chore(privacy): address Fro Bot NBCs on private-wiki gate

[marcusrbrown]

Addresses the four non-blocking concerns and two missing-test items Fro Bot raised on PR #3329 (private-wiki gate v1).

What changed

scripts/check-wiki-private-presence.ts

Parameterize the GraphQL call. node_id is no longer interpolated into the query string. The call now uses gh api graphql -F nodeId=<value> -f query='query($nodeId: ID!) { node(id: $nodeId) { ... } }'. A crafted node_id with " or ) previously produced malformed GraphQL → API reject → script failed closed; the injection surface is gone entirely, and error messages are clearer too. Same pattern survey-repo.yaml already uses.

Distinguish failure modes. resolveCanonicalSlugs internally tracks each unresolved entry as subprocess-threw (network/rate-limit/auth) or node-null (deleted repo, revoked App access). The thrown error labels each entry with its mode and a targeted remediation hint:

check-wiki-private-presence: cannot verify private wiki presence (2 entries unresolved):
  [subprocess-threw] R_kgDOABCDEF (investigate network/rate-limit/auth)
  [node-null] R_kgDOXYZ123 (investigate repo lifecycle/App access)

Operators can act per-entry without grep-and-guess.

Normalize canonical slug at storage. resolveCanonicalSlugs now applies .toLowerCase() before storing the resolved slug. GitHub preserves nameWithOwner case (so bfra-me/Works could come back capitalized); the comparison already used .toLowerCase() on both sides, but storage wasn't normalized. Defensive cleanup — if the comparison ever changes, the storage shape stays correct.

.github/workflows/merge-data.yaml

Added a two-line comment above the second checkout explaining the dual-checkout rationale: scripts live on main, the wiki/metadata being promoted live on data. Future maintainers no longer have to reverse-engineer the layout.

scripts/check-wiki-private-presence.test.ts

Two missing tests called out in the review:

• node: null GraphQL response throws. Locks in the contract that a null node is treated as a failure (mode node-null), not a silent skip.
• nameWithOwner → owner--repo slug conversion edge cases. it.each covering hyphen-in-owner (bfra-me/works), hyphen-in-repo (marcusrbrown/ha-config), dot-in-repo (bfra-me/.github), and uppercase normalization (MarcusRBrown/Poly → marcusrbrown--poly). Catches a future "improvement" to the replacement that breaks one of the live conventions.

Plus a small NBC #2 distinction test that proves a mixed subprocess-threw + node-null failure set produces both mode labels in the error.

Verification

• pnpm check-types, pnpm lint, pnpm test — green. 627 passed + 3 todo (+7 over PR feat(privacy): block merge-data when private wiki pages exist #3329's 620, all behavior-bearing).
• actionlint .github/workflows/merge-data.yaml clean.
• node -e "import('./scripts/check-wiki-private-presence.ts')" exits 0 under Node 24 strip-only.
• node scripts/check-wiki-private-presence.ts against current main (no private entries) prints "no private wiki leaks detected", exits 0.

Deferred (still tracked)

The three larger design follow-ups from #3329's review remain open:

• Private wiki gate: stderr output re-leaks canonical filenames #3326 — stderr output re-leaks canonical filenames (design decision: redact / privileged-log / accept)
• Private wiki gate: defense-in-depth gaps (variants, subdirs, timeouts, non-repo wiki) #3327 — metadata-tampering bypass (mitigation choice: trusted denylist source / live visibility probe / sticky-private record). The parameterized GraphQL call in this PR removes the injection surface that worsened the bypass, but the bypass itself is unchanged.
• Private wiki gate: metadata-tampering bypass via flipping private→false in same PR #3328 — defense-in-depth gaps (slug variants, subdirectory bypass, per-call timeout, non-repo wiki areas)

The single Fro Bot review item NOT addressed here is missing test #3 (comment near .replace(/\.md$/i, '') documenting the strict stem extraction) — that fits naturally with the #3328 work since both touch slug-variant handling.

Refs PR #3329.

[fro-bot]

Verdict: PASS

The parameterized GraphQL call closes the injection surface cleanly — the query string is now a constant and node_id rides through execFileSync argv with no shell in the path. That's the right shape. Failure-mode labeling (subprocess-threw vs node-null) gives operators a remediation hint instead of a grep target, and lowercase normalization at storage matches the comparison side. Tests track each change.

Blocking issues

None.

Non-blocking concerns

• scripts/check-wiki-private-presence.ts:84 — SlugResolutionResult.failures is typed string[] and commented "always empty on success; throws if non-empty". Since the throw path is the only way failures escape, the field is now structurally dead — it's always [] on return. Either drop it from the interface or re-type to ResolutionFailure[] and surface it for callers who want to introspect without parsing the error message. Minor — not worth holding the merge.
• scripts/check-wiki-private-presence.ts:114 — gh api -F nodeId=<value> performs type coercion (numeric strings → numbers, true/false → booleans). Real GitHub node IDs are opaque base64-ish strings so this is fine in practice, and the upstream assertReposFile schema is the real gate. If you want belt-and-suspenders against a future schema regression, --field nodeId=... (long form) forces string. Defense-in-depth, not a defect.
• .replace('/', '--') only replaces the first slash. GitHub nameWithOwner is owner/repo with exactly one slash, so this is correct — but the assumption is load-bearing. A single-line comment naming the invariant would help future maintainers more than another test would.

Missing tests

None for the changes in this PR. The deferred test #3 (comment on .replace(/\.md$/i, '')) is correctly punted to #3328 where slug-variant handling lives.

Risk assessment

LOW. The change reduces attack surface (GraphQL injection gone) and improves operator ergonomics (labeled failure modes, normalized storage). Behavior is fail-closed on resolution failure, which preserves the v1 gate's safety property. The dual-checkout comment in merge-data.yaml is documentation-only. No new dependencies, no permissions changes, no untrusted input flowing into run: blocks.

The bypass tracked in #3327 (metadata tampering) and the stderr re-leak in #3326 remain open — correctly scoped out of this PR.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	26143106506
Cache	hit
Session	ses_1bc29d7c3ffeJwtShkURyWB6Hf