@planu/cli 4.11.6 → 4.11.7

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [4.11.7] - 2026-07-18
+
+### Bug Fixes
+- fix: harden shell execution paths
+
+
 ## [4.11.6] - 2026-07-18
 
 ### Bug Fixes

package/dist/engine/actuals/git-analyzer.js

@@ -1,7 +1,7 @@
 // Planu — engine/actuals/git-analyzer.ts (SPEC-061)
 // Derives actuals from git log history for a given spec.
-import { execSync } from 'node:child_process';
-const SPEC_ID_PATTERN = /^SPEC-\d+$/;
+import { execFileSync } from 'node:child_process';
+import { isCanonicalSpecId } from '../../tools/schemas/spec-id.js';
 const MAX_SESSION_GAP_MS = 2 * 60 * 60 * 1000; // 2 hours
 const REVIEW_HOURS_RATIO = 0.15;
 const MINIMUM_DEV_HOURS = 1;
@@ -121,7 +121,7 @@ export function calculateLinesChanged(commits) {
  * Returns null if specId is invalid or no commits are found.
  */
 export function deriveActualsFromGit(projectPath, specId) {
-    if (!SPEC_ID_PATTERN.test(specId)) {
+    if (!isCanonicalSpecId(specId)) {
         return Promise.resolve(null);
     }
     const gitOutput = runGitLog(projectPath, specId);
@@ -155,7 +155,7 @@ export function deriveActualsFromGit(projectPath, specId) {
 }
 function runGitLog(projectPath, specId) {
     try {
-        const result = execSync(`git log --format="%H|%aI|%s" --numstat --all --grep="${specId}"`, {
+        const result = execFileSync('git', ['log', '--format=%H|%aI|%s', '--numstat', '--all', '--grep', specId], {
             cwd: projectPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],

package/dist/engine/diff-spec-generator.js

@@ -1,5 +1,6 @@
 // engine/diff-spec-generator.ts — Diff-to-Spec generator (SPEC-350)
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { assertPositivePrNumber, assertSafeGitDiffRange } from './git-safe-input.js';
 // ---------------------------------------------------------------------------
 // Diff analysis
 // ---------------------------------------------------------------------------
@@ -88,9 +89,12 @@ export function generateSpecDraft(analysis, sourceType, sourceRef, titleOverride
 // ---------------------------------------------------------------------------
 export function runGitDiff(repoPath, commitRange) {
     const range = commitRange ?? 'HEAD~1..HEAD';
-    const cmd = `git -C "${repoPath}" diff ${range}`;
+    assertSafeGitDiffRange(range);
     try {
-        return execSync(cmd, { encoding: 'utf-8', timeout: 15_000 });
+        return execFileSync('git', ['-C', repoPath, 'diff', range], {
+            encoding: 'utf-8',
+            timeout: 15_000,
+        });
     }
     catch (err) {
         throw new Error(`Failed to run git diff: ${err instanceof Error ? err.message : String(err)}. ` +
@@ -98,9 +102,12 @@ export function runGitDiff(repoPath, commitRange) {
     }
 }
 export function runGhPrDiff(repoPath, prNumber) {
-    const cmd = `gh pr diff ${prNumber} --repo "${repoPath}"`;
+    assertPositivePrNumber(prNumber);
     try {
-        return execSync(cmd, { encoding: 'utf-8', timeout: 20_000 });
+        return execFileSync('gh', ['pr', 'diff', String(prNumber), '--repo', repoPath], {
+            encoding: 'utf-8',
+            timeout: 20_000,
+        });
     }
     catch (err) {
         throw new Error(`Failed to run gh pr diff: ${err instanceof Error ? err.message : String(err)}. ` +

package/dist/engine/git-safe-input.d.ts

@@ -0,0 +1,6 @@
+export declare function isSafeGitRef(value: string): boolean;
+export declare function assertSafeGitRef(value: string, label?: string): void;
+export declare function isSafeGitDiffRange(value: string): boolean;
+export declare function assertSafeGitDiffRange(value: string): void;
+export declare function assertPositivePrNumber(value: number): void;
+//# sourceMappingURL=git-safe-input.d.ts.map

package/dist/engine/git-safe-input.js

@@ -0,0 +1,41 @@
+const SAFE_GIT_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/@{}:+~-]{0,200}$/;
+function hasShellMetacharacters(value) {
+    return /[\s`$;&|<>\\\n\r]/.test(value);
+}
+export function isSafeGitRef(value) {
+    return (value.length > 0 &&
+        SAFE_GIT_REF_PATTERN.test(value) &&
+        !value.startsWith('-') &&
+        !value.includes('..') &&
+        !hasShellMetacharacters(value));
+}
+export function assertSafeGitRef(value, label = 'git ref') {
+    if (!isSafeGitRef(value)) {
+        throw new Error(`Invalid ${label}. Use a canonical commit hash or git ref without whitespace or shell metacharacters.`);
+    }
+}
+export function isSafeGitDiffRange(value) {
+    if (value.length === 0 || hasShellMetacharacters(value)) {
+        return false;
+    }
+    if (value.includes('...')) {
+        const parts = value.split('...');
+        return parts.length === 2 && parts.every((part) => part !== '' && isSafeGitRef(part));
+    }
+    if (value.includes('..')) {
+        const parts = value.split('..');
+        return parts.length === 2 && parts.every((part) => part !== '' && isSafeGitRef(part));
+    }
+    return isSafeGitRef(value);
+}
+export function assertSafeGitDiffRange(value) {
+    if (!isSafeGitDiffRange(value)) {
+        throw new Error('Invalid commitRange. Use a canonical git ref or a safe range like base..head or base...head.');
+    }
+}
+export function assertPositivePrNumber(value) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new Error('Invalid prNumber. Use a positive integer pull request number.');
+    }
+}
+//# sourceMappingURL=git-safe-input.js.map

package/dist/tools/code-impact-handler.js

@@ -2,10 +2,12 @@
 import { listSpecs } from '../storage/spec-store.js';
 import { hashProjectPath } from '../storage/base-store.js';
 import { analyzeCodeImpact, checkCodeChangeCompliance, suggestSpecUpdates, runGitDiffImpact, } from '../engine/code-impact-analyzer.js';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { assertSafeGitRef } from '../engine/git-safe-input.js';
 function getCommitDiff(commitHash, projectPath) {
+    assertSafeGitRef(commitHash, 'commit ref');
     try {
-        return execSync(`git show ${commitHash}`, {
+        return execFileSync('git', ['show', commitHash], {
             cwd: projectPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],

package/dist/tools/update-status/index.js

@@ -14,6 +14,7 @@ import { checkApprovalGate } from '../../engine/approval-workflow.js';
 import * as approvalStore from '../../storage/approval-store.js';
 import { isLocked, getLock } from '../../storage/spec-lock-store.js';
 import { runValidateGate, checkDoneGates, checkComplianceGate, checkQaGate, checkApprovedFormatGate, readApprovedValidationReportGate, checkSpecReviewGate, writeSpecReviewArtifact, } from './dod-gates.js';
+import { writeImplementationReviewReport } from '../../engine/validator/validation-report-writer.js';
 import { checkLifecycleEvidenceTransitionGate } from './evidence-gate.js';
 import { buildStatusResponse, buildValidateBlockedResponse, buildDryRunResponse, } from './response-builder.js';
 import { recordDoneMetrics, syncSpecFiles, tryReconcile, recordTerminalTransitionEvent, } from './file-sync.js';
@@ -570,16 +571,6 @@ export async function handleUpdateStatus(params, server) {
                         validateScoreSource = 'validateSpec';
                     }
                 }
-                if (newStatus === 'done' && !(params.force ?? params.forceStatus ?? false)) {
-                    validationReportGate = await readApprovedValidationReportGate(specId, projectId, false);
-                    if (!validationReportGate.ok) {
-                        return validationReportGate.error;
-                    }
-                    if (validationReportGate.score !== null) {
-                        validateScore = validationReportGate.score;
-                        validateScoreSource = 'validation-report';
-                    }
-                }
                 if (newStatus === 'done' &&
                     effectiveGatePath &&
                     !shouldSkipStrictLayoutGateForLegacyTestHarness()) {
@@ -627,6 +618,27 @@ export async function handleUpdateStatus(params, server) {
                         lintWarnings: [],
                         testWarnings: [],
                     };
+                if (newStatus === 'done' && !(params.force ?? params.forceStatus ?? false)) {
+                    if (!isDryRun && effectiveGatePath) {
+                        await writeImplementationReviewReport({
+                            projectId,
+                            specId,
+                            spec,
+                            projectPath: effectiveGatePath,
+                            score: validateScore,
+                            lintPassed: lintWarnings.length === 0,
+                            conventionRegression: conventionWarnings.length > 0,
+                        });
+                    }
+                    validationReportGate = await readApprovedValidationReportGate(specId, projectId, false);
+                    if (!validationReportGate.ok) {
+                        return validationReportGate.error;
+                    }
+                    if (validationReportGate.score !== null) {
+                        validateScore = validationReportGate.score;
+                        validateScoreSource = 'validation-report';
+                    }
+                }
                 // SPEC-731: dry_run short-circuit — all gates have been evaluated above.
                 // Do NOT call transitionSpec, appendTransitionEvent, or acquire any lock.
                 if (isDryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.11.6",
+  "version": "4.11.7",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,14 +34,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.11.6",
-    "@planu/core-darwin-x64": "4.11.6",
-    "@planu/core-linux-arm64-gnu": "4.11.6",
-    "@planu/core-linux-arm64-musl": "4.11.6",
-    "@planu/core-linux-x64-gnu": "4.11.6",
-    "@planu/core-linux-x64-musl": "4.11.6",
-    "@planu/core-win32-arm64-msvc": "4.11.6",
-    "@planu/core-win32-x64-msvc": "4.11.6"
+    "@planu/core-darwin-arm64": "4.11.7",
+    "@planu/core-darwin-x64": "4.11.7",
+    "@planu/core-linux-arm64-gnu": "4.11.7",
+    "@planu/core-linux-arm64-musl": "4.11.7",
+    "@planu/core-linux-x64-gnu": "4.11.7",
+    "@planu/core-linux-x64-musl": "4.11.7",
+    "@planu/core-win32-arm64-msvc": "4.11.7",
+    "@planu/core-win32-x64-msvc": "4.11.7"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.11.6",
+  "version": "4.11.7",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "4.11.6",
+  "version": "4.11.7",
   "icon": "assets/plugin/icon.svg",
   "command": [
     "npx",