@lythos/agent-adapter 0.9.48 → 0.9.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lythos/agent-adapter",
-  "version": "0.9.48",
+  "version": "0.9.49",
   "main": "./src/index.ts",
   "exports": {
     ".": "./src/index.ts",

package/src/adapters/kimi.test.ts

@@ -2,17 +2,19 @@ import { describe, expect, it } from 'bun:test'
 import { buildKimiCommand, parseKimiStreamJson } from './kimi'
 
 describe('buildKimiCommand', () => {
-  it('builds shell command with prompt file', () => {
-    const cmd = buildKimiCommand('/tmp/prompt.txt')
-    expect(cmd[0]).toBe('sh')
-    expect(cmd[1]).toBe('-c')
-    expect(cmd[2]).toContain('kimi --print --afk --output-format stream-json')
-    expect(cmd[2]).toContain('/tmp/prompt.txt')
+  it('builds kimi CLI args without shell wrapper', () => {
+    const cmd = buildKimiCommand()
+    expect(cmd[0]).toBe('kimi')
+    expect(cmd).toContain('--print')
+    expect(cmd).toContain('--afk')
+    expect(cmd).toContain('--output-format')
+    expect(cmd).toContain('stream-json')
   })
 
-  it('includes stdin redirect from prompt file', () => {
-    const cmd = buildKimiCommand('/tmp/my-prompt.txt')
-    expect(cmd[2]).toContain('< /tmp/my-prompt.txt')
+  it('does not use shell or redirect (injection-safe)', () => {
+    const cmd = buildKimiCommand()
+    expect(cmd).not.toContain('sh')
+    expect(cmd).not.toContain('-c')
   })
 })
 

package/src/adapters/kimi.ts

@@ -7,9 +7,9 @@ import { registerAgent } from '../registry'
 
 // ── Pure functions (testable without CLI) ────────────────────────────────────
 
-/** Build the kimi --print shell command. */
-export function buildKimiCommand(promptFile: string): string[] {
-  return ['sh', '-c', `kimi --print --afk --output-format stream-json < ${promptFile}`]
+/** Build kimi --print command args (no shell wrapper — safe from injection). */
+export function buildKimiCommand(): string[] {
+  return ['kimi', '--print', '--afk', '--output-format', 'stream-json']
 }
 
 /**
@@ -49,9 +49,9 @@ async function spawnKimi(opts: {
 
   const start = Date.now()
 
-  const proc = Bun.spawn(buildKimiCommand(promptFile), {
+  const proc = Bun.spawn(buildKimiCommand(), {
     cwd: opts.cwd,
-    stdin: 'ignore',
+    stdin: Bun.file(promptFile),
     stdout: 'pipe',
     stderr: 'pipe',
   })