验证：backend go vet ./... + go test -count=1 ./... 全绿；新增 blobstore 三组单测（不安全 id 拒绝且目录零残留、正常 Put/Get/Delete 往返、目录外引用 Get/Delete 拒绝）；Dev 仓 make test 组合验证全链 exit 0（日志尾部 test-ui 37/37、agentcmd ok）。
Why: the 2026-09-30 deep security scan triage left one actionable finding: backend Local.Put joined the HTTP-supplied artifact id into the store directory unsanitized (reachable via UpdateArtifactContent path parameter), and Get/Delete took stored refs unvalidated. Backend PR #22 adds validID on Put plus a directory-containment check on Get/Delete with unit tests.
Evidence: backend go vet ./... and go test -count=1 ./... pass (3 new blobstore test groups green); Dev make test combined verification exit 0 across core+backend+frontend+ui+agentcmd (log tail shows test-ui 37/37, agentcmd ok); gitlink pinned to backend main f98dc1d after confirming it already contains the chat-process pointer 76d64a1 (no regression).
Impact: modules/backend gitlink only (+task card); no Dev-repo code change.
Refs: .task/fix-blobstore-id-hardening.md, backend PR #22
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
fix/blobstore-id-hardening 任务卡
任务主记录：<PR 链接，task-finish 时填写>；状态：进行中；owner：weichen
基线与授权
eb1877b3f7目标与非目标
internal/blobstore增加validID（Put 拒绝空/./../含路径分隔符/绝对路径/NUL 的 id）与contains（Get/Delete 对入库引用做目录包含性检查），补齐单测；Dev 仓 gitlink 钉入 backend 合入后的新 main。store.UpdateArtifactContent的 HTTP 路径参数直达Put，穿越面真实可达。同步记录
eb1877b3f7eb1877b3f7结果与验证
go vet ./...+go test -count=1 ./...全绿；新增 blobstore 三组单测（不安全 id 拒绝且目录零残留、正常 Put/Get/Delete 往返、目录外引用 Get/Delete 拒绝）；Dev 仓make test组合验证全链 exit 0（日志尾部 test-ui 37/37、agentcmd ok）。internal/blobstore，纯文件名 id（现网唯一形态）行为不变；剩余项为依赖 CVE 明细（扫描报 3 包 34 条通告未出清单，需子仓 govulncheck/npm audit，另立任务）。