aidp 0.49.13 → 0.49.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5840a5dd1754c05dcb6fb0c8d2b96fecf2a093896caf19704d80397ad97f829c
-  data.tar.gz: '008354478b95ae1e16b8064ae0485c44aa930edec611e0b0aaa1a04da18ccaca'
+  metadata.gz: '0088a7c834709e32224adf25831bfd282f1f9a8019261b9055251699d8b5b99a'
+  data.tar.gz: b00f8596f8cc68cc26f13553a1f1e1c37f0e1d3a6fb7b21dc79ebbc704fede23
 SHA512:
-  metadata.gz: 0a3ca1a4fc8923f0599a85ea630a0d39e429790c1a718891e40e5e56d4d5a9170c72e03bf2d083567686e168391897dc15b8a3e4fc28c83569cb6aa0b2f7bac7
-  data.tar.gz: beb27cca39345af8ed6f546bd284ab1a90dd0b52336479cfe4399a1166ba70aa826f4108556ddbc33522de2a40033dff9791652a7d253043de4a5741cd441114
+  metadata.gz: dd15f595a34f2d6258eb0c62d787c0bdc78b18f69d09ea9cf7db26846badede64dc469ff9d3adc9a8a99c13d6bf2b3a6ca794744953883000331b380a7bd1de4
+  data.tar.gz: b3d0e0710c139d6a509cc7aaf1b07d205b3c1a35b38c61339fa6b83e3ca5ca14708547a7d0af32cf069841bdc7ded1cb493366ab1f672895056e21452e04dec3

data/lib/aidp/cli/issue_importer.rb

@@ -77,7 +77,7 @@ module Aidp
       return nil unless File.exist?(".git")
 
       # Try to get origin URL
-      stdout, _stderr, status = Open3.capture3("git remote get-url origin")
+      stdout, _stderr, status = Open3.capture3("git", "remote", "get-url", "origin")
       return nil unless status.success?
 
       origin_url = stdout.strip

data/lib/aidp/execute/deterministic_unit.rb

@@ -3,6 +3,7 @@
 require "yaml"
 require_relative "../message_display"
 require_relative "../rescue_logging"
+require_relative "../shell_executor"
 require_relative "../util"
 
 module Aidp
@@ -228,24 +229,22 @@ module Aidp
         end
 
         def build_default_command_runner
+          command_executor = ShellExecutor.new
           lambda do |command, _context|
-            require "tty-command"
-
-            cmd = TTY::Command.new(printer: :quiet)
-            result = cmd.run(command, chdir: @project_dir)
-
-            {
-              exit_status: result.exit_status,
-              stdout: result.out,
-              stderr: result.err
-            }
-          rescue TTY::Command::ExitError => e
-            result = e.result
+            result = command_executor.run_line(command, chdir: @project_dir)
             {
               exit_status: result.exit_status,
-              stdout: result.out,
-              stderr: result.err
+              stdout: result.stdout,
+              stderr: result.stderr
             }
+          rescue ArgumentError => e
+            # Rejected shell syntax or an unparseable command line (Shellwords
+            # raises ArgumentError for unbalanced quotes or NUL bytes)
+            {exit_status: 127, stdout: "", stderr: e.message}
+          rescue SystemCallError => e
+            # Spawn failures: missing binary (ENOENT), non-executable file
+            # (EACCES), directory used as command (EISDIR), and similar errnos
+            {exit_status: 127, stdout: "", stderr: e.message}
           end
         end
       end

data/lib/aidp/harness/test_runner.rb

@@ -301,7 +301,7 @@ module Aidp
       def execute_command_line(command)
         result = command_runner.run_line(command, chdir: @project_dir)
         [result.stdout, result.stderr, result]
-      rescue ArgumentError, Errno::ENOENT => e
+      rescue ArgumentError, SystemCallError => e
         result = ShellExecutor::Result.new(stdout: "", stderr: e.message, exit_status: 1)
         [result.stdout, result.stderr, result]
       end

data/lib/aidp/setup/wizard.rb

@@ -650,7 +650,7 @@ module Aidp
           q.validate(/\A[a-z0-9_]+\z/i, "Name must be alphanumeric with underscores")
         end
 
-        command = prompt.ask("Shell command to run:", required: true)
+        command = prompt.ask("Command to run (executed without a shell; no &&, ||, |, ;, redirects, or VAR=value prefixes):", required: true)
 
         category_choices = [
           ["Test (unit, integration, e2e)", :test],
@@ -1343,7 +1343,7 @@ module Aidp
         prompt.say("\n🔀 Pull Request Configuration")
 
         # Check if remote exists
-        has_remote = system("git remote -v > /dev/null 2>&1")
+        has_remote = system("git", "remote", "-v", out: File::NULL, err: File::NULL)
 
         unless has_remote
           prompt.say("No git remote detected. PR creation will be disabled.")

data/lib/aidp/shell_executor.rb

@@ -86,15 +86,33 @@ module Aidp
       argv = Shellwords.split(command.to_s)
       raise ArgumentError, "command must not be blank" if argv.empty?
 
-      # Operator tokens signal an intent to use shell features, which are
-      # intentionally unsupported here; reject them loudly rather than
-      # running them as literal arguments.
-      if argv.any? { |token| %w[&& || ; |].include?(token) || token.match?(/^[<>&]/) }
+      # A leading NAME=value token is a shell environment assignment; without
+      # a shell it would be treated as the program name and fail to run.
+      if argv.first.match?(/\A[A-Za-z_][A-Za-z0-9_]*=/)
+        raise ArgumentError,
+          "environment variable assignments are not supported; " \
+          "prefix the command with env (e.g. env VAR=value command)"
+      end
+
+      # Operator and redirection tokens signal an intent to use shell
+      # features, which are intentionally unsupported here; reject them
+      # loudly rather than running them as literal arguments. A leading file
+      # descriptor digit (e.g. `2>`) still introduces a shell redirect.
+      if argv.any? { |token| %w[&& || ; |].include?(token) || token.match?(/\A\d*[<>&]/) }
         raise ArgumentError,
           "shell operators are not supported in configured commands; " \
           "split into separate commands instead: #{command.inspect}"
       end
 
+      # A single token that still contains shell metacharacters would be
+      # handed to Process.spawn as a lone string, which Ruby routes through
+      # sh -c; reject it rather than let the shell interpret it.
+      if argv.length == 1 && argv.first.match?(/[*?\[\]{}()<>|;&$\\"'`\r\n~#=]/)
+        raise ArgumentError,
+          "shell metacharacters in a single-token command are not supported; " \
+          "split into program and arguments"
+      end
+
       stdout, stderr, status = Open3.capture3(*argv, **opts)
       Result.new(stdout: stdout, stderr: stderr, exit_status: status.exitstatus)
     end

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.49.13"
+  VERSION = "0.49.15"
 end

data/lib/aidp/watch/runner.rb

@@ -749,7 +749,7 @@ module Aidp
       # Capture git worktree context
       # @return [Hash] Worktree information
       def capture_worktree_context
-        return {} unless system("git rev-parse --git-dir > /dev/null 2>&1")
+        return {} unless system("git", "rev-parse", "--git-dir", out: File::NULL, err: File::NULL)
 
         {
           branch: `git rev-parse --abbrev-ref HEAD`.strip,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.49.13
+  version: 0.49.15
 platform: ruby
 authors:
 - Bart Agapinan