@nemus-cli/nemus 0.2.9 → 0.2.11

package/src/commands/delete.ts

@@ -1,7 +1,6 @@
 import { Command } from 'commander';
 import * as fs from 'fs/promises';
-import { WORKSPACES_DIR } from '../utils/config';
-import * as path from 'path';
+import { safeWorkspacePath } from '../utils/validation';
 import { listWorkspaces } from '../utils/workspace-meta';
 import { promptMultiWorkspaceSelection } from '../utils/prompts';
 import { logInfo, logSuccess, logError, logWarning } from '../utils/logger';
@@ -35,10 +34,35 @@ async function handleDelete(opts: {
     if (opts.workspace) {
       const selectedNames = parseList(opts.workspace);
       const workspaces = await listWorkspaces();
+      const known = new Map(workspaces.map(ws => [ws.name, ws]));
 
+      // Resolve to validated, existing targets. safeWorkspacePath() both
+      // enforces the name allowlist and pins the path inside WORKSPACES_DIR, so
+      // a name like "../../etc" can never reach fs.rm; unknown names are skipped
+      // rather than deleted at a guessed path.
+      const targets: { name: string; path: string; workspace: typeof workspaces[number] }[] = [];
       for (const name of selectedNames) {
-        const workspace = workspaces.find(ws => ws.name === name);
-        const workspacePath = path.join(WORKSPACES_DIR, name);
+        const workspace = known.get(name);
+        if (!workspace) {
+          logError(`Workspace "${name}" not found — skipping`);
+          continue;
+        }
+        let workspacePath: string;
+        try {
+          workspacePath = safeWorkspacePath(name);
+        } catch (error) {
+          logError(error instanceof Error ? error.message : `Invalid workspace name "${name}"`);
+          continue;
+        }
+        targets.push({ name, path: workspacePath, workspace });
+      }
+
+      if (targets.length === 0) {
+        logInfo('Nothing to delete');
+        return;
+      }
+
+      for (const { name, path: workspacePath, workspace } of targets) {
         if (workspace?.metadata) {
           console.log(`${colorize(name, 'cyan')}`);
           console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
@@ -56,9 +80,9 @@ async function handleDelete(opts: {
           {
             type: 'confirm',
             name: 'confirmed',
-            message: selectedNames.length === 1
-              ? `Delete workspace ${selectedNames[0]}?`
-              : `Delete these ${selectedNames.length} workspaces?`,
+            message: targets.length === 1
+              ? `Delete workspace ${targets[0].name}?`
+              : `Delete these ${targets.length} workspaces?`,
             default: true,
           },
         ]);
@@ -68,8 +92,7 @@ async function handleDelete(opts: {
         }
       }
 
-      for (const name of selectedNames) {
-        const workspacePath = path.join(WORKSPACES_DIR, name);
+      for (const { name, path: workspacePath } of targets) {
         try {
           await fs.rm(workspacePath, { recursive: true, force: true });
           logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
@@ -92,45 +115,56 @@ async function handleDelete(opts: {
 
       const selectedNames = await promptMultiWorkspaceSelection(workspaces);
 
+      // Resolve + validate paths once. Names come from disk, but safeWorkspacePath
+      // must not throw mid-flow and crash the interactive session, so skip any
+      // name that fails the allowlist rather than aborting.
+      const resolved: { name: string; path: string; workspace: typeof workspaces[number] | undefined }[] = [];
       for (const name of selectedNames) {
-        const workspace = workspaces.find(ws => ws.name === name);
-        const workspacePath = path.join(WORKSPACES_DIR, name);
-        if (workspace?.metadata) {
-          console.log(`${colorize(name, 'cyan')}`);
-          console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
-          console.log(`  Created: ${new Date(workspace.metadata.createdAt).toLocaleString()}`);
-          console.log(`  Path: ${workspacePath}`);
-        } else {
-          console.log(`${colorize(name, 'cyan')}`);
-          console.log(`  Path: ${workspacePath}`);
+        try {
+          resolved.push({ name, path: safeWorkspacePath(name), workspace: workspaces.find(ws => ws.name === name) });
+        } catch (error) {
+          logError(error instanceof Error ? error.message : `Invalid workspace name "${name}"`);
         }
       }
-      console.log('');
 
