ccem 2.30.0 → 2.32.0

package/dist/index.js

@@ -711,7 +711,7 @@ async function parseJSONLFileAsync(filePath, prices, signal) {
           throw new Error("Aborted");
         }
         if (lineCount % 1e3 === 0) {
-          await new Promise((resolve3) => setTimeout(resolve3, 0));
+          await new Promise((resolve4) => setTimeout(resolve4, 0));
         }
       }
       if (!line.trim()) continue;
@@ -800,7 +800,7 @@ async function getUsageStats(signal) {
         fileStats = cachedFile.stats;
       } else {
         fileStats = await parseJSONLFileAsync(file, prices, signal);
-        await new Promise((resolve3) => setTimeout(resolve3, 0));
+        await new Promise((resolve4) => setTimeout(resolve4, 0));
       }
       return {
         file,
@@ -1312,7 +1312,7 @@ var renderFooterHints = (hints) => {
   return minimal;
 };
 var selectEnvWithKeys = (registries, current) => {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const envNames = Object.keys(registries);
     let selectedIndex = envNames.indexOf(current);
     if (selectedIndex === -1) selectedIndex = 0;
@@ -1374,7 +1374,7 @@ var selectEnvWithKeys = (registries, current) => {
       }
       if (char === "\x1B" && key.length === 1) {
         cleanup();
-        resolve3({ action: "cancel" });
+        resolve4({ action: "cancel" });
         return;
       }
       if (char === "\x1B[A" || char === "k") {
@@ -1391,27 +1391,27 @@ var selectEnvWithKeys = (registries, current) => {
       }
       if (char === "\r" || char === "\n") {
         cleanup();
-        resolve3({ action: "select", name: envNames[selectedIndex] });
+        resolve4({ action: "select", name: envNames[selectedIndex] });
         return;
       }
       if (char === "e" || char === "E") {
         cleanup();
-        resolve3({ action: "edit", name: envNames[selectedIndex] });
+        resolve4({ action: "edit", name: envNames[selectedIndex] });
         return;
       }
       if (char === "r" || char === "R") {
         cleanup();
-        resolve3({ action: "rename", name: envNames[selectedIndex] });
+        resolve4({ action: "rename", name: envNames[selectedIndex] });
         return;
       }
       if (char === "c" || char === "C") {
         cleanup();
-        resolve3({ action: "copy", name: envNames[selectedIndex] });
+        resolve4({ action: "copy", name: envNames[selectedIndex] });
         return;
       }
       if (char === "d" || char === "D") {
         cleanup();
-        resolve3({ action: "delete", name: envNames[selectedIndex] });
+        resolve4({ action: "delete", name: envNames[selectedIndex] });
         return;
       }
     };
@@ -1893,7 +1893,7 @@ async function launchClaude(options) {
     console.log(renderStarting());
   }
   const sessionsDir = ensureSessionsDir();
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let provenanceTracking = null;
     const child = spawn("claude", args, {
       stdio: "inherit",
@@ -2151,7 +2151,7 @@ var setupEnvSettings = () => {
   }
 };
 var setupMcpTool = () => {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     console.log(chalk4.cyan("  \u2192 \u6B63\u5728\u6DFB\u52A0 chrome-devtools MCP \u5DE5\u5177..."));
     const child = spawn2("claude", [
       "mcp",
@@ -2176,22 +2176,22 @@ var setupMcpTool = () => {
     child.on("exit", (code) => {
       if (code === 0) {
         console.log(chalk4.green("  \u2713 \u5DF2\u6DFB\u52A0 chrome-devtools MCP \u5DE5\u5177"));
-        resolve3(true);
+        resolve4(true);
       } else {
         if (stderr.includes("already exists") || stdout.includes("already exists")) {
           console.log(chalk4.gray("  \u2713 chrome-devtools MCP \u5DE5\u5177\u5DF2\u5B58\u5728"));
