[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-api/routes/recipes/manage.js

@@ -1,8 +1,23 @@
 const express = require('express');
 const { DOCKER } = require('../../src/utilities/constants');
-const { NotFoundError } = require('../../src/utilities/errors');
+const { NotFoundError, ValidationError } = require('../../src/utilities/errors');
 const { ok } = require('../../src/utils/responses');
 
+/**
+ * Validate a recipe ID for use in Docker label filters.
+ * @param {string} recipeId - Recipe ID from route param
+ * @throws {ValidationError} if the ID contains unsafe characters
+ */
+function validateRecipeId(recipeId) {
+  if (!recipeId || typeof recipeId !== 'string') {
+    throw new ValidationError('Recipe ID is required');
+  }
+  // Recipe IDs are slug-style: lowercase letters, numbers, hyphens
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(recipeId)) {
+    throw new ValidationError('Invalid recipe ID format');
+  }
+}
+
 module.exports = function({ servicesStateManager, asyncHandler, log, docker, notification, buildDomain, caddy }) {
   const router = express.Router();
 
@@ -107,6 +122,7 @@ module.exports = function({ servicesStateManager, asyncHandler, log, docker, not
    */
   router.post('/:recipeId/start', asyncHandler(async (req, res) => {
     const { recipeId } = req.params;
+    validateRecipeId(recipeId);
     const containers = await findRecipeContainers(recipeId);
 
     if (containers.length === 0) {
@@ -138,6 +154,7 @@ module.exports = function({ servicesStateManager, asyncHandler, log, docker, not
    */
   router.post('/:recipeId/stop', asyncHandler(async (req, res) => {
     const { recipeId } = req.params;
+    validateRecipeId(recipeId);
     const containers = await findRecipeContainers(recipeId);
 
     if (containers.length === 0) {
@@ -170,6 +187,7 @@ module.exports = function({ servicesStateManager, asyncHandler, log, docker, not
    */
   router.post('/:recipeId/restart', asyncHandler(async (req, res) => {
     const { recipeId } = req.params;
+    validateRecipeId(recipeId);
     const containers = await findRecipeContainers(recipeId);
 
     if (containers.length === 0) {
@@ -196,6 +214,7 @@ module.exports = function({ servicesStateManager, asyncHandler, log, docker, not
    */
   router.delete('/:recipeId', asyncHandler(async (req, res) => {
     const { recipeId } = req.params;
+    validateRecipeId(recipeId);
     const containers = await findRecipeContainers(recipeId);
 
     if (containers.length === 0) {