@funnycode/myclaude 0.1.285 → 0.1.292

package/dist/myclaude.js

@@ -4,8 +4,8 @@
 // MACRO - build-time constants (injected by build.ts)
 // MACRO injected by build script
 globalThis.MACRO = {
-  VERSION: "0.1.285",
-  BUILD_TIME: "2026-08-21T08:33:09.704Z",
+  VERSION: "0.1.292",
+  BUILD_TIME: "2026-08-23T17:01:45.131Z",
   PACKAGE_URL: "@funnycode/myclaude",
   NATIVE_PACKAGE_URL: "@funnycode/myclaude",
   VERSION_CHANGELOG: '',
@@ -120027,7 +120027,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@funnycode/myclaude",
-    version: "0.1.285",
+    version: "0.1.292",
     private: false,
     description: "An open-source AI coding assistant in your terminal - powered by Claude",
     license: "MIT",
@@ -120094,7 +120094,7 @@ var init_package = __esm(() => {
       asciichart: "1.5.25",
       "async-mutex": "0.5.0",
       "auto-bind": "5.0.1",
-      axios: "1.19.0",
+      axios: "1.7.9",
       "bidi-js": "1.0.3",
       chalk: "5.6.2",
       chokidar: "5.0.0",
@@ -282575,19 +282575,13 @@ __export(exports_sessionIdCompat, {
   getCseShimGate: () => getCseShimGate
 });
 async function setCseShimGate(gate) {
-  await _gateMutex.runExclusive(() => {
-    if (_isCseShimEnabled === undefined) {
-      _isCseShimEnabled = gate;
-    }
-  });
+  _isCseShimEnabled = gate;
 }
 function getCseShimGate() {
   return _isCseShimEnabled;
 }
 async function resetCseShimGateForTesting() {
-  await _gateMutex.runExclusive(() => {
-    _isCseShimEnabled = undefined;
-  });
+  _isCseShimEnabled = undefined;
 }
 function toCompatSessionId(id) {
   if (!id.startsWith("cse_"))
@@ -282603,11 +282597,7 @@ function toInfraSessionId(id) {
     return id;
   return "cse_" + id.slice("session_".length);
 }
-var _isCseShimEnabled, _gateMutex;
-var init_sessionIdCompat = __esm(() => {
-  init_async_mutex();
-  _gateMutex = new Mutex;
-});
+var _isCseShimEnabled;
 
 // src/constants/product.ts
 function isRemoteSessionStaging(sessionId, ingressUrl) {
@@ -282626,7 +282616,7 @@ function getClaudeAiBaseUrl(sessionId, ingressUrl) {
   return CLAUDE_AI_BASE_URL;
 }
 function getRemoteSessionUrl(sessionId, ingressUrl) {
-  const { toCompatSessionId: toCompatSessionId2 } = (init_sessionIdCompat(), __toCommonJS(exports_sessionIdCompat));
+  const { toCompatSessionId: toCompatSessionId2 } = __toCommonJS(exports_sessionIdCompat);
   const compatId = toCompatSessionId2(sessionId);
   const baseUrl = getClaudeAiBaseUrl(compatId, ingressUrl);
   return `${baseUrl}/code/${compatId}`;
@@ -387589,7 +387579,6 @@ var init_concurrentSessions = __esm(() => {
 // src/bridge/replBridgeHandle.ts
 var init_replBridgeHandle = __esm(() => {
   init_concurrentSessions();
-  init_sessionIdCompat();
 });
 
 // src/tasks/LocalMainSessionTask.ts
@@ -464046,7 +464035,6 @@ var init_createSession = __esm(() => {
   init_debug();
   init_errors();
   init_debugUtils();
-  init_sessionIdCompat();
 });
 
