vibebusiness 1.2.49 → 1.2.53

package/.next/standalone/data/implementations.json

@@ -1369,6 +1369,107 @@
         "[2026-02-21T03:14:02.477Z] Create PR only mode — skipping implementation",
         "[2026-02-21T03:14:02.490Z] No commits to push, skipping PR creation"
       ]
+    },
+    {
+      "id": "impl-mly92zre",
+      "idea_id": "idea-073e5d92",
+      "status": "completed",
+      "repo_name": "vibebusiness",
+      "branch_name": "ai/idea-073e5d92-fix-critical-shell-injection-in-implemen",
+      "workspace_path": "/Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+      "logs": [
+        "[2026-02-22T21:19:05.353Z] Implementation started",
+        "[2026-02-22T21:19:05.357Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+        "[2026-02-22T21:19:05.361Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:19:05.372Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g1",
+        "[2026-02-22T21:19:05.377Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:19:05.386Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g2",
+        "[2026-02-22T21:19:05.396Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g3",
+        "[2026-02-22T21:19:05.403Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:19:05.423Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g4",
+        "[2026-02-22T21:19:05.455Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:19:05.466Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g5",
+        "[2026-02-22T21:19:05.477Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:19:35.372Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:35.380Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:35.401Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:35.412Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:35.466Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:35.481Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:19:43.621Z] Claude Code completed successfully in 38s (1000 chars)",
+        "[2026-02-22T21:19:43.657Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:19:43.739Z] Skipping PR creation (--skip-pr)",
+        "[2026-02-22T21:20:04.844Z] Claude Code completed successfully in 59s (1005 chars)",
+        "[2026-02-22T21:20:04.899Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:20:04.975Z] Skipping PR creation (--skip-pr)",
+        "[2026-02-22T21:20:05.021Z] Claude Code completed successfully in 60s (1202 chars)",
+        "[2026-02-22T21:20:05.065Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:20:05.127Z] Skipping PR creation (--skip-pr)",
+        "[2026-02-22T21:20:05.412Z]   ...Claude Code working (60s elapsed, 0 chars output, 60s since last output)",
+        "[2026-02-22T21:20:05.467Z]   ...Claude Code working (60s elapsed, 0 chars output, 60s since last output)",
+        "[2026-02-22T21:20:05.480Z]   ...Claude Code working (60s elapsed, 0 chars output, 60s since last output)",
+        "[2026-02-22T21:20:35.414Z]   ...Claude Code working (90s elapsed, 0 chars output, 90s since last output)",
+        "[2026-02-22T21:20:35.468Z]   ...Claude Code working (90s elapsed, 0 chars output, 90s since last output)",
+        "[2026-02-22T21:20:35.483Z]   ...Claude Code working (90s elapsed, 0 chars output, 90s since last output)",
+        "[2026-02-22T21:20:42.632Z] Claude Code completed successfully in 97s (1206 chars)",
+        "[2026-02-22T21:20:42.685Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:20:42.735Z] Skipping PR creation (--skip-pr)",
+        "[2026-02-22T21:21:05.414Z]   ...Claude Code working (120s elapsed, 0 chars output, 120s since last output)",
+        "[2026-02-22T21:21:05.481Z]   ...Claude Code working (120s elapsed, 0 chars output, 120s since last output)",
+        "[2026-02-22T21:21:35.414Z]   ...Claude Code working (150s elapsed, 0 chars output, 150s since last output)",
