security: remediate Rafter scan (deps + FP triage + tarball hardening) [sable-qsig]

[Rome-1]

Triage + remediation of the Rafter scan report on main (780 findings, score 50.7). Bead sable-qsig.

Triage summary (decide-first: real vs false positive)

Each class was traced input→sink before action.

Bucket	Findings	Disposition
Dependency CVEs (axios, hono, tar, js-yaml, fast-uri, path-to-regexp, form-data, follow-redirects, ip-address, qs, brace-expansion, +py)	Issues 1–15, 39, 48–57, 68	REAL → fixed (node bumped+re-locked; py floors bumped, transitive via mcp tracked in sable-i7ll)
fs/path SAST (R-61603 ~390, R-374DB 93)	~480	FALSE POSITIVE — local CLI reads/writes config/skills/hooks at paths from the user's own $HOME/cwd/CLI args; no external taint. The one real external path (remote-tarball extract) is zip-slip-guarded. Suppressed w/ rationale in .rafter.yml.
XXE (R-6675E)	56	FALSE POSITIVE — Python codebase imports no XML parser; flagged lines are mkdir/read_text/for-loops.
git parsing as URL/format checks (R-3F913, R-88B14)	18	FALSE POSITIVE — startswith('b/')/endswith('.git') is git-diff/URL parsing.
timing attack (R-51C60)	3	FALSE POSITIVE — compares scan status strings, not secrets.
Intentional secrets (demo/, fixtures/, agent.py event labels)	Issues 7,11–14,62–66	FALSE POSITIVE — canonical AWS-docs example keys / [SECRET]/🔑 display labels.
misc style/note rules (random session-id, O_WRONLY append log, re.sub, .read(), eslint, ReDoS on maintained patterns)	~60	FALSE POSITIVE / accepted w/ rationale.
tarfile members (R-F6F89)	1	already zip-slip-guarded → hardened (skip symlink/device members).

Changes

• .rafter.yml (new) — documented ignore: triage for the FP classes above; honored by local engines and remote rafter run. Nothing leaves the audit trail (recoverable via _suppressed).
• Node deps — pnpm-workspace.yaml overrides + node/package.json, re-locked: axios 1.13.6→1.18.1, hono 4.12.8→4.12.27, tar→7.5.17, js-yaml→4.3.0, fast-uri/path-to-regexp/form-data/follow-redirects/ip-address/qs/brace-expansion past fixed (~50 CVEs).
• Python deps — pyproject.toml floors: requests ^2.33.0, urllib3 >=2.7.0, python-dotenv ^1.2.2.
• skill_remote.extract_npm_tarball — defense-in-depth: only extract regular files/dirs.

⚠️ Flagged for follow-up (not in this PR)

• sable-i7ll — transitive Python CVEs (pyjwt/cryptography/idna/pydantic-settings/pygments + major starlette 0.52→1.x & python-multipart) need poetry lock on a box with poetry (absent here) + mcp-compat check. Most are unreachable in stdio MCP usage.
• sable-ufd9 — GH False positive: rule R-E98AA flags every text-type input as a missing email field (incl. non-email fields) #178 (R-E98AA) & False positives: "leftover comment tag" rules (R-5EC1A / R-6EA94) fire on string literals and ordinary prose words #182 (R-5EC1A/R-6EA94) are backend detection-rule FPs (rule ids not in this repo); routed to rafter-backend. Same root cause as the R-6675E XXE misfire here.

Testing

• tsc build clean; platform-integration (most dep-sensitive) 77/77 in isolation; python skill_remote/extract 87 passed.
• Full suites have pre-existing parallel-run flakiness (sable-6udz), unrelated.
• Local secrets rescan: 0 active / 488 suppressed (all triaged fixtures). Remote rafter run not executed — RAFTER_API_KEY unset in this env; please run on CI to confirm the new score.

🤖 Generated with Claude Code