fix: remove eval, quote vars, use mktemp in absolute-zero shell scripts

verify-proofs.sh: eval→array execution, hardcoded /tmp→mktemp+trap
run-local-verification.sh: eval→array execution, hardcoded /tmp→mktemp+trap
setup-and-verify.sh: quoted 26 variable expansions, command -v "$1"

Detected by panic-attack assail batch scan (2026-03-30).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

absolute-zero/run-local-verification.sh

@@ -26,6 +26,10 @@ PASSED_CHECKS=0
 FAILED_CHECKS=0
 SKIPPED_CHECKS=0
 
+# Create a secure temporary directory for check logs
+TMPDIR_CHECKS="$(mktemp -d)"
+trap 'rm -rf "${TMPDIR_CHECKS}"' EXIT
+
 # Function to check if command exists
 command_exists() {
     command -v "$1" >/dev/null 2>&1
@@ -34,18 +38,21 @@ command_exists() {
 # Function to run a check
 run_check() {
     local name="$1"
-    local command="$2"
+    shift
+    local check_cmd=("$@")
     TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
 
-    echo -n "[$TOTAL_CHECKS] $name... "
-    if eval "$command" > /tmp/absolute-zero-check-$TOTAL_CHECKS.log 2>&1; then
+    local log_file="${TMPDIR_CHECKS}/check-${TOTAL_CHECKS}.log"
+
+    echo -n "[${TOTAL_CHECKS}] ${name}... "
+    if "${check_cmd[@]}" > "${log_file}" 2>&1; then
         echo -e "${GREEN}PASS${NC}"
         PASSED_CHECKS=$((PASSED_CHECKS + 1))
         return 0
     else
         echo -e "${RED}FAIL${NC}"
         FAILED_CHECKS=$((FAILED_CHECKS + 1))
-        echo "    Error log: /tmp/absolute-zero-check-$TOTAL_CHECKS.log"
+        echo "    Error log: ${log_file}"
         return 1
     fi
 }
@@ -56,7 +63,7 @@ skip_check() {
     local reason="$2"
     TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
     SKIPPED_CHECKS=$((SKIPPED_CHECKS + 1))
-    echo -e "[$TOTAL_CHECKS] $name... ${YELLOW}SKIP${NC} ($reason)"
+    echo -e "[${TOTAL_CHECKS}] ${name}... ${YELLOW}SKIP${NC} (${reason})"
 }
 
 echo "==== Tool Availability Check ===="
@@ -112,35 +119,35 @@ echo "==== Running Verification ===="
 echo ""
 
 # Z3 SMT Verification
-if [ $Z3_AVAILABLE -eq 1 ]; then
+if [ "${Z3_AVAILABLE}" -eq 1 ]; then
     echo "---- Z3 SMT Solver ----"
-    run_check "Z3: CNO Properties" "z3 proofs/z3/cno_properties.smt2"
+    run_check "Z3: CNO Properties" z3 proofs/z3/cno_properties.smt2
     echo ""
 else
     skip_check "Z3: CNO Properties" "z3 not installed"
     echo ""
 fi
 