+        "[2026-02-22T21:21:35.483Z]   ...Claude Code working (150s elapsed, 0 chars output, 150s since last output)",
+        "[2026-02-22T21:22:05.416Z]   ...Claude Code working (180s elapsed, 0 chars output, 180s since last output)",
+        "[2026-02-22T21:22:05.483Z]   ...Claude Code working (180s elapsed, 0 chars output, 180s since last output)",
+        "[2026-02-22T21:22:35.417Z]   ...Claude Code working (210s elapsed, 0 chars output, 210s since last output)",
+        "[2026-02-22T21:22:35.484Z]   ...Claude Code working (210s elapsed, 0 chars output, 210s since last output)",
+        "[2026-02-22T21:23:05.416Z]   ...Claude Code working (240s elapsed, 0 chars output, 240s since last output)",
+        "[2026-02-22T21:23:05.483Z]   ...Claude Code working (240s elapsed, 0 chars output, 240s since last output)",
+        "[2026-02-22T21:23:17.057Z] Claude Code completed successfully in 252s (2194 chars)",
+        "[2026-02-22T21:23:17.098Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:23:17.156Z] Skipping PR creation (--skip-pr)",
+        "[2026-02-22T21:23:35.417Z]   ...Claude Code working (270s elapsed, 0 chars output, 270s since last output)",
+        "[2026-02-22T21:24:04.053Z] Claude Code completed successfully in 299s (2310 chars)",
+        "[2026-02-22T21:24:04.121Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:24:04.199Z] Skipping PR creation (--skip-pr)"
+      ]
+    },
+    {
+      "id": "impl-mly949xm",
+      "idea_id": "idea-073e5d92",
+      "status": "completed",
+      "repo_name": "vibebusiness",
+      "branch_name": "ai/idea-073e5d92-fix-critical-shell-injection-in-implemen",
+      "workspace_path": "/Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+      "logs": [
+        "[2026-02-22T21:20:05.193Z] Implementation started",
+        "[2026-02-22T21:20:05.195Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+        "[2026-02-22T21:20:05.196Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:20:35.199Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:21:05.200Z]   ...Claude Code working (60s elapsed, 0 chars output, 60s since last output)",
+        "[2026-02-22T21:21:30.701Z] Claude Code completed successfully in 86s (1241 chars)",
+        "[2026-02-22T21:21:30.721Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:21:30.799Z] Skipping PR creation (--skip-pr)"
+      ]
+    },
+    {
+      "id": "impl-mly9641i",
+      "idea_id": "idea-073e5d92",
+      "status": "completed",
+      "repo_name": "vibebusiness",
+      "branch_name": "ai/idea-073e5d92-fix-critical-shell-injection-in-implemen",
+      "workspace_path": "/Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+      "logs": [
+        "[2026-02-22T21:21:30.870Z] Implementation started",
+        "[2026-02-22T21:21:30.871Z] Using pre-configured worktree: /Users/luismey/Code/vibebusiness/workspaces/vibebusiness-worktrees/ai/idea-073e5d92-impl-g0",
+        "[2026-02-22T21:21:30.872Z] Running Claude Code to implement changes (timeout: 600s (model: sonnet))...",
+        "[2026-02-22T21:22:00.877Z]   ...Claude Code working (30s elapsed, 0 chars output, 30s since last output)",
+        "[2026-02-22T21:22:30.876Z]   ...Claude Code working (60s elapsed, 0 chars output, 60s since last output)",
+        "[2026-02-22T21:23:00.877Z]   ...Claude Code working (90s elapsed, 0 chars output, 90s since last output)",
+        "[2026-02-22T21:23:30.878Z]   ...Claude Code working (120s elapsed, 0 chars output, 120s since last output)",
+        "[2026-02-22T21:23:36.366Z] Claude Code completed successfully in 125s (1664 chars)",
+        "[2026-02-22T21:23:36.408Z] Changes detected, staging and committing...",
+        "[2026-02-22T21:23:36.507Z] Skipping PR creation (--skip-pr)"
+      ]
     }
   ]
 }

