Shell syntax passed to run() across multiple tools

[TerminalGravity]

Bug

run() in src/lib/git.ts uses execFileSync (no shell), but many tools pass strings containing shell syntax like 2>/dev/null, ||, pipes, and < file redirects. These get split on whitespace and passed as literal git args, causing silent failures.

Affected files

• src/tools/token-audit.ts — 2>/dev/null, wc -l < file
• src/tools/enrich-agent-task.ts — grep pipes, 2>/dev/null
• src/tools/clarify-intent.ts — pnpm tsc --noEmit 2>&1 | grep, find ... 2>/dev/null
• src/tools/audit-workspace.ts — 2>/dev/null, find ... | wc -l
• src/tools/sharpen-followup.ts — 2>/dev/null
• src/tools/session-handoff.ts — command -v ... 2>/dev/null, || echo
• src/tools/sequence-tasks.ts — git ls-files 2>/dev/null | head
• src/tools/checkpoint.ts — git reset HEAD 2>/dev/null
• src/tools/scan-sessions.ts — various

Fix

Each call needs to be converted to use array args with run(), and non-git commands (wc, find, grep) need their own execFileSync calls or Node.js equivalents.

PR #301 fixes what-changed.ts as a start.

[TerminalGravity]

PR #306 fixes 4 more tools: checkpoint, sharpen-followup, sequence-tasks, session-handoff.

Still affected (need follow-up PRs):

• token-audit.ts
• enrich-agent-task.ts
• clarify-intent.ts
• audit-workspace.ts
• verify-completion.ts

[TerminalGravity]

Status update on the full fix:

✅ Merged/ready:

• fix(what-changed): use array args instead of shell syntax in run() calls #301 — what-changed.ts
• fix: remove shell syntax from run() in checkpoint, sharpen-followup, sequence-tasks, session-handoff (#302) #306 — checkpoint.ts, sharpen-followup.ts, sequence-tasks.ts, session-handoff.ts (CI green, reviewed)
• fix(#302): remove shell syntax from run() calls in 4 more tools #304 — audit-workspace.ts, clarify-intent.ts, enrich-agent-task.ts, token-audit.ts

🧹 Superseded (can close): #300, #303, #305

⚠️ Still needs a look: verify-completion.ts (mentioned in your earlier comment) — is that covered by one of the existing PRs or does it need its own?

Once #301, #304, and #306 all land, this issue should be fully resolved.