AI-2134: 阶段1 — 用 bug-hunter 给真实开源项目提 1 个 PR

[Harukaon]

Linear Issue

https://linear.app/feedmob/issue/AI-2134

Summary

验证闭环跑通。找到未认领的 bug → 修复 → 提 PR → 回写 Linear。

This GitHub issue mirrors progress from Linear AI-2134.
GitHub cannot track status/priority — Linear is the source of truth.

[Harukaon]

🚀 Starting work (mirrored from Linear AI-2134)

• Repo: https://github.com/RachelXiaolan/ticket-pilot
• Strategy: bug-hunter Approach B (direct source audit)
• Targets: bare except, .strip() misuse, missing await, resource leaks, path concat, boundary conditions, file perms
• Fork: https://github.com/Harukaon/ticket-pilot
• Next: scan codebase, fix first real bug, open PR

[Harukaon]

✅ PR opened (mirrored from Linear AI-2134)

• PR: AI-2134 Validate issue_id and --root in init_task_record.py to block path traversal RachelXiaolan/ticket-pilot#3
• Branch: linear/ai-2134-fix-init-task-record-path-validation
• Files: scripts/init_task_record.py, tests/test_init_task_record.py, `CHANGELOG.md"

Bug fixed

scripts/init_task_record.py accepted arbitrary strings for issue_id and --root, then composed them with Path(...). Allowed path traversal, absolute paths, empty strings, and whitespace/shell-metacharacter values.

Fix

• New _validate_issue_id() requires <TEAM_KEY>-<NUMBER> (e.g. AI-2134), rejects whitespace / path separators / shell metacharacters, normalizes to uppercase.
• New _validate_root() requires relative path with no .. segments.
• Re-resolves task dir and verifies it stays under the artifact root before creating anything.
• Exits with code 2 on invalid input.

Verification

python3 -m unittest tests/test_init_task_record.py -v
# Ran 18 tests in 0.131s — OK