dev/disclaw
1
0
Fork 0
Code Issues 9 Pull requests 1 Projects Releases Packages Wiki Activity Actions
disclaw/tasks/DIS-002.md
Nick Tabeling 722d85c2a5
Some checks failed
CI / build-and-test (ubuntu-latest) (pull_request) Has been cancelled
Details
CI / build-and-test (windows-latest) (pull_request) Has been cancelled
Details
CI / lint (pull_request) Has been cancelled
Details
chore: update task board — Phase 0 and Phase 1 marked done 
All DIS-001 through DIS-110 set to status:done with merge dates.
BOARD.md reorganized with Done sections per phase.
Phase 1.5 Refinement epic added as planning placeholder.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 10:42:16 +02:00

1.7 KiB
Raw Blame History

id status phase priority labels branch assignee started pr merged
DIS-002 done 0 p0
phase:0
type:fix
priority:p0
security
phase-0/harden-spawn claude-agent null null 2026-04-08

DIS-002: shell: false + cross-spawn Windows-Fix im Runner

Ziel

Command-Injection über Discord-User-Input eliminieren. shell: true aus src/agent/runner.ts entfernen, durch cross-spawn ersetzen. Windows-.cmd-Wrapper wird korrekt aufgelöst, CVE-2024-27980 umgangen.

Kontext

src/agent/runner.ts nutzt aktuell shell: true → jeder Discord-Input landet in der Shell-Interpretation. spawn("claude", args, { shell: false }) schlägt auf Windows fehl (nur claude.cmd existiert). → docs/development-plan.md §2.2, docs/cli-feature-answers.md Frage 9.

Scope

  • In: cross-spawn + @types/cross-spawn als Dependencies · src/runtime/resolve-claude.ts: resolveClaude() liest CLAUDE_PATH, fällt auf where/which zurück, cached in-memory · runner.ts: shell: false, windowsHide: true, stdio: pipe, setEncoding("utf8")
  • Out: sanitizedEnv() (DIS-003) · --bare-Flags (DIS-004)

Definition of Done

  • Kein shell: true mehr im gesamten src/-Baum (grep -r "shell: true" src/ → leer)
  • cross-spawn in package.json#dependencies
  • resolveClaude() wirft klare Fehlermeldung wenn claude nicht auffindbar
  • Unit-Test tests/unit/resolve-claude.test.ts deckt: .env-Override, PATH-Fallback, Error bei Nichtfund
  • npm run build && npm test grün

Dateien (erwartet)

  • package.json
  • src/runtime/resolve-claude.ts
  • src/agent/runner.ts
  • tests/unit/resolve-claude.test.ts

Abhängigkeiten

Keine. Empfohlener Startpunkt — zuerst lösen.

Spec

→ docs/backlog.md #DIS-002