fix: address Copilot review comments

- Use execFileSync with args array in toPosixPath to avoid shell injection
- Add 5s timeout to app dispose to ensure quit even if disposal hangs
- Log warning when SSH /home/ethan resolution fails and falls back to /tmp
- Add random suffix to test markers to prevent collision

Author: ethanndickson

src/desktop/main.ts

@@ -577,14 +577,15 @@ if (gotTheLock) {
     event.preventDefault();
     isDisposing = true;
 
-    services
-      .dispose()
-      .catch((err) => {
-        console.error("Error during ServiceContainer dispose:", err);
-      })
-      .finally(() => {
-        app.quit();
-      });
+    // Race dispose against timeout to ensure app quits even if disposal hangs
+    const disposePromise = services.dispose().catch((err) => {
+      console.error("Error during ServiceContainer dispose:", err);
+    });
+    const timeoutPromise = new Promise<void>((resolve) => setTimeout(resolve, 5000));
+
+    void Promise.race([disposePromise, timeoutPromise]).finally(() => {
+      app.quit();
+    });
   });
 
   app.on("window-all-closed", () => {

src/node/runtime/SSHRuntime.ts

@@ -106,7 +106,15 @@ export class SSHRuntime implements Runtime {
 
     if (dir === "~" || dir.startsWith("~/")) {
       const result = await execBuffered(this, 'echo "$HOME"', { cwd: "/", timeout: 10 });
-      const home = result.exitCode === 0 && result.stdout.trim() ? result.stdout.trim() : "/tmp";
+      let home: string;
+      if (result.exitCode === 0 && result.stdout.trim()) {
+        home = result.stdout.trim();
+      } else {
+        log.warn(
+          `SSHRuntime: Failed to resolve $HOME (exitCode=${result.exitCode}). Falling back to /tmp.`
+        );
+        home = "/tmp";
+      }
       dir = dir === "~" ? home : `${home}/${dir.slice(2)}`;
     }
 

src/node/utils/paths.ts

@@ -1,4 +1,4 @@
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 
 /**
  * Convert a path to POSIX format for Git Bash on Windows.
@@ -11,7 +11,8 @@ export function toPosixPath(windowsPath: string): string {
   if (process.platform !== "win32") return windowsPath;
   try {
     // cygpath converts Windows paths to POSIX format for Git Bash / MSYS2
-    return execSync(`cygpath -u "${windowsPath}"`, { encoding: "utf8" }).trim();
+    // Use execFileSync with args array to avoid shell injection
+    return execFileSync("cygpath", ["-u", windowsPath], { encoding: "utf8" }).trim();
   } catch {
     // Fallback if cygpath unavailable (shouldn't happen with Git Bash)
     return windowsPath;

tests/ipc/backgroundBash.test.ts

@@ -278,7 +278,7 @@ describeIntegration("Background Bash Execution", () => {
 
         try {
           // Start a background process that outputs a unique marker then exits
-          const marker = `BGTEST_${Date.now()}`;
+          const marker = `BGTEST_${Date.now()}_${Math.random().toString(36).slice(2)}`;
           const startEvents = await sendMessageAndWait(
             env,
             workspaceId,