文件历史

提交图

作者	SHA1	备注	提交日期
jorgelaranjo	46817ecf1c	fix(security): require opt-in for extra command Require CLAUDE_HUD_ALLOW_EXTRA_CMD before executing --extra-cmd, tighten cache file permissions, and document the local command trust boundary. Maintainer follow-up removed generated dist artifacts from the PR and added extra opt-in parsing coverage. Verified locally with npm ci, npm test, and node --test tests/extra-cmd.test.js. Fixes #618.	2026-06-18 15:51:43 -04:00
Jarrod Watts	17475d3f61	fix(extra-cmd): improve robustness and add tests (#94 ) - Add debug logging for failures (uses DEBUG=claude-hud pattern) - Support --extra-cmd=value syntax (in addition to --extra-cmd value) - Reject empty values with debug warning - Add security comment explaining shell injection is intentional (user CLI input) - Export sanitize() for testability - Add 30 unit tests for sanitize, arg parsing, timeout, malformed JSON Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-19 16:11:23 +11:00

作者

SHA1

备注

提交日期

jorgelaranjo

46817ecf1c

fix(security): require opt-in for extra command

Require CLAUDE_HUD_ALLOW_EXTRA_CMD before executing --extra-cmd, tighten cache file permissions, and document the local command trust boundary. Maintainer follow-up removed generated dist artifacts from the PR and added extra opt-in parsing coverage. Verified locally with npm ci, npm test, and node --test tests/extra-cmd.test.js. Fixes #618.

2026-06-18 15:51:43 -04:00

Jarrod Watts

17475d3f61

fix(extra-cmd): improve robustness and add tests (#94 )

- Add debug logging for failures (uses DEBUG=claude-hud pattern)
- Support --extra-cmd=value syntax (in addition to --extra-cmd value)
- Reject empty values with debug warning
- Add security comment explaining shell injection is intentional (user CLI input)
- Export sanitize() for testability
- Add 30 unit tests for sanitize, arg parsing, timeout, malformed JSON

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

2026-01-19 16:11:23 +11:00

2 次代码提交