@lenne.tech/cli 1.50.6 → 1.51.0

package/build/commands/git/rename.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Rename branch
  */
@@ -20,7 +21,7 @@ const NewCommand = {
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
         var _a, _b, _c;
         // Retrieve the tools we need
-        const { config, git, helper, parameters, print: { error, info, spin, success, warning }, prompt: { confirm }, system: { run, startTimer }, } = toolbox;
+        const { config, git, helper, parameters, print: { error, info, spin, success, warning }, prompt: { confirm }, system: { startTimer }, } = toolbox;
         // Load configuration
         const ltConfig = config.loadConfig();
         // Parse CLI arguments
@@ -85,10 +86,10 @@ const NewCommand = {
         const remote = yield git.getBranch(name, { exact: true, remote: true });
         // Rename branch
         const renameSpin = spin(`Rename ${branch} into ${name}`);
-        yield run(`git branch -m ${name}`);
+        yield (0, exec_args_1.execArgs)('git', ['branch', '-m', (0, exec_args_1.safeRef)(name)]);
         // Ask to push branch
         if (remote && (noConfirm || (yield confirm(`Push ${name} to remote?`)))) {
-            yield run(`git push origin ${name}`);
+            yield (0, exec_args_1.execArgs)('git', ['push', 'origin', (0, exec_args_1.safeRef)(name)]);
         }
         renameSpin.succeed();
         // Save time
@@ -98,7 +99,7 @@ const NewCommand = {
             (parameters.options.deleteRemote || (!noConfirm && (yield confirm(`Delete remote branch ${branch}?`))))) {
             timer = startTimer();
             const deleteSpin = spin(`Delete remote branch ${branch}`);
-            yield run(`git push origin :${branch}`);
+            yield (0, exec_args_1.execArgs)('git', ['push', 'origin', `:${(0, exec_args_1.safeRef)(branch)}`]);
             deleteSpin.succeed();
             time += timer();
         }

package/build/commands/git/reset.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
 const git_env_1 = require("../../lib/git-env");
 /**
  * Environment that keeps the `git ls-remote` below non-interactive.
@@ -66,7 +67,9 @@ const NewCommand = {
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
         let remoteBranch = '';
         try {
-            remoteBranch = yield system.run(`git ls-remote --heads origin ${branch}`, { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            remoteBranch = yield (0, exec_args_1.execArgs)('git', ['ls-remote', '--heads', 'origin', (0, exec_args_1.safeRef)(branch)], {
+                env: (0, git_env_1.nonInteractiveGitEnv)(),
+            });
         }
         catch (_d) {
             // ignore - unreachable remote is reported as "no remote branch" below
@@ -95,7 +98,7 @@ const NewCommand = {
             // Show commits that would be lost (none listed when the upstream ref is unknown locally)
             let localCommits = '';
             try {
-                localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline`);
+                localCommits = yield (0, exec_args_1.execArgs)('git', ['log', `origin/${(0, exec_args_1.safeRef)(branch)}..HEAD`, '--oneline']);
             }
             catch (_e) {
                 // ignore - no upstream ref, so nothing ahead to report
@@ -124,14 +127,19 @@ const NewCommand = {
         }
         // Reset
         const resetSpin = spin(`Reset ${branch}`);
-        yield system.run('git clean -fd && ' +
-            'git reset HEAD --hard && ' +
-            'git checkout main && ' +
-            'git fetch && ' +
-            'git pull && ' +
-            `git branch -D ${branch} && ` +
-            `git checkout ${branch} && ` +
-            'git pull');
+        // Argument lists, no shell: the current branch name can come from a remote (see exec-args.ts).
+        for (const args of [
+            ['clean', '-fd'],
+            ['reset', 'HEAD', '--hard'],
+            ['checkout', 'main'],
+            ['fetch'],
+            ['pull'],
+            ['branch', '-D', (0, exec_args_1.safeRef)(branch)],
+            ['checkout', (0, exec_args_1.safeRef)(branch)],
+            ['pull'],
+        ]) {
+            yield (0, exec_args_1.execArgs)('git', args);
+        }
         resetSpin.succeed();
         // Install packages with correctly detected package manager (supports monorepo lockfiles)
         const { path: pkgPath } = yield npm.getPackageJson();