-      logWarning('This will permanently delete all cloned repositories in the selected workspaces!');
+      if (resolved.length > 0) {
+        for (const { name, path: workspacePath, workspace } of resolved) {
+          if (workspace?.metadata) {
+            console.log(`${colorize(name, 'cyan')}`);
+            console.log(`  Repositories: ${workspace.metadata.repositories.length}`);
+            console.log(`  Created: ${new Date(workspace.metadata.createdAt).toLocaleString()}`);
+            console.log(`  Path: ${workspacePath}`);
+          } else {
+            console.log(`${colorize(name, 'cyan')}`);
+            console.log(`  Path: ${workspacePath}`);
+          }
+        }
+        console.log('');
 
-      const confirmMessage = selectedNames.length === 1
-        ? `Delete workspace ${selectedNames[0]}?`
-        : `Delete these ${selectedNames.length} workspaces?`;
+        logWarning('This will permanently delete all cloned repositories in the selected workspaces!');
 
-      const { confirmed } = await inquirer.prompt([
-        {
-          type: 'confirm',
-          name: 'confirmed',
-          message: confirmMessage,
-          default: true,
-        },
-      ]);
+        const confirmMessage = resolved.length === 1
+          ? `Delete workspace ${resolved[0].name}?`
+          : `Delete these ${resolved.length} workspaces?`;
+
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: 'confirm',
+            name: 'confirmed',
+            message: confirmMessage,
+            default: true,
+          },
+        ]);
 
-      if (confirmed) {
-        for (const name of selectedNames) {
-          const workspacePath = path.join(WORKSPACES_DIR, name);
-          try {
-            await fs.rm(workspacePath, { recursive: true, force: true });
-            logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
-          } catch (error) {
-            logError(`Failed to delete "${name}"`);
-            if (error instanceof Error) logError(error.message);
+        if (confirmed) {
+          for (const { name, path: workspacePath } of resolved) {
+            try {
+              await fs.rm(workspacePath, { recursive: true, force: true });
+              logSuccess(`Deleted "${colorize(name, 'cyan')}"`);
+            } catch (error) {
+              logError(`Failed to delete "${name}"`);
+              if (error instanceof Error) logError(error.message);
+            }
           }
         }
       }

package/src/commands/doctor.ts

@@ -4,6 +4,7 @@ import { WORKSPACES_DIR } from '../utils/config';
 import { loadMetadata } from '../utils/workspace-meta';
 import { runAllHealthChecks, calculateHealthScore } from '../utils/health-checks';
 import { logError, logInfo, logStep, logSuccess, logWarning } from '../utils/logger';
+import { outputJson, outputJsonError } from '../utils/output';
 import { colorize } from '../utils/colors';
 import { HealthCheckResult } from '../types';
 import { resolveWorkspace } from '../utils/command-helpers';
@@ -59,22 +60,44 @@ export function registerDoctorCommand(parent: Command) {
     .alias('doc')
     .description('Run comprehensive health checks')
     .argument('[workspace]', 'Workspace name')
-    .action(async (workspace) => {
-      await handleDoctor(workspace);
+    .option('--json', 'Output as JSON')
+    .action(async (workspace, opts) => {
+      await handleDoctor(workspace, opts);
     });
 }
 
