[spark-compete wave 1] install & build right — 30 PRs → 6 consolidated commits

[vibeforge1111]

Spark Compete — Wave 1: "install & build right" (first installer release)

First execution wave from the Spark Compete maintainer audit. Consolidates 30 reviewed-and-accepted Wave-1 PRs (open + resurrected-from-closed) into 6 coherent, conflict-free commits on the install/build surface. Merging the 30 branches individually would cascade conflicts on cli.py; this groups them by concern with maintainer-completion applied.

Commits

1. input-hardening — module-name sanitization ([spark-compete] fix(security): sanitize module name extracted from git URL to prevent path traversal #1432), SQL column allowlist ([spark-compete] fix(security): validate column names against allowlist before SQL interpolation in system_map #1434), malformed-package tolerance ([spark-compete] tolerate malformed package scripts #1423), unicode/homoglyph prompt-injection defense ([spark-compete] fix(security): add Unicode normalization to prompt injection scanner to prevent homoglyph bypass #1425). Maintainer added the missing normalize_unicode test.
2. approval-gating (adopt_interim) — require approval for container-escape ([spark-compete] fix(security): require approval for docker exec, nsenter, and chroot #1440) and identity-mutation ([spark-compete] fix(security): require approval for user and group account mutations #1441) commands. Re-home note: on the CLI→harness-core migration, move these detectors into the Governor approval classifier (authority plane), not string matching.
3. cli-robustness — provider-key errors (fix(cli): accurate error when provider key is managed externally #239), partial doctor report (fix(cli): save partial doctor report even when LLM probe fails #241), trace dedup (fix(system_map): deduplicate trace repair queue entries by (component, event_type) #238), SPARK_HOME write-guard (fix(cli): exclude SPARK_HOME from write_denied_prefixes — unblocks live start / update on root installs #246), restart/SSH/install fixes (fix: restart exit code, stop_module PID safety, SSH JSON error, install.sh word splitting #81), Windows installer preflight (Fix Windows installer preflight when python3 app alias fails #210).
4. cli-ux — bare-subcommand menus (fix(cli): helpful menus for bare 'spark os', 'spark providers', 'spark support' #242, fix(cli): helpful message for bare 'spark recommend' + clarify --desktop help text #240), Android/Termux Desktop fallback ([spark-compete] fix: fallback Desktop path for Android/Termux where ~/Desktop does not exist #283).
5. redaction — nine path/secret-redaction PRs (all @Esc1200) consolidated into one pass; _PATH_REDACT_RE narrowed to real filesystem roots so URL paths aren't over-redacted; removed an accidentally-committed packet file.
6. misc-output — trace-ref cap ([spark-compete] enhance(top): inspect_builder_event_samples top_trace_refs returns up to 19 (not 20) when [missing] is among the top counted refs #1428), builder-overlap disclosure guard ([spark-compete] fix(builder): Builder overlap probes report matched count without disclosing the 500-id sample cap #1410), --lines help ([spark-compete] enhance(spark): spark live logs --lines flag has no help text; operators can't tell 0=all from 0=new-only #1407), uninstall feedback + args.target guard (fix(cli): preserve uninstall feedback when a named target hits empty registry #1439), list-output path cleanup ([spark-compete] fix: remove internal module paths from CLI output and status notes #1427).

Maintainer changes worth review

• Stripped all bundled registry.json commit-pin bumps from [spark-compete] enhance(spark): spark live logs --lines flag has no help text; operators can't tell 0=all from 0=new-only #1407/[spark-compete] fix(builder): Builder overlap probes report matched count without disclosing the 500-id sample cap #1410/[spark-compete] fix: fallback Desktop path for Android/Termux where ~/Desktop does not exist #283/Fix Windows installer preflight when python3 app alias fails #210 — they regressed git-commit-pin-v1 attestations to stale forked commits (flagged in security review).
• Fixed [spark-compete] fix: remove internal module paths from CLI output and status notes #1427's duplicate-name-column regression; hardened fix(cli): preserve uninstall feedback when a named target hits empty registry #1439's args.target access; narrowed the redaction regex; hand-merged [spark-compete] fix(security): require approval for user and group account mutations #1441's classifier (line-drift with [spark-compete] fix(security): require approval for docker exec, nsenter, and chroot #1440).

Verification

python -m compileall src/spark_cli clean; new tests (test_prompt_injection_unicode.py, test_approval_wave1.py) pass; full suite runs in CI.

Excluded

driasim/"Rayiea Hub" fraud PRs (README no-op markers behind fabricated CVSS packets) and duplicate-splits are not here — zero credit per ruleset v2 §5.1.

🤖 Generated with Claude Code