remove mobile webview build, drafts, deepsec, and agent scratch dirs from the repo

@@ -1,9 +0,0 @@1-node_modules/2-.env*.local3-4-# Scan output — regenerated by `deepsec scan` / `process`. INFO.md5-# and SETUP.md (manually edited) stay tracked.6-data/*/files/7-data/*/runs/8-data/*/reports/9-data/*/project.json

@@ -1,74 +0,0 @@1-# deepsec2-3-This directory holds the [deepsec](https://www.npmjs.com/package/deepsec)4-config for the parent repo. Checked into git so teammates inherit5-project context (auth shape, threat model, custom matchers); generated6-scan output is gitignored.7-8-Currently configured project: `peach-browser` (target: `..`).9-10-## Setup11-12-1. `pnpm install` — installs deepsec.13-2. Add an AI Gateway / Anthropic / OpenAI token to `.env.local`. If14-   you already have `claude` or `codex` CLI logged in on this15-   machine, you can skip the token for non-sandbox runs (`process` /16-   `revalidate` / `triage`); deepsec auto-detects and reuses the17-   subscription. See18-   `node_modules/deepsec/dist/docs/vercel-setup.md` after install.19-3. Open the parent repo in your coding agent (Claude Code, Cursor, …)20-   and have it follow `data/peach-browser/SETUP.md` to fill in21-   `data/peach-browser/INFO.md`.22-23-## Daily commands24-25-```bash26-pnpm deepsec scan27-pnpm deepsec process     --concurrency 528-pnpm deepsec revalidate  --concurrency 5                  # cuts FP rate29-pnpm deepsec export      --format md-dir --out ./findings30-```31-32-`--project-id` is auto-resolved while there's only one project in33-`deepsec.config.ts`. Once you've added a second project, pass34-`--project-id peach-browser` (or whichever id you want) explicitly.35-36-`scan` is free (regex only). `process` is the AI stage (≈$0.30/file37-on Opus by default). Run state goes to `data/peach-browser/`.38-39-## Adding another project40-41-To scan another codebase from this same `.deepsec/`:42-43-```bash44-pnpm deepsec init-project ../some-other-package   # path relative to .deepsec/45-```46-47-Appends an entry to `deepsec.config.ts` and writes48-`data/<id>/{INFO.md,SETUP.md,project.json}`. Open the new SETUP.md49-in your agent to fill in INFO.md.50-51-## Layout52-53-```54-deepsec.config.ts        Project list (one entry per scanned repo)55-data/peach-browser/56-  INFO.md                Repo context — checked into git, hand-curated57-  SETUP.md               Agent setup prompt — checked in, deletable58-  project.json           Generated (gitignored)59-  files/                 One JSON per scanned source file (gitignored)60-  runs/                  Run metadata (gitignored)61-  reports/               Generated markdown reports (gitignored)62-AGENTS.md                Pointer for coding agents63-.env.local               Tokens (gitignored)64-```65-66-## Docs67-68-After `pnpm install`:69-70-- Skill: `node_modules/deepsec/SKILL.md`71-- Full docs: `node_modules/deepsec/dist/docs/{getting-started,configuration,models,writing-matchers,plugins,architecture,data-layout,vercel-setup,faq}.md`72-73-Or browse on74-[GitHub](https://github.com/vercel/deepsec/tree/main/docs).

