sinapse-ai 9.4.0 → 9.5.0

package/.sinapse-ai/infrastructure/scripts/llm-routing/templates/claude-free-tracked.cmd

@@ -1,127 +1,127 @@
-@echo off
-:: Claude Code - DeepSeek Native Mode with Usage Tracking
-:: Routes through local proxy to track per-alias usage
-:: Cost: ~$0.14/M tokens with tool calling support
-
-setlocal enabledelayedexpansion
-
-:: Configuration
-set "PROXY_PORT=8787"
-set "ALIAS=claude-free"
-
-:: Find tracker script
-if defined SINAPSE_HOME (
-    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-    if exist "!TRACKER_SCRIPT!" goto :tracker_found
-)
-set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :tracker_found
-set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :tracker_found
-set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
-:tracker_found
-
-:: Find project root (look for .env file)
-set "PROJECT_ROOT=%CD%"
-set /a "LOOP_COUNT=0"
-:find_env
-set /a "LOOP_COUNT+=1"
-if %LOOP_COUNT% gtr 50 goto :no_env
-if exist "%PROJECT_ROOT%\.env" goto :found_env
-if "%PROJECT_ROOT%"=="%PROJECT_ROOT:~0,3%" goto :no_env
-for %%i in ("%PROJECT_ROOT%\..") do set "PROJECT_ROOT=%%~fi"
-goto :find_env
-
-:no_env
-if not "%DEEPSEEK_API_KEY%"=="" goto :use_env_key
-
-echo.
-echo [91mERROR: No .env file found and DEEPSEEK_API_KEY not set![0m
-echo.
-echo Options:
-echo   1. Create .env in your project: cp .env.example .env
-echo   2. Set DEEPSEEK_API_KEY in the .env file
-echo   3. Or set it globally: setx DEEPSEEK_API_KEY "sk-your-key"
-echo.
-echo Get your API key at: https://platform.deepseek.com/api_keys
-echo.
-pause
-exit /b 1
-
-:found_env
-:: Load DEEPSEEK_API_KEY from .env
-for /f "usebackq eol=# tokens=1,* delims==" %%a in ("%PROJECT_ROOT%\.env") do (
-    if "%%a"=="DEEPSEEK_API_KEY" set "DEEPSEEK_API_KEY=%%b"
-)
-set "DEEPSEEK_API_KEY=!DEEPSEEK_API_KEY:"=!"
-
-if "!DEEPSEEK_API_KEY!"=="" (
-    echo.
-    echo [91mERROR: DEEPSEEK_API_KEY not found in .env![0m
-    echo.
-    pause
-    exit /b 1
-)
-
-:use_env_key
-:: Check if proxy is running
-curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
-if %errorlevel% neq 0 (
-    echo.
-    echo [93mUsage Tracker proxy not running. Starting in background...[0m
-
-    :: Start proxy in background
-    start /b "" node "%TRACKER_SCRIPT%" start --port=%PROXY_PORT% --alias=%ALIAS% >nul 2>&1
-
-    :: Wait for proxy to start
-    timeout /t 2 /nobreak >nul
-
-    :: Verify it started
-    curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
-    if %errorlevel% neq 0 (
-        echo [91mFailed to start proxy. Falling back to direct connection.[0m
-        goto :direct_connection
-    )
-    echo [92mProxy started successfully![0m
-)
-
-:: Use local proxy (proxy will forward to DeepSeek with original API key)
-set ANTHROPIC_BASE_URL=http://127.0.0.1:%PROXY_PORT%/anthropic
-set ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%
-set ANTHROPIC_MODEL=deepseek-chat
-set API_TIMEOUT_MS=600000
-
-echo.
-echo [92mClaude Code - DeepSeek Native Mode (TRACKED)[0m
-echo Proxy: 127.0.0.1:%PROXY_PORT%
-echo Alias: %ALIAS%
-echo [92mTool Calling: SUPPORTED[0m
-echo Cost: ~$0.14/M tokens
-echo.
-echo [96mUsage tracking enabled. Run 'deepseek-usage' to view stats.[0m
-echo.
-
-goto :run_claude
-
-:direct_connection
-:: Direct connection without tracking
-set ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic
-set ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%
-set ANTHROPIC_MODEL=deepseek-chat
-set API_TIMEOUT_MS=600000
-
-echo.
-echo [92mClaude Code - DeepSeek Native Mode (DIRECT)[0m
-echo Endpoint: api.deepseek.com/anthropic
-echo [93mUsage tracking: DISABLED (proxy not running)[0m
-echo.
-
-:run_claude
-endlocal & set "ANTHROPIC_BASE_URL=%ANTHROPIC_BASE_URL%" & set "ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%" & set "ANTHROPIC_MODEL=deepseek-chat" & set "API_TIMEOUT_MS=600000"
-
->&2 echo.
->&2 echo [93mWARNING: Running with --dangerously-skip-permissions (no confirmation prompts)[0m
->&2 echo [93mOnly use in trusted repositories/environments.[0m
