[VasiliyRad]

The bug (security)

pressKeyTool in src/inline-tools.ts accepted an optional app parameter and embedded it raw in an AppleScript command:

```ts
if (app) {
execSync(`osascript -e 'tell application "${app}" to activate'`, ...);
}
```

A value containing \" breaks out of the AppleScript string literal and injects arbitrary AppleScript. AppleScript supports do shell script \"...\", so this is arbitrary code execution from a tool-call argument.

PoC (would have worked pre-fix):

```ts
pressKey({
key: 'space',
app: '"); do shell script "rm -rf ~/sensitive"; tell application "Finder',
})
```

The resulting AppleScript runs do shell script \"rm -rf ~/sensitive\".

Why this is the right fix

Two other call sites in the same file already use the correct escape pattern:

Line	Tool	Escape var
~161	pressKeyTool (key fallback path)	safeKey
~214	switchAppTool.execute	safeApp

Only pressKeyTool's app-activation branch was missing the escape. Apply the same 3-step strip (backslash, single-quote, double-quote). No new abstraction needed — local fix where the bug lives, matches the established in-file pattern.

Tests

tests/inline-tools-press-key-app-escape.test.ts — 4 source-grep architectural assertions:

Case	Pins
raw tell application \"\${app}\" pattern absent	Pre-fix pattern fails here.
pressKey branch references safeApp	Post-fix shape.
safeApp computed via .replace() chain	All 3 strips present.
Chain includes \" strip	The actual exploit vector defense.

Source-grep is the right shape — the actual execSync call spawns osascript and is OS-dependent; the security contract is "escape app before embedding," which grep verifies precisely.

All 4 pass locally. npm run typecheck clean.

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[sonichi]

LGTM. Verified the bug: ${app} was interpolated raw into the osascript -e 'tell application "${app}" to activate' string; app: '"; do shell script "..."; tell application "Finder' would close out the AppleScript string literal and inject arbitrary AppleScript (which can do shell script → RCE from a tool-call argument).

The fix is the right shape — same triple-replace safeApp pattern already used by safeKey (line ~161) and switchAppTool (line ~214); reusing the established in-file canon rather than introducing a new abstraction. Order is correct: backslash → single-quote → double-quote, so later-inserted \ chars don't get double-escaped.

Test is a source-grep regression guard rather than a runtime test — appropriate for "future refactor must not re-introduce the raw interpolation," since runtime AppleScript tests need a real Mac with the target app.