From 09457ed730ad7c4b9dedf4f6b067c044a56cd980 Mon Sep 17 00:00:00 2001
From: LukeMackin <luke@yuzu-gca.dev>
Date: Wed, 22 Jul 2026 20:55:57 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20exec=E5=91=BD=E4=BB=A4=E6=AD=A3=E5=88=99?=
 =?UTF-8?q?=E6=94=BE=E5=AE=BD=E2=80=94=E5=85=81=E8=AE=B8=E5=85=A8=E9=83=A8?=
 =?UTF-8?q?ASCII=E5=8F=AF=E6=89=93=E5=8D=B0=E5=AD=97=E7=AC=A6(=E5=BC=95?=
 =?UTF-8?q?=E5=8F=B7/=E7=AE=A1=E9=81=93=E7=AD=89)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/server/src/tools.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/server/src/tools.ts b/packages/server/src/tools.ts
index 137f777..404be2f 100644
--- a/packages/server/src/tools.ts
+++ b/packages/server/src/tools.ts
@@ -55,7 +55,7 @@ export async function file_move(args: { from: string; to: string }): Promise<any
 // ── C-008: exec ─────────────────────────────────────────────
 function sanitizeCommand(cmd: string): string {
   // Allow: alphanumeric, dash, slash, dot, colon, underscore, space, equals, comma
-  if (/[^a-zA-Z0-9_./\-: =,]/.test(cmd)) throw new Error(`Dangerous chars: ${cmd.slice(0,50)}`);
+  if (/[^\x20-\x7E]/.test(cmd)) throw new Error(`Unsafe chars: ${cmd.slice(0,50)}`);
   return cmd;
 }