nanobot: 2026-09-11 09:44:11

skills/project/scripts/project_cli.py

@@ -124,7 +124,12 @@ def cmd_activate(slug: str) -> int:
     return 0
 
 
-def cmd_log(slug: str, text: str | None) -> int:
+def cmd_log(slug: str, entry_file: str | None) -> int:
+    """Append the entry read from `entry_file` (or stdin when None) to memory.md.
+
+    The text is never passed on the command line: the exec safety guard scans the
+    raw command string and misreads prose as a filesystem path (see SKILL.md).
+    """
     directory = project_path(slug)
     if not directory.is_dir():
         slugs = existing_slugs()
@@ -132,7 +137,14 @@ def cmd_log(slug: str, text: str | None) -> int:
         print(f"No such project: {slug}. Existing: {listing}", file=sys.stderr)
         return 1
 
-    body = text if text is not None else sys.stdin.read()
+    if entry_file is None:
+        body = sys.stdin.read()
+    else:
+        source = Path(entry_file)
+        if not source.is_file():
+            print(f"No such file: {entry_file}", file=sys.stderr)
+            return 1
+        body = source.read_text(encoding="utf-8")
     body = body.strip()
     if not body:
         print("Nothing to log (empty input).", file=sys.stderr)
@@ -191,7 +203,9 @@ def main() -> int:
     log = sub.add_parser("log", help="Append a dated entry to memory.md")
     log.add_argument("slug")
     log.add_argument(
-        "--text", default=None, help="Entry text; if omitted, read from stdin"
+        "--file",
+        default=None,
+        help="Path to a file holding the entry text; if omitted, read from stdin",
     )
 
     sub.add_parser("list", help="List projects with file sizes")
@@ -203,7 +217,7 @@ def main() -> int:
     if args.command == "activate":
         return cmd_activate(args.slug)
     if args.command == "log":
-        return cmd_log(args.slug, args.text)
+        return cmd_log(args.slug, args.file)
     if args.command == "list":
         return cmd_list()
     return cmd_new(args.slug)