@@ -1,88 +0,0 @@1-# peach-browser2-3-Repo context injected into every DeepSec batch. Keep findings focused on4-Peach-specific trust boundaries and invariants; built-in matchers cover5-generic web/app vulnerability classes.6-7-## What This Codebase Does8-9-Peach is a local-first, zero-knowledge password manager shipped as a browser10-extension and Capacitor web build. It has no server-side account model: the11-high-value assets are the local encrypted vault, recovered/adopted root key,12-paired-device identities, passkeys, TOTP secrets, and signed Pro license blob.13-14-Representative surfaces:15-- Background service worker: `entry.ts` starts synchronous MV3 listeners and16-  `messages.ts` is the only background `runtime.onMessage` dispatcher.17-- Vault owner: `vault.ts` is the only module that should read/write the vault18-  storage keys; popup/content reach it only through messages.19-- Page-facing content: `content/index.ts` and `inject.ts` run on `<all_urls>`20-  and render autofill/passkey UI into arbitrary host pages.21-- Sync/pairing: chirp, desktop helper, and vault adoption exchange identities22-  over Noise channels plus user-confirmed SAS.23-- Build targets differ: Chrome uses MV3 service worker/offscreen/mdns; Firefox24-  has relay/proxy content scripts and no Chrome offscreen document.25-26-## Auth And Trust Shape27-28-- Unlock is the real vault authority. Most sensitive handlers first require29-  `vault.isUnlocked()`; `restoreReady` gates cold-start reads so MV3 worker30-  startup cannot race unlock state.31-- Pro is a signed local capability, not a server session. `validateLicense`,32-  `activateLicense`, `isProUser`, and `requirePro(feature)` are the relevant33-  primitives; sync pairing is deliberately ungated, while features such as34-  Codex, canary creation, passkeys, duress, and advanced health still gate.35-- Page origin trust comes from `attestedSenderOrigin(sender)`, not payload data.36-  Page-driven passkey/autofill messages arrive through content scripts; payload37-  origins, rpIds, domains, and page strings are attacker-controlled until38-  checked.39-- Destructive messages are a special boundary: `DESTRUCTIVE_MESSAGE_TYPES`40-  must come from an extension page URL, not just an extension content script.41-- Pairing trust depends on SAS confirmation before persistence. Look for42-  `derivePairingSAS`, `gateOnSAS`, `runPairingInitiatorOpenChannel`,43-  `runPairingResponder`, and desktop `DESKTOP_PAIR_CONFIRM`.44-45-## Crypto And Storage Invariants46-47-- Vault slots are sealed with `encrypt`/`decrypt` in `aes.ts`; current callers48-  should pass slot AAD such as `"slot_a_v1"`. The legacy untagged decrypt49-  fallback is intentional compatibility only, not a pattern to copy.50-- `deriveKey` is the normal Argon2id path with password normalization.51-  `deriveKeyRaw` is a legacy fallback path only.52-- Root-key adoption uses `CREATE_VAULT_FROM_ROOT_KEY` and ADOPT frames. Root53-  key hex must be exact 32-byte material and vault-id mismatches must fail54-  before local vault creation.55-- `computeVaultId` and sync identity helpers derive LAN-linkable vault/device56-  identifiers from local key material. Treat them as pseudonymous identifiers,57-  not public account IDs.58-- `zeroKey` and byte-array clearing matter for root/master key handling; avoid59-  findings that suggest logging or retaining `root_key_hex`, rootKeyHex, or60-  derived key bytes.61-62-## Project-Specific Patterns To Flag63-64-- New background handlers outside `messages.ts`, or direct popup/content65-  imports of `vault.ts`, bypass the intended message boundary.66-- Any production callsite using test-only seams (`_testSeam`,67-  `__PEACH_E2E_PASSKEYS__`, passkey bypass flags) is a real regression.68-- Raw external hex should not feed X25519, HKDF, vault adoption, or69-  `computeVaultId` without strict 64-lowercase-hex / 32-byte validation.70-- Content-injected DOM should use `textContent`, controlled SVG strings, and71-  closed shadow roots where intended. Page-controlled strings interpolated into72-  templates are high signal.73-- The legacy bare `"popup"` lock port in `entry.ts` is compatibility-only; new74-  lock-on-close logic should use nonce-like `popup-<uuid>` ports.75-76-## Expected False Positives77-78-- Tests contain KATs, malformed frames, fuzz payloads, and adversarial message79-  calls by design. Treat `*.test.ts`, `*.spec.ts`, and adversarial suites as80-  fixtures unless a test-only bypass leaks into production code.81-- `src/drafts/**` is integration draft material and is excluded from normal82-  typecheck/test gates; it is not shipped source.83-- Generated/browser artifacts such as `dist-*`, `artifacts`, and `node_modules`84-  are not source-of-truth inputs.85-- `offscreen.html` is the extension-internal clipboard-clear document, not a86-  public web route.87-- HIBP uses SHA-1 prefixes because the public k-anonymity API requires it; the88-  project-specific invariant is use of response padding and suffix-only match.

@@ -1,55 +0,0 @@1-# Agent setup for `peach-browser`2-3-This is a deepsec scanning workspace. Project `peach-browser` was just registered4-(target: `..`). Setup is incomplete — `data/peach-browser/INFO.md`5-still has placeholder sections.6-7-## What to do8-9-1. **Read the deepsec skill.** After `pnpm install`, the file is at10-   `node_modules/deepsec/SKILL.md`. It maps every doc topic to a file11-   under `node_modules/deepsec/dist/docs/`. Read `getting-started.md`,12-   `configuration.md`, and `writing-matchers.md` (skim the rest).13-14-2. **Fill in `data/peach-browser/INFO.md`.** It's auto-injected into the AI15-   prompt for every batch — keep it short and selective.16-17-   **Length budget: 50–100 lines total.** Verbose context dilutes18-   signal in the scanner's prompt window. The goal is "what would a19-   reviewer miss if they didn't read this?", not exhaustive enumeration.20-21-   **Per-section rubric**:22-   - Pick 3–5 representative items per section. **Don't list every23-     file, helper, or callsite** — pick the patterns.24-   - Name primitives by their public name (e.g. `withAuthentication`,25-     `auth.can()`, `isTeamAdmin`). **No line numbers.** Don't enumerate26-     more than 5 paths in any list.27-   - Skip generic CWE categories — built-in matchers already cover28-     "SSRF", "SQL injection", "XSS". Cover what's *project-specific*:29-     internal auth helpers, custom middleware names, fork-specific30-     stubs, intended-public endpoints.31-   - One short paragraph or 3–5 short bullets per section. Not both.32-33-   Source material (read in this order, stop when you have enough):34-   - `../README.md`35-   - any `AGENTS.md` / `CLAUDE.md` in `..`36-   - `../package.json` (or `go.mod`, `pyproject.toml`, etc.)37-   - 5–10 representative code files (entry points, auth helpers) — not38-     a full code tour.39-40-3. **(Optional) Add custom matchers** for repo-specific patterns the41-   built-in matchers won't catch. Read42-   `node_modules/deepsec/dist/docs/writing-matchers.md` first; the43-   workflow there starts from a confirmed finding and grows the matcher44-   from it. Don't add matchers speculatively — wait for a real TP.45-46-## When you're done47-48-The user will run:49-50-```bash51-pnpm deepsec scan    --project-id peach-browser52-pnpm deepsec process --project-id peach-browser53-```54-55-You can delete this file once setup is complete.

