Security hardening and dead-code pruning for public release

[scscodes]

Pre-public-release security review and cleanup pass. Net −1,138 lines; all 339 tests pass, tsc clean, bundle builds, npm audit down from 3 critical / 2 high to 2 moderate (both transitive inside npm's own bundle, dev-only; production deps were already clean).

Security fixes

Severity	Finding	Fix
High	hygiene.cleanup was palette/menu-exposed and deleted files with no confirmation (the confirm dialog only lives in the deleteFile wrapper); any extension could invoke it programmatically	Handler now defaults to dryRun: true — deletion requires explicit dryRun: false, which only the modal-confirmed Delete File flow passes. Removed from palette and tree context menu
Med	Deleting a symlink deleted its target (path-guard realpaths the candidate)	deleteFile guards the parent directory and lstats/unlinks the entry itself; directories refused
Med	process.cwd() fallbacks let the scanner/analytics crawl an arbitrary cwd with no workspace open (incl. the hourly background scan)	Handlers return WORKSPACE_NOT_FOUND; background timer only arms with a real workspace folder
Med	infrastructure/workspace.ts exported an unguarded resolveWorkspacePath shadowing the security one (dead module)	Deleted
Med	meridian.security.logging.sensitive was advertised but never enforced	Run-log error messages now pass through the redaction sanitizer (injected into CommandRouter, covered by a new test)
Low	Latent git argument-injection on unvalidated refs in unused provider methods (diff, getCommitRange, getMergeBase, …)	Methods removed entirely (zero call sites)
Low	Webview CSP over-breadth (img-src https:, host-source script-src); session-briefing webview not covered by the security test	Nonce-only script-src, img-src https: dropped, explicit connect-src 'none' everywhere; all three webviews pinned by webview-security.test.ts with new nonce/unsafe-eval assertions
Low	Unescaped enum/numeric webview sinks (defense-in-depth); LM payload serialized before egress check	Escaped/coerced; egress policy check moved before serialization

No exploitable XSS was found — all attacker-influenced strings (commit messages, authors, branch names, paths, AI prose) were already escaped or set via textContent.

Correctness & efficiency

• Large-file scan now uses fs.stat metadata instead of reading every workspace file into memory hourly (also fixes >512 MB files being silently skipped due to ERR_STRING_TOO_LONG)
• Root-anchored ignore patterns (/dist) were silently ineffective in the scan path (absolute vs relative mismatch) — paths are now matched workspace-relative
• Workspace walker prunes .git/node_modules during traversal and pre-compiles glob regexes; Set-based dedupe replaces O(n²) includes
• Impact-analysis cache key now includes functionName (analyzing function B after A in the same file returned A's cached results)
• pruneCandiates → pruneCandidates typo fixed in the exported report schema (last chance before the schema is public)
• Explorer "Delete File" hidden on folders; broken no-op palette entries hidden

Dead code removed (~1,200 lines)

Speculative scaffolding for domains that don't exist: workflow/agent/cache telemetry events + InMemoryTelemetrySink, permission/rate-limit middleware, streamProse, CHAT/WORKFLOW/AGENT/SKILL error-code namespaces, the 240-line telemetry metadata table, GIT_DEFAULTS/CHAT_SETTINGS/LOG_SETTINGS constants, retry-config plumbing, and 8 unused GitProvider methods.

Tooling

• vitest 1.x → 4.x (clears the critical/high dev-dep audit findings; two test-mock fixes for vitest 4's CJS-interop and constructor-mock changes)
• New SECURITY.md documenting network posture (no egress except policy-gated git ops + optional VS Code LM API), local-only telemetry, and filesystem boundaries

Known items deliberately not changed (noted for review)

• Deletion is permanent (fs.unlink), not trash — the modal says "cannot be undone", which is accurate; switching to vscode.workspace.fs.delete({useTrash}) would need vscode plumbed into the infra layer
• Hourly background scan still runs a synchronous ts.createProgram (bounded by 5-min TTL cache); making it a worker is a larger change
• pull(branch) validates but ignores its branch argument (runs plain git pull); behavior-preserving
• Webview context-menu JS is triplicated across the three bundles (acknowledged in code comments)

https://claude.ai/code/session_01NTdZdJhedr99fwxZrpdGka

---

Generated by Claude Code

[github-actions]

🎉 This PR is included in version 2.13.0 🎉

The release is available on:

• Visual Studio Marketplace
• GitHub release

Your semantic-release bot 📦🚀