideQuery] querySource=${querySource}, model=${resolvedModel}, stream=${stream6 ?? false}`);
   const start = Date.now();
+  if (stream6) {
+    return streamOpenAICompat(client10, resolvedModel, opts, providerTag);
+  }
   const response3 = await client10.chat.completions.create({
     model: resolvedModel,
     messages: buildMessages(system, messages),
@@ -804938,7 +805005,11 @@ async function sideQueryOpenAICompat(opts, client10, resolvedModel, providerTag)
   const choice = response3.choices[0];
   const content = [];
   if (choice?.message?.content) {
-    content.push({ type: "text", text: choice.message.content, citations: null });
+    content.push({
+      type: "text",
+      text: choice.message.content,
+      citations: null
+    });
   }
   if (choice?.message?.tool_calls) {
     for (const tc of choice.message.tool_calls) {
@@ -804947,7 +805018,12 @@ async function sideQueryOpenAICompat(opts, client10, resolvedModel, providerTag)
       try {
         input4 = JSON.parse(funcTc.function.arguments);
       } catch {}
-      content.push({ type: "tool_use", id: tc.id, name: funcTc.function.name, input: input4 });
+      content.push({
+        type: "tool_use",
+        id: tc.id,
+        name: funcTc.function.name,
+        input: input4
+      });
     }
   }
   return {
@@ -804967,6 +805043,107 @@ async function sideQueryOpenAICompat(opts, client10, resolvedModel, providerTag)
     }
   };
 }
+async function streamOpenAICompat(client10, resolvedModel, opts, providerTag) {
+  const {
+    system,
+    messages,
+    max_tokens = 1024,
+    signal,
+    temperature,
+    stop_sequences,
+    querySource
+  } = opts;
+  logForDebugging(`[${providerTag} sideQuery:stream] querySource=${querySource}, model=${resolvedModel}`);
+  const start = Date.now();
+  const stream6 = await client10.chat.completions.create({
+    model: resolvedModel,
+    messages: buildMessages(system, messages),
+    max_tokens,
+    stream: true,
+    stream_options: { include_usage: true },
+    ...temperature !== undefined && { temperature },
+    ...stop_sequences && { stop: stop_sequences }
+  }, { signal });
+  let responseId = "";
+  let contentText = "";
+  let finishReason;
+  const toolCalls = new Map;
+  let inputTokens = 0;
+  let outputTokens = 0;
+  for await (const chunk2 of stream6) {
+    if (chunk2.id)
+      responseId = chunk2.id;
+    const choice = chunk2.choices?.[0];
+    if (choice) {
+      if (choice.delta?.content)
+        contentText += choice.delta.content;
+      if (choice.delta?.tool_calls) {
+        for (const tc of choice.delta.tool_calls) {
+          const idx = tc.index ?? 0;
+          const existing = toolCalls.get(idx) ?? {
+            id: "",
+            name: "",
+            arguments: ""
+          };
+          if (tc.id)
+            existing.id = tc.id;
+          if (tc.function?.name)
+            existing.name = tc.function.name;
+          if (tc.function?.arguments)
+            existing.arguments += tc.function.arguments;
+          toolCalls.set(idx, existing);
+        }
+      }
+      if (choice.finish_reason)
+        finishReason = choice.finish_reason;
+    }
+    if (chunk2.usage) {
+      inputTokens = chunk2.usage.prompt_tokens ?? 0;
+      outputTokens = chunk2.usage.completion_tokens ?? 0;
+    }
+  }
+  const now2 = Date.now();
+  const lastCompletion = getLastApiCompletionTimestamp();
+  logEvent("tengu_api_success", {
+    requestId: responseId,
+    querySource,
+    model: resolvedModel,
+    inputTokens,
+    outputTokens,
+    cachedInputTokens: 0,
+    uncachedInputTokens: 0,
+    durationMsIncludingRetries: now2 - start,
+    timeSinceLastApiCallMs: lastCompletion !== null ? now2 - lastCompletion : undefined
+  });
+  setLastApiCompletionTimestamp(now2);
+  const content = [];
+  if (contentText) {
+    content.push({ type: "text", text: contentText, citations: null });
+  }
+  for (const [, tc] of [...toolCalls.entries()].sort((a8, b9) => a8[0] - b9[0])) {
+    let input4 = {};
+    try {
+      input4 = JSON.parse(tc.arguments);
+    } catch {}
+    content.push({ type: "tool_use", id: tc.id, name: tc.name, input: input4 });
+  }
+  return {
+    id: responseId,
