remote-opencode 1.3.0 → 1.3.1

package/dist/src/commands/diff.js

@@ -1,10 +1,11 @@
 import { SlashCommandBuilder, MessageFlags } from 'discord.js';
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import * as dataStore from '../services/dataStore.js';
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 const MAX_LENGTH = 1900;
 const CODE_BLOCK_OVERHEAD = 8; // ```diff\n...\n```
+const GIT_REF_PATTERN = /^[a-zA-Z0-9._\/-]+$/;
 function formatDiff(raw) {
     const maxContent = MAX_LENGTH - CODE_BLOCK_OVERHEAD;
     if (raw.length <= maxContent) {
@@ -61,23 +62,27 @@ export const diff = {
             });
             return;
         }
+        if (target === 'branch' && !GIT_REF_PATTERN.test(base)) {
+            await i.reply({ content: '❌ Invalid base branch name.', flags: MessageFlags.Ephemeral });
+            return;
+        }
         await i.deferReply();
         try {
             let gitArgs;
             switch (target) {
                 case 'staged':
-                    gitArgs = 'git diff --cached';
+                    gitArgs = ['diff', '--cached'];
                     break;
                 case 'branch':
-                    gitArgs = `git diff ${base}...HEAD`;
+                    gitArgs = ['diff', `${base}...HEAD`];
                     break;
                 default:
-                    gitArgs = 'git diff';
+                    gitArgs = ['diff'];
             }
             if (stat) {
-                gitArgs += ' --stat';
+                gitArgs.push('--stat');
             }
-            const { stdout } = await execAsync(gitArgs, { cwd: projectPath });
+            const { stdout } = await execFileAsync('git', gitArgs, { cwd: projectPath });
             const output = stdout.trim();
             if (!output) {
                 const targetLabel = target === 'branch' ? `branch (base: ${base})` : target;

package/dist/src/services/worktreeManager.js

@@ -1,8 +1,8 @@
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 export function sanitizeBranchName(name) {
     return name
         .trim()
@@ -13,8 +13,8 @@ export function sanitizeBranchName(name) {
 export async function branchExists(projectPath, branchName) {
     try {
         const [localRes, remoteRes] = await Promise.all([
-            execAsync(`git branch --list ${branchName}`, { cwd: projectPath }).catch(() => ({ stdout: '' })),
-            execAsync(`git branch -r --list origin/${branchName}`, { cwd: projectPath }).catch(() => ({ stdout: '' }))
+            execFileAsync('git', ['branch', '--list', branchName], { cwd: projectPath }).catch(() => ({ stdout: '' })),
+            execFileAsync('git', ['branch', '-r', '--list', `origin/${branchName}`], { cwd: projectPath }).catch(() => ({ stdout: '' }))
         ]);
         return {
             local: localRes.stdout.trim().length > 0,
@@ -33,12 +33,12 @@ export async function createWorktree(projectPath, branchName) {
     const { local, remote } = await branchExists(projectPath, sanitizedBranch);
     try {
         if (local || remote) {
-            await execAsync(`git worktree add ./worktrees/${sanitizedBranch} ${sanitizedBranch}`, {
+            await execFileAsync('git', ['worktree', 'add', `./worktrees/${sanitizedBranch}`, sanitizedBranch], {
                 cwd: projectPath
             });
         }
         else {
-            await execAsync(`git worktree add ./worktrees/${sanitizedBranch} -b ${sanitizedBranch}`, {
+            await execFileAsync('git', ['worktree', 'add', `./worktrees/${sanitizedBranch}`, '-b', sanitizedBranch], {
                 cwd: projectPath
             });
         }
@@ -53,13 +53,13 @@ export async function removeWorktree(worktreePath, deleteBranch) {
     try {
         let branchName;
         if (deleteBranch) {
-            const { stdout } = await execAsync('git branch --show-current', { cwd: worktreePath });
+            const { stdout } = await execFileAsync('git', ['branch', '--show-current'], { cwd: worktreePath });
             branchName = stdout.trim();
         }
         const projectPath = resolve(worktreePath, '..', '..');
-        await execAsync(`git worktree remove "${worktreePath}" --force`, { cwd: projectPath });
+        await execFileAsync('git', ['worktree', 'remove', worktreePath, '--force'], { cwd: projectPath });
         if (deleteBranch && branchName) {
-            await execAsync(`git branch -D ${branchName}`, { cwd: projectPath });
+            await execFileAsync('git', ['branch', '-D', branchName], { cwd: projectPath });
         }
     }
     catch (error) {
@@ -69,7 +69,7 @@ export async function removeWorktree(worktreePath, deleteBranch) {
 }
 export async function getCurrentBranch(cwd) {
     try {
-        const { stdout } = await execAsync('git rev-parse --abbrev-ref HEAD', { cwd });
+        const { stdout } = await execFileAsync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd });
         return stdout.trim() || null;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-opencode",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Discord bot for remote OpenCode CLI access",
   "main": "dist/src/index.js",
   "bin": {
@@ -52,5 +52,8 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
+  },
+  "overrides": {
+    "undici": "^6.23.0"
   }
 }