fix(#6788): address review feedback on dummy-playback runtime

- Validate playback-comment-url path starts with "/" to prevent argument
  injection via gh/glab CLI flags (both two-line and legacy single-line
  formats)
- Add dummy-playback row to docs/runtimes.md runtime summary table
- Add Dummy-playback runtime operations section to
  docs/contributing/runtime-implementation.md with security matrix note,
  playlist format, companion files, fix/feature entries, tracking comment,
  and config key table
- Update ValidRuntimes() comment to mention dummy-playback alongside dummy
- Group top-level constants into a const() block
- Move dummy-playback case adjacent to dummy in registry.go
- Add 3 test cases for argument injection prevention

Addresses review feedback on #6789

Author: fullsend-ai-coder[bot]

docs/contributing/runtime-implementation.md

@@ -361,6 +361,61 @@ The `dummy` runtime executes a YAML script of operations inside the real sandbox
 | `assert_file` | `path` | Assert file exists and is readable under the workspace |
 | `assert_json` | `path,json_path` | Assert JSON file exists and dot-path field is present and non-null (uses `jq`) |
 
+## Dummy-playback runtime operations
+
+The `dummy-playback` runtime replays canned agent results from an ordered
+playlist, enabling fast, deterministic e2e tests that exercise the full
+dispatch→pre-script→runtime→post-script pipeline using pre-recorded output.
+
+**Security feature matrix:** N/A — test-only runtime. Like `dummy`, it
+does not implement `SandboxHooksBootstrap` and installs no sandbox tool hooks.
+No inference calls are made.
+
+### Playlist format
+
+The playlist is a YAML file at `.fullsend/results/playlist.yaml`:
+
+```yaml
+current: 1
+results:
+  - triage/sufficient
+  - review/approve
+  - code/implemented
+```
+
+`current` is 1-indexed. Each entry names a subdirectory under
+`.fullsend/results/` that contains a `result.json` and optional companion
+files. The runtime serves the entry at `current`, writes `result.json` to
+the sandbox output directory, copies companion files into the workspace,
+and advances `current` via a local write (or git commit+push in
+production).
+
+### Companion files
+
+Files in the entry directory (other than `result.json`) are uploaded to the
+sandbox. Files under a `repo/` subdirectory are placed relative to the
+target repo checkout (simulating code changes); all other files go to the
+workspace root.
+
+### Fix vs. feature entries
+
+Entries whose name starts with `fix/` commit to the current branch
+(preserving the PR branch for post-fix push). All other entries create a
+new feature branch (`fullsend/playback-<entry>`).
+
+### Tracking comment
+
+An optional `playback-comment-url` file in the `.fullsend/` directory
+enables cross-iteration playlist tracking via a forge API comment. The
+file format is `<cli>\n<path>` (e.g. `gh\n/repos/…/comments/42` or
+`glab\n/projects/…/notes/99`). Legacy single-line files default to `gh`.
+
+### Config key table
+
+`dummy-playback` does not support any harness config keys — it replays
+pre-recorded results and ignores `model`, `effort`, `tools`, and other
+runtime-neutral keys.
+
 ## pi runtime internals (#6464)
 
 User-facing pi behaviour is in [Pi](../runtimes/pi.md). This section keeps the

docs/runtimes.md

@@ -9,6 +9,7 @@ sandbox, the credentials, and the verdict.
 | **[`claude`](runtimes/claude.md)** | Production agent runs (Claude Code) | Default |
 | **[`pi`](runtimes/pi.md)** | Second runtime, opt-in per repo — Claude, Grok and Gemini on Vertex; GPT via OpenAI WIF (wired, not yet exercised live) | Supported for `triage`, `prioritize`, `code`, `fix` |
 | `dummy` | Behaviour tests — scripted ops, no inference | Internal |
+| `dummy-playback` | Behaviour tests — replays canned agent results from a playlist, no inference | Internal |
 | `opencode` | Not yet functional | Stub |
 
 Pick one with `runtime:` in `.fullsend/config.yaml`, or per run with `--runtime`.

