@ctliz/agent-intercom-claude 0.13.0-connect.1 → 0.13.0-connect.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.13.0-connect.3 - 2026-08-23
+
+- Add complete OpenAI MCP annotations for all nine Intercom tools and verify their exact semantics in tests.
+- Reference every MCP tool by name so tool coverage is complete.
+- Explicitly disable shell execution for production and release-verification child processes.
+
+## 0.13.0-connect.2 - 2026-08-18
+
+- Document standard stdio MCP setup for Grok Build and AGY, including host-neutral identity variables, scope requirements, source-checkout configuration, manual `intercom_pending` polling, and the absence of wake-on-message support.
+
 ## 0.12.0-connect.3 - 2026-08-14
 
 - Fix package bundling by adding `monitors/**/*` (`monitors/monitors.json`) to `package.json` `files`, ensuring Claude Code plugin monitor configurations resolve properly at runtime when installed from the packaged npm artifact.

package/README.md

@@ -149,6 +149,44 @@ claude mcp add claude-intercom -- claude-intercom-mcp
 
 With `--transport mcp`, `cci` does this automatically for each normal headless worker. Native headless workers are still woken and replied through the worker daemon's broker connection, but omit the packaged MCP server from the Claude turn. `ccim` intentionally uses Claude's `--safe-mode`, which disables MCP servers along with plugins, hooks, and skills.
 
+### Other stdio MCP hosts
+
+The `claude-intercom-mcp` executable is a standard stdio MCP server, so Grok Build, AGY, and other compatible local hosts can use it without installing the Claude Code plugin. An npm/global installation provides that executable; for a source checkout, configure `node` with the absolute path to `dist/claude-server.mjs`. Node 20+ is required.
+
+Use `AGENT_INTERCOM_SESSION_ID` and `AGENT_INTERCOM_SESSION_NAME` for a host-neutral identity; `CLAUDE_INTERCOM_SESSION_ID` and `CLAUDE_INTERCOM_NAME` remain higher-priority compatibility aliases. Do not share a fixed session ID between concurrent host sessions.
+
+A plain MCP host is connected only while its MCP process is alive. Incoming Intercom messages are durable and appear through `intercom_pending`, but this server cannot itself inject a new prompt into Grok or AGY. Use `intercom_send` plus `intercom_pending` for manual-polling workflows; a host-specific relay is required for wake-on-message.
+
+For Grok Build, register the server and use a unique static ID for an individual long-lived probe or worker:
+
+```bash
+grok mcp add agent-intercom \
+  -e AGENT_INTERCOM_SESSION_ID=grok-probe-01 \
+  -e AGENT_INTERCOM_SESSION_NAME=grok-probe \
+  -e CLAUDE_INTERCOM_MODEL=grok-build \
+  -- claude-intercom-mcp
+```
+
+For AGY, add the equivalent entry to `~/.gemini/config/mcp_config.json` (replace the source-checkout paths when using an installed `claude-intercom-mcp` executable):
+
+```json
+{
+  "mcpServers": {
+    "agent-intercom": {
+      "command": "/absolute/path/to/node",
+      "args": ["/absolute/path/to/agent-intercom-claude/dist/claude-server.mjs"],
+      "env": {
+        "AGENT_INTERCOM_SESSION_ID": "agy-probe-01",
+        "AGENT_INTERCOM_SESSION_NAME": "agy-probe",
+        "CLAUDE_INTERCOM_MODEL": "agy"
+      }
+    }
+  }
+}
+```
+
+Both hosts must use the same `AGENT_INTERCOM_SCOPE_ID` as their intended peers, or leave it unset for the default local scope. Call `intercom_whoami` once after startup, then use `intercom_list`, `intercom_send`, and `intercom_pending` to verify delivery.
