agileflow 2.97.0 → 2.98.0

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.98.0] - 2026-02-07
+
+### Fixed
+- Shell injection cleanup, shared lib tests, and async I/O pipeline
+
 ## [2.97.0] - 2026-02-07
 
 ### Added

package/lib/dashboard-server.js

@@ -42,7 +42,7 @@ const {
   serializeMessage,
 } = require('./dashboard-protocol');
 const { getProjectRoot, isAgileflowProject, getAgentsDir } = require('./paths');
-const { execSync, execFileSync, spawn } = require('child_process');
+const { execFileSync, spawn } = require('child_process');
 const os = require('os');
 
 // Lazy-load automation modules to avoid circular dependencies
@@ -910,7 +910,11 @@ class DashboardServer extends EventEmitter {
 
     // Validate commit message
     if (commitMessage !== undefined && commitMessage !== null) {
-      if (typeof commitMessage !== 'string' || commitMessage.length > 10000 || commitMessage.includes('\0')) {
+      if (
+        typeof commitMessage !== 'string' ||
+        commitMessage.length > 10000 ||
+        commitMessage.includes('\0')
+      ) {
         session.send(createError('GIT_ERROR', 'Invalid commit message'));
         return;
       }
@@ -929,7 +933,9 @@ class DashboardServer extends EventEmitter {
           break;
         case InboundMessageType.GIT_UNSTAGE:
           if (fileArgs) {
-            execFileSync('git', ['restore', '--staged', '--', ...fileArgs], { cwd: this.projectRoot });
+            execFileSync('git', ['restore', '--staged', '--', ...fileArgs], {
+              cwd: this.projectRoot,
+            });
           } else {
             execFileSync('git', ['restore', '--staged', '.'], { cwd: this.projectRoot });
           }
@@ -975,14 +981,16 @@ class DashboardServer extends EventEmitter {
    */
   getGitStatus() {
     try {
-      const branch = execSync('git branch --show-current', {
+      const branch = execFileSync('git', ['branch', '--show-current'], {
         cwd: this.projectRoot,
         encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
       }).trim();
 
-      const statusOutput = execSync('git status --porcelain', {
+      const statusOutput = execFileSync('git', ['status', '--porcelain'], {
         cwd: this.projectRoot,
         encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
       });
 
       const staged = [];
@@ -1066,9 +1074,7 @@ class DashboardServer extends EventEmitter {
    */
   getFileDiff(filePath, staged = false) {
     try {
-      const diffArgs = staged
-        ? ['diff', '--cached', '--', filePath]
-        : ['diff', '--', filePath];
+      const diffArgs = staged ? ['diff', '--cached', '--', filePath] : ['diff', '--', filePath];
 
       const diff = execFileSync('git', diffArgs, {
         cwd: this.projectRoot,

package/lib/errors.js

@@ -16,7 +16,7 @@
  */
 
 const fs = require('fs');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 // Debug logging (opt-in via AGILEFLOW_DEBUG=1)
 const DEBUG = process.env.AGILEFLOW_DEBUG === '1';
@@ -421,7 +421,7 @@ function safeExec(command, options = {}) {
   }
 
   try {
-    const output = execSync(command, {
+    const output = execFileSync('bash', ['-c', command], {
       cwd,
       encoding: 'utf8',
       timeout,

package/lib/file-cache.js

@@ -340,7 +340,7 @@ function readProjectFiles(rootDir, options = {}) {
 // Command Caching (for git and other shell commands)
 // =============================================================================
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 // Separate cache for command output with shorter TTL
 const commandCache = new LRUCache({
@@ -372,7 +372,7 @@ function execCached(command, options = {}) {
 
   // Execute command
   try {
-    const output = execSync(command, {
+    const output = execFileSync('bash', ['-c', command], {
       cwd,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],

package/lib/gate-runner.js

@@ -14,7 +14,7 @@
  *   const result = await evaluateGate('tests', rootDir, { timeout: 300000 });
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
@@ -106,7 +106,7 @@ function runCommand(command, rootDir, timeout) {
   const result = { passed: false, output: '', duration: 0 };
 
