@costrict/csc 4.2.23 → 4.2.24

package/dist/cli.js

@@ -66713,8 +66713,8 @@ function getClientVersion() {
   if (cached)
     return cached;
   try {
-    if ("4.2.23") {
-      cached = "4.2.23";
+    if ("4.2.24") {
+      cached = "4.2.24";
       return cached;
     }
   } catch {}
@@ -220503,7 +220503,7 @@ async function fetchCoStrictModels(baseUrl, accessToken) {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
-        "User-Agent": `csc/${"4.2.23"}`
+        "User-Agent": `csc/${"4.2.24"}`
       },
       signal: controller.signal
     });
@@ -222540,7 +222540,7 @@ var init_auth7 = __esm(() => {
 
 // src/utils/userAgent.ts
 function getClaudeCodeUserAgent() {
-  return `costrict/${"4.2.23"}`;
+  return `costrict/${"4.2.24"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -222562,7 +222562,7 @@ function getUserAgent() {
   const clientApp = process.env.CLAUDE_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `csc/${"4.2.23"}`;
+  return `csc/${"4.2.24"}`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -222576,7 +222576,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `csc/${"4.2.23"}${suffix}`;
+  return `csc/${"4.2.24"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `Claude-User (${getClaudeCodeUserAgent()}; +https://support.anthropic.com/)`;
@@ -222696,7 +222696,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "4.2.23",
+      appVersion: "4.2.24",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -233744,7 +233744,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "4.2.23".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "4.2.24".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -233784,9 +233784,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "4.2.23",
+      version: "4.2.24",
       versionBase: getVersionBase(),
-      buildTime: "2026-08-04T07:11:51.439Z",
+      buildTime: "2026-08-04T09:20:56.936Z",
       deploymentEnvironment: env4.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -234457,7 +234457,7 @@ function initialize1PEventLogging() {
   const platform3 = getPlatform();
   const attributes = {
     [import_semantic_conventions2.ATTR_SERVICE_NAME]: "claude-code",
-    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "4.2.23"
+    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "4.2.24"
   };
   if (platform3 === "wsl") {
     const wslVersion = getWslVersion();
@@ -234484,7 +234484,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "4.2.23");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "4.2.24");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -434502,7 +434502,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "4.2.23";
+    attributes["app.version"] = "4.2.24";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -468022,7 +468022,7 @@ function initLangfuse() {
       flushInterval: parseInt(process.env.LANGFUSE_FLUSH_INTERVAL ?? "10", 10),
       mask: maskFn,
       environment: process.env.LANGFUSE_TRACING_ENVIRONMENT ?? "development",
-      release: "4.2.23",
+      release: "4.2.24",
       exportMode: process.env.LANGFUSE_EXPORT_MODE ?? "batched",
       timeout: parseInt(process.env.LANGFUSE_TIMEOUT ?? "5", 10)
     });
@@ -499922,7 +499922,7 @@ function initSentry() {
   }
   init3({
     dsn,
-    release: typeof MACRO !== "undefined" ? "4.2.23" : undefined,
+    release: typeof MACRO !== "undefined" ? "4.2.24" : undefined,
     environment: typeof BUILD_ENV !== "undefined" ? BUILD_ENV : "production",
     maxBreadcrumbs: 20,
     sampleRate: 1,
@@ -527819,7 +527819,7 @@ async function initializeBetaTracing(resource) {
   });
   logs.setGlobalLoggerProvider(loggerProvider);
   setLoggerProvider(loggerProvider);
-  const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.23");
+  const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.24");
   setEventLogger(eventLogger);
   process.on("beforeExit", async () => {
     await loggerProvider?.forceFlush();
@@ -527859,7 +527859,7 @@ async function initializeTelemetry() {
   const platform5 = getPlatform();
   const baseAttributes = {
     [import_semantic_conventions29.ATTR_SERVICE_NAME]: "claude-code",
-    [import_semantic_conventions29.ATTR_SERVICE_VERSION]: "4.2.23"
+    [import_semantic_conventions29.ATTR_SERVICE_VERSION]: "4.2.24"
   };
   if (platform5 === "wsl") {
