aidp 0.49.10 → 0.49.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2edfd145fd098c930d76688336659919ad8fa5a4df4cb9f5c3aa5434a60d425f
-  data.tar.gz: c5a1a71bd5adb17cd850484964f11750e7d10e7d5c05e9aa366c89f700794d31
+  metadata.gz: 7aebc32c94a99c769c32718c0d1831888e9d7e9e16eb2968f64e9fd8e1d04b23
+  data.tar.gz: 10380f1bfa01c5154d3aa19be32a67b8e757a66c27b1e8bb128769787357d194
 SHA512:
-  metadata.gz: 21667ac8aae592117e34e738b74eb3b01c2f941a9a5672f54ae6e1549bff56289e5bf62e568caf6a08b3a492d17db22e01ba4d28e1a2944e2259d6214a83a2b4
-  data.tar.gz: d4f213b4e236003cccbdb5dbbb5dd41be6e9ce4448cdbda52900a0f651a6939d1801cfe201d3ef35b9ed2218caa04f8aa130e8d5479e3eeccf4cefdda2be615b
+  metadata.gz: e5b4b81a0662bbc8e5d6b2a4ecdbc0104f14cef44898cd01c219ed1a09ae53218afa89cb5178acc2a4361eee3d0ff1081fd32cdf225a4df3862168081b3140d5
+  data.tar.gz: '02699b7be327242d960f268f972b6fd38984d251878bca63b2075dceeae3383ac3ca82a42f182755da16263754e5a701581a5d6eeb3436980df7ff4c1c85384f'

data/lib/aidp/cli/security_command.rb

@@ -342,12 +342,13 @@ module Aidp
           return 0
         end
 
-        # Run RSpec with timeout protection
-        cmd = "bundle exec rspec #{rspec_path} --format failures"
-        @prompt.say("$ #{cmd}\n")
+        # Run RSpec with timeout protection, passing arguments without shell
+        # interpretation of the library-provided project path
+        command_args = ["bundle", "exec", "rspec", rspec_path, "--format", "failures"]
+        @prompt.say("$ #{command_args.join(" ")}\n")
         @prompt.say("(timeout: #{AUDIT_TIMEOUT_SECONDS / 60} minutes)\n")
 
-        exit_status = run_with_timeout(cmd, AUDIT_TIMEOUT_SECONDS)
+        exit_status = run_with_timeout(command_args, AUDIT_TIMEOUT_SECONDS)
 
         case exit_status
         when 0
@@ -365,11 +366,11 @@ module Aidp
       private
 
       # Run a command with timeout protection
-      # @param cmd [String] The command to execute
+      # @param command_args [Array<String>] The command and its arguments
       # @param timeout [Integer] Timeout in seconds
       # @return [Integer, Symbol] Exit status or :timeout
-      def run_with_timeout(cmd, timeout)
-        pid = spawn(cmd)
+      def run_with_timeout(command_args, timeout)
+        pid = Process.spawn(*command_args)
         start_time = Time.now
 
         loop do

data/lib/aidp/execute/checkpoint.rb

@@ -3,6 +3,7 @@
 require "yaml"
 require "time"
 require "json"
+require "open3"
 require "aidp/rescue_logging"
 
 module Aidp
@@ -183,7 +184,8 @@ module Aidp
       def run_rubocop_check
         # Run rubocop and parse output to get a quality score
         # This is a simplified version - could be enhanced
-        result = `cd #{@project_dir} && rubocop --format json 2>/dev/null`
+        stdout, _stderr, _status = Open3.capture3("rubocop", "--format", "json", chdir: @project_dir)
+        result = stdout
         return nil if result.empty?
 
         data = JSON.parse(result)

data/lib/aidp/execute/interactive_repl.rb

@@ -2,6 +2,7 @@
 
 require "tty-prompt"
 require "tty-spinner"
+require "open3"
 require_relative "async_work_loop_runner"
 require_relative "repl_macros"
 require_relative "../rescue_logging"
@@ -307,9 +308,9 @@ module Aidp
           }
         end
 
-        # Execute reset
-        output = `git reset --hard HEAD~#{count} 2>&1`
-        success = $?.success?
+        # Execute reset without shell interpretation of the rollback count
+        output, status = Open3.capture2e("git", "reset", "--hard", "HEAD~#{count}")
+        success = status.success?
 
