instar 0.7.26 → 0.7.28

package/dist/commands/server.js

@@ -81,7 +81,7 @@ async function respawnSessionForTopic(sessionManager, telegram, targetSession, t
     // Use topic name, not tmux session name — tmux names include the project prefix
     // which causes cascading names like ai-guy-ai-guy-ai-guy-topic-1 on each respawn.
     const topicName = storedName || `topic-${topicId}`;
-    const newSessionName = await sessionManager.spawnInteractiveSession(bootstrapMessage, topicName);
+    const newSessionName = await sessionManager.spawnInteractiveSession(bootstrapMessage, topicName, { telegramTopicId: topicId });
     telegram.registerTopicSession(topicId, newSessionName);
     await telegram.sendToTopic(topicId, `Session respawned.`);
     console.log(`[telegram→session] Respawned "${newSessionName}" for topic ${topicId}`);

package/dist/core/SessionManager.js

@@ -365,26 +365,21 @@ export class SessionManager extends EventEmitter {
             throw new Error(`Absolute session limit (${absoluteLimit}) reached. ` +
                 `Running: ${runningSessions.map(s => s.name).join(', ')}`);
         }
-        // Spawn Claude in tmux. When a Telegram topic triggered the session,
-        // export the topic ID as an env var so hooks can prime Claude to respond.
+        // Spawn Claude in tmux — no bash -c shell intermediary.
+        // Uses tmux -e flags to set/unset env vars directly, matching spawnSession pattern.
+        // This avoids shell injection risks and handles claudePath with spaces.
         try {
             const tmuxArgs = [
                 'new-session', '-d',
                 '-s', tmuxSession,
                 '-c', this.config.projectDir,
                 '-x', '200', '-y', '50',
+                '-e', 'CLAUDECODE=', // Prevent nested Claude Code detection
             ];
             if (options?.telegramTopicId) {
-                // Wrap in bash shell to export env var before Claude starts
-                // Also unset CLAUDECODE to prevent nested Claude Code errors
-                const claudeCmd = `${this.config.claudePath} --dangerously-skip-permissions`;
-                tmuxArgs.push('bash', '-c', `unset CLAUDECODE; export INSTAR_TELEGRAM_TOPIC=${options.telegramTopicId} && exec ${claudeCmd}`);
-            }
-            else {
-                // Unset CLAUDECODE to prevent nested Claude Code errors
-                const claudeCmd = `${this.config.claudePath} --dangerously-skip-permissions`;
-                tmuxArgs.push('bash', '-c', `unset CLAUDECODE; exec ${claudeCmd}`);
+                tmuxArgs.push('-e', `INSTAR_TELEGRAM_TOPIC=${options.telegramTopicId}`);
             }
+            tmuxArgs.push(this.config.claudePath, '--dangerously-skip-permissions');
             execFileSync(this.config.tmuxPath, tmuxArgs, { encoding: 'utf-8' });
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "0.7.26",
+  "version": "0.7.28",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/.vercel/README.txt

@@ -1,11 +0,0 @@
-> Why do I have a folder named ".vercel" in my project?
-The ".vercel" folder is created when you link a directory to a Vercel project.
-
-> What does the "project.json" file contain?
-The "project.json" file contains:
-- The ID of the Vercel project that you linked ("projectId")
-- The ID of the user or team your Vercel project is owned by ("orgId")
-
-> Should I commit the ".vercel" folder?
-No, you should not share the ".vercel" folder with anyone.
-Upon creation, it will be automatically added to your ".gitignore" file.

package/.vercel/project.json

@@ -1 +0,0 @@
-{"projectId":"prj_evM5LcItYL3IAmw8zNvEPGrHeaya","orgId":"team_dHctwIDcV3X9ydapQlCPHFGI","projectName":"claude-agent-kit"}