     const wslVersion = getWslVersion();
@@ -527904,7 +527904,7 @@ async function initializeTelemetry() {
       } catch {}
     };
     registerCleanup(shutdownTelemetry2);
-    return meterProvider2.getMeter("com.anthropic.claude_code", "4.2.23");
+    return meterProvider2.getMeter("com.anthropic.claude_code", "4.2.24");
   }
   const meterProvider = new import_sdk_metrics2.MeterProvider({
     resource,
@@ -527924,7 +527924,7 @@ async function initializeTelemetry() {
       });
       logs.setGlobalLoggerProvider(loggerProvider);
       setLoggerProvider(loggerProvider);
-      const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.23");
+      const eventLogger = logs.getLogger("com.anthropic.claude_code.events", "4.2.24");
       setEventLogger(eventLogger);
       logForDebugging("[3P telemetry] Event logger set successfully");
       process.on("beforeExit", async () => {
@@ -527986,7 +527986,7 @@ Current timeout: ${timeoutMs}ms
     }
   };
   registerCleanup(shutdownTelemetry);
-  return meterProvider.getMeter("com.anthropic.claude_code", "4.2.23");
+  return meterProvider.getMeter("com.anthropic.claude_code", "4.2.24");
 }
 async function flushTelemetry() {
   const meterProvider = getMeterProvider();
@@ -529045,7 +529045,7 @@ async function installGlobalPackage(specificVersion) {
     logError3(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "4.2.23"
+      currentVersion: "4.2.24"
     });
     return { status: "in_progress" };
   }
@@ -529054,7 +529054,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env4.isRunningWithBun() && env4.isNpmFromWindowsPath()) {
       logError3(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "4.2.23"
+        currentVersion: "4.2.24"
       });
       return {
         status: "install_failed",
@@ -529600,7 +529600,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version9 = typeof MACRO !== "undefined" ? "4.2.23" : "unknown";
+  const version9 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -567787,7 +567787,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client10 = new Client3({
       name: "claude-code",
       title: "CoStrict",
-      version: "4.2.23",
+      version: "4.2.24",
       description: "CoStrict agentic coding tool",
       websiteUrl: PRODUCT_URL
     }, {
@@ -568158,7 +568158,7 @@ var init_client18 = __esm(() => {
       const client10 = new Client3({
         name: "claude-code",
         title: "CoStrict",
-        version: "4.2.23",
+        version: "4.2.24",
         description: "CoStrict agentic coding tool",
         websiteUrl: PRODUCT_URL
       }, {
@@ -569548,7 +569548,7 @@ function getInstallationEnv() {
   return;
 }
 function getClaudeCodeVersion() {
-  return "4.2.23";
+  return "4.2.24";
 }
 async function getInstalledVSCodeExtensionVersion(command4) {
   const { stdout } = await execFileNoThrow2(command4, ["--list-extensions", "--show-versions"], {
@@ -570912,8 +570912,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version10, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version10} to ${maxVersion}`);
-      if (gte2("4.2.23", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"4.2.23"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte2("4.2.24", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"4.2.24"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime2,
           max_version: maxVersion,
@@ -570924,7 +570924,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version10 = maxVersion;
     }
   }
-  if (!forceReinstall && version10 === "4.2.23" && await versionIsAvailable(version10) && await isPossibleClaudeBinary(executablePath)) {
+  if (!forceReinstall && version10 === "4.2.24" && await versionIsAvailable(version10) && await isPossibleClaudeBinary(executablePath)) {
     logForDebugging(`Found ${version10} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime2,
@@ -708992,7 +708992,7 @@ function Feedback({
       platform: env4.platform,
       gitRepo: envInfo.isGit,
       terminal: env4.terminal,
-      version: "4.2.23",
+      version: "4.2.24",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -709175,7 +709175,7 @@ function Feedback({
                       ", ",
                       env4.terminal,
                       ", v",
-                      "4.2.23"
+                      "4.2.24"