internal/config/config.go

@@ -297,7 +297,8 @@ func ValidProviders() []string {
 }
 
 // ValidRuntimes returns the set of recognized agent runtimes. "pi" is
-// opt-in per org/repo (#6464); "dummy" is for behaviour test orgs only.
+// opt-in per org/repo (#6464); "dummy" and "dummy-playback" are for
+// behaviour test orgs only.
 func ValidRuntimes() []string {
 	return []string{"claude", "pi", "dummy", "dummy-playback"}
 }

internal/runtime/dummy_playback.go

@@ -19,9 +19,11 @@ import (
 	"github.com/fullsend-ai/fullsend/internal/ui"
 )
 
-const playlistRelPath = "results/playlist.yaml"
-const playbackCommentFile = "playback-comment-url"
-const resultFileName = "result.json"
+const (
+	playlistRelPath     = "results/playlist.yaml"
+	playbackCommentFile = "playback-comment-url"
+	resultFileName      = "result.json"
+)
 
 // Playlist is the YAML committed to .fullsend/results/playlist.yaml.
 // Results are 1-indexed: current=1 serves results[0].
@@ -322,6 +324,12 @@ func parsePlaybackCommentRef(data string) (playbackCommentRef, bool) {
 		return playbackCommentRef{}, false
 	}
 	if !found {
+		// Legacy single-line format: the entire value is the API path.
+		// Validate it starts with "/" to prevent argument injection
+		// (e.g. "--hostname=attacker.com" interpreted as a flag by gh).
+		if !strings.HasPrefix(cli, "/") {
+			return playbackCommentRef{}, false
+		}
 		return playbackCommentRef{cli: "gh", path: cli, method: "PATCH"}, true
 	}
 	if cli != "gh" && cli != "glab" {
@@ -331,6 +339,10 @@ func parsePlaybackCommentRef(data string) (playbackCommentRef, bool) {
 	if path == "" {
 		return playbackCommentRef{}, false
 	}
+	// Validate path starts with "/" to prevent argument injection.
+	if !strings.HasPrefix(path, "/") {
+		return playbackCommentRef{}, false
+	}
 	method := "PATCH"
 	if cli == "glab" {
 		method = "PUT"

internal/runtime/dummy_playback_test.go

@@ -646,6 +646,21 @@ func TestParsePlaybackCommentRef(t *testing.T) {
 			input:  "bash\n-c whoami",
 			wantOK: false,
 		},
+		{
+			name:   "argument injection in legacy single-line",
+			input:  "--hostname=attacker.com",
+			wantOK: false,
+		},
+		{
+			name:   "argument injection in two-line path",
+			input:  "gh\n--hostname=attacker.com",
+			wantOK: false,
+		},
+		{
+			name:   "relative path rejected in two-line",
+			input:  "gh\nrepos/org/repo/issues/comments/42",
+			wantOK: false,
+		},
 	}
 
 	for _, tt := range tests {

internal/runtime/registry.go

@@ -18,15 +18,16 @@ func Resolve(name string) (Backend, error) {
 		// Selected only via explicit per-repo/org config (behaviour test orgs).
 		r := DummyRuntime{}
 		return Backend{Runtime: r, Transcripts: r}, nil
+	case "dummy-playback":
+		// Replays canned results from a playlist (behaviour test orgs).
+		r := DummyPlaybackRuntime{}
+		return Backend{Runtime: r, Transcripts: r}, nil
 	case "opencode":
 		r := OpenCodeRuntime{}
 		return Backend{Runtime: r, Transcripts: r}, nil
 	case "pi":
 		r := PiRuntime{}
 		return Backend{Runtime: r, Transcripts: r}, nil
-	case "dummy-playback":
-		r := DummyPlaybackRuntime{}
-		return Backend{Runtime: r, Transcripts: r}, nil
 	default:
 		return Backend{}, fmt.Errorf("unknown runtime %q: must be one of %s", name, strings.Join(config.ValidRuntimes(), ", "))
 	}