threadwire 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",

package/scripts/verify-package.js

@@ -59,6 +59,7 @@ const EXPECTED_FILES = [
   "src/notice-queue.js",
   "src/notifiers/fetch-transport.js",
   "src/notifiers/telegram.js",
+  "src/path-safety.js",
   "src/providers/claude.js",
   "src/providers/codex.js",
   "src/providers/executable.js",

package/src/kimi-model-broker-policy.js

@@ -16,7 +16,9 @@ const ALLOWED_HEADERS = new Set([
   "accept-language", "sec-fetch-mode", "user-agent",
   "x-stainless-arch", "x-stainless-lang", "x-stainless-os",
   "x-stainless-package-version", "x-stainless-runtime", "x-stainless-runtime-version",
-  "x-stainless-retry-count", "x-stainless-timeout", "x-stainless-async"
+  "x-stainless-retry-count", "x-stainless-timeout", "x-stainless-async",
+  "x-msh-device-id", "x-msh-device-model", "x-msh-device-name", "x-msh-os-version",
+  "x-msh-platform", "x-msh-version"
 ])
 const BODY_KEYS = new Set([
   "model", "messages", "stream", "stream_options", "tools", "thinking",

package/src/path-safety.js

@@ -0,0 +1,8 @@
+// @ts-check
+
+import {isAbsolute} from "node:path"
+
+/** @param {string} path */
+export function escapesDirectory(path) {
+  return path === ".." || path.startsWith("../") || isAbsolute(path)
+}