loop-task 2.1.2 → 2.1.3

package/dist/core/command-runner.js

@@ -4,7 +4,19 @@ import { formatDuration } from "../duration.js";
 import { t } from "../i18n/index.js";
 import { MAX_CONTEXT_STDOUT_BYTES } from "../config/constants.js";
 function quoteArg(arg) {
-    return /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
+    if (arg.length === 0)
+        return '""';
+    // If the arg already starts with a single quote (from interpolate's
+    // shellEscape), it's already safely shell-quoted — pass through as-is.
+    if (arg.startsWith("'") && arg.endsWith("'"))
+        return arg;
+    // Safe characters: no quoting needed
+    if (/^[A-Za-z0-9_\-=:./,@]+$/.test(arg))
+        return arg;
+    // Otherwise: double-quote and escape inner double-quotes.
+    // Replace newlines with spaces (shell command line is single-line).
+    const cleaned = arg.replace(/[\n\r]/g, " ");
+    return `"${cleaned.replace(/"/g, '\\"')}"`;
 }
 function formatCommandLine(command, commandArgs) {
     return [command, ...commandArgs.map((a) => quoteArg(a.replace(/[\n\r]/g, " ")))].join(" ").trim();

package/dist/core/template.js

@@ -1,3 +1,20 @@
+function shellEscape(value) {
+    if (value.length === 0)
+        return '""';
+    // If the value is purely safe characters, pass it through unmodified
+    if (/^[A-Za-z0-9_\-=:./,@]+$/.test(value))
+        return value;
+    // Escape characters that are dangerous inside double quotes, then wrap
+    // the whole value in single quotes — the strongest shell quoting.
+    // Single quotes preserve everything literally (newlines, backticks,
+    // $, ", \, parens) except single quotes themselves.
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+}
 export function interpolate(input, context) {
-    return input.replace(/{{(\w+)}}/g, (_, key) => String(context[key] ?? ""));
+    return input.replace(/{{(\w+)}}/g, (_, key) => {
+        const raw = context[key];
+        if (raw === undefined || raw === null)
+            return "";
+        return shellEscape(String(raw));
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loop-task",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Loop engineering toolkit. Run any command on a cadence, in the background, managed from a terminal board. Schedule tests, builds, syncs, or agent prompts.",
   "type": "module",
   "bin": {