fix(product): no model-typed value from untrusted input reaches a shell line before tested code validates it (6.30.0)

[PrzemekGalarowicz]

What

A read-only injection audit of the product commands' pinned lines found three places where a value the model derives
from untrusted input reached a shell before anything checked it. Each was reproduced against the 6.28.2 lines in a
throwaway directory.

1. The feature slug (/pharn-spec Step 0, and so /pharn-ship; /pharn-loop S1): the only check ran inside a node
   process, after the shell had parsed the line carrying the candidate. /pharn-loop's own validator ran
   x'$(touch PWNED)' and exited 0.
2. /pharn-loop Step 6d typed git symbolic-ref output into git switch '<original branch>', so a hostile branch
   name ran its command on a failed commit.
3. /pharn-ship --quick item 7 took a --base <ref> the command has no flag for, so the ref came from the
   description.

How

• New floor CLI pharn/floor/feature-name.mjs (header = spec). The model writes the slug with the Write tool to
  .pharn/feature-name/candidate.txt. The CLI refuses a symlinked or non-directory parent, reads the file without
  following it, removes it, and prints it only as a FEATURE_SLUG_RE member. --fresh replaces the loop's S2 shell
  loop.
• Commands.
  • spec and loop run the CLI before any <name> shell line.
  • plan, grill, test, build and review ask for a name they did not receive; regress and verify resolve one only
    through the CLI.
  • Step 6d is the constant git checkout - --, with its bound stated.
  • Quick item 7 takes no ref from the description.
  • A directory at the candidate path stops the run: ask the human, or report back blocked under --model-approve.
• Tests (not shipped).
  • feature-name.test.mjs: 41 tests, 5/5 mutants killed.
  • A SHELL-SINK section in command-hygiene.test.mjs: both tables closed both ways, order and sentence pins (presence
    only), the committed lines executed over hostile names, and the 6.28.2 lines shown to run their payloads.

SKILLS_VERSION 6.29.0 → 6.30.0 (minor, a new floor CLI; this PR merges ahead of #291). MIN_CLI stays
0.5.0.

Floor verdicts

• validate: GREEN.
• /pharn-dev-regress: no-regressions. This was a re-run under low load; the first run's two wall-clock failures are
  recorded in REGRESSION.md.
• /pharn-dev-verify: PASS (4,122/4,122 tests, reconcile CLEAN before the merge).
• /pharn-dev-review: GREEN, 0 floor findings. Advisory 1 and 2 are fixed here; 3 and 4 are recorded only.
• After git merge origin/main, all checks below ran GREEN or exit 0:
  • check:changelog-entry against c1bf663;
  • check:changelog, check:badge, docs:check, validate;
  • command-hygiene and feature-name tests (312/312);
  • format:check, lint, lint:md.
• Local reconcile reads ESCAPE on 32 files. By set difference, every one is a file origin/main changed: the expected
  merge case.

Bounds (advisory)

The pins read command text, never a run, so three things are advisory:

• that the model writes the candidate with the Write tool;
• that it obeys the refusal rules;
• that it re-types only the printed value.

One candidate file serves the whole tree.

Gates were decided by the orchestrating model under the maintainer's delegation, not by a human. Audit trail:
.dev/features/shell-sink-validation/.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9b9daf9d-d4b8-48e5-b24a-f3ffaa002741

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}