@funnycode/myclaude 0.1.270 → 0.1.275

package/dist/myclaude.js

@@ -4,8 +4,8 @@
 // MACRO - build-time constants (injected by build.ts)
 // MACRO injected by build script
 globalThis.MACRO = {
-  VERSION: "0.1.270",
-  BUILD_TIME: "2026-08-17T03:53:05.312Z",
+  VERSION: "0.1.275",
+  BUILD_TIME: "2026-08-18T07:41:26.160Z",
   PACKAGE_URL: "@funnycode/myclaude",
   NATIVE_PACKAGE_URL: "@funnycode/myclaude",
   VERSION_CHANGELOG: '',
@@ -120027,7 +120027,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@funnycode/myclaude",
-    version: "0.1.270",
+    version: "0.1.275",
     private: false,
     description: "An open-source AI coding assistant in your terminal - powered by Claude",
     license: "MIT",
@@ -282571,15 +282571,21 @@ __export(exports_sessionIdCompat, {
   toInfraSessionId: () => toInfraSessionId,
   toCompatSessionId: () => toCompatSessionId,
   setCseShimGate: () => setCseShimGate,
-  resetCseShimGateForTesting: () => resetCseShimGateForTesting
+  resetCseShimGateForTesting: () => resetCseShimGateForTesting,
+  getCseShimGate: () => getCseShimGate
 });
 function setCseShimGate(gate) {
-  if (_isCseShimEnabled === undefined) {
-    _isCseShimEnabled = gate;
-  }
+  if (_gateLocked)
+    return;
+  _gateLocked = true;
+  _isCseShimEnabled = gate;
+}
+function getCseShimGate() {
+  return _isCseShimEnabled;
 }
 function resetCseShimGateForTesting() {
   _isCseShimEnabled = undefined;
+  _gateLocked = false;
 }
 function toCompatSessionId(id) {
   if (!id.startsWith("cse_"))
@@ -282595,7 +282601,7 @@ function toInfraSessionId(id) {
     return id;
   return "cse_" + id.slice("session_".length);
 }
-var _isCseShimEnabled;
+var _isCseShimEnabled, _gateLocked = false;
 
 // src/constants/product.ts
 function isRemoteSessionStaging(sessionId, ingressUrl) {
@@ -480175,6 +480181,35 @@ var init_definitions = __esm(() => {
 });
 