                     ]
                   })
                 ]
@@ -709272,7 +709272,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env4.platform}
 ` + `- Terminal: ${env4.terminal}
-` + `- Version: ${"4.2.23"}
+` + `- Version: ${"4.2.24"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -711511,7 +711511,7 @@ function buildPrimarySection() {
     children: t("settings.status.renameHint")
   });
   return [
-    { label: t("settings.status.version"), value: "4.2.23" },
+    { label: t("settings.status.version"), value: "4.2.24" },
     { label: t("settings.status.sessionName"), value: nameValue },
     { label: t("settings.status.sessionId"), value: sessionId },
     { label: t("settings.status.cwd"), value: getCwd() },
@@ -714369,7 +714369,7 @@ function Config({
         }
       })
     }) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_runtime191.jsx(ChannelDowngradeDialog, {
-      currentVersion: "4.2.23",
+      currentVersion: "4.2.24",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -714381,7 +714381,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "4.2.23";
+          newSettings.minimumVersion = "4.2.24";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev) => ({
@@ -719850,7 +719850,7 @@ function HelpV2({ onClose, commands: commands11 }) {
       color: "professionalBlue",
       children: [
         /* @__PURE__ */ jsx_runtime218.jsx(Tabs, {
-          title: process.env.USER_TYPE === "sf" ? "/help" : `CoStrict v${"4.2.23"}`,
+          title: process.env.USER_TYPE === "sf" ? "/help" : `CoStrict v${"4.2.24"}`,
           color: "professionalBlue",
           defaultTab: "general",
           children: tabs
@@ -742851,7 +742851,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.23") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.24") {
   if (process.env.USER_TYPE === "sf") {
     const changelog = "";
     if (changelog) {
@@ -742878,7 +742878,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "4.2.23")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "4.2.23") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "4.2.24") {
   if (process.env.USER_TYPE === "sf") {
     const changelog = "";
     if (changelog) {
@@ -745391,7 +745391,7 @@ function isNotLoggedIn() {
   return true;
 }
 function getLogoDisplayData() {
-  const version10 = process.env.DEMO_VERSION ?? "4.2.23";
+  const version10 = process.env.DEMO_VERSION ?? "4.2.24";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/claude" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -745969,7 +745969,7 @@ var init_MatrixMessageLine = __esm(() => {
 // src/components/matrix-tactical/MatrixWelcome.tsx
 import { basename as basename47 } from "path";
 function MatrixWelcome({
-  version: version10 = "4.2.23",
+  version: version10 = "4.2.24",
   projectName,
   cwd: cwd2,
   modelDisplayName,
@@ -746604,13 +746604,13 @@ function LogoV2() {
   const { hasReleaseNotes } = checkForReleaseNotesSync(config13.lastReleaseNotesSeen);
   import_react167.useEffect(() => {
     const currentConfig = getGlobalConfig();
-    if (currentConfig.lastReleaseNotesSeen === "4.2.23") {
+    if (currentConfig.lastReleaseNotesSeen === "4.2.24") {
       return;
     }
     saveGlobalConfig((current2) => {
-      if (current2.lastReleaseNotesSeen === "4.2.23")
+      if (current2.lastReleaseNotesSeen === "4.2.24")
         return current2;
-      return { ...current2, lastReleaseNotesSeen: "4.2.23" };
+      return { ...current2, lastReleaseNotesSeen: "4.2.24" };
     });
     if (showOnboarding) {
       incrementProjectOnboardingSeenCount();
@@ -769140,7 +769140,7 @@ async function captureMemoryDiagnostics(trigger, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "4.2.23"
+    ccVersion: "4.2.24"
   };
 }
 async function performHeapDump(trigger = "manual", dumpNumber = 0) {
@@ -769256,7 +769256,7 @@ var init_mock_limits = __esm(() => {
 var call55 = async () => {
   return {
     type: "text",
-    value: `${"4.2.23"} (built ${"2026-08-04T07:11:51.439Z"})`
+    value: `${"4.2.24"} (built ${"2026-08-04T09:20:56.936Z"})`
   };
 }, version10, version_default;
 var init_version2 = __esm(() => {
@@ -776503,6 +776503,34 @@ function agentsDir() {
 function commandsDir() {
   return path54.join(getClaudeConfigHomeDir(), "commands");
 }
