fix: start wecker without shell=True

api/schema.py

@@ -28,13 +28,29 @@ def is_wecker_ringing() -> bool:
         return False
 
 
+def _project_root() -> Path:
+    return Path(__file__).parent.parent.absolute()
+
+
 def _default_command() -> str:
-    """Return the default shell command to run wecker.py."""
-    project_root = Path(__file__).parent.parent.absolute()
+    """Return the default shell command to run wecker.py from crontab."""
+    project_root = _project_root()
     python_exec = sys.executable
     return f"cd {project_root} && {python_exec} wecker.py >> wecker.log 2>&1"
 
 
+def _start_wecker_process() -> subprocess.Popen:
+    """Start wecker.py without invoking a shell."""
+    project_root = _project_root()
+    return subprocess.Popen(
+        [sys.executable, str(project_root / "wecker.py")],
+        cwd=project_root,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        start_new_session=True,
+    )
+
+
 @strawberry.type
 class Alarm:
     id: str
@@ -106,8 +122,7 @@ class Mutation:
         Returns True if started, False if already ringing."""
         if is_wecker_ringing():
             return False
-        cmd = _default_command()
-        subprocess.Popen(cmd, shell=True)
+        _start_wecker_process()
         return True
 
     @strawberry.field