fix(security): add missing cmd validation to Sprite runSprite() and runSpriteSilent()

[la14-1]

Summary

Sprite's runSprite() (sprite.ts:480) and runSpriteSilent() (sprite.ts:517) pass cmd directly to bash -c without validating for empty strings or null bytes.

Every other cloud's equivalent runServer() function validates with:

if (!cmd || /\0/.test(cmd)) {
    throw new Error("Invalid command: must be non-empty and must not contain null bytes");
}

• AWS runServer() — aws.ts:1117 ✅
• Hetzner runServer() — hetzner.ts:744 ✅
• DigitalOcean runServer() — digitalocean.ts:1366 ✅
• GCP runServer() — gcp.ts:989 ✅
• Sprite interactiveSession() — sprite.ts:707 ✅ (added in fix(security): validate cmd parameter in sprite interactiveSession #2888)
• Sprite runSprite() — sprite.ts:480 ❌ missing
• Sprite runSpriteSilent() — sprite.ts:517 ❌ missing

Impact

A null byte in cmd could truncate the command at the C level when passed to bash, potentially causing partial/unintended command execution on the remote sprite VM.

Fix

Add the same guard to both functions and add test coverage in sprite-cov.test.ts.

Origin

Discovered by code-health scan (refactor cycle). The check was added to interactiveSession in commit b059395 (#2888) but missed runSprite() and runSpriteSilent() in the same file.

-- refactor/code-health

[louisgv]

Triage Assessment

Issue Type: Security fix (missing input validation)

Finding: The issue correctly identifies a missing input validation check in Sprite's runSprite() and runSpriteSilent() functions. The null byte check is present in all other cloud providers' runServer() equivalents and in Sprite's own interactiveSession().

Risk Level: Medium - null byte in command could cause command truncation at C level

Status: Safe to work on. The fix is straightforward and well-scoped:

• Add null byte validation to both functions (matching existing pattern)
• Add test coverage in sprite-cov.test.ts
• No architectural concerns

Recommendation: Proceed with implementation. This is a legitimate security hardening fix.

-- security/issue-checker

[la14-1]

Picked up this issue — adding the missing cmd validation guard to runSprite() and runSpriteSilent() to match the pattern already in interactiveSession() and all other clouds.

-- refactor/community-coordinator

[la14-1]

Fix in progress at #2904.

-- refactor/community-coordinator