   try {
-    const output = execSync(command, {
+    const output = execFileSync('bash', ['-c', command], {
       cwd: rootDir,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -155,7 +155,12 @@ function evaluateGate(gateName, rootDir, options = {}) {
     case 'lint': {
       command = command || detectLintCommand(rootDir);
       if (!command) {
-        return { gate: 'lint', passed: true, message: 'No lint command found (skipped)', duration: 0 };
+        return {
+          gate: 'lint',
+          passed: true,
+          message: 'No lint command found (skipped)',
+          duration: 0,
+        };
       }
       const result = runCommand(command, rootDir, timeout);
       return {
@@ -171,7 +176,12 @@ function evaluateGate(gateName, rootDir, options = {}) {
     case 'types': {
       command = command || detectTypeCheckCommand(rootDir);
       if (!command) {
-        return { gate: 'types', passed: true, message: 'No type-check command found (skipped)', duration: 0 };
+        return {
+          gate: 'types',
+          passed: true,
+          message: 'No type-check command found (skipped)',
+          duration: 0,
+        };
       }
       const result = runCommand(command, rootDir, timeout);
       return {

package/lib/git-operations.js

@@ -4,7 +4,7 @@
  * Provides cached git operations and session phase detection for Kanban visualization.
  */
 
-const { execSync, execFileSync, spawnSync, spawn } = require('child_process');
+const { execFileSync, spawnSync, spawn } = require('child_process');
 const fs = require('fs');
 
 const { getProjectRoot } = require('./paths');
@@ -80,7 +80,7 @@ function getCurrentBranch(cwd = ROOT) {
   if (cached !== null) return cached;
 
   try {
-    const branch = execSync('git branch --show-current', { cwd, encoding: 'utf8' }).trim();
+    const branch = execFileSync('git', ['branch', '--show-current'], { cwd, encoding: 'utf8' }).trim();
     gitCache.set(cacheKey, branch);
     return branch;
   } catch (e) {
@@ -189,10 +189,16 @@ function getSessionPhase(session) {
     }
     const commits = parseInt(commitCount, 10);
 
-    const status = execSync('git status --porcelain 2>/dev/null || echo ""', {
-      cwd: sessionPath,
-      encoding: 'utf8',
-    }).trim();
+    let status = '';
+    try {
+      status = execFileSync('git', ['status', '--porcelain'], {
+        cwd: sessionPath,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
+    } catch {
+      // git status failed, treat as no changes
+    }
 
     const phase = determinePhaseFromGitState(commits, status !== '');
     gitCache.set(cacheKey, phase);

package/lib/merge-operations.js

@@ -270,7 +270,10 @@ function integrateSession(sessionId, options = {}, loadRegistry, saveRegistry, r
       result.worktreeDeleted = true;
     } catch (e) {
       try {
-        execFileSync('git', ['worktree', 'remove', '--force', session.path], { cwd: ROOT, encoding: 'utf8' });
+        execFileSync('git', ['worktree', 'remove', '--force', session.path], {
+          cwd: ROOT,
+          encoding: 'utf8',
+        });
         result.worktreeDeleted = true;
       } catch (e2) {
         result.worktreeDeleted = false;
@@ -649,10 +652,16 @@ function resolveConflict(resolution) {
             fs.unlinkSync(tmpOurs);
             fs.unlinkSync(tmpTheirs);
           } else {
-            execFileSync('git', ['checkout', '--theirs', '--', file], { cwd: ROOT, encoding: 'utf8' });
+            execFileSync('git', ['checkout', '--theirs', '--', file], {
+              cwd: ROOT,
+              encoding: 'utf8',
+            });
           }
         } catch (unionError) {
-          execFileSync('git', ['checkout', '--theirs', '--', file], { cwd: ROOT, encoding: 'utf8' });
+          execFileSync('git', ['checkout', '--theirs', '--', file], {
+            cwd: ROOT,
+            encoding: 'utf8',
+          });
         }
         break;
 

