feat(pr-reviewer): agent work [auto-commit]

Author: Test User

Cargo.lock

@@ -798,4 +798,84 @@ mod tests {
         assert!(!debug_output.contains("***REDACTED***"));
         assert!(debug_output.contains("AgentConfig"));
     }
+
+    fn minimal_config(cli_command: &str) -> AgentConfig {
+        AgentConfig {
+            agent_id: "test-agent".to_string(),
+            cli_command: cli_command.to_string(),
+            args: vec![],
+            working_dir: None,
+            env_vars: HashMap::new(),
+            required_api_keys: vec![],
+            resource_limits: ResourceLimits::default(),
+            use_stdin: false,
+            supports_stdin: false,
+        }
+    }
+
+    #[tokio::test]
+    async fn test_validate_missing_cli_returns_cli_not_found() {
+        let config = minimal_config("__terraphim_no_such_cli_xyz_999__");
+        let validator = AgentValidator::new(&config);
+        let result = validator.validate().await;
+        assert!(
+            matches!(result, Err(ValidationError::CliNotFound(_))),
+            "expected CliNotFound, got {:?}",
+            result
+        );
+    }
+
+    #[tokio::test]
+    async fn test_validate_missing_api_key_returns_api_key_not_set() {
+        const KEY: &str = "TERRAPHIM_TEST_MISSING_KEY_SPAWNER_XYZ";
+        unsafe { std::env::remove_var(KEY) };
+
+        let mut config = minimal_config("echo");
+        config.required_api_keys = vec![KEY.to_string()];
+
+        let validator = AgentValidator::new(&config);
+        let result = validator.validate().await;
+        assert!(
+            matches!(result, Err(ValidationError::ApiKeyNotSet(_))),
+            "expected ApiKeyNotSet, got {:?}",
+            result
+        );
+    }
+
+    #[tokio::test]
+    async fn test_validate_valid_config_succeeds() {
+        let config = minimal_config("echo");
+        let validator = AgentValidator::new(&config);
+        let result = validator.validate().await;
+        assert!(result.is_ok(), "expected Ok(()), got {:?}", result);
+    }
+
+    #[tokio::test]
+    async fn test_validate_api_key_present_succeeds() {
+        const KEY: &str = "TERRAPHIM_TEST_PRESENT_KEY_SPAWNER_XYZ";
+        unsafe { std::env::set_var(KEY, "dummy-value") };
+
+        let mut config = minimal_config("echo");
+        config.required_api_keys = vec![KEY.to_string()];
+
+        let validator = AgentValidator::new(&config);
+        let result = validator.validate().await;
+
+        unsafe { std::env::remove_var(KEY) };
+
+        assert!(result.is_ok(), "expected Ok(()), got {:?}", result);
+    }
+
+    #[tokio::test]
+    async fn test_validate_missing_working_dir_returns_error() {
+        let mut config = minimal_config("echo");
+        config.working_dir = Some(std::path::PathBuf::from("/nonexistent/path/xyz_999"));
+        let validator = AgentValidator::new(&config);
+        let result = validator.validate().await;
+        assert!(
+            matches!(result, Err(ValidationError::WorkingDirNotFound(_))),
+            "expected WorkingDirNotFound, got {:?}",
+            result
+        );
+    }
 }

crates/terraphim_spawner/src/config.rs

@@ -0,0 +1,56 @@
+# Spec Validation Report — Issue #2884
+
+**Agent**: Carthos / spec-validator
+**Date**: 2026-06-22 09:32 CEST
+**Issue**: [#2884 — validate_path uses string starts_with](https://git.terraphim.cloud/terraphim/terraphim-ai/issues/2884)
+
+## Verdict
+
+| Scope | Verdict |
+|-------|---------|
+| `main` branch | FAIL |
+| PR #2897 (`task/2884-validate-path-dead-code`, mergeable=True) | PASS |
+| PR #2888 (`task/2884-validate-path-starts-with`, mergeable=False) | PASS |
+
+## Acceptance Criteria
+
+| # | Criterion | `main` | PR #2897 | PR #2888 |
+|---|-----------|--------|----------|----------|
+| AC1 | `validate_path` uses `path.starts_with(&self.root)` | FAIL | PASS | PASS |
+| AC2 | Dead `key.contains('/')` check removed | FAIL | PASS | PASS |
+| AC3 | Sibling-dir regression test added | FAIL | PASS | PASS |
+| AC4 | `cargo test -p terraphim_workspace` passes | — | 27/27 | 29/29 |
+
+## Code Evidence
+
+### Main branch (`lib.rs:240`)
+```rust
+// BUG: string comparison — "/tmp/ws_evil/f" incorrectly passes against root "/tmp/ws"
+let path_str = path.to_string_lossy();
+let root_str = self.root.to_string_lossy();
+if !path_str.starts_with(root_str.as_ref()) { ... }
+// Dead code: lines 248-252 key.contains('/') check
+```
+
+### PR #2897 (`task/2884-validate-path-dead-code`, commit `70046217`)
+```rust
+// FIXED: component-aware Path::starts_with
+fn validate_path(&self, path: &Path, _identifier: &str) -> Result<()> {
+    if !path.starts_with(&self.root) { ... }
+    Ok(())
+}
+```
+Regression test: `path_prefix_confusion_is_rejected` at `lib.rs:573`
+
+### PR #2888 (`task/2884-validate-path-starts-with`, commit `08456e26`)
+Additional security hardening: `..` component pre-rejection + security-sentinel P1-1/P2-1/P2-2 fixes.
+mergeable=False (conflict).
+
+## Recommendation
+
+Merge **PR #2897** — satisfies all acceptance criteria, mergeable=True, compound-review GO.
+Security-sentinel findings from PR #2888 (cleanup() path guard, env-var stripping) should be tracked separately.
+
+## Correction to Prior Analysis
+
+Comment #52253 (quality-coordinator) claimed "Path::starts_with was already correct on main." This is incorrect. Direct inspection of `main:crates/terraphim_workspace/src/lib.rs:240` confirms the string `starts_with` bug is present.