Security audit remediation (PD-001…PD-050)

[aronprins]

Implements the highest-priority fixes from docs/bugs/audit.md. Build passes and all 52 unit tests are green; new tests cover the security-relevant changes.

What's fixed

Supply chain

• PD-015 — verify the bundled Node binary against nodejs.org SHASUMS256.txt before extraction
• PD-016 — version-keyed Node cache marker; a stale cache is rebuilt on NODE_VERSION bump

Electron main process

• PD-001 — single-instance lock + second-instance focus (stops a 2nd instance killing the 1st's server)
• PD-002 — strict /^\d+$/ PID validation before treeKill
• PD-005/006 — idempotent killServer (shared promise) with SIGKILL escalation after 5s
• PD-008 — port-probe connect timeout

Connection layer

• PD-040/041/049 — preflight abort timer armed through body read, 256 KB body cap, malformed JSON no longer misclassified as "unreachable"
• PD-042/050 — atomic profile write, discriminating reader (backs up corrupt files, no clobber on EACCES), mode 0600
• PD-043/044 — private-host classifier (IPv6-literal guard for fc/fd, 0.0.0.0, fe80::/10, IPv4-mapped IPv6)
• PD-011/046 — UUID-validate/regenerate profile ids + de-dup on load

Launcher UI

• PD-010 — verify-token staleness guard + verified-URL match before connect
• PD-013/014 — null snapshot guards, connect re-entry/double-submit guard
• PD-009 — preload onStatus returns an unsubscribe

Release gates / CI

• PD-021 — missing embedded server bundle now fails verification
• PD-022 — notarization fails closed unless ALLOW_UNNOTARIZED_MACOS_BUILD=true
• PD-030 — workflow_dispatch inputs routed through step env: + tag validation (all 3 workflows)
• new ci.yml — build + unit tests on PR/push
• PD-038 — noImplicitOverride, noFallthroughCasesInSwitch

Deferred (tracked in the audit's Remediation log)

PD-017/018/019/020 (need a committed staging lockfile / pinned upstream commit), PD-031 (SHA-pin actions), PD-032 (entitlements need a notarized test build), noUncheckedIndexedAccess (broad unrelated fallout), and remaining lows.

Test plan

• pnpm build ✅
• node --test test/*.test.mjs → 52 passing ✅ (added cases for PD-010 classifier, PD-039 window-policy adversarial URLs, PD-011/046/042 profile sanitization)

🤖 Generated with Claude Code