Joseph O'Brien
55d68ee92f
fix: address security findings from devkit-review (#1–#7)
notsecrets:
- install_age_key_at: create key file with mode 0600 via OpenOptions,
eliminating TOCTOU window where file was transiently world-readable (#3)
- sops_args: extract arg-builder and add -- separator before path,
preventing leading-dash flag injection (#2)
- use .context() instead of .with_context(closure) for string literal (#7)
notstrap:
- extract parse_env_line: validates env lines before set_var — rejects
null bytes (#4) and blocks dangerous keys (LD_PRELOAD, PATH, etc.) (#5)
- wire parse_env_line into injection loop; errors abort the step cleanly
- correct SAFETY comment: documents single-threaded invariant and notes
that subsequent spawns inherit injected env (#6)
Tests: 12 new tests covering all fixes; workspace grows from 44 to 56 passing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>