-          resolve3(true);
+          resolve4(true);
         } else {
           console.error(chalk4.red(`  \u2717 \u6DFB\u52A0 MCP \u5DE5\u5177\u5931\u8D25 (code: ${code})`));
           if (stderr) console.error(chalk4.gray(`      ${stderr.trim()}`));
-          resolve3(false);
+          resolve4(false);
         }
       }
     });
     child.on("error", (err) => {
       console.error(chalk4.red(`  \u2717 \u6267\u884C claude \u547D\u4EE4\u5931\u8D25: ${err.message}`));
       console.log(chalk4.yellow("      \u8BF7\u786E\u4FDD\u5DF2\u5B89\u88C5 Claude Code CLI"));
-      resolve3(false);
+      resolve4(false);
     });
   });
 };
@@ -2221,7 +2221,7 @@ var runSetupInit = async (options = {}) => {
 };
 
 // src/skills.ts
-import { execSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import * as fs8 from "fs";
 import * as path6 from "path";
 import chalk5 from "chalk";
@@ -2230,6 +2230,58 @@ var SKILL_GROUPS = {
   featured: { label: "\u7CBE\u9009", icon: "\u2B50" },
   others: { label: "\u5176\u4ED6", icon: "\u{1F4E6}" }
 };
+var SAFE_GITHUB_PART_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var SAFE_PATH_PART_RE = /^[A-Za-z0-9._-]+$/;
+var SAFE_GIT_REF_RE = /^[A-Za-z0-9._/-]+$/;
+var SAFE_PLUGIN_PACKAGE_RE = /^[A-Za-z0-9._@-]+$/;
+function isSafeGitHubPart(value) {
+  return SAFE_GITHUB_PART_RE.test(value) && value !== "." && value !== "..";
+}
+function isSafePathPart(value) {
+  return SAFE_PATH_PART_RE.test(value) && value !== "." && value !== "..";
+}
+function isSafeRepoPath(value) {
+  if (!value) return true;
+  if (value.startsWith("/") || value.includes("\\")) return false;
+  const parts = value.split("/");
+  if (parts.some((part) => !part || !isSafePathPart(part))) return false;
+  return true;
+}
+function isSafeGitRef(value) {
+  if (!value || !SAFE_GIT_REF_RE.test(value)) return false;
+  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) return false;
+  if (value.includes("..") || value.includes("@{")) return false;
+  if (value.split("/").some((part) => part === "." || part === ".." || part.endsWith(".lock"))) {
+    return false;
+  }
+  return true;
+}
+function isSafeTargetName(value) {
+  return isSafePathPart(value) && !value.startsWith(".");
+}
+function isSafeMarketplace(value) {
+  return isSafeRepoPath(value);
+}
+function isSafePluginPackage(value) {
+  return SAFE_PLUGIN_PACKAGE_RE.test(value) && !value.includes("..");
+}
+function validateGitHubInstallParts(owner, repo, branch, repoPath, targetName) {
+  if (!isSafeGitHubPart(owner)) {
+    throw new Error(`Invalid GitHub owner: ${owner}`);
+  }
+  if (!isSafeGitHubPart(repo)) {
+    throw new Error(`Invalid GitHub repo: ${repo}`);
+  }
+  if (!isSafeGitRef(branch)) {
+    throw new Error(`Invalid Git branch: ${branch}`);
+  }
+  if (!isSafeRepoPath(repoPath)) {
+    throw new Error(`Invalid repository path: ${repoPath}`);
+  }
+  if (!isSafeTargetName(targetName)) {
+    throw new Error(`Invalid skill name: ${targetName}`);
+  }
+}
 var SKILL_PRESETS = [
   // ===== 官方 (Official) =====
   {
@@ -2375,21 +2427,44 @@ function getGroupOrder() {
   return ["official", "featured", "others"];
 }
 function parseGitHubUrl(url) {
-  if (/^[\w-]+\/[\w-]+$/.test(url)) {
-    const [owner2, repo2] = url.split("/");
-    return { owner: owner2, repo: repo2, branch: "main", path: "" };
+  if (url !== url.trim()) return null;
+  if (/(?:^|\/)\.{1,2}(?:\/|$)/.test(url) || /%2e|%2f/i.test(url)) return null;
+  if (/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(url)) {
+    const [owner, repo] = url.split("/");
+    if (!isSafeGitHubPart(owner) || !isSafeGitHubPart(repo)) return null;
+    return { owner, repo, branch: "main", path: "" };
