fix(deploy-on-aws): resolve file paths to prevent path traversal in hook scripts

[scottschreckengaust]

Summary

• Canonicalize file_path with Path.resolve() before any file operations in post_process_drawio.py and validate_drawio.py to prevent path traversal sequences (e.g., ../../etc/passwd.drawio) in hook input from escaping the expected directory
• Move symlink check before resolve() — resolve() follows symlinks, so is_symlink() on the resolved path would always be False
• Use resolved path object for all post-resolve file I/O (never reconstruct from the tainted file_path string)
• Exit non-zero (1) when refusing symlink .drawio files — a symlink is a suspicious/unusual condition (potential attack), not an expected no-op like "not a drawio file". The hook harness (validate-drawio.sh) uses || true so this is safe there, but CLI callers and CI get an honest signal that the file was refused
• Fix nosemgrep inline comments to use full rule IDs (truncated IDs were silently ignored by semgrep)
• Addresses Semgrep finding ai.ai-best-practices.hooks-path-traversal

Exit code behavior

Condition	Exit code	Rationale
Not a .drawio file	0	Expected no-op — the PostToolUse hook fires on every Edit/Write call, so non-drawio files are the 99.9% case. Exit 0 means "not my file, nothing to do" which is the standard hook contract for irrelevant files.
Symlink .drawio file	1	Security rejection — a symlink drawio file is unusual/suspicious (potential attack vector), qualitatively different from "not my file." CLI callers and CI get an honest signal; the hook harness absorbs it via || true.
File too large	0	Policy skip — not an error in the file itself
Parse error	1	Actual processing failure

Test plan

• Verify normal .drawio validation still works with both relative and absolute paths
• Verify symlink rejection exits non-zero: ln -s /tmp/target.drawio test.drawio && python3 post_process_drawio.py test.drawio; echo $? → should print 1
• Run mise run build — passes cleanly

Generated with Claude Code

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.