diff --git a/packages/runtime/src/app/RuntimeApp.ts b/packages/runtime/src/app/RuntimeApp.ts
index 6f6e4a9..b41705f 100755
--- a/packages/runtime/src/app/RuntimeApp.ts
+++ b/packages/runtime/src/app/RuntimeApp.ts
@@ -36,11 +36,6 @@ export class RuntimeApp {
   constructor(config: RuntimeAppConfig) {
     this.config = config
     this.logger = new Logger(config.log_dir || join(config.project_root, '.air', 'logs'))
-    this.scheduler = new Scheduler({
-      session_id: config.session_id,
-      project_id: config.project_id,
-      project_root: config.project_root
-    })
     this.worker_manager = new WorkerManager()
     this.context_assembler = new ContextAssembler()
     this.doctor = new DoctorService(config.project_root)
diff --git a/packages/runtime/src/tools/git/index.ts b/packages/runtime/src/tools/git/index.ts
index 37a376c..dd7768c 100755
--- a/packages/runtime/src/tools/git/index.ts
+++ b/packages/runtime/src/tools/git/index.ts
@@ -7,7 +7,7 @@
  * @module packages/runtime/src/tools/git
  */
 
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import { existsSync } from 'fs'
 import { join, dirname } from 'path'
 import type { ToolDefinition, ToolCall, ToolResultEnvelope, ISOTimeString } from '@aircoding/contracts'
@@ -119,7 +119,8 @@ export function createGitExecutor(project_root: string) {
 
   const run_git = (repo_path: string, ...args: string[]): string => {
     try {
-      return execSync(`git ${args.join(' ')}`, {
+      // SECURITY: use execFileSync with args array — never string-interpolate user-controlled args
+      return execFileSync('git', args, {
         cwd: repo_path,
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe']