beecork 1.4.11 → 1.6.0

package/dist/cli/channel.js

@@ -1,17 +1,24 @@
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 const CHANNEL_PREFIX = 'beecork-channel-';
+const SAFE_NPM_PACKAGE = /^[@a-zA-Z0-9_/.-]+$/;
 export function channelInstall(packageName) {
     // Normalize name
-    const fullName = packageName.startsWith(CHANNEL_PREFIX) ? packageName : `${CHANNEL_PREFIX}${packageName}`;
+    const fullName = packageName.startsWith(CHANNEL_PREFIX)
+        ? packageName
+        : `${CHANNEL_PREFIX}${packageName}`;
+    if (!SAFE_NPM_PACKAGE.test(fullName)) {
+        console.error(`Invalid package name: ${fullName}`);
+        process.exit(1);
+    }
     console.log(`Installing channel: ${fullName}...`);
     try {
-        execSync(`npm install -g ${fullName}`, { stdio: 'inherit' });
+        execFileSync('npm', ['install', '-g', fullName], { stdio: 'inherit' });
         console.log(`\nChannel "${fullName}" installed.`);
         console.log('Restart the daemon to activate: beecork stop && beecork start');
     }
-    catch (err) {
+    catch {
         console.error(`Failed to install ${fullName}. Check the package name and try again.`);
         process.exit(1);
     }
@@ -173,8 +180,11 @@ npm publish
 }
 export function channelList() {
     try {
-        const output = execSync('npm list -g --depth=0', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const lines = output.split('\n').filter(line => line.includes(CHANNEL_PREFIX));
+        const output = execFileSync('npm', ['list', '-g', '--depth=0'], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const lines = output.split('\n').filter((line) => line.includes(CHANNEL_PREFIX));
         if (lines.length === 0) {
             console.log('No community channels installed.');
             console.log(`Install one: beecork channel install <name>`);

package/dist/cli/commands.js

@@ -4,6 +4,7 @@ import { spawn, execSync } from 'node:child_process';
 import { getDb, closeDb } from '../db/index.js';
 import { getConfig } from '../config.js';
 import { TaskStore } from '../tasks/store.js';
+import { TabStore } from '../session/tab-store.js';
 import { getDaemonPid, timeAgo } from './helpers.js';
 import { startService, stopService } from '../service/install.js';
 import { getPidPath, getLogsDir } from '../util/paths.js';
@@ -71,17 +72,17 @@ export async function showStatus() {
     console.log(`Daemon: ${pid ? `running (PID ${pid})` : 'stopped'}`);
     console.log(`Deployment: ${config.deployment}`);
     try {
-        const db = getDb();
-        const tabs = db.prepare('SELECT * FROM tabs ORDER BY last_activity_at DESC').all();
+        getDb(); // ensure DB initialized
+        const tabs = TabStore.listAll();
         console.log(`\nTabs (${tabs.length}):`);
         for (const tab of tabs) {
-            const ago = timeAgo(tab.last_activity_at);
+            const ago = timeAgo(tab.lastActivityAt);
             const pidInfo = tab.pid ? ` (PID ${tab.pid})` : '';
             console.log(`  ${tab.name.padEnd(20)} ${tab.status.padEnd(12)} last active: ${ago}${pidInfo}`);
         }
         const store = new TaskStore();
         const jobs = store.list();
-        const activeJobs = jobs.filter(j => j.enabled);
+        const activeJobs = jobs.filter((j) => j.enabled);
         console.log(`\nTasks: ${activeJobs.length} active (${jobs.length} total)`);
         if (activeJobs.length > 0) {
             for (const job of activeJobs.slice(0, 5)) {
@@ -97,8 +98,8 @@ export async function showStatus() {
     console.log('');
 }
 export async function listTabs() {
-    const db = requireDb();
-    const tabs = db.prepare('SELECT * FROM tabs ORDER BY last_activity_at DESC').all();
+    requireDb();
+    const tabs = TabStore.listAll();
     closeDb();
     if (tabs.length === 0) {
         console.log('No tabs.');
@@ -106,8 +107,8 @@ export async function listTabs() {
     }
     console.log(`\nTabs (${tabs.length}):\n`);
     for (const tab of tabs) {
-        const ago = timeAgo(tab.last_activity_at);
-        console.log(`  ${tab.name.padEnd(20)} [${tab.status}] dir:${tab.working_dir} — ${ago}`);
+        const ago = timeAgo(tab.lastActivityAt);
+        console.log(`  ${tab.name.padEnd(20)} [${tab.status}] dir:${tab.workingDir} — ${ago}`);
     }
     console.log('');
 }
@@ -186,7 +187,9 @@ export async function deleteWatcher(id) {
 }
 export async function listMemories() {
     const db = requireDb();
-    const memories = db.prepare('SELECT * FROM memories ORDER BY created_at DESC LIMIT 50').all();
+    const memories = db
+        .prepare('SELECT * FROM memories ORDER BY created_at DESC LIMIT 50')
+        .all();
     closeDb();
     if (memories.length === 0) {
         console.log('No memories stored.');

