From ed33362c61b3ea47d617ab84da2ae97eb521614d Mon Sep 17 00:00:00 2001
From: Howon Lee <howon@coderabbit.ai>
Date: Tue, 27 Oct 2026 16:16:05 -0700
Subject: [PATCH 1/2] fix(security): quote macOS terminal directory commands
 (12106)

---
 lib/platform.sh     | 10 ++++++----
 tests/platform.bats | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/lib/platform.sh b/lib/platform.sh
index 96ed843..8c1977f 100644
--- a/lib/platform.sh
+++ b/lib/platform.sh
@@ -91,8 +91,10 @@ spawn_terminal_in() {
   case "$os" in
     darwin)
       # Escape variables for AppleScript string interpolation
-      local safe_path safe_title safe_cmd
-      safe_path=$(_escape_applescript "$path")
+      local shell_path safe_cd safe_title safe_cmd
+      # Quote for the terminal shell first, then for the AppleScript string.
+      shell_path="${path//\'/\'\\\'\'}"
+      safe_cd=$(_escape_applescript "cd -- '$shell_path'")
       safe_title=$(_escape_applescript "$title")
       safe_cmd=$(_escape_applescript "$cmd")
 
@@ -109,7 +111,7 @@ spawn_terminal_in() {
 						tell current window
 							create tab with default profile
 							tell current session
-								write text "cd \"$safe_path\""
+								write text "$safe_cd"
 								set name to "$safe_title"
 								$iterm_cmd_line
 							end tell
@@ -119,7 +121,7 @@ spawn_terminal_in() {
       else
         osascript <<-EOF 2>/dev/null || true
 					tell application "Terminal"
-						do script "cd \"$safe_path\"; $safe_cmd"
+						do script "$safe_cd; $safe_cmd"
 						set custom title of front window to "$safe_title"
 					end tell
 				EOF
diff --git a/tests/platform.bats b/tests/platform.bats
index 2888cfc..722ea44 100644
--- a/tests/platform.bats
+++ b/tests/platform.bats
@@ -29,3 +29,38 @@ EOF
   grep -Fx -- "-lc" "$BATS_TMPDIR/gnome-terminal-args"
   grep -Fx -- "echo hello" "$BATS_TMPDIR/gnome-terminal-args"
 }
+
+@test "macOS terminals treat command substitutions and quotes in paths as literal data" {
+  export OSTYPE=darwin
+  local terminal
+  for terminal in iTerm Terminal; do
+    export GTR_TEST_TERMINAL="$terminal"
+    export GTR_TEST_SCRIPT="$_platform_mock_bin/applescript"
+    cat > "$_platform_mock_bin/osascript" <<'EOF'
+#!/usr/bin/env bash
+if [ "${1:-}" = -e ]; then
+  printf '%s\n' "$GTR_TEST_TERMINAL"
+else
+  cat > "$GTR_TEST_SCRIPT"
+fi
+EOF
+    chmod +x "$_platform_mock_bin/osascript"
+    local path="$_platform_mock_bin/"'$(touch injected) `touch injected2` '\''quote"back\slash'
+    mkdir -p "$path"
+    spawn_terminal_in "$path" 'title' ''
+    # Decode the AppleScript string and run the actual shell command it carries.
+    python3 - "$GTR_TEST_SCRIPT" "$_platform_mock_bin/command" <<'PYCODE'
+import re, sys
+s = open(sys.argv[1]).read()
+m = re.search(r'(?:write text|do script) "((?:\\.|[^"\\])*)"', s)
+assert m, s
+command = re.sub(r'\\([\\"])', r'\1', m.group(1))
+open(sys.argv[2], 'w').write(command + '\npwd -P\n')
+PYCODE
+    run bash "$_platform_mock_bin/command"
+    [ "$status" -eq 0 ]
+    [ "$output" = "$path" ]
+    [ ! -e injected ]
+    [ ! -e injected2 ]
+  done
+}

From 4ef86e276829e3c396e2dc40c02611e48d9bf24c Mon Sep 17 00:00:00 2001
From: Howon Lee <howon@coderabbit.ai>
Date: Tue, 27 Oct 2026 16:30:24 -0700
Subject: [PATCH 2/2] test(platform): compare canonical macOS temporary paths

---
 tests/platform.bats | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/platform.bats b/tests/platform.bats
index 722ea44..739b7db 100644
--- a/tests/platform.bats
+++ b/tests/platform.bats
@@ -47,6 +47,8 @@ EOF
     chmod +x "$_platform_mock_bin/osascript"
     local path="$_platform_mock_bin/"'$(touch injected) `touch injected2` '\''quote"back\slash'
     mkdir -p "$path"
+    local expected_path
+    expected_path=$(cd -P "$path" && pwd)
     spawn_terminal_in "$path" 'title' ''
     # Decode the AppleScript string and run the actual shell command it carries.
     python3 - "$GTR_TEST_SCRIPT" "$_platform_mock_bin/command" <<'PYCODE'
@@ -59,7 +61,7 @@ open(sys.argv[2], 'w').write(command + '\npwd -P\n')
 PYCODE
     run bash "$_platform_mock_bin/command"
     [ "$status" -eq 0 ]
-    [ "$output" = "$path" ]
+    [ "$output" = "$expected_path" ]
     [ ! -e injected ]
     [ ! -e injected2 ]
   done