@yemi33/minions 0.1.2070 → 0.1.2071

package/engine/gh-token.js

@@ -18,7 +18,7 @@
  * via `_setTokenForTest(slug, token)` and clear it via `_clearTokenCache()`.
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const path = require('path');
 const shared = require('./shared');
 const { safeJson, MINIONS_DIR, log } = shared;
@@ -70,14 +70,12 @@ function _fetchTokenForAccount(account, opts = {}) {
   const cached = _accountTokens.get(account);
   if (cached && cached.expiresAt > Date.now()) return cached.token;
 
-  const run = opts.execSync || execSync;
+  const run = opts.execFileSync || execFileSync;
   try {
-    // Argv form via `gh` is safer than constructing a shell string when account
-    // names ever include odd chars; using execSync's command form here for
-    // consistency with ado-token.js, but the account name flows from a config
-    // map under our control (validated at write time).
-    const cmd = `gh auth token --user ${account} --hostname github.com`;
-    const out = run(cmd, {
+    // Argv-array form: `account` is passed as a literal argument and never
+    // interpreted by a shell, so shell metacharacters in the configured
+    // account name (e.g. `;`, backticks, `$()`) cannot be executed.
+    const out = run('gh', ['auth', 'token', '--user', account, '--hostname', 'github.com'], {
       timeout: FETCH_TIMEOUT_MS,
       encoding: 'utf8',
       windowsHide: true,
@@ -102,7 +100,7 @@ function _fetchTokenForAccount(account, opts = {}) {
  * caller should fall back to the ambient `gh` identity.
  *
  * Test seam: `_setTokenForTest(slug, token)` short-circuits the entire chain
- * so unit tests do not have to mock execSync nor stand up a config file.
+ * so unit tests do not have to mock execFileSync nor stand up a config file.
  */
 function resolveTokenForSlug(slug, opts = {}) {
   if (slug && _slugTokenOverrides.has(slug)) return _slugTokenOverrides.get(slug);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2070",
+  "version": "0.1.2071",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"