aidp 0.49.8 → 0.49.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c15551574a43168d1adfd3157dd3f8981c17972953e7f5285b355358e7cdc288
-  data.tar.gz: 37ef9124f109f9a615da64d86e938324bc4751322d7e32bfd39c9a93eb2f77f2
+  metadata.gz: 2edfd145fd098c930d76688336659919ad8fa5a4df4cb9f5c3aa5434a60d425f
+  data.tar.gz: c5a1a71bd5adb17cd850484964f11750e7d10e7d5c05e9aa366c89f700794d31
 SHA512:
-  metadata.gz: b1b634b25d0aacea5def51a4e57ccc26a636fed79d144a7e6fdd8ebe248ee735abe57446e0ba98ae369dfd150cfad3abbb309dd8455be315afe7d2cd48fe1c35
-  data.tar.gz: 1b61e3ff6de42b5008c44fe96ad786fdc5fee5ea25ccec925d754dd055ab59c87b4c218fb2af03a5ad6284f2a7fed9fc3fa4aa00873fed6cfc25028416d04768
+  metadata.gz: 21667ac8aae592117e34e738b74eb3b01c2f941a9a5672f54ae6e1549bff56289e5bf62e568caf6a08b3a492d17db22e01ba4d28e1a2944e2259d6214a83a2b4
+  data.tar.gz: d4f213b4e236003cccbdb5dbbb5dd41be6e9ce4448cdbda52900a0f651a6939d1801cfe201d3ef35b9ed2218caa04f8aa130e8d5479e3eeccf4cefdda2be615b

data/lib/aidp/pr_worktree_manager.rb

@@ -434,19 +434,16 @@ module Aidp
           push_result[:git_actions][:staged_changes] = true
           push_result[:changed_files] = staged_changes_output.split("\n")
 
-          # More robust commit command with additional logging
-          commit_message = "Changes applied via AIDP request-changes workflow for PR ##{pr_number}"
-          commit_command = "git commit -m '#{commit_message}' 2>&1"
-          commit_output = @shell_executor.run(commit_command).strip
+          # Commit staged changes without shell interpretation of library input
+          commit_output = commit_staged_changes(pr_number)
 
-          if @shell_executor.success?
+          if commit_output.success?
             push_result[:git_actions][:committed] = true
 
-            # Enhanced push with verbose tracking
-            push_command = "git push origin #{head_branch} 2>&1"
-            push_output = @shell_executor.run(push_command).strip
+            # Push the registry-sourced head branch without shell interpretation
+            push_output = push_head_branch(head_branch)
 
-            if @shell_executor.success?
+            if push_output.success?
               push_result[:git_actions][:pushed] = true
               push_result[:success] = true
 
@@ -458,22 +455,22 @@ module Aidp
               )
             else
               # Detailed push error logging
-              push_result[:errors] << "Push failed: #{push_output}"
+              push_result[:errors] << "Push failed: #{push_output.output.strip}"
               Aidp.log_error(
                 "pr_worktree_manager", "push_changes_failed",
                 pr_number: pr_number,
                 branch: head_branch,
-                error_details: push_output
+                error_details: push_output.output.strip
               )
             end
           else
             # Detailed commit error logging
-            push_result[:errors] << "Commit failed: #{commit_output}"
+            push_result[:errors] << "Commit failed: #{commit_output.output.strip}"
             Aidp.log_error(
               "pr_worktree_manager", "commit_changes_failed",
               pr_number: pr_number,
               branch: head_branch,
-              error_details: commit_output
+              error_details: commit_output.output.strip
             )
           end
         else
@@ -532,6 +529,19 @@ module Aidp
 
     private
 
+    # Commit currently staged changes; argv execution keeps externally
+    # sourced values (pr_number) from being interpreted by a shell
+    def commit_staged_changes(pr_number)
+      commit_message = "Changes applied via AIDP request-changes workflow for PR ##{pr_number}"
+      @shell_executor.run_argv("git", "commit", "-m", commit_message)
+    end
+
+    # Push the head branch; argv execution keeps registry-sourced branch
+    # names from being interpreted by a shell
+    def push_head_branch(head_branch)
+      @shell_executor.run_argv("git", "push", "origin", "--", head_branch)
+    end
+
     # Load the worktree registry from file
     def load_registry
       return {} unless File.exist?(worktree_registry_path)

data/lib/aidp/shell_executor.rb

@@ -25,6 +25,32 @@ module Aidp
     end
     self.suppress_output = false
 
+    # Immutable result of a shell-free command execution
+    class Result
+      attr_reader :stdout, :stderr, :exit_status
+
+      # @param stdout [String] standard output from the command
+      # @param stderr [String] standard error from the command
+      # @param exit_status [Integer] exit status code
+      def initialize(stdout:, stderr:, exit_status:)
+        @stdout = stdout.to_s.freeze
+        @stderr = stderr.to_s.freeze
+        @exit_status = exit_status || 1
+        freeze
+      end
+
+      # @return [Boolean] true if exit_status is 0
+      def success?
+        @exit_status.zero?
+      end
+
+      # Combined output, equivalent to shell `2>&1` redirection
+      # @return [String]
+      def output
+        [@stdout, @stderr].reject(&:empty?).join("\n")
+      end
+    end
+
     # Run a command and capture its output
     #
     # @param command [String] The shell command to run
@@ -33,11 +59,19 @@ module Aidp
       `#{command}`
     end
 
