@lenne.tech/cli 1.50.5 → 1.51.0

package/build/commands/claude/plugins.js

@@ -56,25 +56,38 @@ function installPlugin(plugin, cli, toolbox) {
             info('');
             info(`Warning: No skills or commands found for ${plugin.pluginName}. Plugin may not be installed correctly.`);
         }
-        // Step 3: Setup permissions
-        if (pluginContents.permissions.length > 0) {
-            const permSpinner = spin(`Configuring permissions for ${plugin.pluginName}`);
-            const permResult = (0, plugin_utils_1.setupPermissions)(pluginContents.permissions, error);
-            if (permResult.success) {
-                if (permResult.added.length > 0) {
-                    permSpinner.succeed(`Permissions configured for ${plugin.pluginName} (${permResult.added.length} added)`);
-                }
-                else {
-                    permSpinner.succeed(`Permissions already configured for ${plugin.pluginName}`);
-                }
-            }
-            else {
-                permSpinner.fail(`Failed to configure permissions for ${plugin.pluginName}`);
+        // Step 3: Sync permissions. Also for a plugin that ships no rules (any more): rules an
+        // earlier run wrote for it, and the ones it names in formerPatterns, still have to go.
+        const permSpinner = spin(`Configuring permissions for ${plugin.pluginName}`);
+        const permResult = (0, plugin_utils_1.setupPermissions)(plugin, pluginContents, error);
+        if (!permResult.success) {
+            permSpinner.fail(`Failed to configure permissions for ${plugin.pluginName}`);
+            if (permResult.written.length > 0) {
                 info('');
-                info('Add manually to ~/.claude/settings.json:');
-                info(JSON.stringify({ permissions: { allow: pluginContents.permissions } }, null, 2));
+                info(`Add manually to ${permResult.settingsPath}:`);
+                info(JSON.stringify({ permissions: { allow: permResult.written } }, null, 2));
             }
         }
+        else if (permResult.added.length > 0 || permResult.removed.length > 0) {
+            const changes = [
+                permResult.added.length > 0 ? `${permResult.added.length} added` : '',
+                permResult.removed.length > 0 ? `${permResult.removed.length} removed` : '',
+            ].filter(Boolean);
+            permSpinner.succeed(`Permissions configured for ${plugin.pluginName} (${changes.join(', ')})`);
+            for (const rule of permResult.removed) {
+                info(`  removed: ${rule}`);
+            }
+        }
+        else if (permResult.written.length > 0) {
+            permSpinner.succeed(`Permissions already configured for ${plugin.pluginName}`);
+        }
+        else {
+            permSpinner.stop();
+        }
+        if (permResult.success && permResult.skipped.length > 0) {
+            // ${CLAUDE_PLUGIN_ROOT} cannot be scoped safely (see plugin-permissions.ts); Claude asks instead.
+            info(`  not written (uses \${CLAUDE_PLUGIN_ROOT}, Claude will ask): ${permResult.skipped.length} rule(s)`);
+        }
         // Step 4: Process post-installation requirements (for LSP plugins, etc.)
         const postInstallResult = (0, plugin_utils_1.processPostInstall)(plugin.pluginName, toolbox);
         return { action: pluginAction, contents: pluginContents, postInstall: postInstallResult, success: true };