->&2 echo.
-
-claude --dangerously-skip-permissions %*
+@echo off
+:: Claude Code - DeepSeek Native Mode with Usage Tracking
+:: Routes through local proxy to track per-alias usage
+:: Cost: ~$0.14/M tokens with tool calling support
+
+setlocal enabledelayedexpansion
+
+:: Configuration
+set "PROXY_PORT=8787"
+set "ALIAS=claude-free"
+
+:: Find tracker script
+if defined SINAPSE_HOME (
+    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+    if exist "!TRACKER_SCRIPT!" goto :tracker_found
+)
+set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :tracker_found
+set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :tracker_found
+set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
+:tracker_found
+
+:: Find project root (look for .env file)
+set "PROJECT_ROOT=%CD%"
+set /a "LOOP_COUNT=0"
+:find_env
+set /a "LOOP_COUNT+=1"
+if %LOOP_COUNT% gtr 50 goto :no_env
+if exist "%PROJECT_ROOT%\.env" goto :found_env
+if "%PROJECT_ROOT%"=="%PROJECT_ROOT:~0,3%" goto :no_env
+for %%i in ("%PROJECT_ROOT%\..") do set "PROJECT_ROOT=%%~fi"
+goto :find_env
+
+:no_env
+if not "%DEEPSEEK_API_KEY%"=="" goto :use_env_key
+
+echo.
+echo [91mERROR: No .env file found and DEEPSEEK_API_KEY not set![0m
+echo.
+echo Options:
+echo   1. Create .env in your project: cp .env.example .env
+echo   2. Set DEEPSEEK_API_KEY in the .env file
+echo   3. Or set it globally: setx DEEPSEEK_API_KEY "sk-your-key"
+echo.
+echo Get your API key at: https://platform.deepseek.com/api_keys
+echo.
+pause
+exit /b 1
+
+:found_env
+:: Load DEEPSEEK_API_KEY from .env
+for /f "usebackq eol=# tokens=1,* delims==" %%a in ("%PROJECT_ROOT%\.env") do (
+    if "%%a"=="DEEPSEEK_API_KEY" set "DEEPSEEK_API_KEY=%%b"
+)
+set "DEEPSEEK_API_KEY=!DEEPSEEK_API_KEY:"=!"
+
+if "!DEEPSEEK_API_KEY!"=="" (
+    echo.
+    echo [91mERROR: DEEPSEEK_API_KEY not found in .env![0m
+    echo.
+    pause
+    exit /b 1
+)
+
+:use_env_key
+:: Check if proxy is running
+curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
+if %errorlevel% neq 0 (
+    echo.
+    echo [93mUsage Tracker proxy not running. Starting in background...[0m
+
+    :: Start proxy in background
+    start /b "" node "%TRACKER_SCRIPT%" start --port=%PROXY_PORT% --alias=%ALIAS% >nul 2>&1
+
+    :: Wait for proxy to start
+    timeout /t 2 /nobreak >nul
+
+    :: Verify it started
+    curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
+    if %errorlevel% neq 0 (
+        echo [91mFailed to start proxy. Falling back to direct connection.[0m
+        goto :direct_connection
+    )
+    echo [92mProxy started successfully![0m
+)
+
+:: Use local proxy (proxy will forward to DeepSeek with original API key)
+set ANTHROPIC_BASE_URL=http://127.0.0.1:%PROXY_PORT%/anthropic
+set ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%
+set ANTHROPIC_MODEL=deepseek-chat
+set API_TIMEOUT_MS=600000
+
+echo.
+echo [92mClaude Code - DeepSeek Native Mode (TRACKED)[0m
+echo Proxy: 127.0.0.1:%PROXY_PORT%
+echo Alias: %ALIAS%
+echo [92mTool Calling: SUPPORTED[0m
+echo Cost: ~$0.14/M tokens
+echo.
+echo [96mUsage tracking enabled. Run 'deepseek-usage' to view stats.[0m
+echo.
+
+goto :run_claude
+
+:direct_connection
+:: Direct connection without tracking
+set ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic
+set ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%
+set ANTHROPIC_MODEL=deepseek-chat
+set API_TIMEOUT_MS=600000
+
+echo.
+echo [92mClaude Code - DeepSeek Native Mode (DIRECT)[0m
+echo Endpoint: api.deepseek.com/anthropic
+echo [93mUsage tracking: DISABLED (proxy not running)[0m
+echo.
+
+:run_claude
+endlocal & set "ANTHROPIC_BASE_URL=%ANTHROPIC_BASE_URL%" & set "ANTHROPIC_API_KEY=%DEEPSEEK_API_KEY%" & set "ANTHROPIC_MODEL=deepseek-chat" & set "API_TIMEOUT_MS=600000"
+
+>&2 echo.
+>&2 echo [93mWARNING: Running with --dangerously-skip-permissions (no confirmation prompts)[0m
+>&2 echo [93mOnly use in trusted repositories/environments.[0m
+>&2 echo.
+
+claude --dangerously-skip-permissions %*

