@involvex/super-agent-cli 0.0.89 → 0.0.91

package/dist/index.js

@@ -1731,7 +1731,7 @@ var init_indexer = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@involvex/super-agent-cli",
-    version: "0.0.89",
+    version: "0.0.91",
     description: "An open-source AI agent that brings the power of Super Agent directly into your terminal.",
     keywords: [
       "cli",
@@ -1794,9 +1794,12 @@ var require_package = __commonJS((exports, module) => {
       "test:watch": "vitest",
       typecheck: "tsc --noEmit"
     },
+    overrides: {
+      "@modelcontextprotocol/sdk": "^1.26.0"
+    },
     dependencies: {
       "@google/generative-ai": "^0.24.1",
-      "@modelcontextprotocol/sdk": "^1.25.3",
+      "@modelcontextprotocol/sdk": "^1.26.0",
       "@types/mime": "^4.0.0",
       axios: "^1.13.4",
       bcrypt: "^6.0.0",
@@ -1804,8 +1807,8 @@ var require_package = __commonJS((exports, module) => {
       chalk: "^5.6.2",
       commander: "^14.0.3",
       "conventional-changelog-cli": "^5.0.0",
-      dotenv: "^17.2.3",
-      firebase: "^12.8.0",
+      dotenv: "^17.2.4",
+      firebase: "^12.9.0",
       "fs-extra": "^11.3.3",
       ignore: "^7.0.5",
       ink: "^6.6.0",
@@ -1814,7 +1817,7 @@ var require_package = __commonJS((exports, module) => {
       "marked-terminal": "^7.3.0",
       mime: "^4.1.0",
       open: "^11.0.0",
-      openai: "^6.17.0",
+      openai: "^6.18.0",
       react: "^19.2.4",
       "ripgrep-node": "^1.0.0",
       "shell-quote": "^1.8.3",
@@ -1823,7 +1826,7 @@ var require_package = __commonJS((exports, module) => {
     },
     devDependencies: {
       "@types/fs-extra": "^11.0.4",
-      "@types/node": "^25.1.0",
+      "@types/node": "^25.2.1",
       "@types/react": "18.3.27",
       "@types/ws": "^8.18.1",
       "@typescript-eslint/eslint-plugin": "^8.54.0",
@@ -1833,7 +1836,7 @@ var require_package = __commonJS((exports, module) => {
       prettier: "^3.8.1",
       "prettier-plugin-organize-imports": "^4.3.0",
       "prettier-plugin-packagejson": "^3.0.0",
-      "prettier-plugin-sort-imports": "^1.8.9",
+      "prettier-plugin-sort-imports": "^1.8.10",
       "react-devtools-core": "^7.0.1",
       tsx: "^4.21.0",
       typescript: "^5.9.3",
@@ -1991,11 +1994,9 @@ var BANNER = `
 `;
 
 // src/utils/confirmation-service.ts
-import { exec, spawn } from "child_process";
 import { strict as assert } from "assert";
+import { spawn } from "child_process";
 import { EventEmitter } from "events";
-import { promisify } from "util";
-var execAsync = promisify(exec);
 
 class ConfirmationService extends EventEmitter {
   static instance;
@@ -2910,11 +2911,53 @@ init_config();
 
 // src/plugins/manager.ts
 init_settings_manager();
-import { exec as exec2 } from "child_process";
-import { promisify as promisify2 } from "util";
+
+// src/utils/exec.ts
+import { spawn as spawn2 } from "child_process";
+async function runSafeCommand(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(command, args, {
+      cwd: options.cwd || process.cwd(),
+      env: { ...process.env, ...options.env },
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    if (child.stdout) {
+      child.stdout.on("data", (data) => {
+        stdout += data.toString();
+      });
+    }
+    if (child.stderr) {
+      child.stderr.on("data", (data) => {
+        stderr += data.toString();
+      });
+    }
+    if (options.input && child.stdin) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    }
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr });
+      } else {
+        const error = new Error(`Command "${command} ${args.join(" ")}" failed with exit code ${code}.
+Stderr: ${stderr}`);
+        error.code = code;
+        error.stdout = stdout;
+        error.stderr = stderr;
+        reject(error);
+      }
+    });
+    child.on("error", (err) => {
+      reject(err);
+    });
+  });
+}
+
+// src/plugins/manager.ts
 import * as path4 from "path";
 import fs4 from "fs-extra";
-var execAsync2 = promisify2(exec2);
 