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || parsed.hostname !== "github.com") {
+      return null;
+    }
+    if (parsed.search || parsed.hash || parsed.username || parsed.password) {
+      return null;
+    }
+    const parts = parsed.pathname.split("/");
+    if (parts.shift() !== "") return null;
+    const [owner, rawRepo, ...rest] = parts;
+    if (!owner || !rawRepo) return null;
+    const repo = rawRepo.replace(/\.git$/, "");
+    let branch = "main";
+    let repoPath = "";
+    if (rest.length > 0) {
+      if (rest[0] !== "tree" || !rest[1]) return null;
+      branch = rest[1];
+      repoPath = rest.slice(2).join("/");
+    }
+    validateGitHubInstallParts(
+      owner,
+      repo,
+      branch,
+      repoPath,
+      repoPath ? path6.basename(repoPath) : repo
+    );
+    return { owner, repo, branch, path: repoPath };
+  } catch {
+    return null;
   }
-  const match = url.match(
-    /github\.com\/([^/]+)\/([^/]+)(?:\/tree\/([^/]+)(?:\/(.*))?)?/
-  );
-  if (!match) return null;
-  const [, owner, repo, branch = "main", repoPath = ""] = match;
-  return {
-    owner,
-    repo: repo.replace(/\.git$/, ""),
-    branch,
-    path: repoPath
-  };
 }
 function getSkillsDir() {
   return path6.join(process.cwd(), ".claude", "skills");
@@ -2416,23 +2491,29 @@ function cleanupTempDirs(skillsDir) {
   }
 }
 function downloadSkillWithGit(owner, repo, branch, repoPath, targetName) {
-  const skillsDir = ensureSkillsDir();
-  const targetDir = path6.join(skillsDir, targetName);
-  if (fs8.existsSync(targetDir)) {
-    console.log(chalk5.yellow(`Skill "${targetName}" already exists. Updating...`));
-    fs8.rmSync(targetDir, { recursive: true });
-  }
-  const repoUrl = `https://github.com/${owner}/${repo}.git`;
-  const tempDir = path6.join(skillsDir, `.tmp-${Date.now()}`);
+  let tempDir = null;
   try {
+    validateGitHubInstallParts(owner, repo, branch, repoPath, targetName);
+    const skillsDir = ensureSkillsDir();
+    const targetDir = path6.join(skillsDir, targetName);
+    if (fs8.existsSync(targetDir)) {
+      console.log(chalk5.yellow(`Skill "${targetName}" already exists. Updating...`));
+      fs8.rmSync(targetDir, { recursive: true });
+    }
+    const repoUrl = `https://github.com/${owner}/${repo}.git`;
+    tempDir = path6.join(skillsDir, `.tmp-${Date.now()}`);
     fs8.mkdirSync(tempDir, { recursive: true });
-    execSync(`git init`, { cwd: tempDir, stdio: "pipe" });
-    execSync(`git remote add origin ${repoUrl}`, { cwd: tempDir, stdio: "pipe" });
-    execSync(`git config core.sparseCheckout true`, { cwd: tempDir, stdio: "pipe" });
+    execFileSync2("git", ["init"], { cwd: tempDir, stdio: "pipe" });
+    execFileSync2("git", ["remote", "add", "origin", repoUrl], { cwd: tempDir, stdio: "pipe" });
+    execFileSync2("git", ["config", "core.sparseCheckout", "true"], { cwd: tempDir, stdio: "pipe" });
     const sparseFile = path6.join(tempDir, ".git", "info", "sparse-checkout");
+    fs8.mkdirSync(path6.dirname(sparseFile), { recursive: true });
     fs8.writeFileSync(sparseFile, repoPath ? `${repoPath}/
 ` : "*\n");
-    execSync(`git pull --depth=1 origin ${branch}`, { cwd: tempDir, stdio: "pipe" });
+    execFileSync2("git", ["pull", "--depth=1", "origin", branch], {
+      cwd: tempDir,
+      stdio: "pipe"
+    });
     const sourceDir = repoPath ? path6.join(tempDir, repoPath) : tempDir;
     if (!fs8.existsSync(sourceDir)) {
       throw new Error(`Path "${repoPath}" not found in repository`);
@@ -2445,7 +2526,7 @@ function downloadSkillWithGit(owner, repo, branch, repoPath, targetName) {
     console.error(chalk5.red(`Failed to download skill: ${errMsg}`));
     return false;
   } finally {
-    if (fs8.existsSync(tempDir)) {