package/.sinapse-ai/infrastructure/scripts/llm-routing/templates/deepseek-proxy.cmd

@@ -1,71 +1,71 @@
-@echo off
-:: DeepSeek Usage Tracker Proxy Manager
-:: Start/stop the tracking proxy server
-
-setlocal enabledelayedexpansion
-
-set "PROXY_PORT=8787"
-
-:: Try multiple locations for the tracker script
-if defined SINAPSE_HOME (
-    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-    if exist "!TRACKER_SCRIPT!" goto :found
-)
-
-set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-echo [91mERROR: Usage tracker not found![0m
-exit /b 1
-
-:found
-:: Check if Node.js is available
-where node >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [91mERROR: Node.js not found in PATH[0m
-    exit /b 1
-)
-
-if "%1"=="start" (
-    echo Starting DeepSeek Usage Tracker Proxy...
-    node "%TRACKER_SCRIPT%" start --port=%PROXY_PORT% --alias=claude-free
-    goto :eof
-)
-
-if "%1"=="stop" (
-    echo Stopping proxy on port %PROXY_PORT%...
-    for /f "tokens=5" %%a in ('netstat -ano ^| findstr ":%PROXY_PORT%.*LISTENING"') do (
-        taskkill /PID %%a /F >nul 2>&1
-    )
-    echo Proxy stopped.
-    goto :eof
-)
-
-if "%1"=="status" (
-    curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
-    if %errorlevel% equ 0 (
-        echo [92mProxy is running on port %PROXY_PORT%[0m
-        curl -s http://127.0.0.1:%PROXY_PORT%/health
-    ) else (
-        echo [93mProxy is not running[0m
-    )
-    goto :eof
-)
-
-echo DeepSeek Usage Tracker Proxy
-echo.
-echo Usage:
-echo   deepseek-proxy start   Start the proxy server
-echo   deepseek-proxy stop    Stop the proxy server
-echo   deepseek-proxy status  Check if proxy is running
-echo.
-echo The proxy runs on port %PROXY_PORT% by default.
-echo.
-
-endlocal
+@echo off
+:: DeepSeek Usage Tracker Proxy Manager
+:: Start/stop the tracking proxy server
+
+setlocal enabledelayedexpansion
+
+set "PROXY_PORT=8787"
+
+:: Try multiple locations for the tracker script
+if defined SINAPSE_HOME (
+    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+    if exist "!TRACKER_SCRIPT!" goto :found
+)
+
+set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+echo [91mERROR: Usage tracker not found![0m
+exit /b 1
+
+:found
+:: Check if Node.js is available
+where node >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [91mERROR: Node.js not found in PATH[0m
+    exit /b 1
+)
+
+if "%1"=="start" (
+    echo Starting DeepSeek Usage Tracker Proxy...
+    node "%TRACKER_SCRIPT%" start --port=%PROXY_PORT% --alias=claude-free
+    goto :eof
+)
+
+if "%1"=="stop" (
+    echo Stopping proxy on port %PROXY_PORT%...
+    for /f "tokens=5" %%a in ('netstat -ano ^| findstr ":%PROXY_PORT%.*LISTENING"') do (
+        taskkill /PID %%a /F >nul 2>&1
+    )
+    echo Proxy stopped.
+    goto :eof
+)
+
+if "%1"=="status" (
+    curl -s http://127.0.0.1:%PROXY_PORT%/health >nul 2>&1
+    if %errorlevel% equ 0 (
+        echo [92mProxy is running on port %PROXY_PORT%[0m
+        curl -s http://127.0.0.1:%PROXY_PORT%/health
+    ) else (
+        echo [93mProxy is not running[0m
+    )
+    goto :eof
+)
+
+echo DeepSeek Usage Tracker Proxy
+echo.
+echo Usage:
+echo   deepseek-proxy start   Start the proxy server
+echo   deepseek-proxy stop    Stop the proxy server
+echo   deepseek-proxy status  Check if proxy is running
+echo.
+echo The proxy runs on port %PROXY_PORT% by default.
+echo.
+
+endlocal

