Drop usage of execSync, switch to $ util

utils/setup.ts

@@ -2,6 +2,7 @@ import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { log } from "./cli.ts";
 import type { RepoContext } from "./github.ts";
+import { $ } from "./shell.ts";
 
 export interface SetupOptions {
   tempDir: string;
@@ -25,7 +26,7 @@ export function setupTestRepo(options: SetupOptions): void {
       rmSync(tempDir, { recursive: true, force: true });
 
       log.info("📦 Cloning pullfrogai/scratch into .temp...");
-      execSync(`git clone ${repoUrl} ${tempDir}`, { stdio: "inherit" });
+      $("git", ["clone", repoUrl, tempDir]);
     } else {
       log.info("📦 Resetting existing .temp repository...");
       execSync("git reset --hard HEAD && git clean -fd", {
@@ -35,7 +36,7 @@ export function setupTestRepo(options: SetupOptions): void {
     }
   } else {
     log.info("📦 Cloning pullfrogai/scratch into .temp...");
-    execSync(`git clone ${repoUrl} ${tempDir}`, { stdio: "inherit" });
+    $("git", ["clone", repoUrl, tempDir]);
   }
 }
 
@@ -87,6 +88,6 @@ export function setupGitAuth(githubToken: string, repoContext: RepoContext): voi
 
   // Update remote URL to embed the token
   const remoteUrl = `https://x-access-token:${githubToken}@github.com/${repoContext.owner}/${repoContext.name}.git`;
-  execSync(`git remote set-url origin "${remoteUrl}"`, { stdio: "inherit" });
+  $("git", ["remote", "set-url", "origin", remoteUrl]);
   log.info("✓ Updated remote URL with authentication token");
 }

utils/shell.ts

@@ -0,0 +1,71 @@
+import { spawnSync } from "node:child_process";
+
+interface ShellOptions {
+  cwd?: string;
+  encoding?:
+    | "utf-8"
+    | "utf8"
+    | "ascii"
+    | "base64"
+    | "base64url"
+    | "hex"
+    | "latin1"
+    | "ucs-2"
+    | "ucs2"
+    | "utf16le";
+  log?: boolean;
+  onError?: (result: { status: number; stdout: string; stderr: string }) => void;
+}
+
+/**
+ * Execute a shell command safely using spawnSync with argument arrays.
+ * Prevents shell injection by avoiding string interpolation in shell commands.
+ *
+ * @param cmd - The command to execute
+ * @param args - Array of arguments to pass to the command
+ * @param options - Optional configuration (cwd, encoding, onError)
+ * @returns The trimmed stdout output
+ * @throws Error if command fails and no onError handler is provided
+ */
+export function $(cmd: string, args: string[], options?: ShellOptions): string {
+  const encoding = options?.encoding ?? "utf-8";
+  const result = spawnSync(cmd, args, {
+    stdio: ["inherit", "pipe", "pipe"],
+    encoding,
+    cwd: options?.cwd,
+  });
+
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+
+  // Write output to process streams so it behaves like stdio: "inherit"
+  // Only log if log option is not explicitly set to false
+  if (options?.log !== false) {
+    if (stdout) {
+      process.stdout.write(stdout);
+    }
+    if (stderr) {
+      process.stderr.write(stderr);
+    }
+  }
+
+  // Handle errors
+  if (result.status !== 0) {
+    const errorResult = {
+      status: result.status ?? -1,
+      stdout,
+      stderr,
+    };
+
+    if (options?.onError) {
+      options.onError(errorResult);
+      return stdout.trim();
+    }
+
+    throw new Error(
+      `Command failed with exit code ${errorResult.status}: ${stderr || "Unknown error"}`
+    );
+  }
+
+  return stdout.trim();
+}