Fix server subprocess command boundary

src/github_repo_auditor/serve/routes.py

@@ -407,6 +407,7 @@ def _render_action_row(packet_id: str, idx: int, action: dict[str, Any]) -> str:
     target = _escape(action.get("target") or "—")
     rationale = _escape(action.get("rationale") or "—")
     safe_packet_id = _escape(packet_id)
+    safe_idx = _escape(idx)
 
     if state == "approved":
         state_cell = '<span class="badge badge-approved">&#10003; Approved</span>'
@@ -422,16 +423,16 @@ def _render_action_row(packet_id: str, idx: int, action: dict[str, Any]) -> str:
         state_cell = '<span class="badge badge-pending">Pending</span>'
         buttons = (
             f'<button class="btn-approve" '
-            f'hx-post="/approvals/{safe_packet_id}/actions/{idx}/approve" '
+            f'hx-post="/approvals/{safe_packet_id}/actions/{safe_idx}/approve" '
             f'hx-target="closest tr" hx-swap="outerHTML">&#10003; Approve</button> '
             f'<button class="btn-reject" '
-            f'hx-post="/approvals/{safe_packet_id}/actions/{idx}/reject" '
+            f'hx-post="/approvals/{safe_packet_id}/actions/{safe_idx}/reject" '
             f'hx-target="closest tr" hx-swap="outerHTML">&#10007; Reject</button>'
         )
         row_class = "campaign-plan__row--pending"
 
     return (
-        f'<tr class="{row_class}" id="action-row-{idx}">'
+        f'<tr class="{row_class}" id="action-row-{safe_idx}">'
         f"<td><code>{repo}</code></td>"
         f'<td><span class="campaign-plan__action-type">{action_type}</span></td>'
         f"<td>{target}</td>"
@@ -469,8 +470,6 @@ async def approve_campaign_action(request: Request, packet_id: str, idx: int) ->
     except Exception:
         action_dict = {"state": "approved"}
 
-    # Dynamic values are escaped in _render_action_row before fragment emission.
-    # codeql[py/reflective-xss]
     return HTMLResponse(_render_action_row(packet_id, idx, action_dict))
 
 
@@ -505,8 +504,6 @@ async def reject_campaign_action(
     except Exception:
         action_dict = {"state": "rejected"}
 
-    # Dynamic values are escaped in _render_action_row before fragment emission.
-    # codeql[py/reflective-xss]
     return HTMLResponse(_render_action_row(packet_id, idx, action_dict))
 
 

src/github_repo_auditor/serve/runner.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import re
 import subprocess
 import sys
@@ -43,9 +44,13 @@
 class RunSession:
     """Holds state for one spawned audit subprocess."""
 
-    def __init__(self, run_id: str, cmd: list[str]) -> None:
+    def __init__(self, run_id: str, username: str, flag_args: list[str]) -> None:
         self.run_id = run_id
-        self.cmd = cmd
+        # Keep the OS command line constant. Form-derived values are supplied
+        # to the worker over stdin and become parser arguments only inside the
+        # child process; they never participate in process creation.
+        self.cmd = (sys.executable, "-m", "github_repo_auditor.serve.worker")
+        self._request = {"username": username, "flag_args": flag_args}
         self._lines: deque[str] = deque(maxlen=_MAX_LINES)
         self._lock = threading.Lock()
         self._done = threading.Event()
@@ -68,15 +73,16 @@ def _stream(self) -> None:
 
     def start(self) -> None:
         self._proc = subprocess.Popen(
-            # Command shape is fixed in spawn_run: sys.executable, module name,
-            # validated GitHub owner, and allowlisted flags; shell remains off.
-            # codeql[py/command-line-injection]
             self.cmd,
+            stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             text=True,
             shell=False,  # never shell=True
         )
+        assert self._proc.stdin is not None
+        self._proc.stdin.write(json.dumps(self._request))
+        self._proc.stdin.close()
         t = threading.Thread(target=self._stream, daemon=True)
         t.start()
 
@@ -145,8 +151,7 @@ def spawn_run(username: str, flags: dict[str, str | bool], output_dir: Path) ->
     safe_username = validate_username(username)
     flag_args = validate_flags(flags)
     run_id = uuid.uuid4().hex
-    cmd = [sys.executable, "-m", "github_repo_auditor.cli", safe_username, *flag_args]
-    session = RunSession(run_id=run_id, cmd=cmd)
+    session = RunSession(run_id=run_id, username=safe_username, flag_args=flag_args)
     with _registry_lock:
         _registry[run_id] = session
     session.start()

src/github_repo_auditor/serve/worker.py

@@ -0,0 +1,37 @@
+"""Fixed-command worker for server-triggered local audits."""
+
+from __future__ import annotations
+
+import json
+import sys
+from typing import Any
+
+from github_repo_auditor.serve.runner import validate_username
+
+
+def _load_request() -> tuple[str, list[str]]:
+    payload: Any = json.load(sys.stdin)
+    if not isinstance(payload, dict):
+        raise ValueError("run request must be an object")
+
+    username = payload.get("username")
+    flag_args = payload.get("flag_args")
+    if not isinstance(username, str) or not isinstance(flag_args, list):
+        raise ValueError("run request has an invalid shape")
+    if not all(isinstance(value, str) for value in flag_args):
+        raise ValueError("run request flags must be strings")
+    return validate_username(username), flag_args
+
+
+def main() -> None:
+    username, flag_args = _load_request()
+    # The child invokes the Python entry point directly. The values are parser
+    # arguments here, not an OS command line supplied to subprocess.Popen.
+    sys.argv = ["audit", username, *flag_args]
+    from github_repo_auditor.cli import main as cli_main
+
+    cli_main()
+
+
+if __name__ == "__main__":
+    main()

tests/test_serve.py

@@ -4,6 +4,7 @@
 
 import json
 import sqlite3
+import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
@@ -536,6 +537,60 @@
         assert "text/event-stream" in resp.headers["content-type"]
 
 
+class TestRunnerCommandBoundary:
+    def test_form_values_are_not_embedded_in_worker_command(self, output_dir: Path) -> None:
+        from github_repo_auditor.serve import runner as runner_mod
+        from github_repo_auditor.serve.runner import spawn_run
+
+        with patch.object(runner_mod.RunSession, "start"):
+            run_id = spawn_run(
+                username="octo-org",
+                flags={"output-dir": "user-controlled-output"},
+                output_dir=output_dir,
+            )
+
+        session = runner_mod.get_session(run_id)
+        assert session is not None
+        assert session.cmd == (
+            sys.executable,
+            "-m",
+            "github_repo_auditor.serve.worker",
+        )
+        assert "octo-org" not in session.cmd
+        assert "user-controlled-output" not in session.cmd
+
+    def test_worker_passes_payload_to_cli_inside_child_process(self, monkeypatch) -> None:
+        from io import StringIO
+
+        import github_repo_auditor.cli as cli
+        from github_repo_auditor.serve import worker
+
+        monkeypatch.setattr(
+            worker.sys,
+            "stdin",
+            StringIO(
+                json.dumps(
+                    {
+                        "username": "octo-org",
+                        "flag_args": ["--portfolio-truth", "--output-dir", "safe-output"],
+                    }
+                )
+            ),
+        )
+        captured: dict[str, list[str]] = {}
+        monkeypatch.setattr(cli, "main", lambda: captured.setdefault("argv", list(sys.argv)))
+
+        worker.main()
+
+        assert captured["argv"] == [
+            "audit",
+            "octo-org",
+            "--portfolio-truth",
+            "--output-dir",
+            "safe-output",
+        ]
+
+
 # ---------------------------------------------------------------------------
 # Runner unit tests
 # ---------------------------------------------------------------------------