package/.sinapse-ai/infrastructure/scripts/llm-routing/templates/deepseek-usage.cmd

@@ -1,51 +1,51 @@
-@echo off
-:: DeepSeek Usage Statistics CLI
-:: View usage tracking data per alias
-
-setlocal
-
-:: Try multiple locations for the tracker script
-:: 1. Environment variable (if set during installation)
-if defined SINAPSE_HOME (
-    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-    if exist "%TRACKER_SCRIPT%" goto :found
-)
-
-:: 2. Common installation locations
-set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-:: 3. Relative to this script (for development)
-set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-:: 4. Global npm package location
-set "TRACKER_SCRIPT=%APPDATA%\npm\node_modules\@sinapse-fullstack\core\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
-if exist "%TRACKER_SCRIPT%" goto :found
-
-echo [91mERROR: Usage tracker not found![0m
-echo.
-echo Please ensure SINAPSE is installed correctly.
-echo Expected locations:
-echo   - %%SINAPSE_HOME%%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\
-echo   - %%USERPROFILE%%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\
-echo.
-echo Set SINAPSE_HOME environment variable: setx SINAPSE_HOME "C:\path\to\sinapse-ai"
-exit /b 1
-
-:found
-:: Check if Node.js is available
-where node >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [91mERROR: Node.js not found in PATH[0m
-    echo Please install Node.js from https://nodejs.org/
-    exit /b 1
-)
-
-:: Pass arguments to tracker
-node "%TRACKER_SCRIPT%" usage %*
-
-endlocal
+@echo off
+:: DeepSeek Usage Statistics CLI
+:: View usage tracking data per alias
+
+setlocal
+
+:: Try multiple locations for the tracker script
+:: 1. Environment variable (if set during installation)
+if defined SINAPSE_HOME (
+    set "TRACKER_SCRIPT=%SINAPSE_HOME%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+    if exist "%TRACKER_SCRIPT%" goto :found
+)
+
+:: 2. Common installation locations
+set "TRACKER_SCRIPT=%USERPROFILE%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+set "TRACKER_SCRIPT=%USERPROFILE%\Workspaces\SINAPSE\SinapseAI\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+:: 3. Relative to this script (for development)
+set "TRACKER_SCRIPT=%~dp0..\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+:: 4. Global npm package location
+set "TRACKER_SCRIPT=%APPDATA%\npm\node_modules\@sinapse-fullstack\core\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\index.js"
+if exist "%TRACKER_SCRIPT%" goto :found
+
+echo [91mERROR: Usage tracker not found![0m
+echo.
+echo Please ensure SINAPSE is installed correctly.
+echo Expected locations:
+echo   - %%SINAPSE_HOME%%\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\
+echo   - %%USERPROFILE%%\sinapse-ai\.sinapse-ai\infrastructure\scripts\llm-routing\usage-tracker\
+echo.
+echo Set SINAPSE_HOME environment variable: setx SINAPSE_HOME "C:\path\to\sinapse-ai"
+exit /b 1
+
+:found
+:: Check if Node.js is available
+where node >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [91mERROR: Node.js not found in PATH[0m
+    echo Please install Node.js from https://nodejs.org/
+    exit /b 1
+)
+
+:: Pass arguments to tracker
+node "%TRACKER_SCRIPT%" usage %*
+
+endlocal

