zen-gitsync 2.13.22 → 2.13.24

package/src/ui/public/index.html

@@ -10,12 +10,12 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,400&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-BxxqloTb.js"></script>
+    <script type="module" crossorigin src="/assets/index-BGmxuKoN.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CMxvf4Kt.js">
     <link rel="modulepreload" crossorigin href="/assets/monaco-DC7mqInI.js">
     <link rel="modulepreload" crossorigin href="/assets/element-plus-CJjFCgLP.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-0YbzMuxw.js">
-    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-vLPduyLG.js">
+    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-BfbhkIv4.js">
     <link rel="modulepreload" crossorigin href="/assets/socket-io-z4n873W1.js">
     <link rel="stylesheet" crossorigin href="/assets/monaco-UXx6YYK1.css">
     <link rel="stylesheet" crossorigin href="/assets/element-plus-D36sOm0a.css">

package/src/ui/server/index.js

@@ -110,7 +110,7 @@ async function startUIServer(noOpen = false, savePort = false) {
     let dirPath = process.cwd();
     try {
       if(showConsole) console.log(`记录最近打开目录`)
-      const { stdout } = await execGitCommand('git rev-parse --show-toplevel');
+      const { stdout } = await execGitCommand(['rev-parse', '--show-toplevel']);
       const root = stdout?.trim();
       if (root) dirPath = root;
     } catch (_) {
@@ -290,7 +290,7 @@ async function startUIServer(noOpen = false, savePort = false) {
       }
 
       // 只获取porcelain格式状态，不再获取完整的git status
-      const { stdout: porcelainOutput } = await execGitCommand('git status --porcelain --untracked-files=all');
+      const { stdout: porcelainOutput } = await execGitCommand(['status', '--porcelain', '--untracked-files=all']);
 
       // 广播到当前项目房间的所有客户端
       io.to(projectRoomId).emit('git_status_update', {
@@ -309,7 +309,7 @@ async function startUIServer(noOpen = false, savePort = false) {
   // 检查当前目录是否是Git仓库
   let isGitRepo = false;
   try {
-    const { stdout } = await execGitCommand('git rev-parse --is-inside-work-tree', { log: false });
+    const { stdout } = await execGitCommand(['rev-parse', '--is-inside-work-tree'], { log: false });
     isGitRepo = stdout.trim() === 'true';
   } catch (error) {
     isGitRepo = false;

package/src/ui/server/routes/branchStatus.js

@@ -24,7 +24,7 @@ export function registerBranchStatusRoutes({
   // 获取当前分支 - 直接读取，不缓存（git symbolic-ref 极快，<5ms）
   app.get('/api/branch', async (req, res) => {
     try {
-      const { stdout } = await execGitCommand('git symbolic-ref --short HEAD');
+      const { stdout } = await execGitCommand(['symbolic-ref', '--short', 'HEAD']);
       res.json({ branch: stdout.trim() });
     } catch (error) {
       res.status(500).json({ error: error.message });
@@ -70,11 +70,11 @@ export function registerBranchStatusRoutes({
         console.log(`使用5秒缓存的分支名: ${currentBranch} -> ${upstreamBranch}`);
       } else {
         // 直接读取，不再走5分钟长缓存
-        const { stdout: branchOut } = await execGitCommand('git symbolic-ref --short HEAD');
+        const { stdout: branchOut } = await execGitCommand(['symbolic-ref', '--short', 'HEAD']);
         currentBranch = branchOut.trim();
 
         const { stdout: upstreamOut } = await execGitCommand(
-          'git rev-parse --abbrev-ref --symbolic-full-name @{u}',
+          ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'],
           { ignoreError: true }
         );
         upstreamBranch = upstreamOut.trim() || null;
@@ -88,7 +88,7 @@ export function registerBranchStatusRoutes({
       }
 
