@nemus-cli/nemus 0.2.8 → 0.2.10

package/dist/utils/ghq-integration.js

@@ -47,10 +47,14 @@ exports.getGhqStatus = getGhqStatus;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const path = __importStar(require("path"));
+const fs = __importStar(require("fs/promises"));
 const logger_1 = require("./logger");
 const colors_1 = require("./colors");
 const config_1 = require("./config");
-const execAsync = (0, util_1.promisify)(child_process_1.exec);
+// execFile (no shell): every value below (repo URLs, ghq paths, branch names)
+// is passed as an argv element, so none can be interpreted as a shell command.
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const git = (args, opts = {}) => execFileAsync('git', args, opts);
 /**
  * Turn a raw child-process clone failure (from exec or execFile) into an
  * actionable message. The child API discards the reason on timeout/buffer kill (you just get "Command
@@ -80,7 +84,7 @@ function describeCloneError(error, timeoutMs = config_1.CLONE_TIMEOUT_MS) {
  */
 async function isGhqInstalled() {
     try {
-        await execAsync('which ghq');
+        await execFileAsync('which', ['ghq']);
         return true;
     }
     catch {
@@ -106,7 +110,7 @@ async function warnIfGhqMissing() {
  */
 async function getGhqRoot() {
     try {
-        const { stdout } = await execAsync('ghq root');
+        const { stdout } = await execFileAsync('ghq', ['root']);
         return stdout.trim();
     }
     catch {
@@ -121,8 +125,8 @@ async function ghqRepoExists(repoUrl) {
         const repoPath = await getGhqRepoPath(repoUrl);
         if (!repoPath)
             return false;
-        await execAsync(`test -d "${repoPath}"`);
-        return true;
+        const stat = await fs.stat(repoPath);
+        return stat.isDirectory();
     }
     catch {
         return false;
@@ -154,7 +158,7 @@ async function getGhqRepoPath(repoUrl) {
 async function ghqGet(repoUrl) {
     try {
         (0, logger_1.logInfo)(`Using ghq to clone ${(0, colors_1.colorize)(repoUrl, 'cyan')}...`);
-        await execAsync(`ghq get "${repoUrl}"`, { timeout: config_1.CLONE_TIMEOUT_MS, maxBuffer: config_1.CLONE_MAX_BUFFER });
+        await execFileAsync('ghq', ['get', repoUrl], { timeout: config_1.CLONE_TIMEOUT_MS, maxBuffer: config_1.CLONE_MAX_BUFFER });
         const repoPath = await getGhqRepoPath(repoUrl);
         if (!repoPath) {
             return { success: false, error: 'Could not determine ghq path' };
@@ -172,7 +176,7 @@ async function ghqGet(repoUrl) {
  */
 async function ghqList() {
     try {
-        const { stdout } = await execAsync('ghq list');
+        const { stdout } = await execFileAsync('ghq', ['list']);
         return stdout.trim().split('\n').filter(line => line.length > 0);
     }
     catch {
@@ -227,15 +231,15 @@ async function cloneWithGhq(repoUrl, targetPath) {
                 // would serve stale state via hardlinks — user would open a workspace
                 // missing dozens of recent commits.
                 try {
-                    await execAsync(`git -C "${sourcePath}" fetch origin --quiet --prune`, { timeout: 90 * 1000 });
+                    await git(['-C', sourcePath, 'fetch', 'origin', '--quiet', '--prune'], { timeout: 90 * 1000 });
                 }
                 catch {
                     // Network failure or no upstream — fall through with stale cache,
                     // we'll log a warning after the local clone if we can't align to HEAD.
                 }
-                await execAsync(`git clone --local "${sourcePath}" "${targetPath}"`, { timeout: 60 * 1000 });
+                await git(['clone', '--local', sourcePath, targetPath], { timeout: 60 * 1000 });
                 // Reset remote to point to the original repo URL (not the local ghq path)
-                await execAsync(`git remote set-url origin "${repoUrl}"`, { cwd: targetPath });
+                await git(['remote', 'set-url', 'origin', repoUrl], { cwd: targetPath });
                 // Make sure the working tree is at origin's default-branch tip.
                 // Robust against:
                 //   - cache having a non-default branch checked out
@@ -244,20 +248,24 @@ async function cloneWithGhq(repoUrl, targetPath) {
                 let alignedToHead = false;
                 let alignError = null;
                 try {
-                    await execAsync(`git fetch origin --quiet`, { cwd: targetPath, timeout: 60 * 1000 });
