fix: security hardening, path traversal, code injection, auth bypass, repo hygiene, test cleanup

[htafolla]

Summary

Comprehensive security audit and codebase cleanup addressing 3 critical, 3 high, and multiple medium-severity issues discovered during post-merge review.

Security Fixes

Critical

• C1: Command injection — intelligent-commit-batcher.ts used exec() with string interpolation for git operations. Added runCommandSafe() using spawn() with args array, eliminating shell metacharacter interpretation entirely.
• C2: Auth bypass — /logs endpoint in cli/server.ts was not wrapped in requireAuth middleware while all other API routes were protected. Fixed.
• C3: Timing attack — API key validation in openclaw/api-server.ts used === comparison. Now uses crypto.timingSafeEqual for constant-time comparison.

High

• H1: Memory leak — Rate limiter in security-middleware.ts created a Map that never evicted stale IP entries. Added periodic TTL eviction via setInterval.
• H3: Path traversal — createDynamicConfig() in server-config-registry.ts interpolated serverName into file paths without validation. Now rejects path traversal characters.
• H5: Path traversal — test-auto-creation-processor.ts wrote test files without validating paths stayed within expected directory. Added path resolution check.
• H6: CORS + API key CSRF — OpenClaw API server set Access-Control-Allow-Origin: * with API key auth. Now restricts to localhost origins when apiKey is configured.

Code Quality

• Replaced placeholder secrets with empty strings in OpenClaw sample config
• Fixed req: any, res: any types to proper Request, Response types in CLI server

Repo Hygiene

• Untracked 180 files from git that were gitignored but still tracked:
  • dist/ (33 files), logs/reports/ (14), ci-test-env/ (133), performance-baselines.json
• Fixed enforcer-config.json framework version (1.0.0 → 1.15.18)
• Added context-ses*.json, ci-test-env/ to .gitignore

Test Cleanup (27 files deleted, ~6,300 lines removed)

• Deleted empty/stub test files and 6 non-vitest ad-hoc test scripts never run by npm test
• Deleted backup files (.bak2, .backup)
• Deleted entire scripts/archived/ directory (12 obsolete files)
• Deleted 7 stale report .md files from scripts/
• Fixed 2 broken vitest config references to nonexistent setup files

Verification

• TypeScript: 0 errors
• Tests: 2,399 pass, 0 failures
• Build: Clean
• Version: 1.15.18
  BODY; __hermes_rc=$?; printf 'HERMES_FENCE_a9f7b3'; exit $__hermes_rc