package/build/commands/cli/create.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Create a new CLI
  */
@@ -105,7 +106,7 @@ const NewCommand = {
         // Clone git repository
         const cloneSpinner = spin('Clone https://github.com/lenneTech/cli-starter.git');
         try {
-            yield system.run(`git clone https://github.com/lenneTech/cli-starter.git ${projectDir}`);
+            yield (0, exec_args_1.execArgs)('git', ['clone', '--', 'https://github.com/lenneTech/cli-starter.git', projectDir]);
             if (filesystem.isDirectory(`./${projectDir}`)) {
                 filesystem.remove(`./${projectDir}/.git`);
                 cloneSpinner.succeed('Repository cloned from https://github.com/lenneTech/cli-starter.git');
@@ -123,7 +124,7 @@ const NewCommand = {
         const detectedPm = toolbox.pm.detect(projectDir);
         const installSpinner = spin('Install packages');
         try {
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpinner.succeed('Packages installed');
         }
         catch (err) {
@@ -133,7 +134,14 @@ const NewCommand = {
         // Rename files and data
         const renameSpinner = spin(`Rename files & data ${link ? ' and link' : ''}`);
         try {
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.run('rename', detectedPm)} -- "${name}" --author "${author}" --${link ? 'link' : 'nolink'}`);
+            // Argument list, no shell: name and author come from flags and lt.config (see exec-args.ts).
+            if ([name, author].some((value) => (0, exec_args_1.hasCmdShimHazard)(String(value)))) {
+                throw new Error('name and author must not contain ", % or line breaks on Windows');
+            }
+            const [runner, ...runArgs] = toolbox.pm.run('rename', detectedPm).split(' ');
+            yield (0, exec_args_1.spawnArgs)(runner, [...runArgs, '--', String(name), '--author', String(author), `--${link ? 'link' : 'nolink'}`], {
+                cwd: projectDir,
+            });
             renameSpinner.succeed(`Files & data renamed${link ? ' and linked' : ''}`);
         }
         catch (err) {

package/build/commands/cli/rename.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Rename current CLI
  */
@@ -20,7 +21,7 @@ const NewCommand = {
     name: 'rename',
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
         // Retrieve the tools we need
-        const { npm, parameters, print: { error, info }, system, } = toolbox;
+        const { npm, parameters, print: { error, info }, } = toolbox;
         // Info
         info('Rename current CLI');
         // Get root path
@@ -35,7 +36,14 @@ const NewCommand = {
             return;
         }
         // Run rename script
-        yield system.run(`cd ${rootPath} && ${toolbox.pm.run('rename', toolbox.pm.detect(rootPath))} -- ${parameters.string}`);
+        // Argument list, no shell: the arguments are passed through from the command line (see exec-args.ts).
+        const renameArgs = (parameters.array || []).map(String);
+        if (renameArgs.some((value) => (0, exec_args_1.hasCmdShimHazard)(value))) {
+            error('Arguments must not contain ", % or line breaks on Windows.');
+            return;
+        }
+        const [runner, ...runArgs] = toolbox.pm.run('rename', toolbox.pm.detect(rootPath)).split(' ');
+        yield (0, exec_args_1.spawnArgs)(runner, [...runArgs, '--', ...renameArgs], { cwd: rootPath });
         // Exit if not running from menu
         if (!toolbox.parameters.options.fromGluegunMenu) {
             process.exit();

package/build/commands/dev/prune.js

@@ -62,7 +62,7 @@ const PruneCommand = {
         // driver; the api dir merely improves the driver fallback when present.
         const observed = (0, dev_ticket_1.listDatabaseNames)(undefined, [mainLayout.apiDir, mainRepoRoot].filter(Boolean));
         if (observed === null) {
-            warning('Could not list databases (mongosh missing or MongoDB unreachable) — only the registry is pruned.');
+            warning('Could not list databases (mongosh missing, MongoDB unreachable, or mongosh slower than 10 s) — only the registry is pruned. Re-run to sweep the databases.');
         }
         const plan = (0, dev_prune_1.collectDevPrunePlan)({
             loadRegistry: dev_state_1.loadRegistry,

package/build/commands/dev/up.js

@@ -313,6 +313,15 @@ const UpCommand = {
                 // that nothing listens on.
                 dbName: identity.subdomains.api ? ((_e = existingEntry === null || existingEntry === void 0 ? void 0 : existingEntry.dbName) !== null && _e !== void 0 ? _e : dbName) : undefined,
             });
+            // A Caddyfile from before the loopback bind would keep this running stack on the LAN until
+            // its next restart, because the upsert below is never reached on this path.
+            if ((0, caddy_1.healLoopbackBind)()) {
+                const reload = yield (0, caddy_1.reloadCaddy)();
+                if (reload.ok)
+                    info('Caddy now listens on this machine only (default_bind 127.0.0.1 [::1]).');
+                else
+                    warning(`caddy reload failed:\n${reload.stderr}`);
+            }
             info('Run `lt dev down` first to force a full restart.');
             if (!parameters.options.fromGluegunMenu)
                 process.exit();