-async function handleDoctor(workspaceArg?: string) {
+async function handleDoctor(workspaceArg?: string, opts: { json?: boolean } = {}) {
+  // In --json mode, failures are parseable JSON on stdout + exit 1; otherwise a
+  // human log on stderr. `process.exit(1)` stays the last statement so TS still
+  // narrows `metadata` to non-null below.
   try {
+    // JSON mode is non-interactive: require an explicit workspace rather than prompt.
+    if (opts.json && !workspaceArg) {
+      outputJsonError('doctor --json requires a workspace name');
+      process.exit(1);
+    }
     const selectedWorkspace = await resolveWorkspace(workspaceArg);
     const workspacePath = path.join(WORKSPACES_DIR, selectedWorkspace);
     const metadata = await loadMetadata(workspacePath);
 
     if (!metadata) {
-      logError(`Workspace metadata not found for: ${selectedWorkspace}`);
+      if (opts.json) outputJsonError(`Workspace metadata not found for: ${selectedWorkspace}`);
+      else logError(`Workspace metadata not found for: ${selectedWorkspace}`);
       process.exit(1);
     }
 
+    if (opts.json) {
+      const results = await runAllHealthChecks(workspacePath, metadata);
+      const score = calculateHealthScore(results);
+      const overall = results.some(r => r.status === 'error')
+        ? 'error'
+        : results.some(r => r.status === 'warning')
+          ? 'warning'
+          : 'healthy';
+      outputJson({ workspace: selectedWorkspace, score, status: overall, checks: results });
+      return;
+    }
+
     logStep(`Running health checks for workspace: ${colorize(selectedWorkspace, 'cyan')}`);
     logInfo('This may take a moment...');
 
@@ -101,9 +124,11 @@ async function handleDoctor(workspaceArg?: string) {
       logSuccess('All health checks passed! Your workspace is in good shape.');
     }
   } catch (error) {
-    logError('Failed to run health checks');
-    if (error instanceof Error) {
-      logError(error.message);
+    if (opts.json) {
+      outputJsonError(error instanceof Error ? error.message : 'Failed to run health checks');
+    } else {
+      logError('Failed to run health checks');
+      if (error instanceof Error) logError(error.message);
     }
     process.exit(1);
   }

package/src/commands/list.test.ts

@@ -196,6 +196,36 @@ describe('list-workspaces main', () => {
     expect(messages).toContainEqual(expect.stringContaining('ws-a'));
   });
 
+  it('--json: writes one valid JSON document to stdout and does not prompt', async () => {
+    const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    process.argv = ['node', 'list-workspaces.js', '--json'];
+    mockListWorkspaces.mockResolvedValueOnce(makeWorkspaceList('ws-a', 'ws-b'));
+
+    await main();
+
+    expect(mockPrompt).not.toHaveBeenCalled();
+    expect(writeSpy).toHaveBeenCalledTimes(1);
+    const payload = JSON.parse(writeSpy.mock.calls[0][0] as string);
+    expect(payload.count).toBe(2);
+    expect(payload.workspaces.map((w: any) => w.name).sort()).toEqual(['ws-a', 'ws-b']);
+    expect(payload.workspaces[0]).toMatchObject({ repoCount: 1, hasSession: false });
+    writeSpy.mockRestore();
+  });
+
+  it('--json: empty list emits count 0, no prompt, no log noise', async () => {
+    const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    process.argv = ['node', 'list-workspaces.js', '--json'];
+    mockListWorkspaces.mockResolvedValueOnce([]);
+
+    await main();
+
+    expect(logInfo).not.toHaveBeenCalled();
+    expect(mockPrompt).not.toHaveBeenCalled();
+    const payload = JSON.parse(writeSpy.mock.calls[0][0] as string);
+    expect(payload).toEqual({ archived: false, count: 0, workspaces: [] });
+    writeSpy.mockRestore();
+  });
+
   it('sorts workspaces with sessions before those without', async () => {
     mockListWorkspaces.mockResolvedValueOnce(makeWorkspaceList('no-session', 'has-session'));
     mockGetWorkspaceSessions.mockResolvedValueOnce([{

