mirror of
https://github.com/jackwener/OpenCLI.git
synced 2026-09-14 18:25:42 +08:00
Sebastion
b58f26006d
* fix(autoresearch): pass Claude prompt via stdin to prevent shell injection The modify() function in autoresearch/commands/run.ts interpolated a prompt string — built from git log messages and scope file names — directly into a shell command executed by execSync. The double-quote escaping only handled literal quotes, leaving $(...), backticks and backslashes able to trigger command substitution. Switch to the same pattern already used in autoresearch/commands/fix.ts: pass the prompt via the execSync 'input' option so it is delivered on stdin and never parsed by the shell. * fix(autoresearch): invoke Claude without a shell --------- Co-authored-by: OpenCLI-sol <opencli-sol@users.noreply.github.com>