package/build/commands/directus/docker-setup.js

@@ -431,7 +431,7 @@ const NewCommand = {
         if (instanceExists) {
             const stopSpin = spin('Stopping existing containers');
             try {
-                yield system.run(`cd ${directusDir} && docker-compose down`);
+                yield system.run('docker-compose down', { cwd: directusDir });
                 stopSpin.succeed();
             }
             catch (stopError) {
@@ -444,7 +444,7 @@ const NewCommand = {
         // Start Directus with docker-compose
         const startSpin = spin('Starting Directus instance');
         try {
-            yield system.run(`cd ${directusDir} && docker-compose up -d`);
+            yield system.run('docker-compose up -d', { cwd: directusDir });
             startSpin.succeed();
         }
         catch (startError) {

package/build/commands/directus/remove.js

@@ -93,7 +93,7 @@ const NewCommand = {
         if (filesystem.exists(composePath)) {
             const stopSpin = spin('Stopping and removing containers');
             try {
-                yield system.run(`cd ${instanceDir} && docker-compose down -v`);
+                yield system.run('docker-compose down -v', { cwd: instanceDir });
                 stopSpin.succeed();
             }
             catch (stopError) {

package/build/commands/directus/typegen.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Generate TypeScript types from Directus collections
  */
@@ -134,13 +135,39 @@ const NewCommand = {
                 }
             }
         }
+        // url, token and output come from flags or lt.config, which a cloned repository can supply,
+        // and they used to sit in double quotes in a shell string, where `$(…)` ran. They are now an
+        // argument list (see exec-args.ts). On Windows the runner is a `.cmd` shim that re-parses its
+        // arguments through cmd.exe, so values that could break out there are refused first.
+        let directusUrl;
+        try {
+            const parsed = new URL(url);
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                throw new Error(parsed.protocol);
+            }
+            // The value as given: `href` would append a "/" and change the URL the generator sees.
+            directusUrl = url;
+        }
+        catch (_m) {
+            error(`Invalid Directus URL "${url}": expected http:// or https://.`);
+            return;
+        }
+        if (!/^[\w.~+/=-]+$/.test(token)) {
+            error('Invalid Directus token: only letters, digits and . _ ~ + / = - are allowed.');
+            return;
+        }
+        if ([directusUrl, output].some((value) => (0, exec_args_1.hasCmdShimHazard)(value))) {
+            error('URL and output path must not contain ", % or line breaks on Windows.');
+            return;
+        }
+        const [runner, ...runnerArgs] = useGlobalTypegen
+            ? ['directus-sdk-typegen']
+            : toolbox.pm.exec('directus-sdk-typegen').split(' ');
         // Generate types
         const generateSpin = spin('Generating TypeScript types from Directus');
-        const command = useGlobalTypegen
-            ? `directus-sdk-typegen -u "${url}" -t "${token}" -o "${output}"`
-            : `${toolbox.pm.exec(`directus-sdk-typegen -u "${url}" -t "${token}" -o "${output}"`)}`;
         try {
-            yield system.run(command);
+            // Asynchronous: a synchronous spawn under the spinner would block Ctrl+C until it exits.
+            yield (0, exec_args_1.spawnArgs)(runner, [...runnerArgs, '-u', directusUrl, '-t', token, '-o', output]);
             generateSpin.succeed();
             success(`TypeScript types generated successfully at ${output}`);
         }

package/build/commands/frontend/convert-mode.js

@@ -10,7 +10,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
+const unknown_options_1 = require("../../lib/unknown-options");
+/** The flag names `lt fullstack convert-mode` uses for the same thing, mapped to the real ones for the error message. */
+const RENAMED_FLAGS = {
+    'frontend-framework-upstream-branch': 'upstream-branch',
+    'frontend-framework-version': 'version',
+};
 /**
  * Convert an existing frontend project between npm mode and vendor mode.
  *
@@ -67,6 +74,15 @@ const ConvertModeCommand = {
         if (toolbox.tools.helpJson(exports.help)) {
             return;
         }
+        // Refuse flags this command does not know: a misspelt --skip-* would otherwise be ignored
+        // and the conversion would touch what the caller asked to leave alone (see unknown-options.ts).
+        const declaredFlags = exports.help.options.map((option) => option.flag);
+        const unknownFlags = (0, unknown_options_1.findUnknownOptions)(parameters.options, declaredFlags);
+        if (unknownFlags.length > 0) {
+            error((0, unknown_options_1.formatUnknownOptions)(unknownFlags, declaredFlags, RENAMED_FLAGS));
+            (0, fail_run_1.failRun)(toolbox);
+            return 'convert-mode: unknown option';
+        }
         const targetMode = parameters.options.to;
         if (!targetMode || !['npm', 'vendor'].includes(targetMode)) {
             error('Missing or invalid --to flag. Use: --to vendor  or  --to npm');