 // src/flows/executor.ts
+function sanitizeCommand(command6) {
+  if (typeof command6 !== "string" || command6.trim().length === 0) {
+    throw new Error("Invalid command: empty or non-string command");
+  }
+  const parsed = import_shell_quote4.parse(command6);
+  const argv = [];
+  for (const node of parsed) {
+    if (typeof node === "string") {
+      if (/[`$<>|;&\\\n\r]/.test(node)) {
+        throw new Error(`Invalid command: shell metacharacter in token "${node}" is not allowed: "${command6}"`);
+      }
+      argv.push(node);
+      continue;
+    }
+    if (node && typeof node === "object") {
+      const kind = node.op || node.pattern || "shell metacharacter";
+      throw new Error(`Invalid command: shell metacharacter/operator (${kind}) is not allowed: "${command6}"`);
+    }
+    throw new Error(`Invalid command: unexpected token in command: "${command6}"`);
+  }
+  if (argv.length === 0) {
+    throw new Error("Invalid command: no program specified");
+  }
+  const program = argv[0];
+  if (!ALLOWED_COMMANDS.has(program)) {
+    throw new Error(`Invalid command: program "${program}" is not on the allowlist of permitted commands`);
+  }
+  return argv;
+}
 async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFail, onComplete) {
   const state = {
     currentStepIndex: 0,
@@ -480209,7 +480244,11 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     } catch (error52) {
       state.failedSteps.push(step.id);
       if (onStepFail) {
-        await onStepFail(step, state, error52);
+        try {
+          await onStepFail(step, state, error52);
+        } catch (callbackError) {
+          console.error(`onStepFail callback failed for step "${step.id}":`, callbackError);
+        }
       }
       const shouldContinue = await shouldContinueOnError(error52, step);
       if (!shouldContinue) {
@@ -480218,13 +480257,18 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     }
   }
   if (onComplete) {
-    await onComplete(state);
+    try {
+      await onComplete(state);
+    } catch (callbackError) {
+      console.error("onComplete callback failed:", callbackError);
+    }
   }
   return state;
 }
 async function executeCommand(command6, context2) {
+  const argv = sanitizeCommand(command6);
   if (context2?.bridge?.runCommand) {
-    await context2.bridge.runCommand(command6);
+    await context2.bridge.runCommand(argv);
     return;
   }
   throw new Error("No bridge.runCommand available to execute: " + command6);
@@ -480237,13 +480281,39 @@ async function executeFileOperation(file2, context2) {
   throw new Error("No bridge.editFile available to edit: " + file2);
 }
 async function shouldContinueOnError(error52, step) {
-  const errorMessages2 = [
-    "EACCES",
-    "ENOENT",
-    "ETIMEDOUT"
-  ];
-  return errorMessages2.some((msg) => error52.message.includes(msg));
+  const transientCodes = ["ETIMEDOUT"];
+  const err2 = error52;
+  if (err2.code && transientCodes.includes(err2.code)) {
+    return true;
+  }
+  if (transientCodes.some((code) => error52.message.includes(code))) {
+    return true;
+  }
+  if (error52.message.includes("No bridge")) {
+    return true;
+  }
+  return false;
 }
+var import_shell_quote4, ALLOWED_COMMANDS;
+var init_executor = __esm(() => {
+  import_shell_quote4 = __toESM(require_shell_quote(), 1);
+  ALLOWED_COMMANDS = new Set([
+    "npm",
+    "npx",
+    "node",
+    "bun",
+    "yarn",
+    "pnpm",
+    "mkdir",
+    "touch",
+    "cp",
+    "mv",
+    "echo",
+    "git",
+    "tsc",
+    "vitest"
+  ]);
+});
 
 // src/commands/flow.ts
 function getPromptContent3(args) {
@@ -480301,6 +480371,7 @@ var ALLOWED_TOOLS3, command6, flow_default;
 var init_flow = __esm(() => {
   init_attribution();
   init_definitions();
+  init_executor();
   ALLOWED_TOOLS3 = [
     "Bash(*)",
     "Edit(*)",
@@ -540704,7 +540775,7 @@ function createSearcher(pattern, options) {
   }
   return new BitapSearch(pattern, options);
 }
-function parse14(query3, options, { auto = true } = {}) {
+function parse15(query3, options, { auto = true } = {}) {
   const next = (query4) => {
     let keys2 = Object.keys(query4);
     const isQueryPath = isPath(query4);
@@ -540891,7 +540962,7 @@ class Fuse {
     return results;
   }
   _searchLogical(query3) {
-    const expression = parse14(query3, this.options);
+    const expression = parse15(query3, this.options);
     const evaluate = (node, item, idx) => {
       if (!node.children) {
         const { keyId, searcher } = node;
@@ -541269,7 +541340,7 @@ var init_fuse = __esm(() => {
   Fuse.parseIndex = parseIndex;
   Fuse.config = Config2;
   {
-    Fuse.parseQuery = parse14;
+    Fuse.parseQuery = parse15;
   }
   {
     register(ExtendedSearch);
@@ -582788,7 +582859,7 @@ async function initReplBridge(options) {
       if (generated && gen === genSeq && lastBridgeSessionId === bridgeSessionId && !getCurrentSessionTitle(getSessionId())) {
         patch2(generated, bridgeSessionId, atCount);
       }
-    });
+    }).catch(() => {});
   };
   const onUserMessage = (text2, bridgeSessionId) => {
     if (hasExplicitTitle || getCurrentSessionTitle(getSessionId())) {

