feat: renovate updates and security improvments

[muzomer]

Harden path handling, pin CI supply chain, add Renovate

Three related strands: the extension acts on paths and file modes parsed out of patch text, CI hands a token to an unpinned toolchain, and dependencies had no update mechanism.

Refuse unsafe paths (src/patch/paths.ts, src/review/check.ts)

Every path this extension reads, writes, or deletes comes from patch text, and every place it lands normalises .. rather than confining it — join("/repo", "../../etc/x") is /etc/x, not an error. Containment now happens before the join. Refusing costs nothing: git and jj both emit repo-root-relative paths, and git's one cwd-relative mode omits outside files rather than reaching them with ...

Refuse symlinks and submodules (src/review/check.ts)

Git stores a symlink as a file whose content is its target, so it reached review looking like ordinary one-line text. Nothing interpreted a file mode, so both write sites wrote it back as text and resolved the destination — landing the write wherever the link pointed, outside the workspace. The path check couldn't catch this: a symlink escapes without a suspicious path anywhere.

Refused at checkReviewedFile, the single point both backends pass through, for every file whether marked or not. Regular modes are an allowlist — an unrecognised mode is one nobody has reasoned about. Write sites are hardened for when the working copy and the patch disagree: O_NOFOLLOW on discard, and an unlink before both the redirect and the cp in the jj helper.

The reachable case was an unmarked symlink in a jj review: unmarked files are never read from the working copy, so no staleness check runs, yet the file still becomes a restore instruction.

Pin the CI supply chain (.github/workflows/ci.yml)

CI passes GITHUB_TOKEN to a step, and three gaps compounded: no permissions block, both actions on floating tags that can be retagged onto attacker code, and a jj tarball installed as root with no pinned version or digest. Now contents: read, actions pinned to commit SHAs, and jj pinned to v0.44.0 against a recorded SHA-256. jj publishes no checksum file, so the digest was recorded by hand — it catches a later swap of the asset, it does not attest the build.

https://claude.ai/code/session_01V5yBUZqwwtDFrkKLtANyLw

Two notes on using it: the branch isn't pushed yet, so gh pr create needs a jj git push first — tell me if you want both. And the last section is a checklist for you specifically; if you'd rather it not live
in the PR body permanently, it fits better as a comment.

✻ Cooked for 22s · done 6:14 PM

❯ I mean PR description for all the changes in the branch, but please keep it precise and sh

Right — the branch has earlier commits too. Let me look at the whole thing.

Ran 4 shell commands

Here's the description for the whole branch, kept short:

Harden path handling, pin CI supply chain, add Renovate

Three related strands: the extension acts on paths and file modes parsed out of patch text, CI hands a token to an unpinned toolchain, and dependencies had no update mechanism.

Refuse unsafe paths (src/patch/paths.ts, src/review/check.ts)

Every path this extension reads, writes, or deletes comes from patch text, and every place it lands normalises .. rather than confining it — join("/repo", "../../etc/x") is /etc/x, not an error.
Containment now happens before the join. Refusing costs nothing: git and jj both emit repogit's one cwd-relative mode omits outside files rather than reaching them with ...

Refuse symlinks and submodules (src/review/check.ts)

Git stores a symlink as a file whose content is its target, so it reached review looking like ordinary one-line text. Nothing interpreted a file mode, so both write sites wrote it back as text and resolved the destination — landing the write wherever the link pointed, outside the workspace. The path check couldn't catch this: a symlink escapes without a suspicious path anywhere.

Refused at checkReviewedFile, the single point both backends pass through, for every file whether marked or not. Regular modes are an allowlist — an unrecognised mode is one nobody has reasoned about. Write sites are hardened for when the working copy and the patch disagree: O_NOFOLLOW on discard, and an unlink before both the redirect and the cp in the jj helper.

The reachable case was an unmarked symlink in a jj review: unmarked files are never read from the working copy, so no staleness check runs, yet the file still becomes a restore instruction.

Pin the CI supply chain (.github/workflows/ci.yml)

CI passes GITHUB_TOKEN to a step, and three gaps compounded: no permissions block, both actions on floating tags that can be retagged onto attacker code, and a jj tarball installed as root with no pinned version or digest. Now contents: read, actions pinned to commit SHAs, and jj pinned to v0.44.0 against a recorded SHA-256. jj publishes no checksum file, so the digest was recorded by hand — it catches a later swap of the asset, it does not attest the build.

Add Renovate (renovate.json5, package.json)

Hosted Renovate app, scoped to npm devDependencies and GitHub Actions. config:best-practipinGitHubActionDigests` — the SHAs pinned above are otherwise frozen forever, giving us
the supply-chain benefit and none of the security updates.

@types/bun: latest and typescript: ^5 are pinned first, because Renovate can act on neither: latest is a dist-tag, and every 5.x already satisfies ^5. Both are set to the versions bun.lock already resolved, so nothing installs differently.

A 7-day cooldown (minimumReleaseAge + internalChecksFilter: strict — the first alone s automerge fire unreviewed) holds back fresh uploads. Security fixes bypass it, or the
setting would delay CVE patches and make us less safe. hunkdiff never automerges: it's erased at compile time andbun test` gives zero signal on a bump.

Also

Beads issue tracking, .perles/config.yaml, and CLAUDE.md for agent context.