       const { stdout: aheadBehindOutput } = await execGitCommand(
-        `git rev-list --left-right --count ${currentBranch}...${upstreamBranch}`
+        ['rev-list', '--left-right', '--count', `${currentBranch}...${upstreamBranch}`]
       );
       const [ahead, behind] = aheadBehindOutput.trim().split('\t').map(Number);
 

package/src/ui/server/routes/config.js

@@ -101,7 +101,7 @@ async function collectDiffForAi({ execGitCommand, getCurrentProjectPath, selecte
   let fileList = []
   try {
     // 1. 拿到工作区状态,识别 untracked 文件
-    const { stdout: statusOut } = await execGitCommand('git status --porcelain=1 --untracked-files=all', cwdOpts)
+    const { stdout: statusOut } = await execGitCommand(['status', '--porcelain=1', '--untracked-files=all'], cwdOpts)
     const untracked = []
     const trackedChanges = []
     for (const line of (statusOut || '').split('\n')) {
@@ -129,9 +129,8 @@ async function collectDiffForAi({ execGitCommand, getCurrentProjectPath, selecte
       const batchSize = 20
       for (let i = 0; i < untracked.length; i += batchSize) {
         const batch = untracked.slice(i, i + batchSize)
-        const quoted = batch.map(p => `"${p.replace(/"/g, '\\"')}"`).join(' ')
         try {
-          await execGitCommand(`git add -N --force ${quoted}`, cwdOpts)
+          await execGitCommand(['add', '-N', '--force', ...batch], cwdOpts)
         } catch (e) {
           // 单批失败不影响整体
           console.warn('[generate-commit] git add -N failed for batch:', e?.message)
@@ -142,12 +141,13 @@ async function collectDiffForAi({ execGitCommand, getCurrentProjectPath, selecte
     // 3. 合并 staged + unstaged diff
     //    用 --no-color 避免 ANSI 干扰, --no-ext-diff 避免外接 diff 工具
     //    选择模式下用 `-- <paths>` 限定,避免拉取无关 staged 改动
-    const pathArgs = selectedSet
-      ? ' -- ' + [...selectedSet].map(p => `"${p.replace(/"/g, '\\"')}"`).join(' ')
-      : ''
+    const pathArgs = selectedSet ? [...selectedSet] : []
+    const diffBase = ['diff', '--no-color', '--no-ext-diff']
+    const stagedArgs = ['diff', '--staged', '--no-color', '--no-ext-diff', ...(pathArgs.length ? ['--', ...pathArgs] : [])]
+    const unstagedArgs = [...diffBase, ...(pathArgs.length ? ['--', ...pathArgs] : [])]
     const [stagedRes, unstagedRes] = await Promise.all([
-      execGitCommand(`git diff --staged --no-color --no-ext-diff${pathArgs}`, cwdOpts).catch(() => ({ stdout: '' })),
-      execGitCommand(`git diff --no-color --no-ext-diff${pathArgs}`, cwdOpts).catch(() => ({ stdout: '' }))
+      execGitCommand(stagedArgs, cwdOpts).catch(() => ({ stdout: '' })),
+      execGitCommand(unstagedArgs, cwdOpts).catch(() => ({ stdout: '' }))
     ])
     let combined = ''
     if (stagedRes?.stdout) combined += stagedRes.stdout.trim() + '\n'

package/src/ui/server/routes/exec.js

@@ -16,6 +16,12 @@ import path from 'path';
 import iconv from 'iconv-lite';
 import { spawn } from 'child_process';
 
