fix: replace shell exec with execFile in cleanupFiles

cleanupFiles used the shell-based exec() helper for rm/mkdir/cp commands
that don't require shell features. Switched all calls to execFile() with
explicit args arrays, eliminating unnecessary shell parsing and aligning
with the repo convention that exec() is reserved for shell-only features.

Author: fernandomg

architecture.md

@@ -85,7 +85,7 @@ Plain async functions with no UI dependencies. Each operation receives explicit
 | `cloneRepo(projectName)` | Shallow clone, checkout latest tag, rm .git, git init. Uses `execFile` (no shell) for all commands except `git checkout $(...)` which needs shell substitution. |
 | `createEnvFile(projectFolder)` | Copy .env.example to .env.local |
 | `installPackages(projectFolder, mode, features)` | Full: `pnpm i`. Custom: `pnpm remove` deselected packages + postinstall. Uses `execFile` exclusively (no shell). |
-| `cleanupFiles(projectFolder, mode, features)` | Remove files/folders for deselected features, patch package.json scripts, remove .install-files |
+| `cleanupFiles(projectFolder, mode, features)` | Remove files/folders for deselected features, patch package.json scripts, remove .install-files. Uses `execFile` exclusively (no shell). |
 
 ### Shell Execution (`source/operations/exec.ts`)
 

source/__tests__/operations/cleanupFiles.test.ts

@@ -24,12 +24,14 @@ vi.mock('node:fs', () => ({
   writeFileSync: vi.fn(),
 }))
 
-const { exec } = await import('../../operations/exec.js')
+const { execFile } = await import('../../operations/exec.js')
 const { readFileSync, writeFileSync } = await import('node:fs')
 const { cleanupFiles } = await import('../../operations/cleanupFiles.js')
 
-function getExecCommands(): string[] {
-  return vi.mocked(exec).mock.calls.map((call) => call[0] as string)
+function getExecFileCommands(): string[] {
+  return vi
+    .mocked(execFile)
+    .mock.calls.map((call) => `${call[0]} ${(call[1] as string[]).join(' ')}`)
 }
 
 function getWrittenPackageJson(): Record<string, unknown> {
@@ -63,7 +65,7 @@ describe('cleanupFiles', () => {
     it('only removes .install-files', async () => {
       await cleanupFiles('/project/my_app', 'full')
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toHaveLength(1)
       expect(commands[0]).toBe('rm -rf .install-files')
     })
@@ -80,7 +82,7 @@ describe('cleanupFiles', () => {
       const allFeatures: FeatureName[] = ['demo', 'subgraph', 'typedoc', 'vocs', 'husky']
       await cleanupFiles('/project/my_app', 'custom', allFeatures)
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toEqual(['rm -rf .install-files'])
       expect(writeFileSync).toHaveBeenCalled()
     })
@@ -102,7 +104,7 @@ describe('cleanupFiles', () => {
     it('removes home folder, recreates it, copies replacement', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['subgraph', 'typedoc', 'vocs', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm -rf src/components/pageComponents/home')
       expect(commands).toContain('mkdir -p src/components/pageComponents/home')
       expect(commands).toContain(
@@ -115,14 +117,14 @@ describe('cleanupFiles', () => {
     it('removes src/subgraphs', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['demo', 'typedoc', 'vocs', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm -rf src/subgraphs')
     })
 
     it('cleans up subgraph demos when demo IS selected', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['demo', 'typedoc', 'vocs', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       const homeFolder = 'src/components/pageComponents/home'
       expect(commands).toContain(`rm -rf ${homeFolder}/Examples/demos/subgraphs`)
       expect(commands).toContain(`rm ${homeFolder}/Examples/index.tsx`)
@@ -134,7 +136,7 @@ describe('cleanupFiles', () => {
     it('does NOT clean up subgraph demos when demo is also deselected', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['typedoc', 'vocs', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       const demoCleanupCommands = commands.filter((cmd) => cmd.includes('Examples/demos/subgraphs'))
       expect(demoCleanupCommands).toHaveLength(0)
     })
@@ -152,7 +154,7 @@ describe('cleanupFiles', () => {
     it('removes typedoc.json', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['demo', 'subgraph', 'vocs', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm typedoc.json')
     })
 
@@ -169,7 +171,7 @@ describe('cleanupFiles', () => {
     it('removes vocs.config.ts and docs folder', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['demo', 'subgraph', 'typedoc', 'husky'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm vocs.config.ts')
       expect(commands).toContain('rm -rf docs')
     })
@@ -189,7 +191,7 @@ describe('cleanupFiles', () => {
     it('removes husky folder and config files', async () => {
       await cleanupFiles('/project/my_app', 'custom', ['demo', 'subgraph', 'typedoc', 'vocs'])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm -rf .husky')
       expect(commands).toContain('rm .lintstagedrc.mjs')
       expect(commands).toContain('rm commitlint.config.js')
@@ -208,7 +210,7 @@ describe('cleanupFiles', () => {
     it('runs all cleanup operations', async () => {
       await cleanupFiles('/project/my_app', 'custom', [])
 
