Code & Security Review

Critical Issues

None.

Security Review

Strengths:

• Uses NSHomeDirectory() as the working directory — a safe, predictable path that avoids information leakage from arbitrary git repos
• No new environment variable handling or user input flows introduced
• The cwd parameter is optional with a nil default, preserving backward compatibility for non-glab callers

Concerns:

• None identified. The change is narrowly scoped to process working directory control.

Code Quality

• The fix is consistent across both files: IssueTracker.swift (3 call sites + 2 shell helper signatures) and ProviderManager.swift (2 call sites + 1 shell helper signature)
• All glab invocations now pass cwd: NSHomeDirectory() — no missed call sites
• The cwd parameter placement (between env: and the variadic args) is clean and follows the existing parameter style
• CrowProvider tests pass (25/25)
• Pre-existing (not this PR): ProviderManager.shell calls waitUntilExit() before readDataToEndOfFile() (L137-138), which can deadlock if output exceeds the 64 KB pipe buffer. IssueTracker.shell already reads-then-waits (fixed in a prior PR). Worth a follow-up but not blocking.

Summary Table

Recommendation: Approve — clean, minimal fix that solves the GITLAB_HOST mismatch by running glab from HOME instead of the app's inherited CWD. No security concerns, consistent implementation, tests pass.

Code & Security Review

Critical Issues

None.

Security Review

Strengths:

• NSHomeDirectory() is a safe, deterministic directory choice — it exists on every macOS system and carries no secrets risk beyond what the user already has access to.
• No new user-controlled input is introduced; the cwd parameter is always called with NSHomeDirectory() (a constant) at every call site.
• Environment variable handling (GITLAB_HOST) is unchanged and correctly scoped.

Concerns:

• None identified.

Code Quality

Positive:

• Clean, minimal diff — adds the cwd: parameter exactly where needed without over-engineering.
• Both IssueTracker and ProviderManager shell helpers are updated consistently with the same pattern (cwd: String? = nil with default).
• The IssueTracker.shell correctly captures let cwd = cwd for the Task.detached closure, matching the existing pattern for args and env.
• All four glab call sites are covered: fetchGitLabIssues, fetchGitLabMRsForReconcile, and both glab mr view/glab issue view in ProviderManager.fetchTicket.

Pre-existing note (not introduced by this PR):

• ProviderManager.shell calls waitUntilExit() before readDataToEndOfFile() (lines 137–138). If a glab command produces >64 KB of output, this could deadlock. The IssueTracker.shell already reads pipes before waiting (and has a comment explaining why). This is pre-existing and low-risk for glab ticket views, but worth noting for a future cleanup.

Summary Table

Recommendation: Approve — the fix is correct, well-scoped, and the approach (running glab from $HOME to avoid git-remote auto-detection) is the right solution for the GITLAB_HOST mismatch problem. CrowProvider builds and all 25 tests pass.