Key Themes

• Incomplete fix: The prerequisite repoIdQuery inside linkProjectToRepo still passes owner and name as raw -f arguments — the same injection surface the PR was intended to close. This is a blocking issue.
• Missing regression tests: Neither createProject/linkProjectToRepo in project_command_test.go nor RunGHInputContext in github_cli_test.go have tests that would catch a regression to the vulnerable pattern.
• Spinner safety: RunGHInputContext calls spinner.Stop() manually rather than via defer, leaving a gap if cmd.Output() panics.
• Pattern fragmentation: updateSingleSelectFieldOptions (pre-existing) still uses the lower-level ExecGH(...).Stdin path; this PR is a good opportunity to migrate it to RunGHInputContext for a single canonical approach.

Positive Highlights

• ✅ Clean fix for the two Semgrep-flagged mutations (createProject, linkProjectToRepo) — json.Marshal + --input - eliminates the raw concatenation correctly.
• ✅ RunGHInputContext follows the established runGHWithSpinnerContext pattern, making it easy to audit.
• ✅ Wasm stub is present and consistent with the rest of the wasm build file.
• ✅ The PR description is clear, includes before/after snippets, and references the existing safe pattern.

[/diagnosing-bugs] Spinner is not stopped if cmd.Output() panics — consider using defer spinner.Stop() to ensure the spinner always clears.

<details>
<summary>💡 Suggested change</summary>

spinner := console.NewSpinner(spinnerMessage)
spinner.Start()
defer spinner.Stop()
output, err := cmd.Output()
return output, enrichGHError(err)

The existing runGHWithSpinnerContext calls spinner.Stop() manually without defer, so neither is currently panic-safe. Since `RunGHInputCon…

[/diagnosing-bugs] The repoIdQuery call in linkProjectToRepo still passes owner and name as raw -f arguments — the same injection surface Semgrep flagged. The PR fixed the mutation that follows, but not this prerequisite query.

<details>
<summary>💡 Suggested change</summary>

Replace the raw -f calls with a json.Marshal + --input - pattern consistent with the rest of this function:

repoIdQueryBody, err := json.Marshal(map[string]any{
    "query": repoIdQuery,
    "v…

</details>

<details><summary>pkg/cli/project_command.go:317</summary>

**[/tdd]** No regression test covers `createProject` using the new `--input -` path. If the `json.Marshal` + `RunGHInputContext` wiring regresses, the bug would be silent (no Semgrep alert, no test failure).

&lt;details&gt;
&lt;summary&gt;💡 What to test&lt;/summary&gt;

A table-driven test in `project_command_test.go` could mock `RunGHInputContext` (or use an `httptest` server via `GH_HOST`) and assert:
1. The request body sent to stdin is valid JSON with `query` and `variables` keys.
2. `ownerId` and `title` …

</details>

<details><summary>pkg/workflow/github_cli.go:176</summary>

**[/tdd]** `RunGHInputContext` is not covered in `github_cli_test.go` — there are tests for `RunGH` / `RunGHCombined` consistency but none for the new stdin-piping function.

&lt;details&gt;
&lt;summary&gt;💡 Suggested tests&lt;/summary&gt;

Add a test that:
1. Calls `RunGHInputContext` with a known `bytes.NewReader` payload and verifies stdin was passed through (e.g. via a helper command that echoes stdin).
2. Verifies the function returns the correct error when `cmd.Output()` fails and stderr is populated (mir…

</details>

<details><summary>pkg/cli/project_command.go:404</summary>

**[/codebase-design]** `updateSingleSelectFieldOptions` uses `workflow.ExecGH(...).Stdin = ...` directly (bypassing the spinner), while the two new call sites use `RunGHInputContext`. The same functional pattern is now expressed three ways in the same file — consider migrating `updateSingleSelectFieldOptions` to `RunGHInputContext` to consolidate the pattern.

&lt;details&gt;
&lt;summary&gt;Context&lt;/summary&gt;

- `createProject` → `RunGHInputContext` (new, with spinner + context)
- `linkProjectToRepo` → `Run…

</details>

<details><summary>pkg/workflow/github_cli_wasm.go:47</summary>

**[/codebase-design]** The wasm stub silently returns `nil, errors.New(&quot;gh CLI not available in Wasm&quot;)` without using the `input io.Reader` parameter at all. Go will not warn about the unused parameter, but it is worth noting in the function comment that the `input` argument is intentionally ignored in this build target.

&lt;details&gt;
&lt;summary&gt;💡 Suggested doc comment addition&lt;/summary&gt;

```go
// RunGHInputContext is a no-op stub for Wasm builds. The input reader is not used.
func RunGHInputContex…

</details>

• validateOwner / getOwnerNodeId (lines 240, 275): use escapeGraphQLString for owner literals inline in query strings — not changed by this PR.
• createView REST call (line 514): uses -f name= / -f layout= for a REST POST body (not GraphQL) — gh API handles form encoding correctly.
• getProjectFields (lines 680, 687): inline query strings with escaped owner login — not changed by this PR.

The repoIdQuery call passes user-provided repoOwner and repoName values via -f owner= / -f name= string concatenation. This is technically safe because the query uses typed GraphQL variables ($owner: String!, $name: String!) and gh CLI properly binds them, but it is inconsistent with the new RunGHInputContext + --input - pattern adopted for the mutations below, and will likely trigger a future Semgrep flag on this call site.

For full consistency, convert to the JSON-body ap…

Non-blocking issues (2 medium)

1. Missing defer spinner.Stop() (pkg/workflow/github_cli.go:185) — the new RunGHInputContext calls spinner.Stop() directly after cmd.Output(). A panic inside Output() will leave the terminal with an orphaned spinner. Fixing with defer is trivial.

2. Spinner logic duplicated (pkg/workflow/github_cli.go:176) — RunGHInputContext is a fourth copy of the same TTY/spinner block. This should instead extend runGHWithSpinnerContext with an optional io.Reader stdin parameter so future spinner-behavior changes propagate everywhere automatically.

Neither issue is a correctness or security bug — the core injection fix is sound. Both are straightforward to address before or in a follow-up.