v2.4.1 — Security fix for aidex_screenshot

Security release — please update.

Command injection in aidex_screenshot fixed

Advisory: GHSA-xwqr-wrm9-h3jx · CWE-78 · High

• macOS: filename / save_path ended up unescaped in shell command strings (screencapture, sips, rm, osascript). All tools now run via execFileSync with argument arrays — no shell involved. The window title is passed to AppleScript as an argument instead of being spliced into the script.
• Windows: window_title could evaluate $(...) inside a PowerShell string. The scripts are now static; all values are handed over as environment variables.
• Validation: filename must be a plain file name with .png/.jpg/.jpeg; save_path must be an existing directory (no longer created automatically); numeric parameters are type-checked at runtime.
• Linux was not affected.

Many thanks to Niklas Klutz (@nik-kl) for the responsible disclosure, including a proof of concept and a fix proposal.

Also fixed

• aidex_global_init: nested CMake/Make/Meson sub-builds inside a C/C++ project (vendored libraries like ggml) are no longer registered as dozens of separate projects.

npm install -g aidex-mcp@latest