claude-code-action

mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-03 09:48:31 +08:00

History

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash (#1350 )

* fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash

shell-quote's parse() tokenizes unquoted `(`, `)` as control operators
and barewords containing `*` as glob ops, all returned as non-string
objects. parseClaudeArgsToExtraArgs filtered those out, so an unquoted
`--allowedTools View,Bash(gh:*),Bash(cat:*)` collapsed to bare `Bash` —
silently widening scoped permission rules to unrestricted Bash(*).

Escape shell control metachars to Unicode private-use placeholders
before parse() and restore after; extract .pattern from glob ops.
Preserves existing quote/whitespace handling.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ci: retrigger

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-06-13 22:45:14 -07:00

mcp-test

fix: resolve high vulnerability CVE-2025-66414 (#792 )

2026-01-07 12:53:45 +05:30

execution-file.test.ts

fix: write execution file when SDK throws (#1255 )

2026-05-14 15:37:28 -07:00

install-plugins.test.ts

feat: support local plugin marketplace paths (#761 )

2026-01-05 16:13:32 +05:30

parse-sdk-options.test.ts

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash (#1350 )