[liususan091219]

Summary

Addresses the 10 CodeQL alerts that remained after PR #68.

Path traversal (agent-api.py) — alerts #2-7, #14

• Add _safe_path() helper that combines _safe_id() sanitization with resolve() + is_relative_to() validation
• All file access now goes through _safe_path() instead of constructing paths directly from user input
• Media endpoint: replace mimetypes.guess_type() with a fixed SAFE_TYPES allowlist (eliminates HTTP response splitting vector)
• Media path: add strict character allowlist ([a-zA-Z0-9_./-]) before resolving

HTTP response splitting (agent-api.py) — alert #1

• Eliminated by replacing dynamic mime type guessing with fixed allowlist

Clear-text logging (conversation-server.ts) — alert #15

• Replace regex phone masking with simple *** + last 4 digits (CodeQL-friendly)

Reflected XSS (conversation-server.ts) — alert #13

• This is a false positive: twimlResponse() sends XML to Twilio's server, not a browser. All interpolated values already use esc() for XML escaping. May need CodeQL suppression comment if alert persists.

Test plan

• python3 -c "import py_compile; py_compile.compile('src/agent-api.py', doraise=True)" — syntax check passes
• Verify CodeQL alerts resolve after merge: gh api repos/sonichi/sutando/code-scanning/alerts --jq '[.[] | select(.state == "open")] | length'

🤖 Generated with Claude Code

[sonichi]

LGTM — solid security hardening.

Reviewed each change:

• _safe_path(): correct defense-in-depth (sanitize + resolve + is_relative_to). Minor: docstring says returns None but type hint is Path (cosmetic).
• SAFE_TYPES mime allowlist: reasonable coverage, eliminates response splitting. Note: .html/.js/.svg could be XSS vectors if repo contains attacker-influenced files — low risk for local agent.
• Media endpoint: null byte rejection + strict character allowlist + no silent mutation. Solid.
• Answer task file write: now validates resolved path stays within tasks/. Good.
• conversation-server.ts: handles undefined TWILIO_PHONE_NUMBER gracefully.

No regressions. Ship it.