package/build/commands/git/squash.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Squash branch
  */
@@ -74,7 +75,7 @@ const NewCommand = {
                 return `dry-run squash branch ${branch} (no merge base)`;
             }
             // Show commits that would be squashed
-            const commitsToSquash = yield run(`git log ${mergeBase}..HEAD --oneline`);
+            const commitsToSquash = yield (0, exec_args_1.execArgs)('git', ['log', `${(0, exec_args_1.safeRef)(mergeBase)}..HEAD`, '--oneline']);
             if (commitsToSquash === null || commitsToSquash === void 0 ? void 0 : commitsToSquash.trim()) {
                 const commitCount = commitsToSquash.trim().split('\n').length;
                 info(`Would squash ${commitCount} commit(s) on branch "${branch}" into base "${base}":`);
@@ -201,7 +202,8 @@ const NewCommand = {
         // Start spinner
         const commitSpin = spin('Commit');
         // Commit and push
-        yield run(`git commit -am "${message}" --author="${author}"`);
+        // Argument list, no shell: message and author are free text from the user or lt.config.
+        yield (0, exec_args_1.execArgs)('git', ['commit', '-am', message, `--author=${author}`]);
         commitSpin.succeed();
         if (!noConfirm && !(yield confirm('Push force?'))) {
             return;

package/build/commands/git/update.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
 const git_env_1 = require("../../lib/git-env");
 /**
  * Environment that keeps the `git` calls below non-interactive.
@@ -74,7 +75,7 @@ const NewCommand = {
             // Check for incoming commits (none yet when the upstream ref is unknown locally)
             let incomingCommits = '';
             try {
-                incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline`);
+                incomingCommits = yield (0, exec_args_1.execArgs)('git', ['log', `${(0, exec_args_1.safeRef)(branch)}..origin/${branch}`, '--oneline']);
             }
             catch (_e) {
                 // ignore - no upstream ref, so nothing incoming to report

package/build/commands/npm/reinit.js

@@ -76,7 +76,7 @@ const NewCommand = {
         const detectedPm = pm.detect((0, path_1.dirname)(path));
         if (data.scripts && data.scripts.reinit) {
             const ownReinitSpin = spin('Reinitialize packages');
-            yield system.run(`cd ${(0, path_1.dirname)(path)} && ${pm.run('reinit', detectedPm)}`);
+            yield system.run(pm.run('reinit', detectedPm), { cwd: (0, path_1.dirname)(path) });
             ownReinitSpin.succeed();
         }
         else {
@@ -92,12 +92,12 @@ const NewCommand = {
             reinitSpin.succeed();
             if (data.scripts && data.scripts['test:e2e']) {
                 const testE2eSpin = spin('Run tests');
-                yield system.run(`cd ${(0, path_1.dirname)(path)} && ${pm.run('test:e2e', detectedPm)}`);
+                yield system.run(pm.run('test:e2e', detectedPm), { cwd: (0, path_1.dirname)(path) });
                 testE2eSpin.succeed();
             }
             else if (data.scripts && data.scripts && data.scripts.test) {
                 const testSpin = spin('Run tests');
-                yield system.run(`cd ${(0, path_1.dirname)(path)} && ${pm.run('test', detectedPm)}`);
+                yield system.run(pm.run('test', detectedPm), { cwd: (0, path_1.dirname)(path) });
                 testSpin.succeed();
             }
         }