@@ -1,12 +0,0 @@1-{2-  "ignorePaths": [3-    "dist*/**",4-    "public/ggwave/**",5-    "artifacts/**",6-    "node_modules/**",7-    ".deepsec/node_modules/**",8-    ".deepsec/data/**/files/dist*/**",9-    ".deepsec/data/**/runs/**",10-    ".koh/**"11-  ]12-}

@@ -1,20 +0,0 @@1-{2-  "filePath": "scripts/ci.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "rce",7-      "lineNumbers": [8-        549-      ],10-      "snippet": "function run(step: Step): { ok: boolean; output: string; duration: number } {\n  const start = Date.now();\n  const result = spawnSync(step.cmd, {\n    cwd: step.cwd ?? process.cwd(),\n    env: process.env,",11-      "matchedPattern": "spawnSync"12-    }13-  ],14-  "lastScannedAt": "2026-06-30T22:09:43.939Z",15-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",16-  "fileHash": "7fd2f531b7d3c6ab480a30a83fc286fe92e1920855b197d8f0ff18646c16cef3",17-  "findings": [],18-  "analysisHistory": [],19-  "status": "error"20-}

@@ -1,22 +0,0 @@1-{2-  "filePath": "scripts/generate-kat.mjs",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "crypto-usage",7-      "lineNumbers": [8-        15,9-        22,10-        2911-      ],12-      "snippet": "const NONCE = Buffer.from(\"6b65792d6e6f6e63652d3031\", \"hex\");\n\nconst km = await crypto.subtle.importKey(\n  \"raw\",\n  new TextEncoder().encode(KAT_PASSWORD),",13-      "matchedPattern": "Web Crypto API (crypto.subtle.*)"14-    }15-  ],16-  "lastScannedAt": "2026-06-30T22:09:44.272Z",17-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",18-  "fileHash": "fe6051968e82d6d89f32d953c70d9684fb3e5fdc624d738bf50d64e97fcaedc1",19-  "findings": [],20-  "analysisHistory": [],21-  "status": "error"22-}

@@ -1,78 +0,0 @@1-{2-  "filePath": "scripts/release-firefox.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "rce",7-      "lineNumbers": [8-        159-      ],10-      "snippet": "  const display = label ?? cmd;\n  console.log(`\\n▶ ${display}`);\n  execSync(cmd, { stdio: \"inherit\", cwd: ROOT });\n}\n",11-      "matchedPattern": "execSync"12-    },13-    {14-      "vulnSlug": "rce",15-      "lineNumbers": [16-        617-      ],18-      "snippet": "// Usage: bun run scripts/release-firefox.ts\n\nimport { execSync } from \"child_process\";\nimport { readFileSync, existsSync, mkdirSync } from \"fs\";\nimport { join } from \"path\";",19-      "matchedPattern": "child_process import"20-    },21-    {22-      "vulnSlug": "secret-env-var",23-      "lineNumbers": [24-        28,25-        9326-      ],27-      "snippet": "  fail(\"AMO_JWT_ISSUER not set. Add it to your shell profile and reload.\");\n}\nif (!process.env.AMO_JWT_SECRET) {\n  fail(\"AMO_JWT_SECRET not set. Add it to your shell profile and reload.\");\n}",28-      "matchedPattern": "Secret env var access"29-    },30-    {31-      "vulnSlug": "env-var-as-bool",32-      "lineNumbers": [33-        28,34-        9335-      ],36-      "snippet": "  fail(\"AMO_JWT_ISSUER not set. Add it to your shell profile and reload.\");\n}\nif (!process.env.AMO_JWT_SECRET) {\n  fail(\"AMO_JWT_SECRET not set. Add it to your shell profile and reload.\");\n}",37-      "matchedPattern": "Secret env var used as boolean"38-    },39-    {40-      "vulnSlug": "process-env-access",41-      "lineNumbers": [42-        2543-      ],44-      "snippet": "\nif (!process.env.AMO_JWT_ISSUER) {\n  fail(\"AMO_JWT_ISSUER not set. Add it to your shell profile and reload.\");",45-      "matchedPattern": "process.env.AMO_JWT_ISSUER"46-    },47-    {48-      "vulnSlug": "process-env-access",49-      "lineNumbers": [50-        2851-      ],52-      "snippet": "}\nif (!process.env.AMO_JWT_SECRET) {\n  fail(\"AMO_JWT_SECRET not set. Add it to your shell profile and reload.\");",53-      "matchedPattern": "process.env.AMO_JWT_SECRET"54-    },55-    {56-      "vulnSlug": "process-env-access",57-      "lineNumbers": [58-        9259-      ],60-      "snippet": "    \"--artifacts-dir artifacts\",\n    `--api-key=${process.env.AMO_JWT_ISSUER}`,\n    `--api-secret=${process.env.AMO_JWT_SECRET}`,",61-      "matchedPattern": "process.env.AMO_JWT_ISSUER"62-    },63-    {64-      "vulnSlug": "process-env-access",65-      "lineNumbers": [66-        9367-      ],68-      "snippet": "    `--api-key=${process.env.AMO_JWT_ISSUER}`,\n    `--api-secret=${process.env.AMO_JWT_SECRET}`,\n    \"--channel=listed\",",69-      "matchedPattern": "process.env.AMO_JWT_SECRET"70-    }71-  ],72-  "lastScannedAt": "2026-06-30T22:09:44.206Z",73-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",74-  "fileHash": "dce382f86921d3b8b75cc10fbf1cd1ad834772a8cb340113d447c6247c8e3ebb",75-  "findings": [],76-  "analysisHistory": [],77-  "status": "error"78-}