package/dist/myclaude.mjs

@@ -4,8 +4,8 @@
 // MACRO - build-time constants (injected by build.ts)
 // MACRO injected by build script
 globalThis.MACRO = {
-  VERSION: "0.1.270",
-  BUILD_TIME: "2026-08-17T03:53:05.312Z",
+  VERSION: "0.1.275",
+  BUILD_TIME: "2026-08-18T07:41:26.160Z",
   PACKAGE_URL: "@funnycode/myclaude",
   NATIVE_PACKAGE_URL: "@funnycode/myclaude",
   VERSION_CHANGELOG: '',
@@ -120027,7 +120027,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@funnycode/myclaude",
-    version: "0.1.270",
+    version: "0.1.275",
     private: false,
     description: "An open-source AI coding assistant in your terminal - powered by Claude",
     license: "MIT",
@@ -282571,15 +282571,21 @@ __export(exports_sessionIdCompat, {
   toInfraSessionId: () => toInfraSessionId,
   toCompatSessionId: () => toCompatSessionId,
   setCseShimGate: () => setCseShimGate,
-  resetCseShimGateForTesting: () => resetCseShimGateForTesting
+  resetCseShimGateForTesting: () => resetCseShimGateForTesting,
+  getCseShimGate: () => getCseShimGate
 });
 function setCseShimGate(gate) {
-  if (_isCseShimEnabled === undefined) {
-    _isCseShimEnabled = gate;
-  }
+  if (_gateLocked)
+    return;
+  _gateLocked = true;
+  _isCseShimEnabled = gate;
+}
+function getCseShimGate() {
+  return _isCseShimEnabled;
 }
 function resetCseShimGateForTesting() {
   _isCseShimEnabled = undefined;
+  _gateLocked = false;
 }
 function toCompatSessionId(id) {
   if (!id.startsWith("cse_"))
@@ -282595,7 +282601,7 @@ function toInfraSessionId(id) {
     return id;
   return "cse_" + id.slice("session_".length);
 }
-var _isCseShimEnabled;
+var _isCseShimEnabled, _gateLocked = false;
 
 // src/constants/product.ts
 function isRemoteSessionStaging(sessionId, ingressUrl) {
@@ -480175,6 +480181,35 @@ var init_definitions = __esm(() => {
 });
 