+    if (tempDir && fs8.existsSync(tempDir)) {
       fs8.rmSync(tempDir, { recursive: true });
     }
   }
@@ -2464,6 +2545,13 @@ function copyDir(src, dest) {
     }
   }
 }
+function isSafeSkillName(name) {
+  return name.trim().length > 0 && name !== "." && name !== ".." && !name.startsWith(".") && !path6.isAbsolute(name) && !name.includes("/") && !name.includes("\\") && !name.includes("\0");
+}
+function isPathInside(childPath, parentPath) {
+  const relativePath = path6.relative(parentPath, childPath);
+  return relativePath === "" || relativePath.length > 0 && !relativePath.startsWith("..") && !path6.isAbsolute(relativePath);
+}
 function addSkillFromGitHub(urlOrPreset) {
   const preset = SKILL_PRESETS.find((p) => p.name === urlOrPreset);
   if (preset) {
@@ -2530,22 +2618,42 @@ function listInstalledSkills() {
   }));
 }
 function removeSkill(name) {
+  if (!isSafeSkillName(name)) {
+    console.error(chalk5.red(`Invalid skill name "${name}"`));
+    return false;
+  }
   const skillsDir = getSkillsDir();
-  const targetDir = path6.join(skillsDir, name);
+  const targetDir = path6.resolve(skillsDir, name);
   if (!fs8.existsSync(targetDir)) {
     console.error(chalk5.red(`Skill "${name}" not found`));
     return false;
   }
+  const canonicalSkillsDir = fs8.realpathSync(skillsDir);
+  const canonicalTargetDir = fs8.realpathSync(targetDir);
+  if (!isPathInside(canonicalTargetDir, canonicalSkillsDir)) {
+    console.error(chalk5.red(`Refusing to remove skill outside skills directory: "${name}"`));
+    return false;
+  }
   fs8.rmSync(targetDir, { recursive: true });
   console.log(chalk5.green(`Removed skill "${name}"`));
   return true;
 }
 function installFromPluginMarketplace(marketplace, packageName) {
   try {
+    if (!isSafeMarketplace(marketplace)) {
+      throw new Error(`Invalid marketplace: ${marketplace}`);
+    }
+    if (!isSafePluginPackage(packageName)) {
+      throw new Error(`Invalid package name: ${packageName}`);
+    }
     console.log(chalk5.cyan(`Adding marketplace: ${marketplace}...`));
-    execSync(`claude plugin marketplace add ${marketplace}`, { stdio: "inherit" });
+    execFileSync2("claude", ["plugin", "marketplace", "add", marketplace], {
+      stdio: "inherit"
+    });
     console.log(chalk5.cyan(`Installing package: ${packageName}...`));
-    execSync(`claude plugin install ${packageName}`, { stdio: "inherit" });
+    execFileSync2("claude", ["plugin", "install", packageName], {
+      stdio: "inherit"
+    });
     console.log(chalk5.green(`Successfully installed ${packageName}`));
     return true;
   } catch (error) {
@@ -2660,7 +2768,7 @@ function SkillSelector({ onSelect, onCancel }) {
 
 // src/components/index.tsx
 async function runSkillSelector() {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let resolved = false;
     const { unmount, waitUntilExit } = render(
       /* @__PURE__ */ React2.createElement(
@@ -2671,23 +2779,23 @@ async function runSkillSelector() {
             resolved = true;
             unmount();
             if (result === "custom") {
-              resolve3({ type: "custom" });
+              resolve4({ type: "custom" });
             } else {
-              resolve3({ type: "skill", skill: result });
+              resolve4({ type: "skill", skill: result });
             }
           },
           onCancel: () => {
             if (resolved) return;
             resolved = true;
             unmount();
-            resolve3({ type: "cancelled" });
+            resolve4({ type: "cancelled" });
           }
         }
       )
     );
     waitUntilExit().then(() => {
       if (!resolved) {
-        resolve3({ type: "cancelled" });
