clay-server 2.21.0-beta.3 → 2.21.0-beta.4

package/lib/sdk-bridge.js

@@ -1234,9 +1234,9 @@ function createSDKBridge(opts) {
       // Auto-approve safe Bash commands (read-only, non-destructive)
       if (toolName === "Bash" && input && input.command) {
         var cmd = input.command.trim();
-        var firstWord = cmd.split(/[\s;|&]/)[0];
         var safeBashCommands = {
-          ls: true, cat: true, head: true, tail: true, wc: true, file: true,
+          // Navigation (harmless on its own, checked in compound commands below)
+          cd: true, pushd: true, popd: true,
           // File/dir inspection
           ls: true, cat: true, head: true, tail: true, wc: true, file: true,
           stat: true, find: true, tree: true, du: true, df: true,
@@ -1273,7 +1273,16 @@ function createSDKBridge(opts) {
           nslookup: true, host: true, ping: true, traceroute: true,
           curl: true, wget: true, http: true,
         };
-        if (safeBashCommands[firstWord]) {
+        // Split compound commands (&&, ||, ;, |) and check ALL segments
+        var segments = cmd.split(/\s*(?:&&|\|\||[;|])\s*/);
+        var allSafe = true;
+        for (var si = 0; si < segments.length; si++) {
+          var seg = segments[si].trim();
+          if (!seg) continue;
+          var firstWord = seg.split(/\s/)[0];
+          if (!safeBashCommands[firstWord]) { allSafe = false; break; }
+        }
+        if (allSafe) {
           return Promise.resolve({ behavior: "allow", updatedInput: input });
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.21.0-beta.3",
+  "version": "2.21.0-beta.4",
   "description": "Web UI for Claude Code. Any device. Push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",