fix: release theme-aware reports

[AndreaGriffiths11]

This pull request introduces several important fixes and improvements, primarily focused on security, release automation, and performance. Notably, it adds robust escaping for report content to prevent injection attacks in HTML and CSV exports, repairs the release asset upload process for Marketplace releases, and optimizes file ownership indexing and report rendering. The update also includes new tests for report utilities and updates workflow and documentation files.

Security and Report Export Improvements

• Escaped all Git- and AI-derived report content before writing HTML or CSV exports by adding escapeHtml, escapeCsvCell, and serializeForInlineScript utilities in src/core/report-utils.ts and updating report generation logic. This prevents injection attacks and spreadsheet formula exploits.
• Added comprehensive tests for escaping and serialization logic, ensuring untrusted content is neutralized in both standalone and webview HTML reports (src/core/__tests__/report-utils.test.ts).

Release Automation and CI/CD

• Fixed the release asset upload step in .github/workflows/ci-cd.yml by switching from actions/upload-release-asset to gh release upload, ensuring published Marketplace releases correctly attach their VSIX file. Also added required permissions for the release job. [1] [2]
• Updated CI to use npx vitest for running unit tests and added a type-checking step (npm run compile-tests) to catch type errors earlier.

Performance and Internal Improvements

• Improved performance by indexing file ownership once per report, batching streaming output updates, and deferring below-fold contributor avatars (as described in CHANGELOG.md).
• Added a utility function indexFilesByExpert for efficient file ownership lookup in reports (src/core/report-utils.ts).

Documentation and Housekeeping

• Updated .vscodeignore to exclude additional files and docs from the VSIX package, reducing extension size.
• Bumped extension version to 2.1.3 and documented all changes in CHANGELOG.md. [1] [2]

[github-actions]

🤖 Proof Agent Verification

⚠️ PARTIAL

PARTIAL

Copilot SDK verification failed (exit 1).
Error: CopilotSession.send_and_wait failed

PARTIAL

Copilot SDK verification error: Session error: Authorization error, you may need to run /login (Request ID: 7028:31742B:6F84F0:893B75:6A7D0DB0)

See verification_prompt.txt for the full prompt.

📋 Full verification details

### PARTIAL
Copilot SDK verification failed (exit 1).
Error: CopilotSession.send_and_wait failed
### PARTIAL
Copilot SDK verification error: Session error: Authorization error, you may need to run /login (Request ID: 7028:31742B:6F84F0:893B75:6A7D0DB0)

See verification_prompt.txt for the full prompt.

🔗 View full logs

---

Verified using Proof Agent with GitHub Copilot

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.

[github-actions]

🤖 Proof Agent Verification

❌ FAIL

• File: .github/workflows/ci-cd.yml, around line 119
  Issue: Shell command injection through an untrusted release tag interpolated directly into a run script. A tag containing shell substitutions such as $(...) may execute on the release runner. The job has contents: write, increasing impact.
  Code: gh release upload "${{ github.event.release.tag_name }}" "$VSIX_FILE" --clobber
  Severity: HIGH
  Fix: Pass github.event.release.tag_name through an environment variable and quote the variable.

• File: src/core/expertise-webview.ts, around lines 634–640 and 1280–1287
  Issue: Several AI-/data-derived numeric fields are interpolated into HTML and attributes without runtime validation or escaping. If expert.expertise or expert.contributions contains crafted text, the standalone report can become XSS-capable and the webview markup can be malformed.
  Code: <rect width="${expert.expertise * 4}" ...>; <div class="mini-bar-fill" style="width:${expert.expertise}%">; data-expertise="${expert.expertise}"
  Severity: HIGH

📋 Full verification details

- **File:** `.github/workflows/ci-cd.yml`, around line 119  
  **Issue:** Shell command injection through an untrusted release tag interpolated directly into a `run` script. A tag containing shell substitutions such as ``$(...)`` may execute on the release runner. The job has `contents: write`, increasing impact.  
  **Code:** `gh release upload "${{ github.event.release.tag_name }}" "$VSIX_FILE" --clobber`  
  **Severity:** HIGH  
  **Fix:** Pass `github.event.release.tag_name` through an environment variable and quote the variable.

