Problem

User input prompt (command in server/claude-cli.js:spawnClaude) was parsed as additional CLI options if it began with -. For example, --print --help would trigger the help screen instead of treating --help as text, causing unexpected behavior.

Reproduction

Open any session and send --help to Claude.

In the console output we can see:

🔍 Final Claude command will be: claude --print --help --output-format stream-json --verbose --mcp-config /home/user/.claude.json --model sonnet

Solution

Insert -- before the user-supplied command so it is always interpreted as a positional argument:

args.push('--print');
args.push('--');
args.push(command);

Fixed final command:

🔍 Final Claude command will be: claude --output-format stream-json --verbose --mcp-config /home/user/.claude.json --model sonnet --print -- --help

This ensures user input is treated as plain text, preventing flag injection across platforms.