Backlog/v12 soar fixes

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Introduces conditional command chaining in SOAR flows, changing the command execution contract and potentially breaking existing agent-side command processing.

• high backend/modules/soar/usecase/execution.go:63 — The assembleChain function changes how commands are dispatched to agents by introducing shell operators (&&, ||, ;). If agents expect a single command string or a specific format, this change in the wire protocol/execution contract may break existing agent implementations.
• medium backend/modules/soar/dto/rule.go:20 — The Commands field in CreateRuleRequest and UpdateRuleRequest has been changed from []string to []dto.FlowCommandVM. This is a breaking API contract change for any external integrations or frontend clients relying on the previous schema.
• medium backend/modules/soar/domain/filter.go:6 — Significant expansion of OperatorType constants. Ensure that all existing SOAR rules in production are compatible with these new operators and that the backend logic handles these new types safely.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Introduced SOAR command chaining with conditional operators and template support; logic appears sound with appropriate fallbacks.

No findings.

🛑 security (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Introduction of shell command chaining logic in SOAR module, potentially enabling command injection if user-provided inputs are not strictly sanitized before execution.

• high backend/modules/soar/usecase/execution.go:68 — The assembleChain function concatenates user-defined commands into a single shell string using shell operators (&&, ||, ;). If the 'command' field in FlowCommandVM is not strictly validated against a whitelist or sanitized to prevent shell metacharacter injection, this allows arbitrary command execution on the target agent.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.