Harden file writes and git operations against symlink/option injection

[devill]

Summary

This PR adds security hardening to prevent symlink-following attacks during file writes and option-injection attacks in git operations. It also fixes unsafe property lookups that could be exploited via prototype pollution.

Key Changes

File write safety (safe-fs.ts, safe-fs.test.ts)

• Introduce safeWriteFileSync and safeCopyFileSync that use O_NOFOLLOW flag to prevent writes through symlinks
• Reject attempts to write through symlinks with a new SymlinkWriteError exception
• Prevents malicious working trees from redirecting writes outside the project root (e.g., to executable git hooks)
• Replace all writeFileSync calls with safeWriteFileSync across the codebase (git hooks, baseline storage, config scaffolding, package scripts, jscpd config, skill installation)

Git operation safety (git/scope.ts, git/scope.test.ts)

• Add safeRef validation to reject git revision arguments starting with - (which would be parsed as options)
• Prevents option-injection attacks like --output=/tmp/pwn being passed as a commit hash
• Apply validation to getChangedVsCommit and getMergeBase calls
• Add -- separator in diff command to terminate option parsing
• New UnsafeRefError exception for rejected refs

Tool bin path containment (detect/tool.ts, detect/tool.test.ts)

• Add containedBin validation to reject package.json#bin paths that escape the package directory
• Prevents RCE via malicious tool package.json entries like "bin": "../../evil.js"
• Test case verifies that out-of-bounds bin paths cause tool detection to fail safely

Safe property lookups

• Replace unsafe map?.[key] ?? fallback patterns with Object.hasOwn(map, key) checks in:
  • src/sensors/adapter.ts (smell mapping)
  • src/checks/eslint-wrap.ts (ESLint smell mapping)
  • src/checks/knip-wrap.ts (Knip smell mapping)
• Prevents prototype pollution attacks where a malicious tool emits code like "constructor" that would incorrectly resolve to Object.prototype.constructor
• Test case verifies that constructor as a smell ID is handled correctly

Rule ID slugification (prompts/slug.ts, prompts/slug.test.ts)

• Extract slugify function to dedicated module (previously inline in loader.ts and registry.ts)
• Enhance to replace both / and \ path separators (in addition to : and @)
• Prevents path traversal via crafted rule IDs like ../../etc/passwd when mapping to prompt files
• Test cases verify neutralization of both Unix and Windows path separators

Implementation Details

• O_NOFOLLOW flag closes the TOCTOU window without requiring separate existence checks
• Dangling symlinks are caught by ELOOP error on open, preventing writes to arbitrary locations
• Git ref validation happens before command construction, preventing injection into git arguments
• Bin path containment uses relative() to detect escape attempts (.. prefixes or absolute paths)
• Property lookups use Object.hasOwn() instead of optional chaining to avoid prototype chain traversal

https://claude.ai/code/session_011JpXA4jQJRGPcMfpC3nmmA