Skip to content

fix: replace shell syntax in run() calls across 8 tools#175

Closed
TerminalGravity wants to merge 1 commit intomainfrom
fix/shell-syntax-remaining-tools
Closed

fix: replace shell syntax in run() calls across 8 tools#175
TerminalGravity wants to merge 1 commit intomainfrom
fix/shell-syntax-remaining-tools

Conversation

@TerminalGravity
Copy link
Collaborator

Fixes #172

run() uses execFileSync('git', args) — no shell. Many tools were passing shell operators and non-git commands through it, silently breaking.

Changes across 8 tools:

  • Added shell() helper to git.ts for commands needing shell interpretation
  • Replaced run('git status --porcelain 2>/dev/null')run(['status', '--porcelain'])
  • Replaced run('cat package.json')readFileSync()
  • Replaced run('wc -l < file') → Node.js fs
  • Replaced run('git ls-files | grep | head') → array args + JS filtering
  • Replaced run('npm build | tail')shell()

Build passes clean. All 10 files touched, net +34 lines.

@TerminalGravity
Copy link
Collaborator Author

Reviewed — this looks good to merge. The shell() helper is clean, and the JS-native replacements for wc, cat, head, grep are the right call.

Two things to check before merging:

  1. token-audit.ts uses statSync — make sure { statSync } is in the fs import
  2. package-lock.json bumps node engine to >=20 — intentional or lockfile regen artifact? If intentional, might warrant a note in the PR description

This supersedes #173, #171, #170, and #165 — close those once this lands.

Copy link
Collaborator Author

@TerminalGravity TerminalGravity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Solid fix — the approach is clean. Array args for run(), Node.js fs for file ops, execFileSync for the stuff that genuinely needs a shell. A few things:

  1. This branch includes the examples/.preflight/ files from #174. Looks like the branch wasn't rebased cleanly — the config example commits ended up here too. Should rebase off main (after #174 merges) or cherry-pick just the fix commits.

  2. The shellRun helper in verify-completion.ts is good, but it's local to that file. Since session-handoff.ts also does inline execFileSync('gh', ...), might be worth pulling shellRun into lib/git.ts (or a new lib/shell.ts) so there's one pattern for "needs a real shell" calls. Not blocking, but worth considering before this grows.

  3. In audit-workspace.ts, the recursive countTests function is fine for now, but consider globSync from node:fs if you're on Node 22+ — cleaner than manual recursion.

The actual fixes look correct. The run([...]) array args pattern is right, the error handling is sensible. Just clean up the branch overlap with #174 and this is good to merge.

@TerminalGravity
Copy link
Collaborator Author

Heads up — #178 is a superset of this PR (covers the same files plus checkpoint.ts and adds the shellRun helper in git.ts). Recommend closing this in favor of #178 to avoid merge conflicts.

Replace shell pipes, redirects, and non-git commands that were passed
as literal args to execFileSync('git', args):

- verify-completion: use fs.readFileSync for package.json, execFileSync
  for tsc/test/build commands instead of run() with pipes
- token-audit: use fs for line counting and file size instead of wc/tail
- session-handoff: use 'which' + execFileSync('gh') instead of shell
- audit-workspace: use fs.readdirSync for test file counting
- sharpen-followup: use array args for git diff/status
- scope-work: use JS regex filter instead of shell grep pipes
- enrich-agent-task: use JS filter/slice instead of grep/head pipes
- sequence-tasks: use array args + JS slice instead of shell pipes

All 43 tests pass, clean build.
@TerminalGravity TerminalGravity force-pushed the fix/shell-syntax-remaining-tools branch from 0cec6fe to ae5ae50 Compare March 9, 2026 16:20
@TerminalGravity
Copy link
Collaborator Author

Closing in favor of #189 which is the latest iteration of this fix. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Systematic: shell syntax in git.run() calls across 8+ tools

1 participant