bug(plan_load_dod): repo arg uses bare z.string() — no validation before glab subprocess

[bakeb7j0]

Summary

The plan_load_dod handler (introduced in PR #395, issue #388) defines its repo parameter as a bare z.string().optional() with no regex validation. This is inconsistent with every other handler in the codebase, which use repoOptionalSchema from lib/schemas/repo.ts.

The handler passes args.repo straight into getAdapter({ repo: args.repo }) and then into adapter.fetchIssue({ number: args.plan_id, repo: args.repo }). The GitHub adapter has its own GITHUB_REPO_SLUG adapter-level check, but the GitLab adapter path runs through glab api projects/<url-encoded-slug>/issues/N string concatenation. An unvalidated repo value containing shell metacharacters or path traversal could be passed to execSync via the glab command string.

The schema layer is the documented first line of defence for adapter inputs.

Implementation Steps

1. Update handlers/plan_load_dod.ts line 17 (current input schema):

   const inputSchema = z.object({
     plan_id: z.number().int().positive(),
     repo: z.string().optional(),
   });

   Replace with:

   import { repoOptionalSchema } from '../lib/schemas/repo.js';
   // ...
   const inputSchema = z.object({
     plan_id: z.number().int().positive(),
     repo: repoOptionalSchema,
   });

2. Add a test case asserting that malformed repo values are rejected at the handler boundary (e.g. repo: '../../../etc/passwd', repo: 'foo;bar', repo: '').

3. Add a test case asserting valid GitLab nested groups are accepted.

Test Procedures

1. Run the existing plan_load_dod test suite — all should still pass.
2. Add new test cases covering shell metacharacters, path traversal, and nested groups.
3. Verify error messages match the shared REPO_SLUG_ERROR constant.

Acceptance Criteria

• handlers/plan_load_dod.ts imports and uses repoOptionalSchema
• Bare z.string() removed for repo field
• New test cases cover shell-metachar rejection, path-traversal rejection, and nested-group acceptance
• All existing plan_load_dod tests still pass
• Error messages match shared REPO_SLUG_ERROR constant

Dependencies

• Surfaced by trust-score gate review for plan Plan: Bug Drain + Feature Adds (13 issues) #390 (kahuna/390-bug-drain → main).

Metadata

Field	Value
Repository	Wave-Engineering/mcp-server-sdlc
Surfaced by	code-reviewer trust-score gate (plan #390)