package/src/commands/list.ts

@@ -5,6 +5,7 @@ import * as fsPromises from 'fs/promises';
 import { listWorkspaces } from '../utils/workspace-meta';
 import { getWorkspaceSessions } from '../utils/claude-sessions';
 import { logInfo, logError } from '../utils/logger';
+import { outputJson } from '../utils/output';
 import { colorize } from '../utils/colors';
 import inquirer from 'inquirer';
 import autocompletePrompt from 'inquirer-autocomplete-prompt';
@@ -31,12 +32,13 @@ export function registerListCommand(parent: Command) {
     .alias('l')
     .description('List workspaces and navigate to one')
     .option('-a, --archived', 'Show archived workspaces')
+    .option('--json', 'Output as JSON (no interactive selection)')
     .action(async (opts) => {
       await handleList(opts);
     });
 }
 
-async function handleList(opts: { archived?: boolean }) {
+async function handleList(opts: { archived?: boolean; json?: boolean }) {
   const showArchived = opts.archived ?? false;
   const title = showArchived ? 'Archived Workspaces' : 'Existing Workspaces';
 
@@ -49,6 +51,10 @@ async function handleList(opts: { archived?: boolean }) {
     ]);
 
     if (workspaces.length === 0) {
+      if (opts.json) {
+        outputJson({ archived: showArchived, count: 0, workspaces: [] });
+        return;
+      }
       console.log('\n' + '='.repeat(60));
       console.log(colorize(title, 'bright'));
       console.log('='.repeat(60) + '\n');
@@ -85,6 +91,23 @@ async function handleList(opts: { archived?: boolean }) {
       return new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
     });
 
+    // JSON mode: one document to stdout, no table, no interactive selection.
+    if (opts.json) {
+      outputJson({
+        archived: showArchived,
+        count: items.length,
+        workspaces: items.map(i => ({
+          name: i.name,
+          path: i.wsPath,
+          repoCount: i.repoCount,
+          createdAt: i.createdAt || null,
+          lastActive: i.lastActiveLabel,
+          hasSession: i.hasSession,
+        })),
+      });
+      return;
+    }
+
     console.log('');
     console.log(colorize('  ' + title, 'bright') + colorize('  (sorted by last active)', 'dim'));
     console.log(colorize('  ' + '─'.repeat(54), 'dim'));
@@ -172,5 +195,6 @@ async function handleList(opts: { archived?: boolean }) {
 export async function main() {
   const args = process.argv.slice(2);
   const archived = args.includes('--archived') || args.includes('-a');
-  await handleList({ archived });
+  const json = args.includes('--json');
+  await handleList({ archived, json });
 }

package/src/commands/status.ts

@@ -4,6 +4,7 @@ import { WORKSPACES_DIR } from '../utils/config';
 import { loadMetadata } from '../utils/workspace-meta';
 import { getAllReposStatus } from '../utils/git-status';
 import { logError, logInfo, logStep } from '../utils/logger';
+import { outputJson, outputJsonError } from '../utils/output';
 import { colorize } from '../utils/colors';
 import { resolveWorkspace } from '../utils/command-helpers';
 
@@ -78,33 +79,59 @@ export function registerStatusCommand(parent: Command) {
     .alias('st')
     .description('Show git status across all repos')
     .argument('[workspace]', 'Workspace name')
-    .action(async (workspace) => {
-      await handleStatus(workspace);
+    .option('--json', 'Output as JSON')
+    .action(async (workspace, opts) => {
+      await handleStatus(workspace, opts);
     });
 }
 
-async function handleStatus(workspaceArg?: string) {
+async function handleStatus(workspaceArg?: string, opts: { json?: boolean } = {}) {
+  // In --json mode, failures are parseable JSON on stdout + exit 1; otherwise a
+  // human log on stderr. `process.exit(1)` stays the last statement so TS still
+  // narrows `metadata` to non-null below.
   try {
+    // JSON mode is non-interactive: require an explicit workspace rather than prompt.
+    if (opts.json && !workspaceArg) {
+      outputJsonError('status --json requires a workspace name');
+      process.exit(1);
+    }
     const selectedWorkspace = await resolveWorkspace(workspaceArg);
     const workspacePath = path.join(WORKSPACES_DIR, selectedWorkspace);
     const metadata = await loadMetadata(workspacePath);
 
     if (!metadata) {
-      logError(`Workspace metadata not found for: ${selectedWorkspace}`);
+      if (opts.json) outputJsonError(`Workspace metadata not found for: ${selectedWorkspace}`);
+      else logError(`Workspace metadata not found for: ${selectedWorkspace}`);
       process.exit(1);
     }
 
