brainclaw 1.7.4 → 1.7.5

package/README.md

@@ -345,6 +345,15 @@ npm run test:coverage      # with coverage report
 
 For older releases (v0.x and the early v1.0 launch series), `git log` on `master` is the source of truth — every release commit follows the `chore(release): bump version to <semver>` convention, and the matching feature/fix commits reference their plan id (e.g. `feat(mcp): self-heal ... (pln#478)`).
 
+### v1.7.5
+
+- **Security patch (recommended upgrade)** — fixes a git command-injection / RCE
+  vector flagged by Socket AI: several commands interpolated a git ref (notably
+  one derived from the persisted session `git_sha`) into `execSync` shell
+  strings. All git calls now use `execFileSync` (no shell) and `git_sha` is
+  validated as a hex SHA. No functional change. (session-end, release-claims,
+  release-notes, sync)
+
 ### v1.7.4
 
 - **Dispatch observability + worker DX hardening** (from a real cross-project

package/dist/commands/release-claims.js

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { memoryExists } from '../core/io.js';
 import { mutate } from '../core/mutation-pipeline.js';
 import { listClaims, releaseClaim } from '../core/claims.js';
@@ -23,7 +23,8 @@ export function runReleaseClaims(options = {}) {
         const ref1 = options.ref1 ?? 'ORIG_HEAD';
         const ref2 = options.ref2 ?? 'HEAD';
         try {
-            const output = execSync(`git diff --name-only ${ref1} ${ref2}`, { encoding: 'utf-8' });
+            // Security: execFileSync (no shell) so ref1/ref2 cannot inject (Socket 2026-06-08 class).
+            const output = execFileSync('git', ['diff', '--name-only', ref1, ref2], { encoding: 'utf-8' });
             changedFiles = output.split('\n').map((f) => f.trim()).filter(Boolean);
         }
         catch {

package/dist/commands/release-notes.js

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { loadConfig } from '../core/config.js';
 import { memoryExists } from '../core/io.js';
 import { checkBrainclawInstallableUpdate, getInstalledBrainclawVersion, } from '../core/brainclaw-version.js';
@@ -11,7 +11,8 @@ export function generateAgentReleaseNotes(cwd, since) {
     const baseRef = since ?? findLastVersionTag(cwd) ?? 'HEAD~20';
     let commits;
     try {
-        const raw = execSync(`git log ${baseRef}..HEAD --oneline --no-decorate`, {
+        // Security: execFileSync (no shell) so baseRef cannot inject (Socket 2026-06-08 class).
+        const raw = execFileSync('git', ['log', `${baseRef}..HEAD`, '--oneline', '--no-decorate'], {
             cwd,
             encoding: 'utf-8',
             timeout: 10000,
@@ -58,7 +59,7 @@ export function generateAgentReleaseNotes(cwd, since) {
 }
 function findLastVersionTag(cwd) {
     try {
-        const tag = execSync('git describe --tags --abbrev=0 HEAD', {
+        const tag = execFileSync('git', ['describe', '--tags', '--abbrev=0', 'HEAD'], {
             cwd,
             encoding: 'utf-8',
             timeout: 5000,