package/build/commands/frontend/nuxt.js

@@ -225,7 +225,7 @@ const NewCommand = {
                 // leaving pnpm-lock.yaml stale. Resync it — otherwise the first
                 // `pnpm install --frozen-lockfile` (CI, Docker build) fails with
                 // ERR_PNPM_OUTDATED_LOCKFILE and the project cannot be built/deployed.
-                yield toolbox.system.run(`cd "./${projectDir}" && pnpm install --no-frozen-lockfile`);
+                yield toolbox.system.run('pnpm install --no-frozen-lockfile', { cwd: projectDir });
                 vendorSpinner.succeed('Frontend converted to vendor mode (app/core/)');
             }
             catch (err) {

package/build/commands/fullstack/add-api.js

@@ -300,7 +300,6 @@ const NewCommand = {
                 apiDir: apiDest,
                 patching,
                 projectDir,
-                system,
             });
             if (renameResult.error) {
                 renameSpinner.warn(`Auto-rename failed (${renameResult.error.message}). Run \`bun run rename ${projectDir}\` manually inside projects/api.`);
@@ -341,7 +340,7 @@ const NewCommand = {
             const installSpinner = spin('Install workspace packages');
             try {
                 const detectedPm = toolbox.pm.detect(workspaceDir);
-                yield system.run(`cd ${workspaceDir} && ${toolbox.pm.install(detectedPm)}`);
+                yield system.run(toolbox.pm.install(detectedPm), { cwd: workspaceDir });
                 installSpinner.succeed('Successfully installed workspace packages');
             }
             catch (err) {

package/build/commands/fullstack/add-app.js

@@ -268,7 +268,7 @@ const NewCommand = {
             const installSpinner = spin('Install workspace packages');
             try {
                 const detectedPm = toolbox.pm.detect(workspaceDir);
-                yield system.run(`cd ${workspaceDir} && ${toolbox.pm.install(detectedPm)}`);
+                yield system.run(toolbox.pm.install(detectedPm), { cwd: workspaceDir });
                 installSpinner.succeed('Successfully installed workspace packages');
             }
             catch (err) {

package/build/commands/fullstack/convert-mode.js

@@ -11,9 +11,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
 const path_1 = require("path");
+const fail_run_1 = require("../../lib/fail-run");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
+const unknown_options_1 = require("../../lib/unknown-options");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
+/** The names older lenne.tech plugin docs used for this command's flags, mapped to the real ones for the error message. */
+const RENAMED_FLAGS = {
+    'api-ref': 'framework-upstream-branch',
+    'api-version': 'framework-version',
+    'app-ref': 'frontend-framework-upstream-branch',
+    'app-version': 'frontend-framework-version',
+    'skip-api': 'skip-backend',
+    'skip-app': 'skip-frontend',
+};
 /**
  * Convert both backend and frontend of a fullstack monorepo between
  * npm mode and vendor mode in a single command.
@@ -103,6 +114,15 @@ const ConvertModeCommand = {
         if (toolbox.tools.helpJson(exports.help)) {
             return;
         }
+        // Refuse flags this command does not know: a misspelt --skip-* would otherwise be ignored
+        // and the conversion would touch what the caller asked to leave alone (see unknown-options.ts).
+        const declaredFlags = exports.help.options.map((option) => option.flag);
+        const unknownFlags = (0, unknown_options_1.findUnknownOptions)(parameters.options, declaredFlags);
+        if (unknownFlags.length > 0) {
+            error((0, unknown_options_1.formatUnknownOptions)(unknownFlags, declaredFlags, RENAMED_FLAGS));
+            (0, fail_run_1.failRun)(toolbox);
+            return 'convert-mode: unknown option';
+        }
         const targetMode = parameters.options.to;
         if (!targetMode || !['npm', 'vendor'].includes(targetMode)) {
             error('Missing or invalid --to flag. Use: --to vendor  or  --to npm');