+function assertSafeSlug(slug) {
+  if (!slug || typeof slug !== "string") {
+    throw new Error("Invalid favorite slug: empty or non-string");
+  }
+  if (slug.includes("/") || slug.includes("\\") || slug.includes("\x00") || slug === "." || slug === ".." || slug.startsWith(".") || slug.startsWith(" ") || slug.endsWith(" ") || !SAFE_SLUG_RE.test(slug)) {
+    throw new Error(`Invalid favorite slug: ${slug}`);
+  }
+}
+function resolveFavoritePath(baseDir, slug) {
+  assertSafeSlug(slug);
+  const resolvedBase = path54.resolve(baseDir);
+  const resolvedTarget = path54.resolve(path54.join(resolvedBase, slug));
+  const rel = path54.relative(resolvedBase, resolvedTarget);
+  if (rel === "" || rel.startsWith("..") || path54.isAbsolute(rel)) {
+    throw new Error(`Path traversal detected for favorite slug: ${slug}`);
+  }
+  return resolvedTarget;
+}
+function resolveFavoriteFilePath(baseDir, slug, suffix) {
+  assertSafeSlug(slug);
+  const resolvedBase = path54.resolve(baseDir);
+  const resolvedTarget = path54.resolve(path54.join(resolvedBase, `${slug}${suffix}`));
+  const rel = path54.relative(resolvedBase, resolvedTarget);
+  if (rel.startsWith("..") || path54.isAbsolute(rel)) {
+    throw new Error(`Path traversal detected for favorite slug: ${slug}`);
+  }
+  return resolvedTarget;
+}
 async function readState() {
   try {
     const text2 = await readFile76(favoriteStatePath(), "utf-8");
@@ -776597,11 +776625,18 @@ function parseFavoriteListItem(data) {
   const localType = STORE_TYPE_MAP[storeType];
   if (!localType)
     return;
+  const slug = String(data.slug ?? data.id);
+  try {
+    assertSafeSlug(slug);
+  } catch {
+    logForDebugging(`[favorite] skipping candidate with unsafe slug: ${slug}`);
+    return;
+  }
   const favorited = typeof data.favorited === "boolean" ? data.favorited : data.favorited === "true" || data.favorited === 1;
   logForDebugging(`[favorite] name=${data.name} score=${data.score} experienceScore=${data.experienceScore} favoriteCount=${data.favoriteCount} createdBy=${data.createdBy} fields=[${Object.keys(data).join(",")}]`);
   return {
     id: String(data.id),
-    slug: String(data.slug ?? data.id),
+    slug,
     name: String(data.name ?? data.slug ?? data.id),
     description: String(data.description ?? ""),
     itemType: localType,
@@ -776631,9 +776666,11 @@ async function getRemoteItem(id) {
   if (!localType) {
     throw new Error(`Unsupported item type: ${storeType} (${String(data.slug ?? id)})`);
   }
+  const slug = String(data.slug);
+  assertSafeSlug(slug);
   return {
     id: String(data.id),
-    slug: String(data.slug),
+    slug,
     name: String(data.name),
     description: String(data.description ?? ""),
     itemType: localType,
@@ -776701,7 +776738,7 @@ function deriveStatus(state3, activeSkillSlugs, activeAgentNames, activeCommandN
 }
 async function persistInstalledItem(item) {
   const typeRoot = favoriteTypeRoot(item.itemType);
-  const dir = path54.join(typeRoot, item.slug);
+  const dir = resolveFavoritePath(typeRoot, item.slug);
   const itemJson = JSON.stringify({
     id: item.id,
     slug: item.slug,
@@ -776879,7 +776916,7 @@ async function copyDir2(src, dest) {
 async function addItemToConfig(item, localPath) {
   switch (item.itemType) {
     case "skill": {
-      const destDir = path54.join(skillsDir(), item.slug);
+      const destDir = resolveFavoritePath(skillsDir(), item.slug);
       const fingerprint = await readBundleFingerprint(localPath);
       await replaceDirectoryAtomically(destDir, (stagingDir) => copyDir2(localPath, stagingDir), fingerprint === null ? {} : { fingerprint });
       clearCommandsCache();
@@ -776902,7 +776939,7 @@ async function addItemToConfig(item, localPath) {
       }));
       const agentDestDir = agentsDir();
       await mkdir62(agentDestDir, { recursive: true });
-      await copyFile10(mdPath, path54.join(agentDestDir, `${item.slug}.md`));
+      await copyFile10(mdPath, resolveFavoriteFilePath(agentDestDir, item.slug, ".md"));
       clearAgentDefinitionsCache();
       break;
     }
@@ -776922,7 +776959,7 @@ async function addItemToConfig(item, localPath) {
       }));
       const commandDestDir = commandsDir();
       await mkdir62(commandDestDir, { recursive: true });
-      await copyFile10(mdPath, path54.join(commandDestDir, `${item.slug}.md`));
+      await copyFile10(mdPath, resolveFavoriteFilePath(commandDestDir, item.slug, ".md"));
       clearCommandsCache();
       skillChangeDetector.notify();
       break;
@@ -776951,7 +776988,7 @@ Supported formats: opencode native, VS Code / Claude Desktop style, or simplifie
 async function removeItemFromConfig(itemType, slug, _localPath) {
   switch (itemType) {
     case "skill": {
-      const destDir = path54.join(skillsDir(), slug);
+      const destDir = resolveFavoritePath(skillsDir(), slug);
       await withTargetDirLock(destDir, () => rm16(destDir, { recursive: true, force: true }));
       clearCommandsCache();
       skillChangeDetector.notify();
@@ -776963,7 +777000,9 @@ async function removeItemFromConfig(itemType, slug, _localPath) {
         delete agents2[slug];
         return { ...cfg, agents: agents2 };
       });
-      await rm16(path54.join(agentsDir(), `${slug}.md`), { force: true });
+      await rm16(resolveFavoriteFilePath(agentsDir(), slug, ".md"), {
+        force: true
+      });
       clearAgentDefinitionsCache();
       break;
     }
@@ -776973,7 +777012,9 @@ async function removeItemFromConfig(itemType, slug, _localPath) {
         delete commands11[slug];
         return { ...cfg, commands: commands11 };
       });
-      await rm16(path54.join(commandsDir(), `${slug}.md`), { force: true });
+      await rm16(resolveFavoriteFilePath(commandsDir(), slug, ".md"), {
+        force: true
+      });
       clearCommandsCache();
       skillChangeDetector.notify();
       break;
@@ -777235,7 +777276,8 @@ function hasUpdate(item, localVersion) {
 async function updateFavoriteItem(slugOrId) {
   const installed = await ensureInstalled(slugOrId);
   const remote = await getRemoteItem(installed.id);
-  const backupDir = path54.join(path54.dirname(installed.localPath), ".backup", installed.slug, new Date().toISOString().replace(/[:.]/gu, "-"));
+  const backupBase = path54.join(path54.dirname(installed.localPath), ".backup");
+  const backupDir = path54.join(resolveFavoritePath(backupBase, installed.slug), new Date().toISOString().replace(/[:.]/gu, "-"));
   await copyDir2(installed.localPath, backupDir);
   await persistInstalledItem(remote);
   if (installed.lifecycle === "active") {
@@ -777319,7 +777361,7 @@ async function batchUpdateFavoriteItems(slugs) {
   }
   return { updated, errors: errors14 };
 }
-var FAVORITE_PAGE_SIZE = 20, FAVORITE_MAX_PAGES = 20, FAVORITE_LIST_CACHE_TTL_MS = 30000, _listFavoriteItemsCache = null, STORE_TYPE_MAP, LOCAL_TO_STORE_TYPE, FETCH_TIMEOUT_MS7 = 15000, RemoteListHttpError, _untypedListUnsupported = false, SUPPORTED_MCP_TYPES;
+var FAVORITE_PAGE_SIZE = 20, FAVORITE_MAX_PAGES = 20, FAVORITE_LIST_CACHE_TTL_MS = 30000, _listFavoriteItemsCache = null, STORE_TYPE_MAP, LOCAL_TO_STORE_TYPE, SAFE_SLUG_RE, FETCH_TIMEOUT_MS7 = 15000, RemoteListHttpError, _untypedListUnsupported = false, SUPPORTED_MCP_TYPES;
 var init_favorite = __esm(() => {
   init_fetch2();
   init_auth();
@@ -777345,6 +777387,7 @@ var init_favorite = __esm(() => {
     command: "command",
     mcp: "mcp"
   };
+  SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+$/u;
   RemoteListHttpError = class RemoteListHttpError extends Error {
     status;
     constructor(status2, message2) {
@@ -787180,7 +787223,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version11 = typeof MACRO !== "undefined" ? "4.2.23" : "unknown";
+  const version11 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h8) => h8.sessionCount > 0).map((h8) => h8.name);
   const facets_summary = {
     total: facets.size,
@@ -791630,7 +791673,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION11 = typeof MACRO !== "undefined" ? "4.2.23" : "unknown";
+  VERSION11 = typeof MACRO !== "undefined" ? "4.2.24" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN2 = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -792971,7 +793014,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes24(16).toString("hex");
-    return join204(getCostrictTempDir(), "bundled-skills", "4.2.23", nonce);
+    return join204(getCostrictTempDir(), "bundled-skills", "4.2.24", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -799241,7 +799284,7 @@ function computeFingerprint(messageText, version11) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "4.2.23");
+  return computeFingerprint(firstMessageText, "4.2.24");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -799651,7 +799694,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-08-04T07:11:51.439Z").getTime();
+  const buildTime = new Date("2026-08-04T09:20:56.936Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -805175,7 +805218,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText = extractFirstUserMessageText(messages);
-  const fingerprint = computeFingerprint(messageText, "4.2.23");
+  const fingerprint = computeFingerprint(messageText, "4.2.24");
   const attributionHeader = getAttributionHeader(fingerprint);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -808571,7 +808614,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c10) => c10.userInvocable !== false).map((c10) => c10.name),
     apiKeySource: getAnthropicApiKeyWithSource().source,
     betas: getSdkBetas(),
-    claude_code_version: "4.2.23",
+    claude_code_version: "4.2.24",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent) => agent.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill) => skill.name),
@@ -812115,7 +812158,7 @@ function appendToLog(path57, message2) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "4.2.23"
+    version: "4.2.24"
   };
   getLogWriter(path57).write(messageWithTimestamp);
 }
@@ -833171,7 +833214,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "4.2.23",
+    version: "4.2.24",
     output_style: {
       name: outputStyleName
     },
@@ -851796,7 +851839,7 @@ async function submitTranscriptShare(messages, trigger, appearanceId) {
     } catch {}
     const data = {
       trigger,
-      version: "4.2.23",
+      version: "4.2.24",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -853051,7 +853094,7 @@ function getReleaseType(current2, latest) {
   return "patch";
 }
 async function checkNewAutoUpdate(callbacks) {
-  const currentVersion = "4.2.23";
+  const currentVersion = "4.2.24";
   logForDebugging(`[newAutoUpdater] checking, current: ${currentVersion}`);
   if (isNewAutoUpdaterDisabled()) {
     return { action: "skip", currentVersion, latestVersion: null };
@@ -864274,7 +864317,7 @@ function WelcomeV2() {
               dimColor: true,
               children: [
                 "v",
-                "4.2.23",
+                "4.2.24",
                 " "
               ]
             })
@@ -864340,7 +864383,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "4.2.23",
+              "4.2.24",
               " "
             ]
           })
@@ -864442,7 +864485,7 @@ function AppleTerminalWelcomeV2({ theme: theme2, welcomeMessage }) {
               dimColor: true,
               children: [
                 "v",
-                "4.2.23",
+                "4.2.24",
                 " "
               ]
             })
@@ -864508,7 +864551,7 @@ function AppleTerminalWelcomeV2({ theme: theme2, welcomeMessage }) {
             dimColor: true,
             children: [
               "v",
-              "4.2.23",
+              "4.2.24",
               " "
             ]
           })
@@ -865448,7 +865491,7 @@ function completeOnboarding() {
   saveGlobalConfig((current2) => ({
     ...current2,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "4.2.23"
+    lastOnboardingVersion: "4.2.24"
   }));
 }
 function showDialog(root9, renderer) {
@@ -880530,7 +880573,7 @@ async function startMCPServer(cwd3, debug5, verbose) {
   setCwd(cwd3);
   const server2 = new Server({
     name: "claude/tengu",
-    version: "4.2.23"
+    version: "4.2.24"
   }, {
     capabilities: {
       tools: {}
@@ -882815,7 +882858,7 @@ function createHealthRoutes(sessionManager) {
     const uptime2 = process.uptime() * 1000;
     return c10.json({
       status: "ok",
-      version: "4.2.23",
+      version: "4.2.24",
       uptime_ms: Math.round(uptime2),
       active_sessions: sessionManager.getActiveCount()
     });
@@ -883087,7 +883130,7 @@ function getMacroDefines() {
     commit = execSync3("git rev-parse --short HEAD", { encoding: "utf-8", cwd: __dirname }).trim();
   } catch {}
   return {
-    "MACRO.VERSION": JSON.stringify("4.2.23"),
+    "MACRO.VERSION": JSON.stringify("4.2.24"),
     "MACRO.BUILD_TIME": JSON.stringify(new Date().toISOString()),