+// 把 "git config --global key value" 这种空格分隔命令拆成 argv 数组,
+// 注意:简单 split 不处理引号/转义;保持与之前 shell 模式一致的语义。
+function splitCommandArgs(command) {
+  return command.trim().split(/\s+/).filter(Boolean);
+}
+
 export function registerExecRoutes({
   app,
   execGitCommand,
@@ -33,7 +39,7 @@ export function registerExecRoutes({
       }
 
       try {
-        const { stdout = '', stderr = '' } = await execGitCommand(command, { log: false });
+        const { stdout = '', stderr = '' } = await execGitCommand(splitCommandArgs(command), { log: false });
         return res.json({ success: true, stdout, stderr });
       } catch (err) {
         return res.status(400).json({ success: false, error: err?.message || String(err) });

package/src/ui/server/routes/fs.js

@@ -45,7 +45,7 @@ export function registerFsRoutes({
 
       // 检查当前目录是否是Git仓库
       try {
-        await execGitCommand('git rev-parse --is-inside-work-tree');
+        await execGitCommand(['rev-parse', '--is-inside-work-tree']);
       } catch (error) {
         return res.status(400).json({
           error: '当前目录不是一个Git仓库',
@@ -86,7 +86,7 @@ export function registerFsRoutes({
 
         // 检查新目录是否是Git仓库
         try {
-          await execGitCommand('git rev-parse --is-inside-work-tree');
+          await execGitCommand(['rev-parse', '--is-inside-work-tree']);
 
           // 更新全局变量
           setCurrentProjectPath(newProjectPath);

package/src/ui/server/routes/git/diff.js

@@ -34,10 +34,11 @@ export function registerGitDiffRoutes({
         return res.status(400).json({ error: '缺少文件路径参数' });
       }
 
-      const diffCommand = `git diff -- "${filePath}"`;
+      const diffArgs = ['diff', '--', filePath];
 
-      // 使用优化的检查函数
-      const skipCheck = await checkShouldSkipDiff(filePath, diffCommand);
+      // 使用优化的检查函数(diffCommand 用于内部 numstat 检测的字符串转换,
+      // 实际走 git 时用 argv 数组,避免 Windows cmd.exe 拼引号问题)
+      const skipCheck = await checkShouldSkipDiff(filePath, `git diff -- "${filePath}"`);
       if (skipCheck.shouldSkip) {
         return res.json({
           diff: skipCheck.reason,
@@ -47,7 +48,7 @@ export function registerGitDiffRoutes({
       }
 
       // 执行git diff命令获取文件差异
-      const { stdout } = await execGitCommand(diffCommand);
+      const { stdout } = await execGitCommand(diffArgs);
 
       // 检查实际diff大小
       const sizeCheck = checkDiffSize(stdout, 500);
@@ -72,10 +73,10 @@ export function registerGitDiffRoutes({
         return res.status(400).json({ error: '缺少文件路径参数' });
       }
 
-      const diffCommand = `git diff --cached -- "${filePath}"`;
+      const diffArgs = ['diff', '--cached', '--', filePath];
 
       // 使用优化的检查函数
-      const skipCheck = await checkShouldSkipDiff(filePath, diffCommand);
+      const skipCheck = await checkShouldSkipDiff(filePath, `git diff --cached -- "${filePath}"`);
       if (skipCheck.shouldSkip) {
         return res.json({
           diff: skipCheck.reason,
@@ -85,7 +86,7 @@ export function registerGitDiffRoutes({
       }
 
       // 执行git diff --cached命令获取已暂存文件差异
-      const { stdout } = await execGitCommand(diffCommand);
+      const { stdout } = await execGitCommand(diffArgs);
 
       // 检查实际diff大小
       const sizeCheck = checkDiffSize(stdout, 500);
@@ -105,7 +106,7 @@ export function registerGitDiffRoutes({
   // 获取全量 diff（git diff HEAD，含已暂存与未暂存的所有变更）
   app.get('/api/diff-head', async (req, res) => {
     try {
-      const { stdout } = await execGitCommand('git diff HEAD');
+      const { stdout } = await execGitCommand(['diff', 'HEAD']);
       const MAX = 500 * 1024;
       const content = stdout.length > MAX
         ? stdout.slice(0, MAX) + '\n\n[内容过大，已截断]'
@@ -172,7 +173,7 @@ export function registerGitDiffRoutes({
 
       let sizeBytes = 0;
       try {
-        const { stdout: sizeOut } = await execGitCommand(`git cat-file -s "${spec}"`, { log: false });
+        const { stdout: sizeOut } = await execGitCommand(['cat-file', '-s', spec], { log: false });
         sizeBytes = parseInt(String(sizeOut).trim(), 10) || 0;
       } catch (e) {
         return res.json({ success: true, notFound: true, content: '' });
@@ -187,7 +188,7 @@ export function registerGitDiffRoutes({
         });
       }
 
