feat(validation): reject shell-string command in MCP stdio entries#809

Merged

danielmeppiel merged 13 commits intomainfrom

feat/mcp-stdio-shell-string-validation

Apr 21, 2026

Commits on Apr 20, 2026

feat(transport): TransportSelector + strict-by-default transport (#778)

danielmeppiel
and
Copilot
committed
test(transport): wave-3 unit + integration matrix; fix per-attempt clone env

danielmeppiel
and
Copilot
committed
docs(transport): document strict-by-default transport selection (#778)

danielmeppiel
and
Copilot
committed
chore: revert accidental uv.lock churn (no dependency change in this PR)

danielmeppiel
and
Copilot
committed
docs+changelog: address copilot review feedback (#779)

danielmeppiel
and
Copilot
committed
Address PR #779 review feedback

danielmeppiel
and
Copilot
committed
fix(install): MARKETPLACE_PLUGIN beats HOOK_PACKAGE in detection cascade (#780)

danielmeppiel
and
Copilot
committed
Merge branch 'main' into fix/issue-780-package-type-detection
danielmeppiel
authored
Address PR #781 review: broaden detect_package_type with .claude-plugin/ evidence

danielmeppiel
and
Copilot
committed