 // src/commands/rename/rename.ts
@@ -480216,16 +480204,45 @@ function sanitizeCommand(command6) {
   if (!ALLOWED_COMMANDS.has(program)) {
     throw new Error("Invalid command: program is not on the allowlist of permitted commands (input omitted for security)");
   }
+  const FILE_OPERATING_COMMANDS = new Set(["cp", "mv", "touch", "mkdir", "tsc", "vitest"]);
+  if (FILE_OPERATING_COMMANDS.has(program)) {
+    for (let i3 = 1;i3 < argv.length; i3++) {
+      const arg = argv[i3];
+      if (typeof arg !== "string")
+        continue;
+      if (arg.includes("\x00")) {
+        throw new Error("Invalid command argument: NUL byte detected (input omitted for security)");
+      }
+      const valuesToCheck = [arg];
+      const eqIndex = arg.indexOf("=");
+      if (eqIndex !== -1) {
+        valuesToCheck.push(arg.slice(eqIndex + 1));
+      }
+      for (const value of valuesToCheck) {
+        const normalized = value.replace(/\\/g, "/");
+        if (normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
+          throw new Error("Invalid command argument: absolute paths are not allowed (input omitted for security)");
+        }
+        const parts = normalized.split("/");
+        for (const part of parts) {
+          if (part === "..") {
+            throw new Error("Invalid command argument: path traversal (..) is not allowed (input omitted for security)");
+          }
+        }
+      }
+    }
+  }
   return argv;
 }
 function escapeCodeSpan(text2) {
-  const maxRun = (text2.match(/`+/g) || []).reduce((m2, s) => Math.max(m2, s.length), 0);
+  const sanitized = text2.replace(/\r\n|\r|\n/g, " ");
+  const maxRun = (sanitized.match(/`+/g) || []).reduce((m2, s) => Math.max(m2, s.length), 0);
   const delim = "`".repeat(maxRun + 1);
-  const pad = text2.startsWith("`") || text2.endsWith("`") ? " " : "";
-  return `${delim}${pad}${text2}${pad}${delim}`;
+  const pad = sanitized.startsWith("`") || sanitized.endsWith("`") ? " " : "";
+  return `${delim}${pad}${sanitized}${pad}${delim}`;
 }
 function escapeMarkdown(text2) {
-  return text2.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/#/g, "\\#").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/!/g, "\\!").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
+  return text2.replace(/\r\n|\r|\n/g, " ").replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/#/g, "\\#").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/!/g, "\\!").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
 }
 function generateDiffPreview(flow) {
   const lines2 = [];
@@ -480281,7 +480298,12 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     state.currentStepIndex = i3;
     try {
       if (onStepStart) {
-        await onStepStart(step, state);
+        try {
+          await onStepStart(step, state);
+        } catch (callbackError) {
+          console.error(`onStepStart callback failed for step "${step.id}":`, callbackError);
+          callbackErrors.push(callbackError);
+        }
       }
       if (step.command) {
         await executeCommand(step.command, context2);
@@ -480370,9 +480392,7 @@ async function shouldContinueOnError(error52, step) {
     "ECONNRESET",
     "ENETUNREACH",
     "EPIPE",
-    "EAI_AGAIN",
-    "ENOTFOUND",
-    "ECONNREFUSED"
+    "EAI_AGAIN"
   ];
   const err2 = error52;
   const codeFromProps = typeof err2.code === "string" ? err2.code : typeof err2.errno === "string" ? err2.errno : null;
@@ -582303,7 +582323,6 @@ var init_replBridge = __esm(() => {
   init_cleanupRegistry();
   init_bridgeMessaging();
   init_workSecret();
-  init_sessionIdCompat();
   init_concurrentSessions();
   init_trustedDevice();
   init_HybridTransport();
@@ -582884,7 +582903,6 @@ var init_remoteBridgeCore = __esm(() => {
   init_axios2();
   init_replBridgeTransport();
   init_workSecret();
-  init_sessionIdCompat();
   init_jwtUtils();
   init_trustedDevice();
   init_envLessBridgeConfig();
@@ -583175,7 +583193,6 @@ var init_initReplBridge = __esm(() => {
   init_envLessBridgeConfig();
   init_pollConfig();
   init_replBridge();
-  init_sessionIdCompat();
 });
 
