Copilot instructions

1---
2applyTo: "src/utils/**/*.ts"
3---
4 
5# Security Review Guidelines — Core Utilities
6 
7## Command Injection Prevention (resume.ts)
8 
9- External processes must be spawned with `spawn()` and arguments as an **array** — NEVER `exec()` with string interpolation
10- Session IDs and file paths from parsed sessions are user-controlled and may contain shell metacharacters (`;`, `|`, `&`, `$`, backticks) — they must always be array elements, never embedded in a shell string
11 
12```typescript
13// Avoid — command injection if sessionId contains ; or | or $()
14exec(`claude --resume ${sessionId}`);
15 
16// Prefer — safe regardless of sessionId content
17spawn('claude', ['--resume', sessionId], { stdio: 'inherit' });
18```
19 
20## Forward Flag Security (forward-flags.ts)
21 
22- `--dangerously-skip-permissions` (Claude) and `--dangerously-bypass-approvals-and-sandbox` (Codex) must ONLY be set when the source session **explicitly** requested auto-approve behavior
23- Flag precedence is security-critical: auto-approve > full-auto > sandbox > ask-for-approval — deviations from this order could grant unintended permissions in the target tool
24- Never map a "plan mode" flag or any scheduling flag to auto-approve behavior
25 
26## Handoff Output Safety (markdown.ts)
27 
28- Do NOT embed secrets, API keys, tokens, or environment variable values in handoff markdown output
29- Tool activity summaries (shell command output, file diffs) may contain sensitive data — the verbosity config caps limit exposure; do not bypass these caps
30- Home directory paths in handoff output must be tildified (`~/`) using `safePath()` — never expose the full absolute home path
31 
32## General
33 
34- No hardcoded credentials, API keys, or tokens anywhere in source files
35- User-supplied paths (session file paths, `cwd` values) must not be passed to shell execution without sanitization — use `spawn()` with array args only
36