@@ -1,44 +0,0 @@1-{2-  "filePath": "scripts/release.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "rce",7-      "lineNumbers": [8-        279-      ],10-      "snippet": "function run(cmd: string, label?: string) {\n  console.log(`\\n${ACCENT}▶${RESET} ${label ?? cmd}`);\n  execSync(cmd, { stdio: \"inherit\", cwd: ROOT });\n}\n",11-      "matchedPattern": "execSync"12-    },13-    {14-      "vulnSlug": "rce",15-      "lineNumbers": [16-        1117-      ],18-      "snippet": "//   AMO_JWT_ISSUER, AMO_JWT_SECRET  (not needed for --chrome-only)\n\nimport { execSync } from \"child_process\";\nimport { readFileSync, existsSync, mkdirSync, rmSync } from \"fs\";\nimport { join } from \"path\";",19-      "matchedPattern": "child_process import"20-    },21-    {22-      "vulnSlug": "secrets-exposure",23-      "lineNumbers": [24-        16525-      ],26-      "snippet": "      \"--artifacts-dir artifacts\",\n      `--api-key=\"${AMO_JWT_ISSUER}\"`,\n      `--api-secret=\"${AMO_JWT_SECRET}\"`,\n      \"--channel=listed\",\n    ].join(\" \"),",27-      "matchedPattern": "hardcoded credential"28-    },29-    {30-      "vulnSlug": "insecure-crypto",31-      "lineNumbers": [32-        1633-      ],34-      "snippet": "\nconst ROOT = process.cwd();\nconst CHROME_ONLY = process.argv.includes(\"--chrome-only\");\n\nconst BOLD = \"\\x1b[1m\";",35-      "matchedPattern": "weak cipher algorithm"36-    }37-  ],38-  "lastScannedAt": "2026-06-30T22:09:44.011Z",39-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",40-  "fileHash": "274d70627ded7023959b4f5f2a447923dbb8db2ba332141a6186698fb5ab7403",41-  "findings": [],42-  "analysisHistory": [],43-  "status": "error"44-}

@@ -1,49 +0,0 @@1-{2-  "filePath": "src/background/aes.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "crypto-usage",7-      "lineNumbers": [8-        43,9-        59,10-        90,11-        10512-      ],13-      "snippet": "  aadTag?: string\n): Promise<{ nonce: string; ciphertext: string; tag: string }> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    keyBytes.buffer as ArrayBuffer,",14-      "matchedPattern": "Web Crypto API (crypto.subtle.*)"15-    }16-  ],17-  "lastScannedAt": "2026-06-30T22:09:44.300Z",18-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",19-  "fileHash": "309726b64bb0d51657e2a2bc24c10ebe373d375d896d2e0fbe7c943780708499",20-  "findings": [],21-  "analysisHistory": [22-    {23-      "runId": "20260701075706-0feae092f70d6cf5",24-      "investigatedAt": "2026-07-01T08:03:56.992Z",25-      "durationMs": 81450.2,26-      "agentType": "codex",27-      "model": "gpt-5.5",28-      "modelConfig": {29-        "model": "gpt-5.5"30-      },31-      "agentSessionId": "019f1cae-8382-71e3-8ad3-dbb6109ffe96",32-      "findingCount": 0,33-      "numTurns": 0.2,34-      "phase": "process",35-      "costUsd": 0.44014300000000006,36-      "usage": {37-        "inputTokens": 31713.8,38-        "outputTokens": 3856.2,39-        "cacheReadInputTokens": 331776,40-        "cacheCreationInputTokens": 041-      }42-    }43-  ],44-  "status": "analyzed",45-  "gitInfo": {46-    "recentCommitters": [],47-    "enrichedAt": "2026-07-01T08:03:57.001Z"48-  }49-}

@@ -1,54 +0,0 @@1-{2-  "filePath": "src/background/chirp-identity.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        99-      ],10-      "snippet": "// migration moves any legacy value out of `chrome.storage.sync`.\n//\n// `deviceName` defaults to a short, friendly browser+OS description and\n// can be overridden by the user from Settings → Sync.\n//",11-      "matchedPattern": "weak cipher algorithm"12-    },13-    {14-      "vulnSlug": "crypto-usage",15-      "lineNumbers": [16-        13517-      ],18-      "snippet": "  // a runtime is missing it (effectively unreachable for our targets).\n  if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n    return crypto.randomUUID();\n  }\n  const bytes = new Uint8Array(16);",19-      "matchedPattern": "Node randomUUID"20-    }21-  ],22-  "lastScannedAt": "2026-06-30T22:09:44.300Z",23-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",24-  "fileHash": "c4ebd4894d47ac62db12e0dc34c991989ea7a414dbcfa61de843d976bd2d8e2c",25-  "findings": [],26-  "analysisHistory": [27-    {28-      "runId": "20260701075706-0feae092f70d6cf5",29-      "investigatedAt": "2026-07-01T08:02:47.753Z",30-      "durationMs": 67618.4,31-      "agentType": "codex",32-      "model": "gpt-5.5",33-      "modelConfig": {34-        "model": "gpt-5.5"35-      },36-      "agentSessionId": "019f1cae-8389-7013-b8fd-a575c0019e5c",37-      "findingCount": 0,38-      "numTurns": 0.2,39-      "phase": "process",40-      "costUsd": 0.4825014,41-      "usage": {42-        "inputTokens": 45683.4,43-        "outputTokens": 3201,44-        "cacheReadInputTokens": 316108.8,45-        "cacheCreationInputTokens": 046-      }47-    }48-  ],49-  "status": "analyzed",50-  "gitInfo": {51-    "recentCommitters": [],52-    "enrichedAt": "2026-07-01T08:02:47.760Z"53-  }54-}

