@boyingliu01/opencode-plugin 0.35.10 → 0.35.12

package/index.ts

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin"
 import { z } from "zod"
-import { exec, execSync, spawn } from "node:child_process"
+import { exec, execFileSync, execSync, spawn } from "node:child_process"
 import { promisify } from "node:util"
 import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node:fs"
 import { join } from "node:path"
@@ -345,7 +345,7 @@ function generateSessionTitle(dbPath: string, sessionId: string): string {
       ORDER BY m.time_created DESC
       LIMIT 10
     `
-    const raw = execSync(`sqlite3 "${dbPath}" "${sql}"`, {
+    const raw = execFileSync("sqlite3", [dbPath, sql], {
       encoding: "utf8",
       timeout: 5000,
     })
@@ -492,7 +492,11 @@ function writeSessionModel(dbPath: string, sessionId: string, modelJson: string)
   const escapedModel = modelJson.replace(/'/g, "''")
   const sql = `UPDATE session SET model = '${escapedModel}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    // execFileSync, NOT execSync: `dbPath` was interpolated into a shell string with
+    // only double quotes for protection, so a path containing `"` or `$()` broke out
+    // into shell (semgrep security-audit flagged it as a command-injection sink).
+    // Passing the arguments as an array removes the shell from the picture entirely.
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
   } catch (err) {
     // Contract is to propagate: the caller renders the failure as
     // "Session reload failed: <message>". Wrapped so the IO sits inside
@@ -616,7 +620,7 @@ function renameSession(sessionId: string, newTitle?: string): string {
   const escapedId = sessionId.replace(/'/g, "''")
   const sql = `UPDATE session SET title = '${escapedTitle}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
     return `Session renamed to: "${trimmed}"`
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.