package/build/commands/server/add-property.js

@@ -15,7 +15,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
 const path_1 = require("path");
 const ts_morph_1 = require("ts-morph");
+const fail_run_1 = require("../../lib/fail-run");
 const framework_detection_1 = require("../../lib/framework-detection");
+const safe_paths_1 = require("../../lib/safe-paths");
 const module_1 = __importDefault(require("./module"));
 const object_1 = __importDefault(require("./object"));
 /**
@@ -121,6 +123,14 @@ const NewCommand = {
             error(`No src directory in "${path}".`);
             return;
         }
+        // One directory name, nothing else: `--element ../../../other-project/src/server/modules/x`
+        // passed the existence check below and edited another project.
+        if (!(0, safe_paths_1.isSafePathSegment)(String(elementToEdit))) {
+            info('');
+            error(`"${elementToEdit}" is not a ${String(objectOrModule).toLowerCase()} name: no "/", "\\" or "..".`);
+            (0, fail_run_1.failRun)(toolbox);
+            return;
+        }
         // Verify the target module/object directory exists
         const targetDir = objectOrModule === 'Module'
             ? (0, path_1.join)(path, 'src', 'server', 'modules', elementToEdit)

package/build/commands/server/convert-mode.js

@@ -10,7 +10,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const framework_detection_1 = require("../../lib/framework-detection");
+const unknown_options_1 = require("../../lib/unknown-options");
+/** The flag names `lt fullstack convert-mode` uses for the same thing, mapped to the real ones for the error message. */
+const RENAMED_FLAGS = {
+    'framework-upstream-branch': 'upstream-branch',
+    'framework-version': 'version',
+};
 /**
  * Convert an existing API project between npm mode and vendor mode.
  *
@@ -67,6 +74,15 @@ const ConvertModeCommand = {
         if (toolbox.tools.helpJson(exports.help)) {
             return;
         }
+        // Refuse flags this command does not know: a misspelt --skip-* would otherwise be ignored
+        // and the conversion would touch what the caller asked to leave alone (see unknown-options.ts).
+        const declaredFlags = exports.help.options.map((option) => option.flag);
+        const unknownFlags = (0, unknown_options_1.findUnknownOptions)(parameters.options, declaredFlags);
+        if (unknownFlags.length > 0) {
+            error((0, unknown_options_1.formatUnknownOptions)(unknownFlags, declaredFlags, RENAMED_FLAGS));
+            (0, fail_run_1.failRun)(toolbox);
+            return 'convert-mode: unknown option';
+        }
         const targetMode = parameters.options.to;
         if (!targetMode || !['npm', 'vendor'].includes(targetMode)) {
             error('Missing or invalid --to flag. Use: --to vendor  or  --to npm');

package/build/commands/server/permissions.js

@@ -10,10 +10,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const framework_detection_1 = require("../../lib/framework-detection");
+const safe_paths_1 = require("../../lib/safe-paths");
 // ────────────────────────────────────────────────────────────────────────────
 // Helper functions (alphabetically sorted per ESLint rules)
 // ────────────────────────────────────────────────────────────────────────────
@@ -132,14 +132,6 @@ function loadScanner(projectPath) {
         return null;
     });
 }
-/**
- * Open a file in the default browser/application
- */
-function openFile(filePath) {
-    const platform = process.platform;
-    const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open';
-    (0, child_process_1.exec)(`${cmd} "${filePath}"`);
-}
 /**
  * Print console summary
  */
@@ -313,6 +305,13 @@ const PermissionsCommand = {
             defaultValue: defaultOutputName,
         }) || defaultOutputName;
         const outputPath = (0, path_1.join)(projectPath, outputFile);
+        // --output and lt.config's `output` must not write outside the project (`../../x`).
+        if (!(0, safe_paths_1.isPathInside)(projectPath, outputPath)) {
+            error(`Output ${outputFile} lies outside the project ${projectPath}. Use a path inside the project.`);
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return 'permissions: output outside project';
+        }
         // Load scanner from project's @lenne.tech/nest-server
         const spinner = spin('Loading permissions scanner...');
         const scanner = yield loadScanner(projectPath);
@@ -374,7 +373,8 @@ const PermissionsCommand = {
         }
         // Open in browser
         if (shouldOpen && (format === 'html' || format === 'md')) {
-            openFile(outputPath);
+            // No shell: the file name comes from --output or lt.config (see safe-paths.ts).
+            (0, safe_paths_1.openFileWithDefaultApp)(outputPath);
             info(`Report opened in default application`);
         }
         // Summary line (always shown)