+    type: "message",
+    role: "assistant",
+    content,
+    model: resolvedModel,
+    stop_reason: STOP_REASON_MAP[finishReason ?? "stop"] ?? "end_turn",
+    stop_sequence: null,
+    usage: {
+      input_tokens: inputTokens,
+      output_tokens: outputTokens,
+      cache_creation_input_tokens: null,
+      cache_read_input_tokens: null,
+      server_tool_use: null
+    }
+  };
+}
 var STOP_REASON_MAP;
 var init_sideQueryOpenAICompat = __esm(() => {
   init_analytics();
@@ -805041,7 +805218,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText = extractFirstUserMessageText(messages);
-  const fingerprint = computeFingerprint(messageText, "4.2.22");
+  const fingerprint = computeFingerprint(messageText, "4.2.24");
   const attributionHeader = getAttributionHeader(fingerprint);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -808437,7 +808614,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c10) => c10.userInvocable !== false).map((c10) => c10.name),
     apiKeySource: getAnthropicApiKeyWithSource().source,
     betas: getSdkBetas(),
-    claude_code_version: "4.2.22",
+    claude_code_version: "4.2.24",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent) => agent.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill) => skill.name),
@@ -811981,7 +812158,7 @@ function appendToLog(path57, message2) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "4.2.22"
+    version: "4.2.24"
   };
   getLogWriter(path57).write(messageWithTimestamp);
 }
@@ -828450,7 +828627,7 @@ function getCommandFuse(commands11) {
   if (fuseCache?.commands === commands11) {
     return fuseCache.fuse;
   }
-  const commandData = commands11.filter((cmd) => !cmd.isHidden).map((cmd) => {
+  const commandData = deduplicateCommands(commands11.filter((cmd) => !cmd.isHidden)).map((cmd) => {
     const commandName = getCommandName(cmd);
     const commandNameKey = getSearchAliases([commandName]);
     const aliasKey = cmd.aliases ? getSearchAliases(cmd.aliases) : undefined;
@@ -828584,6 +828761,17 @@ function getCommandId2(cmd) {
   }
   return `${commandName}:${cmd.type}`;
 }
+function deduplicateCommands(commands11) {
+  const seenIds = new Set;
+  return commands11.filter((cmd) => {
+    const id = getCommandId2(cmd);
+    if (seenIds.has(id)) {
+      return false;
+    }
+    seenIds.add(id);
+    return true;
+  });
+}
 function findMatchedAlias(query5, aliases) {
   if (!aliases || aliases.length === 0 || query5 === "") {
     return;
@@ -828614,7 +828802,7 @@ function generateCommandSuggestions(input4, commands11) {
   }
   const query5 = input4.slice(1).toLowerCase().trim();
   if (query5 === "") {
-    const visibleCommands = commands11.filter((cmd) => !cmd.isHidden);
+    const visibleCommands = deduplicateCommands(commands11.filter((cmd) => !cmd.isHidden));
     const recentlyUsed = [];
     const commandsWithScores = visibleCommands.filter((cmd) => cmd.type === "prompt").map((cmd) => ({
       cmd,
@@ -833026,7 +833214,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "4.2.22",
+    version: "4.2.24",
     output_style: {
       name: outputStyleName
     },
@@ -851651,7 +851839,7 @@ async function submitTranscriptShare(messages, trigger, appearanceId) {
     } catch {}
     const data = {
       trigger,
-      version: "4.2.22",
+      version: "4.2.24",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -852906,7 +853094,7 @@ function getReleaseType(current2, latest) {
   return "patch";
 }
 async function checkNewAutoUpdate(callbacks) {
-  const currentVersion = "4.2.22";
+  const currentVersion = "4.2.24";
   logForDebugging(`[newAutoUpdater] checking, current: ${currentVersion}`);
   if (isNewAutoUpdaterDisabled()) {
     return { action: "skip", currentVersion, latestVersion: null };
@@ -864129,7 +864317,7 @@ function WelcomeV2() {
               dimColor: true,
               children: [
                 "v",
-                "4.2.22",
+                "4.2.24",
                 " "
               ]
             })
@@ -864195,7 +864383,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "4.2.22",
+              "4.2.24",
               " "
             ]
           })
@@ -864297,7 +864485,7 @@ function AppleTerminalWelcomeV2({ theme: theme2, welcomeMessage }) {