package/.sinapse-ai/infrastructure/scripts/pr-review-ai.js

@@ -13,7 +13,7 @@
  * Based on Auto-Claude's AI PR Reviewer architecture.
  */
 
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const EventEmitter = require('events');
@@ -577,8 +577,9 @@ Respond with a JSON object:
   async callClaude(prompt) {
     return new Promise((resolve, reject) => {
       try {
-        const result = execSync(
-          `claude --print --dangerously-skip-permissions -p "${prompt.replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/`/g, '\\`')}"`,
+        const result = execFileSync(
+          'claude',
+          ['--print', '--dangerously-skip-permissions', '-p', prompt],
           {
             encoding: 'utf8',
             maxBuffer: 10 * 1024 * 1024,
@@ -705,9 +706,10 @@ class PRReviewAI extends EventEmitter {
    */
   async fetchPRData(prNumber) {
     try {
-      // Get PR info
-      const prJson = execSync(
-        `gh pr view ${prNumber} --json title,body,author,baseRefName,headRefName,files,additions,deletions`,
+      // Get PR info (use execFileSync array form to prevent shell injection)
+      const prJson = execFileSync(
+        'gh',
+        ['pr', 'view', String(prNumber), '--json', 'title,body,author,baseRefName,headRefName,files,additions,deletions'],
         {
           cwd: this.rootPath,
           encoding: 'utf8',
@@ -716,7 +718,7 @@ class PRReviewAI extends EventEmitter {
       const pr = JSON.parse(prJson);
 
       // Get diff
-      const diff = execSync(`gh pr diff ${prNumber}`, {
+      const diff = execFileSync('gh', ['pr', 'diff', String(prNumber)], {
         cwd: this.rootPath,
         encoding: 'utf8',
         maxBuffer: 50 * 1024 * 1024,
@@ -842,16 +844,17 @@ class PRReviewAI extends EventEmitter {
     const body = this.formatReviewBody(review);
 
     try {
-      // Post as PR comment
-      execSync(`gh pr comment ${prNumber} --body "${body.replace(/"/g, '\\"')}"`, {
+      // Post as PR comment (use execFileSync array form to prevent shell injection)
+      execFileSync('gh', ['pr', 'comment', String(prNumber), '--body', body], {
         cwd: this.rootPath,
         encoding: 'utf8',
       });
 
       // If requesting changes, also submit a review
       if (review.verdict === Verdict.REQUEST_CHANGES) {
-        execSync(
-          `gh pr review ${prNumber} --request-changes --body "Please address the issues found by the automated review."`,
+        execFileSync(
+          'gh',
+          ['pr', 'review', String(prNumber), '--request-changes', '--body', 'Please address the issues found by the automated review.'],
           {
             cwd: this.rootPath,
             encoding: 'utf8',
@@ -861,7 +864,7 @@ class PRReviewAI extends EventEmitter {
         review.verdict === Verdict.APPROVE &&
         review.findings.filter((f) => f.severity === Severity.CRITICAL).length === 0
       ) {
-        execSync(`gh pr review ${prNumber} --approve --body "LGTM! Automated review passed."`, {
+        execFileSync('gh', ['pr', 'review', String(prNumber), '--approve', '--body', 'LGTM! Automated review passed.'], {
           cwd: this.rootPath,
           encoding: 'utf8',
         });
@@ -931,7 +934,7 @@ class PRReviewAI extends EventEmitter {
    * Review local changes (not yet in PR)
    */
   async reviewLocal(baseBranch = 'main') {
-    const diff = execSync(`git diff ${baseBranch}...HEAD`, {
+    const diff = execFileSync('git', ['diff', `${baseBranch}...HEAD`], {
       cwd: this.rootPath,
       encoding: 'utf8',
     });