+                    await git(['fetch', 'origin', '--quiet'], { cwd: targetPath, timeout: 60 * 1000 });
                     // Explicitly set refs/remotes/origin/HEAD by querying the remote.
                     // Without this, symbolic-ref may fail if the local symref wasn’t set.
-                    await execAsync(`git remote set-head origin --auto`, { cwd: targetPath, timeout: 30 * 1000 })
+                    await git(['remote', 'set-head', 'origin', '--auto'], { cwd: targetPath, timeout: 30 * 1000 })
                         .catch(() => { });
                     let defaultBranch = null;
                     try {
-                        const headRes = await execAsync(`git symbolic-ref --short refs/remotes/origin/HEAD`, { cwd: targetPath, timeout: 5000 });
+                        const headRes = await git(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], {
+                            cwd: targetPath, timeout: 5000,
+                        });
                         defaultBranch = headRes.stdout.trim().replace(/^origin\//, '');
                     }
                     catch {
                         // Fall back to ls-remote query against the actual remote
                         try {
-                            const lsRes = await execAsync(`git ls-remote --symref origin HEAD`, { cwd: targetPath, timeout: 30 * 1000 });
+                            const lsRes = await git(['ls-remote', '--symref', 'origin', 'HEAD'], {
+                                cwd: targetPath, timeout: 30 * 1000,
+                            });
                             const match = lsRes.stdout.match(/^ref:\s+refs\/heads\/(\S+)\s+HEAD$/m);
                             if (match)
                                 defaultBranch = match[1];
@@ -267,7 +275,9 @@ async function cloneWithGhq(repoUrl, targetPath) {
                     // Final fallback: try common default branches
                     if (!defaultBranch) {
                         for (const candidate of ['main', 'master']) {
-                            const exists = await execAsync(`git rev-parse --verify --quiet origin/${candidate}`, { cwd: targetPath, timeout: 5000 }).then(() => true).catch(() => false);
+                            const exists = await git(['rev-parse', '--verify', '--quiet', `origin/${candidate}`], {
+                                cwd: targetPath, timeout: 5000,
+                            }).then(() => true).catch(() => false);
                             if (exists) {
                                 defaultBranch = candidate;
                                 break;
@@ -277,8 +287,8 @@ async function cloneWithGhq(repoUrl, targetPath) {
                     if (!defaultBranch) {
                         throw new Error('could not determine default branch (no origin/HEAD, no main, no master)');
                     }
-                    await execAsync(`git checkout --quiet "${defaultBranch}"`, { cwd: targetPath, timeout: 10 * 1000 });
-                    await execAsync(`git reset --hard --quiet "origin/${defaultBranch}"`, { cwd: targetPath, timeout: 10 * 1000 });
+                    await git(['checkout', '--quiet', defaultBranch], { cwd: targetPath, timeout: 10 * 1000 });
+                    await git(['reset', '--hard', '--quiet', `origin/${defaultBranch}`], { cwd: targetPath, timeout: 10 * 1000 });
                     alignedToHead = true;
                 }
                 catch (error) {
@@ -298,7 +308,7 @@ async function cloneWithGhq(repoUrl, targetPath) {
                 (0, logger_1.logWarning)(`Local clone from ghq failed: ${errorMessage}`);
                 // Clean up partial clone before fallback
                 try {
-                    await execAsync(`rm -rf "${targetPath}"`);
+                    await fs.rm(targetPath, { recursive: true, force: true });
                 }
                 catch { /* ignore */ }
                 // Fall through to direct clone
@@ -307,7 +317,7 @@ async function cloneWithGhq(repoUrl, targetPath) {
     }
     // Fallback to direct git clone
     try {
-        await execAsync(`git clone "${repoUrl}" "${targetPath}"`, { timeout: config_1.CLONE_TIMEOUT_MS, maxBuffer: config_1.CLONE_MAX_BUFFER });
+        await git(['clone', repoUrl, targetPath], { timeout: config_1.CLONE_TIMEOUT_MS, maxBuffer: config_1.CLONE_MAX_BUFFER });
         return { success: true, usedGhq: false };
     }
     catch (error) {

package/dist/utils/git-operations.js

@@ -44,7 +44,6 @@ const ghq_integration_1 = require("./ghq-integration");
 const retry_1 = require("./retry");
 const progress_1 = require("./progress");
 const config_1 = require("./config");
-const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const CONCURRENCY_LIMIT = 3;
 const CLONE_TIMEOUT = config_1.CLONE_TIMEOUT_MS;
@@ -119,13 +118,13 @@ async function cloneLocal(repo, sourcePath, workspacePath, directoryName) {
     const targetPath = path.join(workspacePath, directoryName);
     try {
         // git clone --local creates hardlinks for .git/objects — nearly instant
-        await execAsync(`git clone --local "${sourcePath}" "${targetPath}"`, {
+        await execFileAsync('git', ['clone', '--local', sourcePath, targetPath], {
             timeout: CLONE_TIMEOUT,
             maxBuffer: config_1.CLONE_MAX_BUFFER,
         });
         // Reset the remote to point to the original repo (not the local source)
         const remoteUrl = (0, config_1.getCloneUrl)(repo);
-        await execAsync(`git remote set-url origin "${remoteUrl}"`, {
+        await execFileAsync('git', ['remote', 'set-url', 'origin', remoteUrl], {
             cwd: targetPath,
         });
         return {

package/dist/utils/health-checks.js

@@ -40,6 +40,7 @@ const fs = __importStar(require("fs/promises"));
 const path = __importStar(require("path"));
 const git_status_1 = require("./git-status");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const checkMissingRepositories = async (workspacePath, metadata) => {
     const missingRepos = [];
     for (const repo of metadata.repositories) {
@@ -221,7 +222,7 @@ exports.checkDependencies = checkDependencies;
 const checkDiskSpace = async (workspacePath) => {
     try {
         // Get disk usage for workspace
-        const { stdout } = await execAsync(`du -sh "${workspacePath}"`, { timeout: 30000 });
+        const { stdout } = await execFileAsync('du', ['-sh', workspacePath], { timeout: 30000 });
         const sizeStr = stdout.trim().split('\t')[0];
         // Parse size (rough check for > 10GB)
         const sizeValue = parseFloat(sizeStr);

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@nemus-cli/nemus",
-  "version": "0.2.8",
+  "version": "0.2.10",
+  "workspaces": [
+    "packages/*"
+  ],
   "description": "Nemus — a CLI for managing multi-repository workspaces. Create, sync, and operate across dozens of repos with a single command, and wire them up to your favorite coding agent.",
   "keywords": [
     "workspace",

package/scripts/check-lock-version.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * CI guard: fail if package-lock.json's version fields drift from package.json.
+ *
+ * A stale lockfile version makes `npm ci` fail at release time (npm errors on a
+ * package.json/lock mismatch before build/publish run). This catches the drift
+ * in PR CI instead. Checks both the lockfile root `version` and the self entry
+ * at `packages[""]`.
+ *
+ * Usage: node scripts/check-lock-version.js
+ * Exit 0 when consistent, 1 (with an ::error:: annotation) otherwise.
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function read(file) {
+  return JSON.parse(fs.readFileSync(path.join(__dirname, '..', file), 'utf8'));
+}
+
+const pkg = read('package.json');
+const lock = read('package-lock.json');
+
+const pkgV = pkg.version;
+const rootV = lock.version;
+const selfV = lock.packages && lock.packages[''] && lock.packages[''].version;
+
+const errs = [];
+if (rootV !== pkgV) {
+  errs.push(`package-lock.json root version "${rootV}" != package.json "${pkgV}"`);
+}
+if (selfV !== pkgV) {
+  errs.push(`package-lock.json packages[""] version "${selfV}" != package.json "${pkgV}"`);
+}
+
+if (errs.length) {
+  console.error('::error::' + errs.join('; '));
+  console.error('Fix: run `npm install --package-lock-only` and commit package-lock.json.');
+  process.exit(1);
+}
+
+console.log(`\u2713 package-lock.json version matches package.json (${pkgV})`);

