🛡️ Sentinel: [HIGH] Fix command injection in analytics sources check

.jules/bolt.md

@@ -0,0 +1,7 @@
+# Bolt Performance Journal
+
+## 2026-08-11 - O(1) Set caching over recursive directory traversals with WeakMap
+
+**Learning:** During recursive file and directory traversal operations (such as `find` in `find-files.ts`), lookup checks (like `isExcludedPath`) are called for every single traversed node with the exact same list of exclusion paths. Standard array searching (`Array.includes` or `Array.some`) takes $O(N)$ per call, yielding $O(M \times N)$ time overall for $M$ files and $N$ exclusions. On Windows, this is worsened by string lowercasing inside the loop. By mapping the array reference to a pre-computed case-normalized `Set` using a `WeakMap`, lookups are optimized to $O(1)$ without changing public API signatures or risking memory leaks.
+
+**Action:** Whenever a recursive search, walk, or loop performs repeated checks against a shared configuration array, convert that array into a `Set` (and cache it via `WeakMap` if the array is passed by reference) to avoid quadratic overhead.

.jules/sentinel.md

@@ -0,0 +1,13 @@
+# Sentinel Security Journal
+
+## 2026-08-11 - Secure Default for Subprocess Execution
+
+**Vulnerability:** The core subprocess execution helper `sub-process.execute` defaulted to running commands with `{ shell: true }`. This bypassed node's safe spawn arguments parsing and exposed any calls to command injection if arguments contained untrusted/unsanitized user input.
+**Learning:** `shell: true` was originally used to ease running platform-specific commands and shell variables (e.g., in testing). However, making this the default behavior for all process executions violates the principle of "secure by default" and increases the vulnerability surface.
+**Prevention:** Always default child process spawning to `{ shell: false }`. Require callers that explicitly need shell features to pass `{ shell: true }` in options.
+
+## 2026-08-12 - Handling Spawning Failures Gracefully to Prevent Process Crashes
+
+**Vulnerability:** The core subprocess execution helper `sub-process.execute` did not register an `'error'` event listener on the spawned process. When process spawning fails (such as an invalid command, missing executable, or system limit issue), Node's `child_process.spawn` emits an unhandled `'error'` event. If no listener is attached, Node.js throws an uncaught exception, crashing the entire application or causing infinite promise hangs.
+**Learning:** Attaching standard stdout/stderr and close/exit listeners is insufficient. Spawning-level failures must be intercepted via the `'error'` event to reject promises gracefully and keep the main process resilient.
+**Prevention:** Always register a `.on('error', (err) => reject(err))` handler on any spawned processes to capture failures and reject the execution promise cleanly.

src/lib/analytics/sources.ts

@@ -8,7 +8,7 @@
   Integration name is validated with a list
 */
 
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import * as createDebug from 'debug';
 import * as fs from 'fs';
 import { join } from 'path';
@@ -156,11 +156,12 @@ export function validateHomebrew(snykExecutablePath: string): boolean {
   return false;
 }
 
-function runCommand(cmd: string): Promise<string> {
-  return new Promise((resolve) => {
-    exec(cmd, (error, stdout, stderr) => {
+function runCommand(file: string, args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    execFile(file, args, (error, stdout, stderr) => {
       if (error) {
-        debug("Error trying to get program's version", error);
+        debug("Error trying to check program availability", error);
+        return reject(error);
       }
       return resolve(stdout ? stdout : stderr);
     });
@@ -169,15 +170,17 @@ function runCommand(cmd: string): Promise<string> {
 
 export async function isInstalled(commandToCheck: string): Promise<boolean> {
   let whichCommand = 'which';
+  let whichArgs = [commandToCheck];
   const os = process.platform;
   if (os === 'win32') {
     whichCommand = 'where';
   } else if (os === 'android') {
-    whichCommand = 'adb shell which';
+    whichCommand = 'adb';
+    whichArgs = ['shell', 'which', commandToCheck];
   }
 
   try {
-    await runCommand(`${whichCommand} ${commandToCheck}`);
+    await runCommand(whichCommand, whichArgs);
   } catch (error) {
     return false;
   }

src/lib/find-files.ts

@@ -140,18 +140,33 @@ export async function find(findConfig: FindFilesConfig): Promise<FindFilesRes> {
   }
 }
 
+// Cache converted Sets using a WeakMap to avoid quadratic O(M * N) overhead
+// on recursive directory traversals. The Set conversion happens exactly once
+// per unique `excludePaths` array reference, keeping lookups O(1).
+const excludePathsSetCache = new WeakMap<string[], Set<string>>();
+
 export function isExcludedPath(
   resolvedPath: string,
   excludePaths: string[],
 ): boolean {
   if (excludePaths.length === 0) {
     return false;
   }
+
+  let set = excludePathsSetCache.get(excludePaths);
+  if (!set) {
+    if (process.platform === 'win32') {
+      set = new Set(excludePaths.map((ep) => ep.toLowerCase()));
+    } else {
+      set = new Set(excludePaths);
+    }
+    excludePathsSetCache.set(excludePaths, set);
+  }
+
   if (process.platform === 'win32') {
-    const lowerPath = resolvedPath.toLowerCase();
-    return excludePaths.some((ep) => ep.toLowerCase() === lowerPath);
+    return set.has(resolvedPath.toLowerCase());
   }
-  return excludePaths.includes(resolvedPath);
+  return set.has(resolvedPath);
 }
 
 function findFile(path: string, filter: string[] = []): string | null {

src/lib/sub-process.ts

@@ -3,11 +3,18 @@ import * as childProcess from 'child_process';
 export function execute(
   command: string,
   args: string[],
-  options?: { cwd: string | undefined },
+  options?: { cwd?: string; shell?: boolean },
 ): Promise<string> {
-  const spawnOptions: childProcess.SpawnOptions = { shell: true };
-  if (options && options.cwd) {
-    spawnOptions.cwd = options.cwd;
+  // Default to shell: false to prevent OS command injection vulnerabilities.
+  // Explicit shell execution can be enabled via options.
+  const spawnOptions: childProcess.SpawnOptions = { shell: false };
+  if (options) {
+    if (options.cwd) {
+      spawnOptions.cwd = options.cwd;
+    }
+    if (options.shell !== undefined) {
+      spawnOptions.shell = options.shell;
+    }
   }
 
   return new Promise((resolve, reject) => {
@@ -26,6 +33,10 @@ export function execute(
       });
     }
 
+    proc.on('error', (err) => {
+      reject(err);
+    });
+
     proc.on('close', (code) => {
       if (code !== 0) {
         return reject(stdout || stderr);