package/dist/cli/doctor.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs';
 import { execSync } from 'node:child_process';
 import { getConfig } from '../config.js';
-import { getDbPath, getPidPath, getBeecorkHome } from '../util/paths.js';
+import { getDbPath, getPidPath, getBeecorkHome, getConfigPath, getMcpConfigPath, getWhatsappSessionPath, } from '../util/paths.js';
+import { getMediaDir } from '../media/store.js';
 export async function runDoctor() {
     const checks = [];
     // 1. Check Claude binary
@@ -19,10 +20,14 @@ export async function runDoctor() {
         }
     }
     catch {
-        checks.push({ name: 'Claude Code', status: 'fail', message: 'Claude Code binary not found. Install: npm install -g @anthropic-ai/claude-code' });
+        checks.push({
+            name: 'Claude Code',
+            status: 'fail',
+            message: 'Claude Code binary not found. Install: npm install -g @anthropic-ai/claude-code',
+        });
     }
     // 2. Check config file
-    const configPath = `${getBeecorkHome()}/config.json`;
+    const configPath = getConfigPath();
     if (fs.existsSync(configPath)) {
         try {
             const config = getConfig();
@@ -30,17 +35,31 @@ export async function runDoctor() {
             // 3. Check Telegram token
             if (config.telegram?.token) {
                 try {
-                    const resp = await fetch(`https://api.telegram.org/bot${config.telegram.token}/getMe`, { signal: AbortSignal.timeout(10000) });
+                    const resp = await fetch(`https://api.telegram.org/bot${config.telegram.token}/getMe`, {
+                        signal: AbortSignal.timeout(10000),
+                    });
                     if (resp.ok) {
-                        const data = await resp.json();
-                        checks.push({ name: 'Telegram bot', status: 'pass', message: `@${data.result.username}` });
+                        const data = (await resp.json());
+                        checks.push({
+                            name: 'Telegram bot',
+                            status: 'pass',
+                            message: `@${data.result.username}`,
+                        });
                     }
                     else {
-                        checks.push({ name: 'Telegram bot', status: 'fail', message: 'Invalid token — getMe returned error' });
+                        checks.push({
+                            name: 'Telegram bot',
+                            status: 'fail',
+                            message: 'Invalid token — getMe returned error',
+                        });
                     }
                 }
-                catch (err) {
-                    checks.push({ name: 'Telegram bot', status: 'warn', message: 'Could not reach Telegram API' });
+                catch {
+                    checks.push({
+                        name: 'Telegram bot',
+                        status: 'warn',
+                        message: 'Could not reach Telegram API',
+                    });
                 }
             }
             else {
@@ -48,12 +67,16 @@ export async function runDoctor() {
             }
             // 4. Check WhatsApp session
             if (config.whatsapp?.enabled) {
-                const sessionPath = config.whatsapp.sessionPath || `${getBeecorkHome()}/whatsapp-session`;
+                const sessionPath = config.whatsapp.sessionPath || getWhatsappSessionPath();
                 if (fs.existsSync(sessionPath) && fs.readdirSync(sessionPath).length > 0) {
                     checks.push({ name: 'WhatsApp session', status: 'pass', message: sessionPath });
                 }
                 else {
-                    checks.push({ name: 'WhatsApp session', status: 'warn', message: 'No session data — QR scan needed' });
+                    checks.push({
+                        name: 'WhatsApp session',
+                        status: 'warn',
+                        message: 'No session data — QR scan needed',
+                    });
                 }
             }
         }
@@ -62,14 +85,18 @@ export async function runDoctor() {
         }
     }
     else {
-        checks.push({ name: 'Config', status: 'fail', message: `Not found at ${configPath}. Run: beecork setup` });
+        checks.push({
+            name: 'Config',
+            status: 'fail',
+            message: `Not found at ${configPath}. Run: beecork setup`,
+        });
     }
     // 5. Check database
     const dbPath = getDbPath();
     if (fs.existsSync(dbPath)) {
         try {
-            const Database = (await import('better-sqlite3')).default;
-            const db = new Database(dbPath, { readonly: true });
+            const { openDb } = await import('../db/connection.js');
