From 0a5356b607351c549757cc6e192940c7f978f611 Mon Sep 17 00:00:00 2001
From: RitualDev <developer@ritualdev.in>
Date: Fri, 2 Oct 2026 17:05:24 +0530
Subject: [PATCH] Potential fix for code scanning alert no. 10: Uncontrolled
 command line

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 bin/cli.js | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/bin/cli.js b/bin/cli.js
index f4d43253..e40105b7 100644
--- a/bin/cli.js
+++ b/bin/cli.js
@@ -13,7 +13,7 @@
  *   npx devshelf open <name>         # Open resource URL in default browser
  */
 
-import { exec } from "node:child_process";
+import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
@@ -44,13 +44,24 @@ const c = {
 // Open URL cross-platform
 function openUrl(url) {
   if (!url) return;
-  const cmd =
-    process.platform === "win32"
-      ? `start "" "${url}"`
-      : process.platform === "darwin"
-        ? `open "${url}"`
-        : `xdg-open "${url}"`;
-  exec(cmd);
+
+  if (process.platform === "win32") {
+    const child = spawn(process.env.comspec || "cmd.exe", ["/c", "start", "", url], {
+      detached: true,
+      stdio: "ignore",
+      shell: false,
+    });
+    child.unref();
+    return;
+  }
+
+  const opener = process.platform === "darwin" ? "open" : "xdg-open";
+  const child = spawn(opener, [url], {
+    detached: true,
+    stdio: "ignore",
+    shell: false,
+  });
+  child.unref();
 }
 
 // Load resources from local file or fetch remotely