 # Coq Verification
-if [ $COQ_AVAILABLE -eq 1 ]; then
+if [ "${COQ_AVAILABLE}" -eq 1 ]; then
     echo "---- Coq Proof Assistant ----"
-    run_check "Coq: Phase 1 Core (CNO.v)" "coqc -Q proofs/coq/common CNO proofs/coq/common/CNO.v"
-    run_check "Coq: Statistical Mechanics" "coqc -Q proofs/coq/common CNO -Q proofs/coq/physics Physics proofs/coq/physics/StatMech.v"
-    run_check "Coq: Category Theory" "coqc -Q proofs/coq/common CNO -Q proofs/coq/category Category proofs/coq/category/CNOCategory.v"
-    run_check "Coq: Lambda Calculus" "coqc -Q proofs/coq/common CNO -Q proofs/coq/lambda Lambda proofs/coq/lambda/LambdaCNO.v"
-    run_check "Coq: Quantum CNO" "coqc -Q proofs/coq/common CNO -Q proofs/coq/quantum Quantum proofs/coq/quantum/QuantumCNO.v"
-    run_check "Coq: Filesystem CNO" "coqc -Q proofs/coq/common CNO -Q proofs/coq/filesystem Filesystem proofs/coq/filesystem/FilesystemCNO.v"
+    run_check "Coq: Phase 1 Core (CNO.v)" coqc -Q proofs/coq/common CNO proofs/coq/common/CNO.v
+    run_check "Coq: Statistical Mechanics" coqc -Q proofs/coq/common CNO -Q proofs/coq/physics Physics proofs/coq/physics/StatMech.v
+    run_check "Coq: Category Theory" coqc -Q proofs/coq/common CNO -Q proofs/coq/category Category proofs/coq/category/CNOCategory.v
+    run_check "Coq: Lambda Calculus" coqc -Q proofs/coq/common CNO -Q proofs/coq/lambda Lambda proofs/coq/lambda/LambdaCNO.v
+    run_check "Coq: Quantum CNO" coqc -Q proofs/coq/common CNO -Q proofs/coq/quantum Quantum proofs/coq/quantum/QuantumCNO.v
+    run_check "Coq: Filesystem CNO" coqc -Q proofs/coq/common CNO -Q proofs/coq/filesystem Filesystem proofs/coq/filesystem/FilesystemCNO.v
     echo ""
 else
     skip_check "Coq: All proofs" "coqc not installed"
     echo ""
 fi
 
 # Lean 4 Verification
-if [ $LEAN_AVAILABLE -eq 1 ]; then
+if [ "${LEAN_AVAILABLE}" -eq 1 ]; then
     echo "---- Lean 4 Proof Assistant ----"
     if [ -f "proofs/lean4/lakefile.lean" ]; then
-        run_check "Lean 4: Build all proofs" "cd proofs/lean4 && lake build"
+        run_check "Lean 4: Build all proofs" bash -c "cd proofs/lean4 && lake build"
     else
         skip_check "Lean 4: Build all proofs" "lakefile.lean not found"
     fi
@@ -151,19 +158,19 @@ else
 fi
 
 # Agda Verification
-if [ $AGDA_AVAILABLE -eq 1 ]; then
+if [ "${AGDA_AVAILABLE}" -eq 1 ]; then
     echo "---- Agda Proof Assistant ----"
-    run_check "Agda: CNO Core" "agda proofs/agda/CNO.agda"
+    run_check "Agda: CNO Core" agda proofs/agda/CNO.agda
     echo ""
 else
     skip_check "Agda: CNO Core" "agda not installed"
     echo ""
 fi
 
 # Isabelle Verification
-if [ $ISABELLE_AVAILABLE -eq 1 ]; then
+if [ "${ISABELLE_AVAILABLE}" -eq 1 ]; then
     echo "---- Isabelle/HOL ----"
-    run_check "Isabelle: CNO Theory" "isabelle build -d proofs/isabelle -b CNO"
+    run_check "Isabelle: CNO Theory" isabelle build -d proofs/isabelle -b CNO
     echo ""
 else
     skip_check "Isabelle: CNO Theory" "isabelle not installed"
@@ -175,22 +182,22 @@ echo "========================================"
 echo "Verification Summary"
 echo "========================================"
 echo ""
-echo "Total checks: $TOTAL_CHECKS"
-echo -e "${GREEN}Passed: $PASSED_CHECKS${NC}"
-echo -e "${RED}Failed: $FAILED_CHECKS${NC}"
-echo -e "${YELLOW}Skipped: $SKIPPED_CHECKS${NC}"
+echo "Total checks: ${TOTAL_CHECKS}"
+echo -e "${GREEN}Passed: ${PASSED_CHECKS}${NC}"
+echo -e "${RED}Failed: ${FAILED_CHECKS}${NC}"
+echo -e "${YELLOW}Skipped: ${SKIPPED_CHECKS}${NC}"
 echo ""
 