+            const db = openDb(dbPath, { readonly: true });
             const integrity = db.pragma('integrity_check');
             if (integrity[0]?.integrity_check === 'ok') {
                 const size = (fs.statSync(dbPath).size / 1024).toFixed(0);
@@ -85,7 +112,11 @@ export async function runDoctor() {
         }
     }
     else {
-        checks.push({ name: 'Database', status: 'warn', message: 'No database yet — starts on first run' });
+        checks.push({
+            name: 'Database',
+            status: 'warn',
+            message: 'No database yet — starts on first run',
+        });
     }
     // 6. Check daemon
     const pidPath = getPidPath();
@@ -96,7 +127,11 @@ export async function runDoctor() {
             checks.push({ name: 'Daemon', status: 'pass', message: `Running (PID ${pid})` });
         }
         catch {
-            checks.push({ name: 'Daemon', status: 'warn', message: `Stale PID file (PID ${pid} not running)` });
+            checks.push({
+                name: 'Daemon',
+                status: 'warn',
+                message: `Stale PID file (PID ${pid} not running)`,
+            });
         }
     }
     else {
@@ -104,7 +139,7 @@ export async function runDoctor() {
     }
     // 7. Check disk space for media
     try {
-        const mediaDir = `${getBeecorkHome()}/media`;
+        const mediaDir = getMediaDir();
         const homeDir = getBeecorkHome();
         // Simple check: can we write a temp file?
         const testPath = `${homeDir}/.doctor-test`;
@@ -112,38 +147,61 @@ export async function runDoctor() {
         fs.unlinkSync(testPath);
         if (fs.existsSync(mediaDir)) {
             const files = fs.readdirSync(mediaDir);
-            checks.push({ name: 'Media dir', status: 'pass', message: `${files.length} files in ${mediaDir}` });
+            checks.push({
+                name: 'Media dir',
+                status: 'pass',
+                message: `${files.length} files in ${mediaDir}`,
+            });
         }
         else {
-            checks.push({ name: 'Media dir', status: 'pass', message: 'Not created yet (created on first media)' });
+            checks.push({
+                name: 'Media dir',
+                status: 'pass',
+                message: 'Not created yet (created on first media)',
+            });
         }
     }
     catch {
-        checks.push({ name: 'Disk space', status: 'fail', message: 'Cannot write to beecork home directory' });
+        checks.push({
+            name: 'Disk space',
+            status: 'fail',
+            message: 'Cannot write to beecork home directory',
+        });
     }
     // 8. Check MCP config
-    const mcpConfigPath = `${getBeecorkHome()}/mcp-config.json`;
+    const mcpConfigPath = getMcpConfigPath();
     if (fs.existsSync(mcpConfigPath)) {
         try {
             const mcpConfig = JSON.parse(fs.readFileSync(mcpConfigPath, 'utf-8'));
             const serverCount = Object.keys(mcpConfig.mcpServers || {}).length;
-            checks.push({ name: 'MCP config', status: 'pass', message: `${serverCount} server(s) configured` });
+            checks.push({
+                name: 'MCP config',
+                status: 'pass',
+                message: `${serverCount} server(s) configured`,
+            });
         }
         catch {
-            checks.push({ name: 'MCP config', status: 'fail', message: 'Invalid JSON in mcp-config.json' });
+            checks.push({
+                name: 'MCP config',
+                status: 'fail',
+                message: 'Invalid JSON in mcp-config.json',
+            });
         }
     }
     else {
         checks.push({ name: 'MCP config', status: 'pass', message: 'Default (beecork MCP only)' });
     }
-    // Print results
+    // Print results — gate ANSI on a real TTY so piping to a file/grep yields plain text.
     console.log('\nBeecork Doctor\n');
-    const icons = { pass: '\x1b[32m✓\x1b[0m', warn: '\x1b[33m!\x1b[0m', fail: '\x1b[31m✗\x1b[0m' };
+    const colored = process.stdout.isTTY && !process.env.NO_COLOR;
+    const icons = colored
+        ? { pass: '\x1b[32m✓\x1b[0m', warn: '\x1b[33m!\x1b[0m', fail: '\x1b[31m✗\x1b[0m' }
+        : { pass: '✓', warn: '!', fail: '✗' };
     for (const check of checks) {
         console.log(`  ${icons[check.status]} ${check.name}: ${check.message}`);
     }
-    const fails = checks.filter(c => c.status === 'fail').length;
-    const warns = checks.filter(c => c.status === 'warn').length;
+    const fails = checks.filter((c) => c.status === 'fail').length;
+    const warns = checks.filter((c) => c.status === 'warn').length;
     console.log(`\n  ${checks.length} checks: ${checks.length - fails - warns} passed, ${warns} warnings, ${fails} failures\n`);
     if (fails > 0)
         process.exit(1);