         {
           success: success,

data/lib/aidp/execute/work_loop_runner.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "open3"
 require_relative "prompt_manager"
 require_relative "prompt_evaluator"
 require_relative "checkpoint"
@@ -2359,8 +2360,9 @@ module Aidp
 
         stats = {}
         files.each do |file|
-          # Use git diff to get line counts
-          output = `git diff --numstat HEAD -- "#{file}" 2>/dev/null`.strip
+          # Use git diff to get line counts without shell interpretation of file names
+          stdout, _stderr, _status = Open3.capture3("git", "diff", "--numstat", "HEAD", "--", file.to_s)
+          output = stdout.strip
           next if output.empty?
 
           parts = output.split("\t")

data/lib/aidp/harness/completion_checker.rb

@@ -64,27 +64,27 @@ module Aidp
         test_commands = detect_test_commands
         return true if test_commands.empty?
 
-        test_commands.any? do |cmd|
-          system("cd #{@project_dir} && #{cmd} > /dev/null 2>&1")
-        end
+        test_commands.any? { |cmd| run_project_command(cmd) }
       end
 
       def linting_clean?
         lint_commands = detect_lint_commands
         return true if lint_commands.empty?
 
-        lint_commands.all? do |cmd|
-          system("cd #{@project_dir} && #{cmd} > /dev/null 2>&1")
-        end
+        lint_commands.all? { |cmd| run_project_command(cmd) }
       end
 
       def build_successful?
         build_commands = detect_build_commands
         return true if build_commands.empty?
 
-        build_commands.any? do |cmd|
-          system("cd #{@project_dir} && #{cmd} > /dev/null 2>&1")
-        end
+        build_commands.any? { |cmd| run_project_command(cmd) }
+      end
+
+      # Run a detected command in the project directory without building a
+      # shell command string from the library-provided project path
+      def run_project_command(cmd)
+        system(cmd, chdir: @project_dir, out: File::NULL, err: File::NULL)
       end
 
       def documentation_complete?

data/lib/aidp/init/runner.rb

@@ -357,9 +357,9 @@ module Aidp
 
           next unless tool_command
 
-          # Check if command exists
+          # Check if command exists without shell interpretation
           begin
-            unless system("which #{tool_command} > /dev/null 2>&1")
+            unless system("which", tool_command, out: File::NULL, err: File::NULL)
               warnings << "   ⚠️  #{format_tool(tool_data[:tool])} detected but command '#{tool_command}' not found in PATH"
             end
           rescue IOError

data/lib/aidp/pr_worktree_manager.rb

@@ -1,6 +1,5 @@
 require "json"
 require "fileutils"
-require "shellwords"
 
 module Aidp
   # Manages worktrees specifically for Pull Request branches
@@ -151,17 +150,18 @@ module Aidp
             branch == "* #{base_branch}"
         end
 
-        # Enhance branch tracking and fetching
+        # Enhance branch tracking and fetching; argv execution keeps the
+        # library-provided branch name from being interpreted by a shell
         unless base_branch_exists
           # Try multiple fetch strategies
           fetch_commands = [
-            "git fetch origin #{base_branch}:#{base_branch} 2>/dev/null",
-            "git fetch origin 2>/dev/null",
-            "git fetch --all 2>/dev/null"
+            ["git", "fetch", "origin", "#{base_branch}:#{base_branch}"],
+            ["git", "fetch", "origin"],
+            ["git", "fetch", "--all"]
           ]
 
