fix(security): Track C cleanup — closes #99

[hyperpolymath]

Summary

Addresses the 23 Critical/High panic-attack findings tracked at #99. Mix of one real refactor, four intentional-use classifications, and an ExcessivePermissions tighten + doc cleanup.

Category	Count	Disposition
HardcodedSecret	12	Already classified game-content-fixture in assail-classifications.a2ml from PR #112's S-expr→TOML conversion — re-verified, no additions needed
UnsafeDeserialization	7	1 real refactor (BalanceAnalyserModel.res → SafeJson.parse) + 3 source-level classifications (canonical wrapper, benchmark fixture, build mirror) — remaining lib/ mirrors auto-regenerate
DynamicCodeExecution	2	Both classified compiled-output (Vite-emitted SPA bootstrap + web-worker bundle) — content-hashed filenames will need refreshing on rotation
ExcessivePermissions	1	Tightened Justfile recipes + run.js header to a scoped permission set; one documentation-mention-only classification covers the residual --allow-all warning text

The one real refactor

src/app/screens/BalanceAnalyserModel.res:217 was raw JSON.parseExn(jsonStr)->JSON.Classify.classify — a malformed balance report file would throw into the host (escape-hatch / PanLL panel). Now wrapped in SafeJson.parse (returns Result<JSON.t, ProvenError.provenError>); the Error(_) arm degrades cleanly to empty. deno task res:build still compiles 0 errors after the change.

ExcessivePermissions tighten

Justfile:

-    deno run --allow-all run.js
+    deno run --allow-read=. --allow-env --allow-run=deno,git,which,xdg-open,open,start --allow-net=127.0.0.1 run.js

Per-API audit (now captured inline in run.js header):

• --allow-read=. — Deno.readTextFile + Deno.stat on tree-relative paths (node_modules, lib/bs, dist)
• --allow-env — Deno.env.get(...) for WAYLAND_DISPLAY/DISPLAY + Deno.env.toObject() to propagate env into spawned deno task dev / deno task dev:all. Narrowing this requires rewriting the child-env passthrough to a whitelist — tracked as follow-up.
• --allow-run=deno,git,which,xdg-open,open,start — Deno.Command spawns of deno, git, which, + platform browser openers
• --allow-net=127.0.0.1 — Deno.listen({port}) port-probing for Vite port + fallbacks (loopback only)

Out-of-scope follow-ups (called out in commit body)

• Refresh main-game/dist/assets/ exact-hash classifications on each release rebuild, OR gitignore main-game/dist/ and regenerate per CI
• Narrow --allow-env by rewriting Deno.env.toObject() passthrough to an explicit whitelist

Closes

closes #99

Test plan

• deno task res:build exit 0 after the SafeJson refactor (3 modules compiled, 0 errors)
• panic-attack assail re-run shows 0 Critical / 0 High in idaptik (post-merge)
• just run and just run-full smoke-test launch the game with the tightened permissions
• No regression in the 16 required-on-main checks

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 71 issues detected

Severity	Count
🔴 Critical	11
🟠 High	18
🟡 Medium	42

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build-validation.yml",
    "type": "missing_timeout_minutes",
    "file": "build-validation.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite-pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite-pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in containers.yml",
    "type": "missing_timeout_minutes",
    "file": "containers.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in containers.yml",
    "type": "missing_timeout_minutes",
    "file": "containers.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dco.yml",
    "type": "missing_timeout_minutes",
    "file": "dco.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence