From 1d8893d0cdc320c046c08722c8fcb26a0ce66e6e Mon Sep 17 00:00:00 2001 From: scanner Date: Thu, 8 Oct 2026 12:34:22 -0400 Subject: [PATCH 1/2] fix: label a literal-quote plain-form refusal as shell_metachars_refused Signed-off-by: scanner --- README.md | 2 +- windows/HotshotCapture.psm1 | 3 ++- windows/tests/hotshot-capture.tests.ps1 | 18 ++++++++++++++++++ 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index dbd494a..4a3cf1e 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ All platforms honor the same contract: | Clipboard: file URL / drop list | ✅ file URL | with CopyQ | ✅ file drop list | | CLI detection (focused terminal's processes) | `ps -t ` | `/proc` descendants | Win32_Process tree | | Claude Code → typed `[path] ` | ✅ | ✅ | ✅ | -| Copilot CLI / aider / OpenCode → bare escaped path | ✅ backslash-escaped | ✅ backslash-escaped | quoted if spaces | +| Copilot CLI / aider / OpenCode → bare escaped path | ✅ backslash-escaped | ✅ backslash-escaped | double-quoted if it contains spaces or shell metacharacters; refused if it contains `"`, `$` or `` ` `` | | Unknown CLI → bracketed default | ✅ | ✅ | ✅ | The rest of this page documents the **macOS** app. diff --git a/windows/HotshotCapture.psm1 b/windows/HotshotCapture.psm1 index a758816..9f83842 100644 --- a/windows/HotshotCapture.psm1 +++ b/windows/HotshotCapture.psm1 @@ -224,7 +224,8 @@ function Invoke-HotshotInjection { if ($NoType) { return } if (-not $Text) { $refusal = 'injection.control_chars_refused' - if ($ShotPath -notmatch '[\x00-\x1F\x7F\u2028\u2029]' -and (Test-HotshotShellMetacharacters -Path $ShotPath)) { + if ($ShotPath -notmatch '[\x00-\x1F\x7F\u2028\u2029]' -and + ((Test-HotshotShellMetacharacters -Path $ShotPath) -or $ShotPath -match '"')) { $refusal = 'injection.shell_metachars_refused' } Write-Warning (Format-HotshotDiagnostic -Severity WARN -Event $refusal ` diff --git a/windows/tests/hotshot-capture.tests.ps1 b/windows/tests/hotshot-capture.tests.ps1 index 04d04ae..61d209d 100644 --- a/windows/tests/hotshot-capture.tests.ps1 +++ b/windows/tests/hotshot-capture.tests.ps1 @@ -448,6 +448,24 @@ Describe 'Invoke-HotshotInjection' { "$w" | Should -Be 'hotshot [WARN] injection.shell_metachars_refused: path=' } + It 'warns injection.shell_metachars_refused (not control_chars) for a plain-form path refused for a literal quote' { + $fakes = $script:Fakes + Invoke-HotshotInjection -Text '' -TerminalHandle $script:Hwnd -ShotPath 'C:\Shots\a"b.png' ` + @fakes -WarningVariable w -WarningAction SilentlyContinue + + $script:Calls.Count | Should -Be 0 + "$w" | Should -Be 'hotshot [WARN] injection.shell_metachars_refused: path=' + } + + It 'labels the $ and backtick plain-form refusals as shell_metachars_refused' { + $fakes = $script:Fakes + foreach ($path in @('C:\Shots\$(id).png', 'C:\Shots\`x`.png')) { + Invoke-HotshotInjection -Text '' -TerminalHandle $script:Hwnd -ShotPath $path ` + @fakes -WarningVariable w -WarningAction SilentlyContinue + "$w" | Should -Be 'hotshot [WARN] injection.shell_metachars_refused: path=' + } + } + It 'reveals the path in the control_chars_refused warning when verbose logging is on' { $fakes = $script:Fakes $env:HOTSHOT_VERBOSE_LOGGING = '1' From 2847704f17b07e8df25fa70c6407870add745bfd Mon Sep 17 00:00:00 2001 From: scanner Date: Thu, 8 Oct 2026 14:11:15 -0400 Subject: [PATCH 2/2] ci: retrigger macOS Swift build (runner never scheduled on previous run) Signed-off-by: scanner