fix: address PR review security and validation issues

- Add runtime type check for worktreePath in open-in-terminal handler
- Fix Windows Terminal detection using commandExists before spawn
- Fix xterm shell injection by using sh -c with escapeShellArg
- Use loose equality for null/undefined in useEffectiveDefaultTerminal
- Consolidate duplicate imports from open-in-terminal.js

apps/server/src/routes/worktree/index.ts

@@ -29,8 +29,8 @@ import {
   createGetAvailableEditorsHandler,
   createRefreshEditorsHandler,
 } from './routes/open-in-editor.js';
-import { createOpenInTerminalHandler } from './routes/open-in-terminal.js';
 import {
+  createOpenInTerminalHandler,
   createGetAvailableTerminalsHandler,
   createGetDefaultTerminalHandler,
   createRefreshTerminalsHandler,

apps/server/src/routes/worktree/routes/open-in-terminal.ts

@@ -32,10 +32,10 @@ export function createOpenInTerminalHandler() {
         worktreePath: string;
       };
 
-      if (!worktreePath) {
+      if (!worktreePath || typeof worktreePath !== 'string') {
         res.status(400).json({
           success: false,
-          error: 'worktreePath required',
+          error: 'worktreePath required and must be a string',
         });
         return;
       }

apps/ui/src/components/views/board-view/worktree-panel/hooks/use-available-terminals.ts

@@ -82,8 +82,8 @@ export function useEffectiveDefaultTerminal(terminals: TerminalInfo[]): Terminal
   const defaultTerminalId = useAppStore((s) => s.defaultTerminalId);
 
   return useMemo(() => {
-    // If user hasn't set a preference (null), they prefer integrated terminal
+    // If user hasn't set a preference (null/undefined), they prefer integrated terminal
-    if (defaultTerminalId === null) {
+    if (defaultTerminalId == null) {
       return null;
     }
 

libs/platform/src/editor.ts

@@ -374,8 +374,9 @@ export async function openInTerminal(targetPath: string): Promise<{ terminalName
     await execFileAsync('osascript', ['-e', script]);
     return { terminalName: 'Terminal' };
   } else if (isWindows) {
-    // Try Windows Terminal first
+    // Try Windows Terminal first - check if it exists before trying to spawn
-    try {
+    const hasWindowsTerminal = await commandExists('wt');
+    if (hasWindowsTerminal) {
       return await new Promise((resolve, reject) => {
         const child: ChildProcess = spawn('wt', ['-d', targetPath], {
           shell: true,
@@ -384,13 +385,13 @@ export async function openInTerminal(targetPath: string): Promise<{ terminalName
         });
         child.unref();
 
-        child.on('error', () => {
+        child.on('error', (err) => {
-          reject(new Error('Windows Terminal not available'));
+          reject(err);
         });
 
         setTimeout(() => resolve({ terminalName: 'Windows Terminal' }), 100);
       });
-    } catch {
+    }
     // Fall back to cmd
     return await new Promise((resolve, reject) => {
       const child: ChildProcess = spawn(
@@ -410,7 +411,6 @@ export async function openInTerminal(targetPath: string): Promise<{ terminalName
 
       setTimeout(() => resolve({ terminalName: 'Command Prompt' }), 100);
     });
-    }
   } else {
     // Linux: Try common terminal emulators in order
     const terminals = [
@@ -425,7 +425,11 @@ export async function openInTerminal(targetPath: string): Promise<{ terminalName
         command: 'xfce4-terminal',
         args: ['--working-directory', targetPath],
       },
-      { name: 'xterm', command: 'xterm', args: ['-e', `cd "${targetPath}" && $SHELL`] },
+      {
+        name: 'xterm',
+        command: 'xterm',
+        args: ['-e', 'sh', '-c', `cd ${escapeShellArg(targetPath)} && $SHELL`],
+      },
       {
         name: 'x-terminal-emulator',
         command: 'x-terminal-emulator',

libs/platform/src/terminal.ts

@@ -556,7 +556,12 @@ async function executeTerminalCommand(terminal: TerminalInfo, targetPath: string
 
     case 'xterm':
       // XTerm: uses -e to run a shell in the directory
-      await spawnDetached(command, ['-e', `cd "${targetPath}" && $SHELL`]);
+      await spawnDetached(command, [
+        '-e',
+        'sh',
+        '-c',
+        `cd ${escapeShellArg(targetPath)} && $SHELL`,
+      ]);
       break;
 
     default: