Security hardening: path validation and test coverage

[Copilot]

Proactive security analysis revealed path traversal vulnerabilities and missing input validation. Added defensive checks throughout the codebase and comprehensive test coverage for previously untested core packages.

Security Fixes

Path Traversal Protection

Added validation to prevent directory traversal attacks:

// Before: vulnerable to path traversal
sourcePath := filepath.Join(overlayRoot, relPath)  // relPath could be "../../../etc/passwd"

// After: validated before use
if err := fs.ValidateRelPath(relPath); err != nil {
    return nil, fmt.Errorf("invalid tracked path: %w", err)
}
sourcePath := filepath.Join(overlayRoot, relPath)

Store ID Injection Prevention

Store IDs now validated across all operations (Create, LoadMeta, SaveMeta, LoadTrack, SaveTrack, Delete, OverlayRoot):

func (r *FileStoreRepo) LoadMeta(id string) (*StoreMeta, error) {
    if err := r.fs.ValidateIdentifier(id); err != nil {
        return nil, fmt.Errorf("invalid store ID: %w", err)
    }
    // Prevents: id = "../../../etc" from escaping stores directory
}

Silent Error Handling

Fixed ignored filesystem errors in diff.go that could mask permission issues:

// Before
workspaceExists, _ := e.fs.Exists(workspaceDir)  // error silently dropped

// After
workspaceExists, err := e.fs.Exists(workspaceDir)
if err != nil {
    return nil, fmt.Errorf("failed to check workspace directory: %w", err)
}

Test Coverage

Added 22 unit tests (670 LOC) for previously untested packages:

• fsops: Path validation (ValidateRelPath, ValidateIdentifier), file operations, edge cases
• config: Path initialization, MONODEV_ROOT handling, nested directory creation
• hash: SHA256 consistency, empty files, FakeHasher behavior

Documentation

Added package-level documentation for 7 internal packages (engine, planner, state, stores, fsops, hash, config).

Verification

• All existing tests pass
• CodeQL security scan: 0 alerts
• 856 lines added, 17 files changed

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[danieljhkim]

LGTM