+
 Optional identity variables can be attached at registration time:
 
 ```bash
@@ -413,6 +451,8 @@ environment when no config file is given (`CLAUDE_INTERCOM_WORKER_ID`, `…_NAME
 | `CLAUDE_INTERCOM_NAME` | MCP server | Discoverable session name |
 | `CLAUDE_INTERCOM_SESSION_ID` | MCP server | Stable intercom id |
 | `CLAUDE_INTERCOM_MODEL` | MCP server | Model label shown to peers |
+| `AGENT_INTERCOM_SESSION_ID` / `_NAME` | MCP server | Host-neutral identity fallback; Claude-specific values take precedence |
+| `AGENT_INTERCOM_SCOPE_ID` | MCP server | Broker-enforced local routing scope |
 | `CLAUDE_INTERCOM_EFFORT` | `cci` / `ccim` | Effort level forwarded to every Claude turn |
 | `CLAUDE_INTERCOM_CWD` / `_INSTRUCTIONS` | `cci` / `ccim` | Defaults for `--cwd` / `--instructions` |
 | `CLAUDE_INTERCOM_CLAUDE_COMMAND` | workers | Claude Code executable (default `claude`) |

package/broker/spawn.ts

@@ -191,6 +191,7 @@ export function getBrokerSpawnOptions(
   cwd: string;
   env: NodeJS.ProcessEnv;
   windowsHide: true;
+  shell: false;
 } {
   return {
     detached: true,
@@ -198,6 +199,7 @@ export function getBrokerSpawnOptions(
     cwd: extensionDir,
     env: { ...env, PI_CODING_AGENT_DIR: getAgentDirPath(env), NODE_NO_WARNINGS: "1" },
     windowsHide: true,
+    shell: false,
   };
 }
 

package/claude/cci.ts

@@ -66,6 +66,7 @@ function gitString(cwd: string, args: string[]): string | null {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
+    shell: false,
   });
   if (result.status !== 0) return null;
   const trimmed = result.stdout.trim();
@@ -341,6 +342,7 @@ async function runCciTui(options: CciOptions, id: string, name: string, scopeId:
   const child = spawn(options.claudeCommand, args, {
     cwd: options.cwd,
     stdio: "inherit",
+    shell: false,
     env: {
       ...process.env,
       ...scopeEnv,

package/claude/cli-runner.ts

@@ -116,6 +116,7 @@ export function runClaudeTurn(options: ClaudeTurnOptions): Promise<ClaudeTurnRes
         cwd: launch.cwd,
         env: { ...process.env, ...options.env },
         stdio: ["pipe", "pipe", "pipe"],
+        shell: false,
       });
     } finally {
       // Directory descriptors remain open across the synchronous spawn setup,

package/claude/contact.ts

@@ -20,14 +20,14 @@ export function copyTextToClipboard(text: string): boolean {
           ["clip.exe", []],
         ];
   for (const [command, args] of candidates) {
-    if (spawnSync("which", [command], { stdio: "ignore" }).status !== 0) continue;
+    if (spawnSync("which", [command], { stdio: "ignore", shell: false }).status !== 0) continue;
     if (command === "wl-copy") {
-      const child = spawn(command, args, { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn(command, args, { stdio: ["pipe", "ignore", "ignore"], shell: false });
       child.stdin.end(text);
       child.unref();
       return true;
     }
-    if (spawnSync(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"] }).status === 0) return true;
+    if (spawnSync(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"], shell: false }).status === 0) return true;
   }
   return false;
 }

package/claude/mcp-protocol.ts

@@ -17,6 +17,12 @@ interface ToolDefinition {
   name: string;
   description: string;
   inputSchema: Record<string, unknown>;
+  annotations: {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+  };
   handler: ToolHandler;
 }
 
@@ -78,18 +84,21 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
       name: "intercom_whoami",
       description: "Return this Claude session's intercom identity for reliable targeting.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       handler: async () => runtime.whoami(),
     },
     {
       name: "intercom_team",
       description: "Show your current manager and the live coworkers owned by that manager. No arguments are required.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async () => runtime.team(),
     },
     {
       name: "intercom_status",
       description: "Show intercom connection status, active sessions, unread messages, and pending asks.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async () => runtime.status(),
     },
     {
@@ -103,6 +112,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         },
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async (args) => runtime.list(
         args.scope === "directory" || args.scope === "repo" ? args.scope : "machine",
         asBoolean(args.include_self, false),
@@ -117,6 +127,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         required: ["summary"],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
       handler: async (args) => runtime.setSummary(asString(args.summary, "summary")),
     },
     {
@@ -132,6 +143,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         required: ["to", "message"],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       handler: async (args) => runtime.send(asString(args.to, "to"), asString(args.message, "message"), asAttachmentArray(args.attachments)),