package/dist/commands/session-end.js

@@ -1,5 +1,22 @@
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import path from 'node:path';
+/**
+ * Security (Socket alert 2026-06-08, medium): a session snapshot's `git_sha` is
+ * persisted state and must be treated as untrusted — it must NEVER be
+ * interpolated into a shell command. The fix has two layers: (1) every git call
+ * below uses execFileSync (NO shell, args passed literally → no metacharacter
+ * interpretation), and (2) git_sha is validated as a plain hex SHA before it can
+ * reach a git ref. Either layer alone closes the command-injection vector; both
+ * are kept as defense in depth.
+ */
+export const GIT_SHA_RE = /^[0-9a-f]{7,40}$/i;
+export function isValidGitSha(gitSha) {
+    return typeof gitSha === 'string' && GIT_SHA_RE.test(gitSha);
+}
+/** A trusted start ref: the snapshot SHA only if it is a valid hex SHA, else a safe literal. */
+export function safeStartRef(gitSha) {
+    return isValidGitSha(gitSha) ? gitSha : 'HEAD~10';
+}
 import { memoryExists } from '../core/io.js';
 import { buildOperationalIdentity, clearCurrentSession } from '../core/identity.js';
 import { buildContextDiff } from '../core/context-diff.js';
@@ -166,10 +183,10 @@ export async function endSession(options = {}) {
         try {
             const snapshot = loadSessionSnapshot(sessionId, options.cwd);
             const startSha = snapshot?.git_sha;
-            const ref = startSha ?? 'HEAD~10';
+            const ref = safeStartRef(startSha);
             const cwd = options.cwd ?? process.cwd();
-            const commits = execSync(`git log --oneline ${ref}..HEAD`, { encoding: 'utf-8', cwd }).trim();
-            const diffStat = execSync(`git diff --stat ${ref}..HEAD`, { encoding: 'utf-8', cwd }).trim();
+            const commits = execFileSync('git', ['log', '--oneline', `${ref}..HEAD`], { encoding: 'utf-8', cwd }).trim();
+            const diffStat = execFileSync('git', ['diff', '--stat', `${ref}..HEAD`], { encoding: 'utf-8', cwd }).trim();
             if (commits) {
                 const releasedClaims = listClaims(options.cwd)
                     .filter((c) => c.status === 'released' && c.agent === registered.agent_name);
@@ -178,7 +195,7 @@ export async function endSession(options = {}) {
                 let filesTouched = [];
                 let fullDiff;
                 try {
-                    fullDiff = execSync(`git diff ${ref}..HEAD`, { encoding: 'utf-8', cwd, maxBuffer: 10 * 1024 * 1024 }).trim();
+                    fullDiff = execFileSync('git', ['diff', `${ref}..HEAD`], { encoding: 'utf-8', cwd, maxBuffer: 10 * 1024 * 1024 }).trim();
                     filesTouched = extractFilesFromDiff(fullDiff);
                 }
                 catch { /* fall back to empty */ }
@@ -662,8 +679,9 @@ function countSessionEditedFiles(sessionId, cwd) {
     const repoCwd = cwd ?? process.cwd();
     try {
         const touched = new Set();
-        if (snapshot?.git_sha) {
-            for (const pathEntry of execSync(`git diff --name-only ${snapshot.git_sha}..HEAD`, {
+        const sha = snapshot?.git_sha;
+        if (isValidGitSha(sha)) {
+            for (const pathEntry of execFileSync('git', ['diff', '--name-only', `${sha}..HEAD`], {
                 cwd: repoCwd,
                 encoding: 'utf-8',
                 stdio: ['ignore', 'pipe', 'ignore'],
@@ -671,14 +689,14 @@ function countSessionEditedFiles(sessionId, cwd) {
                 touched.add(pathEntry);
             }
         }
-        for (const pathEntry of execSync('git diff --name-only HEAD', {
+        for (const pathEntry of execFileSync('git', ['diff', '--name-only', 'HEAD'], {
             cwd: repoCwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
         }).split(/\r?\n/).filter((entry) => Boolean(entry) && shouldCountEditedPath(entry))) {
             touched.add(pathEntry);
         }
-        for (const pathEntry of execSync('git ls-files --others --exclude-standard', {
+        for (const pathEntry of execFileSync('git', ['ls-files', '--others', '--exclude-standard'], {
             cwd: repoCwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],

package/dist/commands/sync.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { memoryExists } from '../core/io.js';
 import { loadState } from '../core/state.js';
 import { listCandidates } from '../core/candidates.js';
@@ -63,7 +63,9 @@ export function runSync(options = {}) {
     // Check git status of .brainclaw/
     let gitStatus = '';
     try {
-        gitStatus = execSync(`git status --porcelain ${pathSpec}`, {
+        // Security: execFileSync (no shell) + scopePaths spread as separate args so
+        // path specs cannot inject (Socket 2026-06-08 class).
+        gitStatus = execFileSync('git', ['status', '--porcelain', ...scopePaths], {
             encoding: 'utf-8',
             cwd: options.cwd ?? process.cwd(),
             timeout: 5000,
@@ -85,11 +87,12 @@ export function runSync(options = {}) {
     if (options.commit) {
         const msg = options.message ?? `chore: sync brainclaw (${new Date().toISOString().slice(0, 10)})`;
         try {
-            execSync(`git add ${pathSpec}`, {
+            execFileSync('git', ['add', ...scopePaths], {
                 cwd: options.cwd ?? process.cwd(),
                 timeout: 5000,
             });
-            execSync(`git commit -m "${msg.replace(/"/g, '\\"')}"`, {
+            // commit message passed as a literal arg — no shell, no escaping needed.
+            execFileSync('git', ['commit', '-m', msg], {
                 encoding: 'utf-8',
                 cwd: options.cwd ?? process.cwd(),
                 timeout: 10000,

package/dist/facts.js

@@ -1,8 +1,8 @@
 // Generated by scripts/emit-site-facts.mjs at build time. Do not edit manually.
-// Source: brainclaw v1.7.4 on 2026-06-08T21:59:54.110Z
+// Source: brainclaw v1.7.5 on 2026-06-09T05:31:24.417Z
 export const FACTS = {
-  "version": "1.7.4",
-  "generated_at": "2026-06-08T21:59:54.110Z",
+  "version": "1.7.5",
+  "generated_at": "2026-06-09T05:31:24.417Z",
   "tools": {
     "count": 62,
     "published_count": 61,

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.7.4",
-  "generated_at": "2026-06-08T21:59:54.110Z",
+  "version": "1.7.5",
+  "generated_at": "2026-06-09T05:31:24.417Z",
   "tools": {
     "count": 62,
     "published_count": 61,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainclaw",
-  "version": "1.7.4",
+  "version": "1.7.5",
   "description": "Shared project memory for humans and coding agents.",
   "type": "module",
   "bin": {