Summary

• `delimit_security_audit` flagged `core/generator_drift.py:104` for `subprocess(shell=True)` — a command injection surface since the `generator_command` input flows from caller workflow files straight to a shell
• Fixed with `shlex.split()` + `shell=False` and explicit shell metacharacter rejection
• Added `tests/test_generator_drift.py` with 17 tests covering injection guards, happy path, error handling, and report formatting

Why this matters

This is the first gate-driven fix in the v1.9.0 re-release. The previous attempt at v1.9.0 was rolled back because the deploy gates (`security_audit`, `test_smoke`, `changelog`, `deploy_plan`) were skipped. Running them properly caught this bug before it shipped.

Test plan

• 17 new tests in `tests/test_generator_drift.py` — all passing
• 88 existing tests still passing (105 total)
• Real agentspec `pnpm run schema:export` still works (8.1s)
• `delimit_security_audit` now clean — 0 findings (was 1 medium)

What changed in generator_drift.py

Before:
```python
result = subprocess.run(
regen_command,
shell=True, # ← command injection surface
...
)
```

After:
```python
argv = shlex.split(regen_command)

Reject shell metacharacters — force script files for chaining

if any(ch in token for token in argv for ch in "&|;><`$"):
return DriftResult(error="generator_command contains shell metacharacters...")
result = subprocess.run(argv, shell=False, ...)
```

Users needing shell features (chaining, env vars, redirection) should point `generator_command` at a script file instead of inline-chaining — documented in the rejection error message.

🤖 Generated with Claude Code