Remove shell interpolation from process launches #48

Merged

lost-rob0t merged 1 commit from fix/zara-012-process-safety into master

2026-07-19 02:27:59 +00:00

lost-rob0t commented

2026-07-19 02:25:24 +00:00

(Migrated from github.com)

What changed

replace dynamic shell command strings for search, app launch, and dictation with direct executable/argv process creation
add canonical argv-list configuration while constraining legacy whitespace command strings and rejecting shell interpreters/syntax
preserve literal alert/search/app/dictation arguments, detached launches, home-path expansion, and actionable startup failures
add a fake-executable regression corpus covering quotes, semicolons, command substitutions, newlines, leading dashes, Unicode, exact argv boundaries, and marker non-execution
document the safe Prolog command format

Why

User-, config-, and model-controlled text could cross shell parsing boundaries, allowing injection and obscuring executable argument boundaries and startup status.

Impact

Normal alert, search, app-launch, and dictation paths no longer invoke sh -c or shell/1 with dynamic text. Existing simple command strings remain supported through a constrained parser; argv lists are the canonical format.

Validation

nix develop -c bash -c 'pytest && for test_script in scripts/test-*.sh; do bash "$test_script"; done'
70 Python tests passed
every scripts/test-*.sh suite passed, including 7 process-safety cases
nix build

Closes #13

## What changed - replace dynamic shell command strings for search, app launch, and dictation with direct executable/argv process creation - add canonical argv-list configuration while constraining legacy whitespace command strings and rejecting shell interpreters/syntax - preserve literal alert/search/app/dictation arguments, detached launches, home-path expansion, and actionable startup failures - add a fake-executable regression corpus covering quotes, semicolons, command substitutions, newlines, leading dashes, Unicode, exact argv boundaries, and marker non-execution - document the safe Prolog command format ## Why User-, config-, and model-controlled text could cross shell parsing boundaries, allowing injection and obscuring executable argument boundaries and startup status. ## Impact Normal alert, search, app-launch, and dictation paths no longer invoke `sh -c` or `shell/1` with dynamic text. Existing simple command strings remain supported through a constrained parser; argv lists are the canonical format. ## Validation - `nix develop -c bash -c 'pytest && for test_script in scripts/test-*.sh; do bash "$test_script"; done'` - 70 Python tests passed - every `scripts/test-*.sh` suite passed, including 7 process-safety cases - `nix build` Closes #13