fix(cli): run git without a shell when installing plugins

[gl0bal01]

Problem

quartz/cli/plugin-git-handlers.js builds shell command strings from values that come out of quartz.config.yaml and quartz.lock.json:

await execAsync(`git clone --depth 1${branchArg} "${entry.resolved}" "${pluginDir}"`)
await execAsync(`git checkout ${entry.commit}`, { cwd: pluginDir })
await execAsync(`git reset --hard ${resetTarget}`, { cwd: pluginDir })
await execAsync(`git ls-remote "${row.entry.resolved}" ${lsRemoteRef}`)

The repository URL is double-quoted, but $(...) and backticks still expand inside double quotes, and the ref, commit, and --branch argument are not quoted at all. A crafted entry therefore runs arbitrary commands on whatever machine performs the install — a contributor's laptop, or CI.

Reproduction (on v5, before this change)

Install any plugin, then set a ref in quartz.lock.json:

"spacer": { "ref": "$(touch /tmp/quartz-pwned)", ... }

$ npx quartz plugin install
  → spacer: cloning...
  ✗ spacer: failed to clone
$ ls /tmp/quartz-pwned
/tmp/quartz-pwned

The clone reports failure and the injected command runs anyway, so nothing in the output signals what happened.

I hit this while upgrading a fork to v5; happy to adjust the approach if you'd prefer it shaped differently.

Fix

• every git call goes through execFile with an argv array, so no shell is involved
• values still passed to git are validated: commits must be hex (/^[0-9a-f]{7,40}$/i), refs must look like refnames and may not contain .., and a repository may not begin with -
• clones pass -- before <repository>, so a URL can never be parsed as a flag such as --upload-pack=<cmd>
• npm install <pkg> for npm-sourced plugins gets the same argv treatment

With the patch, the reproduction above fails the clone and creates no file.

Testing

• npm test — 109/109 pass
• npx prettier --check — clean
• exercised against a real repository: plugin add, plugin install, plugin update, plugin check all still clone, build, and report correctly

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
quartz	✅ Ready (View Log)	Visit Preview	2f62ab3