fix(security): harden and refactor system.run command resolution

src/infra/system-run-command.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "vitest";
 import {
   extractShellCommandFromArgv,
   formatExecCommand,
+  resolveSystemRunCommand,
   validateSystemRunCommandConsistency,
 } from "./system-run-command.js";
 
@@ -18,6 +19,12 @@ describe("system run command helpers", () => {
     expect(extractShellCommandFromArgv(["cmd.exe", "/d", "/s", "/c", "echo hi"])).toBe("echo hi");
   });
 
+  test("extractShellCommandFromArgv includes trailing cmd.exe args after /c", () => {
+    expect(extractShellCommandFromArgv(["cmd.exe", "/d", "/s", "/c", "echo", "SAFE&&whoami"])).toBe(
+      "echo SAFE&&whoami",
+    );
+  });
+
   test("validateSystemRunCommandConsistency accepts rawCommand matching direct argv", () => {
     const res = validateSystemRunCommandConsistency({
       argv: ["echo", "hi"],
@@ -51,4 +58,41 @@ describe("system run command helpers", () => {
     });
     expect(res.ok).toBe(true);
   });
+
+  test("validateSystemRunCommandConsistency rejects cmd.exe /c trailing-arg smuggling", () => {
+    const res = validateSystemRunCommandConsistency({
+      argv: ["cmd.exe", "/d", "/s", "/c", "echo", "SAFE&&whoami"],
+      rawCommand: "echo",
+    });
+    expect(res.ok).toBe(false);
+    if (res.ok) {
+      throw new Error("unreachable");
+    }
+    expect(res.message).toContain("rawCommand does not match command");
+    expect(res.details?.code).toBe("RAW_COMMAND_MISMATCH");
+  });
+
+  test("resolveSystemRunCommand requires command when rawCommand is present", () => {
+    const res = resolveSystemRunCommand({ rawCommand: "echo hi" });
+    expect(res.ok).toBe(false);
+    if (res.ok) {
+      throw new Error("unreachable");
+    }
+    expect(res.message).toContain("rawCommand requires params.command");
+    expect(res.details?.code).toBe("MISSING_COMMAND");
+  });
+
+  test("resolveSystemRunCommand returns normalized argv and cmdText", () => {
+    const res = resolveSystemRunCommand({
+      command: ["cmd.exe", "/d", "/s", "/c", "echo", "SAFE&&whoami"],
+      rawCommand: "echo SAFE&&whoami",
+    });
+    expect(res.ok).toBe(true);
+    if (!res.ok) {
+      throw new Error("unreachable");
+    }
+    expect(res.argv).toEqual(["cmd.exe", "/d", "/s", "/c", "echo", "SAFE&&whoami"]);
+    expect(res.shellCommand).toBe("echo SAFE&&whoami");
+    expect(res.cmdText).toBe("echo SAFE&&whoami");
+  });
 });