@landienzla/claude-code-notify 1.0.1 → 1.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -4,13 +4,15 @@
4
4
 
5
5
  INPUT=$(cat)
6
6
 
7
- # Parse JSON with python3 to extract the notification message
7
+ # Parse JSON and sanitize for safe shell usage
8
+ # - Strip characters that could break shell/PowerShell/XML/AppleScript interpolation
9
+ # - Truncate to 200 chars (OS notification display limit)
8
10
  MESSAGE=$(echo "$INPUT" | python3 -c "
9
- import sys, json
11
+ import sys, json, re
10
12
  data = json.load(sys.stdin)
11
13
  message = data.get('notification_message', data.get('message', 'Needs your attention'))
12
- for old, new in [('&','&amp;'),('<','&lt;'),('>','&gt;'),('\"','&quot;')]:
13
- message = message.replace(old, new)
14
+ message = re.sub(r'[^\w\s.,!?:;()\[\]{}/\\@#%+=\-]', '', message)
15
+ message = message[:200]
14
16
  print(message)
15
17
  " 2>/dev/null)
16
18
 
@@ -37,8 +39,7 @@ case "$(uname -s)" in
37
39
  ;;
38
40
  Darwin*)
39
41
  # macOS
40
- ESCAPED=$(echo "$MESSAGE" | sed 's/\\/\\\\/g; s/"/\\"/g')
41
- osascript -e "display notification \"$ESCAPED\" with title \"Claude Code\"" 2>/dev/null || true
42
+ osascript -e "display notification \"$MESSAGE\" with title \"Claude Code\"" 2>/dev/null || true
42
43
  ;;
43
44
  CYGWIN*|MINGW*|MSYS*)
44
45
  # Native Windows (Git Bash / MSYS2)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@landienzla/claude-code-notify",
3
- "version": "1.0.1",
3
+ "version": "1.0.2",
4
4
  "description": "Cross-platform desktop notifications for Claude Code — plugin and CLI setup tool",
5
5
  "author": "Talha <landienzla@gmail.com>",
6
6
  "license": "MIT",