Workflow prose transports derived text through double-quoted shell arguments #133

New issue

Closed

opened 2026-08-15 14:33:36 +00:00 by john · 1 comment

john commented

2026-08-15 14:33:36 +00:00

Owner

Source: deep dive F7
Verdict: AGREE - high

Claim as reviewed

The codebase already explains why caller-derived prose cannot safely sit in a double-quoted shell argument, and prescribes a file transport for one command. Roughly sixteen other workflow sites still prescribe the unsafe form for values derived from agent output or repository content.

At HEAD `f354864` (v3.3.0)

The principle is already conceded in-tree at cadence-core/bin/planning.mjs:3295-3300: "--text \"<item>\" puts caller-derived prose inside a double-quoted shell word, so an item carrying $(...) or a backtick executes before Node starts. A path cannot."

Sites still prescribing the quoted form:

--detail "<...>" - cadence-core/workflows/execute.md:206, workflows/verify.md:294, workflows/plan.md:191 and :289, workflows/context.md:184, workflows/verify-deep.md:19, workflows/decision-review.md:65, workflows/minimalism-review.md:91, references/triage-gate.md:46, references/plan-revision.md:27 and :55, references/review-triggers.md:135 and :279.

--read "<...>" - references/review-triggers.md:111, workflows/decision-review.md:52, workflows/minimalism-review.md:73.

--label <label> unquoted - cadence-core/workflows/milestone.md:97, where the label is derived from PROJECT.md.

Note

Source of the value is a subagent return, a repository path, an error string, or reviewer output. A $(...) or backtick in any of those executes before planning.mjs can validate or record it.

Fix shape: --detail-file / --read-file / --label-file (or a JSON payload on stdin), workflow prose requiring the file form for every derived value, and a self-verification rule that rejects workflow examples interpolating placeholders into quoted Bash arguments for free-form fields.

**Source:** deep dive F7 **Verdict:** AGREE - high ### Claim as reviewed The codebase already explains why caller-derived prose cannot safely sit in a double-quoted shell argument, and prescribes a file transport for one command. Roughly sixteen other workflow sites still prescribe the unsafe form for values derived from agent output or repository content. ### At HEAD f354864 (v3.3.0) The principle is already conceded in-tree at `cadence-core/bin/planning.mjs:3295-3300`: "`--text \"<item>\"` puts caller-derived prose inside a double-quoted shell word, so an item carrying `$(...)` or a backtick executes before Node starts. A path cannot." Sites still prescribing the quoted form: `--detail "<...>"` - `cadence-core/workflows/execute.md:206`, `workflows/verify.md:294`, `workflows/plan.md:191` and `:289`, `workflows/context.md:184`, `workflows/verify-deep.md:19`, `workflows/decision-review.md:65`, `workflows/minimalism-review.md:91`, `references/triage-gate.md:46`, `references/plan-revision.md:27` and `:55`, `references/review-triggers.md:135` and `:279`. `--read "<...>"` - `references/review-triggers.md:111`, `workflows/decision-review.md:52`, `workflows/minimalism-review.md:73`. `--label <label>` unquoted - `cadence-core/workflows/milestone.md:97`, where the label is derived from `PROJECT.md`. ### Note Source of the value is a subagent return, a repository path, an error string, or reviewer output. A `$(...)` or backtick in any of those executes before `planning.mjs` can validate or record it. Fix shape: `--detail-file` / `--read-file` / `--label-file` (or a JSON payload on stdin), workflow prose requiring the file form for every derived value, and a self-verification rule that rejects workflow examples interpolating placeholders into quoted Bash arguments for free-form fields.

john added the

security

external-review

labels

2026-08-15 14:33:36 +00:00

john added this to the v3.5.2 milestone

2026-08-15 15:06:08 +00:00

john referenced this issue

2026-08-15 15:06:09 +00:00

plan-overlap and lease-check disagree on directory-lease semantics #132

john commented

2026-08-15 15:06:09 +00:00

Author

Owner

Scope note: this is ~16 prose sites plus the flags they call, so it is the larger half of the milestone by file count and the smaller by risk. The reference implementation already exists - planning.mjs:3295-3300 states the rule and 'capture --text-file' is the working example. Generalize that pattern rather than inventing one, and add the self-verify rule that rejects a workflow example interpolating a placeholder into a quoted Bash argument, or these sites grow back.

Bundled with #132 as v3.5.2. The two share no files, so plan-overlap will report empty and the phase looks parallel-eligible - but #132 is rewriting the gate that grants that eligibility. Run sequentially or split the phase; see the comment on #132. Scope note: this is ~16 prose sites plus the flags they call, so it is the larger half of the milestone by file count and the smaller by risk. The reference implementation already exists - planning.mjs:3295-3300 states the rule and 'capture --text-file' is the working example. Generalize that pattern rather than inventing one, and add the self-verify rule that rejects a workflow example interpolating a placeholder into a quoted Bash argument, or these sites grow back.

john referenced this issue from a pull request that will close it,

2026-08-16 16:39:05 +00:00

v3.5.2 - one reader, one transport #196

john closed this issue

2026-08-16 16:39:37 +00:00