agentic-qe 3.7.19 → 3.7.21

package/dist/adapters/claude-flow/pretrain-bridge.js

@@ -49,8 +49,8 @@ export class PretrainBridge {
         }
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const result = execSync(`npx --no-install @claude-flow/cli hooks pretrain --path ${this.escapeArg(targetPath)} --depth ${depth}`, { encoding: 'utf-8', timeout: 120000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const result = execFileSync('npx', ['--no-install', '@claude-flow/cli', 'hooks', 'pretrain', '--path', targetPath, '--depth', depth], { encoding: 'utf-8', timeout: 120000, cwd: this.options.projectRoot });
                 // Try to parse JSON result
                 try {
                     const parsed = safeJsonParse(result);
@@ -87,8 +87,8 @@ export class PretrainBridge {
     async generateAgentConfigs(format = 'yaml') {
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const result = execSync(`npx --no-install @claude-flow/cli hooks build-agents --format ${format}`, { encoding: 'utf-8', timeout: 60000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const result = execFileSync('npx', ['--no-install', '@claude-flow/cli', 'hooks', 'build-agents', '--format', format], { encoding: 'utf-8', timeout: 60000, cwd: this.options.projectRoot });
                 try {
                     return safeJsonParse(result);
                 }
@@ -111,8 +111,8 @@ export class PretrainBridge {
     async transferPatterns(sourcePath, minConfidence = 0.7) {
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const result = execSync(`npx --no-install @claude-flow/cli hooks transfer --source-path ${this.escapeArg(sourcePath)} --min-confidence ${minConfidence}`, { encoding: 'utf-8', timeout: 60000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const result = execFileSync('npx', ['--no-install', '@claude-flow/cli', 'hooks', 'transfer', '--source-path', sourcePath, '--min-confidence', String(minConfidence)], { encoding: 'utf-8', timeout: 60000, cwd: this.options.projectRoot });
                 const transferredMatch = result.match(/transferred[:\s]+(\d+)/i);
                 const skippedMatch = result.match(/skipped[:\s]+(\d+)/i);
                 return {
@@ -133,19 +133,6 @@ export class PretrainBridge {
     isClaudeFlowAvailable() {
         return this.claudeFlowAvailable;
     }
-    /**
-     * Escape shell argument using $'...' syntax for complete safety
-     * This ANSI-C quoting handles ALL special characters including backslashes
-     * CodeQL: js/incomplete-sanitization - Fixed by escaping backslashes AND quotes
-     */
-    escapeArg(arg) {
-        // Escape backslashes first, then single quotes, using ANSI-C quoting
-        // $'...' syntax interprets escape sequences like \\ and \'
-        const escaped = arg
-            .replace(/\\/g, '\\\\') // Escape backslashes first
-            .replace(/'/g, "\\'"); // Then escape single quotes
-        return "$'" + escaped + "'";
-    }
     /**
      * Local analysis using file system scanning
      */

package/dist/adapters/claude-flow/trajectory-bridge.d.ts

@@ -54,12 +54,6 @@ export declare class TrajectoryBridge {
      * Persist trajectory to local SQLite
      */
     private persistTrajectory;
-    /**
-     * Escape shell argument using $'...' syntax for complete safety
-     * This ANSI-C quoting handles ALL special characters including backslashes
-     * CodeQL: js/incomplete-sanitization - Fixed by escaping backslashes AND quotes
-     */
-    private escapeArg;
 }
 /**
  * Create trajectory bridge

package/dist/adapters/claude-flow/trajectory-bridge.js

@@ -29,9 +29,12 @@ export class TrajectoryBridge {
         const id = `trajectory-${randomUUID()}`;
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const agentArg = agent ? `--agent ${this.escapeArg(agent)}` : '';
-                const result = execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-start --task ${this.escapeArg(task)} ${agentArg}`, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const args = ['--no-install', '@claude-flow/cli', 'hooks', 'intelligence', 'trajectory-start', '--task', task];
+                if (agent) {
+                    args.push('--agent', agent);
+                }
+                const result = execFileSync('npx', args, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
                 // Parse trajectory ID from result
                 const match = result.match(/trajectoryId[:\s]+["']?([^"'\s,}]+)/i);
                 if (match?.[1]) {
@@ -59,10 +62,15 @@ export class TrajectoryBridge {
     async recordStep(trajectoryId, action, result, quality) {
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const resultArg = result ? `--result ${this.escapeArg(result)}` : '';
-                const qualityArg = quality !== undefined ? `--quality ${quality}` : '';
-                execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-step --trajectory-id ${this.escapeArg(trajectoryId)} --action ${this.escapeArg(action)} ${resultArg} ${qualityArg}`, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const args = ['--no-install', '@claude-flow/cli', 'hooks', 'intelligence', 'trajectory-step', '--trajectory-id', trajectoryId, '--action', action];
+                if (result) {
+                    args.push('--result', result);
+                }
+                if (quality !== undefined) {
+                    args.push('--quality', String(quality));
+                }
+                execFileSync('npx', args, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
                 return;
             }
             catch (error) {
@@ -88,9 +96,12 @@ export class TrajectoryBridge {
     async endTrajectory(trajectoryId, success, feedback) {
         if (this.claudeFlowAvailable) {
             try {
-                const { execSync } = await import('child_process');
-                const feedbackArg = feedback ? `--feedback ${this.escapeArg(feedback)}` : '';
-                execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-end --trajectory-id ${this.escapeArg(trajectoryId)} --success ${success} ${feedbackArg}`, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
+                const { execFileSync } = await import('child_process');
+                const args = ['--no-install', '@claude-flow/cli', 'hooks', 'intelligence', 'trajectory-end', '--trajectory-id', trajectoryId, '--success', String(success)];
+                if (feedback) {
+                    args.push('--feedback', feedback);
+                }
+                execFileSync('npx', args, { encoding: 'utf-8', timeout: 10000, cwd: this.options.projectRoot });
             }
             catch {
                 // Continue to return local trajectory
@@ -163,19 +174,6 @@ export class TrajectoryBridge {
             console.debug('[TrajectoryBridge] Trajectory persistence failed:', error instanceof Error ? error.message : error);
         }
     }
-    /**
-     * Escape shell argument using $'...' syntax for complete safety
-     * This ANSI-C quoting handles ALL special characters including backslashes
-     * CodeQL: js/incomplete-sanitization - Fixed by escaping backslashes AND quotes
-     */
-    escapeArg(arg) {
-        // Escape backslashes first, then single quotes, using ANSI-C quoting
-        // $'...' syntax interprets escape sequences like \\ and \'
-        const escaped = arg
-            .replace(/\\/g, '\\\\') // Escape backslashes first
-            .replace(/'/g, "\\'"); // Then escape single quotes
-        return "$'" + escaped + "'";
-    }
 }
 /**
  * Create trajectory bridge