fix(security): parameterize SQL, redact sensitive logs, harden ReDoS regexes

[kovtcharov]

Closes five open high-severity Python CodeQL alerts. Before: a memory-browser sort parameter was interpolated into SQL after only a silent-fallback check, the EMR agent wrote patient names into its plain-text success log, and three schedule-parsing regexes could be driven into pathological backtracking by hostile input from the schedules API. After: invalid sort columns fail loudly and never touch the SQL, the success log carries only the patient ID (identity fields still display in the details panel right after), and schedule parsing is length-bounded with linear-time patterns.

Alerts addressed (all fixed, none dismissed):

Alert	Rule	Resolution
#351	py/sql-injection	get_all_knowledge maps sort_by through a literal column allowlist; unknown values raise ValueError instead of silently falling back
#350	py/clear-text-logging-sensitive-data	EMR success line redacts the patient name (source of the flagged flow into print_success); on-screen details panel unchanged
#214	py/polynomial-redos	Bounded digit quantifier (\d{1,9}) + 256-char input cap in parse_interval
#215	py/polynomial-redos	Removed ambiguous `\s*(?:am
#216	py/polynomial-redos	Bounded digit quantifier + input cap on the bare Xh/Xm pattern

Test plan

• pytest tests/unit/test_scheduler.py tests/unit/test_memory_store.py — 374 passed (includes new tests: SQLi sort_by raises, oversized/hostile schedule inputs rejected, all natural-language schedule formats still parse)
• pytest tests/unit/test_memory_router.py tests/unit/test_scheduler_api.py tests/unit/test_daemon_scheduler.py tests/unit/test_schedule_daemon.py — one failure reproduces identically on pristine origin/main (pre-existing, unrelated)
• EMR agent tests — 23 passed
• python util/lint.py --all — exit 0
• Hostile-input timing check: 10k-char digit/tab payloads now rejected in <1 ms

[github-actions]

Verdict: Approve

This PR closes five high-severity CodeQL alerts with tightly-scoped, correct fixes: it parameterizes the memory-store sort column against a literal allowlist, drops the patient name from the EMR success log (still shown on-screen right after), and length-caps + de-ambiguates three schedule-parsing regexes so hostile input can't drive pathological backtracking. Each fix ships with a matching test, and the behavior changes are safe — nothing downstream relied on the old silent fallbacks. Nice, focused security work.

🔍 Technical details

Issues Found

None blocking.

Verification notes

• SQL allowlist change is safe end-to-end (memory_store.py:2087-2092). get_all_knowledge now raises ValueError on an unknown sort_by instead of silently defaulting — correct per the "No Silent Fallbacks" rule. I checked the one HTTP caller: src/gaia/ui/routers/memory.py:337-340 constrains sort_by with Query(pattern="^(updated_at|confidence|created_at|category|context|content|use_count)$"), so FastAPI rejects invalid values with a 422 before they reach the store — the new raise can't turn into an uncaught 500. The other internal callers (memory.py:2396/2427/2453) pass hardcoded literals. So this is defense-in-depth, not a breaking change.
• EMR redaction preserves the on-screen data (agent.py:631-638). The name is removed only from the persisted success log; _print_patient_details immediately renders identity fields to the console, so the operator still sees them. Claim in the description holds.
• ReDoS regexes are correctly bounded. \d{1,9} + the 256-char _MAX_SCHEDULE_INPUT_LEN cap kill the polynomial blowup, and rewriting \s*(?:am|pm)? → (?:\s*(?:am|pm))? removes the whitespace overlap with the trailing \s+ that CodeQL flagged (scheduler.py:130, 144-145). All natural-language forms ("9:30 am to 5 pm", "9pm", bare "6h") still match. The inline NOTE at scheduler.py:139-140 explaining why the group is nested is a good one-line WHY comment.

Strengths

• Every fix has a corresponding assertion, including the negative cases: SQLi sort_by now asserts pytest.raises(ValueError) (tightening the old "raise or fall back" test), and the new TestScheduleInputBounds class exercises oversized input, absurd digit runs, and confirms legitimate window/time parsing still works.
• Fixes stay minimal and scope-clean — no drive-by refactors, and the changes align with the repo's fail-loudly convention rather than papering over bad input.