               dimColor: true,
               children: [
                 "v",
-                "4.2.22",
+                "4.2.24",
                 " "
               ]
             })
@@ -864363,7 +864551,7 @@ function AppleTerminalWelcomeV2({ theme: theme2, welcomeMessage }) {
             dimColor: true,
             children: [
               "v",
-              "4.2.22",
+              "4.2.24",
               " "
             ]
           })
@@ -865303,7 +865491,7 @@ function completeOnboarding() {
   saveGlobalConfig((current2) => ({
     ...current2,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "4.2.22"
+    lastOnboardingVersion: "4.2.24"
   }));
 }
 function showDialog(root9, renderer) {
@@ -880385,7 +880573,7 @@ async function startMCPServer(cwd3, debug5, verbose) {
   setCwd(cwd3);
   const server2 = new Server({
     name: "claude/tengu",
-    version: "4.2.22"
+    version: "4.2.24"
   }, {
     capabilities: {
       tools: {}
@@ -882670,7 +882858,7 @@ function createHealthRoutes(sessionManager) {
     const uptime2 = process.uptime() * 1000;
     return c10.json({
       status: "ok",
-      version: "4.2.22",
+      version: "4.2.24",
       uptime_ms: Math.round(uptime2),
       active_sessions: sessionManager.getActiveCount()
     });
@@ -882942,7 +883130,7 @@ function getMacroDefines() {
     commit = execSync3("git rev-parse --short HEAD", { encoding: "utf-8", cwd: __dirname }).trim();
   } catch {}
   return {
-    "MACRO.VERSION": JSON.stringify("4.2.22"),
+    "MACRO.VERSION": JSON.stringify("4.2.24"),
     "MACRO.BUILD_TIME": JSON.stringify(new Date().toISOString()),
     "MACRO.COMMIT": JSON.stringify(commit),
     "MACRO.FEEDBACK_CHANNEL": JSON.stringify(""),
@@ -886858,6 +887046,11 @@ var init_find = __esm(() => {
 });
 
 // src/server/routes/favorite.ts
+function validateRouteId(id) {
+  if (id.includes("/") || id.includes("\\") || id.includes("\x00") || id === ".." || id === ".") {
+    throw new Error(`Invalid favorite id: ${id}`);
+  }
+}
 function createFavoriteRoutes() {
   return new Hono2().get("/global/favorite/skills", async (c10) => {
     try {
@@ -886871,6 +887064,7 @@ function createFavoriteRoutes() {
   }).post("/global/favorite/skills/:id/load", async (c10) => {
     const id = c10.req.param("id");
     try {
+      validateRouteId(id);
       const result = await loadFavoriteItem(id);
       return c10.json({ success: true, item: result });
     } catch (error100) {
@@ -886883,6 +887077,7 @@ function createFavoriteRoutes() {
   }).post("/global/favorite/skills/:id/unload", async (c10) => {
     const id = c10.req.param("id");
     try {
+      validateRouteId(id);
       const result = await unloadFavoriteItem(id);
       return c10.json({ success: true, item: result });
     } catch (error100) {
@@ -889935,7 +890130,7 @@ __export(exports_update, {
 });
 async function update() {
   logEvent("tengu_update_check", {});
-  writeToStdout(`${t("cli.update.currentVersion", "Current version")}: ${"4.2.22"}
+  writeToStdout(`${t("cli.update.currentVersion", "Current version")}: ${"4.2.24"}
 `);
   const channel5 = getInitialSettings()?.autoUpdatesChannel ?? "latest";
   writeToStdout(`${t("cli.update.checkingUpdates", { channel: channel5 }, "Checking for updates to {channel} version...")}
@@ -890010,8 +890205,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByHomebrew", "CoStrict is managed by Homebrew.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.22", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.22", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890027,8 +890222,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByWinget", "CoStrict is managed by winget.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.22", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.22", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890044,8 +890239,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByApk", "CoStrict is managed by apk.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.22", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.22", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890110,11 +890305,11 @@ async function update() {
 `);
         await gracefulShutdown(1);
       }
-      if (result2.latestVersion === "4.2.22") {
-        writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.22" }, "CoStrict is up to date ({version})")) + `
+      if (result2.latestVersion === "4.2.24") {
+        writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.24" }, "CoStrict is up to date ({version})")) + `
 `);
       } else {
-        writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.22", to: String(result2.latestVersion) }, "Successfully updated from {from} to version {to}")) + `
+        writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.24", to: String(result2.latestVersion) }, "Successfully updated from {from} to version {to}")) + `
 `);
         regenerateCompletionCache();
       }
@@ -890174,12 +890369,12 @@ async function update() {
 `);
     await gracefulShutdown(1);
   }
-  if (latestVersion === "4.2.22") {
-    writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.22" }, "CoStrict is up to date ({version})")) + `
+  if (latestVersion === "4.2.24") {
+    writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.24" }, "CoStrict is up to date ({version})")) + `
 `);
     await gracefulShutdown(0);
   }
-  writeToStdout(`${t("cli.update.newVersionAvailable", { latest: String(latestVersion), current: "4.2.22" }, "New version available: {latest} (current: {current})")}
+  writeToStdout(`${t("cli.update.newVersionAvailable", { latest: String(latestVersion), current: "4.2.24" }, "New version available: {latest} (current: {current})")}
 `);
   writeToStdout(`${t("cli.update.installing", "Installing update...")}
 `);
@@ -890224,7 +890419,7 @@ async function update() {
   logForDebugging(`update: Installation status: ${result.status}`);
   switch (result.status) {
     case "success":
-      writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.22", to: String(latestVersion) }, "Successfully updated from {from} to version {to}")) + `
+      writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.24", to: String(latestVersion) }, "Successfully updated from {from} to version {to}")) + `
 `);
       regenerateCompletionCache();
       break;
@@ -892428,7 +892623,7 @@ ${assistantAddendum}` : assistantAddendum;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "4.2.22",
+      version: "4.2.24",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -892919,7 +893114,7 @@ Session: ${directConnectConfig.sessionId}`, "info");
           sshSession = await createSSHSession2({
             host: _pendingSSH.host,
             cwd: _pendingSSH.cwd,
-            localVersion: "4.2.22",
+            localVersion: "4.2.24",
             permissionMode: _pendingSSH.permissionMode,
             dangerouslySkipPermissions: _pendingSSH.dangerouslySkipPermissions,
             extraCliArgs: _pendingSSH.extraCliArgs,
@@ -893388,7 +893583,7 @@ Usage: csc --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("4.2.22 (CoStrict)", "-v, --version", cliDesc("cli.option.version", "Output the version number"));
+  }).version("4.2.24 (CoStrict)", "-v, --version", cliDesc("cli.option.version", "Output the version number"));
   program2.addOption(new Option("-w, --worktree [name]", cliDesc("cli.option.worktree", "Create a new git worktree for this session (optionally specify a name)")).hideHelp());
   program2.addOption(new Option("--tmux", cliDesc("cli.option.tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.")).hideHelp());
   if (canUserConfigureAdvisor()) {
@@ -894131,10 +894326,10 @@ if (process.env.CLAUDE_CODE_REMOTE === "true") {
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    const d7 = new Date("2026-08-03T04:18:00.311Z");
+    const d7 = new Date("2026-08-04T09:20:56.936Z");
     const p2 = (n3) => String(n3).padStart(2, "0");
     const buildTime = `${d7.getFullYear()}/${p2(d7.getMonth() + 1)}/${p2(d7.getDate())} ${p2(d7.getHours())}:${p2(d7.getMinutes())}:${p2(d7.getSeconds())}`;
-    console.log(`${"4.2.22"} (commit: ${"3c5da52d8"}, built: ${buildTime})`);
+    console.log(`${"4.2.24"} (commit: ${"bf82163cc"}, built: ${buildTime})`);
     return;
   }
   let stopServeParentWatchdog;
@@ -894310,5 +894505,5 @@ async function main2() {
