fix(security): replace string splitting with array args in git-wrapper

[riaworks]

Summary

• Replace execGit(string) with execGitArgs(array) as the primary method in git-wrapper.js
• All internal callers now pass arguments as arrays instead of concatenated strings
• Eliminates command injection risk from naive command.split(' ') (spaces in branch names, file paths, or tag messages would break or inject arguments)
• Preserve execGit() as a deprecated backwards-compatible wrapper for external consumers (branch-manager, conflict-resolver, worktree-manager)

Context

The original execGit() used command.split(' ') to parse command strings, which is a known injection vector:

// Before: breaks with spaces in args, e.g. branch "my feature"
await this.execGit(`checkout -b ${branchName}`);

// After: safe, each arg is isolated
await this.execGitArgs(['checkout', '-b', branchName]);

Files Changed

File	Change
git-wrapper.js	New execGitArgs() method, all internal callers migrated, execGit() deprecated

Backwards Compatibility

execGit() still works for external callers (7 files reference it) — it delegates to execGitArgs() internally. These callers can be migrated in follow-up PRs.

Test plan

• npm test passes
• Git operations (branch, checkout, commit, push, stash, tag, diff) work correctly with array args
• External callers using deprecated execGit() continue to work

🤖 Generated with Claude Code

[vercel]

@riaworks is attempting to deploy a commit to the Pedro Valério Lopez's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[riaworks]

CodeRabbit review is running on the fork PR: riaworks#3
Review results will be validated there before requesting merge here.

@coderabbitai ignore

[coderabbitai]

@riaworks: Understood! I'll pause automatic reviews on this PR. You can validate the changes on your fork PR (riaworks#3) first.

When you're ready to resume reviews here, just mention me with @coderabbitai resume.

✅ Actions performed

Reviews paused.