-      const { stdout } = await execGitCommand(`git show "${spec}"`, { log: false });
+      const { stdout } = await execGitCommand(['show', spec], { log: false });
       return res.json({ success: true, content: stdout ?? '' });
     } catch (error) {
       res.status(500).json({ success: false, error: error.message });
@@ -253,7 +254,7 @@ export function registerGitDiffRoutes({
       }
 
       // 检查文件状态：未跟踪文件需要删除，修改文件需要恢复
-      const { stdout: statusOutput } = await execGitCommand(`git status --porcelain -- "${filePath}"`);
+      const { stdout: statusOutput } = await execGitCommand(['status', '--porcelain', '--', filePath]);
 
       // 未跟踪的文件 (??), 需要删除它
       if (statusOutput.startsWith('??')) {
@@ -270,12 +271,12 @@ export function registerGitDiffRoutes({
       // 已暂存的文件，先取消暂存
       else if (statusOutput.startsWith('A ') || statusOutput.startsWith('M ') || statusOutput.startsWith('D ')) {
         // 先取消暂存
-        await execGitCommand(`git reset HEAD -- "${filePath}"`);
+        await execGitCommand(['reset', 'HEAD', '--', filePath]);
       }
 
       // 已修改文件，取消所有本地修改
       if (statusOutput) {
-        await execGitCommand(`git checkout -- "${filePath}"`);
+        await execGitCommand(['checkout', '--', filePath]);
         return res.json({ success: true, message: '文件修改已撤回' });
       } else {
         return res.status(400).json({
@@ -307,7 +308,7 @@ export function registerGitDiffRoutes({
     for (const filePath of filePaths) {
       try {
         // 检查文件状态：未跟踪 ??、已暂存 A/M/D、已修改（空状态会返回空字符串）
-        const { stdout: statusOutput } = await execGitCommand(`git status --porcelain -- "${filePath}"`)
+        const { stdout: statusOutput } = await execGitCommand(['status', '--porcelain', '--', filePath])
 
         // 未跟踪的文件 (??) → 直接删除
         if (statusOutput.startsWith('??')) {
@@ -324,12 +325,12 @@ export function registerGitDiffRoutes({
 
         // 已暂存的文件，先取消暂存（不影响工作区）
         if (statusOutput.startsWith('A ') || statusOutput.startsWith('M ') || statusOutput.startsWith('D ')) {
-          await execGitCommand(`git reset HEAD -- "${filePath}"`)
+          await execGitCommand(['reset', 'HEAD', '--', filePath])
         }
 
         // 已修改文件：丢弃工作区修改
         if (statusOutput) {
-          await execGitCommand(`git checkout -- "${filePath}"`)
+          await execGitCommand(['checkout', '--', filePath])
           results.push({ path: filePath, success: true, message: '文件修改已撤回' })
           successCount++
         } else {

