meels 3bc1afa9f1 Fix ingest subprocess dropping the filename argument (C1) ...

spawn(..., { shell: true }) made Node concatenate argv without quoting;
cmd.exe re-tokenized it and the ingest prompt arrived as a bare "ingest"
with the filename silently discarded, while the run still reported
success. claude.exe is a real executable here, so no shell is needed:
drop shell: true and pass argv directly. isSafeFilename is unchanged
(still correct defence in depth) but its comment now reflects that the
spawn path carries no injection surface today.

2026-07-28 14:55:04 +02:00

20 KiB

Raw Blame History

View Raw