package/build/commands/starter/chrome-extension.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Create a new TypeScript project
  */
@@ -46,7 +47,12 @@ const NewCommand = {
         }
         // Clone git repository
         const cloneSpinner = spin('Clone https://github.com/lenneTech/chrome-extension-angular-starter.git');
-        yield system.run(`git clone https://github.com/lenneTech/chrome-extension-angular-starter.git ${projectDir}`);
+        yield (0, exec_args_1.execArgs)('git', [
+            'clone',
+            '--',
+            'https://github.com/lenneTech/chrome-extension-angular-starter.git',
+            projectDir,
+        ]);
         if (filesystem.isDirectory(`./${projectDir}`)) {
             filesystem.remove(`./${projectDir}/.git`);
             cloneSpinner.succeed('Repository cloned from https://github.com/lenneTech/chrome-extension-angular-starter.git');
@@ -102,7 +108,7 @@ const NewCommand = {
         prepareSpinner.succeed('Files prepared');
         // Install packages
         const installSpinner = spin('Install packages');
-        yield system.run(`cd ${projectDir} && ${toolbox.pm.install(toolbox.pm.detect(projectDir))}`);
+        yield system.run(toolbox.pm.install(toolbox.pm.detect(projectDir)), { cwd: projectDir });
         installSpinner.succeed('Packages installed');
         // Init git
         const initGitSpinner = spin('Initialize git');

package/build/commands/typescript/create.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const exec_args_1 = require("../../lib/exec-args");
 /**
  * Create a new TypeScript project
  */
@@ -61,7 +62,7 @@ const NewCommand = {
         // Clone git repository
         const cloneSpinner = spin('Clone https://github.com/lenneTech/typescript-starter.git');
         try {
-            yield system.run(`git clone https://github.com/lenneTech/typescript-starter.git ${projectDir}`);
+            yield (0, exec_args_1.execArgs)('git', ['clone', '--', 'https://github.com/lenneTech/typescript-starter.git', projectDir]);
             if (filesystem.isDirectory(`./${projectDir}`)) {
                 filesystem.remove(`./${projectDir}/.git`);
                 cloneSpinner.succeed('Repository cloned from https://github.com/lenneTech/typescript-starter.git');
@@ -153,7 +154,7 @@ const NewCommand = {
             // Install packages
             const installSpinner = spin('Install packages');
             try {
-                yield system.run(`cd ${projectDir} && ${toolbox.pm.install(toolbox.pm.detect(projectDir))}`);
+                yield system.run(toolbox.pm.install(toolbox.pm.detect(projectDir)), { cwd: projectDir });
                 installSpinner.succeed('Packages installed');
             }
             catch (err) {

package/build/extensions/api-mode.js

@@ -103,7 +103,7 @@ class ApiMode {
             const { pm, system } = this.toolbox;
             const runner = (_c = (_b = pm === null || pm === void 0 ? void 0 : pm.run) === null || _b === void 0 ? void 0 : _b.call(pm, formatScript, pm.detect(projectPath))) !== null && _c !== void 0 ? _c : `pnpm run ${formatScript}`;
             try {
-                yield system.run(`cd "${projectPath}" && ${runner}`);
+                yield system.run(runner, { cwd: projectPath });
             }
             catch (_e) {
                 // Non-fatal: the user can run format manually if this misbehaves.