 // src/flows/executor.ts
+function sanitizeCommand(command6) {
+  if (typeof command6 !== "string" || command6.trim().length === 0) {
+    throw new Error("Invalid command: empty or non-string command");
+  }
+  const parsed = import_shell_quote4.parse(command6);
+  const argv = [];
+  for (const node of parsed) {
+    if (typeof node === "string") {
+      if (/[`$<>|;&\\\n\r]/.test(node)) {
+        throw new Error(`Invalid command: shell metacharacter in token "${node}" is not allowed: "${command6}"`);
+      }
+      argv.push(node);
+      continue;
+    }
+    if (node && typeof node === "object") {
+      const kind = node.op || node.pattern || "shell metacharacter";
+      throw new Error(`Invalid command: shell metacharacter/operator (${kind}) is not allowed: "${command6}"`);
+    }
+    throw new Error(`Invalid command: unexpected token in command: "${command6}"`);
+  }
+  if (argv.length === 0) {
+    throw new Error("Invalid command: no program specified");
+  }
+  const program = argv[0];
+  if (!ALLOWED_COMMANDS.has(program)) {
+    throw new Error(`Invalid command: program "${program}" is not on the allowlist of permitted commands`);
+  }
+  return argv;
+}
 async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFail, onComplete) {
   const state = {
     currentStepIndex: 0,
@@ -480209,7 +480244,11 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     } catch (error52) {
       state.failedSteps.push(step.id);
       if (onStepFail) {
-        await onStepFail(step, state, error52);
+        try {
+          await onStepFail(step, state, error52);
+        } catch (callbackError) {
+          console.error(`onStepFail callback failed for step "${step.id}":`, callbackError);
+        }
       }
       const shouldContinue = await shouldContinueOnError(error52, step);
       if (!shouldContinue) {
@@ -480218,13 +480257,18 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     }
   }
   if (onComplete) {
-    await onComplete(state);
+    try {
+      await onComplete(state);
+    } catch (callbackError) {
+      console.error("onComplete callback failed:", callbackError);
+    }
   }
   return state;
 }
 async function executeCommand(command6, context2) {
+  const argv = sanitizeCommand(command6);
   if (context2?.bridge?.runCommand) {
-    await context2.bridge.runCommand(command6);
+    await context2.bridge.runCommand(argv);
     return;
   }
   throw new Error("No bridge.runCommand available to execute: " + command6);
@@ -480237,13 +480281,39 @@ async function executeFileOperation(file2, context2) {
   throw new Error("No bridge.editFile available to edit: " + file2);
 }
 async function shouldContinueOnError(error52, step) {
-  const errorMessages2 = [
-    "EACCES",
-    "ENOENT",
-    "ETIMEDOUT"
-  ];
-  return errorMessages2.some((msg) => error52.message.includes(msg));
+  const transientCodes = ["ETIMEDOUT"];
+  const err2 = error52;
+  if (err2.code && transientCodes.includes(err2.code)) {
+    return true;
+  }
+  if (transientCodes.some((code) => error52.message.includes(code))) {
+    return true;
+  }
+  if (error52.message.includes("No bridge")) {
+    return true;
+  }
+  return false;
 }
+var import_shell_quote4, ALLOWED_COMMANDS;
+var init_executor = __esm(() => {
+  import_shell_quote4 = __toESM(require_shell_quote(), 1);
+  ALLOWED_COMMANDS = new Set([
+    "npm",
+    "npx",
+    "node",
+    "bun",
+    "yarn",
+    "pnpm",
+    "mkdir",
+    "touch",
+    "cp",
+    "mv",
+    "echo",
+    "git",
+    "tsc",
+    "vitest"
+  ]);
+});
 
 // src/commands/flow.ts
 function getPromptContent3(args) {
@@ -480301,6 +480371,7 @@ var ALLOWED_TOOLS3, command6, flow_default;
 var init_flow = __esm(() => {
   init_attribution();
   init_definitions();
+  init_executor();
   ALLOWED_TOOLS3 = [
     "Bash(*)",
     "Edit(*)",
@@ -540704,7 +540775,7 @@ function createSearcher(pattern, options) {
   }
   return new BitapSearch(pattern, options);
 }
-function parse14(query3, options, { auto = true } = {}) {
+function parse15(query3, options, { auto = true } = {}) {
   const next = (query4) => {
     let keys2 = Object.keys(query4);
     const isQueryPath = isPath(query4);
@@ -540891,7 +540962,7 @@ class Fuse {
     return results;
   }
   _searchLogical(query3) {
-    const expression = parse14(query3, this.options);
+    const expression = parse15(query3, this.options);
     const evaluate = (node, item, idx) => {
       if (!node.children) {
         const { keyId, searcher } = node;
@@ -541269,7 +541340,7 @@ var init_fuse = __esm(() => {
   Fuse.parseIndex = parseIndex;
   Fuse.config = Config2;
   {
-    Fuse.parseQuery = parse14;
+    Fuse.parseQuery = parse15;
   }
   {
     register(ExtendedSearch);
@@ -582788,7 +582859,7 @@ async function initReplBridge(options) {
       if (generated && gen === genSeq && lastBridgeSessionId === bridgeSessionId && !getCurrentSessionTitle(getSessionId())) {
         patch2(generated, bridgeSessionId, atCount);
       }
-    });
+    }).catch(() => {});
   };
   const onUserMessage = (text2, bridgeSessionId) => {
     if (hasExplicitTitle || getCurrentSessionTitle(getSessionId())) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@funnycode/myclaude",
-  "version": "0.1.270",
+  "version": "0.1.275",
   "private": false,
   "description": "An open-source AI coding assistant in your terminal - powered by Claude",
   "license": "MIT",