package/lib/registry-cache.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const fs = require('fs');
+
+/**
+ * Registry scanning cache
+ * Caches directory scan results keyed by path + mtime.
+ * TTL-based expiration (default 60s).
+ */
+
+const _cache = new Map();
+const DEFAULT_TTL_MS = 60 * 1000;
+
+/**
+ * Get cached scan result for a directory
+ * @param {string} dirPath - Directory path
+ * @param {Object} [options]
+ * @param {number} [options.ttlMs] - TTL in milliseconds (default 60000)
+ * @param {boolean} [options.noCache] - Bypass cache entirely
+ * @returns {*|null} Cached result or null if miss/expired
+ */
+function getCached(dirPath, options = {}) {
+  const { ttlMs = DEFAULT_TTL_MS, noCache = false } = options;
+
+  if (noCache) return null;
+
+  const entry = _cache.get(dirPath);
+  if (!entry) return null;
+
+  // Check TTL
+  if (Date.now() - entry.cachedAt > ttlMs) {
+    _cache.delete(dirPath);
+    return null;
+  }
+
+  // Check directory mtime hasn't changed
+  try {
+    const stat = fs.statSync(dirPath);
+    const currentMtime = stat.mtimeMs;
+    if (currentMtime !== entry.mtimeMs) {
+      _cache.delete(dirPath);
+      return null;
+    }
+  } catch {
+    _cache.delete(dirPath);
+    return null;
+  }
+
+  return entry.data;
+}
+
+/**
+ * Store scan result in cache
+ * @param {string} dirPath - Directory path
+ * @param {*} data - Data to cache
+ */
+function setCached(dirPath, data) {
+  try {
+    const stat = fs.statSync(dirPath);
+    _cache.set(dirPath, {
+      data,
+      mtimeMs: stat.mtimeMs,
+      cachedAt: Date.now(),
+    });
+  } catch {
+    // Can't stat directory, don't cache
+  }
+}
+
+/**
+ * Clear all cached entries
+ */
+function clearCache() {
+  _cache.clear();
+}
+
+/**
+ * Get cache stats
+ * @returns {{ size: number, keys: string[] }}
+ */
+function getCacheStats() {
+  return {
+    size: _cache.size,
+    keys: Array.from(_cache.keys()),
+  };
+}
+
+/**
+ * Wrap a scan function with caching
+ * @param {Function} scanFn - Function that takes (dirPath, ...args) and returns results
+ * @param {Object} [options]
+ * @param {number} [options.ttlMs] - TTL in ms
+ * @returns {Function} Cached version of scanFn
+ */
+function withCache(scanFn, options = {}) {
+  return function cachedScan(dirPath, ...args) {
+    const noCache = process.argv.includes('--no-cache') || options.noCache;
+    const cached = getCached(dirPath, { ...options, noCache });
+    if (cached !== null) return cached;
+
+    const result = scanFn(dirPath, ...args);
+    setCached(dirPath, result);
+    return result;
+  };
+}
+
+module.exports = {
+  getCached,
+  setCached,
+  clearCache,
+  getCacheStats,
+  withCache,
+  DEFAULT_TTL_MS,
+};