package/build/extensions/frontend-helper.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
+const exec_args_1 = require("../lib/exec-args");
 const markdown_table_1 = require("../lib/markdown-table");
 const module_specifiers_1 = require("../lib/module-specifiers");
 const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
@@ -184,7 +185,8 @@ class FrontendHelper {
             if (!skipInstall && result.method !== 'link') {
                 try {
                     const { pm } = this.toolbox;
-                    yield system.run(`cd "${dest}" && ${pm.install(pm.detect(dest))}`);
+                    // `cwd` instead of `cd "<dest>" &&`: the directory name must not be shell syntax.
+                    yield system.run(pm.install(pm.detect(dest)), { cwd: dest });
                 }
                 catch (_a) {
                     return { method: result.method, path: dest, success: false };
@@ -223,7 +225,8 @@ class FrontendHelper {
             if (!skipInstall) {
                 try {
                     const { pm } = this.toolbox;
-                    yield system.run(`cd "${dest}" && ${pm.install(pm.detect(dest))}`);
+                    // `cwd` instead of `cd "<dest>" &&`: the directory name must not be shell syntax.
+                    yield system.run(pm.install(pm.detect(dest)), { cwd: dest });
                 }
                 catch (err) {
                     return { method: result.method, path: dest, success: false };
@@ -232,12 +235,13 @@ class FrontendHelper {
             // Initialize git
             if (!skipGitInit) {
                 try {
-                    yield system.run(`cd "${dest}" && git init --initial-branch=main`);
+                    // Argument lists, no shell: gitLink comes from a CLI flag or lt.config (see exec-args.ts).
+                    yield (0, exec_args_1.execArgs)('git', ['init', '--initial-branch=main'], { cwd: dest });
                     if (gitLink) {
-                        yield system.run(`cd "${dest}" && git remote add origin ${gitLink}`);
-                        yield system.run(`cd "${dest}" && git add .`);
-                        yield system.run(`cd "${dest}" && git commit -m "Initial commit"`);
-                        yield system.run(`cd "${dest}" && git push -u origin main`);
+                        yield (0, exec_args_1.execArgs)('git', ['remote', 'add', '--', 'origin', gitLink], { cwd: dest });
+                        yield (0, exec_args_1.execArgs)('git', ['add', '.'], { cwd: dest });
+                        yield (0, exec_args_1.execArgs)('git', ['commit', '-m', 'Initial commit'], { cwd: dest });
+                        yield (0, exec_args_1.execArgs)('git', ['push', '-u', 'origin', 'main'], { cwd: dest });
                     }
                 }
                 catch (err) {
@@ -260,7 +264,7 @@ class FrontendHelper {
             // Add localize
             if (localize) {
                 try {
-                    yield system.run(`cd "${dest}" && ng add @angular/localize --skip-confirmation`);
+                    yield system.run('ng add @angular/localize --skip-confirmation', { cwd: dest });
                 }
                 catch (_a) {
                     // Localize failure is not fatal
@@ -270,7 +274,7 @@ class FrontendHelper {
             if (!skipInstall) {
                 try {
                     const { pm: pmHelper } = this.toolbox;
-                    yield system.run(`cd "${dest}" && ${pmHelper.run('init', pmHelper.detect(dest))}`);
+                    yield system.run(pmHelper.run('init', pmHelper.detect(dest)), { cwd: dest });
                 }
                 catch (_b) {
                     // Init script failure is not fatal
@@ -421,13 +425,21 @@ class FrontendHelper {
         return __awaiter(this, void 0, void 0, function* () {
             const { dest, upstreamBranch, upstreamRepoUrl = 'https://github.com/lenneTech/nuxt-extensions.git' } = options;
             const path = require('node:path');
-            const { filesystem, system } = this.toolbox;
+            const { filesystem } = this.toolbox;
             const coreDir = path.join(dest, 'app', 'core');
             // ── 1. Clone @lenne.tech/nuxt-extensions into temp dir ──────────────
             const tmpClone = path.join(require('os').tmpdir(), `lt-vendor-nuxt-ext-${Date.now()}`);
-            const branchArg = upstreamBranch ? `--branch ${upstreamBranch} ` : '';
             try {
-                yield system.run(`git clone --depth 1 ${branchArg}${upstreamRepoUrl} ${tmpClone}`);
+                // Argument list, no shell: the branch comes from a CLI flag or lt.config (see exec-args.ts).
+                yield (0, exec_args_1.execArgs)('git', [
+                    'clone',
+                    '--depth',
+                    '1',
+                    ...(upstreamBranch ? ['--branch', upstreamBranch] : []),
+                    '--',
+                    upstreamRepoUrl,
+                    tmpClone,
+                ]);
             }
             catch (err) {
                 const raw = err.message || '';
@@ -476,7 +488,7 @@ class FrontendHelper {
             }
             let upstreamCommit = '';
             try {
-                const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
+                const sha = yield (0, exec_args_1.execArgs)('git', ['-C', tmpClone, 'rev-parse', 'HEAD']);
                 upstreamCommit = (sha || '').trim();
             }
             catch (_c) {

