Function escapeShellArg

src/security/sanitize.js:176–188

* Escape a string for safe inclusion as a single shell argument. * Cross-platform: uses POSIX single-quoting on Linux/macOS, and CMD-style * double-quote-with-escape on Windows. * * For Windows we double internal double-quotes and reject embedded NULs. * Use this in preference to manual `"${val

(value)

 * a tool result, user input, or model output is going into a shell command.
 */
function escapeShellArg(value) {
  const s = String(value == null ? '' : value);
  if (s.indexOf('\u0000') !== -1) {
    throw new Error('shell argument contains NUL byte');
  }
  if (process.platform === 'win32') {
    // CMD: wrap in double quotes, escape internal double quotes by doubling.
    // Reject backticks/dollar-paren — they're CMD metachars in some contexts.
    return `"${s.replace(/"/g, '""')}"`;
  }
  // POSIX: single-quote and escape any embedded single quote with '\''
  return `'${s.replace(/'/g, `'\\''`)}'`;
}

/**
 * Build a shell command from a base + already-trusted prefix and an array