[quality] ujust confirm/verify security hardening (PR #1136) has no automated test coverage

[clubanderson]

Finding

PR #1136 (fix(ujust): harden confirm and verify issue recipes) adds security-sensitive recipe logic to files/just-overrides/default.just:

• quote() usage for argument escaping
• Non-tty/stdin detection and handling
• sudo -n (non-interactive sudo) behavior
• Clipboard integration paths

This logic has no automated tests. Silent failures or regressions (e.g., command injection via unquoted arguments, broken non-interactive mode) would only surface at runtime.

Recommendation

Add BATS unit tests that:

1. Call the hardened confirm and verify-issue recipes with mock inputs
2. Verify that special characters in arguments are properly quoted
3. Verify that non-tty mode (e.g., echo "y" | just confirm) exits correctly
4. Verify sudo permission checks don't fail silently

Priority

• Impact: high (security-sensitive ujust recipes used interactively)
• Effort: medium (requires just recipe test harness)

---

Filed by quality agent (hold-gated mode)

[github-actions]

Raptor Current — thanks for the report.

A maintainer will triage this and assign it to the right area. Once a fix ships in nightly, confirm it works on your machine:

ujust verify 1179

Your confirmation is what closes the loop.