+    const repoDirectoryNames = metadata.repositories.map(r => r.directoryName);
+
+    if (opts.json) {
+      const statuses = await getAllReposStatus(workspacePath, repoDirectoryNames, 3);
+      outputJson({
+        workspace: selectedWorkspace,
+        path: workspacePath,
+        repoCount: statuses.length,
+        clean: statuses.every(s => s.clean),
+        repositories: statuses,
+      });
+      return;
+    }
+
     logStep(`Checking status for workspace: ${colorize(selectedWorkspace, 'cyan')}`);
     logInfo(`Found ${metadata.repositories.length} repositories`);
 
-    const repoDirectoryNames = metadata.repositories.map(r => r.directoryName);
     const statuses = await getAllReposStatus(workspacePath, repoDirectoryNames, 3);
 
     displayStatusTable(statuses);
   } catch (error) {
-    logError('Failed to check workspace status');
-    if (error instanceof Error) {
-      logError(error.message);
+    const msg = error instanceof Error ? error.message : 'Failed to check workspace status';
+    if (opts.json) {
+      outputJsonError(msg);
+    } else {
+      logError('Failed to check workspace status');
+      if (error instanceof Error) logError(error.message);
     }
     process.exit(1);
   }

package/src/mcp/install.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env ts-node
 
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
 import { logSuccess, logError, logInfo, logWarning } from '../utils/logger';
@@ -37,7 +37,7 @@ function installShellIntegration(): void {
   }
 
   try {
-    execSync(`bash "${scriptPath}" ${shellType}`, { stdio: 'inherit' });
+    execFileSync('bash', [scriptPath, shellType], { stdio: 'inherit' });
     logSuccess('Shell integration installed (auto-CD for w/workspace commands)');
   } catch {
     logInfo('Shell integration install skipped (non-critical)');
@@ -264,8 +264,9 @@ async function install() {
     logInfo(`MCP server path: ${colorize(serverPath, 'cyan')}`);
 
     try {
-      execSync(
-        `claude mcp add nemus -s user -- node "${serverPath}"`,
+      execFileSync(
+        'claude',
+        ['mcp', 'add', 'nemus', '-s', 'user', '--', 'node', serverPath],
         { stdio: 'pipe' }
       );
       logSuccess('MCP server registered globally with Claude Code');

package/src/utils/branch-operations.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// Record execFile invocations; every git call must pass args as an argv ARRAY
+// (no shell), so a branch name with shell metacharacters is inert.
+const mockExecFile = vi.fn();
+vi.mock('child_process', () => ({
+  execFile: (...args: unknown[]) => {
+    const cb = args[args.length - 1] as (e: Error | null, r: { stdout: string; stderr: string }) => void;
+    mockExecFile(args[0], args[1], args[2]);
+    cb(null, { stdout: '', stderr: '' });
+  },
+}));
+vi.mock('./git-status', () => ({ hasUncommittedChanges: vi.fn().mockResolvedValue(false) }));
+
+import { createBranch } from './branch-operations';
+
+describe('branch-operations argv safety (no shell injection)', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('passes a malicious branch name as a single argv element, never a shell string', async () => {
+    const evil = 'foo$(touch /tmp/pwned)';
+    const res = await createBranch('/repo', 'api', evil);
+    expect(res.success).toBe(true);
+
+    // Every call is execFile('git', [...args]) — args is an array, and the evil
+    // name appears verbatim as one element (so the shell never sees it).
+    for (const [bin, args] of mockExecFile.mock.calls) {
+      expect(bin).toBe('git');
+      expect(Array.isArray(args)).toBe(true);
+    }
+    const checkout = mockExecFile.mock.calls.find(([, a]) => (a as string[])[0] === 'checkout');
+    expect(checkout![1]).toEqual(['checkout', '-b', evil]);
+  });
+
+  it('checks out a base branch as its own argv element too', async () => {
+    await createBranch('/repo', 'api', 'feature', 'release/1.0');
+    const calls = mockExecFile.mock.calls.map(([, a]) => a as string[]);
+    expect(calls).toContainEqual(['checkout', 'release/1.0']);
+    expect(calls).toContainEqual(['checkout', '-b', 'feature']);
+  });
+});