-    # Check if the last command succeeded
+    # Run a command without shell interpretation and capture its output
+    #
+    # The command and its arguments are passed directly to the operating
+    # system, so shell metacharacters in any argument are treated as
+    # literal data. Prefer this over #run whenever an argument may contain
+    # externally supplied values.
     #
-    # @return [Boolean] true if last command exited with status 0
-    def success?
-      $?.success?
+    # @param command [Array<String>] the command and its arguments
+    # @return [Result] captured stdout/stderr with the exit status
+    def run_argv(*command)
+      require "open3"
+      stdout, stderr, status = Open3.capture3(*command.map(&:to_s))
+      Result.new(stdout: stdout, stderr: stderr, exit_status: status.exitstatus)
     end
 
     # Run a command via system(), optionally suppressing output

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.49.8"
+  VERSION = "0.49.10"
 end

data/lib/aidp/watch/rebase_processor.rb

@@ -1,3 +1,4 @@
+require "open3"
 require "aidp/watch/base_processor"
 require "aidp/worktree"
 require "aidp/pr_worktree_manager"
@@ -116,11 +117,12 @@ module Aidp
         # Use PRWorktreeManager's method to perform rebase and conflict resolution
         with_worktree_context(worktree_path) do
           # Fetch the latest changes
-          @shell_executor.system("git fetch origin")
+          @shell_executor.system("git", "fetch", "origin")
 
-          # Attempt to rebase
-          rebase_command = "git rebase origin/#{base_branch}"
-          rebase_output = @shell_executor.system(rebase_command)
+          # Attempt to rebase. Pass args as separate argv entries (not an
+          # interpolated shell string) so branch names can never be
+          # interpreted by a shell.
+          rebase_output = @shell_executor.system("git", "rebase", "origin/#{base_branch}")
 
           unless rebase_output
             # Conflict resolution using AI
@@ -134,9 +136,8 @@ module Aidp
               if resolution
                 # Stage resolved files and continue rebase
                 # GIT_EDITOR=true prevents editor from opening during automated rebase
-                quoted_files = conflict_files.map { |f| "\"#{f}\"" }.join(" ")
-                @shell_executor.system("git add #{quoted_files}")
-                @shell_executor.system({"GIT_EDITOR" => "true"}, "git rebase --continue")
+                @shell_executor.system("git", "add", *conflict_files)
+                @shell_executor.system({"GIT_EDITOR" => "true"}, "git", "rebase", "--continue")
               else
                 return false
               end
@@ -147,15 +148,19 @@ module Aidp
           end
 
           # Push the rebased branch
-          @shell_executor.system("git push -f origin #{head_branch}")
+          @shell_executor.system("git", "push", "-f", "origin", head_branch)
         end
 
         true
       end
 
       def detect_conflicting_files(worktree_path)
-        # Use git to list conflicting files
-        `cd #{worktree_path} && git diff --name-only --diff-filter=U`.split("\n")
+        # Use git to list conflicting files. Argv form avoids shell
+        # interpretation of worktree_path or any file names in the output.
+        stdout, _stderr, _status = Dir.chdir(worktree_path) do
+          Open3.capture3("git", "diff", "--name-only", "--diff-filter=U")
+        end
+        stdout.split("\n")
       end
 
       def resolve_conflicts(worktree_path, base_branch, conflict_files)
@@ -189,8 +194,10 @@ module Aidp
 
         # Stage and continue rebase
         # GIT_EDITOR=true prevents editor from opening during automated rebase
-        @shell_executor.system("cd #{worktree_path} && git add .")
-        @shell_executor.system({"GIT_EDITOR" => "true"}, "cd #{worktree_path} && git rebase --continue")
+        Dir.chdir(worktree_path) do
+          @shell_executor.system("git", "add", ".")
+          @shell_executor.system({"GIT_EDITOR" => "true"}, "git", "rebase", "--continue")
+        end
       end
 
       def post_rebase_status(pr_number, rebase_result, error_detail = nil)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.49.8
+  version: 0.49.10
 platform: ruby
 authors:
 - Bart Agapinan