package/dist/cli/handoff.d.ts

@@ -1,15 +1,8 @@
-interface TabInfo {
-    name: string;
-    sessionId: string;
-    workingDir: string;
-    status: string;
-    lastActivity: string;
-    recentMessages: Array<{
-        role: string;
-        content: string;
-    }>;
-}
-export declare function exportTab(tabName: string): TabInfo | null;
+import { exportTab, formatHandoffInfo, type TabHandoffInfo } from '../session/handoff.js';
+export { exportTab, formatHandoffInfo, type TabHandoffInfo };
+/**
+ * CLI-only flow: print the handoff info, spawn claude with `--resume`, and
+ * inherit stdio so the user is dropped into an interactive session. Calls
+ * `process.exit` on subprocess exit — only safe from the CLI entry point.
+ */
 export declare function attachTab(tabName: string): void;
-export declare function formatHandoffInfo(info: TabInfo): string;
-export {};

package/dist/cli/handoff.js

@@ -1,21 +1,13 @@
 import { spawn } from 'node:child_process';
-import { getDb } from '../db/index.js';
 import { getConfig } from '../config.js';
-export function exportTab(tabName) {
-    const db = getDb();
-    const tab = db.prepare('SELECT * FROM tabs WHERE name = ?').get(tabName);
-    if (!tab)
-        return null;
-    const messages = db.prepare('SELECT role, content FROM messages WHERE tab_id = ? ORDER BY created_at DESC LIMIT 5').all(tab.id);
-    return {
-        name: tab.name,
-        sessionId: tab.session_id,
-        workingDir: tab.working_dir,
-        status: tab.status,
-        lastActivity: tab.last_activity_at,
-        recentMessages: messages.reverse(),
-    };
-}
+import { exportTab, formatHandoffInfo } from '../session/handoff.js';
+// Re-export the daemon-shared helpers so existing CLI callers keep working.
+export { exportTab, formatHandoffInfo };
+/**
+ * CLI-only flow: print the handoff info, spawn claude with `--resume`, and
+ * inherit stdio so the user is dropped into an interactive session. Calls
+ * `process.exit` on subprocess exit — only safe from the CLI entry point.
+ */
 export function attachTab(tabName) {
     const info = exportTab(tabName);
     if (!info) {
@@ -30,10 +22,7 @@ export function attachTab(tabName) {
     console.log(`  Status: ${info.status}`);
     console.log('');
     // Spawn Claude Code in the terminal, resuming the session
-    const child = spawn(bin, [
-        '--session-id', info.sessionId,
-        '--resume',
-    ], {
+    const child = spawn(bin, ['--session-id', info.sessionId, '--resume'], {
         cwd: info.workingDir,
         stdio: 'inherit', // Attach to terminal
         env: { ...process.env },
@@ -42,27 +31,3 @@ export function attachTab(tabName) {
         process.exit(code ?? 0);
     });
 }
-export function formatHandoffInfo(info) {
-    const lines = [
-        `Session Handoff — tab "${info.name}"`,
-        '',
-        `Session ID: ${info.sessionId}`,
-        `Working dir: ${info.workingDir}`,
-        `Status: ${info.status}`,
-        `Last activity: ${info.lastActivity}`,
-        '',
-        'To resume in terminal:',
-        `  beecork attach ${info.name}`,
-        '',
-        'Or manually:',
-        `  cd ${info.workingDir}`,
-        `  claude --session-id ${info.sessionId} --resume`,
-    ];
-    if (info.recentMessages.length > 0) {
-        lines.push('', 'Recent context:');
-        for (const msg of info.recentMessages) {
-            lines.push(`  [${msg.role}] ${msg.content.slice(0, 150)}${msg.content.length > 150 ? '...' : ''}`);
-        }
-    }
-    return lines.join('\n');
-}