     },
     {
@@ -148,6 +160,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         required: ["to", "message"],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       handler: async (args, signal) => runtime.ask(
         asString(args.to, "to"),
         asString(args.message, "message"),
@@ -164,6 +177,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         properties: { mark_read: { type: "boolean", default: false } },
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
       handler: async (args) => runtime.pending(asBoolean(args.mark_read, false)),
     },
     {
@@ -179,6 +193,7 @@ export function buildToolDefinitions(runtime: ClaudeIntercomRuntime): ToolDefini
         required: ["message"],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
       handler: async (args) => runtime.reply(asString(args.message, "message"), typeof args.to === "string" ? args.to : undefined, args.which === "oldest" || args.which === "latest" ? args.which : undefined),
     },
   ];
@@ -222,7 +237,7 @@ export async function handleMcpRequest(request: JsonRpcRequest, runtime: ClaudeI
       return ok(request.id, {});
     case "tools/list":
       return ok(request.id, {
-        tools: tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })),
+        tools: tools.map(({ name, description, inputSchema, annotations }) => ({ name, description, inputSchema, annotations })),
       });
     case "tools/call": {
       const name = request.params?.name;

package/claude/native-protocol.ts

@@ -271,7 +271,7 @@ export async function bindNativeClaudeSocket(socketPath: string, onFrame: (frame
 
 function processStart(pid: number): Promise<string | undefined> {
   return new Promise((resolve) => {
-    execFile("ps", ["-o", "lstart=", "-p", String(pid)], (error, stdout) => resolve(error ? undefined : stdout.trim() || undefined));
+    execFile("ps", ["-o", "lstart=", "-p", String(pid)], { shell: false }, (error, stdout) => resolve(error ? undefined : stdout.trim() || undefined));
   });
 }
 

package/claude/runtime.ts

@@ -183,6 +183,7 @@ export function detectGitRoot(cwd: string): string | null {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
+    shell: false,
   });
   if (result.status !== 0) return null;
   return result.stdout.trim() || null;

package/claude/transport.ts

@@ -49,6 +49,7 @@ export function probeClaudeVersion(command = "claude"): ClaudeVersionProbe {
   const result = spawnSync(command, ["--version"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
+    shell: false,
   });
   if (result.error || result.status !== 0) {
     return {

package/dist/cci.mjs

@@ -274,7 +274,8 @@ function runClaudeTurn(options) {
       child = spawn(command, launch.args, {
         cwd: launch.cwd,
         env: { ...process.env, ...options.env },
-        stdio: ["pipe", "pipe", "pipe"]
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: false
       });
     } finally {
       launch.release();
@@ -566,7 +567,8 @@ function isNativeClaudeVersionCompatible(version) {
 function probeClaudeVersion(command = "claude") {
   const result = spawnSync(command, ["--version"], {
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
   });
   if (result.error || result.status !== 0) {
     return {
@@ -2063,7 +2065,8 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, env = process.env)
     stdio: "ignore",
     cwd: extensionDir,
     env: { ...env, PI_CODING_AGENT_DIR: getAgentDirPath(env), NODE_NO_WARNINGS: "1" },
-    windowsHide: true
+    windowsHide: true,
+    shell: false
   };
 }
 function toError2(error) {
@@ -2444,14 +2447,14 @@ function copyTextToClipboard(text) {
     ["clip.exe", []]
   ];
   for (const [command, args] of candidates) {
-    if (spawnSync2("which", [command], { stdio: "ignore" }).status !== 0) continue;
+    if (spawnSync2("which", [command], { stdio: "ignore", shell: false }).status !== 0) continue;
     if (command === "wl-copy") {
-      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"], shell: false });
       child.stdin.end(text);
       child.unref();
       return true;
     }
-    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"] }).status === 0) return true;
+    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"], shell: false }).status === 0) return true;
   }
   return false;
 }
@@ -3018,7 +3021,7 @@ async function bindNativeClaudeSocket(socketPath, onFrame) {
 }
 function processStart(pid) {
   return new Promise((resolve5) => {
-    execFile("ps", ["-o", "lstart=", "-p", String(pid)], (error, stdout) => resolve5(error ? void 0 : stdout.trim() || void 0));
+    execFile("ps", ["-o", "lstart=", "-p", String(pid)], { shell: false }, (error, stdout) => resolve5(error ? void 0 : stdout.trim() || void 0));
   });
 }
 async function registerNativeClaudePeer(options) {
@@ -3202,7 +3205,8 @@ function gitString(cwd, args) {
   const result = spawnSync3("git", args, {
     cwd,
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
