Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions ui/server/routes/commands.js
Original file line number Diff line number Diff line change
Expand Up @@ -489,7 +489,7 @@
// Check if PILOTDECK.md exists
let exists = false;
try {
await fs.access(pilotDeckMdPath);

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
exists = true;
} catch (err) {
// File doesn't exist
Expand Down Expand Up @@ -751,10 +751,10 @@
let installed = false;
let skillMeta = null;
try {
await fs.access(path.join(installPath, 'SKILL.md'));

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
installed = true;
try {
const content = await fs.readFile(path.join(installPath, 'SKILL.md'), 'utf8');

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
const { data: fm } = parseFrontmatter(content);
skillMeta = {
name: fm.name || slug,
Expand Down Expand Up @@ -979,7 +979,7 @@
*/
router.post('/execute', async (req, res) => {
try {
const { commandName, commandPath, args = [], context = {} } = req.body;
const { commandName, commandPath, args = [], rawArgs, rawInput, context = {} } = req.body;

if (!commandName) {
return res.status(400).json({
Expand All @@ -997,7 +997,7 @@
command: commandName
});
} catch (error) {
console.error(`Error executing built-in command ${commandName}:`, error);

Check failure

Code scanning / CodeQL

Use of externally-controlled format string High

Format string depends on a
user-provided value
.
return res.status(500).json({
error: 'Command execution failed',
message: error.message,
Expand All @@ -1014,11 +1014,18 @@
const isBundledStub = BUNDLED_SKILL_STUBS.some(
(stub) => stub.name === commandName,
);
const buildPassthroughContent = () => {
if (typeof rawInput === 'string' && rawInput.trimStart().startsWith(commandName)) {
return rawInput.trim();
}
const argsString = typeof rawArgs === 'string'
? rawArgs.trimStart()
: args.join(' ').trim();
return argsString ? `${commandName} ${argsString}` : commandName;
};

if (isBundledStub) {
const argsString = args.join(' ').trim();
const passthroughContent = argsString
? `${commandName} ${argsString}`
: commandName;
const passthroughContent = buildPassthroughContent();
return res.json({
type: 'custom',
command: commandName,
Expand All @@ -1033,10 +1040,7 @@
// SKILL.md body into chat. Instead, passthrough the slash text so the
// proxy's slash parser invokes SkillTool with the procedural body.
if (commandPath && /\/\.pilotdeck\/skills\/[^/]+\/SKILL\.md$/i.test(commandPath)) {
const argsString = args.join(' ').trim();
const passthroughContent = argsString
? `${commandName} ${argsString}`
: commandName;
const passthroughContent = buildPassthroughContent();
return res.json({
type: 'custom',
command: commandName,
Expand Down Expand Up @@ -1074,7 +1078,7 @@
if (!allowedBases.some(isUnder)) {
return res.status(403).json({
error: 'Access denied',
message: 'Command must be in a .pilotdeck/commands or .pilotdeck/skills directory'

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
});
}
}
Expand Down
12 changes: 7 additions & 5 deletions ui/src/components/chat/hooks/useChatComposerState.ts
Original file line number Diff line number Diff line change
Expand Up @@ -434,9 +434,10 @@ export function useChatComposerState({

try {
const effectiveInput = rawInput ?? input;
const commandMatch = effectiveInput.match(new RegExp(`${escapeRegExp(command.name)}\\s*(.*)`));
const args =
commandMatch && commandMatch[1] ? commandMatch[1].trim().split(/\s+/) : [];
const rawArgs = effectiveInput.startsWith(command.name)
? effectiveInput.slice(command.name.length).trimStart()
: '';
const args = rawArgs.trim() ? rawArgs.trim().split(/\s+/) : [];

const context = {
projectPath: selectedProject.fullPath || selectedProject.path,
Expand All @@ -455,6 +456,8 @@ export function useChatComposerState({
commandName: command.name,
commandPath: command.path,
args,
rawArgs,
rawInput: effectiveInput,
context,
}),
});
Expand Down Expand Up @@ -635,8 +638,7 @@ export function useChatComposerState({
if (skipSlashDetectionOnceRef.current) {
skipSlashDetectionOnceRef.current = false;
} else if (trimmedInput.startsWith('/')) {
const firstSpace = trimmedInput.indexOf(' ');
const commandName = firstSpace > 0 ? trimmedInput.slice(0, firstSpace) : trimmedInput;
const commandName = trimmedInput.match(/^(\S+)/)?.[1] ?? trimmedInput;
const matchedCommand = slashCommands.find((cmd: SlashCommand) => cmd.name === commandName);
if (matchedCommand) {
executeCommand(matchedCommand, trimmedInput);
Expand Down