fix(P0): close 2 audit findings from independent review
1. P0 SECURITY: git/index.ts run_git used execSync(`git ${args.join(' ')}`)
with LLM-controlled args (commit messages, branch names, ranges) —
classic command injection. Replaced with execFileSync('git', args, ...)
which uses argv array (no shell parsing).
2. P1 CORRECTNESS: RuntimeApp constructor created TWO Scheduler instances:
- Line 39: Scheduler({...}) without worker_manager
- Line 55: Scheduler({...}, worker_manager) replacing the first
First instance was leaked (allocated then overwritten). Removed the
duplicate, kept only the wired version.
Verification:
- 169/169 tests pass
- tsc --noEmit: 0 errors
- depcruise: 0 violations
- grep 'new Scheduler' RuntimeApp.ts → 1 match (was 2)
- grep 'execSync' git/index.ts → 0 matches (was 1, with LLM-controlled args)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ed9735ac76