+    stdio: ["ignore", "pipe", "ignore"],
+    shell: false
   });
   if (result.status !== 0) return null;
   const trimmed = result.stdout.trim();
@@ -3446,6 +3450,7 @@ async function runCciTui(options, id, name, scopeId) {
   const child = spawn4(options.claudeCommand, args, {
     cwd: options.cwd,
     stdio: "inherit",
+    shell: false,
     env: {
       ...process.env,
       ...scopeEnv,

package/dist/ccim.mjs

@@ -278,7 +278,8 @@ function runClaudeTurn(options) {
       child = spawn(command, launch.args, {
         cwd: launch.cwd,
         env: { ...process.env, ...options.env },
-        stdio: ["pipe", "pipe", "pipe"]
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: false
       });
     } finally {
       launch.release();
@@ -570,7 +571,8 @@ function isNativeClaudeVersionCompatible(version) {
 function probeClaudeVersion(command = "claude") {
   const result = spawnSync(command, ["--version"], {
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
   });
   if (result.error || result.status !== 0) {
     return {
@@ -2067,7 +2069,8 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, env = process.env)
     stdio: "ignore",
     cwd: extensionDir,
     env: { ...env, PI_CODING_AGENT_DIR: getAgentDirPath(env), NODE_NO_WARNINGS: "1" },
-    windowsHide: true
+    windowsHide: true,
+    shell: false
   };
 }
 function toError2(error) {
@@ -2448,14 +2451,14 @@ function copyTextToClipboard(text) {
     ["clip.exe", []]
   ];
   for (const [command, args] of candidates) {
-    if (spawnSync2("which", [command], { stdio: "ignore" }).status !== 0) continue;
+    if (spawnSync2("which", [command], { stdio: "ignore", shell: false }).status !== 0) continue;
     if (command === "wl-copy") {
-      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"], shell: false });
       child.stdin.end(text);
       child.unref();
       return true;
     }
-    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"] }).status === 0) return true;
+    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"], shell: false }).status === 0) return true;
   }
   return false;
 }
@@ -3022,7 +3025,7 @@ async function bindNativeClaudeSocket(socketPath, onFrame) {
 }
 function processStart(pid) {
   return new Promise((resolve5) => {
-    execFile("ps", ["-o", "lstart=", "-p", String(pid)], (error, stdout) => resolve5(error ? void 0 : stdout.trim() || void 0));
+    execFile("ps", ["-o", "lstart=", "-p", String(pid)], { shell: false }, (error, stdout) => resolve5(error ? void 0 : stdout.trim() || void 0));
   });
 }
 async function registerNativeClaudePeer(options) {
@@ -3206,7 +3209,8 @@ function gitString(cwd, args) {
   const result = spawnSync3("git", args, {
     cwd,
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
+    stdio: ["ignore", "pipe", "ignore"],
+    shell: false
   });
   if (result.status !== 0) return null;
   const trimmed = result.stdout.trim();
@@ -3450,6 +3454,7 @@ async function runCciTui(options, id, name, scopeId) {
   const child = spawn4(options.claudeCommand, args, {
     cwd: options.cwd,
     stdio: "inherit",
+    shell: false,
     env: {
       ...process.env,
       ...scopeEnv,

package/dist/claude-server.mjs

@@ -1501,7 +1501,8 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, env = process.env)
     stdio: "ignore",
     cwd: extensionDir,
     env: { ...env, PI_CODING_AGENT_DIR: getAgentDirPath(env), NODE_NO_WARNINGS: "1" },
-    windowsHide: true
+    windowsHide: true,
+    shell: false
   };
 }
 function toError2(error2) {
@@ -2274,7 +2275,8 @@ function detectGitRoot(cwd) {
   const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
     cwd,
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
+    stdio: ["ignore", "pipe", "ignore"],
+    shell: false
   });
   if (result.status !== 0) return null;
   return result.stdout.trim() || null;
@@ -2629,18 +2631,21 @@ function buildToolDefinitions(runtime2) {
       name: "intercom_whoami",
       description: "Return this Claude session's intercom identity for reliable targeting.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       handler: async () => runtime2.whoami()
     },
     {
       name: "intercom_team",
       description: "Show your current manager and the live coworkers owned by that manager. No arguments are required.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async () => runtime2.team()
     },
     {
       name: "intercom_status",
       description: "Show intercom connection status, active sessions, unread messages, and pending asks.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async () => runtime2.status()
     },
     {
@@ -2654,6 +2659,7 @@ function buildToolDefinitions(runtime2) {
         },
         additionalProperties: false
       },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
       handler: async (args) => runtime2.list(
         args.scope === "directory" || args.scope === "repo" ? args.scope : "machine",
         asBoolean(args.include_self, false)
@@ -2668,6 +2674,7 @@ function buildToolDefinitions(runtime2) {
