@cortexkit/aft 0.15.3 → 0.15.4

package/dist/index.js

@@ -10115,17 +10115,19 @@ function createGitHubIssue(repo, title, body) {
   if (!isGhInstalled()) {
     return { url: null, stderr: "gh CLI not installed" };
   }
-  try {
-    const result = execSync4(`gh issue create --repo ${repo} --title ${JSON.stringify(title)} --body-file -`, {
-      input: body,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const url = result.trim().split(/\r?\n/).pop();
-    return { url: url || null };
-  } catch (error) {
-    return { url: null, stderr: error instanceof Error ? error.message : String(error) };
+  const result = spawnSync("gh", ["issue", "create", "--repo", repo, "--title", title, "--body-file", "-"], {
+    input: body,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (result.error) {
+    return { url: null, stderr: result.error.message };
+  }
+  if (result.status !== 0) {
+    return { url: null, stderr: result.stderr?.trim() || `gh exited with status ${result.status}` };
   }
+  const url = result.stdout.trim().split(/\r?\n/).pop();
+  return { url: url || null };
 }
 var init_github = () => {};
 

package/dist/lib/github.d.ts

@@ -3,6 +3,13 @@ export declare function openBrowser(url: string): void;
 /**
  * Create a GitHub issue via `gh issue create`. Returns the issue URL on
  * success or null on failure.
+ *
+ * Uses spawnSync with argv array instead of execSync with a shell string —
+ * avoids shell metacharacter injection when `title` or `repo` contain
+ * backticks, `$(...)`, or `;`. Even though `JSON.stringify` quotes the title,
+ * the outer command runs through a shell which reinterprets backticks inside
+ * double-quoted strings. spawnSync with shell: false (default) passes argv
+ * directly to execve without any shell involvement.
  */
 export declare function createGitHubIssue(repo: string, title: string, body: string): {
     url: string | null;

package/dist/lib/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/lib/github.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,IAAI,OAAO,CAOvC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAc7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBzC"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/lib/github.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,IAAI,OAAO,CAOvC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAc7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAqBzC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "type": "module",
   "description": "Unified CLI for Agent File Tools (AFT) — setup, doctor, and diagnostics across supported agent harnesses (OpenCode, Pi)",
   "license": "MIT",