     "MACRO.COMMIT": JSON.stringify(commit),
     "MACRO.FEEDBACK_CHANNEL": JSON.stringify(""),
@@ -887003,6 +887046,11 @@ var init_find = __esm(() => {
 });
 
 // src/server/routes/favorite.ts
+function validateRouteId(id) {
+  if (id.includes("/") || id.includes("\\") || id.includes("\x00") || id === ".." || id === ".") {
+    throw new Error(`Invalid favorite id: ${id}`);
+  }
+}
 function createFavoriteRoutes() {
   return new Hono2().get("/global/favorite/skills", async (c10) => {
     try {
@@ -887016,6 +887064,7 @@ function createFavoriteRoutes() {
   }).post("/global/favorite/skills/:id/load", async (c10) => {
     const id = c10.req.param("id");
     try {
+      validateRouteId(id);
       const result = await loadFavoriteItem(id);
       return c10.json({ success: true, item: result });
     } catch (error100) {
@@ -887028,6 +887077,7 @@ function createFavoriteRoutes() {
   }).post("/global/favorite/skills/:id/unload", async (c10) => {
     const id = c10.req.param("id");
     try {
+      validateRouteId(id);
       const result = await unloadFavoriteItem(id);
       return c10.json({ success: true, item: result });
     } catch (error100) {
@@ -890080,7 +890130,7 @@ __export(exports_update, {
 });
 async function update() {
   logEvent("tengu_update_check", {});
-  writeToStdout(`${t("cli.update.currentVersion", "Current version")}: ${"4.2.23"}
+  writeToStdout(`${t("cli.update.currentVersion", "Current version")}: ${"4.2.24"}
 `);
   const channel5 = getInitialSettings()?.autoUpdatesChannel ?? "latest";
   writeToStdout(`${t("cli.update.checkingUpdates", { channel: channel5 }, "Checking for updates to {channel} version...")}
@@ -890155,8 +890205,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByHomebrew", "CoStrict is managed by Homebrew.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.23", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.23", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890172,8 +890222,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByWinget", "CoStrict is managed by winget.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.23", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.23", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890189,8 +890239,8 @@ async function update() {
       writeToStdout(`${t("cli.update.managedByApk", "CoStrict is managed by apk.")}
 `);
       const latest = await getLatestVersion(channel5);
-      if (latest && !gte2("4.2.23", latest)) {
-        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.23", latest }, "Update available: {current} \u2192 {latest}")}
+      if (latest && !gte2("4.2.24", latest)) {
+        writeToStdout(`${t("cli.update.updateAvailable", { current: "4.2.24", latest }, "Update available: {current} \u2192 {latest}")}
 `);
         writeToStdout(`
 `);
@@ -890255,11 +890305,11 @@ async function update() {
 `);
         await gracefulShutdown(1);
       }
-      if (result2.latestVersion === "4.2.23") {
-        writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.23" }, "CoStrict is up to date ({version})")) + `
+      if (result2.latestVersion === "4.2.24") {
+        writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.24" }, "CoStrict is up to date ({version})")) + `
 `);
       } else {
-        writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.23", to: String(result2.latestVersion) }, "Successfully updated from {from} to version {to}")) + `
+        writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.24", to: String(result2.latestVersion) }, "Successfully updated from {from} to version {to}")) + `
 `);
         regenerateCompletionCache();
       }
@@ -890319,12 +890369,12 @@ async function update() {
 `);
     await gracefulShutdown(1);
   }
-  if (latestVersion === "4.2.23") {
-    writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.23" }, "CoStrict is up to date ({version})")) + `
+  if (latestVersion === "4.2.24") {
+    writeToStdout(source_default.green(t("cli.update.upToDateVersion", { version: "4.2.24" }, "CoStrict is up to date ({version})")) + `
 `);
     await gracefulShutdown(0);
   }
-  writeToStdout(`${t("cli.update.newVersionAvailable", { latest: String(latestVersion), current: "4.2.23" }, "New version available: {latest} (current: {current})")}
