Fix five code-review bugs (#37–#41)

[TYRMars]

Resolves the five open code-review bugs. Each fix is targeted and ships a regression test.

#37 — Security: arbitrary command execution via unvalidated git-include URL

• New validate_git_url rejects git's remote-helper transport syntax (ext::, fd::, any <name>::<addr>), leading -, and control chars — while still allowing normal https/ssh/git/file URLs, scp-like git@host:path, and plain local paths (which git clones over the safe local transport, and which existing tests rely on).
• Applied at IncludeDirective::parse_target (dangerous directives never parse into a GitUrl) and in git_clone (defence in depth, plus a -- separator before the URL).
• run_git now exports GIT_ALLOW_PROTOCOL=https:ssh:git:file so git itself refuses command-executing transports even if a bad URL slipped through.
• The same validator replaces the leading---only check in memory_sync's remote_url.

#38 — Panic: byte-slice truncation in GET /v1/tasks

• Subagent task labels are now truncated by char count (chars().take(47)), not a raw byte slice, so multibyte (CJK/emoji) task names >48 bytes no longer panic — and no longer take down the WS socket via the turn-terminal handler.

#39 — Streaming agent loop: terminal tool orphans sibling tool_calls / dangles ToolStart

• Sequential path: on a terminal tool, synthesize a tool cancelled: … tool_result for every unprocessed sibling before returning, so the persisted conversation has a reply for every tool_call id (no more provider 400 on resume).
• Parallel path: track which ToolEnds genuinely fired and emit a closing ToolEnd for any call cancelled in-flight, so no ToolStart is left dangling on the wire.

#40 — fs.patch: disk-commit phase not atomic on I/O failure

• The commit phase now snapshots each target's prior content, then rolls back every already-committed write/delete on any mid-batch I/O error, honouring the "atomic per call" contract. Error message reports whether rollback was complete.

#41 — SummarizingMemory: summary inserted out of chronological order under cache breakpoint

• The summary is now placed at the chronological position of the dropped turns. On the cache-breakpoint path (non-contiguous kept set: cached prefix + recent tail with a hole), the summary sits between the cached prefix and the recent tail instead of before the cached prefix.

Testing

• cargo clippy -p harness-core -p harness-tools -p harness-memory -p harness-server --all-targets -- -D warnings — clean.
• New regression tests: validate_git_url_* / parse_target_drops_command_executing_git_transport / sync_setup_rejects_command_executing_transport (Security: arbitrary command execution via unvalidated git URL in memory-include directives #37), multibyte_task_name_does_not_panic (Panic: byte-slice truncation in GET /v1/tasks crashes request and WS socket on multibyte task names #38), streaming_terminal_tool_fills_sibling_results_and_pairs_events (Streaming agent loop: terminal tool in a multi-call batch orphans sibling tool_calls / dangles ToolStart events #39), phase_two_io_failure_rolls_back_committed_writes (fs.patch: disk-commit phase is not atomic on I/O failure, leaving a partial multi-file write #40), breakpoint_summary_sits_between_cached_prefix_and_recent_tail (SummarizingMemory: summary of dropped 'hole' turns is inserted out of chronological order under cache breakpoint #41).
• Affected-crate lib tests pass (+5 vs baseline, no regressions). The only failing tests are pre-existing environmental ones in memory_include/memory_sync that perform real git commit/push — they fail on baseline too because the sandbox's commit-signing hook returns HTTP 400.

Closes #37, closes #38, closes #39, closes #40, closes #41.

https://claude.ai/code/session_013gxHmLU1sk8WabMxPvMRf7

---

Generated by Claude Code