-if [ $FAILED_CHECKS -eq 0 ] && [ $PASSED_CHECKS -gt 0 ]; then
+if [ "${FAILED_CHECKS}" -eq 0 ] && [ "${PASSED_CHECKS}" -gt 0 ]; then
     echo -e "${GREEN}✓ All available verifications passed!${NC}"
     exit 0
-elif [ $PASSED_CHECKS -eq 0 ]; then
+elif [ "${PASSED_CHECKS}" -eq 0 ]; then
     echo -e "${YELLOW}⚠ No verification tools available locally${NC}"
     echo "Consider installing: coqc, z3, lean, agda, isabelle"
     echo "Or run: podman build -t absolute-zero . && podman run --rm absolute-zero ./verify-proofs.sh"
     exit 2
 else
     echo -e "${RED}✗ Some verifications failed${NC}"
-    echo "Check error logs in /tmp/absolute-zero-check-*.log"
+    echo "Check error logs in ${TMPDIR_CHECKS}/"
     exit 1
 fi

absolute-zero/setup-and-verify.sh

@@ -14,7 +14,7 @@ export GIT_DISCOVERY_ACROSS_FILESYSTEM=1
 cd "$(dirname "$0")"
 REPO_ROOT=$(pwd)
 
-echo "Repository root: $REPO_ROOT"
+echo "Repository root: ${REPO_ROOT}"
 echo ""
 
 # ============================================================================
@@ -75,11 +75,11 @@ echo "=== Step 3: Tool Availability ==="
 echo ""
 
 check_tool() {
-    if command -v $1 &> /dev/null; then
-        echo "✓ $1: $(command -v $1)"
+    if command -v "$1" &> /dev/null; then
+        echo "✓ $1: $(command -v "$1")"
         return 0
     else
-        echo "✗ $1: NOT FOUND"
+        echo "✗ ${1}: NOT FOUND"
         return 1
     fi
 }
@@ -117,7 +117,7 @@ fi
 
 echo ""
 
-if [ ${#MISSING_TOOLS[@]} -gt 0 ]; then
+if [ "${#MISSING_TOOLS[@]}" -gt 0 ]; then
     echo "❌ Missing REQUIRED tools: ${MISSING_TOOLS[*]}"
     echo ""
     echo "Install with:"
@@ -132,7 +132,7 @@ if [ ${#MISSING_TOOLS[@]} -gt 0 ]; then
     echo ""
 fi
 
-if [ ${#OPTIONAL_TOOLS[@]} -gt 0 ]; then
+if [ "${#OPTIONAL_TOOLS[@]}" -gt 0 ]; then
     echo "ℹ️  Missing OPTIONAL tools: ${OPTIONAL_TOOLS[*]}"
     echo ""
     echo "Install with:"
@@ -159,43 +159,43 @@ echo "Coq proofs:"
 COQC_TOTAL=$(find proofs/coq -name "*.v" -exec grep -h "^Theorem\|^Lemma\|^Corollary" {} \; 2>/dev/null | wc -l)
 COQC_ADMITTED=$(grep -r "Admitted\." proofs/coq/ 2>/dev/null | wc -l)
 COQC_PROVEN=$((COQC_TOTAL - COQC_ADMITTED))
-if [ $COQC_TOTAL -gt 0 ]; then
+if [ "${COQC_TOTAL}" -gt 0 ]; then
     COQC_PERCENT=$((COQC_PROVEN * 100 / COQC_TOTAL))
 else
     COQC_PERCENT=0
 fi
 
-echo "  Total theorems: $COQC_TOTAL"
-echo "  Proven: $COQC_PROVEN"
-echo "  Admitted: $COQC_ADMITTED"
-echo "  Completion: $COQC_PERCENT%"
+echo "  Total theorems: ${COQC_TOTAL}"
+echo "  Proven: ${COQC_PROVEN}"
+echo "  Admitted: ${COQC_ADMITTED}"
+echo "  Completion: ${COQC_PERCENT}%"
 echo ""
 
 # Count Lean theorems and sorry
 echo "Lean 4 proofs:"
 LEAN_TOTAL=$(find proofs/lean4 -name "*.lean" -exec grep -h "^theorem\|^lemma" {} \; 2>/dev/null | wc -l)
 LEAN_SORRY=$(grep -r "sorry" proofs/lean4/ 2>/dev/null | wc -l)
 LEAN_PROVEN=$((LEAN_TOTAL - LEAN_SORRY))
-if [ $LEAN_TOTAL -gt 0 ]; then
+if [ "${LEAN_TOTAL}" -gt 0 ]; then
     LEAN_PERCENT=$((LEAN_PROVEN * 100 / LEAN_TOTAL))
 else
     LEAN_PERCENT=0
 fi
 