package/build/extensions/git.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Git = void 0;
+const exec_args_1 = require("../lib/exec-args");
 const git_env_1 = require("../lib/git-env");
 /**
  * Git functions
@@ -96,10 +97,18 @@ class Git {
                 showWarning: false,
             }, options);
             // Toolbox features
-            const { print: { warning }, system, } = this.toolbox;
+            const { print: { warning }, } = this.toolbox;
             // Get diff
             try {
-                const diff = yield system.run(`git --no-pager diff --name-only ${branch} ${opts.otherBranch}`);
+                // Every git call in this file that carries a value runs as an argument list, no shell:
+                // branch names come from the user, from lt.config and from the remote (see exec-args.ts).
+                const diff = yield (0, exec_args_1.execArgs)('git', [
+                    '--no-pager',
+                    'diff',
+                    '--name-only',
+                    (0, exec_args_1.safeRef)(branch),
+                    (0, exec_args_1.safeRef)(opts.otherBranch),
+                ]);
                 // Return relative file paths as array
                 return diff.split(/\r?\n/).filter((item) => item);
             }
@@ -147,8 +156,8 @@ class Git {
     getMergeBase() {
         return __awaiter(this, arguments, void 0, function* (baseBranch = 'dev') {
             // Toolbox features
-            const { helper: { trim }, system: { run }, } = this.toolbox;
-            return trim(yield run(`git merge-base HEAD ${baseBranch}`));
+            const { helper: { trim }, } = this.toolbox;
+            return trim(yield (0, exec_args_1.execArgs)('git', ['merge-base', 'HEAD', (0, exec_args_1.safeRef)(baseBranch)]));
         });
     }
     /**
@@ -163,10 +172,9 @@ class Git {
                 throw new Error('Missing branch');
             }
             // Toolbox features
-            const { helper: { trim }, system: { run }, } = this.toolbox;
+            const { helper: { trim }, } = this.toolbox;
             try {
-                const logCommand = `git log ${baseBranch}..${branch} --oneline`;
-                const output = yield run(logCommand);
+                const output = yield (0, exec_args_1.execArgs)('git', ['log', `${(0, exec_args_1.safeRef)(baseBranch)}..${(0, exec_args_1.safeRef)(branch)}`, '--oneline']);
                 if (!output) {
                     throw new Error('No commits found');
                 }
@@ -277,14 +285,18 @@ class Git {
             }
             // Search branch
             if (opts.exact) {
-                if (opts.remote) {
-                    if (!(yield system.run(`git ls-remote --heads origin ${branch}`))) {
+                if (!(0, exec_args_1.isSafeRef)(branch)) {
+                    // Cannot be a branch name; report it as not found instead of handing it to git.
+                    branch = null;
+                }
+                else if (opts.remote) {
+                    if (!(yield (0, exec_args_1.execArgs)('git', ['ls-remote', '--heads', 'origin', (0, exec_args_1.safeRef)(branch)]))) {
                         branch = null;
                     }
                 }
                 else {
                     try {
-                        yield system.run(`git rev-parse --verify ${branch}`);
+                        yield (0, exec_args_1.execArgs)('git', ['rev-parse', '--verify', (0, exec_args_1.safeRef)(branch)]);
                     }
                     catch (e) {
                         branch = null;
@@ -310,7 +322,7 @@ class Git {
             branch = trim(branch);
             // Check remote, if not done before
             if (opts.remote && !opts.exact) {
-                const remoteBranch = trim(yield system.run(`git ls-remote --heads origin ${branch}`));
+                const remoteBranch = trim(yield (0, exec_args_1.execArgs)('git', ['ls-remote', '--heads', 'origin', (0, exec_args_1.safeRef)(branch)]));
                 if (!remoteBranch) {
                     if (opts.spin) {
                         searchSpin.fail();
@@ -323,7 +335,7 @@ class Git {
             }
             // Check local
             if (opts.local) {
-                const remoteBranch = trim(yield system.run(`git rev-parse --verify --quiet ${branch}`));
+                const remoteBranch = trim(yield (0, exec_args_1.execArgs)('git', ['rev-parse', '--verify', '--quiet', (0, exec_args_1.safeRef)(branch)]));
                 if (!remoteBranch) {
                     if (opts.spin) {
                         searchSpin.fail();
@@ -357,8 +369,7 @@ class Git {
      */
     reset(mergeBase, soft = false) {
         // Toolbox features
-        const { system: { run }, } = this.toolbox;
-        return run(soft ? `git reset --soft ${mergeBase}` : `git reset ${mergeBase}`);
+        return (0, exec_args_1.execArgs)('git', soft ? ['reset', '--soft', (0, exec_args_1.safeRef)(mergeBase)] : ['reset', (0, exec_args_1.safeRef)(mergeBase)]);
     }
     /**
      * Select a branch

