@jiggai/recipes 0.4.56 → 0.4.57

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "recipes",
   "name": "Recipes",
   "description": "Markdown recipes that scaffold agents and teams (workspace-local).",
-  "version": "0.4.56",
+  "version": "0.4.57",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jiggai/recipes",
-  "version": "0.4.56",
+  "version": "0.4.57",
   "description": "ClawRecipes plugin for OpenClaw (markdown recipes -> scaffold agents/teams)",
   "main": "index.ts",
   "type": "commonjs",
@@ -13,7 +13,7 @@
       "pluginApiRange": ">=2026.3"
     },
     "build": {
-      "openclawVersion": "2026.3.28"
+      "openclawVersion": "2026.4.20"
     }
   },
   "publishConfig": {

package/recipes/default/swarm-orchestrator.md

@@ -542,6 +542,10 @@ templates:
       [[ "$1" =~ ^[a-z0-9][a-z0-9-]{0,62}$ ]]
     }
 
+    safe_ref() {
+      [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$ ]]
+    }
+
     cmd="${1:-}"
     shift || true
 
@@ -635,6 +639,14 @@ templates:
           echo "Worktree directory already exists: $worktree_dir" >&2
           exit 2
         fi
+        if ! safe_ref "$base_ref"; then
+          echo "invalid --base-ref: must match ^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$" >&2
+          exit 2
+        fi
+        if ! safe_ref "$branch"; then
+          echo "invalid --branch: must match ^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$" >&2
+          exit 2
+        fi
         git worktree add "$worktree_dir" -b "$branch" "$base_ref"
 
         # Start tmux session.