fix: consolidated security and robustness improvements

[echobt]

Summary

This PR consolidates 4 security and robustness fixes into a single, cohesive change.

Included PRs:

• fix(shell-snapshot): prevent shell injection in restore_script via path escaping #74: Prevent shell injection in restore_script via path escaping
• fix(exec): replace unsafe unwrap() with expect() in init_client #76: Replace unsafe unwrap() with expect() in init_client
• fix(tui): use secure random temp files in external editor to prevent symlink attacks #78: Use secure random temp files in external editor to prevent symlink attacks
• fix(exec): add per-chunk streaming timeout to prevent indefinite hangs #79: Add per-chunk streaming timeout to prevent indefinite hangs

Key Changes:

• Added shell escaping for paths in shell-snapshot restore scripts to prevent injection
• Replaced unwrap() with expect() for better error context in exec runner
• Use secure random temp files instead of predictable names to prevent symlink attacks
• Added streaming chunk timeout to prevent indefinite hangs during LLM responses

Files Modified:

• src/cortex-shell-snapshot/src/snapshot.rs
• src/cortex-exec/src/runner.rs
• src/cortex-tui/Cargo.toml
• src/cortex-tui/src/external_editor.rs

Closes #74, #76, #78, #79

[greptile-apps]

Greptile Overview

Greptile Summary

This PR consolidates four well-implemented security and robustness improvements into a single cohesive change.

Key improvements:

• Shell injection prevention: Added proper path escaping in snapshot restore scripts using the '\"'\"' technique for single quotes, with comprehensive test coverage
• Better error context: Replaced unwrap() with expect() providing clear error message
• Symlink attack prevention: Migrated from predictable temp filenames to cryptographically secure random names using the tempfile crate with O_EXCL and restricted permissions
• Streaming timeout: Added 30-second per-chunk timeout to prevent indefinite hangs when LLM connections stall mid-stream

All changes are well-documented, include appropriate tests, and follow Rust security best practices.

Confidence Score: 5/5

• Safe to merge - all changes are security improvements with proper test coverage
• All four security fixes are correctly implemented, well-tested, and use industry-standard approaches (shell escaping, expect over unwrap, tempfile crate, streaming timeouts)
• No files require special attention

Important Files Changed

Filename	Overview
src/cortex-shell-snapshot/src/snapshot.rs	added shell_escape_path function to prevent shell injection in restore scripts, with comprehensive test coverage
src/cortex-exec/src/runner.rs	replaced unwrap with expect for better error context, added per-chunk streaming timeout to prevent indefinite hangs
src/cortex-tui/src/external_editor.rs	replaced predictable temp filenames with secure random temp files using tempfile crate to prevent symlink attacks
src/cortex-tui/Cargo.toml	added tempfile dependency for secure temp file creation

Sequence Diagram

sequenceDiagram
    participant User
    participant TUI as Cortex TUI
    participant ExecRunner
    participant ShellSnapshot
    participant LLMProvider
    participant TempFile as Temp File System

    Note over User,TempFile: Security Improvements in Action

    User->>TUI: Press Ctrl+G for external editor
    TUI->>TempFile: Create secure temp file<br/>(random 16-byte suffix)
    TempFile-->>TUI: Secure file handle with O_EXCL
    Note over TUI,TempFile: Prevents symlink attacks
    TUI->>TUI: Open editor with temp file
    User->>TUI: Edit and save content
    TUI->>TempFile: Read edited content
    TUI->>TempFile: Delete temp file securely

    User->>ExecRunner: Execute LLM request
    ExecRunner->>ExecRunner: init_client()
    Note over ExecRunner: Uses expect() for<br/>better error context
    ExecRunner->>LLMProvider: Start streaming request
    
    loop For each chunk (30s timeout)
        LLMProvider->>ExecRunner: Stream response chunk
        Note over ExecRunner,LLMProvider: Per-chunk timeout<br/>prevents indefinite hangs
        ExecRunner->>ExecRunner: Process chunk
    end
    
    LLMProvider->>ExecRunner: Complete response
    ExecRunner->>ShellSnapshot: Generate restore script
    ShellSnapshot->>ShellSnapshot: shell_escape_path()
    Note over ShellSnapshot: Escapes single quotes<br/>using '"'"' technique
    ShellSnapshot-->>ExecRunner: Safe shell script
    ExecRunner-->>User: Return result

Loading

[greptile-apps]

_{4 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[echobt]

Closing this PR to consolidate into a single mega-PR combining all bug fixes. The changes will be included in a new consolidated PR.