package/dist/cli/mcp.js

@@ -1,14 +1,14 @@
 import fs from 'node:fs';
-import { getBeecorkHome } from '../util/paths.js';
-const MCP_CONFIG_PATH = `${getBeecorkHome()}/mcp-config.json`;
+import { getMcpConfigPath } from '../util/paths.js';
 function loadMcpConfig() {
-    if (fs.existsSync(MCP_CONFIG_PATH)) {
-        return JSON.parse(fs.readFileSync(MCP_CONFIG_PATH, 'utf-8'));
+    const path = getMcpConfigPath();
+    if (fs.existsSync(path)) {
+        return JSON.parse(fs.readFileSync(path, 'utf-8'));
     }
     return { mcpServers: {} };
 }
 function saveMcpConfig(config) {
-    fs.writeFileSync(MCP_CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });
+    fs.writeFileSync(getMcpConfigPath(), JSON.stringify(config, null, 2), { mode: 0o600 });
 }
 export function mcpAdd(name, command, args) {
     const config = loadMcpConfig();

package/dist/cli/media.js

@@ -1,12 +1,20 @@
 import readline from 'node:readline';
 function ask(rl, question, defaultValue) {
     const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-    return new Promise(r => rl.question(prompt, a => r(a.trim() || defaultValue || '')));
+    return new Promise((r) => rl.question(prompt, (a) => r(a.trim() || defaultValue || '')));
 }
 const IMAGE_PROVIDERS = [
-    { id: 'nano-banana', name: 'Google Nano Banana', keyHint: 'Google AI API key (from ai.google.dev)' },
+    {
+        id: 'nano-banana',
+        name: 'Google Nano Banana',
+        keyHint: 'Google AI API key (from ai.google.dev)',
+    },
     { id: 'dall-e', name: 'DALL-E (OpenAI)', keyHint: 'OpenAI API key (sk-...)' },
-    { id: 'stable-diffusion', name: 'Stable Diffusion (Stability AI)', keyHint: 'Stability AI API key' },
+    {
+        id: 'stable-diffusion',
+        name: 'Stable Diffusion (Stability AI)',
+        keyHint: 'Stability AI API key',
+    },
     { id: 'recraft', name: 'Recraft (Images + SVG Vectors)', keyHint: 'Recraft API key' },
 ];
 const VIDEO_PROVIDERS = [
@@ -17,7 +25,11 @@ const VIDEO_PROVIDERS = [
 const AUDIO_PROVIDERS = [
     { id: 'elevenlabs-music', name: 'ElevenLabs Music', keyHint: 'ElevenLabs API key (xi-...)' },
     { id: 'lyria', name: 'Google Lyria (Music)', keyHint: 'Google AI API key (from ai.google.dev)' },
-    { id: 'elevenlabs-sfx', name: 'ElevenLabs Sound Effects', keyHint: 'ElevenLabs API key (xi-...)' },
+    {
+        id: 'elevenlabs-sfx',
+        name: 'ElevenLabs Sound Effects',
+        keyHint: 'ElevenLabs API key (xi-...)',
+    },
 ];
 export async function mediaSetup() {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -27,7 +39,8 @@ export async function mediaSetup() {
     console.log('\nMedia Generation Setup\n');
     console.log('Configure AI providers for generating images, videos, and audio.');
     console.log('You need API keys from each provider.\n');
-    console.log('Already configured: ' + (generators.length > 0 ? generators.map(g => g.provider).join(', ') : 'none'));
+    console.log('Already configured: ' +
+        (generators.length > 0 ? generators.map((g) => g.provider).join(', ') : 'none'));
     console.log('');
     // Image providers
     console.log('Image Generation:');
@@ -42,7 +55,7 @@ export async function mediaSetup() {
             const apiKey = await ask(rl, `  ${provider.keyHint}`);
             if (apiKey) {
                 // Remove existing same provider if any
-                const filtered = generators.filter(g => g.provider !== provider.id);
+                const filtered = generators.filter((g) => g.provider !== provider.id);
                 filtered.push({ provider: provider.id, apiKey });
                 generators.length = 0;
                 generators.push(...filtered);
@@ -62,7 +75,7 @@ export async function mediaSetup() {
             const provider = VIDEO_PROVIDERS[idx];
             const apiKey = await ask(rl, `  ${provider.keyHint}`);
             if (apiKey) {
-                const filtered = generators.filter(g => g.provider !== provider.id);
+                const filtered = generators.filter((g) => g.provider !== provider.id);
                 filtered.push({ provider: provider.id, apiKey });
                 generators.length = 0;
                 generators.push(...filtered);
@@ -82,7 +95,7 @@ export async function mediaSetup() {
             const provider = AUDIO_PROVIDERS[idx];
             const apiKey = await ask(rl, `  ${provider.keyHint}`);
             if (apiKey) {
-                const filtered = generators.filter(g => g.provider !== provider.id);
+                const filtered = generators.filter((g) => g.provider !== provider.id);
                 filtered.push({ provider: provider.id, apiKey });
                 generators.length = 0;
                 generators.push(...filtered);

