chore(security): masking rule precision — annotate correct fail-closed sites + fix nosemgrep placement (#790)

[ClintEastman02]

Closes #790 (Category 0 of the #756 silent-success-masking gate).

What changed vs. what the issue proposed

The issue proposed tightening the rule with a pattern-not for a catch/except that contains a throw/raise. Investigation showed that can't be delivered as a clean precision win, so this PR takes a different route. Full reasoning below.

Why not the pattern-not

cli/src/linear-oauth.ts's correct classify-then-rethrow —

catch (err) {
  if (isNotFound(err)) return undefined; // "not found" legitimately means nothing
  throw err;                             // everything else fails closed
}

— is structurally indistinguishable from the conditional-rethrow masking the rule was built to catch, encoded in the maskedConditionalRethrow / masked_conditional_reraise fixtures shipped in the original rule PR #311:

catch (err) { if (cond) throw err; return null; } // sometimes throws, otherwise masks

Both "catch, contain a throw, and return an empty default." Semgrep's ... ellipsis matching is too loose to anchor on the throw being the terminal / fallthrough statement, so any pattern-not broad enough to clear the linear-oauth false positive also silences the #311 detection — a real, deliberately-flagged masking pattern. Weakening a security rule to remove two annotations is the wrong trade, so we annotate instead.

Changes

• cli/src/linear-oauth.ts (readExistingWebhookSecret) — justified nosemgrep on the classified return undefined: "no such secret" is the empty success (a first install has no bundle); every other error rethrows below (the fix(cli): linear setup clobbers a second workspace's webhook signing secret with the stack-wide one → 401 Invalid signature #611 fail-closed contract). Mirrors the already-annotated twin readExistingOauthTokens.
• cdk/src/handlers/registry-publish.ts (parseBody) — justified nosemgrep: malformed JSON is an expected client-input class, and null is the failure encoding — the caller turns it into a 400 VALIDATION_ERROR. This site is structurally identical to a real mask, so no rule change could clear it.
• agent/src/observability.py — the existing nosemgrep never bound: it was a multi-line comment whose continuation line abutted the return None, leaving the token two lines above the finding. Restructured so the # nosemgrep: token sits directly above the return.
• .semgrep/silent-success-masking.yaml — documented the placement footgun in the rule header (focus-metavariable: $RET anchors the finding on the return; the nosemgrep token must be on the return line or the line immediately above).

Verification

• semgrep test .semgrep/ passes (fixtures unchanged; feat(security): custom semgrep rules for silent-success masking (AI004) #311 detection preserved).
• All three target sites drop out of the full masking scan (19 → 16 findings; the remaining 16 are other-category baseline tracked separately under chore(security): clean up 21 pre-existing silent-success-masking findings on main #756).
• Ratcheted PR gate (security:sast:masking:range vs main) reports zero new findings.
• ruff, eslint (cli + cdk), tsc (cli + cdk), and the agent observability tests (9/9) are green.

Line numbers in the issue were verified against the PR #788 branch and had drifted; all sites re-verified on current main.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@12c9b63). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #862   +/-   ##
=======================================
  Coverage        ?   92.48%           
=======================================
  Files           ?      328           
  Lines           ?    95035           
  Branches        ?    10504           
=======================================
  Hits            ?    87891           
  Misses          ?     7144           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.