package/src/ui/server/routes/git/diffUtils.js

@@ -31,8 +31,27 @@ export function createDiffHelpers({ execGitCommand }) {
 
     // 2. 使用 --numstat 快速检查变更量（不获取实际内容，速度快）
     try {
-      const numstatCommand = diffCommand.replace(/git (diff|show)/, 'git $1 --numstat');
-      const { stdout: numstat } = await execGitCommand(numstatCommand, { log: false });
+      // 把传入的 diffCommand 字符串改写成 git diff/show 加 --numstat 的 argv 数组。
+      // 不再走 shell 模式,避免 Windows cmd.exe 下引号兼容问题(参 utils execGitCommand execFile 化)。
+      const numstatCommand = diffCommand.replace(/git (diff|show)/, 'git $1 --numstat')
+      const argvMatch = numstatCommand.trim().match(/^git\s+(\S+)\s*(.*)$/)
+      let numstatArgs
+      if (argvMatch) {
+        const subCmd = argvMatch[1]
+        const rest = argvMatch[2]
+        // 简单按空白拆分,带引号段整体保留 -- "--" + 路径
+        // 这里最常见形态是 'git diff/show -- "--path"' 或 'git diff/show hash -- "--path"'
+        const tokens = []
+        const re = /"([^"]*)"|(\S+)/g
+        let m
+        while ((m = re.exec(rest)) !== null) tokens.push(m[1] !== undefined ? m[1] : m[2])
+        // 找到 '--numstat' 位置,把它加到 subCmd 后面作为第一个参数
+        numstatArgs = [subCmd, '--numstat', ...tokens]
+      } else {
+        // fallback: 走旧逻辑(字符串)
+        numstatArgs = numstatCommand
+      }
+      const { stdout: numstat } = await execGitCommand(numstatArgs, { log: false });
 
       if (numstat.trim()) {
         const lines = numstat.trim().split('\n');

package/src/ui/server/routes/git/stash.js

@@ -20,7 +20,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
   // 获取stash列表
   app.get('/api/stash-list', async (req, res) => {
     try {
-      const { stdout } = await execGitCommand('git stash list');
+      const { stdout } = await execGitCommand(['stash', 'list']);
 
       // 解析stash列表
       const stashList = stdout.split('\n')
@@ -53,7 +53,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       if (excludeLocked) {
         const lockedFiles = await configManager.getLockedFiles();
         // 包含未跟踪文件，确保状态与 UI 一致
-        const { stdout: statusStdout } = await execGitCommand('git status --porcelain --untracked-files=all', { log: false });
+        const { stdout: statusStdout } = await execGitCommand(['status', '--porcelain', '--untracked-files=all'], { log: false });
         const changedFiles = statusStdout
           .split('\n')
           .filter(line => line.trim())
@@ -100,7 +100,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
                 if (includeUntracked) {
                   try {
                     // 使用 git 列出该目录下的未跟踪和已修改文件
-                    const { stdout: listStdout } = await execGitCommand(`git ls-files -mo --exclude-standard "${filename}"`, { log: false });
+                    const { stdout: listStdout } = await execGitCommand(['ls-files', '-mo', '--exclude-standard', '--', filename], { log: false });
                     const listed = listStdout
                       .split('\n')
                       .map(l => l.trim())
@@ -145,14 +145,13 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
         // 在执行 stash 前进行候选校验：
         // 1) 仍有跟踪差异的文件
         try {
-          const args = filesToStash.map(f => `"${f}"`).join(' ');
-          const { stdout: diffNames } = await execGitCommand(`git diff --name-only -- ${args}`, { log: false });
+          const { stdout: diffNames } = await execGitCommand(['diff', '--name-only', '--', ...filesToStash], { log: false });
           const trackedChanged = new Set(diffNames.split('\n').map(s => s.trim()).filter(Boolean));
 
           // 2) 仍为未跟踪的文件（当 includeUntracked 才检查）
           let untrackedExisting = new Set();
           if (includeUntracked) {
-            const { stdout: others } = await execGitCommand(`git ls-files --others --exclude-standard -- ${args}`, { log: false });
+            const { stdout: others } = await execGitCommand(['ls-files', '--others', '--exclude-standard', '--', ...filesToStash], { log: false });
             untrackedExisting = new Set(others.split('\n').map(s => s.trim()).filter(Boolean));
           }
 
@@ -174,27 +173,22 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
           return res.json({ success: false, message: '没有可储藏的更改（可能刚刚已储藏，或被锁定过滤）' });
         }
 
-        let command = 'git stash push';
-        if (message) command += ` -m "${message}"`;
-        if (includeUntracked) command += ' --include-untracked';
-        const args = filesToStash.map(f => `"${f}"`).join(' ');
-        command += ` -- ${args}`;
+        const stashArgs = ['stash', 'push'];
+        if (message) stashArgs.push('-m', message);
+        if (includeUntracked) stashArgs.push('--include-untracked');
+        if (filesToStash.length > 0) stashArgs.push('--', ...filesToStash);
 
-        const { stdout } = await execGitCommand(command);
+        const { stdout } = await execGitCommand(stashArgs);
         if (stdout.includes('No local changes to save')) {
           return res.json({ success: false, message: '没有本地更改需要保存' });
         }
         return res.json({ success: true, message: '成功保存未锁定的工作区更改', output: stdout });
       }
 
-      let command = 'git stash push';
-      if (message) {
-        command += ` -m "${message}"`;
-      }
-      if (includeUntracked) {
-        command += ' --include-untracked';
-      }
-      const { stdout } = await execGitCommand(command);
+      const stashArgs = ['stash', 'push'];
+      if (message) stashArgs.push('-m', message);
+      if (includeUntracked) stashArgs.push('--include-untracked');
+      const { stdout } = await execGitCommand(stashArgs);
       if (stdout.includes('No local changes to save')) {
         return res.json({ success: false, message: '没有本地更改需要保存' });
       }
@@ -220,19 +214,18 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       }
 
       // 构建 git stash push 命令
-      let command = 'git stash push';
+      const stashArgs = ['stash', 'push'];
       if (message) {
-        command += ` -m "${message}"`;
+        stashArgs.push('-m', message);
       }
       if (includeUntracked) {
-        command += ' --include-untracked';
+        stashArgs.push('--include-untracked');
       }
 
       // 添加文件列表
-      const args = files.map(f => `"${f}"`).join(' ');
-      command += ` -- ${args}`;
+      stashArgs.push('--', ...files);
 
-      const { stdout } = await execGitCommand(command);
+      const { stdout } = await execGitCommand(stashArgs);
 
       if (stdout.includes('No local changes to save')) {
         return res.json({ success: false, message: '没有本地更改需要保存' });
@@ -266,7 +259,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       }
 
       // 决定是使用apply(保留stash)还是pop(应用后删除stash)
-      const command = pop ? `git stash pop ${stashId}` : `git stash apply ${stashId}`;
+      const command = pop ? ['stash', 'pop', stashId] : ['stash', 'apply', stashId];
 
       try {
         const { stdout } = await execGitCommand(command);
@@ -306,7 +299,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
         });
       }
 
-      const { stdout } = await execGitCommand(`git stash drop ${stashId}`);
+      const { stdout } = await execGitCommand(['stash', 'drop', stashId]);
 
       res.json({
         success: true,
@@ -322,7 +315,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
   // 清空所有stash
   app.post('/api/stash-clear', async (req, res) => {
     try {
-      const { stdout } = await execGitCommand('git stash clear');
+      const { stdout } = await execGitCommand(['stash', 'clear']);
 
       res.json({
         success: true,
@@ -350,7 +343,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       console.log(`获取stash文件列表: stashId=${stashId}`);
 
       // 0) 解析出当前 stash 提交及其父提交哈希，避免在 Windows 上使用 ^ 语法
-      const { stdout: parentsLine } = await execGitCommand(`git rev-list --parents -n 1 ${stashId}`, { log: false });
+      const { stdout: parentsLine } = await execGitCommand(['rev-list', '--parents', '-n', '1', stashId], { log: false });
       const hashes = parentsLine.trim().split(/\s+/).filter(Boolean);
       const stashCommit = hashes[0] || '';
       const parent1 = hashes[1] || '';
@@ -359,14 +352,14 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       // 1) 跟踪文件的变更列表：父1 与 stash 提交的差异（若无父1则为空）
       let trackedFiles = [];
       if (parent1) {
-        const { stdout: trackedOut } = await execGitCommand(`git diff --name-only ${parent1} ${stashCommit}`, { log: false });
+        const { stdout: trackedOut } = await execGitCommand(['diff', '--name-only', parent1, stashCommit], { log: false });
         trackedFiles = trackedOut.split('\n').map(s => s.trim()).filter(Boolean);
       }
 
       // 2) 未跟踪文件：来自第三父（若存在）
       let untrackedFiles = [];
       if (parent3) {
-        const { stdout: untrackedOut } = await execGitCommand(`git ls-tree -r --name-only ${parent3}`, { log: false });
+        const { stdout: untrackedOut } = await execGitCommand(['ls-tree', '-r', '--name-only', parent3], { log: false });
         untrackedFiles = untrackedOut.split('\n').map(s => s.trim()).filter(Boolean);
       }
 
@@ -403,7 +396,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       console.log(`获取stash文件差异: stashId=${stashId}, file=${file}`);
 
       // 先解析父提交哈希，避免使用 ^ 语法
-      const { stdout: parentsLine } = await execGitCommand(`git rev-list --parents -n 1 ${stashId}`, { log: false });
+      const { stdout: parentsLine } = await execGitCommand(['rev-list', '--parents', '-n', '1', stashId], { log: false });
       const hashes = parentsLine.trim().split(/\s+/).filter(Boolean);
       const stashCommit = hashes[0] || '';
       const parent1 = hashes[1] || '';
@@ -413,7 +406,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       let isFromThirdParent = false;
       if (parent3) {
         try {
-          await execGitCommand(`git cat-file -e ${parent3}:"${file}"`, { log: false });
+          await execGitCommand(['cat-file', '-e', `${parent3}:${file}`], { log: false });
           isFromThirdParent = true;
         } catch (_) {
           isFromThirdParent = false;
@@ -422,7 +415,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
 
       if (isFromThirdParent) {
         // 未跟踪文件：读取第三父中的内容，构造新增文件的统一diff
-        const { stdout: blob } = await execGitCommand(`git show ${parent3}:"${file}"`, { log: false });
+        const { stdout: blob } = await execGitCommand(['show', `${parent3}:${file}`], { log: false });
 
         // 检查文件大小
         const sizeCheck = checkDiffSize(blob, 500);
@@ -457,10 +450,13 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       }
 
       // 否则，使用原有方式获取与父1的变更
-      const diffCommand = `git show ${stashCommit} -- "${file}"`;
+      // checkShouldSkipDiff 接受字符串命令用于日志展示,这里只用于大小判断;
+      // 走 execGitCommand 时用 argv 数组,避免 Windows 下 cmd.exe 拼引号被破坏。
+      const diffCommandForCheck = `git show ${stashCommit} -- "${file}"`;
+      const diffCommandArgs = ['show', stashCommit, '--', file];
 
       // 使用优化的检查函数
-      const skipCheck = await checkShouldSkipDiff(file, diffCommand);
+      const skipCheck = await checkShouldSkipDiff(file, diffCommandForCheck);
       if (skipCheck.shouldSkip) {
         return res.json({
           success: true,
@@ -470,7 +466,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
         });
       }
 
-      const { stdout } = await execGitCommand(diffCommand);
+      const { stdout } = await execGitCommand(diffCommandArgs);
 
       console.log(`获取到差异内容，长度: ${stdout.length}`);
 
@@ -503,7 +499,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       }
 
       // 解析父提交哈希
-      const { stdout: parentsLine } = await execGitCommand(`git rev-list --parents -n 1 ${stashId}`, { log: false });
+      const { stdout: parentsLine } = await execGitCommand(['rev-list', '--parents', '-n', '1', stashId], { log: false });
       const hashes = parentsLine.trim().split(/\s+/).filter(Boolean);
       const stashCommit = hashes[0] || '';
       const parent1 = hashes[1] || '';
@@ -513,7 +509,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       let isFromThirdParent = false;
       if (parent3) {
         try {
-          await execGitCommand(`git cat-file -e ${parent3}:"${file}"`, { log: false });
+          await execGitCommand(['cat-file', '-e', `${parent3}:${file}`], { log: false });
           isFromThirdParent = true;
         } catch (_) {
           isFromThirdParent = false;
@@ -524,7 +520,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       let original = '';
       if (!isFromThirdParent && parent1) {
         try {
-          const { stdout: origOut } = await execGitCommand(`git show ${parent1}:"${file}"`, { log: false });
+          const { stdout: origOut } = await execGitCommand(['show', `${parent1}:${file}`], { log: false });
           original = origOut ?? '';
         } catch (_) {
           original = ''; // 文件在储藏前不存在
@@ -536,7 +532,7 @@ export function registerGitStashRoutes({ app, execGitCommand, configManager }) {
       const modRef = isFromThirdParent ? parent3 : stashCommit;
       if (modRef) {
         try {
-          const { stdout: modOut } = await execGitCommand(`git show ${modRef}:"${file}"`, { log: false });
+          const { stdout: modOut } = await execGitCommand(['show', `${modRef}:${file}`], { log: false });
           modified = modOut ?? '';
         } catch (_) {
           modified = ''; // 文件已被删除

package/src/ui/server/routes/git/tags.js

@@ -24,25 +24,25 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
         return res.status(400).json({ success: false, error: '缺少标签名称' });
       }
 
-      let command = 'git tag';
+      const tagArgs = ['tag'];
 
       if (type === 'annotated') {
         // 附注标签
         if (!message) {
           return res.status(400).json({ success: false, error: '附注标签需要提供说明信息' });
         }
-        command += ` -a "${tagName}" -m "${message}"`;
+        tagArgs.push('-a', tagName, '-m', message);
       } else {
         // 轻量标签
-        command += ` "${tagName}"`;
+        tagArgs.push(tagName);
       }
 
       // 如果指定了commit，添加到命令中
       if (commit && commit.trim()) {
-        command += ` ${commit.trim()}`;
+        tagArgs.push(commit.trim());
       }
 
-      const { stdout } = await execGitCommand(command);
+      const { stdout } = await execGitCommand(tagArgs);
 
       res.json({
         success: true,
@@ -60,7 +60,7 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
     try {
       // 使用 git tag -n --format 获取详细信息
       const { stdout } = await execGitCommand(
-        'git tag -n --format="%(refname:short)|%(objectname:short)|%(creatordate:iso8601)|%(subject)"'
+        ['tag', '-n', '--format=%(refname:short)|%(objectname:short)|%(creatordate:iso8601)|%(subject)']
       );
 
       if (!stdout.trim()) {
@@ -82,7 +82,7 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
       for (const tag of tags) {
         try {
           const { stdout: typeCheck } = await execGitCommand(
-            `git cat-file -t ${tag.name}`,
+            ['cat-file', '-t', tag.name],
             { log: false }
           );
           if (typeCheck.trim() === 'tag') {
@@ -109,7 +109,7 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
         return res.status(400).json({ success: false, error: '缺少标签名称' });
       }
 
-      const { stdout } = await execGitCommand(`git push origin ${tagName}`);
+      const { stdout } = await execGitCommand(['push', 'origin', tagName]);
 
       res.json({
         success: true,
@@ -125,7 +125,7 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
   // 推送所有标签到远程
   app.post('/api/push-all-tags', async (req, res) => {
     try {
-      const { stdout } = await execGitCommand('git push origin --tags');
+      const { stdout } = await execGitCommand(['push', 'origin', '--tags']);
 
       res.json({
         success: true,
@@ -147,7 +147,7 @@ export function registerGitTagRoutes({ app, execGitCommand, clearCommandHistory
         return res.status(400).json({ success: false, error: '缺少标签名称' });
       }
 
-      const { stdout } = await execGitCommand(`git tag -d ${tagName}`);
+      const { stdout } = await execGitCommand(['tag', '-d', tagName]);
 
       res.json({
         success: true,