mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-06-11 02:33:10 +08:00
4f4654bf21
Lock in the behavior added by the previous commit. Each new case was verified to fail before the fix and pass after. Bypasses now blocked (exit 2): - \$(npm run dev) command substitution - \`npm run dev\` backtick substitution - echo \$(npm run dev) substitution inside an argument - (npm run dev) plain subshell group - \$(echo a; npm run dev) substitution containing a sequenced segment - (pnpm dev) plain subshell group, alt package manager Allow cases — explicitly proven NOT to regress so the fix doesn't over-block legitimate uses: - (tmux new-session -d -s dev "npm run dev") tmux launcher inside () - git commit -m '(npm run dev)' literal in single quotes - echo "(npm run dev)" literal in double quotes (bash does NOT subshell () inside double quotes) - git commit -m '\$(npm run dev) fix' literal in single quotes Single- and double-quote allow cases are important: they distinguish a real subshell construct from one that's just text inside a string, which is what `extractSubshellGroups` / `extractCommandSubstitutions` quote-awareness is for.