-          fetch_commands.each do |fetch_cmd|
-            @shell_executor.system(fetch_cmd)
+          fetch_commands.each do |fetch_args|
+            @shell_executor.system(*fetch_args, err: File::NULL)
             branch_list_output = `git branch -a`.split("\n").map(&:strip)
             base_branch_exists = branch_list_output.any? do |branch|
               branch.end_with?("/#{base_branch}", "remotes/origin/#{base_branch}") ||
@@ -174,14 +174,15 @@ module Aidp
 
         raise ArgumentError, "Base branch '#{base_branch}' does not exist in the repository" unless base_branch_exists
 
-        # Robust worktree creation with enhanced error handling and logging
-        worktree_create_command = "git worktree add #{Shellwords.escape(worktree_path)} -b #{Shellwords.escape(head_branch)} #{Shellwords.escape(base_branch)}"
-        unless @shell_executor.system(worktree_create_command)
+        # Robust worktree creation with enhanced error handling and logging;
+        # argv execution keeps library-provided branches and paths literal
+        worktree_create_args = ["git", "worktree", "add", worktree_path, "-b", head_branch, base_branch]
+        unless @shell_executor.system(*worktree_create_args)
           error_details = {
             pr_number: pr_number,
             base_branch: base_branch,
             head_branch: head_branch,
-            command: worktree_create_command
+            command: worktree_create_args.join(" ")
           }
           Aidp.log_error(
             "pr_worktree_manager", "worktree_creation_failed",
@@ -377,9 +378,9 @@ module Aidp
           end
         end
 
-        # Stage only successfully modified files
+        # Stage only successfully modified files without shell interpretation
         unless successful_files.empty?
-          @shell_executor.system("git add #{successful_files.map { |f| Shellwords.escape(f) }.join(" ")}")
+          @shell_executor.system("git", "add", "--", *successful_files)
         end
       end
 
@@ -428,7 +429,7 @@ module Aidp
 
       Dir.chdir(worktree_path) do
         # Check staged changes with more robust capture
-        staged_changes_output = @shell_executor.run("git diff --staged --name-only").strip
+        staged_changes_output = @shell_executor.run_argv("git", "diff", "--staged", "--name-only").stdout.strip
 
         if !staged_changes_output.empty?
           push_result[:git_actions][:staged_changes] = true
@@ -493,8 +494,10 @@ module Aidp
       existing_worktree = @worktrees[pr_number.to_s]
       return false unless existing_worktree
 
-      # Remove git worktree
-      @shell_executor.system("git worktree remove #{existing_worktree["path"]}") if File.exist?(existing_worktree["path"])
+      # Remove git worktree without shell interpretation of registry data
+      if File.exist?(existing_worktree["path"])
+        @shell_executor.system("git", "worktree", "remove", existing_worktree["path"])
+      end
 
       # Remove from registry and save
       @worktrees.delete(pr_number.to_s)

data/lib/aidp/shell_executor.rb

@@ -3,8 +3,9 @@
 module Aidp
   # Shell command executor wrapper for testability
   #
-  # Provides two modes of execution:
-  # 1. `run(command)` - Captures output silently via backticks
+  # Commands are always executed in argument form so shell
+  # metacharacters in any value are treated as literal data:
+  # 1. `run_argv(*command)` - Captures output without shell interpretation
   # 2. `system(*args)` - Wraps Kernel.system() with optional output suppression
   #
   # In tests, set `ShellExecutor.suppress_output = true` to suppress all
@@ -51,14 +52,6 @@ module Aidp
       end
     end
 
-    # Run a command and capture its output
-    #
-    # @param command [String] The shell command to run
-    # @return [String] The command's stdout output
-    def run(command)
-      `#{command}`
-    end
-
     # Run a command without shell interpretation and capture its output
     #
     # The command and its arguments are passed directly to the operating

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.49.10"
+  VERSION = "0.49.12"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.49.10
+  version: 0.49.12
 platform: ruby
 authors:
 - Bart Agapinan