Several tools pass shell syntax to run() which uses execFileSync

[TerminalGravity]

Bug

run() in src/lib/git.ts uses execFileSync (no shell). Several tools pass strings with shell operators (||, &&, 2>/dev/null, |) that get split on whitespace and passed as literal git arguments, silently failing.

Fixed in #88: what-changed.ts, checkpoint.ts

Still affected:

• token-audit.ts — uses wc -l < ..., tail -c via run()
• verify-completion.ts — uses npx tsc --noEmit 2>&1 | tail via run()
• enrich-agent-task.ts — uses git ls-files | head | grep via run()
• scope-work.ts — uses git ls-files | head | grep via run()
• session-handoff.ts — uses command -v via run()

These need to either:

1. Use array args with proper fallback logic (like getDiffFiles)
2. Use a separate execSync with shell: true for non-git commands
3. Use Node APIs directly (e.g. fs.statSync instead of wc)

[TerminalGravity]

Good catch documenting all the affected tools. #88 handles what-changed and checkpoint — reviewed and it looks clean.

For the remaining ones, here's how I'd approach each:

Use Node APIs directly (best):

• token-audit.ts — wc -l → fs.readFileSync().split('\n').length, tail -c → Buffer.byteLength
• session-handoff.ts — command -v → which package or try/catch execFileSync

Use array args + JS logic:

• enrich-agent-task.ts / scope-work.ts — git ls-files as array args, then .split('\n').slice(0, N) and .filter() in JS instead of piping to head and grep

Use execSync with shell: true (last resort):

• verify-completion.ts — npx tsc --noEmit 2>&1 | tail is genuinely a shell pipeline; either use execSync with shell: true or split into two steps

I can take the follow-up PR if needed.