@yagni-app/code-staging 0.3.0-staging.1091.1 → 0.3.0-staging.1093.1

package/dist/extension/guardian.js

@@ -29,7 +29,7 @@
  */
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
 export const DEFAULT_GUARDIAN_LIMITS = {
-    maxReviews: 30,
+    maxReviews: 120,
     maxConsecutiveDenials: 3,
     timeoutMs: 15_000,
 };

package/dist/login.d.ts

@@ -34,8 +34,10 @@ type OpenRunner = (cmd: string, args: string[]) => Promise<void>;
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export declare function resolveOpenCommand(url: string, platform?: NodeJS.Platform): {
     cmd: string;

package/dist/login.js

@@ -31,14 +31,17 @@ function isTimeoutError(err) {
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export function resolveOpenCommand(url, platform = process.platform) {
     if (platform === "darwin")
         return { cmd: "open", args: [url] };
-    if (platform === "win32")
-        return { cmd: "cmd", args: ["/c", "start", "", url] };
+    if (platform === "win32") {
+        return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    }
     return { cmd: "xdg-open", args: [url] };
 }
 const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
@@ -50,6 +53,18 @@ const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
  * URL is still printed for manual copy. `runner` is injectable for tests.
  */
 export const realOpenUrl = (url, runner = spawnRunner) => {
+    // Only ever hand http(s) URLs to the OS opener — refuse file:, javascript:,
+    // or custom schemes a compromised server response could try to smuggle in.
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return Promise.resolve();
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return Promise.resolve();
+    }
     const { cmd, args } = resolveOpenCommand(url);
     return runner(cmd, args).catch(() => {
         // Silently fail — the user can still copy the URL manually.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1091.1",
+  "version": "0.3.0-staging.1093.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "50ccbb69838d6ee20a0b0d7a7b7259105158f215"
+  "yagniSourceSha": "189159f08a0b5f7ab5cf10221f8238782ff7d1f7"
 }