Security hardening + gist UI fixes (#731)

* security: harden against XSS, ReDoS, path traversal, and injection

Defensive fixes across the server, storage, and viewer:

- XSS (CWE-79): sanitise rendered notebooks with DOMPurify, escape file
  names interpolated into AngularJS expressions (escapeNgString), set
  Mermaid securityLevel to 'strict', and stop urlRel2abs from returning
  javascript:/vbscript:/data:text/html URLs.
- Path traversal / zip-slip (CWE-22/23/24): validate URL-derived path
  components before they reach the storage layer (file/webview routes +
  StorageBase.assertSafePath) and sanitise zip entry names on extract for
  both the filesystem and S3 backends.
- ReDoS (CWE-1333): escape anonymization terms with catastrophic
  backtracking shapes to literals instead of compiling them as regexes.
- Secret hardening (CWE-798): require SESSION_SECRET / OAuth creds / DB
  password in production, random dev SESSION_SECRET fallback.
- Rate-limit spoofing (CWE-290): derive request.ip via trust-proxy hop
  count instead of the client-settable cf-connecting-ip header.
- NoSQL injection (CWE-943): allow only plain field paths as admin sort keys.
- Reject malformed streamer requests missing required string fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ui): make gists reachable/visible and clarify the ZIP button

- Gist & PR routes now accept a trailing slash (/gist/:id/:path*?), so the
  dashboard links (which end in "/") resolve to the gist/PR page instead of
  falling through to the 404 route (#725).
- Gist viewer picks the default tab after content loads, defaulting to
  "files" when files exist; previously the ng-init ran before the async
  load and a files-only gist rendered blank under the hidden comments tab.
- Explorer toolbar: relabel ZIP to "Full repo ZIP" with a tooltip, and add
  tooltips to Raw/Download clarifying they apply to the current file (#721).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: report SAML-enforced orgs clearly instead of "token expired"

When a repo's organization enforces SAML SSO, GitHub returns a 403 whose
message differs from the OAuth-App-restriction case. That 403 fell through
to the generic handler and surfaced as "token_expired", pushing users to
re-login when the real fix is authorizing their token for the org. Detect
the "SAML enforcement" message and raise a dedicated, actionable error
instead (#379, #550).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* security: catch nested quantified groups in ReDoS guard and backslash path traversal

- hasCatastrophicBacktracking now scans across nested parens ([\s\S]*?)
  so shapes like ((a+))+ are detected; comment reframed as a heuristic
  backstop rather than a proof.
- file route path-traversal check now rejects backslash separators and a
  leading backslash, covering Windows-style "..\" payloads (CWE-22/25).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(dev): track dev-proxy script, ignore .DS_Store and .claude/

scripts/dev-proxy.js is referenced by the "dev:ui" npm script but was
never committed, breaking the command on a fresh clone. Add it and
ignore local-only macOS/Claude Code files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/core/storage/FileSystem.ts

@@ -24,6 +24,7 @@ export default class FileSystem extends StorageBase {
 
   /** @override */
   async exists(repoId: string, p: string = ""): Promise<FILE_TYPE> {
+    this.assertSafePath(p);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), p);
     try {
       const stat = await fs.promises.stat(fullPath);
@@ -37,17 +38,20 @@ export default class FileSystem extends StorageBase {
 
   /** @override */
   async send(repoId: string, p: string, res: Response) {
+    this.assertSafePath(p);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), p);
     res.sendFile(fullPath, { dotfiles: "allow" });
   }
 
   /** @override */
   async read(repoId: string, p: string): Promise<Readable> {
+    this.assertSafePath(p);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), p);
     return fs.createReadStream(fullPath);
   }
 
   async fileInfo(repoId: string, path: string) {
+    this.assertSafePath(path);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), path);
     const info = await fs.promises.stat(fullPath);
     return {
@@ -67,6 +71,7 @@ export default class FileSystem extends StorageBase {
     _source?: string,
     expectedSize?: number
   ): Promise<void> {
+    this.assertSafePath(p);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), p);
     // Atomic write: stream into a sibling .tmp and only rename into place
     // when the source stream finishes successfully. If the source errors
@@ -126,6 +131,7 @@ export default class FileSystem extends StorageBase {
 
   /** @override */
   async rm(repoId: string, dir: string = ""): Promise<void> {
+    this.assertSafePath(dir);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), dir);
     await fs.promises.rm(fullPath, {
       force: true,
@@ -135,6 +141,7 @@ export default class FileSystem extends StorageBase {
 
   /** @override */
   async mk(repoId: string, dir: string = ""): Promise<void> {
+    this.assertSafePath(dir);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), dir);
     try {
       await fs.promises.mkdir(fullPath, {
@@ -155,6 +162,7 @@ export default class FileSystem extends StorageBase {
       onEntry?: (file: { path: string; size: number }) => void;
     } = {}
   ): Promise<IFile[]> {
+    this.assertSafePath(dir);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), dir);
     const files = await fs.promises.readdir(fullPath);
     const output2: IFile[] = [];
@@ -197,13 +205,18 @@ export default class FileSystem extends StorageBase {
 
   /** @override */
   async extractZip(repoId: string, p: string, data: Readable): Promise<void> {
+    this.assertSafePath(p);
     const pipe = promisify(pipeline);
     const fullPath = join(config.FOLDER, this.repoPath(repoId), p);
     const extractor = Extract({
       path: fullPath,
       decodeString: (buf) => {
         const name = buf.toString();
-        const newName = name.substr(name.indexOf("/") + 1);
+        // Strip the top-level directory GitHub wraps every entry in, then
+        // drop any "../" / absolute segments so a malicious entry name
+        // cannot escape the extraction root (zip-slip, CWE-24).
+        const stripped = name.substr(name.indexOf("/") + 1);
+        const newName = this.sanitizeZipEntryName(stripped);
         if (newName == "") {
           return "___IGNORE___";
         }
@@ -223,6 +236,7 @@ export default class FileSystem extends StorageBase {
       fileTransformer?: (path: string) => Transform;
     }
   ) {
+    this.assertSafePath(dir);
     const archive = archiver(opt?.format || "zip", {});
     const fullPath = join(config.FOLDER, this.repoPath(repoId), dir);