Fix 8 code-review findings: security + reliability

1. agent.py: shell allow-check reads cfg, not server payload (RCE fix)
2. webhook.php: move WEBHOOK_SECRET to gitignored config.php; rotate secret
3. agent.py: replace recursive main() with while loop (RecursionError fix)
4. jarvis-deploy.sh: push force-revert to GitHub on syntax fail (loop fix)
5. agent.py: self_update() verifies SHA-256 before exec (integrity fix)
6. agent.php: remove JARVIS_IP from browser-action bypass (auth fix)
7. jarvis-watchdog.sh: escape SQL vars in alert() to prevent injection
8. jarvis-deploy.sh: atomic mv instead of cat+truncate (TOCTOU fix)

Also: distribute jarvis-agent.py.sha256 alongside agent for integrity checks

deploy/jarvis-deploy.sh

@@ -13,9 +13,12 @@ log() { echo "[$(TS)] $1" >> "$LOG"; }
 [ ! -f "$QUEUE" ] && exit 0
 [ ! -s "$QUEUE" ] && exit 0
 
-# Snapshot and clear queue atomically
-SNAPSHOT=$(cat "$QUEUE")
-> "$QUEUE"
+# Atomically take ownership of the queue via rename — prevents TOCTOU loss of
+# entries written between a cat and truncate
+PROCESSING="${QUEUE}.processing"
+mv "$QUEUE" "$PROCESSING" 2>/dev/null || exit 0
+SNAPSHOT=$(cat "$PROCESSING")
+rm -f "$PROCESSING"
 
 while IFS= read -r path; do
     [ -z "$path" ] && continue
@@ -51,13 +54,20 @@ while IFS= read -r path; do
     done <<< "$CHANGED"
 
     if [ "$SYNTAX_OK" = false ]; then
-        log "SYNTAX ERROR in $BAD_FILE — reverting to $BEFORE"
+        log "SYNTAX ERROR in $BAD_FILE — reverting locally and pushing revert to GitHub"
         git reset --hard "$BEFORE" >> "$LOG" 2>&1
+        # Push the revert so GitHub matches the live server — prevents infinite re-deploy loop
+        git push --force origin HEAD:main >> "$LOG" 2>&1
+        PUSH_EXIT=$?
+        if [ $PUSH_EXIT -ne 0 ]; then
+            log "WARNING: Force-push of revert failed (exit $PUSH_EXIT) — bad commit still on GitHub"
+        fi
         # Insert alert into JARVIS DB
+        BAD_ESCAPED=$(printf '%s' "$BAD_FILE" | sed "s/'/\\\\\\'/g")
         mysql -u jarvis_user -pJ4rv1s_Pr0t0c0l_2026! jarvis_db -se \
             "INSERT INTO alerts (alert_type,title,message,severity)
              VALUES ('deploy_fail','Deploy reverted: syntax error',
-             'PHP syntax error in $BAD_FILE. Commit $AFTER was reverted automatically.','critical');" 2>/dev/null
+             'PHP syntax error in $BAD_ESCAPED. Commit $AFTER was reverted and force-pushed to GitHub.','critical');" 2>/dev/null
         log "Reverted. Bad commit: $AFTER"
         continue
     fi

deploy/jarvis-watchdog.sh

@@ -10,15 +10,23 @@ TS() { date '+%Y-%m-%d %H:%M:%S'; }
 
 log() { echo "[$(TS)] $1" >> "$LOG"; }
 
+# Escape single quotes for MySQL string interpolation in bash
+sql_esc() { printf '%s' "$1" | sed "s/'/\\\\''/g"; }
+
 alert() {
     local type="$1" title="$2" msg="$3" sev="${4:-warning}"
+    local e_type e_title e_msg e_sev
+    e_type=$(sql_esc "$type"); e_title=$(sql_esc "$title")
+    e_msg=$(sql_esc "$msg");   e_sev=$(sql_esc "$sev")
     $MYSQL "INSERT IGNORE INTO alerts (alert_type,title,message,severity,source_key,auto_resolve)
-            VALUES ('$type','$title','$msg','$sev','watchdog:$type',1);" 2>/dev/null
+            VALUES ('$e_type','$e_title','$e_msg','$e_sev','watchdog:$e_type',1);" 2>/dev/null
 }
 
 resolve() {
+    local e_key
+    e_key=$(sql_esc "$1")
     $MYSQL "UPDATE alerts SET resolved=1,resolved_at=NOW()
-            WHERE source_key='watchdog:$1' AND resolved=0;" 2>/dev/null
+            WHERE source_key='watchdog:$e_key' AND resolved=0;" 2>/dev/null
 }
 
 # ── Service health ─────────────────────────────────────────────────────────────