Merge branch 'main' into jules-fix-governance-injection-12456679039303197057

src/lock-publisher.mjs

@@ -1,4 +1,4 @@
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomInt } from 'node:crypto';
 import { SimplePool } from 'nostr-tools/pool';
 import {
   getPublishTimeoutMs,

src/services/governance/index.js

@@ -220,8 +220,9 @@ export async function applyProposal(id) {
 
   // Git Commit (optional)
   try {
-    // We use execFileSync for git operations to avoid command injection
-    // Ensure we are in repo root? cwd is repo root.
+    // We use execFileSync for git operations to avoid command injection.
+    // Explicitly using the array form ensures arguments are passed directly to the spawned process
+    // without shell interpretation, preventing command injection attacks via 'meta.target' or 'commitMsg'.
     execFileSync('git', ['add', meta.target]);
     const commitMsg = `feat(prompts): apply proposal ${id} by ${meta.author}`;
     execFileSync('git', ['commit', '-m', commitMsg]);