- **File:** `src/core/expertise-webview.ts`, around lines 634–640 and 1280–1287  
  **Issue:** Several AI-/data-derived numeric fields are interpolated into HTML and attributes without runtime validation or escaping. If `expert.expertise` or `expert.contributions` contains crafted text, the

...*[truncated]*

[📋 View full output in action logs](https://github.com/AndreaGriffiths11/teamxray/actions/runs/31654438004)

---
*Verified using [Proof Agent](https://github.com/AndreaGriffiths11/proof-agent) with GitHub Copilot*

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.

[github-actions]

🤖 Proof Agent Verification

⚠️ PARTIAL

• File: .github/workflows/ci-cd.yml, Lines: 42–43
  Issue: The workflow replaces npm test with npx --no-install vitest run --dir src, potentially excluding the existing VS Code extension/integration test suite. This weakens release verification and can allow activation or runtime regressions into published VSIX artifacts.
  Code: run: npx --no-install vitest run --dir src
  Severity: MEDIUM

• No SQL injection, hardcoded secrets, command injection, path traversal, authentication bypass, or insecure cryptography is evident in the provided diff. The report-rendering changes consistently escape HTML/CSV/script contexts and normalize numeric values.

PARTIAL

📋 Full verification details

- **File:** `.github/workflows/ci-cd.yml`, **Lines:** 42–43  
  **Issue:** The workflow replaces `npm test` with `npx --no-install vitest run --dir src`, potentially excluding the existing VS Code extension/integration test suite. This weakens release verification and can allow activation or runtime regressions into published VSIX artifacts.  
  **Code:** `run: npx --no-install vitest run --dir src`  
  **Severity:** MEDIUM

- No SQL injection, hardcoded secrets, command injection, path traversal, authentication bypass, or insecure cryptography is evident in the provided diff. The report-rendering changes consistently escape HTML/CSV/script contexts and normalize numeric values.

### PARTIAL

🔗 View full logs

---

Verified using Proof Agent with GitHub Copilot

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.

[github-actions]

🤖 Proof Agent Verification

⚠️ PARTIAL

• File: src/core/expertise-webview.ts, Line: ~1310
  Issue: Untrusted Git-derived identity data is interpolated directly into an HTML src attribute. If getGitHubUsername() returns attacker-controlled email/name content containing quotes or attribute syntax, this can cause webview HTML injection/XSS.
  Code: src="https://github.com/${this.getGitHubUsername(expert.email, expert.name)}.png?size=96"
  Severity: HIGH
  Recommendation: HTML-escape the returned username and constrain it to a strict GitHub username allowlist before URL construction.

• File: .github/workflows/ci-cd.yml, Lines: ~32–39
  Issue: The CI workflow removes the lint and compile steps, replacing them with npm test. Unless the test command independently performs type-checking and linting, malformed or unsafe production code can pass CI and reach packaging/release.
  Code: - name: Run test suite / run: npm test
  Severity: MEDIUM

📋 Full verification details

- **File:** `src/core/expertise-webview.ts`, **Line:** ~1310  
  **Issue:** Untrusted Git-derived identity data is interpolated directly into an HTML `src` attribute. If `getGitHubUsername()` returns attacker-controlled email/name content containing quotes or attribute syntax, this can cause webview HTML injection/XSS.  
  **Code:** ``src="https://github.com/${this.getGitHubUsername(expert.email, expert.name)}.png?size=96"``  
  **Severity:** HIGH  
  **Recommendation:** HTML-escape the returned username and constrain it to a strict GitHub username allowlist before URL construction.

- **File:** `.github/workflows/ci-cd.yml`, **Lines:** ~32–39  
  **Issue:** The CI workflow removes the lint and compile steps, replacing them with `npm test`. Unless the test command independently performs type-checking and linting, malformed or unsafe production code can pass CI and reach packaging/release.  
  **Code:** `- name: Run test suite` / `run: npm 

...*[truncated]*

[📋 View full output in action logs](https://github.com/AndreaGriffiths11/teamxray/actions/runs/31654846303)

---
*Verified using [Proof Agent](https://github.com/AndreaGriffiths11/proof-agent) with GitHub Copilot*

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.

