loop-task 2.1.1 → 2.1.3

package/dist/config/constants.js

@@ -74,6 +74,7 @@ export const CTRL_SHORTCUT_DELETE = "Ctrl+D";
 export const CODE_EDITOR_MAX_VISIBLE = 2;
 export const CODE_EDITOR_MODAL_HEIGHT = 40;
 export const CODE_EDITOR_MODAL_WIDTH = 120;
+export const CODE_EDITOR_WRAP_LENGTH = 40;
 export const CODE_EDITOR_UNDO_LIMIT = 50;
 export const CODE_EDITOR_SYNTAX_COLORS = {
     flag: "#38bdf8",

package/dist/core/command-runner.js

@@ -4,7 +4,19 @@ import { formatDuration } from "../duration.js";
 import { t } from "../i18n/index.js";
 import { MAX_CONTEXT_STDOUT_BYTES } from "../config/constants.js";
 function quoteArg(arg) {
-    return /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
+    if (arg.length === 0)
+        return '""';
+    // If the arg already starts with a single quote (from interpolate's
+    // shellEscape), it's already safely shell-quoted — pass through as-is.
+    if (arg.startsWith("'") && arg.endsWith("'"))
+        return arg;
+    // Safe characters: no quoting needed
+    if (/^[A-Za-z0-9_\-=:./,@]+$/.test(arg))
+        return arg;
+    // Otherwise: double-quote and escape inner double-quotes.
+    // Replace newlines with spaces (shell command line is single-line).
+    const cleaned = arg.replace(/[\n\r]/g, " ");
+    return `"${cleaned.replace(/"/g, '\\"')}"`;
 }
 function formatCommandLine(command, commandArgs) {
     return [command, ...commandArgs.map((a) => quoteArg(a.replace(/[\n\r]/g, " ")))].join(" ").trim();

package/dist/core/loop-controller.js

@@ -347,11 +347,19 @@ export class LoopController extends EventEmitter {
                 let combinedStdout = "";
                 for (const step of taskSteps) {
                     const stepResults = await Promise.allSettled(step.commands.map((cmd) => executeCommand(interpolate(cmd.command, chainContext), cmd.commandArgs.map(a => interpolate(a, chainContext)), cwd, this.logStream, AbortSignal.any([signal, this.runAbortController.signal]), this.runCount, shouldCaptureStdout)));
+                    let stepStdout = "";
                     for (const r of stepResults) {
                         if (r.status === "fulfilled") {
                             totalDuration += r.value.duration;
                             if (r.value.stdout)
-                                combinedStdout += (combinedStdout ? "\n" : "") + r.value.stdout;
+                                stepStdout += (stepStdout ? "\n" : "") + r.value.stdout;
+                        }
+                    }
+                    combinedStdout += (combinedStdout && stepStdout ? "\n" : "") + stepStdout;
+                    if (shouldCaptureStdout && stepStdout) {
+                        const parsed = parseStdout(stepStdout);
+                        if (parsed !== null) {
+                            Object.assign(chainContext, parsed);
                         }
                     }
                     const stepFailure = stepResults.some((r) => r.status === "rejected" || (r.status === "fulfilled" && r.value.exitCode !== 0));
@@ -362,12 +370,6 @@ export class LoopController extends EventEmitter {
                     }
                 }
                 this.runAbortController = null;
-                if (shouldCaptureStdout && combinedStdout) {
-                    const parsed = parseStdout(combinedStdout);
-                    if (parsed !== null) {
-                        Object.assign(chainContext, parsed);
-                    }
-                }
                 const result = {
                     exitCode,
                     duration: totalDuration,

package/dist/core/template.js

@@ -1,3 +1,20 @@
+function shellEscape(value) {
+    if (value.length === 0)
+        return '""';
+    // If the value is purely safe characters, pass it through unmodified
+    if (/^[A-Za-z0-9_\-=:./,@]+$/.test(value))
+        return value;
+    // Escape characters that are dangerous inside double quotes, then wrap
+    // the whole value in single quotes — the strongest shell quoting.
+    // Single quotes preserve everything literally (newlines, backticks,
+    // $, ", \, parens) except single quotes themselves.
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+}
 export function interpolate(input, context) {
-    return input.replace(/{{(\w+)}}/g, (_, key) => String(context[key] ?? ""));
+    return input.replace(/{{(\w+)}}/g, (_, key) => {
+        const raw = context[key];
+        if (raw === undefined || raw === null)
+            return "";
+        return shellEscape(String(raw));
+    });
 }

package/dist/tui/components/CodeEditorModal.js

@@ -7,7 +7,7 @@ import { useUndoRedo } from "../../shared/useUndoRedo.js";
 import { highlightSegments } from "../utils/syntax.js";
 import { joinCommandLines } from "../../loop-config.js";
 import { copyToClipboard, readFromClipboard } from "../../shared/clipboard.js";
-import { sanitizeMultilinePaste } from "../utils/paste.js";
+import { sanitizeMultilinePaste, wrapCommand } from "../utils/paste.js";
 import { CODE_EDITOR_MODAL_HEIGHT, CODE_EDITOR_MODAL_WIDTH, CODE_EDITOR_UNDO_LIMIT, CODE_EDITOR_SYNTAX_COLORS, } from "../../config/constants.js";
 // Cap modal to terminal size: never exceed (terminal - 2) so the border
 // and a 1-row margin are always visible. Ideal max is the constant.
@@ -62,7 +62,7 @@ export function CodeEditorModal(props) {
         // Must be detected BEFORE the escape check — the leading ESC trips
         // key.escape and would close the modal before paste is handled.
         if (input.includes("\x1b[200~")) {
-            const pasted = sanitizeMultilinePaste(input);
+            const pasted = wrapCommand(sanitizeMultilinePaste(input));
             if (pasted) {
                 const next = [...lines];
                 const line = next[cursorRow] ?? "";
@@ -197,7 +197,7 @@ export function CodeEditorModal(props) {
         // Multi-char printable input = unbracketed paste (e.g. right-click
         // in terminals that don't support DECSET 2004). Preserve newlines.
         if (input.length > 1 && !key.meta) {
-            const pasted = sanitizeMultilinePaste(input);
+            const pasted = wrapCommand(sanitizeMultilinePaste(input));
             if (pasted) {
                 const next = [...lines];
                 const line = next[cursorRow] ?? "";

package/dist/tui/utils/paste.js

@@ -1,4 +1,5 @@
 import { PASTE_MAX_CHARS } from "../../config/constants.js";
+import { CODE_EDITOR_WRAP_LENGTH } from "../../config/constants.js";
 export function sanitizePaste(raw) {
     return raw
         .replace(/\x1b\[20[01]~/g, "")
@@ -14,3 +15,23 @@ export function sanitizeMultilinePaste(raw) {
         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "")
         .slice(0, PASTE_MAX_CHARS);
 }
+export function wrapCommand(text, maxLen = CODE_EDITOR_WRAP_LENGTH) {
+    const words = text.split(" ");
+    const lines = [];
+    let current = "";
+    for (const word of words) {
+        if (current.length === 0) {
+            current = word;
+        }
+        else if (current.length + 1 + word.length <= maxLen) {
+            current += " " + word;
+        }
+        else {
+            lines.push(current);
+            current = word;
+        }
+    }
+    if (current)
+        lines.push(current);
+    return lines.join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loop-task",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Loop engineering toolkit. Run any command on a cadence, in the background, managed from a terminal board. Schedule tests, builds, syncs, or agent prompts.",
   "type": "module",
   "bin": {