package/.next/standalone/data/posthog.json

@@ -0,0 +1,68 @@
+{
+  "last_updated": "2026-02-22T21:45:00.000Z",
+  "integration_status": {
+    "sdk_installed": true,
+    "api_key_valid": true,
+    "provider_generated": true,
+    "pageview_tracker": true,
+    "event_helper": true,
+    "kpi_adapter": true
+  },
+  "framework": {
+    "framework": "nextjs",
+    "typescript": true,
+    "appRouter": true,
+    "srcDir": true
+  },
+  "generated_files": [
+    "website/src/components/PostHogProvider.tsx",
+    "website/src/components/PostHogPageview.tsx",
+    "website/src/lib/posthog.ts"
+  ],
+  "detected_events": [
+    {
+      "event": "waitlist_signup_success",
+      "location": "website/src/app/page.tsx",
+      "type": "website"
+    },
+    {
+      "event": "waitlist_signup_error",
+      "location": "website/src/app/page.tsx",
+      "type": "website"
+    },
+    {
+      "event": "checkout_completed",
+      "location": "website/src/components/TrackCheckoutComplete.tsx",
+      "type": "website"
+    },
+    {
+      "event": "command_run",
+      "location": "bin/ai-analyst.ts",
+      "type": "cli",
+      "properties": ["command", "dryRun", "session", "task", "type", "deep", "minimal"]
+    },
+    {
+      "event": "heartbeat_task",
+      "location": "scripts/heartbeat.ts",
+      "type": "backend",
+      "properties": ["taskType", "success", "errorType"]
+    }
+  ],
+  "kpi_mappings": {
+    "kpi-beta-signups": "waitlist_signup_success",
+    "kpi-paying-users": "checkout_completed",
+    "kpi-cli-init-count": "command_run[command=init]",
+    "kpi-cli-vibe-count": "command_run[command=vibe]",
+    "kpi-cli-scan-count": "command_run[command=scan]"
+  },
+  "unmapped_events": [
+    {
+      "event": "waitlist_signup_error",
+      "reason": "No matching KPI — useful for error monitoring in PostHog dashboards"
+    },
+    {
+      "event": "heartbeat_task",
+      "reason": "Operational metric — useful in PostHog dashboards but no business KPI match"
+    }
+  ]
+}

package/.next/standalone/data/sessions.json

@@ -341,18 +341,19 @@
     {
       "id": "session-4a6293fb",
       "created_at": "2026-02-19T20:11:45.297Z",
-      "completed_at": null,
+      "completed_at": "2026-02-22T00:00:00.000Z",
       "type": "quick",
-      "status": "running",
+      "status": "failed",
       "repos_analyzed": [
         "vibebusiness"
       ],
       "ideas_generated": [],
-      "error_message": null,
+      "error_message": "Session timed out — marked failed by dedup-triage-and-approve-inbox meta-task on 2026-02-22. Was stuck in 'running' with 0 ideas generated since 2026-02-19T20:11:45.",
       "logs": [
         "[2026-02-19T20:11:45.297Z] Session started",
         "[2026-02-19T20:11:45.301Z] Generated quick analysis prompt",
-        "[2026-02-19T20:11:45.301Z] Running Claude Code analysis..."
+        "[2026-02-19T20:11:45.301Z] Running Claude Code analysis...",
+        "[2026-02-22T00:00:00.000Z] Session marked failed by meta-task cleanup (zombie session — no ideas generated, stuck in running state)"
       ]
     }
   ]