-echo "  Total theorems: $LEAN_TOTAL"
-echo "  Proven: $LEAN_PROVEN"
-echo "  Sorry: $LEAN_SORRY"
-echo "  Completion: $LEAN_PERCENT%"
+echo "  Total theorems: ${LEAN_TOTAL}"
+echo "  Proven: ${LEAN_PROVEN}"
+echo "  Sorry: ${LEAN_SORRY}"
+echo "  Completion: ${LEAN_PERCENT}%"
 echo ""
 
 # List files with Admitted/sorry
-if [ $COQC_ADMITTED -gt 0 ]; then
+if [ "${COQC_ADMITTED}" -gt 0 ]; then
     echo "Files with Admitted:"
     grep -r "Admitted\." proofs/coq/ 2>/dev/null | cut -d: -f1 | sort -u | sed 's/^/  - /'
     echo ""
 fi
 
-if [ $LEAN_SORRY -gt 0 ]; then
+if [ "${LEAN_SORRY}" -gt 0 ]; then
     echo "Files with sorry:"
     grep -r "sorry" proofs/lean4/ 2>/dev/null | cut -d: -f1 | sort -u | sed 's/^/  - /'
     echo ""
@@ -210,7 +210,7 @@ echo ""
 
 read -p "Run verification now? (y/n) " -n 1 -r
 echo ""
-if [[ $REPLY =~ ^[Yy]$ ]]; then
+if [[ "${REPLY}" =~ ^[Yy]$ ]]; then
     if command -v just &> /dev/null; then
         echo "Using justfile..."
         just verify-all
@@ -250,8 +250,8 @@ echo ""
 echo "Choose what you want to do:"
 echo ""
 echo "1. FIX ADMITTED PROOFS:"
-echo "   - $COQC_ADMITTED Coq proofs need completion"
-echo "   - $LEAN_SORRY Lean proofs need completion"
+echo "   - ${COQC_ADMITTED} Coq proofs need completion"
+echo "   - ${LEAN_SORRY} Lean proofs need completion"
 echo "   See files listed above"
 echo ""
 echo "2. VERIFY EXISTING PROOFS:"
@@ -305,13 +305,13 @@ Next Priority:
 EOF
 
 # Substitute actual values
-sed -i "s/{COQC_PROVEN}/$COQC_PROVEN/g" QUICKSTART.txt
-sed -i "s/{COQC_TOTAL}/$COQC_TOTAL/g" QUICKSTART.txt
-sed -i "s/{COQC_PERCENT}/$COQC_PERCENT/g" QUICKSTART.txt
-sed -i "s/{LEAN_PROVEN}/$LEAN_PROVEN/g" QUICKSTART.txt
-sed -i "s/{LEAN_TOTAL}/$LEAN_TOTAL/g" QUICKSTART.txt
-sed -i "s/{LEAN_PERCENT}/$LEAN_PERCENT/g" QUICKSTART.txt
-sed -i "s/{COQC_ADMITTED}/$COQC_ADMITTED/g" QUICKSTART.txt
+sed -i "s/{COQC_PROVEN}/${COQC_PROVEN}/g" QUICKSTART.txt
+sed -i "s/{COQC_TOTAL}/${COQC_TOTAL}/g" QUICKSTART.txt
+sed -i "s/{COQC_PERCENT}/${COQC_PERCENT}/g" QUICKSTART.txt
+sed -i "s/{LEAN_PROVEN}/${LEAN_PROVEN}/g" QUICKSTART.txt
+sed -i "s/{LEAN_TOTAL}/${LEAN_TOTAL}/g" QUICKSTART.txt
+sed -i "s/{LEAN_PERCENT}/${LEAN_PERCENT}/g" QUICKSTART.txt
+sed -i "s/{COQC_ADMITTED}/${COQC_ADMITTED}/g" QUICKSTART.txt
 
 echo "✓ Created QUICKSTART.txt with current status"
 echo ""