John Smith 7eda883589 fix(code-scanning): remediate 13 CodeQL alerts (sanitization, TOCTOU, temp file, 9 ReDoS) ...

- permission-guard: add g flag to glob escape (alert 2)
- edit-transaction: remove existsSync TOCTOU gates, try/catch ENOENT (alert 8)
- harness-host.upstream: mkdtempSync dir + 0600 probe file (alert 21)
- muse-calibration: indexOf recent-context scan, 20k inner cap (alert 6)
- diagnostics-runner: per-line bounded frame patterns (alert 4)
- import-verifier: bounded quantifiers + manual brace scan (alerts 10-13)
- repomap: manual quoted-span mask + bounded outline patterns (alerts 14-15)
- architecture-advisor: catch prefilter + bounded patterns (alerts 9,20)
- guards.test: glob regression (*.ts must not match ats)
- check-loc budget revised 12100/10100 -> 12176/10104 (documented)

Gates: bun run check 0, bun test 0 (398 pass), make check 0, make accept 0

2026-10-19 12:37:38 -04:00

..

harness-host.upstream.ts

fix(code-scanning): remediate 13 CodeQL alerts (sanitization, TOCTOU, temp file, 9 ReDoS)

2026-10-19 12:37:38 -04:00

run.sh

Audit remediation 20261018: P0 shell/guard/taint + P1/P2 fixes, 1.0.10 bump (QA ACCEPT + VERDICT pending)

2026-10-18 03:38:07 -04:00