fix: CI pip install failure + 2 bandit security issues

- Remove pysqlite3 from [dev] deps (caused pip resolution failure on CI;
  keep in [graphqlite] where it belongs; code already handles import error)
- Fix B324: add usedforsecurity=False to hashlib.md5() call
- Fix B202: add safe member validation to tarfile.extractall()
  (use filter='data' on Python 3.12+, manual validation on older)

Author: johnteee

pyproject.toml

@@ -96,8 +96,7 @@ github = [
     "PyGithub>=2.0.0",
 ]
 dev = [
-    "graphqlite>=0.6.0",
-    "pysqlite3>=0.6.0",
+    "teaagent[graphqlite]",
     "teaagent[crypto]",
     "watchdog>=3.0.0",
     "prompt-toolkit>=3.0.0",

teaagent/subagents/_feature_flags.py

@@ -183,7 +183,9 @@ def should_use_hybrid_queue(self, request_id: str) -> bool:
         # Use consistent hashing based on request_id
         import hashlib
 
-        hash_value = int(hashlib.md5(request_id.encode()).hexdigest(), 16)
+        hash_value = int(
+            hashlib.md5(request_id.encode(), usedforsecurity=False).hexdigest(), 16
+        )
         threshold = (rollout_percentage / 100) * (2**32)
         return hash_value % (2**32) < threshold
 

teaagent/update/installer.py

@@ -11,6 +11,8 @@
 import hashlib
 import json
 import shutil
+import sys
+import tarfile
 import tempfile
 from dataclasses import dataclass, field
 from enum import Enum
@@ -160,6 +162,18 @@ def verify_checksum(self, file_path: Path, expected_checksum: str) -> bool:
         return sha256_hash.hexdigest() == expected_checksum
 
 
+def _safe_extract(tar: tarfile.TarFile, path: Path) -> None:
+    """Extract tar safely, preventing path traversal."""
+    for member in tar.getmembers():
+        member_path = (path.resolve() / member.name).resolve()
+        if not str(member_path).startswith(str(path.resolve())):
+            raise tarfile.ExtractError(
+                f'Unsafe tar member: {member.name} would escape {path}'
+            )
+    # bandit B202: members validated above — safe to extract
+    tar.extractall(path)  # nosec
+
+
 class UpdateInstaller:
     """Installer for update packages."""
 
@@ -221,10 +235,11 @@ def install_package(
 
         try:
             # Extract package (placeholder - assumes tar.gz)
-            import tarfile
-
             with tarfile.open(package_path, 'r:gz') as tar:
-                tar.extractall(self.install_dir)
+                if sys.version_info >= (3, 12):
+                    tar.extractall(self.install_dir, filter='data')
+                else:
+                    _safe_extract(tar, self.install_dir)
 
             if progress_callback:
                 progress_callback(75)