package/build/commands/fullstack/init.js

@@ -16,6 +16,7 @@ const gluegun_1 = require("gluegun");
 const caddy_1 = require("../../lib/caddy");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
+const exec_args_1 = require("../../lib/exec-args");
 const fail_run_1 = require("../../lib/fail-run");
 const package_name_1 = require("../../lib/package-name");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
@@ -419,7 +420,7 @@ const NewCommand = {
         const workspaceSpinner = spin(`Create fullstack workspace with ${frontend} in ${projectDir} with ${name} app`);
         // Clone monorepo
         try {
-            yield system.run(`git clone https://github.com/lenneTech/lt-monorepo.git ${projectDir}`);
+            yield (0, exec_args_1.execArgs)('git', ['clone', '--', 'https://github.com/lenneTech/lt-monorepo.git', projectDir]);
         }
         catch (err) {
             workspaceSpinner.fail(`Failed to clone monorepo: ${err.message}`);
@@ -485,7 +486,8 @@ const NewCommand = {
         (0, package_name_1.setPackageName)({ filesystem, name: projectDir, packageJsonPath: `${projectDir}/package.json` });
         // Always initialize git
         try {
-            yield system.run(`cd ${projectDir} && git init --initial-branch=dev`);
+            // Argument lists, no shell: projectDir comes from --name, gitLink from a flag or lt.config.
+            yield (0, exec_args_1.execArgs)('git', ['init', '--initial-branch=dev'], { cwd: projectDir });
         }
         catch (err) {
             ngBaseSpinner.fail(`Failed to initialize git: ${err.message}`);
@@ -495,7 +497,7 @@ const NewCommand = {
         // Add remote if push is configured
         if (pushToRemote && gitLink) {
             try {
-                yield system.run(`cd ${projectDir} && git remote add origin ${gitLink}`);
+                yield (0, exec_args_1.execArgs)('git', ['remote', 'add', '--', 'origin', gitLink], { cwd: projectDir });
             }
             catch (err) {
                 ngBaseSpinner.fail(`Failed to add remote: ${err.message}`);
@@ -600,7 +602,7 @@ const NewCommand = {
                 }
                 const renameSpinner = spin(`Rename nest-base → ${projectDir}`);
                 try {
-                    yield system.run(`cd ${apiDest} && bun run rename ${projectDir}`);
+                    yield (0, exec_args_1.spawnArgs)('bun', ['run', 'rename', projectDir], { cwd: apiDest });
                     renameSpinner.succeed(`Renamed nest-base → ${projectDir} in projects/api`);
                 }
                 catch (err) {
@@ -701,7 +703,8 @@ const NewCommand = {
             });
             // Create initial commit after everything is set up
             try {
-                yield system.run(`cd ${projectDir} && git add . && git commit -m "Initial commit"`);
+                yield (0, exec_args_1.execArgs)('git', ['add', '.'], { cwd: projectDir });
+                yield (0, exec_args_1.execArgs)('git', ['commit', '-m', 'Initial commit'], { cwd: projectDir });
             }
             catch (err) {
                 error(`Failed to create initial commit: ${err.message}`);
@@ -711,7 +714,7 @@ const NewCommand = {
             // Push to remote if configured
             if (pushToRemote) {
                 try {
-                    yield system.run(`cd ${projectDir} && git push -u origin dev`);
+                    yield (0, exec_args_1.execArgs)('git', ['push', '-u', 'origin', 'dev'], { cwd: projectDir });
                 }
                 catch (err) {
                     error(`Failed to push to remote: ${err.message}`);

package/build/commands/git/clean.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const gluegun_1 = require("gluegun");
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Removed local merged branches
  */
@@ -89,7 +90,7 @@ const NewCommand = {
                     spin: true,
                 });
             }
-            yield run(`git checkout ${branch}`);
+            yield (0, exec_args_1.execArgs)('git', ['checkout', (0, exec_args_1.safeRef)(branch)]);
             info(`Changed Branch to ${branch}`);
         }
         // Start timer
@@ -114,7 +115,7 @@ const NewCommand = {
         info(`Deleting branches: ${branches.join(', ')}`);
         // Delete branches
         for (const branchToDelete of branches) {
-            yield gluegun_1.system.run(`git branch -d ${branchToDelete}`);
+            yield (0, exec_args_1.execArgs)('git', ['branch', '-d', (0, exec_args_1.safeRef)(branchToDelete)]);
             success(`Deleted branch: ${branchToDelete}`);
         }
         undoSpinner.succeed();

