@dadado/agent-kit-cli 5.14.1 → 5.15.0

package/dashboard/dashboard-data.mjs

@@ -4,7 +4,7 @@
 // Scans .cursor/plans, HANDOFF, memory, config, git status, terminals, processes
 // Outputs JSON to stdout (consumed by dashboard.html)
 
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import {
@@ -500,7 +500,7 @@ try {
   const parsed = parseGitStatusShort(status);
   let recentLog = [];
   try {
-    recentLog = execSync(`git log --oneline -n ${MAX_GIT_ACTIVITY}`, gitOpts)
+    recentLog = execFileSync("git", ["log", "--oneline", "-n", String(MAX_GIT_ACTIVITY)], gitOpts)
       .trim()
       .split("\n")
       .filter(Boolean);
@@ -512,7 +512,11 @@ try {
   // origin/main, plus staging vs main (pending promotion count).
   const countDivergence = (range) => {
     try {
-      const out = execSync(`git rev-list --left-right --count ${range}`, gitOpts).trim();
+      const out = execFileSync(
+        "git",
+        ["rev-list", "--left-right", "--count", range],
+        gitOpts,
+      ).trim();
       const [left, right] = out.split(/\s+/).map((n) => Number.parseInt(n, 10) || 0);
       return { ahead: right, behind: left };
     } catch {
@@ -528,8 +532,18 @@ try {
   // Readable graph (branch lanes + merges) as pre-rendered text lines.
   let graphLines = [];
   try {
-    graphLines = execSync(
-      `git log --graph --oneline --decorate --date-order --all -n ${MAX_GIT_GRAPH_LINES}`,
+    graphLines = execFileSync(
+      "git",
+      [
+        "log",
+        "--graph",
+        "--oneline",
+        "--decorate",
+        "--date-order",
+        "--all",
+        "-n",
+        String(MAX_GIT_GRAPH_LINES),
+      ],
       gitOpts,
     )
       .trimEnd()
@@ -589,8 +603,16 @@ function collectPipelineRuns() {
     // and url are dropped: the pipeline card is display-only with no
     // paste-destination for a run URL (ADR 2026-07-25 copy-only convention),
     // so requesting them only adds payload cost without a consumer.
-    const out = execSync(
-      `gh run list --limit ${MAX_PIPELINE_RUNS} --json workflowName,status,conclusion,headBranch,event,createdAt`,
+    const out = execFileSync(
+      "gh",
+      [
+        "run",
+        "list",
+        "--limit",
+        String(MAX_PIPELINE_RUNS),
+        "--json",
+        "workflowName,status,conclusion,headBranch,event,createdAt",
+      ],
       { cwd: ROOT, encoding: "utf-8", timeout: GH_RUN_LIST_TIMEOUT_MS },
     );
     const rows = JSON.parse(out);
@@ -651,8 +673,15 @@ function collectDeploySignal() {
   try {
     // v*-only: an archive/* or other non-release tag under "what shipped
     // recently" would be exactly the misleading signal this phase avoids.
-    const out = execSync(
-      `git for-each-ref --sort=-creatordate --format='%(refname:short)|%(creatordate:short)' --count=${MAX_DEPLOY_TAGS} 'refs/tags/v*'`,
+    const out = execFileSync(
+      "git",
+      [
+        "for-each-ref",
+        "--sort=-creatordate",
+        "--format=%(refname:short)|%(creatordate:short)",
+        `--count=${MAX_DEPLOY_TAGS}`,
+        "refs/tags/v*",
+      ],
       gitOpts,
     ).trim();
     tags = out

package/dist/index.js

@@ -364,7 +364,15 @@ var KNOWN_SHIPPED_OVERLAY_HASHES = /* @__PURE__ */ new Set([
   "bc71bb9c93cb9a4aaba901537681cdb81a5f2a9fd1e6f740eb54bca25b7b878e",
   "f502f374f1d25cb20448aeebe678caa17a3c9cd0c683aaf8073878dda72e5375",
   "5fb839c42331b9298302c374334c358a73ec58bb5bb5a6942847f9e49c154b3c",
-  "1782bf44268490c9e5465aa890447f01b1bc88e426dd8968186c5c9a7493086e"
+  "1782bf44268490c9e5465aa890447f01b1bc88e426dd8968186c5c9a7493086e",
+  "4ab0925a44544c1a43e5abc007a0e5ec2bd60353ec67ce82f8a68f2623dccac0",
+  "0970a3732ee6a869b5f96494d8e3a69850989745a8841dd64b96aa5f9d6e54d4",
+  "86cf6c8c0aa44c47736ebc741c2cd7d88c2566d4612859e873eb330613c2d0f4",
+  "38f1aafe4d1c6e3ec450c252acc4a02d963bd95eb8412481a466e07739aad08f",
+  "a56905278b2d5c31b253f08b8d352401a261556b0c1a9ddc3a825c95bd1c24d9",
+  "cdd8f7d7311ebc5c741011f8243c8bf4d569e5dfdeb1bc42cc63150fc691c0b1",
+  "a34699ec6ee5319095c1f942b2dda529267024731c1226af527b5e965fcb263a",
+  "d4fd6b07139c50f1279603b4043c7d3416fb28e5f4905d57246945fcb4155e46"
 ]);
 
 // src/lifecycle/paths.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dadado/agent-kit-cli",
-  "version": "5.14.1",
+  "version": "5.15.0",
   "description": "Agent Kit CLI: HITL framework install and tooling for AI-assisted IDEs (rules, skills, plan/handoff, context).",
   "license": "PolyForm-Noncommercial-1.0.0",
   "type": "module",