 class PluginManager {
   static instance;
@@ -3015,12 +3058,14 @@ class PluginManager {
     if (await fs4.pathExists(targetDir)) {
       console.log(`Repository already cloned at ${targetDir}. Pulling latest...`);
       try {
-        await execAsync2(`cd "${targetDir}" && git pull`);
+        await runSafeCommand("git", ["pull"], {
+          cwd: targetDir
+        });
       } catch (error) {
         console.warn(`Failed to pull updates: ${error}`);
       }
     } else {
-      await execAsync2(`git clone "${gitUrl}" "${targetDir}"`);
+      await runSafeCommand("git", ["clone", gitUrl, targetDir]);
     }
     const packageJsonPath = path4.join(targetDir, "package.json");
     if (await fs4.pathExists(packageJsonPath)) {
@@ -3028,11 +3073,17 @@ class PluginManager {
       try {
         const hasBun = await fs4.pathExists(path4.join(targetDir, "bun.lockb"));
         const hasYarn = await fs4.pathExists(path4.join(targetDir, "yarn.lock"));
-        const installCmd = hasBun ? "bun install" : hasYarn ? "yarn install" : "npm install";
-        await execAsync2(`cd "${targetDir}" && ${installCmd}`);
+        const installCmd = hasBun ? "bun" : hasYarn ? "yarn" : "npm";
+        const installArgs = ["install"];
+        await runSafeCommand(installCmd, installArgs, {
+          cwd: targetDir
+        });
         console.log("\uD83D\uDD28 Building plugin...");
-        const buildCmd = hasBun ? "bun run build" : hasYarn ? "yarn build" : "npm run build";
-        await execAsync2(`cd "${targetDir}" && ${buildCmd}`);
+        const buildCmd = hasBun ? "bun" : hasYarn ? "yarn" : "npm";
+        const buildArgs = ["run", "build"];
+        await runSafeCommand(buildCmd, buildArgs, {
+          cwd: targetDir
+        });
       } catch (error) {
         console.warn(`Build failed: ${error.message}`);
       }
@@ -3055,11 +3106,17 @@ class PluginManager {
       try {
         const hasBun = await fs4.pathExists(path4.join(absolutePath, "bun.lockb"));
         const hasYarn = await fs4.pathExists(path4.join(absolutePath, "yarn.lock"));
-        const installCmd = hasBun ? "bun install" : hasYarn ? "yarn install" : "npm install";
-        await execAsync2(`cd "${absolutePath}" && ${installCmd}`);
+        const installCmd = hasBun ? "bun" : hasYarn ? "yarn" : "npm";
+        const installArgs = ["install"];
+        await runSafeCommand(installCmd, installArgs, {
+          cwd: absolutePath
+        });
         console.log("\uD83D\uDD28 Building plugin...");
-        const buildCmd = hasBun ? "bun run build" : hasYarn ? "yarn build" : "npm run build";
-        await execAsync2(`cd "${absolutePath}" && ${buildCmd}`);
+        const buildCmd = hasBun ? "bun" : hasYarn ? "yarn" : "npm";
+        const buildArgs = ["run", "build"];
+        await runSafeCommand(buildCmd, buildArgs, {
+          cwd: absolutePath
+        });
       } catch (error) {
         console.warn(`Build failed: ${error.message}`);
       }
@@ -3476,11 +3533,8 @@ async function getAllSuperAgentTools() {
 }
 
