Repository navigation
Shell syntax passed to run() across multiple tools #302
Description
Bug
run() in src/lib/git.ts uses execFileSync (no shell), but many tools pass strings containing shell syntax like 2>/dev/null, ||, pipes, and < file redirects. These get split on whitespace and passed as literal git args, causing silent failures.
Affected files
src/tools/token-audit.ts—2>/dev/null,wc -l < filesrc/tools/enrich-agent-task.ts—greppipes,2>/dev/nullsrc/tools/clarify-intent.ts—pnpm tsc --noEmit 2>&1 | grep,find ... 2>/dev/nullsrc/tools/audit-workspace.ts—2>/dev/null,find ... | wc -lsrc/tools/sharpen-followup.ts—2>/dev/nullsrc/tools/session-handoff.ts—command -v ... 2>/dev/null,|| echosrc/tools/sequence-tasks.ts—git ls-files 2>/dev/null | headsrc/tools/checkpoint.ts—git reset HEAD 2>/dev/nullsrc/tools/scan-sessions.ts— various
Fix
Each call needs to be converted to use array args with run(), and non-git commands (wc, find, grep) need their own execFileSync calls or Node.js equivalents.
PR #301 fixes what-changed.ts as a start.
Activity
fix(#302): remove shell syntax from run() calls in 4 tools
fix(#302): remove shell syntax from run() calls in 4 more tools
fix: remove shell syntax from run() in 4 tools (#302)
fix: remove shell syntax from run() calls in 4 tools (#302)
TerminalGravity commentedon Mar 20, 2026
PR #306 fixes 4 more tools: checkpoint, sharpen-followup, sequence-tasks, session-handoff.
Still affected (need follow-up PRs):
token-audit.tsenrich-agent-task.tsclarify-intent.tsaudit-workspace.tsverify-completion.tsTerminalGravity commentedon Mar 20, 2026
Status update on the full fix:
✅ Merged/ready:
what-changed.tscheckpoint.ts,sharpen-followup.ts,sequence-tasks.ts,session-handoff.ts(CI green, reviewed)audit-workspace.ts,clarify-intent.ts,enrich-agent-task.ts,token-audit.ts🧹 Superseded (can close): #300, #303, #305
verify-completion.ts(mentioned in your earlier comment) — is that covered by one of the existing PRs or does it need its own?Once #301, #304, and #306 all land, this issue should be fully resolved.
fix: replace shell syntax in run() calls with safe array args (#302)
fix: convert shell syntax to array args in 4 tools (#302)
fix(audit-workspace): replace shell syntax with array args and Node.js