[github-actions]

🤖 Proof Agent Verification

✅ PASS

The diff does not introduce a confirmed SQL injection, command injection, credential exposure, authentication bypass, path traversal, or insecure cryptography issue.

Security controls reviewed:

• src/core/report-utils.ts:22-25 safely escapes HTML contexts.
• src/core/report-utils.ts:30-33 neutralizes </script> sequences before inline-script serialization.
• src/core/report-utils.ts:39-42 quotes CSV cells and prefixes formula-like values.
• src/core/expertise-webview.ts:175-186 restricts avatar usernames to lowercase alphanumeric characters and hyphens before URL construction.
• Numeric report values are bounded by normalizePercentage, normalizeCount, and normalizeRatio in src/core/report-utils.ts:47-78.
• Release upload uses quoted arguments in .github/workflows/ci-cd.yml:116-119, preventing release-tag shell interpretation.

📋 Full verification details

The diff does not introduce a confirmed SQL injection, command injection, credential exposure, authentication bypass, path traversal, or insecure cryptography issue.

Security controls reviewed:

- `src/core/report-utils.ts:22-25` safely escapes HTML contexts.
- `src/core/report-utils.ts:30-33` neutralizes `</script>` sequences before inline-script serialization.
- `src/core/report-utils.ts:39-42` quotes CSV cells and prefixes formula-like values.
- `src/core/expertise-webview.ts:175-186` restricts avatar usernames to lowercase alphanumeric characters and hyphens before URL construction.
- Numeric report values are bounded by `normalizePercentage`, `normalizeCount`, and `normalizeRatio` in `src/core/report-utils.ts:47-78`.
- Release upload uses quoted arguments in `.github/workflows/ci-cd.yml:116-119`, preventing release-tag shell interpretation.
- Workflow permissions are explicitly scoped in `.github/workflows/ci-cd.yml:86-87` and `.github/workflows/proof-agent.yml:8-9`.

No hardcoded secrets or unsafe query construction are present in the supplied changes. Th

...*[truncated]*

[📋 View full output in action logs](https://github.com/AndreaGriffiths11/teamxray/actions/runs/31654990726)

---
*Verified using [Proof Agent](https://github.com/AndreaGriffiths11/proof-agent) with GitHub Copilot*

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.

[github-actions]

🤖 Proof Agent Verification

⚠️ PARTIAL

Security & Correctness Assessment

Findings

1. .github/workflows/proof-agent.yml line 10 — Permission scope change

• Code: copilot-requests: write replacing models: read # Required for GitHub Models API
• Issue: Grants the workflow write access to Copilot request quota/billing scope instead of read-only Models API access, for a workflow triggered on PR events (pull_request / pull_request_target context not fully shown, but permissions block applies repo-wide for the job). If this workflow runs on pull_request_target or processes untrusted PR content with this elevated permission, a malicious PR could trigger costly or abusive Copilot API calls under repo credentials. Without seeing the trigger type and full job steps, this cannot be fully verified, but broadening from read to write on an agent-facing permission for PR-triggered automation is a privilege escalation concern.
• Severity: MEDIUM (unverified trigger context; flag for follow-up review of the on: block and job steps not shown in this diff)

2. .github/workflows/ci-cd.yml — Release upload command injection risk (fixed correctly)

📋 Full verification details

# Security & Correctness Assessment

## Findings

**1. `.github/workflows/proof-agent.yml` line 10 — Permission scope change**
- **Code:** `copilot-requests: write` replacing `models: read  # Required for GitHub Models API`
- **Issue:** Grants the workflow write access to Copilot request quota/billing scope instead of read-only Models API access, for a workflow triggered on PR events (`pull_request` / `pull_request_target` context not fully shown, but permissions block applies repo-wide for the job). If this workflow runs on `pull_request_target` or processes untrusted PR content with this elevated permission, a malicious PR could trigger costly or abusive Copilot API calls under repo credentials. Without seeing the trigger type and full job steps, this cannot be fully verif

...*[truncated]*

[📋 View full output in action logs](https://github.com/AndreaGriffiths11/teamxray/actions/runs/31656383060)

---
*Verified using [Proof Agent](https://github.com/AndreaGriffiths11/proof-agent) with GitHub Copilot*

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.3.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.