package/lib/template-loader.js

@@ -0,0 +1,141 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Template Loader Factory
+ *
+ * Centralized template reading with caching and frontmatter parsing.
+ * Replaces scattered readFileSync + parse patterns in generator scripts.
+ */
+
+const _templateCache = new Map();
+
+/**
+ * Read a template file with optional caching
+ * @param {string} filePath - Absolute path to template file
+ * @param {Object} [options]
+ * @param {boolean} [options.cache] - Enable caching (default true)
+ * @param {boolean} [options.parseFrontmatter] - Parse YAML frontmatter (default false)
+ * @returns {{ content: string, frontmatter: Object|null, raw: string }}
+ */
+function loadTemplate(filePath, options = {}) {
+  const { cache = true, parseFrontmatter = false } = options;
+
+  // Check cache
+  if (cache) {
+    const cached = _templateCache.get(filePath);
+    if (cached) {
+      try {
+        const stat = fs.statSync(filePath);
+        if (stat.mtimeMs === cached.mtimeMs) {
+          return cached.result;
+        }
+      } catch {
+        // File changed or gone, fall through to reload
+      }
+      _templateCache.delete(filePath);
+    }
+  }
+
+  // Read file
+  const raw = fs.readFileSync(filePath, 'utf-8');
+
+  let content = raw;
+  let frontmatter = null;
+
+  if (parseFrontmatter) {
+    const parsed = extractSimpleFrontmatter(raw);
+    content = parsed.content;
+    frontmatter = parsed.frontmatter;
+  }
+
+  const result = { content, frontmatter, raw };
+
+  // Cache with mtime
+  if (cache) {
+    try {
+      const stat = fs.statSync(filePath);
+      _templateCache.set(filePath, { result, mtimeMs: stat.mtimeMs });
+    } catch {
+      // Can't stat, don't cache
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Simple frontmatter extraction (no js-yaml dependency)
+ * Handles key: value pairs in --- delimited blocks
+ * @param {string} raw - Raw file content
+ * @returns {{ frontmatter: Object, content: string }}
+ */
+function extractSimpleFrontmatter(raw) {
+  const fmRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+  const match = raw.match(fmRegex);
+
+  if (!match) {
+    return { frontmatter: {}, content: raw };
+  }
+
+  const fmBlock = match[1];
+  const content = match[2];
+  const frontmatter = {};
+
+  for (const line of fmBlock.split('\n')) {
+    const colonIdx = line.indexOf(':');
+    if (colonIdx > 0) {
+      const key = line.substring(0, colonIdx).trim();
+      let value = line.substring(colonIdx + 1).trim();
+      // Remove quotes if present
+      if ((value.startsWith('"') && value.endsWith('"')) ||
+          (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1);
+      }
+      frontmatter[key] = value;
+    }
+  }
+
+  return { frontmatter, content };
+}
+
+/**
+ * Create a cached template loader for a specific directory
+ * @param {string} baseDir - Base directory for templates
+ * @param {Object} [defaultOptions] - Default options for loadTemplate
+ * @returns {Function} Loader function: (relativePath) => templateResult
+ */
+function createTemplateLoader(baseDir, defaultOptions = {}) {
+  return function load(relativePath, overrides = {}) {
+    const filePath = path.join(baseDir, relativePath);
+    return loadTemplate(filePath, { ...defaultOptions, ...overrides });
+  };
+}
+
+/**
+ * Clear the template cache
+ */
+function clearTemplateCache() {
+  _templateCache.clear();
+}
+
+/**
+ * Get template cache stats
+ * @returns {{ size: number, keys: string[] }}
+ */
+function getTemplateCacheStats() {
+  return {
+    size: _templateCache.size,
+    keys: Array.from(_templateCache.keys()),
+  };
+}
+
+module.exports = {
+  loadTemplate,
+  createTemplateLoader,
+  clearTemplateCache,
+  getTemplateCacheStats,
+  extractSimpleFrontmatter,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agileflow",
-  "version": "2.97.0",
+  "version": "2.98.0",
   "description": "AI-driven agile development system for Claude Code, Cursor, Windsurf, and more",
   "keywords": [
     "agile",

package/scripts/agent-loop.js

@@ -19,7 +19,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
 const crypto = require('crypto');
 
 // Shared utilities

package/scripts/agileflow-welcome.js

@@ -13,7 +13,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { execFileSync, spawnSync } = require('child_process');
 
 // Shared utilities
 const { c, box } = require('../lib/colors');
@@ -178,7 +178,7 @@ function detectPlatform() {
  */
 function checkTmuxAvailability() {
   try {
-    execSync('which tmux', { encoding: 'utf8', stdio: 'pipe' });
+    execFileSync('which', ['tmux'], { encoding: 'utf8', stdio: 'pipe' });
     return { available: true };
   } catch (e) {
     const platform = detectPlatform();
@@ -197,8 +197,9 @@ function checkTmuxAvailability() {
  */
 function getGitInfo(rootDir) {
   try {
-    const output = execSync(
-      'git branch --show-current && git rev-parse --short HEAD && git log -1 --format="%s"',
+    const output = execFileSync(
+      'bash',
+      ['-c', 'git branch --show-current && git rev-parse --short HEAD && git log -1 --format="%s"'],
       { cwd: rootDir, encoding: 'utf8', timeout: 5000 }
     );
     const lines = output.trim().split('\n');
@@ -376,7 +377,7 @@ function runArchival(rootDir, cache = null) {
     if (toArchiveCount > 0) {
       // Run archival
       try {
-        execSync('bash scripts/archive-completed-stories.sh', {
+        execFileSync('bash', ['scripts/archive-completed-stories.sh'], {
           cwd: rootDir,
           encoding: 'utf8',
           stdio: 'pipe',
@@ -493,7 +494,7 @@ function checkParallelSessions(rootDir) {
 
     try {
       // PERFORMANCE: Single subprocess call instead of 3 (register + count + status)
-      const fullStatusOutput = execSync(`node "${scriptPath}" full-status`, {
+      const fullStatusOutput = execFileSync('node', [scriptPath, 'full-status'], {
         cwd: rootDir,
         encoding: 'utf8',
         stdio: ['pipe', 'pipe', 'pipe'],
@@ -515,7 +516,7 @@ function checkParallelSessions(rootDir) {
     } catch (e) {
       // Fall back to individual calls if full-status not available (older version)
       try {
-        const registerOutput = execSync(`node "${scriptPath}" register`, {
+        const registerOutput = execFileSync('node', [scriptPath, 'register'], {
           cwd: rootDir,
           encoding: 'utf8',
           stdio: ['pipe', 'pipe', 'pipe'],
@@ -528,7 +529,7 @@ function checkParallelSessions(rootDir) {
       }
 
