Work-in-progress snapshot preserved for the dedicated #2026 PR. NOT for merge
as-is: the migration is incomplete (injected-executor ...WithAdb helpers,
packages/platform-* host ports, and ~30 test files still assert the legacy
['shell', ...] shape), and a partially enforced seam is exactly what #2026
must avoid landing.
Mechanism (complete, green in isolation):
- packages/kernel/src/shell-safe.ts: branded ShellSafe plus sh.lit/lits/arg/num/raw,
byte-identical to raw argv for safe-charset input (parity test).
- runAndroidShell/runAndroidExecOut, runHarmonyShell, runLimrunAndroidShell
funnels; a raw shell/exec-out argv is rejected at the adb executor, hdc, and
limrun boundaries (catches variable-built argv, which a static gate cannot).
- src/platforms/android/__tests__/device-shell-boundary.test.ts: planted-red
tests for raw and indirect/variable-built argv, plus a ts-expect-error proving
raw strings do not typecheck.
- scripts/shell-safe: AST backstop holding sh.raw and ShellSafe casts to sites
carrying a shell-safe-approved comment with a reason.
Migrated so far: android input-actions/perf*/settings/screenshot/notifications/
permission-grant-state/app-deployment-resolution, all harmonyos, limrun,
daemon/android-system-dialog, platform-runtime-runtime-hints.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wb8EuoySL26UsdtCtRj5X8
Claude
0d4e58914e