fix(cli): bound local inputs and redact paths (signed DCO)

Merged
TH
11d ago
+51-11

Signed, DCO-compliant replacement for PR #203 — issue #202

This is a new single signed commit from the unchanged protected V2 main f82565cca917d119e1c774b2c470e2ac20e0d6dd. The original PR #203 is technically qualified but has unsigned GitHub-API-created commit history. This candidate reproduces its identical Git content tree, without force-push, rebasing, history rewriting, changing FHIR semantics or touching protected rules.

  • Signed commit: f297bce8ab314e44cc895ecba34319069ab4142f, live GitHub API verification.verified=true, reason=valid.
  • DCO: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Exact content tree: dd13f88404292d3b7d9caa420d5ae985073798fa (byte-identical to old PR #203 head).
  • Parent: f82565cca917d119e1c774b2c470e2ac20e0d6dd.
  • Windows evidence: verified online Abdulaziz device, temporary shallow checkout from canonical main, fetched immutable original PR head, git apply --check, git diff --cached --check, cargo fmt --all -- --check PASS; exact git write-tree equality checked before and after git commit -S -s. Pushed one new branch with normal Git push; original worktree not modified. Original GitHub CLI account restored.

Scope

Keep JSON/lockfile CLI reads bounded and fail early on known oversized local files; keep post-metadata growth probe. Remove host-absolute path from the oversized JSON diagnostic. Regression test checks actual GitHub annotations CLI and sparse lockfile behavior.

Mandatory remaining gates

The original PR #203 had 15/15 technical SUCCESS at its own SHA; that does not qualify this new commit. Run all exact-head GitHub required checks independently on f297bce8ab314e44cc895ecba34319069ab4142f and acquire one genuine independent eligible human Code Owner APPROVED review after the last push, resolve review threads, normal merge commit, then verify fresh-main CI. Do not treat bot COMMENTED/NEUTRAL or the user's generic continuation as approval or FD-1/FD-2 exception. Keep issue #202 open until actually merged and proven on main. Full consumer contract decision and signed/atomic receipts remain separate unfinished work.

Summary by cubic

CLI input reads now reject oversized JSON and lockfiles based on file metadata, while retaining a streaming check for files that grow during reading. Oversize diagnostics no longer reveal host paths.

  • Adds regression tests for sparse oversized lockfiles and GitHub annotation path redaction.