M14 finalization: SEC-4, SEC-5, SEC-6, version.sh fix

[wkusnierczyk]

Summary

• [SEC-4] Reject path traversal (..) in plugin.json path overrides (P011)
  Closes [SEC-4] Path traversal in plugin.json path overrides #151
• [SEC-5] Enforce 1 MiB file size limit in all plugin validators via read_file_checked
  Closes [SEC-5] Unbounded file reads in plugin validators #152
• [SEC-6] Re-check is_regular_file before write-back in fixer and formatter
  Closes [SEC-6] TOCTOU window between file validation and write-back #153
• Fix non-portable \n in sed replacement in version.sh (awk-based approach)

Details

SEC-4: Added P011 diagnostic and contains_path_traversal() check in manifest.rs. Paths with .. components are rejected as warnings. Traversal paths skip the P007 existence check (same pattern as S006 in structure.rs). 5 new tests.

SEC-5: Replaced std::fs::read_to_string() with crate::parser::read_file_checked() in all 5 plugin modules (manifest, hooks, agent, command, cross). The bounded reader rejects files over 1 MiB. Error handling uses the existing diagnostic pattern (match Ok/Err → push diagnostic → return).

SEC-6: Added is_regular_file() re-check immediately before std::fs::write() in fixer.rs and cli/format.rs. This is option 1 from issue #153 (proportionate to the low risk level of a single-user CLI). Exported is_regular_file from lib.rs for binary crate access.

version.sh: Replaced sedi "s/^# Changes$/# Changes\n\n$STUB/" (GNU sed \n extension) with portable awk that explicitly prints each line — matching the pattern in write_changelog().

Test plan

• All 537 unit tests pass
• All integration tests pass
• cargo clippy -- -D warnings clean
• cargo fmt --check clean
• No remaining std::fs::read_to_string in src/plugin/
• Verify version.sh CHANGES.md stub on macOS (BSD sed)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR finalizes M14 security items by hardening plugin validation and reducing file-write race windows, plus makes scripts/version.sh portable across BSD/GNU toolchains.

Changes:

• Add SEC-4 traversal detection for plugin.json path overrides via new P011 diagnostic.
• Add SEC-5 bounded reads (1 MiB cap) by switching plugin validators to read_file_checked.
• Add SEC-6 is_regular_file() re-checks before write-back in the fixer and formatter; make version.sh changelog stub insertion portable.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/plugin/manifest.rs	Adds contains_path_traversal() + P011 and switches to bounded file reads for plugin.json.
src/plugin/hooks.rs	Switches hooks.json reading to read_file_checked (1 MiB cap).
src/plugin/agent.rs	Switches agent file reading to read_file_checked (1 MiB cap).
src/plugin/command.rs	Switches command file reading to read_file_checked (1 MiB cap).
src/plugin/cross.rs	Switches hooks.json reading to read_file_checked inside cross-component checks.
src/diagnostics.rs	Defines new diagnostic code constant P011 and includes it in the codes test list.
src/fs_util.rs	Makes is_regular_file public for binary crate use.
src/lib.rs	Re-exports is_regular_file from the library API.
src/fixer.rs	Re-checks is_regular_file immediately before writing fixes back to disk.
src/cli/format.rs	Re-checks is_regular_file before formatting write-back.
scripts/version.sh	Replaces non-portable sed newline replacement with a portable awk insertion.
CHANGES.md	Adds release notes for SEC-4/5/6 and the version.sh portability fix.

Comments suppressed due to low confidence (2)

src/cli/format.rs:36

• find_skill_md(dir).unwrap() can panic if the SKILL.md path disappears or becomes a symlink/non-regular file between format_skill(dir) and this write-back. That undermines the new TOCTOU hardening because the process may crash before the is_regular_file re-check. Handle the None case explicitly and emit an error/exit (or have format_skill return the resolved path so it can be reused).

                        let path = aigent::find_skill_md(dir).unwrap();
                        if !aigent::is_regular_file(&path) {
                            eprintln!(
                                "aigent format: target is no longer a regular file: {}",
                                path.display()
                            );
                            std::process::exit(1);
                        }

src/plugin/cross.rs:143

• validate_cross_component now uses read_file_checked, but any read error (including the new >1 MiB limit) is silently ignored due to if let Ok(...). This can cause X002 hook-script checks to be skipped with no diagnostic, reducing the usefulness of validation on malformed/oversized hooks.json. Consider switching to a match and pushing a dedicated cross-component diagnostic when hooks.json can't be read/parsed (including when it exceeds the size limit).

    // X002: Hook command references script that doesn't exist
    let hooks_path = root.join("hooks.json");
    if hooks_path.is_file() {
        if let Ok(content) = crate::parser::read_file_checked(&hooks_path) {
            if let Ok(raw) = serde_json::from_str::<serde_json::Value>(&content) {
                check_hook_script_paths(&raw, root, &mut diags);
            }
        }