refactor: replace fs with secureFs for improved file handling

This commit updates various modules to utilize the secure file system operations from the secureFs module instead of the native fs module. Key changes include:

- Replaced fs imports with secureFs in multiple route handlers and services to enhance security and consistency in file operations.
- Added centralized validation for working directories in the sdk-options module to ensure all AI model invocations are secure.

These changes aim to improve the security and maintainability of file handling across the application.

apps/server/src/routes/worktree/common.ts

@@ -2,18 +2,14 @@
  * Common utilities for worktree routes
  */
 
-import { createLogger } from "@automaker/utils";
-import { exec } from "child_process";
-import { promisify } from "util";
-import path from "path";
-import fs from "fs/promises";
-import {
-  getErrorMessage as getErrorMessageShared,
-  createLogError,
-} from "../common.js";
-import { FeatureLoader } from "../../services/feature-loader.js";
+import { createLogger } from '@automaker/utils';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import path from 'path';
+import { getErrorMessage as getErrorMessageShared, createLogError } from '../common.js';
+import { FeatureLoader } from '../../services/feature-loader.js';
 
-const logger = createLogger("Worktree");
+const logger = createLogger('Worktree');
 export const execAsync = promisify(exec);
 const featureLoader = new FeatureLoader();
 
@@ -28,10 +24,10 @@ export const MAX_BRANCH_NAME_LENGTH = 250;
 // Extended PATH configuration for Electron apps
 // ============================================================================
 
-const pathSeparator = process.platform === "win32" ? ";" : ":";
+const pathSeparator = process.platform === 'win32' ? ';' : ':';
 const additionalPaths: string[] = [];
 
-if (process.platform === "win32") {
+if (process.platform === 'win32') {
   // Windows paths
   if (process.env.LOCALAPPDATA) {
     additionalPaths.push(`${process.env.LOCALAPPDATA}\\Programs\\Git\\cmd`);
@@ -39,23 +35,22 @@ if (process.platform === "win32") {
   if (process.env.PROGRAMFILES) {
     additionalPaths.push(`${process.env.PROGRAMFILES}\\Git\\cmd`);
   }
-  if (process.env["ProgramFiles(x86)"]) {
-    additionalPaths.push(`${process.env["ProgramFiles(x86)"]}\\Git\\cmd`);
+  if (process.env['ProgramFiles(x86)']) {
+    additionalPaths.push(`${process.env['ProgramFiles(x86)']}\\Git\\cmd`);
   }
 } else {
   // Unix/Mac paths
   additionalPaths.push(
-    "/opt/homebrew/bin",        // Homebrew on Apple Silicon
-    "/usr/local/bin",           // Homebrew on Intel Mac, common Linux location
-    "/home/linuxbrew/.linuxbrew/bin", // Linuxbrew
-    `${process.env.HOME}/.local/bin`, // pipx, other user installs
+    '/opt/homebrew/bin', // Homebrew on Apple Silicon
+    '/usr/local/bin', // Homebrew on Intel Mac, common Linux location
+    '/home/linuxbrew/.linuxbrew/bin', // Linuxbrew
+    `${process.env.HOME}/.local/bin` // pipx, other user installs
   );
 }
 
-const extendedPath = [
-  process.env.PATH,
-  ...additionalPaths.filter(Boolean),
-].filter(Boolean).join(pathSeparator);
+const extendedPath = [process.env.PATH, ...additionalPaths.filter(Boolean)]
+  .filter(Boolean)
+  .join(pathSeparator);
 
 /**
  * Environment variables with extended PATH for executing shell commands.
@@ -85,9 +80,7 @@ export function isValidBranchName(name: string): boolean {
  */
 export async function isGhCliAvailable(): Promise<boolean> {
   try {
-    const checkCommand = process.platform === "win32"
-      ? "where gh"
-      : "command -v gh";
+    const checkCommand = process.platform === 'win32' ? 'where gh' : 'command -v gh';
     await execAsync(checkCommand, { env: execEnv });
     return true;
   } catch {
@@ -95,8 +88,7 @@ export async function isGhCliAvailable(): Promise<boolean> {
   }
 }
 
-export const AUTOMAKER_INITIAL_COMMIT_MESSAGE =
-  "chore: automaker initial commit";
+export const AUTOMAKER_INITIAL_COMMIT_MESSAGE = 'chore: automaker initial commit';
 
 /**
  * Normalize path separators to forward slashes for cross-platform consistency.
@@ -104,7 +96,7 @@ export const AUTOMAKER_INITIAL_COMMIT_MESSAGE =
  * from git commands (which may use forward slashes).
  */
 export function normalizePath(p: string): string {
-  return p.replace(/\\/g, "/");
+  return p.replace(/\\/g, '/');
 }
 
 /**
@@ -112,7 +104,7 @@ export function normalizePath(p: string): string {
  */
 export async function isGitRepo(repoPath: string): Promise<boolean> {
   try {
-    await execAsync("git rev-parse --is-inside-work-tree", { cwd: repoPath });
+    await execAsync('git rev-parse --is-inside-work-tree', { cwd: repoPath });
     return true;
   } catch {
     return false;
@@ -124,30 +116,21 @@ export async function isGitRepo(repoPath: string): Promise<boolean> {
  * These are expected in test environments with mock paths
  */
 export function isENOENT(error: unknown): boolean {
-  return (
-    error !== null &&
-    typeof error === "object" &&
-    "code" in error &&
-    error.code === "ENOENT"
-  );
+  return error !== null && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
 }
 
 /**
  * Check if a path is a mock/test path that doesn't exist
  */
 export function isMockPath(worktreePath: string): boolean {
-  return worktreePath.startsWith("/mock/") || worktreePath.includes("/mock/");
+  return worktreePath.startsWith('/mock/') || worktreePath.includes('/mock/');
 }
 
 /**
  * Conditionally log worktree errors - suppress ENOENT for mock paths
  * to reduce noise in test output
  */
-export function logWorktreeError(
-  error: unknown,
-  message: string,
-  worktreePath?: string
-): void {
+export function logWorktreeError(error: unknown, message: string, worktreePath?: string): void {
   // Don't log ENOENT errors for mock paths (expected in tests)
   if (isENOENT(error) && worktreePath && isMockPath(worktreePath)) {
     return;
@@ -165,17 +148,14 @@ export const logError = createLogError(logger);
  */
 export async function ensureInitialCommit(repoPath: string): Promise<boolean> {
   try {
-    await execAsync("git rev-parse --verify HEAD", { cwd: repoPath });
+    await execAsync('git rev-parse --verify HEAD', { cwd: repoPath });
     return false;
   } catch {
     try {
-      await execAsync(
-        `git commit --allow-empty -m "${AUTOMAKER_INITIAL_COMMIT_MESSAGE}"`,
-        { cwd: repoPath }
-      );
-      logger.info(
-        `[Worktree] Created initial empty commit to enable worktrees in ${repoPath}`
-      );
+      await execAsync(`git commit --allow-empty -m "${AUTOMAKER_INITIAL_COMMIT_MESSAGE}"`, {
+        cwd: repoPath,
+      });
+      logger.info(`[Worktree] Created initial empty commit to enable worktrees in ${repoPath}`);
       return true;
     } catch (error) {
       const reason = getErrorMessageShared(error);