package/build/extensions/server.js

@@ -50,6 +50,7 @@ const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const cross_env_1 = require("../lib/cross-env");
+const exec_args_1 = require("../lib/exec-args");
 const express_type_imports_1 = require("../lib/express-type-imports");
 const markdown_table_1 = require("../lib/markdown-table");
 const migrate_scripts_1 = require("../lib/migrate-scripts");
@@ -762,7 +763,7 @@ class Server {
             if (!skipInstall && !experimental) {
                 try {
                     const { pm } = this.toolbox;
-                    yield system.run(`cd "${dest}" && ${pm.install(pm.detect(dest))}`);
+                    yield system.run(pm.install(pm.detect(dest)), { cwd: dest });
                 }
                 catch (err) {
                     return { method: result.method, path: dest, success: false };
@@ -958,7 +959,6 @@ class Server {
             var _a;
             const { dest, upstreamBranch, upstreamRepoUrl = 'https://github.com/lenneTech/nest-server.git' } = options;
             const filesystem = this.filesystem;
-            const { system } = this.toolbox;
             const os = require('os');
             const path = require('path');
             const { Project, SyntaxKind } = require('ts-morph');
@@ -970,9 +970,18 @@ class Server {
             // `bin/migrate.js`, and associated meta files. The clone lives in a
             // throw-away tmp dir that gets cleaned up at the end.
             const tmpClone = path.join(os.tmpdir(), `lt-vendor-nest-server-${Date.now()}`);
-            const branchArg = upstreamBranch ? `--branch ${upstreamBranch} ` : '';
             try {
-                yield system.run(`git clone --depth 1 ${branchArg}${upstreamRepoUrl} ${tmpClone}`);
+                // Argument list, no shell: the branch comes from --framework-upstream-branch or
+                // lt.config (see exec-args.ts).
+                yield (0, exec_args_1.execArgs)('git', [
+                    'clone',
+                    '--depth',
+                    '1',
+                    ...(upstreamBranch ? ['--branch', upstreamBranch] : []),
+                    '--',
+                    upstreamRepoUrl,
+                    tmpClone,
+                ]);
             }
             catch (err) {
                 // Clone failures usually boil down to one of four causes — network,
@@ -1067,7 +1076,7 @@ class Server {
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
             let upstreamCommit = '';
             try {
-                const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
+                const sha = yield (0, exec_args_1.execArgs)('git', ['-C', tmpClone, 'rev-parse', 'HEAD']);
                 upstreamCommit = (sha || '').trim();
             }
             catch (_f) {