fix: edit chromium args

skills/news-harvester/scripts/ensure-chromium.js

@@ -118,11 +118,15 @@ function macCandidates() {
 
 function linuxCandidates() {
   // `command -v` resolves PATH-based binaries; fall back to common fixed paths.
+  // We invoke `sh -c 'command -v "$1"' sh <name>` rather than `execFileSync('command',
+  // [...], { shell: true })` because passing args together with shell:true triggers
+  // Node's DEP0190 deprecation (and is unsafe if `name` were ever user input). Here
+  // the name is passed positionally as $1, so it is never re-interpreted by the shell.
   const names = ['chromium', 'chromium-browser', 'google-chrome', 'google-chrome-stable', 'brave-browser'];
   const found = [];
   for (const n of names) {
     try {
-      const p = execFileSync('command', ['-v', n], { stdio: ['ignore', 'pipe', 'ignore'], shell: true })
+      const p = execFileSync('sh', ['-c', 'command -v "$1"', 'sh', n], { stdio: ['ignore', 'pipe', 'ignore'] })
         .toString().trim();
       if (p) found.push({ name: n, path: p });
     } catch (e) { /* not on PATH */ }

skills/news-source-analyzer/scripts/ensure-chromium.js

@@ -118,11 +118,15 @@ function macCandidates() {
 
 function linuxCandidates() {
   // `command -v` resolves PATH-based binaries; fall back to common fixed paths.
+  // We invoke `sh -c 'command -v "$1"' sh <name>` rather than `execFileSync('command',
+  // [...], { shell: true })` because passing args together with shell:true triggers
+  // Node's DEP0190 deprecation (and is unsafe if `name` were ever user input). Here
+  // the name is passed positionally as $1, so it is never re-interpreted by the shell.
   const names = ['chromium', 'chromium-browser', 'google-chrome', 'google-chrome-stable', 'brave-browser'];
   const found = [];
   for (const n of names) {
     try {
-      const p = execFileSync('command', ['-v', n], { stdio: ['ignore', 'pipe', 'ignore'], shell: true })
+      const p = execFileSync('sh', ['-c', 'command -v "$1"', 'sh', n], { stdio: ['ignore', 'pipe', 'ignore'] })
         .toString().trim();
       if (p) found.push({ name: n, path: p });
     } catch (e) { /* not on PATH */ }