fix: security hardening — path traversal, injection, jq filter bug (batch 3)#3877

Merged

marcusquinn merged 6 commits intomarcusquinn:mainfrom

johnwaldo:bugfix/critical-batch3

Mar 9, 2026

Commits on Mar 8, 2026

fix: security hardening — path traversal, arithmetic injection, awk injection, JSON injection, jq filter bug
AI DevOps
committed
fix: address review feedback — dedup, compact JSON, tuple unique_by, idempotent revoke
marcusquinn
committed
fix: validate confidence as numeric before awk comparison, canonicalize TOKEN_DIR in cmd_validate
marcusquinn
committed
fix: validate numeric params before side effects, guard label_clear against missing state
marcusquinn
committed
fix: address CodeRabbit review feedback on batch 3
AI DevOps
committed
fix: propagate advisory-comment failure from label-stuck
AI DevOps
committed