fix: bound scheduled recipe validation

[jbg]

Summary

• require scheduled recipe paths to resolve to regular files
• bound recipe reads to 1 MiB and recheck the opened file before reading
• enforce the same bound when the scheduler persists the validated recipe
• pass the exact validated recipe bytes to the scheduler so source swaps cannot change the persisted job
• bind the scheduled job's recipe base directory to the canonical file used for validation
• make persisted recipe copies owner-only on Unix before truncating or writing their contents
• reject Unix FIFOs and final-component symlink swaps without blocking while preserving canonical symlink targets
• return stable, non-content-bearing errors for read, UTF-8, and parse failures
• add focused regressions for reflected parse content, non-regular paths, nonblocking FIFO rejection, canonical symlinks, oversized files, source growth and replacement after validation, canonical base-directory handoff, private copy permissions, and valid recipes

Security impact

The schedule-management tool can no longer read an unbounded arbitrary filesystem object or reflect attacker-selected recipe contents through parser diagnostics. The scheduler also preserves the validated recipe's canonical directory across the handoff and does not relax a private source recipe to a group- or world-readable internal copy on Unix.

Verification

• cargo test -p goose --test schedule_tool_security (6 passed)
• cargo test -p goose --lib bounded_recipe_copy_rejects_source_that_grew_after_validation
• cargo test -p goose validated_recipe_bytes_and_base_are_persisted_after_source_replacement
• cargo test -p goose validated_recipe_copy_makes_existing_destination_owner_private
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings

This finding was discovered by Project Loupe.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42f1f0c740

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4ca54e7581

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e82c5de43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d928905c5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".