3 commits

Author	SHA1	Message	Date
Athena	f28259bb13	fix(bugseti): sanitize shell metacharacters in seeder env vars ... SanitizeEnv() only removed control characters but not shell metacharacters. A malicious repo name could execute arbitrary commands via environment variable injection (e.g. backticks, $(), semicolons). Add stripShellMeta() to strip backticks, dollar signs, semicolons, pipes, ampersands, and other shell-significant characters from values passed to the bash seed script environment. Fixes #59 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-16 05:53:52 +00:00
Snider	00c011bd39	feat(bugseti): add marketplace MCP root ... - add MarketplaceMCPRoot config and UI setting\n- prefer config root before env or auto-discovery\n- thread config root into ethics guard usage	2026-02-05 22:07:24 +00:00
Snider	2a8963ffdf	feat(bugseti): integrate marketplace MCP ... - add MCP marketplace client for plugin/ethics discovery\n- resolve seed-agent-developer via marketplace and sanitize context\n- apply ethics guardrails for notifications and PR metadata\n- add bugseti tests for sanitization and skill lookup\n- include mcp-go dependency for BugSETI	2026-02-05 21:36:33 +00:00