Relocate BDD tests to correct Behave directories and fix step definitions:
- Move feature file from features/scripts/ to features/ (Behave root)
- Move step file from features/scripts/ to features/steps/ with correct naming
- Fix step file to use importlib.util for loading hyphenated script filename
- Fix mock patching to use patch.object on loaded module's subprocess
- Rename ambiguous step definitions to avoid conflicts with existing steps

@@ -22,6 +22,65 @@ import sys
 from pathlib import Path
 
 
+def validate_path(path_str: str, project_root: Path | None = None) -> Path:

@@ -50,6 +110,7 @@ def check_typecheck() -> tuple[bool, str]:
         capture_output=True,
         text=True,
         check=False,

@@ -25,0 +62,4 @@
+
+    # Resolve to absolute path to prevent traversal
+    try:
+        resolved = path.resolve()

@@ -0,0 +1,78 @@
+Feature: Quality gates script prevents command injection attacks

@@ -0,0 +11,4 @@
+
+def _load_quality_gates_module():
+    """Load the check-quality-gates.py script as a module via importlib."""
+    spec = importlib.util.spec_from_file_location(

@@ -22,6 +22,69 @@ import sys
 from pathlib import Path
 
 
+def validate_path(path_str: str, project_root: Path | None = None) -> Path:

@@ -50,6 +114,7 @@ def check_typecheck() -> tuple[bool, str]:
         capture_output=True,
         text=True,

@@ -25,0 +62,4 @@
+            raise ValueError(f"Path contains dangerous pattern: {pattern}")
+
+    # Convert to Path object
+    path_obj = Path(path_str)

@@ -0,0 +27,4 @@
+    Then the validation should fail
+    And the path validation error should contain "dangerous pattern"
+
+  Scenario: Paths with pipe are rejected

@@ -0,0 +8,4 @@
+from behave import given, then, when
+from behave.runner import Context
+
+

@@ -0,0 +129,4 @@
+def step_all_paths_validated(context: Context) -> None:
+    """Assert that all path arguments were validated."""
+    assert hasattr(context, "mock_run"), "No mock_run available"
+    assert context.mock_run.called, "subprocess.run was not called"

@@ -5,7 +5,7 @@ Aggregates results from multiple quality tools and produces a summary
 report. Returns non-zero exit code if any critical gate fails.
 
 Usage:

@@ -25,0 +30,4 @@
+    command injection when passed as subprocess arguments.
+
+    Args:
+        path_str: The path string to validate

@@ -25,0 +35,4 @@
+
+    Returns:
+        A validated, resolved Path object
+