 // src/cli/print.ts

package/dist/myclaude.mjs

@@ -4,8 +4,8 @@
 // MACRO - build-time constants (injected by build.ts)
 // MACRO injected by build script
 globalThis.MACRO = {
-  VERSION: "0.1.285",
-  BUILD_TIME: "2026-08-21T08:33:09.704Z",
+  VERSION: "0.1.292",
+  BUILD_TIME: "2026-08-23T17:01:45.131Z",
   PACKAGE_URL: "@funnycode/myclaude",
   NATIVE_PACKAGE_URL: "@funnycode/myclaude",
   VERSION_CHANGELOG: '',
@@ -120027,7 +120027,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@funnycode/myclaude",
-    version: "0.1.285",
+    version: "0.1.292",
     private: false,
     description: "An open-source AI coding assistant in your terminal - powered by Claude",
     license: "MIT",
@@ -120094,7 +120094,7 @@ var init_package = __esm(() => {
       asciichart: "1.5.25",
       "async-mutex": "0.5.0",
       "auto-bind": "5.0.1",
-      axios: "1.19.0",
+      axios: "1.7.9",
       "bidi-js": "1.0.3",
       chalk: "5.6.2",
       chokidar: "5.0.0",
@@ -282575,19 +282575,13 @@ __export(exports_sessionIdCompat, {
   getCseShimGate: () => getCseShimGate
 });
 async function setCseShimGate(gate) {
-  await _gateMutex.runExclusive(() => {
-    if (_isCseShimEnabled === undefined) {
-      _isCseShimEnabled = gate;
-    }
-  });
+  _isCseShimEnabled = gate;
 }
 function getCseShimGate() {
   return _isCseShimEnabled;
 }
 async function resetCseShimGateForTesting() {
-  await _gateMutex.runExclusive(() => {
-    _isCseShimEnabled = undefined;
-  });
+  _isCseShimEnabled = undefined;
 }
 function toCompatSessionId(id) {
   if (!id.startsWith("cse_"))
@@ -282603,11 +282597,7 @@ function toInfraSessionId(id) {
     return id;
   return "cse_" + id.slice("session_".length);
 }
-var _isCseShimEnabled, _gateMutex;
-var init_sessionIdCompat = __esm(() => {
-  init_async_mutex();
-  _gateMutex = new Mutex;
-});
+var _isCseShimEnabled;
 
 // src/constants/product.ts
 function isRemoteSessionStaging(sessionId, ingressUrl) {
@@ -282626,7 +282616,7 @@ function getClaudeAiBaseUrl(sessionId, ingressUrl) {
   return CLAUDE_AI_BASE_URL;
 }
 function getRemoteSessionUrl(sessionId, ingressUrl) {
-  const { toCompatSessionId: toCompatSessionId2 } = (init_sessionIdCompat(), __toCommonJS(exports_sessionIdCompat));
+  const { toCompatSessionId: toCompatSessionId2 } = __toCommonJS(exports_sessionIdCompat);
   const compatId = toCompatSessionId2(sessionId);
   const baseUrl = getClaudeAiBaseUrl(compatId, ingressUrl);
   return `${baseUrl}/code/${compatId}`;
@@ -387589,7 +387579,6 @@ var init_concurrentSessions = __esm(() => {
 // src/bridge/replBridgeHandle.ts
 var init_replBridgeHandle = __esm(() => {
   init_concurrentSessions();
-  init_sessionIdCompat();
 });
 
 // src/tasks/LocalMainSessionTask.ts
@@ -464046,7 +464035,6 @@ var init_createSession = __esm(() => {
   init_debug();
   init_errors();
   init_debugUtils();
-  init_sessionIdCompat();
 });
 
 // src/commands/rename/rename.ts
@@ -480216,16 +480204,45 @@ function sanitizeCommand(command6) {
   if (!ALLOWED_COMMANDS.has(program)) {
     throw new Error("Invalid command: program is not on the allowlist of permitted commands (input omitted for security)");
   }
+  const FILE_OPERATING_COMMANDS = new Set(["cp", "mv", "touch", "mkdir", "tsc", "vitest"]);
+  if (FILE_OPERATING_COMMANDS.has(program)) {
+    for (let i3 = 1;i3 < argv.length; i3++) {
+      const arg = argv[i3];
+      if (typeof arg !== "string")
+        continue;
+      if (arg.includes("\x00")) {
+        throw new Error("Invalid command argument: NUL byte detected (input omitted for security)");
+      }
+      const valuesToCheck = [arg];
+      const eqIndex = arg.indexOf("=");
+      if (eqIndex !== -1) {
+        valuesToCheck.push(arg.slice(eqIndex + 1));
+      }
+      for (const value of valuesToCheck) {
+        const normalized = value.replace(/\\/g, "/");
+        if (normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
+          throw new Error("Invalid command argument: absolute paths are not allowed (input omitted for security)");
+        }
+        const parts = normalized.split("/");
+        for (const part of parts) {
+          if (part === "..") {
+            throw new Error("Invalid command argument: path traversal (..) is not allowed (input omitted for security)");
+          }
+        }
+      }
+    }
+  }
   return argv;
 }
 function escapeCodeSpan(text2) {
-  const maxRun = (text2.match(/`+/g) || []).reduce((m2, s) => Math.max(m2, s.length), 0);
+  const sanitized = text2.replace(/\r\n|\r|\n/g, " ");
+  const maxRun = (sanitized.match(/`+/g) || []).reduce((m2, s) => Math.max(m2, s.length), 0);
   const delim = "`".repeat(maxRun + 1);
-  const pad = text2.startsWith("`") || text2.endsWith("`") ? " " : "";
-  return `${delim}${pad}${text2}${pad}${delim}`;
+  const pad = sanitized.startsWith("`") || sanitized.endsWith("`") ? " " : "";
+  return `${delim}${pad}${sanitized}${pad}${delim}`;
 }
 function escapeMarkdown(text2) {
-  return text2.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/#/g, "\\#").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/!/g, "\\!").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
+  return text2.replace(/\r\n|\r|\n/g, " ").replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/#/g, "\\#").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/!/g, "\\!").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
 }
 function generateDiffPreview(flow) {
   const lines2 = [];
@@ -480281,7 +480298,12 @@ async function executeFlow(flow, context2, onStepStart, onStepComplete, onStepFa
     state.currentStepIndex = i3;
     try {
       if (onStepStart) {
-        await onStepStart(step, state);
+        try {
+          await onStepStart(step, state);
+        } catch (callbackError) {
+          console.error(`onStepStart callback failed for step "${step.id}":`, callbackError);
+          callbackErrors.push(callbackError);
+        }
       }
       if (step.command) {
         await executeCommand(step.command, context2);
@@ -480370,9 +480392,7 @@ async function shouldContinueOnError(error52, step) {
     "ECONNRESET",
     "ENETUNREACH",
     "EPIPE",
-    "EAI_AGAIN",
-    "ENOTFOUND",
-    "ECONNREFUSED"
+    "EAI_AGAIN"
   ];
   const err2 = error52;
   const codeFromProps = typeof err2.code === "string" ? err2.code : typeof err2.errno === "string" ? err2.errno : null;
@@ -582303,7 +582323,6 @@ var init_replBridge = __esm(() => {
   init_cleanupRegistry();
   init_bridgeMessaging();
   init_workSecret();
-  init_sessionIdCompat();
   init_concurrentSessions();
   init_trustedDevice();
   init_HybridTransport();
@@ -582884,7 +582903,6 @@ var init_remoteBridgeCore = __esm(() => {
   init_axios2();
   init_replBridgeTransport();
   init_workSecret();
-  init_sessionIdCompat();
   init_jwtUtils();
   init_trustedDevice();
   init_envLessBridgeConfig();
@@ -583175,7 +583193,6 @@ var init_initReplBridge = __esm(() => {
   init_envLessBridgeConfig();
   init_pollConfig();
   init_replBridge();
-  init_sessionIdCompat();
 });
 
 // src/cli/print.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@funnycode/myclaude",
-  "version": "0.1.285",
+  "version": "0.1.292",
   "private": false,
   "description": "An open-source AI coding assistant in your terminal - powered by Claude",
   "license": "MIT",
@@ -67,7 +67,7 @@
     "asciichart": "1.5.25",
     "async-mutex": "0.5.0",
     "auto-bind": "5.0.1",
-    "axios": "1.19.0",
+    "axios": "1.7.9",
     "bidi-js": "1.0.3",
     "chalk": "5.6.2",
     "chokidar": "5.0.0",