[ultra-review] Full-codebase audit of master — HIGH-severity findings

[l2ysho]

Ultra review — master full-codebase audit

This tracking issue collects the HIGH-severity findings from an ultra code review of the whole src/ tree on master. Each finding was independently adversarially verified before inclusion; one candidate (shell injection via apify run --entrypoint) was refuted and excluded as self-inflicted (no trust boundary crossed).

Sub-issues (HIGH only):

• Required array inputs skip minItems validation (validation bypass) — src/lib/input_schema.ts
• apify run exits 0 when the Actor fails — src/commands/run.ts
• Path traversal in apify actors pull via API-supplied filenames — src/commands/actors/pull.ts
• outputJobLog crashes when a job log is missing — src/lib/utils.ts
• actor set-value KEY with no value doesn't delete the record — src/commands/actor/set-value.ts

MEDIUM/LOW findings (token leak under APIFY_CLI_DEBUG, world-readable auth.json, corrupt legacy apify.json, choices-validation bypass, ResponsiveTable row accumulation, node:process import convention) were also identified but are out of scope for this tracker.

Generated by an ultra code review.