+  writeToStdout(`${t("cli.update.newVersionAvailable", { latest: String(latestVersion), current: "4.2.24" }, "New version available: {latest} (current: {current})")}
 `);
   writeToStdout(`${t("cli.update.installing", "Installing update...")}
 `);
@@ -890369,7 +890419,7 @@ async function update() {
   logForDebugging(`update: Installation status: ${result.status}`);
   switch (result.status) {
     case "success":
-      writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.23", to: String(latestVersion) }, "Successfully updated from {from} to version {to}")) + `
+      writeToStdout(source_default.green(t("cli.update.successfullyUpdated", { from: "4.2.24", to: String(latestVersion) }, "Successfully updated from {from} to version {to}")) + `
 `);
       regenerateCompletionCache();
       break;
@@ -892573,7 +892623,7 @@ ${assistantAddendum}` : assistantAddendum;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "4.2.23",
+      version: "4.2.24",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -893064,7 +893114,7 @@ Session: ${directConnectConfig.sessionId}`, "info");
           sshSession = await createSSHSession2({
             host: _pendingSSH.host,
             cwd: _pendingSSH.cwd,
-            localVersion: "4.2.23",
+            localVersion: "4.2.24",
             permissionMode: _pendingSSH.permissionMode,
             dangerouslySkipPermissions: _pendingSSH.dangerouslySkipPermissions,
             extraCliArgs: _pendingSSH.extraCliArgs,
@@ -893533,7 +893583,7 @@ Usage: csc --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("4.2.23 (CoStrict)", "-v, --version", cliDesc("cli.option.version", "Output the version number"));
+  }).version("4.2.24 (CoStrict)", "-v, --version", cliDesc("cli.option.version", "Output the version number"));
   program2.addOption(new Option("-w, --worktree [name]", cliDesc("cli.option.worktree", "Create a new git worktree for this session (optionally specify a name)")).hideHelp());
   program2.addOption(new Option("--tmux", cliDesc("cli.option.tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.")).hideHelp());
   if (canUserConfigureAdvisor()) {
@@ -894276,10 +894326,10 @@ if (process.env.CLAUDE_CODE_REMOTE === "true") {
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    const d7 = new Date("2026-08-04T07:11:51.439Z");
+    const d7 = new Date("2026-08-04T09:20:56.936Z");
     const p2 = (n3) => String(n3).padStart(2, "0");
     const buildTime = `${d7.getFullYear()}/${p2(d7.getMonth() + 1)}/${p2(d7.getDate())} ${p2(d7.getHours())}:${p2(d7.getMinutes())}:${p2(d7.getSeconds())}`;
-    console.log(`${"4.2.23"} (commit: ${"c5c7891a2"}, built: ${buildTime})`);
+    console.log(`${"4.2.24"} (commit: ${"bf82163cc"}, built: ${buildTime})`);
     return;
   }
   let stopServeParentWatchdog;
@@ -894455,5 +894505,5 @@ async function main2() {
 }
 main2();
 
-//# debugId=572B24B78021B29264756E2164756E21
+//# debugId=D85CD535754BCE3164756E2164756E21
 

package/dist/services/rawDump/batchWorker.js

@@ -736,8 +736,8 @@ function getClientVersion() {
   if (cached)
     return cached;
   try {
-    if ("4.2.23") {
-      cached = "4.2.23";
+    if ("4.2.24") {
+      cached = "4.2.24";
       return cached;
     }
   } catch {}
@@ -138557,7 +138557,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "4.2.23",
+      appVersion: "4.2.24",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -138844,7 +138844,7 @@ var init_metadata = __esm(() => {
     "sed"
   ]);
   getVersionBase = memoize_default(() => {
-    const match = "4.2.23".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "4.2.24".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -138884,9 +138884,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "4.2.23",
+      version: "4.2.24",
       versionBase: getVersionBase(),
-      buildTime: "2026-08-04T07:11:53.958Z",
+      buildTime: "2026-08-04T09:20:59.781Z",
       deploymentEnvironment: env4.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -143224,5 +143224,5 @@ export {
   isParentHeartbeatValid
 };
 
-//# debugId=22A05C2AEDAD152664756E2164756E21
+//# debugId=3B86544BA0122FB764756E2164756E21
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@costrict/csc",
-  "version": "4.2.23",
+  "version": "4.2.24",
   "description": "costrict",
   "type": "module",
   "author": "costrict",