 }
 main2();
 
-//# debugId=BDFFF13975C5A74064756E2164756E21
+//# debugId=D85CD535754BCE3164756E2164756E21
 

package/dist/services/rawDump/batchWorker.js

@@ -736,8 +736,8 @@ function getClientVersion() {
   if (cached)
     return cached;
   try {
-    if ("4.2.22") {
-      cached = "4.2.22";
+    if ("4.2.24") {
+      cached = "4.2.24";
       return cached;
     }
   } catch {}
@@ -61589,17 +61589,20 @@ var init_memoize2 = __esm(() => {
 // src/utils/windowsPaths.ts
 import { existsSync as existsSync3 } from "fs";
 import * as pathWin32 from "path/win32";
-function isWslBash(candidatePath) {
+function isNonGitBash(candidatePath) {
   const lower = candidatePath.toLowerCase();
-  return lower.endsWith("\\bash.exe") && (lower.includes("\\windows\\system32\\") || lower.includes("\\windows\\syswow64\\"));
+  if (!lower.endsWith("\\bash.exe")) {
+    return false;
+  }
+  return lower.includes("\\windows\\system32\\") || lower.includes("\\windows\\syswow64\\") || lower.includes("\\windowsapps\\") || lower.includes("\\cygwin\\") || lower.includes("\\cygwin64\\");
 }
 function findExecutableWithDeps(executable, deps) {
   try {
     const paths2 = deps.execCommand(`where.exe ${executable}`).split(/\r?\n/u).map((candidate) => candidate.trim()).filter(Boolean);
     const cwd2 = pathWin32.resolve(deps.cwdFn()).toLowerCase();
     for (const candidatePath of paths2) {
-      if (executable === "bash" && isWslBash(candidatePath)) {
-        logForDebugging(`Skipping WSL bash launcher (incompatible with Windows paths): ${candidatePath}`);
+      if (executable === "bash" && isNonGitBash(candidatePath)) {
+        logForDebugging(`Skipping non-Git bash launcher (incompatible with Windows paths): ${candidatePath}`);
         continue;
       }
       const candidateDirectory = pathWin32.dirname(pathWin32.resolve(candidatePath)).toLowerCase();
@@ -61631,10 +61634,6 @@ function findGitBashPathOrNullWithDeps(deps = DEFAULT_DEPS) {
   if (envOverride) {
     return deps.checkExists(envOverride) ? envOverride : null;
   }
-  const bashPath = findExecutableWithDeps("bash", deps);
-  if (bashPath && deps.checkExists(bashPath)) {
-    return bashPath;
-  }
   const gitPath = findExecutableWithDeps("git", deps);
   if (gitPath) {
     const candidates = [
@@ -61642,11 +61641,20 @@ function findGitBashPathOrNullWithDeps(deps = DEFAULT_DEPS) {
       pathWin32.join(gitPath, "..", "..", "usr", "bin", "bash.exe"),
       pathWin32.join(gitPath, "..", "bash.exe")
     ];
-    const derivedPath = candidates.find(deps.checkExists);
+    const derivedPath = candidates.find((candidate) => {
+      if (isNonGitBash(candidate)) {
+        return false;
+      }
+      return deps.checkExists(candidate);
+    });
     if (derivedPath) {
       return derivedPath;
     }
   }
+  const bashPath = findExecutableWithDeps("bash", deps);
+  if (bashPath && deps.checkExists(bashPath)) {
+    return bashPath;
+  }
   return findCommonGitBashPath(deps.checkExists, deps.userProfile);
 }
 var DEFAULT_DEPS, findGitBashPathOrNull, windowsPathToPosixPath, posixPathToWindowsPath;
@@ -138549,7 +138557,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "4.2.22",
+      appVersion: "4.2.24",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -138836,7 +138844,7 @@ var init_metadata = __esm(() => {
     "sed"
   ]);
   getVersionBase = memoize_default(() => {
-    const match = "4.2.22".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "4.2.24".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -138876,9 +138884,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "4.2.22",
+      version: "4.2.24",
       versionBase: getVersionBase(),
-      buildTime: "2026-08-03T04:18:02.694Z",
+      buildTime: "2026-08-04T09:20:59.781Z",
       deploymentEnvironment: env4.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -143216,5 +143224,5 @@ export {
   isParentHeartbeatValid
 };
 
-//# debugId=72170B1EA6BB7F1764756E2164756E21
+//# debugId=3B86544BA0122FB764756E2164756E21
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@costrict/csc",
-  "version": "4.2.22",
+  "version": "4.2.24",
   "description": "costrict",
   "type": "module",
   "author": "costrict",