package/.next/standalone/data/social.json

@@ -1,11 +1,94 @@
 {
-  "last_updated": "2026-02-20T22:50:48.200Z",
+  "last_updated": "2026-02-22T21:40:50.506Z",
   "platform": "x",
   "username": "@luisgmey",
   "credentials_valid": true,
-  "drafts": [],
+  "drafts": [
+    {
+      "id": "draft-a53d0edc",
+      "text": "6 months ago I had 47 product ideas and shipped 0 of them.\n\nThis week I shipped 6 updates without writing a single line of code.\n\nI built an AI product manager that runs on autopilot.\n\nHere's exactly how it works 🧵",
+      "source": "thread",
+      "source_ref": null,
+      "status": "draft",
+      "created_at": "2026-02-22T21:40:50.506Z",
+      "published_at": null,
+      "tweet_id": null,
+      "tweet_url": null,
+      "is_thread": true,
+      "thread_tweets": [
+        "6 months ago I had 47 product ideas and shipped 0 of them.\n\nThis week I shipped 6 updates without writing a single line of code.\n\nI built an AI product manager that runs on autopilot.\n\nHere's exactly how it works 🧵",
+        "The real indie hacker problem isn't building.\n\nIt's deciding *what* to build.\n\n20 ideas → 0 shipped. Every week.\n\nAnalysis paralysis kills more products than bad code.\n\nI was stuck here for 18 months.",
+        "So I built VibeBusiness.\n\nAn autonomous AI that:\n→ Analyzes your codebase\n→ Reviews your metrics\n→ Decides what to build next\n→ Implements it\n→ Ships it\n→ Verifies the results\n\nThe full PM loop. Zero humans required.",
+        "It runs on a heartbeat pattern.\n\nEvery few hours it checks:\n• What's broken?\n• What's growing?\n• What would move the needle most?\n\nThen it acts. Creates branches. Opens PRs. Ships code.\n\nThis is what 'AI-native' actually means.",
+        "This week alone it shipped:\n→ Stripe payment integration\n→ OG meta tags for link previews\n→ Social proof section\n→ npm README update\n→ Hero copy improvements\n\nAll from one command: `vibebusiness heartbeat`",
+        "It's live on npm right now.\n\n`npm install -g vibebusiness`\n\nConnects to your repo in 60 seconds.\n\nI need 20 indie hackers to beta test.\n\nShip code solo and struggle with prioritization? DM me. 👋\n\n#buildinpublic",
+        "What's the #1 thing blocking you from shipping more?\n\nA) Too many ideas, can't prioritize\nB) Not enough coding time\nC) Stuck in planning/research hell\nD) Fear of shipping something broken\n\nDrop your answer 👇"
+      ],
+      "scheduled_date": "2026-02-23"
+    },
+    {
+      "id": "draft-301d9eae",
+      "text": "Hot take: most AI coding tools just make you faster at the wrong things.\n\nFaster at writing code ≠ faster at shipping.\n\nVibeBusiness skips 'how do I build this?' and starts with 'what should I build next?'\n\nDifferent layer. Way bigger leverage.\n\n#buildinpublic",
+      "source": "insight",
+      "source_ref": null,
+      "status": "draft",
+      "created_at": "2026-02-22T21:40:50.506Z",
+      "published_at": null,
+      "tweet_id": null,
+      "tweet_url": null,
+      "media_paths": null,
+      "scheduled_date": "2026-02-24"
+    },
+    {
+      "id": "draft-3da42b09",
+      "text": "Stripe just went live in VibeBusiness. 🎉\n\nThe AI now factors in:\n→ Your MRR and churn\n→ Who's paying (and who's dropping off)\n→ Where the funnel breaks\n\nMost tools show you the data.\nThis one decides what to build based on it.\n\nDay 4 of 90. #buildinpublic",
+      "source": "insight",
+      "source_ref": null,
+      "status": "draft",
+      "created_at": "2026-02-22T21:40:50.506Z",
+      "published_at": null,
+      "tweet_id": null,
+      "tweet_url": null,
+      "media_paths": null,
+      "scheduled_date": "2026-02-25"
+    },
+    {
+      "id": "draft-138c8256",
+      "text": "I run `vibebusiness heartbeat` 3x per day.\n\nEach time: AI scans my codebase, checks metrics, picks the highest-leverage task, and ships it.\n\nHere's what one heartbeat actually looks like — step by step 🧵",
+      "source": "thread",
+      "source_ref": null,
+      "status": "draft",
+      "created_at": "2026-02-22T21:40:50.506Z",
+      "published_at": null,
+      "tweet_id": null,
+      "tweet_url": null,
+      "is_thread": true,
+      "thread_tweets": [
+        "I run `vibebusiness heartbeat` 3x per day.\n\nEach time: AI scans my codebase, checks metrics, picks the highest-leverage task, and ships it.\n\nHere's what one heartbeat actually looks like — step by step 🧵",
+        "Step 1: Read state.\n\nThe AI reads TODO.md, STATUS.md, MEMORY.md, and all data files.\n\nIt knows:\n• What's been done\n• What's blocked\n• Current metrics\n• What's been tried before\n\nContext is everything.",
+        "Step 2: Reason.\n\nClaude asks:\n→ What's the most important thing right now?\n→ Can I execute this autonomously?\n→ What's the expected impact?\n\nIt outputs a structured decision with a confidence score.\n\nNo vibes. Just logic.",
+        "Step 3: Execute.\n\nIf autonomous → implements directly\nIf human-needed → flags to Blocked\n\nNo wasted cycles. No hallucinated shell commands.\n\nThere's a 3-layer safety gate to stop the AI from acting on things it can't actually do.",
+        "Step 4: Verify + update state.\n\nAfter shipping, it updates STATUS.md.\n\nNext heartbeat starts with full context.\n\nThis is continuous improvement — without a PM, a standup, or a quarterly OKR session.",
+        "The hardest part wasn't the code.\n\nIt was teaching the AI to know when NOT to act.\n\nMost AI agents fail here — they try everything and hallucinate through blockers.\n\nWhat's your biggest fear about autonomous AI agents? 👇\n\n#buildinpublic"
+      ],
+      "scheduled_date": "2026-02-26"
+    },
+    {
+      "id": "draft-1dffa7b2",
+      "text": "Week 1 of building VibeBusiness in public: done.\n\nShipped:\n✅ Stripe payments live\n✅ npm package published\n✅ Landing page + OG tags\n✅ Social proof section\n\nNext milestone: 20 beta users.\n\nSolo dev who can't prioritize what to build? I want you.\n\nWhat's your stack? 👇 #buildinpu...",
+      "source": "insight",
+      "source_ref": null,
+      "status": "draft",
+      "created_at": "2026-02-22T21:40:50.506Z",
+      "published_at": null,
+      "tweet_id": null,
+      "tweet_url": null,
+      "media_paths": null,
+      "scheduled_date": "2026-02-27"
+    }
+  ],
   "metrics": {
-    "followers_count": 334,
+    "followers_count": 335,
     "post_streak_days": 0,
     "total_posts": 0,
     "last_post_date": null