package/src/cli/ai-prompt.test.ts

@@ -2,12 +2,14 @@ import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
 
 const {
   mockExec,
+  mockExecFile,
   mockExecFileSync,
   mockSpawn,
   mockMkdirSync,
   mockWriteFileSync,
 } = vi.hoisted(() => ({
   mockExec: vi.fn(),
+  mockExecFile: vi.fn(),
   mockExecFileSync: vi.fn(),
   mockSpawn: vi.fn(),
   mockMkdirSync: vi.fn(),
@@ -16,6 +18,7 @@ const {
 
 vi.mock('child_process', () => ({
   exec: mockExec,
+  execFile: mockExecFile,
   execFileSync: mockExecFileSync,
   spawn: mockSpawn,
 }));
@@ -69,7 +72,8 @@ function setupSpawnMock(exitCode: number = 0) {
 }
 
 function setupExecMock(success: boolean) {
-  mockExec.mockImplementation((_cmd: string, cb: Function) => {
+  // isPrimaryAgentAvailable now uses execFile('which', [cmd], cb) — cb is the 3rd arg.
+  mockExecFile.mockImplementation((_file: string, _args: string[], cb: Function) => {
     if (success) {
       cb(null, { stdout: '/usr/local/bin/claude\n', stderr: '' });
     } else {

package/src/cli/ai-prompt.ts

@@ -1,4 +1,4 @@
-import { spawn, exec, execFileSync } from 'child_process';
+import { spawn, execFile, execFileSync } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -9,7 +9,7 @@ import { colorize } from '../utils/colors';
 import { getPrimaryAgent } from '../utils/agent-config';
 import { sanitizeWorkspaceName, checkWorkspaceExists, resolveWorkspaceNameConflict } from '../utils/validation';
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export const AI_PROMPT_FILE = path.join(os.homedir(), '.workspace-ai-prompt');
 
@@ -97,7 +97,7 @@ export function buildInvestigationPreamble(
 export async function isPrimaryAgentAvailable(): Promise<boolean> {
   const agent = getPrimaryAgent();
   try {
-    await execAsync(`which ${agent.launchCommand}`);
+    await execFileAsync('which', [agent.launchCommand]);
     return true;
   } catch {
     return false;

package/src/commands/configure.ts

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import inquirer from 'inquirer';
@@ -117,7 +117,7 @@ async function handleConfigure() {
       logInfo('Installing MCP server...');
       try {
         const mcpInstallScript = path.join(__dirname, '..', '..', 'dist', 'mcp', 'install.js');
-        execSync(`node "${mcpInstallScript}" install`, { stdio: 'inherit' });
+        execFileSync('node', [mcpInstallScript, 'install'], { stdio: 'inherit' });
         mcpInstalled = true;
       } catch { logError('MCP install failed. You can retry later with: w mcp install'); }
     }
@@ -169,7 +169,7 @@ function installShellIntegration(): void {
   }
 
   try {
-    execSync(`bash "${scriptPath}" ${shellType}`, { stdio: 'inherit' });
+    execFileSync('bash', [scriptPath, shellType], { stdio: 'inherit' });
   } catch {
     logWarning('Shell integration install failed — you can run it manually:');
     logInfo(`  bash "${scriptPath}" ${shellType}`);

package/src/commands/delete.ts

@@ -1,7 +1,6 @@
 import { Command } from 'commander';
 import * as fs from 'fs/promises';
-import { WORKSPACES_DIR } from '../utils/config';
-import * as path from 'path';
+import { safeWorkspacePath } from '../utils/validation';
 import { listWorkspaces } from '../utils/workspace-meta';
 import { promptMultiWorkspaceSelection } from '../utils/prompts';
 import { logInfo, logSuccess, logError, logWarning } from '../utils/logger';
@@ -35,10 +34,35 @@ async function handleDelete(opts: {
     if (opts.workspace) {
       const selectedNames = parseList(opts.workspace);
       const workspaces = await listWorkspaces();
+      const known = new Map(workspaces.map(ws => [ws.name, ws]));
 