package/dist/cli/setup.js

@@ -34,11 +34,11 @@ export async function setupWizard() {
         console.log('Checking prerequisites...\n');
         try {
             const version = execSync('claude --version 2>&1', { encoding: 'utf-8' }).trim();
-            console.log(`  \u2713 Claude Code found: ${version}`);
+            console.log(`  ✓ Claude Code found: ${version}`);
         }
         catch {
             claudeCodeMissing = true;
-            console.log('  \u2717 Claude Code is not installed yet.');
+            console.log('  ✗ Claude Code is not installed yet.');
             console.log('');
             console.log('    Claude Code is the AI brain that Beecork connects to.');
             console.log('    You need a Claude Pro or Max subscription ($20/month) from anthropic.com');
@@ -74,13 +74,15 @@ export async function setupWizard() {
             }
             // Validate token by calling getMe
             try {
-                const resp = await fetch(`https://api.telegram.org/bot${token}/getMe`, { signal: AbortSignal.timeout(10000) });
+                const resp = await fetch(`https://api.telegram.org/bot${token}/getMe`, {
+                    signal: AbortSignal.timeout(10000),
+                });
                 if (resp.ok) {
-                    const data = await resp.json();
-                    console.log(`  \u2713 Connected to bot: @${data.result.username}\n`);
+                    const data = (await resp.json());
+                    console.log(`  ✓ Connected to bot: @${data.result.username}\n`);
                 }
                 else {
-                    console.log('  \u2717 Invalid token. Please check and try again.\n');
+                    console.log('  ✗ Invalid token. Please check and try again.\n');
                     token = '';
                 }
             }
@@ -128,7 +130,6 @@ export async function setupWizard() {
             },
             memory: {
                 dbPath: '~/.beecork/memory.db',
-                maxLongTermEntries: 1000,
             },
             projectScanPaths: scanPaths,
             deployment: 'local',
@@ -234,5 +235,5 @@ function generateMcpConfig() {
             },
         },
     };
-    fs.writeFileSync(getMcpConfigPath(), JSON.stringify(mcpConfig, null, 2) + '\n');
+    fs.writeFileSync(getMcpConfigPath(), JSON.stringify(mcpConfig, null, 2) + '\n', { mode: 0o600 });
 }

