Problem
Transport epic PR #2035 at exact head b3ce045 has a medium CodeQL js/shell-command-injection-from-environment finding at apps/desktop/scripts/run-bounded-darwin-command.mjs:155 (check/job 101128142786). The wrapper currently invokes an argv array through spawn with shell: false, but the security gate is red and the command boundary must be made unambiguously safe to both execution and static analysis.
Required correction
Trace the CodeQL flow from environment/CLI input to process creation. Make the smallest robust correction or precise documented suppression that proves:
- no shell is invoked;
- the executable is selected from a fixed allowlist or otherwise authenticated before spawn;
- argument boundaries cannot be reinterpreted as shell syntax;
- existing bounded timeout, process-group termination, output cap, and cleanup behavior remain intact;
- no secrets or raw commands are logged.
Do not weaken the macOS ephemeral signing/verification evidence and do not touch Windows-specific behavior. Add focused adversarial tests for metacharacters, executable substitution, and environment influence.
Acceptance
The exact CodeQL medium finding is absent on fresh CI; bounded-command tests, packaged Darwin x64/ARM64 signing and Connect journeys, Linux lanes, full suite, and unsigned Mac/Linux validation remain green.
Problem
Transport epic PR #2035 at exact head b3ce045 has a medium CodeQL
js/shell-command-injection-from-environmentfinding atapps/desktop/scripts/run-bounded-darwin-command.mjs:155(check/job 101128142786). The wrapper currently invokes an argv array throughspawnwithshell: false, but the security gate is red and the command boundary must be made unambiguously safe to both execution and static analysis.Required correction
Trace the CodeQL flow from environment/CLI input to process creation. Make the smallest robust correction or precise documented suppression that proves:
Do not weaken the macOS ephemeral signing/verification evidence and do not touch Windows-specific behavior. Add focused adversarial tests for metacharacters, executable substitution, and environment influence.
Acceptance
The exact CodeQL medium finding is absent on fresh CI; bounded-command tests, packaged Darwin x64/ARM64 signing and Connect journeys, Linux lanes, full suite, and unsigned Mac/Linux validation remain green.