 // src/plugins/repository-manager.ts
-import { exec as exec3 } from "child_process";
-import { promisify as promisify3 } from "util";
 import * as path5 from "path";
 import fs5 from "fs-extra";
-var execAsync3 = promisify3(exec3);
 var BUILTIN_REPOSITORIES = {
   agents: {
     type: "agents",
@@ -3534,21 +3588,21 @@ class RepositoryManager {
       const gitRoot = process.cwd();
       const gitDirPath = path5.join(gitRoot, ".git");
       if (!await fs5.pathExists(gitDirPath)) {
-        await execAsync3(`git clone ${repoConfig.url} ${targetDir}`, {
+        await runSafeCommand("git", ["clone", repoConfig.url, targetDir], {
           cwd: process.cwd()
         });
       } else {
         try {
-          await execAsync3(`git submodule add ${repoConfig.url} ${targetDir}`, {
+          await runSafeCommand("git", ["submodule", "add", repoConfig.url, targetDir], {
             cwd: process.cwd()
           });
         } catch (submoduleError) {
-          await execAsync3(`git clone ${repoConfig.url} ${targetDir}`, {
+          await runSafeCommand("git", ["clone", repoConfig.url, targetDir], {
             cwd: process.cwd()
           });
         }
         try {
-          await execAsync3(`git submodule update --init --recursive`, {
+          await runSafeCommand("git", ["submodule", "update", "--init", "--recursive"], {
             cwd: process.cwd()
           });
         } catch {}
@@ -3566,7 +3620,7 @@ class RepositoryManager {
       const targetDir = path5.join(this.reposDir, config.type);
       try {
         if (await fs5.pathExists(targetDir)) {
-          await execAsync3(`git pull origin ${config.branch || "main"}`, {
+          await runSafeCommand("git", ["pull", "origin", config.branch || "main"], {
             cwd: targetDir
           });
           updated.push(key);
@@ -4246,8 +4300,16 @@ Note: Some providers may require a full restart of the CLI to take effect.`;
         if (key.tab || key.return) {
           const safeIndex = Math.min(selectedCommandIndex, filteredSuggestions.length - 1);
           const selectedCommand = filteredSuggestions[safeIndex];
-          let completedCommand = selectedCommand.command;
-          completedCommand = completedCommand.replace(/\s*<[^>]+>/g, "").replace(/\s*\[[^\]]+\]/g, "");
+          const stripCommandPlaceholders = (command) => {
+            let previous;
+            let current = command;
+            do {
+              previous = current;
+              current = current.replace(/\s*<[^>]+>/g, "").replace(/\s*\[[^\]]+\]/g, "");
+            } while (current !== previous);
+            return current;
+          };
+          let completedCommand = stripCommandPlaceholders(selectedCommand.command);
           if (!completedCommand.endsWith(" ") && selectedCommand.command.includes("<")) {
             completedCommand += " ";
           } else if (!completedCommand.endsWith(" ")) {
@@ -7811,7 +7873,7 @@ init_settings_manager();
 
 // src/tools/bash.ts
 import * as shellQuote from "shell-quote";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 class BashTool {
   currentDirectory = process.cwd();
   confirmationService = ConfirmationService.getInstance();
@@ -7824,7 +7886,7 @@ class BashTool {
     const cmd = argv[0];
     const args = argv.slice(1);
     return await new Promise((resolve2, reject) => {
-      const child = spawn2(cmd, args, {
+      const child = spawn3(cmd, args, {
         cwd: options.cwd,
         shell: false
       });
@@ -8467,7 +8529,7 @@ Important Files:
 }
 // src/tools/search.ts
 init_indexer();
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import * as path16 from "path";
 import fs16 from "fs-extra";
 
@@ -8568,7 +8630,7 @@ class SearchTool {
       }
       args.push("--no-require-git", "--follow", "--glob", "!.git/**", "--glob", "!node_modules/**", "--glob", "!.DS_Store", "--glob", "!*.log");
       args.push(query, this.currentDirectory);
-      const rg = spawn3("rg", args);
+      const rg = spawn4("rg", args);
       let output = "";
       let errorOutput = "";
       rg.stdout.on("data", (data) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@involvex/super-agent-cli",
-  "version": "0.0.89",
+  "version": "0.0.91",
   "description": "An open-source AI agent that brings the power of Super Agent directly into your terminal.",
   "keywords": [
     "cli",
@@ -63,9 +63,12 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit"
   },
+  "overrides": {
+    "@modelcontextprotocol/sdk": "^1.26.0"
+  },
   "dependencies": {
     "@google/generative-ai": "^0.24.1",
-    "@modelcontextprotocol/sdk": "^1.25.3",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "@types/mime": "^4.0.0",
     "axios": "^1.13.4",
     "bcrypt": "^6.0.0",
@@ -73,8 +76,8 @@
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "conventional-changelog-cli": "^5.0.0",
-    "dotenv": "^17.2.3",
-    "firebase": "^12.8.0",
+    "dotenv": "^17.2.4",
+    "firebase": "^12.9.0",
     "fs-extra": "^11.3.3",
     "ignore": "^7.0.5",
     "ink": "^6.6.0",
@@ -83,7 +86,7 @@
     "marked-terminal": "^7.3.0",
     "mime": "^4.1.0",
     "open": "^11.0.0",
-    "openai": "^6.17.0",
+    "openai": "^6.18.0",
     "react": "^19.2.4",
     "ripgrep-node": "^1.0.0",
     "shell-quote": "^1.8.3",
@@ -92,7 +95,7 @@
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^25.1.0",
+    "@types/node": "^25.2.1",
     "@types/react": "18.3.27",
     "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
@@ -102,7 +105,7 @@
     "prettier": "^3.8.1",
     "prettier-plugin-organize-imports": "^4.3.0",
     "prettier-plugin-packagejson": "^3.0.0",
-    "prettier-plugin-sort-imports": "^1.8.9",
+    "prettier-plugin-sort-imports": "^1.8.10",
     "react-devtools-core": "^7.0.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",

package/vscode-extension/dist/chat.js

@@ -124,23 +124,22 @@ function renderMessages() {
 }
 
 function formatContent(content) {
-  // Simple markdown-like formatting
-  let formatted = content;
+  // First escape everything to prevent XSS
+  let formatted = escapeHtml(content);
 
+  // Now apply formatting on the escaped content
   // Code blocks
   formatted = formatted.replace(
     /```(\w+)?\n([\s\S]*?)```/g,
     (match, lang, code) => {
-      return `<pre><code class="language-${lang || "text"}">${escapeHtml(
-        code.trim(),
-      )}</code></pre>`;
+      return `<pre><code class="language-${lang || "text"}">${code.trim()}</code></pre>`;
     },
   );
 
   // Inline code
   formatted = formatted.replace(
     /`([^`]+)`/g,
-    (match, code) => `<code>${escapeHtml(code)}</code>`,
+    (match, code) => `<code>${code}</code>`,
   );
 
   // Bold

package/vscode-extension/icon.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24">
+  <defs>
+    <linearGradient id="grad1" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#6366f1;stop-opacity:1" />
+      <stop offset="100%" style="stop-color:#8b5cf6;stop-opacity:1" />
+    </linearGradient>
+  </defs>
+  <rect width="24" height="24" rx="4" fill="url(#grad1)"/>
+  <path d="M7 8h10M7 12h7M7 16h10" stroke="white" stroke-width="2" stroke-linecap="round"/>
+  <circle cx="18" cy="6" r="2" fill="#22c55e"/>
+</svg>

package/vscode-extension/package.json

@@ -1,7 +1,7 @@
 {
   "name": "super-agent-vscode",
   "displayName": "Super Agent AI",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "AI-powered coding assistant with file context from Super Agent CLI",
   "categories": [
     "Machine Learning",
@@ -17,13 +17,13 @@
   "publisher": "involvex",
   "main": "./dist/extension.js",
   "scripts": {
-    "build": "npm run compile && npm run copy-assets",
+    "build": "bun run compile && bun run copy-assets",
     "compile": "tsc -p ./",
     "copy-assets": "node build.js",
     "lint": "eslint src --ext ts",
-    "package": "bun run build && vsce package --no-dependencies -o dist/",
+    "package": "npx vsce package --no-dependencies -o dist/",
     "typecheck": "tsc --noEmit",
-    "vscode:prepublish": "npm run compile && npm run copy-assets",
+    "vscode:prepublish": "bun run compile && bun run copy-assets",
     "watch": "tsc -w -p ./"
   },
   "contributes": {
@@ -31,17 +31,17 @@
       {
         "command": "super-agent.openChat",
         "title": "Open Super Agent Chat",
-        "icon": "icon.png"
+        "icon": "icon.svg"
       },
       {
         "command": "super-agent.reconnect",
         "title": "Reconnect to CLI",
-        "icon": "icon.png"
+        "icon": "icon.svg"
       },
       {
         "command": "super-agent.startServer",
         "title": "Start CLI Server",
-        "icon": "icon.png"
+        "icon": "icon.svg"
       },
       {
         "command": "super-agent.mentionFile",
@@ -58,7 +58,7 @@
           "type": "webview",
           "id": "super-agent.chat",
           "name": "Chat",
-          "icon": "icon.png"
+          "icon": "icon.svg"
         }
       ]
     },
@@ -67,7 +67,7 @@
         {
           "id": "super-agent-sidebar",
           "title": "Super Agent",
-          "icon": "icon.png"
+          "icon": "icon.svg"
         }
       ]
     }
@@ -82,7 +82,7 @@
     "@types/node": "^20.17.6",
     "@types/vscode": "^1.80.0",
     "@types/ws": "^8.5.13",
-    "@vscode/vsce": "^3.2.1",
+    "@vscode/vsce": "^3.7.1",
     "typescript": "^5.7.2"
   },
   "engines": {