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibebusiness",
-  "version": "1.2.49",
+  "version": "1.2.53",
   "description": "AI-powered autonomous product manager. Research. Build. Ship. Grow.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,

package/.next/standalone/scripts/analyze.ts

@@ -21,6 +21,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { getAnalysisPrompt } from '../src/lib/prompts';
 import type { AnalystConfig as ImportedAnalystConfig, BusinessConfig } from '../src/lib/types';
 import { atomicWriteFileSync } from './lib/json-lock';
+import { requireClaudeCLI } from './lib/ai-provider';
 
 // Local type alias for compatibility
 type AnalystConfig = ImportedAnalystConfig;
@@ -454,6 +455,8 @@ async function runClaudeAnalysis(
   config: AnalystConfig,
   timeoutMs: number = 600000 // 10 minute default timeout
 ): Promise<string> {
+  requireClaudeCLI('codebase analysis');
+
   return new Promise((resolve, reject) => {
     // Build the command to run Claude Code
     // We'll use the --print flag to get the response directly
@@ -562,6 +565,13 @@ async function runClaudeAnalysis(
 
 // Generate a codebase snapshot for the heartbeat
 async function generateCodebaseSnapshot(config: AnalystConfig): Promise<void> {
+  try {
+    requireClaudeCLI('codebase snapshot');
+  } catch {
+    console.log('Skipping codebase snapshot (Claude Code CLI not available)');
+    return;
+  }
+
   const snapshotPath = path.join(DATA_DIR, 'codebase-snapshot.json');
 
   console.log('Generating codebase snapshot...');

package/.next/standalone/scripts/implement.ts

@@ -14,11 +14,13 @@
  *   npx tsx scripts/implement.ts --idea=idea-demo003
  */
 
-import { execSync, spawn } from 'child_process';
+import { execFileSync, spawn } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
-import { cleanGitState, exec } from './lib/git-utils';
+import { cleanGitState, exec, execGit } from './lib/git-utils';
+import { validateBranchName, sanitizeForCommitMessage } from './lib/shell-safe';
 import { atomicWriteFileSync } from './lib/json-lock';
+import { requireClaudeCLI } from './lib/ai-provider';
 
