@fusengine/harness 0.1.88 → 0.1.89

package/dist/cli/bin.mjs

@@ -3,7 +3,7 @@ import { o as resolveStdinMaxBytes } from "../limits-DG5pl-5s.mjs";
 import { c as resolveTtlSec, r as loadDotenv } from "../dotenv-BLBkBTww.mjs";
 import { t as detectHarness } from "../harness-BMuLJ9lm.mjs";
 import { t as claudeHome } from "../home-state-oUGFB4ds.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DdWG0Meg.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 import { n as writeInitFile, t as initFor } from "../run-TAXNRSpD.mjs";
 import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-DHhukRdh.mjs";
 import { delimiter, join } from "node:path";

package/dist/cli/index.d.mts

@@ -1,7 +1,12 @@
 //#region src/cli/run.d.ts
 /** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
 declare function stagedFiles(): string[];
-/** Read a file's staged (index) content — not the working-tree version. */
+/**
+ * Read a file's staged (index) content — not the working-tree version.
+ * Uses `execFileSync` with an argv array (never a shell), so a staged
+ * filename containing shell metacharacters (backticks, `$(...)`, quotes)
+ * reaches `git show` as a single literal argument — see issue #87.
+ */
 declare function stagedContent(path: string): string;
 /**
  * Evaluate staged code files against the policy core; return violation blocks.

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DdWG0Meg.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{run-DdWG0Meg.mjs → run-CdIlUtjv.mjs}

@@ -1,15 +1,25 @@
 import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { t as evaluate } from "./evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 //#region src/cli/run.ts
 /** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
 function stagedFiles() {
-	return execSync("git diff --cached --name-only --diff-filter=ACMR", { encoding: "utf8" }).trim().split("\n").filter(Boolean);
+	return execFileSync("git", [
+		"diff",
+		"--cached",
+		"--name-only",
+		"--diff-filter=ACMR"
+	], { encoding: "utf8" }).trim().split("\n").filter(Boolean);
 }
-/** Read a file's staged (index) content — not the working-tree version. */
+/**
+* Read a file's staged (index) content — not the working-tree version.
+* Uses `execFileSync` with an argv array (never a shell), so a staged
+* filename containing shell metacharacters (backticks, `$(...)`, quotes)
+* reaches `git show` as a single literal argument — see issue #87.
+*/
 function stagedContent(path) {
-	return execSync(`git show ":${path}"`, { encoding: "utf8" });
+	return execFileSync("git", ["show", `:${path}`], { encoding: "utf8" });
 }
 /**
 * Evaluate staged code files against the policy core; return violation blocks.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fusengine/harness",
-	"version": "0.1.88",
+	"version": "0.1.89",
 	"description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
 	"type": "module",
 	"module": "src/index.ts",