aidp 0.49.9 → 0.49.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 152b6f4bd772dffcdd49bff974dc989b987e16e1d5a2a6cbc28ff0017eb654ad
-  data.tar.gz: 6163f77e46235f25748344bd675e8ccd221a6ce56d0322d63da1e93969ffc903
+  metadata.gz: 2edfd145fd098c930d76688336659919ad8fa5a4df4cb9f5c3aa5434a60d425f
+  data.tar.gz: c5a1a71bd5adb17cd850484964f11750e7d10e7d5c05e9aa366c89f700794d31
 SHA512:
-  metadata.gz: fcde2af278ae33285b683948d102eecb16b38bd40d121135c80fceab6ed01908be325ce7cb2ff266d5e4399a9f1127b6aae538ad7eedf8442c46bd7630c3bdfe
-  data.tar.gz: a2d8a65e046f8bb81bcb4ec50bbf6838fe6119beb4872bec33f4249db67c107809fa12e65aeaa4452bd8b02e41be3bde74f2956a8faa6b0c70e0bfd4b3240f06
+  metadata.gz: 21667ac8aae592117e34e738b74eb3b01c2f941a9a5672f54ae6e1549bff56289e5bf62e568caf6a08b3a492d17db22e01ba4d28e1a2944e2259d6214a83a2b4
+  data.tar.gz: d4f213b4e236003cccbdb5dbbb5dd41be6e9ce4448cdbda52900a0f651a6939d1801cfe201d3ef35b9ed2218caa04f8aa130e8d5479e3eeccf4cefdda2be615b

data/lib/aidp/pr_worktree_manager.rb

@@ -434,19 +434,16 @@ module Aidp
           push_result[:git_actions][:staged_changes] = true
           push_result[:changed_files] = staged_changes_output.split("\n")
 
-          # More robust commit command with additional logging
-          commit_message = "Changes applied via AIDP request-changes workflow for PR ##{pr_number}"
-          commit_command = "git commit -m '#{commit_message}' 2>&1"
-          commit_output = @shell_executor.run(commit_command).strip
+          # Commit staged changes without shell interpretation of library input
+          commit_output = commit_staged_changes(pr_number)
 
-          if @shell_executor.success?
+          if commit_output.success?
             push_result[:git_actions][:committed] = true
 
-            # Enhanced push with verbose tracking
-            push_command = "git push origin #{head_branch} 2>&1"
-            push_output = @shell_executor.run(push_command).strip
+            # Push the registry-sourced head branch without shell interpretation
+            push_output = push_head_branch(head_branch)
 
-            if @shell_executor.success?
+            if push_output.success?
               push_result[:git_actions][:pushed] = true
               push_result[:success] = true
 
@@ -458,22 +455,22 @@ module Aidp
               )
             else
               # Detailed push error logging
-              push_result[:errors] << "Push failed: #{push_output}"
+              push_result[:errors] << "Push failed: #{push_output.output.strip}"
               Aidp.log_error(
                 "pr_worktree_manager", "push_changes_failed",
                 pr_number: pr_number,
                 branch: head_branch,
-                error_details: push_output
+                error_details: push_output.output.strip
               )
             end
           else
             # Detailed commit error logging
-            push_result[:errors] << "Commit failed: #{commit_output}"
+            push_result[:errors] << "Commit failed: #{commit_output.output.strip}"
             Aidp.log_error(
               "pr_worktree_manager", "commit_changes_failed",
               pr_number: pr_number,
               branch: head_branch,
-              error_details: commit_output
+              error_details: commit_output.output.strip
             )
           end
         else
@@ -532,6 +529,19 @@ module Aidp
 
     private
 
+    # Commit currently staged changes; argv execution keeps externally
+    # sourced values (pr_number) from being interpreted by a shell
+    def commit_staged_changes(pr_number)
+      commit_message = "Changes applied via AIDP request-changes workflow for PR ##{pr_number}"
+      @shell_executor.run_argv("git", "commit", "-m", commit_message)
+    end
+
+    # Push the head branch; argv execution keeps registry-sourced branch
+    # names from being interpreted by a shell
+    def push_head_branch(head_branch)
+      @shell_executor.run_argv("git", "push", "origin", "--", head_branch)
+    end
+
     # Load the worktree registry from file
     def load_registry
       return {} unless File.exist?(worktree_registry_path)

data/lib/aidp/shell_executor.rb

@@ -25,6 +25,32 @@ module Aidp
     end
     self.suppress_output = false
 
+    # Immutable result of a shell-free command execution
+    class Result
+      attr_reader :stdout, :stderr, :exit_status
+
+      # @param stdout [String] standard output from the command
+      # @param stderr [String] standard error from the command
+      # @param exit_status [Integer] exit status code
+      def initialize(stdout:, stderr:, exit_status:)
+        @stdout = stdout.to_s.freeze
+        @stderr = stderr.to_s.freeze
+        @exit_status = exit_status || 1
+        freeze
+      end
+
+      # @return [Boolean] true if exit_status is 0
+      def success?
+        @exit_status.zero?
+      end
+
+      # Combined output, equivalent to shell `2>&1` redirection
+      # @return [String]
+      def output
+        [@stdout, @stderr].reject(&:empty?).join("\n")
+      end
+    end
+
     # Run a command and capture its output
     #
     # @param command [String] The shell command to run
@@ -33,11 +59,19 @@ module Aidp
       `#{command}`
     end
 
-    # Check if the last command succeeded
+    # Run a command without shell interpretation and capture its output
+    #
+    # The command and its arguments are passed directly to the operating
+    # system, so shell metacharacters in any argument are treated as
+    # literal data. Prefer this over #run whenever an argument may contain
+    # externally supplied values.
     #
-    # @return [Boolean] true if last command exited with status 0
-    def success?
-      $?.success?
+    # @param command [Array<String>] the command and its arguments
+    # @return [Result] captured stdout/stderr with the exit status
+    def run_argv(*command)
+      require "open3"
+      stdout, stderr, status = Open3.capture3(*command.map(&:to_s))
+      Result.new(stdout: stdout, stderr: stderr, exit_status: status.exitstatus)
     end
 
     # Run a command via system(), optionally suppressing output

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.49.9"
+  VERSION = "0.49.10"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.49.9
+  version: 0.49.10
 platform: ruby
 authors:
 - Bart Agapinan