 // Types (duplicated to avoid import issues with tsx)
 interface RepoConfig {
@@ -269,19 +271,19 @@ function setupWorkspace(repo: RepoConfig, workspaceDir: string, implId: string):
         const currentOrigin = exec('git remote get-url origin', repoWorkspace);
         if (!currentOrigin.includes('github.com')) {
           addLog(implId, `Repointing origin from local path to ${repo.github_url}`);
-          exec(`git remote set-url origin ${repo.github_url}`, repoWorkspace);
+          execGit(['remote', 'set-url', 'origin', repo.github_url], repoWorkspace);
         }
       } catch {
         // If remote doesn't exist, add it
-        exec(`git remote add origin ${repo.github_url}`, repoWorkspace);
+        execGit(['remote', 'add', 'origin', repo.github_url], repoWorkspace);
       }
     }
 
     // Update existing clone
     addLog(implId, `Updating existing clone at ${repoWorkspace}`);
-    exec(`git fetch origin`, repoWorkspace);
-    exec(`git checkout ${repo.default_branch || 'main'}`, repoWorkspace);
-    exec(`git pull origin ${repo.default_branch || 'main'}`, repoWorkspace);
+    exec('git fetch origin', repoWorkspace);
+    execGit(['checkout', repo.default_branch || 'main'], repoWorkspace);
+    execGit(['pull', 'origin', repo.default_branch || 'main'], repoWorkspace);
   } else {
     // Clone fresh — prefer github_url, fall back to local path
     const cloneSource = repo.github_url || repo.path;
@@ -289,7 +291,7 @@ function setupWorkspace(repo: RepoConfig, workspaceDir: string, implId: string):
       throw new Error(`No github_url or path configured for repo: ${repo.name}`);
     }
     addLog(implId, `Cloning ${cloneSource} to ${repoWorkspace}`);
-    exec(`git clone ${cloneSource} ${repoWorkspace}`);
+    execGit(['clone', cloneSource, repoWorkspace]);
   }
 
   return repoWorkspace;
@@ -297,20 +299,21 @@ function setupWorkspace(repo: RepoConfig, workspaceDir: string, implId: string):
 
 // Create feature branch
 function createBranch(workspacePath: string, branchName: string, defaultBranch: string, implId: string): void {
+  validateBranchName(branchName);
   addLog(implId, `Creating branch: ${branchName}`);
 
   // Make sure we're on the default branch
-  exec(`git checkout ${defaultBranch}`, workspacePath);
+  execGit(['checkout', defaultBranch], workspacePath);
 
   // Check if branch already exists
   try {
-    exec(`git rev-parse --verify ${branchName}`, workspacePath);
+    execGit(['rev-parse', '--verify', branchName], workspacePath);
     // Branch exists, check it out
     addLog(implId, `Branch ${branchName} already exists, checking out`);
-    exec(`git checkout ${branchName}`, workspacePath);
+    execGit(['checkout', branchName], workspacePath);
   } catch {
     // Branch doesn't exist, create it
-    exec(`git checkout -b ${branchName}`, workspacePath);
+    execGit(['checkout', '-b', branchName], workspacePath);
   }
 }
 
@@ -417,6 +420,8 @@ async function runImplementation(
   timeoutMs: number = 300000,
   options: { model?: string; scoped?: boolean } = {}
 ): Promise<boolean> {
+  requireClaudeCLI('implementation');
+
   const modelLabel = options.model ? ` (model: ${options.model})` : '';
   addLog(implId, `Running Claude Code to implement changes (timeout: ${timeoutMs / 1000}s${modelLabel})...`);
 
@@ -530,7 +535,7 @@ function createPR(
 ): { url: string; number: number } | null {
   // Check if there are commits ahead of default branch
   try {
-    const ahead = exec(`git rev-list --count ${defaultBranch}..${branchName}`, workspacePath);
+    const ahead = execGit(['rev-list', '--count', `${defaultBranch}..${branchName}`], workspacePath);
     if (parseInt(ahead, 10) === 0) {
       addLog(implId, 'No commits to push, skipping PR creation');
       return null;
@@ -540,7 +545,7 @@ function createPR(
   }
 
   addLog(implId, `Pushing branch ${branchName} to origin`);
-  exec(`git push -u origin ${branchName}`, workspacePath, 30000);
+  execGit(['push', '-u', 'origin', branchName], workspacePath, 30000);
 
   addLog(implId, 'Creating PR with gh CLI');
 
@@ -564,11 +569,11 @@ Idea ID: \`${idea.id}\`
 `;
 
   try {
-    const prOutput = exec(
-      `gh pr create --title "${title.replace(/"/g, '\\"')}" --body "${body.replace(/"/g, '\\"')}" --base ${defaultBranch}`,
-      workspacePath,
-      30000
-    );
+    const prOutput = execFileSync(
+      'gh',
+      ['pr', 'create', '--title', title, '--body', body, '--base', defaultBranch],
+      { cwd: workspacePath, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30000 }
+    ).trim();
 
     // Extract PR URL and number
     const urlMatch = prOutput.match(/https:\/\/github\.com\/[^\s]+\/pull\/(\d+)/);
@@ -670,22 +675,23 @@ async function main(): Promise<void> {
       try { exec('git fetch origin', workspacePath); } catch {}
 
       // Check out or create the feature branch
+      validateBranchName(branchName);
       addLog(impl.id, `Checking out branch: ${branchName}`);
       try {
-        exec(`git checkout ${branchName}`, workspacePath);
+        execGit(['checkout', branchName], workspacePath);
         // Merge latest main into feature branch to stay current
         addLog(impl.id, `Merging origin/${defaultBranch} into ${branchName}...`);
         try {
-          exec(`git merge origin/${defaultBranch} --no-edit`, workspacePath);
+          execGit(['merge', `origin/${defaultBranch}`, '--no-edit'], workspacePath);
         } catch {
           addLog(impl.id, 'Merge conflict detected, aborting merge');
-          exec('git merge --abort', workspacePath);
+          execGit(['merge', '--abort'], workspacePath);
         }
       } catch {
         // Branch doesn't exist yet, create it from latest default branch
-        exec(`git checkout ${defaultBranch}`, workspacePath);
-        exec(`git pull origin ${defaultBranch}`, workspacePath);
-        exec(`git checkout -b ${branchName}`, workspacePath);
+        execGit(['checkout', defaultBranch], workspacePath);
+        execGit(['pull', 'origin', defaultBranch], workspacePath);
+        execGit(['checkout', '-b', branchName], workspacePath);
       }
     } else {
       // Full workspace setup (original behavior)
@@ -746,7 +752,7 @@ async function main(): Promise<void> {
             addLog(impl.id, `Skipping junk file: ${file}`);
             continue;
           }
-          exec(`git add "${file}"`, workspacePath);
+          execGit(['add', file], workspacePath);
         }
       } else {
         exec('git add -A', workspacePath);
@@ -755,10 +761,11 @@ async function main(): Promise<void> {
       // Only commit if there are staged changes
       const staged = exec('git diff --cached --stat', workspacePath);
       if (staged.trim().length > 0) {
+        const safeTitle = sanitizeForCommitMessage(idea.title);
         const commitMsg = scope
-          ? `feat: ${idea.title} (sub-task)\n\nImplemented by AI Product Manager\nIdea: ${idea.id}`
-          : `feat: ${idea.title}\n\nImplemented by AI Product Manager\nIdea: ${idea.id}`;
-        exec(`git commit -m "${commitMsg}"`, workspacePath);
+          ? `feat: ${safeTitle} (sub-task)\n\nImplemented by AI Product Manager\nIdea: ${idea.id}`
+          : `feat: ${safeTitle}\n\nImplemented by AI Product Manager\nIdea: ${idea.id}`;
+        execGit(['commit', '-m', commitMsg], workspacePath);
       } else {
         addLog(impl.id, 'No staged changes after filtering, skipping commit');
       }
@@ -773,7 +780,7 @@ async function main(): Promise<void> {
         // Still push the branch so work isn't lost when workspace is deleted
         try {
           addLog(impl.id, `Pushing branch ${branchName} to origin`);
-          exec(`git push -u origin ${branchName}`, workspacePath, 30000);
+          execGit(['push', '-u', 'origin', branchName], workspacePath, 30000);
         } catch (pushError) {
           addLog(impl.id, `Warning: Failed to push branch: ${(pushError as Error).message}`);
           // Don't fail the whole task if push fails - code is still committed locally