         required: ["summary"],
         additionalProperties: false
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
       handler: async (args) => runtime2.setSummary(asString(args.summary, "summary"))
     },
     {
@@ -2683,6 +2690,7 @@ function buildToolDefinitions(runtime2) {
         required: ["to", "message"],
         additionalProperties: false
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       handler: async (args) => runtime2.send(asString(args.to, "to"), asString(args.message, "message"), asAttachmentArray(args.attachments))
     },
     {
@@ -2699,6 +2707,7 @@ function buildToolDefinitions(runtime2) {
         required: ["to", "message"],
         additionalProperties: false
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       handler: async (args, signal) => runtime2.ask(
         asString(args.to, "to"),
         asString(args.message, "message"),
@@ -2715,6 +2724,7 @@ function buildToolDefinitions(runtime2) {
         properties: { mark_read: { type: "boolean", default: false } },
         additionalProperties: false
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
       handler: async (args) => runtime2.pending(asBoolean(args.mark_read, false))
     },
     {
@@ -2730,6 +2740,7 @@ function buildToolDefinitions(runtime2) {
         required: ["message"],
         additionalProperties: false
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
       handler: async (args) => runtime2.reply(asString(args.message, "message"), typeof args.to === "string" ? args.to : void 0, args.which === "oldest" || args.which === "latest" ? args.which : void 0)
     }
   ];
@@ -2767,7 +2778,7 @@ async function handleMcpRequest(request, runtime2) {
       return ok(request.id, {});
     case "tools/list":
       return ok(request.id, {
-        tools: tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema }))
+        tools: tools.map(({ name, description, inputSchema, annotations }) => ({ name, description, inputSchema, annotations }))
       });
     case "tools/call": {
       const name = request.params?.name;

package/dist/worker-daemon.mjs

@@ -265,7 +265,8 @@ function runClaudeTurn(options) {
       child = spawn(command, launch.args, {
         cwd: launch.cwd,
         env: { ...process.env, ...options.env },
-        stdio: ["pipe", "pipe", "pipe"]
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: false
       });
     } finally {
       launch.release();
@@ -557,7 +558,8 @@ function isNativeClaudeVersionCompatible(version) {
 function probeClaudeVersion(command = "claude") {
   const result = spawnSync(command, ["--version"], {
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
   });
   if (result.error || result.status !== 0) {
     return {
@@ -2054,7 +2056,8 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, env = process.env)
     stdio: "ignore",
     cwd: extensionDir,
     env: { ...env, PI_CODING_AGENT_DIR: getAgentDirPath(env), NODE_NO_WARNINGS: "1" },
-    windowsHide: true
+    windowsHide: true,
+    shell: false
   };
 }
 function toError2(error) {
@@ -2426,14 +2429,14 @@ function copyTextToClipboard(text) {
     ["clip.exe", []]
   ];
   for (const [command, args] of candidates) {
-    if (spawnSync2("which", [command], { stdio: "ignore" }).status !== 0) continue;
+    if (spawnSync2("which", [command], { stdio: "ignore", shell: false }).status !== 0) continue;
     if (command === "wl-copy") {
-      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"], shell: false });
       child.stdin.end(text);
       child.unref();
       return true;
     }
-    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"] }).status === 0) return true;
+    if (spawnSync2(command, args, { input: text, stdio: ["pipe", "ignore", "ignore"], shell: false }).status === 0) return true;
   }
   return false;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctliz/agent-intercom-claude",
-  "version": "0.13.0-connect.1",
+  "version": "0.13.0-connect.3",
   "description": "Claude Code MCP plugin and wakeable worker for direct local messaging with Pi, Codex, and Claude coding-agent sessions.",
   "license": "AGPL-3.0-or-later",
   "type": "module",

package/scripts/verify-core-provenance.mjs

@@ -54,7 +54,7 @@ export function verifyPublishedProvenance(runner = spawnSync) {
     "version",
     "dist.integrity",
     "--json",
-  ], { encoding: "utf8" });
+  ], { encoding: "utf8", shell: false });
   if (result.error) throw result.error;
   if (result.status !== 0) {
     throw new Error(`Unable to inspect published Core ${APPROVED_CORE.version}: ${(result.stderr || result.stdout).trim()}`);

package/scripts/verify-packed-runtime.mjs

@@ -51,6 +51,7 @@ function createPackageArchive(temp) {
     cwd: repositoryRoot,
     env: { ...process.env, npm_config_cache: join(temp, "npm-cache") },
     encoding: "utf8",
+    shell: false,
   });
   if (result.error) throw result.error;
   if (result.status !== 0) throw new Error(`npm pack failed: ${result.stderr || result.stdout}`);