Repository navigation
Several tools pass shell syntax to run() which uses execFileSync #89
Description
Bug
run() in src/lib/git.ts uses execFileSync (no shell). Several tools pass strings with shell operators (||, &&, 2>/dev/null, |) that get split on whitespace and passed as literal git arguments, silently failing.
Fixed in #88: what-changed.ts, checkpoint.ts
Still affected:
token-audit.ts— useswc -l < ...,tail -cvia run()verify-completion.ts— usesnpx tsc --noEmit 2>&1 | tailvia run()enrich-agent-task.ts— usesgit ls-files | head | grepvia run()scope-work.ts— usesgit ls-files | head | grepvia run()session-handoff.ts— usescommand -vvia run()
These need to either:
- Use array args with proper fallback logic (like
getDiffFiles) - Use a separate
execSyncwithshell: truefor non-git commands - Use Node APIs directly (e.g.
fs.statSyncinstead ofwc)
Activity
TerminalGravity commentedon Mar 4, 2026
Good catch documenting all the affected tools. #88 handles what-changed and checkpoint — reviewed and it looks clean.
For the remaining ones, here's how I'd approach each:
Use Node APIs directly (best):
token-audit.ts—wc -l→fs.readFileSync().split('\n').length,tail -c→Buffer.byteLengthsession-handoff.ts—command -v→whichpackage or try/catchexecFileSyncUse array args + JS logic:
enrich-agent-task.ts/scope-work.ts—git ls-filesas array args, then.split('\n').slice(0, N)and.filter()in JS instead of piping toheadandgrepUse execSync with shell: true (last resort):
verify-completion.ts—npx tsc --noEmit 2>&1 | tailis genuinely a shell pipeline; either useexecSyncwithshell: trueor split into two stepsI can take the follow-up PR if needed.
fix: replace shell syntax in run() calls with shell() helper (#89)
fix: use shell() for commands needing pipes/redirects in 5 tools
fix: replace shell syntax in run() calls with runShell/Node APIs
fix: replace shell syntax in run() calls with proper APIs
fix: convert remaining run() shell syntax to array args
fix: replace shell syntax in run() calls with proper APIs (#89)
fix: replace shell syntax in run() calls with shellRun() and Node APIs
TerminalGravity commentedon Mar 5, 2026
Fixed in a7c6cc5 — all shell-syntax calls now use shellRun() or Node APIs.
fix: replace remaining run() calls using shell syntax with shellRun()