Why
Agent hooks advertise read-only tools, but the command-name whitelist accepts newline command injection and mutating arguments such as find -delete, sort -o, git diff --output and awk system(). A real temporary-directory probe created a file.
Scope
Replace shell execution with validated argument execution and narrowly supported read-only operations. Cover quoting, unsafe options, executable selection and genuine read-only commands.
Approach
Turn the audit reproduction into a repository regression, fix the runtime boundary, and verify callers and adjacent hooks tests using Bun 1.3.14. Keep the user's existing working-tree edits outside this delivery.
Acceptance
Regression probes reject writes and shell injection before spawning, while documented read-only commands return real output.
Why
Agent hooks advertise read-only tools, but the command-name whitelist accepts newline command injection and mutating arguments such as find -delete, sort -o, git diff --output and awk system(). A real temporary-directory probe created a file.
Scope
Replace shell execution with validated argument execution and narrowly supported read-only operations. Cover quoting, unsafe options, executable selection and genuine read-only commands.
Approach
Turn the audit reproduction into a repository regression, fix the runtime boundary, and verify callers and adjacent hooks tests using Bun 1.3.14. Keep the user's existing working-tree edits outside this delivery.
Acceptance
Regression probes reject writes and shell injection before spawning, while documented read-only commands return real output.