fix(mcp): shell-quote doctor next commands

[JSONbored]

Motivation

• The doctor checklist emitted copy-pastable shell commands using untrusted login and repoFullName values which could contain shell metacharacters and enable command-substitution when pasted into a shell.

Description

• Add a shellArg helper and use it in doctorNextCommand to quote dynamic values in generated commands (profile, --login, and --repo) in packages/gittensory-mcp/bin/gittensory-mcp.js to prevent shell injection.
• Update the login and preflight recommendation strings to call shellArg so safe plain tokens remain unquoted while unsafe values are single-quoted with internal single-quotes escaped.
• Add a regression test shell-quotes doctor next command values derived from local repo metadata to test/unit/mcp-cli.test.ts that sets a crafted remote containing command-substitution and asserts both JSON and human doctor output include the quoted repo argument.

Testing

• Ran npm test -- test/unit/mcp-cli.test.ts and all tests passed (Tests 44 passed).
• Ran npm run build:mcp which completed successfully (type-check step passed).
• Verified git diff --check/lint-style check showed no issues.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	6f581a9	Commit Preview URL Branch Preview URL	Jun 06 2026, 07:58 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#439 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.