fix: coord review remediations (path traversal, JSON parse, race condition) #81

jason.woltje · 2026-03-13T03:43:44Z

jason.woltje commented

2026-03-13 03:43:44 +00:00

Addresses code review findings from P2-005 coord migration.

Changes

Validate projectPath against allowed workspace roots (path traversal fix)
Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock
Add delay after stale lock removal to reduce race window
Add @Inject(CoordService) per project guideline
Eliminate double loadMission in getTaskStatus via shared buildStatusSummary
Fix fragile prompt-inclusion check to test original command for {prompt}
Add mkdir to writeAtomic for consistency

Test plan

All 19 existing tests pass
typecheck, lint, format:check all green

Closes #80

Addresses code review findings from P2-005 coord migration. ## Changes - Validate projectPath against allowed workspace roots (path traversal fix) - Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock - Add delay after stale lock removal to reduce race window - Add @Inject(CoordService) per project guideline - Eliminate double loadMission in getTaskStatus via shared buildStatusSummary - Fix fragile prompt-inclusion check to test original command for {prompt} - Add mkdir to writeAtomic for consistency ## Test plan - All 19 existing tests pass - typecheck, lint, format:check all green Closes #80

jason.woltje added 1 commit 2026-03-13 03:43:44 +00:00

fix: coord review remediations — path traversal, JSON parse, race condition 4de23e238a

Addresses code review findings from P2-005:
- Validate projectPath against allowed workspace roots (path traversal)
- Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock
- Add delay after stale lock removal to reduce race window
- Add @Inject(CoordService) per project guideline (no emitDecoratorMetadata)
- Eliminate double loadMission in getTaskStatus via shared buildStatusSummary
- Fix fragile prompt-inclusion check to test original command for {prompt}
- Add mkdir to writeAtomic for consistency with other atomic helpers

Closes #80

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jason.woltje merged commit 8da2759fec into main

2026-03-13 03:43:50 +00:00

jason.woltje referenced this issue from a commit

2026-03-13 03:43:51 +00:00

fix: coord review remediations (path traversal, JSON parse, race condition) (#81)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#81