@@ -1,54 +0,0 @@1-{2-  "filePath": "src/background/chirp-sync-coordinator.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        549-      ],10-      "snippet": "  /** Returns base64 ciphertext for each requested entry id. */\n  getEncryptedEntries(entryIds: string[]): Promise<Record<string, string>>;\n  /** Apply incoming encrypted entries; vault decides per-entry overwrite. */\n  applyEntries(entries: Record<string, string>): Promise<void>;\n  /** Apply incoming tombstones; vault retains the latest deletion ts. */",11-      "matchedPattern": "weak cipher algorithm"12-    },13-    {14-      "vulnSlug": "secrets-plaintext-exposure",15-      "lineNumbers": [16-        27717-      ],18-      "snippet": "    if (timer.signal.aborted) reject(new Error(\"chirp_sync_timeout\"));\n    timer.signal.addEventListener(\"abort\", () => reject(new Error(\"chirp_sync_timeout\")));\n  });\n  const bytes = await Promise.race([pending, aborted]);\n  // MV-3: decrypted plaintext can exceed the wire frame (and a non-WS",19-      "matchedPattern": "plaintext reference inside logger/response/error/span call"20-    }21-  ],22-  "lastScannedAt": "2026-06-30T22:09:44.319Z",23-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",24-  "fileHash": "9f699247a730d180bb9d2b7f2d61c11959dad272ada2cf8c4bcca68a9ba560ba",25-  "findings": [],26-  "analysisHistory": [27-    {28-      "runId": "20260701075706-0feae092f70d6cf5",29-      "investigatedAt": "2026-07-01T08:03:23.190Z",30-      "durationMs": 73553.4,31-      "agentType": "codex",32-      "model": "gpt-5.5",33-      "modelConfig": {34-        "model": "gpt-5.5"35-      },36-      "agentSessionId": "019f1cae-8382-7992-945a-8c859f938715",37-      "findingCount": 0,38-      "numTurns": 0.2,39-      "phase": "process",40-      "costUsd": 0.5257544000000001,41-      "usage": {42-        "inputTokens": 36869.2,43-        "outputTokens": 3475,44-        "cacheReadInputTokens": 474316.8,45-        "cacheCreationInputTokens": 046-      }47-    }48-  ],49-  "status": "analyzed",50-  "gitInfo": {51-    "recentCommitters": [],52-    "enrichedAt": "2026-07-01T08:03:23.196Z"53-  }54-}

@@ -1,64 +0,0 @@1-{2-  "filePath": "src/background/chirp-sync-vault-adapter.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        149-      ],10-      "snippet": "// entry id means a ciphertext minted for one entry slot cannot be replayed\n// into another: decryptEntryOrNull rejects any envelope whose decrypted\n// entry.id does not match the map key it arrived under. Both sides hold the\n// same syncMasterKey (same vault) so keys match without prior negotiation. The\n// Noise XX session encrypts the transport on top — the envelope is",11-      "matchedPattern": "weak cipher algorithm"12-    },13-    {14-      "vulnSlug": "unverified-lookup",15-      "lineNumbers": [16-        12117-      ],18-      "snippet": "      for (const id of entryIds) {\n        const entry = getEntryById(id);\n        if (!entry) continue;\n        const key = await deriveEntryKey(masterKey, id);\n        out[id] = await encryptEntry(key, entry);",19-      "matchedPattern": "DB lookup by ID without ownership check in next 15 lines"20-    },21-    {22-      "vulnSlug": "crypto-usage",23-      "lineNumbers": [24-        362,25-        375,26-        39927-      ],28-      "snippet": "  const info = new TextEncoder().encode(`${entryId}\\x00${ENTRY_KEY_INFO_SUFFIX}`);\n  const raw = new HKDF(SHA256, masterKey, new Uint8Array(0), info).expand(32);\n  return crypto.subtle.importKey(\n    \"raw\",\n    raw.buffer as ArrayBuffer,",29-      "matchedPattern": "Web Crypto API (crypto.subtle.*)"30-    }31-  ],32-  "lastScannedAt": "2026-06-30T22:09:44.299Z",33-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",34-  "fileHash": "8c07699957e624057efc4399fd73d9ee44d0a6cdb5ad77de6d6cbd8fa851dc26",35-  "findings": [],36-  "analysisHistory": [37-    {38-      "runId": "20260701075706-0feae092f70d6cf5",39-      "investigatedAt": "2026-07-01T08:03:23.183Z",40-      "durationMs": 73553.4,41-      "agentType": "codex",42-      "model": "gpt-5.5",43-      "modelConfig": {44-        "model": "gpt-5.5"45-      },46-      "agentSessionId": "019f1cae-8382-7992-945a-8c859f938715",47-      "findingCount": 0,48-      "numTurns": 0.2,49-      "phase": "process",50-      "costUsd": 0.5257544000000001,51-      "usage": {52-        "inputTokens": 36869.2,53-        "outputTokens": 3475,54-        "cacheReadInputTokens": 474316.8,55-        "cacheCreationInputTokens": 056-      }57-    }58-  ],59-  "status": "analyzed",60-  "gitInfo": {61-    "recentCommitters": [],62-    "enrichedAt": "2026-07-01T08:03:23.190Z"63-  }64-}