-      const commands = getExecCommands()
+      const commands = getExecFileCommands()
       expect(commands).toContain('rm -rf src/components/pageComponents/home')
       expect(commands).toContain('rm -rf src/subgraphs')
       expect(commands).toContain('rm typedoc.json')
@@ -237,7 +239,7 @@ describe('cleanupFiles', () => {
   it('always removes .install-files as the last step', async () => {
     await cleanupFiles('/project/my_app', 'custom', ['demo'])
 
-    const commands = getExecCommands()
+    const commands = getExecFileCommands()
     expect(commands.at(-1)).toBe('rm -rf .install-files')
   })
 })

source/operations/cleanupFiles.ts

@@ -3,7 +3,7 @@ import { resolve } from 'node:path'
 import type { FeatureName } from '../constants/config.js'
 import type { InstallationType } from '../types/types.js'
 import { isFeatureSelected } from '../utils/utils.js'
-import { exec } from './exec.js'
+import { execFile } from './exec.js'
 
 function patchPackageJson(projectFolder: string, features: FeatureName[]): void {
   const packageJsonPath = resolve(projectFolder, 'package.json')
@@ -31,40 +31,44 @@ function patchPackageJson(projectFolder: string, features: FeatureName[]): void
 }
 
 async function cleanupDemo(projectFolder: string): Promise<void> {
-  await exec('rm -rf src/components/pageComponents/home', { cwd: projectFolder })
-  await exec('mkdir -p src/components/pageComponents/home', { cwd: projectFolder })
-  await exec('cp .install-files/home/index.tsx src/components/pageComponents/home/', {
+  await execFile('rm', ['-rf', 'src/components/pageComponents/home'], { cwd: projectFolder })
+  await execFile('mkdir', ['-p', 'src/components/pageComponents/home'], { cwd: projectFolder })
+  await execFile('cp', ['.install-files/home/index.tsx', 'src/components/pageComponents/home/'], {
     cwd: projectFolder,
   })
 }
 
 async function cleanupSubgraph(projectFolder: string, features: FeatureName[]): Promise<void> {
-  await exec('rm -rf src/subgraphs', { cwd: projectFolder })
+  await execFile('rm', ['-rf', 'src/subgraphs'], { cwd: projectFolder })
 
   if (isFeatureSelected('demo', features)) {
     const homeFolder = 'src/components/pageComponents/home'
 
-    await exec(`rm -rf ${homeFolder}/Examples/demos/subgraphs`, { cwd: projectFolder })
-    await exec(`rm ${homeFolder}/Examples/index.tsx`, { cwd: projectFolder })
-    await exec(`cp .install-files/home/Examples/index.tsx ${homeFolder}/Examples/index.tsx`, {
+    await execFile('rm', ['-rf', `${homeFolder}/Examples/demos/subgraphs`], {
       cwd: projectFolder,
     })
+    await execFile('rm', [`${homeFolder}/Examples/index.tsx`], { cwd: projectFolder })
+    await execFile(
+      'cp',
+      ['.install-files/home/Examples/index.tsx', `${homeFolder}/Examples/index.tsx`],
+      { cwd: projectFolder },
+    )
   }
 }
 
 async function cleanupTypedoc(projectFolder: string): Promise<void> {
-  await exec('rm typedoc.json', { cwd: projectFolder })
+  await execFile('rm', ['typedoc.json'], { cwd: projectFolder })
 }
 
 async function cleanupVocs(projectFolder: string): Promise<void> {
-  await exec('rm vocs.config.ts', { cwd: projectFolder })
-  await exec('rm -rf docs', { cwd: projectFolder })
+  await execFile('rm', ['vocs.config.ts'], { cwd: projectFolder })
+  await execFile('rm', ['-rf', 'docs'], { cwd: projectFolder })
 }
 
 async function cleanupHusky(projectFolder: string): Promise<void> {
-  await exec('rm -rf .husky', { cwd: projectFolder })
-  await exec('rm .lintstagedrc.mjs', { cwd: projectFolder })
-  await exec('rm commitlint.config.js', { cwd: projectFolder })
+  await execFile('rm', ['-rf', '.husky'], { cwd: projectFolder })
+  await execFile('rm', ['.lintstagedrc.mjs'], { cwd: projectFolder })
+  await execFile('rm', ['commitlint.config.js'], { cwd: projectFolder })
 }
 
 export async function cleanupFiles(
@@ -96,5 +100,5 @@ export async function cleanupFiles(
     patchPackageJson(projectFolder, features)
   }
 
-  await exec('rm -rf .install-files', { cwd: projectFolder })
+  await execFile('rm', ['-rf', '.install-files'], { cwd: projectFolder })
 }