ruvnet e855ae2e4e chore(release): 3.39.2 -> 3.39.3 ...

Ships #3250: the agentbbs MCP tools gated on `await import('agentbbs')`, but the
published package is a CLI-only launcher with no importable entry point, so all
four federation_bbs_* tools reported degraded regardless of install state.
Replaced with a subprocess probe.

Includes the follow-up hardening: the probe's shell is now gated to win32
instead of always on. The probed binary comes from AGENTBBS_BIN, and under a
shell that argument is command-interpreted, so a crafted value executed a
trailing command (verified locally). POSIX now spawns without a shell.

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_013u4pmL9ZUAXb6usVQgNo67

2026-09-09 16:26:04 -04:00

4.9 KiB

Raw Permalink Blame History

View Raw