Fix shell injection vulnerability in ShortcutsCommandRunner

[Copilot]

The ShortcutsCommandRunner was vulnerable to shell command injection through unescaped shortcutIdentifier values in shell scripts. A malicious identifier like Shortcut"; rm -rf ~; echo "x" would execute arbitrary commands.

Changes

• Replace shell script execution with direct Process invocation in ShortcutsCommandRunner.run()

  • Pass shortcutIdentifier as a separate argument array instead of interpolating into a shell string
  • Remove dependency on ScriptCommandRunner

• Apply same fix to CommandRunner.reveal() for the shortcuts view command

Before

let source = """
shortcuts run "\(command.shortcutIdentifier)"
"""
let shellScript = ScriptCommand(...)
return try await commandRunner.run(shellScript, ...)

After

let process = Process()
process.executableURL = URL(filePath: "/usr/bin/shortcuts")
process.arguments = ["run", command.shortcutIdentifier]
try process.run()

This prevents shell interpretation of special characters in user-controlled input from configuration files.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

Test: succeeded ✅
https://github.com/zenangst/KeyboardCowboy/actions/runs/20883160741

@Copilot