mirror of
https://github.com/nexu-io/open-design.git
synced 2026-10-27 09:51:12 +01:00
pftomandClaude Opus 4.7
dd0f00f9d2
- When `resolveAgentBin` returns null we now emit a friendly SSE `error` pointing at /api/agents and end the stream, instead of silently falling back to spawn(def.bin) — which would re-introduce the exact issue #10 symptom this PR is meant to prevent. - Strengthen the comment around `shell: true` on Windows: call out that the only thing keeping user-controlled prompt text safe today is Node's CVE-2024-27980 escaper, that the proper fix is to route the composed prompt through child stdin (not a new `-p $prompt`-style flag), and that cmd.exe's ~8191-char command-line cap reintroduces an ENAMETOOLONG-class failure for long prompts under shell:true. - Document why the `.cmd`/`.bat` regex is the right gate: those are the only PATHEXT extensions that strictly need cmd.exe; `.exe`/`.com` launch directly and `.ps1`/`.vbs` would need a different host that shell:true (=cmd.exe) wouldn't help with. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>