Alex Newman 57d865619f fix: upgrade shell-quote to 1.9.0 (CVE-2026-13311) (#4018) ...

Pin shell-quote to 1.9.0 in the plugin manifest, lockfile, root
devDependency, and build-hooks generator so a normal build cannot
regenerate the CVE-affected ^1.8.3 range.

Rebase of #3646.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>

2026-09-11 00:09:45 -07:00

..

anti-pattern-test

UX redesign: installer + provider rename + /learn-codebase + welcome card + SessionStart hint (#2255)

2026-05-02 16:05:56 -07:00

bug-report

fix: use health oracle and configured worker endpoint

2026-07-05 15:06:12 -07:00

openrouter-price-history

docs: add OpenRouter list-price history for expense reports

2026-09-09 04:18:24 +00:00

translate-readme

docs: refresh release docs and translations

2026-07-06 12:20:58 -07:00

build-hooks.js

fix: upgrade shell-quote to 1.9.0 (CVE-2026-13311) (#4018)

2026-09-11 00:09:45 -07:00

build-viewer.js

feat(worker): read-only Observation TV broadcast behind CLAUDE_MEM_TV_TOKEN

2026-09-05 17:59:00 -07:00

build-worker-binary.js

UX redesign: installer + provider rename + /learn-codebase + welcome card + SessionStart hint (#2255)

2026-05-02 16:05:56 -07:00

check-hook-io-discipline.cjs

refactor(hooks): plan-01 hook IO discipline — typed stdout/stderr/exit channels

2026-05-28 18:05:33 -07:00

check-pending-queue.ts

fix: use health oracle and configured worker endpoint

2026-07-05 15:06:12 -07:00

check-postinstall-allowlist.js

chore: remove unused dependencies (ponytail audit wave 2, P17)

2026-07-02 21:07:37 -07:00

check-spawn-env-discipline.cjs

fix(env): plan-06 worker env isolation — block effort vars, spawn-env discipline, $TIER

2026-05-28 18:22:47 -07:00

claude-mem-sync

feat: add claude-mem-sync for multi-machine observation synchronization (#1570)

2026-04-04 15:14:31 -07:00

clear-pending-queue.ts

Server-beta: Postgres storage + independent runtime + BullMQ queue (Phases 1–3) (#2351)

2026-05-08 01:20:07 -07:00

discord-release-notify.js

UX redesign: installer + provider rename + /learn-codebase + welcome card + SessionStart hint (#2255)

2026-05-02 16:05:56 -07:00

e2e-server-docker.sh

refactor(server): rename server-beta → server runtime (plan phase 1)

2026-05-29 14:01:34 -07:00

export-memories.ts

fix: harden startup and schema repair contracts

2026-05-06 18:29:26 -07:00

gen-plugin-lockfile.cjs

fix(build): enforce shipped dependency-closure boundary (plan-10, closes #2783) (#2800)

2026-06-05 20:27:34 -07:00

generate-changelog.js

UX redesign: installer + provider rename + /learn-codebase + welcome card + SessionStart hint (#2255)

2026-05-02 16:05:56 -07:00

grok-bot-session-inject.mjs

feat(grok-bot): Phase 1 hack-on-Memory JIT — rich timeline INDEX (#3959)

2026-09-10 13:50:20 -07:00

import-memories.ts

fix: use health oracle and configured worker endpoint

2026-07-05 15:06:12 -07:00

mirror-dir.cjs

fix(windows): address PR #3661 review and tester findings

2026-08-25 16:24:52 -07:00

pr-babysit-status.ts

fix: harden startup and schema repair contracts

2026-05-06 18:29:26 -07:00

regenerate-claude-md.ts

UX redesign: installer + provider rename + /learn-codebase + welcome card + SessionStart hint (#2255)

2026-05-02 16:05:56 -07:00

restart-marketplace-worker.cjs

fix(windows): make build-and-sync run without rsync or a POSIX shell

2026-08-19 10:02:55 -07:00

smoke-clean-room.cjs

fix(build): enforce shipped dependency-closure boundary (plan-10, closes #2783) (#2800)

2026-06-05 20:27:34 -07:00

strip-comments.ts

chore: remove over-engineering findings from repo-wide ponytail audit (wave 1)

2026-07-02 20:49:27 -07:00

sync-kill-switch-e2e.ts

feat(sync): complete SyncHub-only client cutover

2026-07-20 09:30:22 -07:00

sync-marketplace.cjs

fix(windows): reconcile rsync -a metadata on the quick-check path, bound the log tail

2026-08-19 10:26:55 -07:00

sync-matrix-e2e.ts

feat(sync): complete SyncHub-only client cutover

2026-07-20 09:30:22 -07:00

sync-plugin-manifests.js

fix: stop sync-plugin-manifests clobbering Cursor/Grok plugin copy

2026-09-05 05:22:19 +00:00

worker-logs.cjs

fix(windows): address PR #3661 review and tester findings

2026-08-25 16:24:52 -07:00