slashvibe-mcp 0.5.6 → 0.5.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/notify.js +7 -5
  2. package/package.json +1 -1
package/notify.js CHANGED
@@ -10,7 +10,7 @@
10
10
  * This is escalation, not baseline.
11
11
  */
12
12
 
13
- const { exec } = require('child_process');
13
+ const { execFile } = require('child_process');
14
14
  const os = require('os');
15
15
  const fs = require('fs');
16
16
  const path = require('path');
@@ -56,16 +56,18 @@ function showNotification(title, message, sound = false, bell = true) {
56
56
  ringBell();
57
57
  }
58
58
 
59
- // Escape quotes for osascript
60
- const safeTitle = title.replace(/"/g, '\\"');
61
- const safeMessage = message.replace(/"/g, '\\"');
59
+ // Escape double quotes so title/message stay inside their AppleScript string
60
+ // literals. Everything is passed to osascript via execFile (no shell), so
61
+ // sender-controlled single quotes can no longer break out into a shell command.
62
+ const safeTitle = String(title).replace(/"/g, '\\"');
63
+ const safeMessage = String(message).replace(/"/g, '\\"');
62
64
 
63
65
  let script = `display notification "${safeMessage}" with title "${safeTitle}"`;
64
66
  if (sound) {
65
67
  script += ` sound name "Ping"`;
66
68
  }
67
69
 
68
- exec(`osascript -e '${script}'`, (err) => {
70
+ execFile('osascript', ['-e', script], (err) => {
69
71
  if (err) {
70
72
  // Silently fail - notifications are best-effort
71
73
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "slashvibe-mcp",
3
- "version": "0.5.6",
3
+ "version": "0.5.7",
4
4
  "mcpName": "io.github.vibecodinginc/vibe",
5
5
  "description": "Social layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers",
6
6
  "main": "index.js",