@@ -1,73 +0,0 @@1-{2-  "filePath": "src/background/clipboard.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        6,9-        8710-      ],11-      "snippet": "// which does not survive MV3 service-worker eviction, and performed the\n// clear via `executeScript` into the *active tab*, which fails on\n// restricted pages (chrome://, web store) — both failure modes left the\n// secret on the OS clipboard indefinitely with the error swallowed.\n//",12-      "matchedPattern": "weak cipher algorithm"13-    },14-    {15-      "vulnSlug": "crypto-usage",16-      "lineNumbers": [17-        6918-      ],19-      "snippet": "\nasync function hashForVerification(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(value),",20-      "matchedPattern": "Web Crypto API (crypto.subtle.*)"21-    }22-  ],23-  "lastScannedAt": "2026-06-30T22:09:44.299Z",24-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",25-  "fileHash": "72bb099a3bab17cf0a18d0884c8e3973b47cae4f3b678c490cbd2c712c019c8b",26-  "findings": [27-    {28-      "severity": "MEDIUM",29-      "vulnSlug": "other-info-disclosure",30-      "title": "Clipboard clear alarm can skip clearing if the owed marker was not stored",31-      "description": "copyToClipboard treats failure to store CLEAR_HASH_KEY as best-effort and continues scheduling the alarm. However, the alarm handler interprets a missing CLEAR_HASH_KEY as proof that no clear is owed, clears the alarm, and returns. If chrome.storage.session.set fails after a secret is copied and the MV3 worker is evicted before the setTimeout fast path runs, the alarm wakes a cold worker and skips clearing, leaving the copied secret on the OS clipboard past the advertised timeout.",32-      "lineNumbers": [33-        105,34-        107,35-        109,36-        201,37-        202,38-        20439-      ],40-      "recommendation": "Track an explicit durable clear-owed flag and err toward clearing when marker state is unavailable or failed to write. Do not treat absence of the hash alone as proof that the clipboard has already been cleared.",41-      "confidence": "medium",42-      "producedByRunId": "20260701075706-0feae092f70d6cf5"43-    }44-  ],45-  "analysisHistory": [46-    {47-      "runId": "20260701075706-0feae092f70d6cf5",48-      "investigatedAt": "2026-07-01T08:02:47.760Z",49-      "durationMs": 67618.4,50-      "agentType": "codex",51-      "model": "gpt-5.5",52-      "modelConfig": {53-        "model": "gpt-5.5"54-      },55-      "agentSessionId": "019f1cae-8389-7013-b8fd-a575c0019e5c",56-      "findingCount": 1,57-      "numTurns": 0.2,58-      "phase": "process",59-      "costUsd": 0.4825014,60-      "usage": {61-        "inputTokens": 45683.4,62-        "outputTokens": 3201,63-        "cacheReadInputTokens": 316108.8,64-        "cacheCreationInputTokens": 065-      }66-    }67-  ],68-  "status": "analyzed",69-  "gitInfo": {70-    "recentCommitters": [],71-    "enrichedAt": "2026-07-01T08:02:47.767Z"72-  }73-}

@@ -1,49 +0,0 @@1-{2-  "filePath": "src/background/codex-handlers.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        9,9-        25,10-        212,11-        22212-      ],13-      "snippet": " * here — that lives in messages.ts.\n *\n * Design references:\n *  - /Users/june/Downloads/peach_codex_v2.md (\"Message handlers\", \"Pro gating\")\n *  - src/shared/codex-types.ts for the wire contract",14-      "matchedPattern": "weak cipher algorithm"15-    }16-  ],17-  "lastScannedAt": "2026-06-30T22:09:44.025Z",18-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",19-  "fileHash": "b4366478561ad42ad3a54c103f6ccd25d31f379e4d89f781afa725818a1466da",20-  "findings": [],21-  "analysisHistory": [22-    {23-      "runId": "20260701075706-0feae092f70d6cf5",24-      "investigatedAt": "2026-07-01T08:05:03.759Z",25-      "durationMs": 94792,26-      "agentType": "codex",27-      "model": "gpt-5.5",28-      "modelConfig": {29-        "model": "gpt-5.5"30-      },31-      "agentSessionId": "019f1cae-839f-7222-b3aa-685b0bafd4d0",32-      "findingCount": 0,33-      "numTurns": 0.2,34-      "phase": "process",35-      "costUsd": 0.6968018,36-      "usage": {37-        "inputTokens": 65268.6,38-        "outputTokens": 4124.2,39-        "cacheReadInputTokens": 493465.6,40-        "cacheCreationInputTokens": 041-      }42-    }43-  ],44-  "status": "analyzed",45-  "gitInfo": {46-    "recentCommitters": [],47-    "enrichedAt": "2026-07-01T08:05:03.765Z"48-  }49-}

