fellow-agents 0.0.22 → 0.0.28

package/dist/commands/config.js

@@ -1,4 +1,4 @@
-import { readPreferences, writePreferences, lookupCli, preferencesFile, KNOWN_KEYS, } from "../lib/preferences.js";
+import { readPreferences, writePreferences, lookupCli, preferencesFile, stripMatchedQuotes, KNOWN_KEYS, } from "../lib/preferences.js";
 function printHelp() {
     console.log(`fellow-agents config — read or write user preferences
 
@@ -75,7 +75,7 @@ function handleSet(args) {
         process.exit(1);
     }
     const key = args[0];
-    const value = args.slice(1).join(" ");
+    const value = stripMatchedQuotes(args.slice(1).join(" ").trim()).trim();
     if (!isKnownKey(key)) {
         console.error(`Unknown key: ${key}`);
         console.error(`Known keys: ${KNOWN_KEYS.join(", ")}`);

package/dist/commands/start.js

@@ -10,7 +10,7 @@ import { startEmcomServer, startPtyWin, stopAll, logPath } from "../lib/services
 import { scaffoldWorkspaces, registerAgents, writeHooks } from "../lib/workspaces.js";
 import { installSkills } from "../lib/skills.js";
 import { binarySuffix } from "../lib/platform.js";
-import { readPreferences, writePreferences, autoDetectClis, lookupCli, } from "../lib/preferences.js";
+import { readPreferences, writePreferences, autoDetectClis, lookupCli, stripMatchedQuotes, } from "../lib/preferences.js";
 // Minimal engines.node range check — handles ">=N", "<N", and combinations.
 function nodeInRange(version, range) {
     const major = parseInt(version.split(".")[0], 10);
@@ -63,7 +63,8 @@ async function promptForCliPreference() {
             return detected[num - 1];
         }
         if (!isNaN(num) && num === customIdx) {
-            const value = (await rl.question("  Enter command or full path: ")).trim();
+            const raw = (await rl.question("  Enter command or full path: ")).trim();
+            const value = stripMatchedQuotes(raw).trim();
             if (!value) {
                 console.log("  Empty input — skipped.");
                 return null;

package/dist/lib/preferences.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync } from "fs";
 import { join } from "path";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { dataDir } from "./paths.js";
 /** ~/.fellow-agents/preferences.json */
 export const preferencesFile = join(dataDir, "preferences.json");
@@ -42,16 +42,39 @@ export function readPreferences() {
         return null;
     }
 }
+/**
+ * Strip a single pair of matched leading/trailing single or double quotes.
+ * Defensive helper for user inputs where a shell-style quoted value
+ * (`'agency cp'` or `"agency cp"`) gets typed literally — e.g. into a
+ * readline prompt or a config-set value after the outer shell has already
+ * consumed its own quote layer.
+ *
+ * Unmatched, mixed, or absent quotes pass through unchanged.
+ */
+export function stripMatchedQuotes(s) {
+    if (s.length < 2)
+        return s;
+    const first = s[0];
+    const last = s[s.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return s.slice(1, -1);
+    }
+    return s;
+}
 /**
  * Write preferences atomically (temp + renameSync — atomic on Windows from Node 10+).
  * Always stamps `updatedAt` to now and `updatedBy` to the supplied value.
  * Ensures dataDir exists. Cleans up the temp file on failure.
+ *
+ * Preserves forward-compat keys from `prefs` that aren't in the current
+ * Preferences type — callers spreading an existing file with future schema:2
+ * fields can rely on those fields surviving a schema:1-aware writer.
  */
 export function writePreferences(prefs) {
     mkdirSync(dataDir, { recursive: true });
     const next = {
+        ...prefs,
         schema: prefs.schema ?? CURRENT_SCHEMA,
-        cliPreference: prefs.cliPreference,
         updatedAt: new Date().toISOString(),
         updatedBy: prefs.updatedBy,
     };
@@ -72,12 +95,18 @@ export function writePreferences(prefs) {
 }
 /**
  * Look up a CLI on PATH. Returns the resolved full path (first hit), or null if not found.
- * Uses `where.exe` on Windows and `which -a` on Unix. Never throws.
+ * Uses `where.exe` on Windows and `which` on Unix. Never throws.
+ *
+ * Uses execFileSync with shell: false so user-controlled `name` values
+ * (e.g. a cliPreference set by config-set) cannot inject shell metacharacters.
+ * Values containing spaces or shell-special chars (`;`, `&`, `|`, `$`, etc.) are
+ * passed verbatim as a single argv to where.exe/which — which will simply not
+ * find a match and return null, rather than execute arbitrary commands.
  */
 export function lookupCli(name) {
-    const cmd = process.platform === "win32" ? `where.exe ${name}` : `which ${name}`;
+    const bin = process.platform === "win32" ? "where.exe" : "which";
     try {
-        const out = execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })
+        const out = execFileSync(bin, [name], { stdio: ["ignore", "pipe", "ignore"] })
             .toString()
             .split(/\r?\n/)
             .map((s) => s.trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fellow-agents",
-  "version": "0.0.22",
+  "version": "0.0.28",
   "description": "Multi-agent system — multiple Claude Code instances collaborating via messaging",
   "type": "module",
   "bin": {