fix(miner): validate commitSha as hex before joining it into the replay snapshot path

[xfodev]

Summary

normalizeCommitSha (packages/loopover-miner/lib/replay-snapshot.ts) accepted any non-empty string, and the value is join()'d straight into planReplaySnapshotPath's on-disk path (and used by exportReplaySnapshot). So a ../..-laden commitSha escaped the repo directory (path traversal) — e.g. commitSha: "../../../../../../tmp/evil-worktree" resolved outside the repos dir.

Fix: enforce that a commit SHA is 7-40 hex chars (/^[0-9a-f]{7,40}$/i) — the identical format check the sibling replay-task-generation.ts already applies — so a malformed or traversal value throws invalid_commit_sha before it can reach path.join. No behavior change for real SHAs.

Tests

• Adds a regression test (traversal / too-short / non-hex commitSha throw; a genuine 40-hex SHA still resolves inside the snapshot subdir).
• Updates the placeholder short SHAs the new check would reject to valid hex, in both the tool's own test AND its cross-file consumer test/unit/miner-store-seam-rollout.test.ts (which round-trips saveSnapshot/getSnapshot through the same validated path).

Validation

• The changed test files pass on Linux (miner-replay-snapshot + miner-store-seam-rollout); a full test/unit/miner-* sweep shows zero new failures vs main (41 vs main's 43 — all pre-existing Windows-only path.join separator artifacts that pass on Linux CI). Root tsc --noEmit clean; the changed line's throw + pass branches are both covered. No secrets/reward terms.

Closes #7796

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.42%. Comparing base (510d25b) to head (fe67f9d).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/loopover-miner/lib/replay-snapshot.ts	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7927      +/-   ##
==========================================
- Coverage   91.77%   88.42%   -3.36%     
==========================================
  Files         731       89     -642     
  Lines       74902    21317   -53585     
  Branches    22847     3698   -19149     
==========================================
- Hits        68741    18849   -49892     
+ Misses       5083     2290    -2793     
+ Partials     1078      178     -900     

Flag	Coverage Δ
shard-1	0.00% <0.00%> (-59.81%)	⬇️
shard-2	0.00% <0.00%> (-53.53%)	⬇️
shard-3	0.00% <0.00%> (-47.71%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/replay-snapshot.ts	0.00% <0.00%> (-100.00%)	⬇️

... and 642 files with indirect coverage changes

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-21 18:44:24 UTC}

3 files · 1 AI reviewer · no blockers · CI failing · unstable

🛑 Suggested Action - Fix Blockers

Review summary
This is a legitimate, narrowly-scoped path traversal fix: normalizeCommitSha now enforces a 7-40 hex char format, matching the sibling replay-task-generation.ts check, before the value reaches path.join in planReplaySnapshotPath. The traversal, too-short, and non-hex regression tests exercise the real reachable path, and the placeholder SHAs across both the tool's own test file and the cross-file consumer test are correctly updated to valid hex so they don't trip the new guard. The change is behavior-preserving for real SHAs and closes #7796 as described.

Nits — 4 non-blocking

• packages/loopover-miner/lib/replay-snapshot.ts:84 — the 7/40 hex-length bounds are magic numbers duplicated from replay-task-generation.ts; consider extracting a shared regex/constant instead of the two files independently repeating `/^[0-9a-f]{7,40}$/i`.
• The codecov/patch check failing at 0.00% is likely a reporting artifact given the PR states the changed throw/pass branches are covered by the new test in miner-replay-snapshot.test.ts — worth confirming coverage is actually wired for this file rather than silently excluded.
• Extract the `/^[0-9a-f]{7,40}$/i` pattern into a small shared helper/constant used by both replay-snapshot.ts and replay-task-generation.ts to avoid future drift between the two copies.
• Double-check why codecov/patch reports 0% despite the new regression test — confirm the coverage tool is actually instrumenting replay-snapshot.ts's changed lines.

CI checks failing

• codecov/patch — 0.00% of diff hit (target 99.00%)

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7796
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 88 registered-repo PR(s), 47 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	xfodev; Gittensor profile; 88 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: significant

Linked issue satisfaction

Addressed
The diff adds the exact hex regex validator (`/^[0-9a-f]{7,40}$/i`) to normalizeCommitSha before the trimmed value is used, throwing invalid_commit_sha on traversal/non-hex input, matching the issue's requested fix and validator reuse.

Review context

• Author: xfodev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, TypeScript
• Official Gittensor activity: 88 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (CI is failing (codecov/patch)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.