fix: replace execSync('cat') with readFileSync to prevent command injection

discovery.ts used execSync('cat "${path}"') to read package.json and
Cargo.toml, which could execute arbitrary shell commands if a project
path contained metacharacters. Replaced with readFileSync in 3 locations.
Also exports MODULE_ROOTS constant and adds buildModuleNodes() helper
to eliminate duplication across init.ts, update.ts, and discovery.ts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rushikeshmore

src/core/discovery.ts

@@ -1,8 +1,8 @@
 import{execSync}from'node:child_process'
 import{readFileasfsRead,stat}from'node:fs/promises'
 import{join,relative,dirname,basename,extname}from'node:path'
-import{existsSync}from'node:fs'
-importtype{DiscoveredFile,ProjectInfo}from'../types/index.js'
+import{existsSync,readFileSyncasreadFileSyncFs}from'node:fs'
+importtype{DiscoveredFile,ProjectInfo,ModuleNode,SymbolRecord}from'../types/index.js'
 import{EXTENSION_MAP}from'../extraction/parser.js'
 
 constIGNORED_DIRS=newSet([
@@ -32,7 +32,7 @@ function detectProjectName(root: string): string {
 constpkgPath=join(root,'package.json')
 if(existsSync(pkgPath)){
 try{
-constpkg=JSON.parse(execSync(`cat "${pkgPath}"`,{encoding: 'utf-8'}))
+constpkg=JSON.parse(readFileSyncFs(pkgPath,'utf-8'))
 if(pkg.name)returnpkg.name
 }catch{/* ignore */}
 }
@@ -41,7 +41,7 @@ function detectProjectName(root: string): string {
 constcargoPath=join(root,'Cargo.toml')
 if(existsSync(cargoPath)){
 try{
-constcargo=execSync(`cat "${cargoPath}"`,{encoding: 'utf-8'})
+constcargo=readFileSyncFs(cargoPath,'utf-8')
 constmatch=cargo.match(/name\s*=\s*"(.+?)"/)
 if(match?.[1])returnmatch[1]
 }catch{/* ignore */}
@@ -128,9 +128,10 @@ async function walkDirectory(root: string, baseRoot: string): Promise<string[]>
 returnpaths
 }
 
+/** Directories that contain modules (src/cli, lib/utils, etc.) */
+exportconstMODULE_ROOTS=newSet(['src','lib','pkg','packages','apps','extensions','crates','internal','cmd','scripts','tools','rust'])
+
 functiondetectModules(root: string,files: DiscoveredFile[]): string[]{
-// Detect top-level directories under src/ (or equivalent)
-constMODULE_ROOTS=newSet(['src','lib','pkg','packages','apps','extensions','crates','internal','cmd','scripts','tools','rust'])
 constsrcDirs=newSet<string>()
 
 for(constfileoffiles){
@@ -149,6 +150,30 @@ function detectModules(root: string, files: DiscoveredFile[]): string[] {
 return[...srcDirs].sort()
 }
 
+exportfunctionbuildModuleNodes(
+modules: string[],
+files: DiscoveredFile[],
+symbols: SymbolRecord[],
+): ModuleNode[]{
+returnmodules.map(modName=>{
+constmodFiles=files.filter(f=>{
+constparts=f.path.split('/')
+consttopDir=parts[0]??''
+return(MODULE_ROOTS.has(topDir)&&parts[1]===modName)||
+(parts[0]===modName)
+})
+consttopDir=modFiles[0]?.path.split('/')[0]??'src'
+return{
+path: `${topDir}/${modName}`,
+name: modName,
+files: modFiles.map(f=>f.path),
+language: modFiles[0]?.language||'unknown',
+lines: modFiles.reduce((sum,f)=>sum+f.lines,0),
+symbols: symbols.filter(s=>modFiles.some(f=>f.path===s.file)).length,
+}
+})
+}
+
 functiondetectEntryPoints(root: string,files: DiscoveredFile[],type: ProjectInfo['type']): string[]{
 constentryPoints: string[]=[]
 
@@ -157,7 +182,7 @@ function detectEntryPoints(root: string, files: DiscoveredFile[], type: ProjectI
 constpkgPath=join(root,'package.json')
 if(existsSync(pkgPath)){
 try{
-constpkg=JSON.parse(execSync(`cat "${pkgPath}"`,{encoding: 'utf-8'}))
+constpkg=JSON.parse(readFileSyncFs(pkgPath,'utf-8'))
 if(pkg.main)entryPoints.push(pkg.main)
 if(pkg.bin){
 constbins=typeofpkg.bin==='string' ? [pkg.bin] : Object.values(pkg.bin)