v5.15.5 - Security fixes: path traversal, fail-closed network surfaces, Node 18/20 CLI

Four privately reported vulnerabilities, all reported by zx (@manus-pi):

Security

Four privately reported vulnerabilities, all reported by zx (@manus-pi):

• GHSA-5mm5-4mh4-6gm6 (High, CWE-22): InputSanitizer.sanitizePath() accepted sibling directories that share the base directory's name prefix (/data/project-evil for base /data/project). Containment is now checked on path-segment boundaries; NUL bytes are rejected.
• GHSA-v64j-mc7x-c7x7 (High, CWE-23): FileJobStore job IDs allowed ../ traversal to read or delete arbitrary .json files.
• GHSA-mfxv-jg44-xj48 (High, CWE-23): AgentVCR cassette names allowed ../ traversal to read or write arbitrary .json files. Both now use the new InputSanitizer.safeChildPath().
• GHSA-qvf5-9prv-7r9c (High, CWE-306): A2AServer task routes were unauthenticated when no secret was configured (the default).

Same-class hardening from a follow-up audit:

• ApprovalInbox (HTTP API) and SwarmTransportServer now require a secret; allowUnauthenticated: true is an explicit, loopback-only opt-out.
• SwarmTransportServer signatures now cover the request id, source node, timestamp, and TTL, are verified in constant time, and stale or replayed requests are rejected. A listed sourceNode is required when allowedNodes is set.
• ControlPlane and WorkTreeDashboard gained the GHSA-hr6v-mfxm-4438 Host/Origin checks (DNS rebinding, cross-site WebSocket hijacking).

Breaking changes

• A2AServer, ApprovalInbox (HTTP), and SwarmTransportServer throw without a non-empty secret. Pass a secret, or allowUnauthenticated: true for loopback-only local development.
• Swarm transport clients and servers must both run 5.15.5 (the signed payload changed).
• FileJobStore IDs and AgentVCR cassette names must match [A-Za-z0-9_.-]{1,128} without ..; other values throw SecurityError.

Fixed

• CodeQL #183 (py/mixed-returns) in scripts/context_manager.py.
• ClawHub skill 5.15.4 scan follow-up: reworded inject preamble and capability declarations, declared blackboard.py archive writes, moved scan-findings history to SECURITY.md.

Tests

3,738 tests across 41 suites; test-phase20.ts reproduces all four advisory PoCs. Local HOL plugin-scanner: 95/100, no high findings.

Full changelog: https://github.com/Jovancoding/Network-AI/compare/v5.15.4...v5.15.5