       try {
-        const countOutput = execSync(`node "${scriptPath}" count`, {
+        const countOutput = execFileSync('node', [scriptPath, 'count'], {
           cwd: rootDir,
           encoding: 'utf8',
           stdio: ['pipe', 'pipe', 'pipe'],
@@ -540,7 +541,7 @@ function checkParallelSessions(rootDir) {
       }
 
       try {
-        const statusOutput = execSync(`node "${scriptPath}" status`, {
+        const statusOutput = execFileSync('node', [scriptPath, 'status'], {
           cwd: rootDir,
           encoding: 'utf8',
           stdio: ['pipe', 'pipe', 'pipe'],
@@ -1076,7 +1077,7 @@ function getChangelogEntries(version) {
 async function runAutoUpdate(rootDir, fromVersion, toVersion) {
   const runUpdate = () => {
     // Use stdio: 'pipe' to capture output instead of showing everything
-    return execSync('npx agileflow@latest update --force', {
+    return execFileSync('npx', ['agileflow@latest', 'update', '--force'], {
       cwd: rootDir,
       encoding: 'utf8',
       stdio: 'pipe',
@@ -1097,7 +1098,7 @@ async function runAutoUpdate(rootDir, fromVersion, toVersion) {
     if (e.message && (e.message.includes('ETARGET') || e.message.includes('notarget'))) {
       console.log(`${c.dim}  Clearing npm cache and retrying...${c.reset}`);
       try {
-        execSync('npm cache clean --force', { stdio: 'pipe', timeout: 30000 });
+        execFileSync('npm', ['cache', 'clean', '--force'], { stdio: 'pipe', timeout: 30000 });
         runUpdate();
         console.log(`${c.mintGreen}✓ Update complete${c.reset}`);
         return true;
@@ -1705,7 +1706,10 @@ async function main() {
   let agentTeamsInfo = {};
   if (featureFlags) {
     try {
-      agentTeamsInfo = featureFlags.getAgentTeamsDisplayInfo({ rootDir, metadata: cache?.metadata });
+      agentTeamsInfo = featureFlags.getAgentTeamsDisplayInfo({
+        rootDir,
+        metadata: cache?.metadata,
+      });
     } catch (e) {
       // Silently fail - Agent Teams info is non-critical
     }

package/scripts/auto-self-improve.js

@@ -19,7 +19,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 // Shared utilities
 const { c } = require('../lib/colors');
@@ -79,27 +79,30 @@ function getSessionState(rootDir) {
 function getGitDiff(rootDir) {
   try {
     // Get list of changed files (staged and unstaged)
-    const diffFiles = execSync('git diff --name-only HEAD 2>/dev/null || git diff --name-only', {
+    const diffFiles = execFileSync('git', ['diff', '--name-only', 'HEAD'], {
       cwd: rootDir,
       encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
     })
       .trim()
       .split('\n')
       .filter(Boolean);
 
     // Get staged files
-    const stagedFiles = execSync('git diff --cached --name-only 2>/dev/null', {
+    const stagedFiles = execFileSync('git', ['diff', '--cached', '--name-only'], {
       cwd: rootDir,
       encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
     })
       .trim()
       .split('\n')
       .filter(Boolean);
 
     // Get untracked files
-    const untrackedFiles = execSync('git ls-files --others --exclude-standard 2>/dev/null', {
+    const untrackedFiles = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], {
       cwd: rootDir,
       encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
     })
       .trim()
       .split('\n')
@@ -112,9 +115,10 @@ function getGitDiff(rootDir) {
     let additions = 0;
     let deletions = 0;
     try {
-      const stats = execSync('git diff --shortstat HEAD 2>/dev/null || echo ""', {
+      const stats = execFileSync('git', ['diff', '--shortstat', 'HEAD'], {
         cwd: rootDir,
         encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
       });
       const addMatch = stats.match(/(\d+) insertion/);
       const delMatch = stats.match(/(\d+) deletion/);