Widespread shell syntax in run() calls after execFileSync migration

[TerminalGravity]

Problem

run() in src/lib/git.ts uses execFileSync (no shell), but many tool files still pass shell syntax that silently breaks:

• Shell operators: ||, &&, |
• Redirects: 2>/dev/null, 2>&1
• Prefixing git in strings (becomes a literal arg since execFileSync('git', ['git', ...]))
• Shell quoting/escaping

Affected files

PR #109 fixes 3 files. These still need fixing:

• verify-completion.ts — cat, tsc --noEmit 2>&1 | tail, npm run build 2>&1 | tail
• token-audit.ts — wc -l, wc -c, tail -c, 2>/dev/null
• clarify-intent.ts — tsc --noEmit 2>&1 | grep, find ... | head
• session-handoff.ts — command -v, gh pr list ... || echo
• audit-workspace.ts — find ... | wc -l, 2>/dev/null
• enrich-agent-task.ts — git ls-files | grep, head -30
• scope-work.ts — git ls-files | head | grep
• sequence-tasks.ts — git ls-files | head

Options

1. Fix each caller to use array args + JS logic (like PR fix: shell syntax bugs in what-changed, checkpoint, session-health #109)
2. Add a shell() helper that uses execSync for commands that genuinely need shell features
3. Both — array args where simple, shell() for complex piping

Option 3 is probably best. Some commands (find | grep | head) are genuinely easier with shell.

[TerminalGravity]

PR #113 covers all the files listed here with a clean three-tier approach: array args for simple git commands, shell() for genuine pipe/redirect needs, and exec() for non-git binaries. Once that lands, the older fix PRs (#109, #111, #112, #101, #100) can be closed.

One thing to watch: the shell() helper defaults to a 10s timeout which might be tight for type-checking larger projects. Easy fix if it comes up.

[TerminalGravity]

Quick status check on the competing fix PRs:

• fix: resolve shell syntax in run() calls across all tools #116 — CI green ✅, 231 additions. Takes the array-args-everywhere approach.
• fix: resolve remaining shell syntax in run() calls (closes #110) #119 — 352 additions, no CI yet. Covers all 8 files from the issue.
• fix: replace shell syntax in run() calls with shell() helper #120 — 374 additions, no CI yet. Covers the remaining 4 files (assumes fix: shell syntax bugs in what-changed, checkpoint, session-health #109's 3 are handled). Cleanest implementation of the three.

Recommendation: merge #120 (once CI passes) since it builds on #109's approach and the JS replacements are solid. Then close #116 and #119 as superseded. The Option 3 approach (array args where simple, shell helper for complex piping) is the right call — some of those find | grep | head chains really are easier with shell.