🛡️ Sentinel: [CRITICAL] Fix command injection in LLMEnricher

Author: sl4m3

src/ledgermind/core/reasoning/llm_enrichment.py

@@ -288,14 +288,15 @@ def _call_cli_model(self, prompt: str) -> Optional[str]:
             with open(prompt_file, "w", encoding="utf-8") as f:
                 f.write(prompt)
 
-            if self.client_name == "gemini":
-                # Using shell redirect for 100% reliable capture
-                cmd = f"gemini --model {self.model_name or 'gemini-2.5-flash-lite'} --prompt \"$(cat {prompt_file})\" > {response_file} 2>/dev/null"
-                subprocess.run(cmd, shell=True, check=True, timeout=120) # nosec B602
-                
-            elif self.client_name == "claude":
-                cmd = f"claude \"$(cat {prompt_file})\" > {response_file} 2>/dev/null"
-                subprocess.run(cmd, shell=True, check=True, timeout=120) # nosec B602
+            with open(response_file, "w", encoding="utf-8") as f_out:
+                with open(os.devnull, "w") as f_err:
+                    if self.client_name == "gemini":
+                        cmd = ["gemini", "--model", str(self.model_name or "gemini-2.5-flash-lite"), "--prompt", prompt]
+                        subprocess.run(cmd, stdout=f_out, stderr=f_err, check=True, timeout=120) # nosec B603
+
+                    elif self.client_name == "claude":
+                        cmd = ["claude", prompt]
+                        subprocess.run(cmd, stdout=f_out, stderr=f_err, check=True, timeout=120) # nosec B603
 
             # Read response from buffer
             if os.path.exists(response_file):

tests/core/reasoning/test_llm_enrichment_full.py

@@ -66,13 +66,11 @@ def test_rich_mode_prefers_gemini_cli(mock_run, sample_proposal):
 
     # Mock successful gemini run with file-writing side effect
     def side_effect(cmd, **kwargs):
-        # Extract response file path from cmd string
-        import re
-        match = re.search(r'> (/[^ ]+)', cmd)
-        if match:
-            res_path = match.group(1)
-            with open(res_path, "w", encoding="utf-8") as f:
-                f.write("<goal>CLI Goal</goal><rationale>Human Gemini Text</rationale><compressive>CLI Comp</compressive>")
+        # The file is passed via kwargs["stdout"] when using the subprocess.run without shell=True
+        stdout_file = kwargs.get("stdout")
+        if stdout_file and hasattr(stdout_file, "write"):
+            stdout_file.write("<goal>CLI Goal</goal><rationale>Human Gemini Text</rationale><compressive>CLI Comp</compressive>")
+            stdout_file.flush()
         return MagicMock(returncode=0)
 
     mock_run.side_effect = side_effect