catlog22 ad6c18f615 fix(security): prevent command injection and strengthen input validation ...

BREAKING: executeCodexLens now uses shell:false to prevent RCE

Security fixes:
- Remove shell:true from spawn() to prevent command injection (CRITICAL)
- Add .env value escaping to prevent injection when file is sourced
- Strengthen path validation with startsWith to block subdirectories
- Add path traversal detection (../)
- Improve JSON extraction to handle trailing CLI output

Features:
- Refactor CodexLens panel to tabbed layout (Overview/Settings/Search/Advanced)
- Add environment variables editor for ~/.codexlens/.env
- Add API concurrency settings (max_workers, batch_size)
- Add escapeHtml() helper to prevent XSS
- Implement merge mode for env saving to preserve custom variables

2026-01-03 18:33:47 +08:00

..

classify-folders.ts

feat(ccw): migrate backend to TypeScript

2025-12-13 10:43:15 +08:00

claude-cli-tools.ts

feat: Implement multi-phase project analysis workflow with Mermaid diagram generation and CPCC compliance documentation

2025-12-26 11:44:29 +08:00

cli-config-manager.ts

Refactor CLI command usage from ccw cli exec to ccw cli -p for improved prompt handling

2025-12-18 14:12:45 +08:00

cli-executor.ts

fix(ccw): Add path validation for --cd parameter in CLI executor

2026-01-03 11:46:51 +08:00

cli-history-store.ts

feat(cli-executor): add streaming option and enhance output handling

2025-12-25 22:22:31 +08:00

codex-lens.ts

fix(security): prevent command injection and strengthen input validation

2026-01-03 18:33:47 +08:00

context-cache-store.ts

feat: Add context_cache MCP tool with simplified CLI options

2025-12-23 19:54:05 +08:00

context-cache.ts

feat: Add context_cache MCP tool with simplified CLI options

2025-12-23 19:54:05 +08:00

convert-tokens-to-css.ts

feat(ccw): migrate backend to TypeScript

2025-12-13 10:43:15 +08:00

core-memory.ts

feat: Enhance configuration management and embedding capabilities

2025-12-24 16:32:27 +08:00

detect-changed-modules.ts

feat(ccw): migrate backend to TypeScript

2025-12-13 10:43:15 +08:00

discover-design-files.ts

feat(ccw): migrate backend to TypeScript

2025-12-13 10:43:15 +08:00

edit-file.ts

feat: 实现 MCP 工具集中式路径验证，增强安全性和可配置性

2025-12-21 18:14:06 +08:00

generate-module-docs.ts

Add comprehensive tests for vector/semantic search functionality

2025-12-14 17:17:09 +08:00

get-modules-by-depth.ts

feat(ccw): migrate backend to TypeScript

2025-12-13 10:43:15 +08:00

index.ts

feat: Add context_cache MCP tool with simplified CLI options

2025-12-23 19:54:05 +08:00

litellm-client.ts

feat: Add unified LiteLLM API management with dashboard UI and CLI integration

2025-12-23 20:36:32 +08:00

litellm-executor.ts

test(litellm): add integration tests for retry and rate limiting

2025-12-29 15:14:03 +08:00

native-session-discovery.ts

feat: Enhance navigation and cleanup for graph explorer view

2025-12-15 23:11:01 +08:00

notifier.ts

feat: Implement Skills Manager View and Notifier Module

2025-12-14 11:12:48 +08:00

pattern-parser.ts

feat: Add context_cache MCP tool with simplified CLI options

2025-12-23 19:54:05 +08:00

read-file.ts

feat: 增加文件读取功能的行分页支持，优化智能搜索的多词查询匹配

2025-12-21 21:45:04 +08:00

resume-strategy.ts

feat: Implement resume strategy engine and session content parser

2025-12-13 20:29:19 +08:00

session-content-parser.ts

feat: Implement resume strategy engine and session content parser

2025-12-13 20:29:19 +08:00

session-manager.ts

fix(workflow): Add user choice for session completion and sync task status on archive

2026-01-03 11:36:20 +08:00

smart-context.ts

feat(dashboard): CLI settings UI and Smart Context support

2025-12-13 17:28:39 +08:00

smart-search.ts

feat: Add code analysis and LLM action templates with detailed configurations and examples

2026-01-03 17:37:49 +08:00

smart-search.ts.backup

fix: improve chunking logic in Chunker class and enhance smart search tool with comprehensive features

2025-12-20 21:44:15 +08:00

storage-manager.ts

feat: Enhance navigation and cleanup for graph explorer view

2025-12-15 23:11:01 +08:00

ui-generate-preview.js

test(ui-tools): add visual regression tests for preview generation

2025-12-29 16:15:12 +08:00

ui-instantiate-prototypes.js

feat(ccw): 添加 ccw tool exec 工具系统

2025-12-08 21:10:31 +08:00

update-module-claude.js

fix(tools): 修复CLI工具多行prompt的shell转义问题

2025-12-08 21:56:41 +08:00

write-file.ts

feat: 实现 MCP 工具集中式路径验证，增强安全性和可配置性

2025-12-21 18:14:06 +08:00