address Greptile review on PR #45

- optimizer.run: validate self.max_proposals >= 0 before the proposal_limit
  guard, so the specific 'must be non-negative' error is reachable (was a
  dead branch that always tripped the generic message first).
- compiler._safe_extract_tar: extractall(filter='data') to strip device
  files / setuid bits and neutralize unsafe links, matching
  extract_harbor_session_archive (also silences the py3.14 deprecation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: varunursekar

vero/src/vero/harbor/build/compiler.py

@@ -90,7 +90,9 @@ def _safe_extract_tar(payload: bytes, destination: Path) -> None:
                 link = PurePosixPath(member.linkname)
                 if link.is_absolute() or ".." in link.parts:
                     raise ValueError(f"unsafe link in Git archive: {member.linkname!r}")
-        archive.extractall(destination)
+        # filter="data" strips device files / setuid bits and neutralizes unsafe
+        # links, matching extract_harbor_session_archive's defensive posture.
+        archive.extractall(destination, filter="data")
 
 
 def _prepare_baseline_repo(

vero/src/vero/optimization/optimizer.py

@@ -415,12 +415,15 @@ async def run(
         max_proposals: int | None = None,
     ) -> OptimizationResult:
         proposal_limit = self.max_proposals if max_proposals is None else max_proposals
+        # Check the session-level limit first: otherwise a negative
+        # self.max_proposals always trips the proposal_limit guard below and its
+        # specific message is unreachable.
+        if self.max_proposals < 0:
+            raise ValueError("max_proposals must be non-negative")
         if proposal_limit < 0 or proposal_limit > self.max_proposals:
             raise ValueError(
                 "run max_proposals must be between zero and the session protocol limit"
             )
-        if self.max_proposals < 0:
-            raise ValueError("max_proposals must be non-negative")
         if self.max_rounds < 1:
             raise ValueError("max_rounds must be positive")
         if self.max_concurrency < 1: