[danoszz]

Code cleanup with no behaviour change. Stacked on #70 (base fix/security-review-2), so retarget to main after #70 merges. PR #63 is still open, so this PR doesn't touch the dashboard client.

What changed

Area	Before	After
Git runners	4 copies: src/agent/git.js, lib/hook/index.js, lib/deps/lockfile.js, src/cli/detect.js	lib/git.js: safe config, git(), gitSpawn(), gitToplevel(). The loop's allow-list runner builds on it. Reads that need the repo's real core.hooksPath pass raw: true
Markdown escaping	mdInline plus 4 hand-rolled table-cell escapes in CI scripts	src/report/md-escape.js: mdInline (untrusted text) and mdCell (our own CI tables)
Fetch wrappers	3 copies of fetch → status check → capped JSON parse in recon	fetchJson() in src/utils/http.js (on top of #70's readBody)
Temp folders	mkdtemp + try/finally rmSync in hook and install	lib/tmp.js: withTempDir()
Dead code	findShadowEndpoints, getTemplateStats, DEPS_FLAGS, stagedFiles (never referenced), runFile in machine.js, unused imports and bindings	removed
Lint	none	eslint.config.js (recommended rules minus style-only ones), npm run lint, and a CI step before the tests. ESLint 10.12.0, @eslint/js 10.0.1 and globals 17.12.0 are pinned exactly, each at least two weeks old, and are dev-only

Unused flags: none found. Every parsed option is read and documented. fix --plan is the documented default mode.
Module splits: none. The largest files are cohesive: lib/machine.js (machine audit), lib/injections.js (probes) and lib/deps/index.js. src/cli.js is mostly a single 600-line run(), and splitting it would be a rewrite while #70 and #63 are in flight.
Runtime dependencies: still exactly one (yaml).

Numbers

	Before (#70 head)	After
Lines in bin + src + lib + scripts	35,028	35,026 (two new documented modules absorb the removed copies)
Lines in tests	13,323	13,322
Packed	683,240 B	683,617 B
Unpacked	1,814,746 B	1,815,454 B
Files in package	185	187 (lib/git.js, lib/tmp.js)
Locked packages (dev included)	68	145 (ESLint)

The line count barely moves. The gain is one place each for the git safety config, escaping and temp folders, not a smaller codebase.

Tests

• npm run lint: clean.
• npm test: 1,010 passed, 21 skipped, the same as fix(security): fail closed in deps, hook and git; bound the dashboard, HTTP and regex paths #70. The test edits only remove unused imports (tests/ui.test.js, tests/validate-report.test.js, tests/pentest-adaptive.test.js) and one unused const result = binding; no assertion changed.
• npm run audit:internal: all gates pass.

Small side effects

• The hook's checkout-index and the lockfile and detect reads now run with the same safe config overrides as the loop: no hooks, no signing, no attributes file. For a normal repo the output is the same.
• If recon gets a JSON null body, it returns no results instead of throwing.

🤖 Generated with Claude Code

[github-actions]

Dependency capability diff

Compared against 0562cbaba42143bdce1c535b4b274e5cccf7be47: 75 added · 2 changed · 0 removed.

Upgrades that gained capabilities

Package	Version	Gained	Evidence
ajv	8.20.0 → 6.15.0	computed require/import	node_modules/eslint/node_modules/ajv/scripts/bundle.js:15

New packages

Package	Version	Can do
@​humanwhocodes/module-importer	1.0.1	computed require/import
cross-spawn	7.0.6	shell, env vars
debug	4.4.3	env vars, whole environment
eslint	10.12.0	env vars, dynamic code, computed require/import
fast-json-stable-stringify	2.1.0	computed require/import
ignore	5.3.2	env vars
isexe	2.0.0	env vars
minimatch	10.2.6	env vars
path-key	3.1.1	env vars
which	2.0.2	env vars

Evidence (file:line)

ajv@​6.15.0

• computed require/import: node_modules/eslint/node_modules/ajv/scripts/bundle.js:15 var json = require(path.join(packageDir, 'package.json'));

cross-spawn@​7.0.6

• shell: node_modules/cross-spawn/index.js:3 const cp = require('child_process');

debug@​4.4.3

• whole environment: node_modules/debug/src/node.js:124 exports.inspectOpts = Object.keys(process.env).filter(key =› {

eslint@​10.12.0

• dynamic code: node_modules/eslint/lib/rules/no-eval.js:58 description: "Disallow the use of ˋeval()ˋ",
• dynamic code: node_modules/eslint/lib/rules/no-implied-eval.js:25 description: "Disallow the use of ˋeval()ˋ-like methods",
• dynamic code: node_modules/eslint/lib/rules/no-param-reassign.js:12 /(?:Statement¦Declaration¦Function(?:Expression)?¦Program)$/u;

_{penthera deps v1.7.0: offline static analysis, no telemetry. Capabilities are what code can do, not a verdict.}

Checked by Penthera, open-source security for the apps and AI systems you ship · https://github.com/danoszz/penthera

_{Updated for commit fdb6252 · workflow run. This comment is edited in place on every push.}