fix: security hardening — path traversal, injection, jq filter bug (batch 3)

.agents/scripts/ai-judgment-helper.sh

@@ -905,9 +905,10 @@ ${user_message}"
 				if [[ -n "$score" ]]; then
 					# Determine pass/fail using awk for float comparison
 					local passed
-					passed=$(awk "BEGIN { print ($score >= $threshold) ? \"true\" : \"false\" }")
+					passed=$(awk -v s="$score" -v t="$threshold" 'BEGIN { print (s >= t) ? "true" : "false" }')
 
-					local result_json="{\"evaluator\": \"${eval_type}\", \"score\": ${score}, \"passed\": ${passed}, \"details\": \"${details}\"}"
+					local result_json
+					result_json=$(jq -n --arg type "$eval_type" --argjson score "${score:-null}" --argjson passed "$passed" --arg details "$details" '{evaluator: $type, score: $score, passed: $passed, details: $details}')
 
 					# Cache the result
 					cache_judgment "$cache_key" "$result_json" "" "haiku"
@@ -919,7 +920,8 @@ ${user_message}"
 	fi
 
 	# Deterministic fallback: API unavailable
-	local fallback_json="{\"evaluator\": \"${eval_type}\", \"score\": null, \"passed\": null, \"details\": \"API unavailable, using fallback\"}"
+		local fallback_json
+		fallback_json=$(jq -n --arg type "$eval_type" '{evaluator: $type, score: null, passed: null, details: "API unavailable, using fallback"}')
 	echo "$fallback_json"
 	return 0
 }

.agents/scripts/stuck-detection-helper.sh

@@ -147,7 +147,7 @@ _sd_write_state() {
 
 	# Atomic write via temp file + mv
 	local tmp_file="${state_file}.tmp.$$"
-	if ! printf '%s\n' "$state_json" >"$tmp_file" 2>/dev/null; then
+	if ! printf '%s\n' "$state_json" >"$tmp_file"; then
 		_sd_log_warn "failed to write temp state file: $tmp_file"
 		rm -f "$tmp_file" 2>/dev/null || true
 		return 1
@@ -268,7 +268,7 @@ cmd_label_stuck() {
 
 	# Check confidence threshold
 	local above_threshold
-	above_threshold=$(awk "BEGIN { print ($confidence >= $STUCK_CONFIDENCE_THRESHOLD) ? 1 : 0 }" 2>/dev/null) || above_threshold="0"
+	above_threshold=$(awk -v c="$confidence" -v t="$STUCK_CONFIDENCE_THRESHOLD" 'BEGIN { print (c >= t) ? 1 : 0 }') || above_threshold="0"
 
 	if [[ "$above_threshold" -ne 1 ]]; then
 		_sd_log_info "confidence $confidence below threshold $STUCK_CONFIDENCE_THRESHOLD for issue #$issue_number — not labeling"
@@ -307,7 +307,7 @@ cmd_label_stuck() {
 
 	# Apply label
 	gh issue edit "$issue_number" --repo "$repo_slug" \
-		--add-label "$STUCK_LABEL" 2>/dev/null || {
+		--add-label "$STUCK_LABEL" || {
 		_sd_log_warn "failed to add label to issue #$issue_number"
 		return 1
 	}
@@ -331,7 +331,7 @@ ${suggested_actions}
 *This is an advisory notification only. No automated action has been taken. The worker continues running. The \`${STUCK_LABEL}\` label will be automatically removed if the task completes successfully.*"
 
 	gh issue comment "$issue_number" --repo "$repo_slug" \
-		--body "$comment_body" 2>/dev/null || {
+		--body "$comment_body" || {
 		_sd_log_warn "failed to comment on issue #$issue_number"
 	}
 
@@ -344,6 +344,7 @@ ${suggested_actions}
 	new_state=$(printf '%s' "$state" | jq \
 		--arg issue "$issue_number" \
 		--arg repo "$repo_slug" \
+		--arg repo "$repo_slug" \
 		--arg now "$now" \
 		'.labeled_issues = ((.labeled_issues // []) + [{"issue": $issue, "repo": $repo, "labeled_at": $now}] | unique_by(.issue + .repo))') || true
 	if [[ -n "$new_state" ]]; then
@@ -394,7 +395,7 @@ cmd_label_clear() {
 
