@landienzla/claude-code-notify 1.0.1 → 1.0.3

package/bin/cli.js

@@ -90,7 +90,13 @@ function uninstall() {
 function test() {
   const input = JSON.stringify({ notification_message: 'Test notification from claude-code-notify' });
   try {
-    execSync(`echo '${input}' | bash "${NOTIFY_SRC}"`, { stdio: 'inherit', timeout: 15000 });
+    const { spawnSync } = require('child_process');
+    const result = spawnSync('bash', [NOTIFY_SRC], {
+      input,
+      stdio: ['pipe', 'inherit', 'inherit'],
+      timeout: 15000
+    });
+    if (result.status !== 0) throw new Error(`exit code ${result.status}`);
     console.log('Test notification sent!');
   } catch (e) {
     console.error('Test failed:', e.message);

package/hooks/scripts/notify.sh

@@ -4,13 +4,15 @@
 
 INPUT=$(cat)
 
-# Parse JSON with python3 to extract the notification message
-MESSAGE=$(echo "$INPUT" | python3 -c "
-import sys, json
+# Parse JSON and sanitize for safe shell usage
+# - Strip characters that could break shell/PowerShell/XML/AppleScript interpolation
+# - Truncate to 200 chars (OS notification display limit)
+MESSAGE=$(printf '%s' "$INPUT" | python3 -c "
+import sys, json, re
 data = json.load(sys.stdin)
 message = data.get('notification_message', data.get('message', 'Needs your attention'))
-for old, new in [('&','&amp;'),('<','&lt;'),('>','&gt;'),('\"','&quot;')]:
-    message = message.replace(old, new)
+message = re.sub(r'[^\w\s.,!?:;()\[\]{}/\\@#%+=\-]', '', message)
+message = message[:200]
 print(message)
 " 2>/dev/null)
 
@@ -37,8 +39,7 @@ case "$(uname -s)" in
     ;;
   Darwin*)
     # macOS
-    ESCAPED=$(echo "$MESSAGE" | sed 's/\\/\\\\/g; s/"/\\"/g')
-    osascript -e "display notification \"$ESCAPED\" with title \"Claude Code\"" 2>/dev/null || true
+    osascript -e "display notification \"$MESSAGE\" with title \"Claude Code\"" 2>/dev/null || true
     ;;
   CYGWIN*|MINGW*|MSYS*)
     # Native Windows (Git Bash / MSYS2)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@landienzla/claude-code-notify",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Cross-platform desktop notifications for Claude Code — plugin and CLI setup tool",
   "author": "Talha <landienzla@gmail.com>",
   "license": "MIT",