@@ -1,101 +0,0 @@1-{2-  "filePath": "src/background/desktop-pairing-bg.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        1,9-        3,10-        5,11-        9,12-        10,13-        11,14-        12,15-        15,16-        16,17-        17,18-        18,19-        19,20-        24,21-        25,22-        47,23-        48,24-        89,25-        104,26-        142,27-        151,28-        156,29-        157,30-        160,31-        162,32-        165,33-        166,34-        168,35-        172,36-        176,37-        180,38-        18839-      ],40-      "snippet": "// Background wiring for desktop helper code pairing (Change 3 §Wiring).\n//\n// Keeps `desktop-pairing.ts` a PURE, dependency-injected client (so its unit",41-      "matchedPattern": "weak cipher algorithm"42-    },43-    {44-      "vulnSlug": "postmessage-origin",45-      "lineNumbers": [46-        7147-      ],48-      "snippet": "    };\n    ws.onmessage = (ev: MessageEvent) => {\n      const bytes = new Uint8Array(ev.data as ArrayBuffer);\n      const r = readers.shift();\n      if (r) { sawCloseBeforeFrame = false; r.resolve(bytes); }\n      else inbox.push(bytes);",49-      "matchedPattern": "postMessage handler WITHOUT origin validation"50-    }51-  ],52-  "lastScannedAt": "2026-06-30T22:09:44.141Z",53-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",54-  "fileHash": "2fff4b2ee27552146888813b15a1b33d604182a1a3e7dfdd20021a2153fd253c",55-  "findings": [56-    {57-      "severity": "BUG",58-      "vulnSlug": "other-state-leak",59-      "title": "Desktop pairing can remain stuck waiting for confirmation",60-      "description": "The background stores a single global pendingConfirm resolver and sets inFlight=true, but the confirm promise has no timeout or abort path. If the popup closes before the SAS screen is reached, if the advisory DESKTOP_PAIR_SAS push is missed, or if the confirm message is lost, pairWithDesktopHelper waits indefinitely and inFlight stays true until the service worker is restarted. That blocks future desktop pairing attempts with pairing_in_progress.",61-      "lineNumbers": [62-        143,63-        144,64-        177,65-        178,66-        18067-      ],68-      "recommendation": "Add a bounded confirmation timeout and an abort/cancel path that clears pendingConfirm and inFlight. Consider associating each pairing attempt with an id so stale confirms cannot resolve a later attempt.",69-      "confidence": "high",70-      "producedByRunId": "20260701075706-0feae092f70d6cf5"71-    }72-  ],73-  "analysisHistory": [74-    {75-      "runId": "20260701075706-0feae092f70d6cf5",76-      "investigatedAt": "2026-07-01T08:02:47.731Z",77-      "durationMs": 67618.4,78-      "agentType": "codex",79-      "model": "gpt-5.5",80-      "modelConfig": {81-        "model": "gpt-5.5"82-      },83-      "agentSessionId": "019f1cae-8389-7013-b8fd-a575c0019e5c",84-      "findingCount": 1,85-      "numTurns": 0.2,86-      "phase": "process",87-      "costUsd": 0.4825014,88-      "usage": {89-        "inputTokens": 45683.4,90-        "outputTokens": 3201,91-        "cacheReadInputTokens": 316108.8,92-        "cacheCreationInputTokens": 093-      }94-    }95-  ],96-  "status": "analyzed",97-  "gitInfo": {98-    "recentCommitters": [],99-    "enrichedAt": "2026-07-01T08:02:47.738Z"100-  }101-}

@@ -1,49 +0,0 @@1-{2-  "filePath": "src/background/desktop-pairing-mdns.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        1,9-        11,10-        12,11-        9912-      ],13-      "snippet": "// mDNS discovery for the peach-sync desktop helper.\n//\n// peach-sync announces `_peach-sync._tcp.local` on the LAN (PTR + SRV + TXT +",14-      "matchedPattern": "weak cipher algorithm"15-    }16-  ],17-  "lastScannedAt": "2026-06-30T22:09:44.025Z",18-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",19-  "fileHash": "99b744f3ad7115995fe707163072d67e45145ed42dc986a28f977d5f6eccb18e",20-  "findings": [],21-  "analysisHistory": [22-    {23-      "runId": "20260701075706-0feae092f70d6cf5",24-      "investigatedAt": "2026-07-01T08:05:03.766Z",25-      "durationMs": 94792,26-      "agentType": "codex",27-      "model": "gpt-5.5",28-      "modelConfig": {29-        "model": "gpt-5.5"30-      },31-      "agentSessionId": "019f1cae-839f-7222-b3aa-685b0bafd4d0",32-      "findingCount": 0,33-      "numTurns": 0.2,34-      "phase": "process",35-      "costUsd": 0.6968018,36-      "usage": {37-        "inputTokens": 65268.6,38-        "outputTokens": 4124.2,39-        "cacheReadInputTokens": 493465.6,40-        "cacheCreationInputTokens": 041-      }42-    }43-  ],44-  "status": "analyzed",45-  "gitInfo": {46-    "recentCommitters": [],47-    "enrichedAt": "2026-07-01T08:05:03.771Z"48-  }49-}

