mirror of
https://github.com/Gitlawb/openclaude.git
synced 2026-08-24 10:14:19 -05:00
ArkhAngelLifeJiggyandGitHub
0d4e247905
* fix(mcp): pass MCP stdio server args as separate array elements to prevent shell injection (issue #131) * fix: extract buildMcpStdioCommand helper and add regression tests (PR #131 review) * fix(mcp): handle shell -c prefix in buildMcpStdioCommand (PR #131 review) When CLAUDE_CODE_SHELL_PREFIX contains -c (e.g. sh -c, bash -c), the original MCP command and args must be joined as a single shell command string after -c. Without this join, sh -c runs only the first word as the command string and treats remaining entries as positional parameters, so the MCP server never receives its configured arguments. - Detect -c in prefixParts and join command+args into one string - Non-shell prefixes (docker run --rm -i, bunx, etc.) unchanged - Add regression test for sh -c pattern * chore: add .tmp to gitignore * fix(mcp): shell-quote each arg in sh -c join to prevent injection (PR #131 P2 fixup) * fix(mcp): preserve spaced executable path in buildMcpStdioCommand -c split (PR #131 fixup) Use lastIndexOf(' -c') instead of whitespace split so paths like 'C:\Program Files\Git\bin\bash.exe -c' are handled correctly. Removes dead old code left in from previous edit.
22 lines
239 B
Plaintext
22 lines
239 B
Plaintext
node_modules/
|
|
dist/
|
|
*.tsbuildinfo
|
|
web/dist/
|
|
web/*.tsbuildinfo
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
auth.json
|
|
.openclaude-profile.json
|
|
.openclaude/
|
|
reports/
|
|
GEMINI.md
|
|
CLAUDE.md
|
|
package-lock.json
|
|
/.claude
|
|
coverage/
|
|
agent.log
|
|
plan/
|
|
.tmp
|
|
temp_reference/
|