From f9d93285e0fd8a8565d53f6dd8e578f2bae5021e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 03:16:34 +0000
Subject: [PATCH] fix: suppress gosec G204 warning for trusted local config
 commands

Addresses a Gosec G204 (Command Injection) warning where provider command strings were passed directly into `sh -c` and `cmd /C`. Since these commands originate from the user's trusted local config and explicitly require shell features (like pipes and variable expansions) to function, removing the shell invocation introduces a breaking change. This adds a documented `#nosec` annotation to suppress the false positive instead of degrading functionality.

Co-authored-by: euxaristia <25621994+euxaristia@users.noreply.github.com>
---
 internal/config/command.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/internal/config/command.go b/internal/config/command.go
index ba4094ee1..f3bf34c29 100644
--- a/internal/config/command.go
+++ b/internal/config/command.go
@@ -76,8 +76,10 @@ func shellCommand(command string) *exec.Cmd {
 		if strings.HasPrefix(strings.TrimSpace(command), `"`) {
 			command = "call " + command
 		}
+		/* #nosec G204 -- Provider commands are intentionally evaluated by a shell to support features like pipes and env expansions. The command string originates from the user's trusted local config. */
 		return exec.Command("cmd", "/C", command)
 	}
+	/* #nosec G204 -- Provider commands are intentionally evaluated by a shell to support features like pipes and env expansions. The command string originates from the user's trusted local config. */
 	return exec.Command("sh", "-c", command)
 }