+        resolve4({ type: "cancelled" });
       }
     });
   });
@@ -3838,12 +3946,12 @@ var findAttachSession = (id) => {
 };
 var attachTmuxTarget = (target) => {
   const args = process.env.TMUX ? ["switch-client", "-t", target] : ["attach-session", "-t", target];
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const child = spawn3("tmux", args, { stdio: "inherit" });
     child.on("error", reject);
     child.on("exit", (code) => {
       if (code === 0 || code === null) {
-        resolve3();
+        resolve4();
       } else {
         reject(new Error(`tmux exited with code ${code}`));
       }
@@ -4562,11 +4670,11 @@ Editing environment '${result.name}'`));
         registries[result.name] = applyPromptAnswers(envToEdit, answers, true);
         setRegistries(registries);
         msg.success(`Environment '${result.name}' updated.`);
-        await new Promise((resolve3) => setTimeout(resolve3, 800));
+        await new Promise((resolve4) => setTimeout(resolve4, 800));
       } else if (result.action === "rename") {
         if (result.name === "official") {
           msg.error("Cannot rename default 'official' environment.");
-          await new Promise((resolve3) => setTimeout(resolve3, 800));
+          await new Promise((resolve4) => setTimeout(resolve4, 800));
         } else {
           const { newName } = await inquirer.prompt([
             {
@@ -4587,7 +4695,7 @@ Editing environment '${result.name}'`));
             config2.set("current", newName);
           }
           msg.success(`Environment '${result.name}' renamed to '${newName}'.`);
-          await new Promise((resolve3) => setTimeout(resolve3, 800));
+          await new Promise((resolve4) => setTimeout(resolve4, 800));
         }
       } else if (result.action === "copy") {
         const { targetName } = await inquirer.prompt([
@@ -4620,11 +4728,11 @@ Editing environment '${result.name}'`));
           setRegistries(registries);
           msg.success(`Environment '${targetName}' updated.`);
         }
-        await new Promise((resolve3) => setTimeout(resolve3, 800));
+        await new Promise((resolve4) => setTimeout(resolve4, 800));
       } else if (result.action === "delete") {
         if (result.name === "official") {
           msg.error("Cannot delete default 'official' environment.");
-          await new Promise((resolve3) => setTimeout(resolve3, 800));
+          await new Promise((resolve4) => setTimeout(resolve4, 800));
         } else {
           const { confirm } = await inquirer.prompt([
             {
@@ -4644,7 +4752,7 @@ Editing environment '${result.name}'`));
               msg.success(`Environment '${result.name}' deleted.`);
             }
           }
-          await new Promise((resolve3) => setTimeout(resolve3, 800));
+          await new Promise((resolve4) => setTimeout(resolve4, 800));
         }
       }
     } else if (action === "perm") {
@@ -4675,11 +4783,11 @@ Editing environment '${result.name}'`));
       if (selectedMode === "clear") {
         config2.set("defaultMode", null);
         msg.success("Default mode cleared");
-        await new Promise((resolve3) => setTimeout(resolve3, 800));
+        await new Promise((resolve4) => setTimeout(resolve4, 800));
       } else if (selectedMode !== "back") {
         config2.set("defaultMode", selectedMode);
         msg.success(`Default mode set: ${PERMISSION_PRESETS[selectedMode].name}`);
-        await new Promise((resolve3) => setTimeout(resolve3, 800));
+        await new Promise((resolve4) => setTimeout(resolve4, 800));
       }
     } else {
       process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.30.0",
+  "version": "2.32.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {