AirCoding
560dfcce09
fix(P3): eliminate all execSync usage — uniform execFileSync pattern
3 P3 residuals found in independent audit, all non-exploitable but
inconsistent with the project security pattern (execFileSync + args array):
1. WorkerManager.find_bun: 'which bun' + 'test -x ${path}' replaced with
existsSync() + hardcoded candidates (no shell). BUN_INSTALL env var added
as first candidate.
2. CppTestRunner: 'ctest --output-on-failure' (literal string, safe but
inconsistent) → execFileSync('ctest', ['--output-on-failure'], ...).
3. e2e.ts: 4 execSync calls (find tools + run depcruise/tsc) replaced with
execFileSync + args arrays. Removed unused findDepcruise(). Inlined
the 7 package paths instead of relying on shell glob expansion.
Verification:
- grep 'execSync' across packages/cli + packages/runtime/src +
packages/toolchain-cpp/src returns 0 matches
- 28 execFileSync usages (uniform pattern)
- 169/169 tests pass
- tsc --noEmit: 0 errors
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>