+      // Resolve to validated, existing targets. safeWorkspacePath() both
+      // enforces the name allowlist and pins the path inside WORKSPACES_DIR, so
+      // a name like "../../etc" can never reach fs.rm; unknown names are skipped
+      // rather than deleted at a guessed path.
+      const targets: { name: string; path: string; workspace: typeof workspaces[number] }[] = [];
       for (const name of selectedNames) {
-        const workspace = workspaces.find(ws => ws.name === name);
-        const workspacePath = path.join(WORKSPACES_DIR, name);
+        const workspace = known.get(name);
+        if (!workspace) {
+          logError(`Workspace "${name}" not found — skipping`);
+          continue;
+        }
+        let workspacePath: string;
+        try {
+          workspacePath = safeWorkspacePath(name);
+        } catch (error) {
+          logError(error instanceof Error ? error.message : `Invalid workspace name "${name}"`);
+          continue;
+        }
+        targets.push({ name, path: workspacePath, workspace });
+      }
+
+      if (targets.length === 0) {
+        logInfo('Nothing to delete');
+        return;
+      }
+
+      for (const { name, path: workspacePath, workspace } of targets) {
         if (workspace?.metadata) {
           console.log(`${colorize(name, 'cyan')}`);
           console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
@@ -56,9 +80,9 @@ async function handleDelete(opts: {
           {
             type: 'confirm',
             name: 'confirmed',
-            message: selectedNames.length === 1
-              ? `Delete workspace ${selectedNames[0]}?`
-              : `Delete these ${selectedNames.length} workspaces?`,
+            message: targets.length === 1
+              ? `Delete workspace ${targets[0].name}?`
+              : `Delete these ${targets.length} workspaces?`,
             default: true,
           },
         ]);
@@ -68,8 +92,7 @@ async function handleDelete(opts: {
         }
       }
 
-      for (const name of selectedNames) {
-        const workspacePath = path.join(WORKSPACES_DIR, name);
+      for (const { name, path: workspacePath } of targets) {
         try {
           await fs.rm(workspacePath, { recursive: true, force: true });
           logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
@@ -92,45 +115,56 @@ async function handleDelete(opts: {
 
       const selectedNames = await promptMultiWorkspaceSelection(workspaces);
 
+      // Resolve + validate paths once. Names come from disk, but safeWorkspacePath
+      // must not throw mid-flow and crash the interactive session, so skip any
+      // name that fails the allowlist rather than aborting.
+      const resolved: { name: string; path: string; workspace: typeof workspaces[number] | undefined }[] = [];
       for (const name of selectedNames) {
-        const workspace = workspaces.find(ws => ws.name === name);
-        const workspacePath = path.join(WORKSPACES_DIR, name);
-        if (workspace?.metadata) {
-          console.log(`${colorize(name, 'cyan')}`);
-          console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
-          console.log(`  Created: ${new Date(workspace.metadata.createdAt).toLocaleString()}`);
-          console.log(`  Path: ${workspacePath}`);
-        } else {
-          console.log(`${colorize(name, 'cyan')}`);
-          console.log(`  Path: ${workspacePath}`);
+        try {
+          resolved.push({ name, path: safeWorkspacePath(name), workspace: workspaces.find(ws => ws.name === name) });
+        } catch (error) {
+          logError(error instanceof Error ? error.message : `Invalid workspace name "${name}"`);
         }
       }
-      console.log('');
 
-      logWarning('This will permanently delete all cloned repositories in the selected workspaces!');
+      if (resolved.length > 0) {
+        for (const { name, path: workspacePath, workspace } of resolved) {
+          if (workspace?.metadata) {
+            console.log(`${colorize(name, 'cyan')}`);
+            console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
+            console.log(`  Created: ${new Date(workspace.metadata.createdAt).toLocaleString()}`);
+            console.log(`  Path: ${workspacePath}`);
+          } else {
+            console.log(`${colorize(name, 'cyan')}`);
+            console.log(`  Path: ${workspacePath}`);
+          }
+        }
+        console.log('');
 
-      const confirmMessage = selectedNames.length === 1
-        ? `Delete workspace ${selectedNames[0]}?`
-        : `Delete these ${selectedNames.length} workspaces?`;
+        logWarning('This will permanently delete all cloned repositories in the selected workspaces!');
 