package/dist/cli/store.js

@@ -1,5 +1,11 @@
-import { execSync } from 'node:child_process';
-const BEECORK_PREFIXES = ['beecork-capability-', 'beecork-media-', 'beecork-channel-', 'beecork-watcher-'];
+import { execFileSync } from 'node:child_process';
+const BEECORK_PREFIXES = [
+    'beecork-capability-',
+    'beecork-media-',
+    'beecork-channel-',
+    'beecork-watcher-',
+];
+const SAFE_NPM_PACKAGE = /^[@a-zA-Z0-9_/.-]+$/;
 export async function storeSearch(query) {
     console.log(`\nSearching for "${query}"...\n`);
     try {
@@ -9,8 +15,8 @@ export async function storeSearch(query) {
             console.log('Failed to search npm registry. Try: npm search beecork');
             return;
         }
-        const data = await response.json();
-        const packages = data.objects.filter(o => BEECORK_PREFIXES.some(p => o.package.name.startsWith(p)));
+        const data = (await response.json());
+        const packages = data.objects.filter((o) => BEECORK_PREFIXES.some((p) => o.package.name.startsWith(p)));
         if (packages.length === 0) {
             console.log(`No beecork packages found for "${query}".`);
             console.log('Community packages use naming convention: beecork-capability-*, beecork-media-*, beecork-channel-*');
@@ -19,7 +25,9 @@ export async function storeSearch(query) {
         console.log(`${packages.length} package(s) found:\n`);
         for (const pkg of packages) {
             const p = pkg.package;
-            const type = BEECORK_PREFIXES.find(prefix => p.name.startsWith(prefix))?.replace('beecork-', '').replace('-', '') || '';
+            const type = BEECORK_PREFIXES.find((prefix) => p.name.startsWith(prefix))
+                ?.replace('beecork-', '')
+                .replace('-', '') || '';
             console.log(`  ${p.name}@${p.version}`);
             console.log(`    ${p.description || 'No description'}`);
             console.log(`    Type: ${type}`);
@@ -35,13 +43,18 @@ export async function storeSearch(query) {
 export function storeInstall(packageName) {
     // Normalize: if user types "shopify", try "beecork-capability-shopify" first
     let fullName = packageName;
-    if (!BEECORK_PREFIXES.some(p => packageName.startsWith(p)) && !packageName.startsWith('beecork-')) {
+    if (!BEECORK_PREFIXES.some((p) => packageName.startsWith(p)) &&
+        !packageName.startsWith('beecork-')) {
         // Try capability first, then media, then channel
         fullName = `beecork-capability-${packageName}`;
     }
+    if (!SAFE_NPM_PACKAGE.test(fullName)) {
+        console.error(`Invalid package name: ${fullName}`);
+        return;
+    }
     console.log(`\nInstalling ${fullName}...\n`);
     try {
-        execSync(`npm install -g ${fullName}`, { stdio: 'inherit' });
+        execFileSync('npm', ['install', '-g', fullName], { stdio: 'inherit' });
         console.log(`\n${fullName} installed.`);
         console.log('Restart daemon to activate: beecork stop && beecork start\n');
     }
@@ -51,8 +64,10 @@ export function storeInstall(packageName) {
             const baseName = packageName;
             for (const prefix of ['beecork-media-', 'beecork-channel-', 'beecork-']) {
                 const altName = prefix + baseName;
+                if (!SAFE_NPM_PACKAGE.test(altName))
+                    continue;
                 try {
-                    execSync(`npm install -g ${altName}`, { stdio: 'inherit' });
+                    execFileSync('npm', ['install', '-g', altName], { stdio: 'inherit' });
                     console.log(`\n${altName} installed.`);
                     console.log('Restart daemon to activate: beecork stop && beecork start\n');
                     return;
@@ -68,14 +83,16 @@ export function storeInstall(packageName) {
 }
 export async function storeInfo(packageName) {
     try {
-        const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, { signal: AbortSignal.timeout(10000) });
+        const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+            signal: AbortSignal.timeout(10000),
+        });
         if (!response.ok) {
             console.log(`Package "${packageName}" not found on npm.`);
             return;
         }
-        const data = await response.json();
-        const latest = data['dist-tags']?.latest;
-        const info = data.versions?.[latest];
+        const data = (await response.json());
+        const latest = data['dist-tags']?.latest ?? '';
+        const info = latest ? data.versions?.[latest] : undefined;
         console.log(`\n${data.name}@${latest}`);
         console.log(`  ${data.description || 'No description'}`);
         if (info?.homepage)

package/dist/config.d.ts

@@ -3,5 +3,9 @@ export declare function getConfig(): BeecorkConfig;
 export declare function saveConfig(config: BeecorkConfig): void;
 export declare function getTabConfig(tabName: string): TabConfig;
 export declare function resolveWorkingDir(tabName: string): string;
-export declare function getAdminUserId(): number;
 export declare function validateTabName(name: string): string | null;
+/**
+ * Like validateTabName but allows the literal name "default" (used by send/update
+ * endpoints that reference an existing tab rather than creating one).
+ */
+export declare function validateTabNameOrDefault(name: string): string | null;