Refine interpolated command lint detection

[Copilot]

Template-literal command checks flagged static write-once values and digits-only sanitized ports as dynamic. Gateway shell command construction also retained interpolation warnings for argument-based process invocations.

• Template interpolation analysis

  • Resolve write-once initializer chains before classifying interpolations.
  • Allow static resolved values and String(value).replace(/[^0-9]/g, "").

  const safePort = String(port).replace(/[^0-9]/g, "");
  exec.exec(`netstat | grep :${safePort}`, []);

• Gateway process execution

  • Replace interpolated node and bash shell commands with execFileSync executable/argument calls.

• Coverage

  • Add rule cases for static initializer chains and digits-only sanitization while retaining dynamic interpolation reporting.

• Fixes no-child-process-interpolated-command / no-exec-interpolated-command: template-literal check ignores sanitized/static interpolat [Content truncated due to length] #53310

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.29 AIC · ⌖ 7.25 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[gh-aw-bot]

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

• Refresh the branch with the latest base changes.
• Run the skill after the fixes and summarize the outcome.

Run: https://github.com/github/gh-aw/actions/runs/32052943209

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.29 AIC · ⌖ 7.25 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[github-actions]

PR Triage

Category: bug (security lint tooling) · Risk: medium · Score: 58/100 (Impact 28, Urgency 15, Quality 15)

Recommended action: fast_track

Fixes false-positive interpolated-command lint findings (static write-once initializers, digits-only sanitized ports) and replaces interpolated shell invocations in the MCP gateway startup script with execFileSync. Closes #53310. This touches security-relevant lint rules and shell command construction, so it merits careful human review despite being a targeted fix with added rule test cases. Note: the Copilot AI reviewer failed to complete its automated review ("encountered an error") — a human reviewer should look closely at the execFileSync replacement in start_mcp_gateway.cjs.

Generated by 🔧 PR Triage Agent · auto · 45.8 AIC · ⌖ 2.4 AIC · ⊞ 8.1K · ◷

[Copilot]

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:...

Refreshed the branch with fd0c35a. Completed the PR finishing pass: make agent-report-progress, make test, and make recompile pass; the reviewed workflow failure was an external safe-output API failure. CI for this refreshed head still needs a maintainer re-trigger.

[gh-aw-bot]

@copilot thanks for the refresh. This looks ready for maintainer follow-up. Please run the pr-finisher skill one more time, confirm the latest branch state/checks in a short reply, and flag any remaining maintainer-only unblockers.

Run: https://github.com/github/gh-aw/actions/runs/32061066549

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17.6 AIC · ⌖ 7.44 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot thanks for the refresh. This looks ready for maintainer follow-up. Please run the pr-finisher skill one more time, confirm the latest branch state/checks in a short reply, and flag any rema...

PR-finisher pass complete: working tree is clean at 8f626e0, with no unresolved review threads; all 8 jobs in run 32061066549 succeeded, and the PR CI suite on this head is green. Remaining unblockers are maintainer review/merge approval and refreshing from current main (91ba9fd) if branch protection requires it; the active copilot check is this finishing pass.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1