Tool-facing just recipes interpolate titles straight into a shell script

• Status: Todo
• Kind: Bug
• Authors: jp
• Date: 2026-09-07
• Label: domain=tooling
• Label: type=bug

just rfd-draft, just rfd-rename, and just ticket-add all take a free-text title and reach it through {{TITLE}} inside a #!/usr/bin/env sh recipe body. Just substitutes the text before the shell parses the script, so a title carrying $(...), a backtick, or a " is read as shell syntax rather than as a title.

rfd-draft and rfd-rename are the commands behind the rfd_draft and rfd_rename tools, so the title on those calls is model-generated, repeating text that came from the conversation. ticket-add is human-facing: the ticket_create tool goes through just serve-tools and never touches this recipe.

Nothing here is exploitable by accident: a title with a stray backtick fails the recipe rather than doing something quiet. The concern is a title that was crafted upstream, in an issue body or a pasted diff, and then handed to rfd_draft verbatim.

The fix is to stop interpolating into the script and pass the arguments through argv instead: mark the recipes [positional-arguments] and read $1, $2, ... rather than {{NNN}} and {{TITLE}}. _shape-args in the justfile already does this, so the pattern is in the tree.

Worth auditing every recipe that takes free text at the same time, not just these three.