package/src/utils/branch-operations.ts

@@ -1,10 +1,13 @@
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs/promises';
-import * as path from 'path';
 import { hasUncommittedChanges } from './git-status';
 
-const execAsync = promisify(exec);
+// execFile (no shell): git args are passed as an argv array, so a branch name
+// containing shell metacharacters can never be interpreted as a command.
+const execFileAsync = promisify(execFile);
+const git = (args: string[], opts: { cwd: string; timeout?: number }) =>
+  execFileAsync('git', args, opts);
 const GIT_TIMEOUT = 30000;
 
 export interface BranchSwitchResult {
@@ -34,7 +37,7 @@ export const switchBranch = async (
 
     // Check if it's a git repository
     try {
-      await execAsync('git rev-parse --git-dir', { cwd: repoPath });
+      await git(['rev-parse', '--git-dir'], { cwd: repoPath });
     } catch {
       return {
         repo: repoName,
@@ -44,7 +47,7 @@ export const switchBranch = async (
     }
 
     // Get current branch
-    const { stdout: currentBranchOutput } = await execAsync('git branch --show-current', { cwd: repoPath });
+    const { stdout: currentBranchOutput } = await git(['branch', '--show-current'], { cwd: repoPath });
     const currentBranch = currentBranchOutput.trim();
 
     if (currentBranch === targetBranch) {
@@ -57,7 +60,7 @@ export const switchBranch = async (
     }
 
     // Check for uncommitted changes
-    const { stdout: statusOutput } = await execAsync('git status --porcelain', { cwd: repoPath });
+    const { stdout: statusOutput } = await git(['status', '--porcelain'], { cwd: repoPath });
     if (statusOutput.trim().length > 0) {
       return {
         repo: repoName,
@@ -68,17 +71,17 @@ export const switchBranch = async (
     }
 
     // Fetch to ensure we have latest branches
-    await execAsync('git fetch', { cwd: repoPath, timeout: GIT_TIMEOUT });
+    await git(['fetch'], { cwd: repoPath, timeout: GIT_TIMEOUT });
 
     // Check if branch exists locally
     try {
-      await execAsync(`git rev-parse --verify ${targetBranch}`, { cwd: repoPath });
+      await git(['rev-parse', '--verify', targetBranch], { cwd: repoPath });
     } catch {
       // Branch doesn't exist locally, check remote
       try {
-        await execAsync(`git rev-parse --verify origin/${targetBranch}`, { cwd: repoPath });
+        await git(['rev-parse', '--verify', `origin/${targetBranch}`], { cwd: repoPath });
         // Branch exists on remote, create local tracking branch
-        await execAsync(`git checkout -b ${targetBranch} origin/${targetBranch}`, { cwd: repoPath });
+        await git(['checkout', '-b', targetBranch, `origin/${targetBranch}`], { cwd: repoPath });
         return {
           repo: repoName,
           status: 'success',
@@ -96,7 +99,7 @@ export const switchBranch = async (
     }
 
     // Switch to existing local branch
-    await execAsync(`git checkout ${targetBranch}`, { cwd: repoPath });
+    await git(['checkout', targetBranch], { cwd: repoPath });
 
     return {
       repo: repoName,
@@ -143,17 +146,11 @@ export const createBranch = async (
 
     // Checkout base branch if specified
     if (baseBranch) {
-      await execAsync(`git checkout ${baseBranch}`, {
-        cwd: repoPath,
-        timeout: GIT_TIMEOUT,
-      });
+      await git(['checkout', baseBranch], { cwd: repoPath, timeout: GIT_TIMEOUT });
     }
 
     // Create and checkout new branch
-    await execAsync(`git checkout -b ${branchName}`, {
-      cwd: repoPath,
-      timeout: GIT_TIMEOUT,
-    });
+    await git(['checkout', '-b', branchName], { cwd: repoPath, timeout: GIT_TIMEOUT });
 
     return {
       repo: repoName,
@@ -179,21 +176,15 @@ export const mergeBranch = async (
 ): Promise<BranchOperationResult> => {
   try {
     // Checkout target branch
-    await execAsync(`git checkout ${targetBranch}`, {
-      cwd: repoPath,
-      timeout: GIT_TIMEOUT,
-    });
-
-    // Build merge command
-    let mergeCmd = `git merge ${sourceBranch}`;
-    if (options?.noFf) mergeCmd += ' --no-ff';
-    if (options?.ffOnly) mergeCmd += ' --ff-only';
-    if (options?.squash) mergeCmd += ' --squash';
-
-    await execAsync(mergeCmd, {
-      cwd: repoPath,
-      timeout: GIT_TIMEOUT,
-    });
+    await git(['checkout', targetBranch], { cwd: repoPath, timeout: GIT_TIMEOUT });
+
+    // Build merge argv
+    const mergeArgs = ['merge', sourceBranch];
+    if (options?.noFf) mergeArgs.push('--no-ff');
+    if (options?.ffOnly) mergeArgs.push('--ff-only');
+    if (options?.squash) mergeArgs.push('--squash');
+
+    await git(mergeArgs, { cwd: repoPath, timeout: GIT_TIMEOUT });
 
     return {
       repo: repoName,
@@ -216,10 +207,7 @@ export const rebaseBranch = async (
   targetBranch: string
 ): Promise<BranchOperationResult> => {
   try {
-    await execAsync(`git rebase ${targetBranch}`, {
-      cwd: repoPath,
-      timeout: GIT_TIMEOUT,
-    });
+    await git(['rebase', targetBranch], { cwd: repoPath, timeout: GIT_TIMEOUT });
 
     return {
       repo: repoName,

package/src/utils/cleanup-operations.ts

@@ -1,9 +1,9 @@
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs/promises';
 import * as path from 'path';
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export interface CleanupResult {
   operation: string;
@@ -14,7 +14,7 @@ export interface CleanupResult {
 
 export const calculateDirSize = async (dirPath: string): Promise<number> => {
   try {
-    const { stdout } = await execAsync(`du -sk "${dirPath}"`);
+    const { stdout } = await execFileAsync('du', ['-sk', dirPath]);
     const sizeInKB = parseInt(stdout.split('\t')[0], 10);
     return sizeInKB;
   } catch {
@@ -72,10 +72,10 @@ export const removeBuildArtifacts = async (repoPath: string): Promise<CleanupRes
 
 export const gitClean = async (repoPath: string, dryRun: boolean = false): Promise<CleanupResult> => {
   try {
-    const cmd = dryRun ? 'git clean -fdxn' : 'git clean -fdx';
-    const { stdout } = await execAsync(cmd, { cwd: repoPath });
+    const args = dryRun ? ['clean', '-fdxn'] : ['clean', '-fdx'];
+    const { stdout } = await execFileAsync('git', args, { cwd: repoPath });
 
-    const lines = stdout.split('\n').filter(l => l.trim());
+    const lines = stdout.split('\n').filter((l: string) => l.trim());
 
     return {
       operation: 'Git clean',