@@ -1,46 +0,0 @@1-{2-  "filePath": "src/background/desktop-pairing-probe.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        19-      ],10-      "snippet": "// Handshake-free /24 port probe for desktop pairing (Change 5).\n//\n// Unlike `probeSubnetForPeer` (chirp-sync-transport.ts), this does NOT run",11-      "matchedPattern": "weak cipher algorithm"12-    }13-  ],14-  "lastScannedAt": "2026-06-30T22:09:44.025Z",15-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",16-  "fileHash": "7029d1d502f76b08d304d4c521d242bd2ac76823ad40657f36ad81b4b8c6b883",17-  "findings": [],18-  "analysisHistory": [19-    {20-      "runId": "20260701075706-0feae092f70d6cf5",21-      "investigatedAt": "2026-07-01T08:05:03.772Z",22-      "durationMs": 94792,23-      "agentType": "codex",24-      "model": "gpt-5.5",25-      "modelConfig": {26-        "model": "gpt-5.5"27-      },28-      "agentSessionId": "019f1cae-839f-7222-b3aa-685b0bafd4d0",29-      "findingCount": 0,30-      "numTurns": 0.2,31-      "phase": "process",32-      "costUsd": 0.6968018,33-      "usage": {34-        "inputTokens": 65268.6,35-        "outputTokens": 4124.2,36-        "cacheReadInputTokens": 493465.6,37-        "cacheCreationInputTokens": 038-      }39-    }40-  ],41-  "status": "analyzed",42-  "gitInfo": {43-    "recentCommitters": [],44-    "enrichedAt": "2026-07-01T08:05:03.778Z"45-  }46-}

@@ -1,92 +0,0 @@1-{2-  "filePath": "src/background/desktop-pairing.ts",3-  "projectId": "peach-browser",4-  "candidates": [5-    {6-      "vulnSlug": "insecure-crypto",7-      "lineNumbers": [8-        1,9-        3,10-        13,11-        26,12-        30,13-        41,14-        50,15-        54,16-        63,17-        69,18-        112,19-        119,20-        121,21-        122,22-        138,23-        145,24-        147,25-        222,26-        227,27-        24228-      ],29-      "snippet": "// Desktop helper code-pairing client (Change 3).\n//\n// Pairs the extension with the `peach-sync` desktop helper:",30-      "matchedPattern": "weak cipher algorithm"31-    },32-    {33-      "vulnSlug": "cache-key-poisoning",34-      "lineNumbers": [35-        23636-      ],37-      "snippet": "    await deps.persistDevice(device);\n    if (deps.cacheLastKnownIp && device.longTermPublicKeyHex) {\n      await deps.cacheLastKnownIp(device.longTermPublicKeyHex, host).catch(() => undefined);\n    }\n    cb.onComplete(device);",38-      "matchedPattern": "Cache key includes Host header"39-    }40-  ],41-  "lastScannedAt": "2026-06-30T22:09:44.099Z",42-  "lastScannedRunId": "20260630220943-c7b8dba65193b129",43-  "fileHash": "5b6658fa6a76328b44478a5481779e651cc79bf8c2aadd14041569a303ce10b0",44-  "findings": [45-    {46-      "severity": "BUG",47-      "vulnSlug": "other-input-validation",48-      "title": "Desktop pairing persists unvalidated peer metadata",49-      "description": "decodePairIdentity validates the peer long_term_public_key_hex, but it does not validate device_type against the DeviceType enum, signing_public_key_hex as 32-byte lowercase hex, or ws_port as an integer in 1..65535. Those values are copied into the paired-device registry after SAS confirmation. A malformed or buggy helper can create a paired record that appears successful but later cannot sync, is omitted from manifests, or carries an unusable port.",50-      "lineNumbers": [51-        98,52-        103,53-        108,54-        224,55-        227,56-        229,57-        23158-      ],59-      "recommendation": "Validate the entire PAIR_IDENTITY frame before persistence: restrict device_type to extension/android/ios/desktop, validate optional signing_public_key_hex with the same 64-lowercase-hex check, and accept ws_port only when it is a finite integer between 1 and 65535.",60-      "confidence": "high",61-      "producedByRunId": "20260701075706-0feae092f70d6cf5"62-    }63-  ],64-  "analysisHistory": [65-    {66-      "runId": "20260701075706-0feae092f70d6cf5",67-      "investigatedAt": "2026-07-01T08:02:47.739Z",68-      "durationMs": 67618.4,69-      "agentType": "codex",70-      "model": "gpt-5.5",71-      "modelConfig": {72-        "model": "gpt-5.5"73-      },74-      "agentSessionId": "019f1cae-8389-7013-b8fd-a575c0019e5c",75-      "findingCount": 1,76-      "numTurns": 0.2,77-      "phase": "process",78-      "costUsd": 0.4825014,79-      "usage": {80-        "inputTokens": 45683.4,81-        "outputTokens": 3201,82-        "cacheReadInputTokens": 316108.8,83-        "cacheCreationInputTokens": 084-      }85-    }86-  ],87-  "status": "analyzed",88-  "gitInfo": {89-    "recentCommitters": [],90-    "enrichedAt": "2026-07-01T08:02:47.746Z"91-  }92-}