-      const { confirmed } = await inquirer.prompt([
-        {
-          type: 'confirm',
-          name: 'confirmed',
-          message: confirmMessage,
-          default: true,
-        },
-      ]);
+        const confirmMessage = resolved.length === 1
+          ? `Delete workspace ${resolved[0].name}?`
+          : `Delete these ${resolved.length} workspaces?`;
+
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: 'confirm',
+            name: 'confirmed',
+            message: confirmMessage,
+            default: true,
+          },
+        ]);
 
-      if (confirmed) {
-        for (const name of selectedNames) {
-          const workspacePath = path.join(WORKSPACES_DIR, name);
-          try {
-            await fs.rm(workspacePath, { recursive: true, force: true });
-            logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
-          } catch (error) {
-            logError(`Failed to delete "${name}"`);
-            if (error instanceof Error) logError(error.message);
+        if (confirmed) {
+          for (const { name, path: workspacePath } of resolved) {
+            try {
+              await fs.rm(workspacePath, { recursive: true, force: true });
+              logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
+            } catch (error) {
+              logError(`Failed to delete "${name}"`);
+              if (error instanceof Error) logError(error.message);
+            }
           }
         }
       }

package/src/mcp/install.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env ts-node
 
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
 import { logSuccess, logError, logInfo, logWarning } from '../utils/logger';
@@ -37,7 +37,7 @@ function installShellIntegration(): void {
   }
 
   try {
-    execSync(`bash "${scriptPath}" ${shellType}`, { stdio: 'inherit' });
+    execFileSync('bash', [scriptPath, shellType], { stdio: 'inherit' });
     logSuccess('Shell integration installed (auto-CD for w/workspace commands)');
   } catch {
     logInfo('Shell integration install skipped (non-critical)');
@@ -264,8 +264,9 @@ async function install() {
     logInfo(`MCP server path: ${colorize(serverPath, 'cyan')}`);
 
     try {
-      execSync(
-        `claude mcp add nemus -s user -- node "${serverPath}"`,
+      execFileSync(
+        'claude',
+        ['mcp', 'add', 'nemus', '-s', 'user', '--', 'node', serverPath],
         { stdio: 'pipe' }
       );
       logSuccess('MCP server registered globally with Claude Code');

package/src/utils/branch-operations.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// Record execFile invocations; every git call must pass args as an argv ARRAY
+// (no shell), so a branch name with shell metacharacters is inert.
+const mockExecFile = vi.fn();
+vi.mock('child_process', () => ({
+  execFile: (...args: unknown[]) => {
+    const cb = args[args.length - 1] as (e: Error | null, r: { stdout: string; stderr: string }) => void;
+    mockExecFile(args[0], args[1], args[2]);
+    cb(null, { stdout: '', stderr: '' });
+  },
+}));
+vi.mock('./git-status', () => ({ hasUncommittedChanges: vi.fn().mockResolvedValue(false) }));
+
+import { createBranch } from './branch-operations';
+
+describe('branch-operations argv safety (no shell injection)', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('passes a malicious branch name as a single argv element, never a shell string', async () => {
+    const evil = 'foo$(touch /tmp/pwned)';
+    const res = await createBranch('/repo', 'api', evil);
+    expect(res.success).toBe(true);
+
+    // Every call is execFile('git', [...args]) — args is an array, and the evil
+    // name appears verbatim as one element (so the shell never sees it).
+    for (const [bin, args] of mockExecFile.mock.calls) {
+      expect(bin).toBe('git');
+      expect(Array.isArray(args)).toBe(true);
+    }
+    const checkout = mockExecFile.mock.calls.find(([, a]) => (a as string[])[0] === 'checkout');
+    expect(checkout![1]).toEqual(['checkout', '-b', evil]);
+  });
+
+  it('checks out a base branch as its own argv element too', async () => {
+    await createBranch('/repo', 'api', 'feature', 'release/1.0');
+    const calls = mockExecFile.mock.calls.map(([, a]) => a as string[]);
+    expect(calls).toContainEqual(['checkout', 'release/1.0']);
+    expect(calls).toContainEqual(['checkout', '-b', 'feature']);
+  });
+});