 	# Remove the label
 	gh issue edit "$issue_number" --repo "$repo_slug" \
-		--remove-label "$STUCK_LABEL" 2>/dev/null || {
+		--remove-label "$STUCK_LABEL" || {
 		_sd_log_warn "failed to remove label from issue #$issue_number"
 		return 1
 	}
@@ -416,7 +417,8 @@ cmd_label_clear() {
 	new_state=$(printf '%s' "$state" | jq \
 		--arg key "$issue_key" \
 		--arg issue "$issue_number" \
-		'del(.milestones_checked[$key]) | .labeled_issues = [.labeled_issues[] | select(.issue != $issue)]') || true
+		--arg repo "$repo_slug" \
+		'del(.milestones_checked[$key]) | .labeled_issues = [.labeled_issues[] | select(not (.issue == $issue and .repo == $repo))]') || true
 	if [[ -n "$new_state" ]]; then
 		_sd_write_state "$new_state" || true
 	fi

.agents/scripts/worker-token-helper.sh

@@ -367,6 +367,16 @@ cmd_create() {
 			;;
 		--ttl | -t)
 			ttl="$2"
+			# Validate TTL is numeric to prevent arithmetic injection
+			if ! [[ "$ttl" =~ ^[0-9]+$ ]]; then
+				log_token "ERROR" "TTL must be a positive integer: ${ttl}"
+				return 1
+			fi
+			# Validate TTL is numeric to prevent arithmetic injection
+			if ! [[ "$ttl" =~ ^[0-9]+$ ]]; then
+				log_token "ERROR" "TTL must be a positive integer: ${ttl}"
+				return 1
+			fi
 			if ((ttl > MAX_TTL)); then
 				log_token "WARN" "TTL capped at ${MAX_TTL}s (requested ${ttl}s)"
 				ttl=$MAX_TTL
@@ -398,14 +408,14 @@ cmd_create() {
 
 	# Strategy 1: GitHub App installation token (best — enforced by GitHub)
 	local token_file
-	token_file=$(create_app_token "$repo" "$permissions" "$ttl" 2>/dev/null) && {
+	token_file=$(create_app_token "$repo" "$permissions" "$ttl") && {
 		log_token "INFO" "Strategy: GitHub App installation token (enforced scoping)"
 		printf '%s' "$token_file"
 		return 0
 	}
 
 	# Strategy 2: Delegated token (fallback — advisory scoping)
-	token_file=$(create_delegated_token "$repo" "$permissions" "$ttl" 2>/dev/null) && {
+	token_file=$(create_delegated_token "$repo" "$permissions" "$ttl") && {
 		log_token "INFO" "Strategy: Delegated token (advisory scoping)"
 		printf '%s' "$token_file"
 		return 0
@@ -437,6 +447,17 @@ cmd_validate() {
 		return 1
 	fi
 
+	# Validate token file path is within TOKEN_DIR to prevent path traversal
+	local real_path
+	real_path=$(realpath "$token_file" 2>/dev/null) || {
+		log_token "ERROR" "Cannot resolve token file path: ${token_file}"
+		return 1
+	}
+	if [[ "$real_path" != "${TOKEN_DIR}/"* ]]; then
+		log_token "ERROR" "Token file must be within ${TOKEN_DIR}: ${token_file}"
+		return 1
+	fi
+
 	if [[ ! -f "$token_file" ]]; then
 		log_token "ERROR" "Token file not found: ${token_file}"
 		return 1
@@ -505,6 +526,17 @@ cmd_revoke() {
 		return 1
 	fi
 
+	# Validate token file path is within TOKEN_DIR to prevent path traversal
+	local real_path
+	real_path=$(realpath "$token_file" 2>/dev/null) || {
+		log_token "ERROR" "Cannot resolve token file path: ${token_file}"
+		return 1
+	}
+	if [[ "$real_path" != "${TOKEN_DIR}/"* ]]; then
+		log_token "ERROR" "Token file must be within ${TOKEN_DIR}: ${token_file}"
+		return 1
+	fi
+
 	local meta_file="${token_file%.token}.meta"
 	local strategy=""
 	local repo=""