package/build/commands/git/create.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Create a new branch
  */
@@ -139,7 +140,11 @@ const NewCommand = {
         const timer = system.startTimer();
         // Checkout
         const createSpin = spin(`Create ${branch}`);
-        yield system.run('git fetch &&' + `git checkout ${baseBranch} &&` + 'git pull && ' + `git checkout -b ${branch}`);
+        // Argument lists, no shell: both branch names come from the user or lt.config (see exec-args.ts).
+        yield (0, exec_args_1.execArgs)('git', ['fetch']);
+        yield (0, exec_args_1.execArgs)('git', ['checkout', (0, exec_args_1.safeRef)(baseBranch)]);
+        yield (0, exec_args_1.execArgs)('git', ['pull']);
+        yield (0, exec_args_1.execArgs)('git', ['checkout', '-b', (0, exec_args_1.safeRef)(branch)]);
         createSpin.succeed();
         // Install packages with correctly detected package manager (supports monorepo lockfiles)
         const { path: pkgPath } = yield npm.getPackageJson();
@@ -147,7 +152,7 @@ const NewCommand = {
             const projectDir = (0, path_1.dirname)(pkgPath);
             const detectedPm = toolbox.pm.detect(projectDir);
             const installSpin = spin(`Install packages using ${detectedPm}`);
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpin.succeed();
         }
         // Success info

package/build/commands/git/force-pull.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Pull branch with losing changes
  */
@@ -61,7 +62,7 @@ const NewCommand = {
             // silently claimed there was nothing ahead. try/catch behaves the same on every platform.
             let localCommits = '';
             try {
-                localCommits = yield run(`git log origin/${branch}..HEAD --oneline`);
+                localCommits = yield (0, exec_args_1.execArgs)('git', ['log', `origin/${(0, exec_args_1.safeRef)(branch)}..HEAD`, '--oneline']);
             }
             catch (_d) {
                 // ignore - no upstream ref, so nothing ahead to report
@@ -84,7 +85,8 @@ const NewCommand = {
         const timer = startTimer();
         // Reset soft
         const pullSpinner = spin(`Fetch and pull ${branch}`);
-        yield run(`git fetch && git reset origin/${branch} --hard`);
+        yield (0, exec_args_1.execArgs)('git', ['fetch']);
+        yield (0, exec_args_1.execArgs)('git', ['reset', `origin/${(0, exec_args_1.safeRef)(branch)}`, '--hard']);
         pullSpinner.succeed();
         // Success
         success(`Force pulled ${branch} in ${helper.msToMinutesAndSeconds(timer())}m.`);

package/build/commands/git/get.js

@@ -10,6 +10,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
+/**
+ * Run git steps one after another, each without a shell; stops at the first failure like the
+ * former `a && b && c` chain did.
+ */
+function gitSteps(...steps) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (const args of steps) {
+            yield (0, exec_args_1.execArgs)('git', args);
+        }
+    });
+}
 /**
  * Checkout git branch
  */
@@ -74,7 +86,8 @@ const NewCommand = {
             success(`Branch ${branchName} found`);
         }
         // Checkout branch
-        yield system.run(`git checkout ${(yield git.getDefaultBranch()) || 'main'}`);
+        // Argument lists, no shell: branch names come from the user and from the remote (see exec-args.ts).
+        yield (0, exec_args_1.execArgs)('git', ['checkout', (0, exec_args_1.safeRef)((yield git.getDefaultBranch()) || 'main')]);
         let checkoutSpin;
         // Handling for remote
         if (remoteBranch) {
@@ -99,7 +112,7 @@ const NewCommand = {
                 }
                 if (mode === 'hard') {
                     const prepareSpin = spin(`Refresh ${branch}`);
-                    yield system.run(`git branch -D ${branch}`);
+                    yield (0, exec_args_1.execArgs)('git', ['branch', '-D', (0, exec_args_1.safeRef)(branch)]);
                     removed = true;
                     prepareSpin.succeed();
                 }
@@ -111,17 +124,17 @@ const NewCommand = {
             checkoutSpin = spin(`Checkout ${branch}`);
             // Checkout remote if local branch not exists
             if (removed || !(yield git.getBranch(branch, { local: true }))) {
-                yield system.run(`git fetch && git checkout --track origin/${branch} && git reset --hard && git clean -fd && git pull`);
+                yield gitSteps(['fetch'], ['checkout', '--track', `origin/${(0, exec_args_1.safeRef)(branch)}`], ['reset', '--hard'], ['clean', '-fd'], ['pull']);
                 // Checkout local branch
             }
             else {
-                yield system.run(`git fetch && git checkout ${branch} && git reset --hard && git clean -fd && git pull`);
+                yield gitSteps(['fetch'], ['checkout', (0, exec_args_1.safeRef)(branch)], ['reset', '--hard'], ['clean', '-fd'], ['pull']);
             }
             // Handling for local only
         }
         else if (branch) {
             checkoutSpin = spin(`Checkout ${branch}`);
-            yield system.run(`git fetch && git checkout ${branch} && git reset --hard && git clean -fd`);
+            yield gitSteps(['fetch'], ['checkout', (0, exec_args_1.safeRef)(branch)], ['reset', '--hard'], ['clean', '-fd']);
             // No branch found
         }
         else {
@@ -136,7 +149,7 @@ const NewCommand = {
             const projectDir = (0, path_1.dirname)(pkgPath);
             const detectedPm = toolbox.pm.detect(projectDir);
             const installSpin = spin(`Install packages using ${detectedPm}`);
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpin.succeed();
         }
         // Init lerna projects

package/build/commands/git/rebase.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Rebase branch
  */
@@ -20,7 +21,7 @@ const NewCommand = {
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         // Retrieve the tools we need
-        const { config, git, helper, parameters, print: { error, info, spin, success, warning }, prompt: { confirm }, system: { run, startTimer }, } = toolbox;
+        const { config, git, helper, parameters, print: { error, info, spin, success, warning }, prompt: { confirm }, system: { startTimer }, } = toolbox;
         // Load configuration
         const ltConfig = config.loadConfig();
         const configBaseBranch = (_d = (_c = (_b = (_a = ltConfig === null || ltConfig === void 0 ? void 0 : ltConfig.commands) === null || _a === void 0 ? void 0 : _a.git) === null || _b === void 0 ? void 0 : _b.rebase) === null || _c === void 0 ? void 0 : _c.base) !== null && _d !== void 0 ? _d : (_f = (_e = ltConfig === null || ltConfig === void 0 ? void 0 : ltConfig.commands) === null || _e === void 0 ? void 0 : _e.git) === null || _f === void 0 ? void 0 : _f.baseBranch;
@@ -60,7 +61,7 @@ const NewCommand = {
             // what the real command will do.
             let commitsToRebase = '';
             try {
-                commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline`);
+                commitsToRebase = yield (0, exec_args_1.execArgs)('git', ['log', `${(0, exec_args_1.safeRef)(baseBranchPreview)}..HEAD`, '--oneline']);
             }
             catch (_k) {
                 // Unknown base ref — nothing to preview, which the check below handles.
@@ -139,7 +140,16 @@ const NewCommand = {
         const timer = startTimer();
         // Rebase
         const rebaseSpin = spin(`Set ${baseBranch} as base of ${branch}`);
-        yield run(`git fetch && git checkout ${baseBranch} && git pull && git checkout ${branch} && git rebase ${baseBranch}`);
+        // Argument lists, no shell: both names come from flags, lt.config and the remote (see exec-args.ts).
+        for (const args of [
+            ['fetch'],
+            ['checkout', (0, exec_args_1.safeRef)(baseBranch)],
+            ['pull'],
+            ['checkout', (0, exec_args_1.safeRef)(branch)],
+            ['rebase', (0, exec_args_1.safeRef)(baseBranch)],
+        ]) {
+            yield (0, exec_args_1.execArgs)('git', args);
+        }
         rebaseSpin.succeed();
         // Success
         success(`Rebased ${branch} in ${helper.msToMinutesAndSeconds(timer())}m.`);