security: drop vhs dev tool to clear critical wish SCP path traversal (CVE-2026-41589)

Dependabot alert #2 (the only open alert on the default branch) flags
github.com/charmbracelet/wish v1.4.7 in tools/go.mod for CVE-2026-41589 /
GHSA-xjvp-7243-rg9h — a critical (CVSS 9.6) path traversal in wish's SCP
middleware.

There is no fixed v1: the patch ships only as charm.land/wish/v2 >= 2.0.1,
a different module path, and the latest vhs (v0.11.0) still requires
wish v1.4.7 — so neither a version bump nor a `replace` resolves it in place.

wish is pulled in solely as an indirect dependency of the vhs dev tool. vhs is
never compiled into the mdsmith binary and nothing invokes
`go tool -modfile=tools/go.mod vhs` (the demo workflow installs a prebuilt vhs
release binary). Removing vhs from the tool directive and tidying drops wish
plus ~38 other indirect modules from the graph (258 -> 219), clearing the
alert with no impact on the shipped binary or CI.

tools/go.mod keeps its go 1.25.8 directive: the skill-eval workflow reads it
via go-version-file to compile a baseline worktree that requires 1.25.8, so the
floor stays pinned there now that vhs no longer forces it. golangci-lint and
gobco still build and run from the trimmed modfile.

Closes #617

https://claude.ai/code/session_01UT8dyBo9sjkBDNbAbAUVgs

Author: claude

.github/copilot-instructions.md

@@ -229,9 +229,9 @@ row: "- [{title}](../docs/development/{filename})"
 
 #### Build & Test Commands
 
-Requires Go 1.25+. Dev tools (golangci-lint, vhs,
+Requires Go 1.25+. Dev tools (golangci-lint and
 gobco) build from `tools/go.mod`, which needs Go
-1.25.8+; `go.mod` itself must stay tool-free so
+1.25.8+; `go.mod` itself stays tool-free so
 `go install` consumers never inherit a dev tool's
 go floor.
 

AGENTS.md

@@ -234,9 +234,9 @@ row: "- [{title}](docs/development/{filename})"
 
 ### Build & Test Commands
 
-Requires Go 1.25+. Dev tools (golangci-lint, vhs,
+Requires Go 1.25+. Dev tools (golangci-lint and
 gobco) build from `tools/go.mod`, which needs Go
-1.25.8+; `go.mod` itself must stay tool-free so
+1.25.8+; `go.mod` itself stays tool-free so
 `go install` consumers never inherit a dev tool's
 go floor.
 

CLAUDE.md

@@ -220,9 +220,9 @@ row: "- [{title}](docs/development/{filename})"
 
 ### Build & Test Commands
 
-Requires Go 1.25+. Dev tools (golangci-lint, vhs,
+Requires Go 1.25+. Dev tools (golangci-lint and
 gobco) build from `tools/go.mod`, which needs Go
-1.25.8+; `go.mod` itself must stay tool-free so
+1.25.8+; `go.mod` itself stays tool-free so
 `go install` consumers never inherit a dev tool's
 go floor.
 

docs/development/index.md

@@ -35,9 +35,9 @@ row: "- [{title}]({filename})"
 
 ## Build & Test Commands
 
-Requires Go 1.25+. Dev tools (golangci-lint, vhs,
+Requires Go 1.25+. Dev tools (golangci-lint and
 gobco) build from `tools/go.mod`, which needs Go
-1.25.8+; `go.mod` itself must stay tool-free so
+1.25.8+; `go.mod` itself stays tool-free so
 `go install` consumers never inherit a dev tool's
 go floor.
 

tools/go.mod

@@ -1,19 +1,20 @@
 module github.com/jeduden/mdsmith
 
-// Alternate modfile for dev tools only: golangci-lint, vhs, and
-// gobco are built from this graph via
+// Alternate modfile for dev tools only: golangci-lint and gobco are
+// built from this graph via
 // `go tool -modfile=tools/go.mod <tool>`. Keeping them out of
-// go.mod keeps their dependency trees and go-version floors out of
-// the module graph that `go install m@version` and library
-// consumers resolve (vhs alone forces go >= 1.25.8 here, while the
-// real dependencies in go.mod top out at 1.25.0). Tidy with
+// go.mod keeps their large dependency trees out of the module graph
+// that `go install m@version` and library consumers resolve. The go
+// directive is held at 1.25.8 — above the 1.25.0 the linters need —
+// because the skill-eval job reads it via go-version-file to compile
+// a baseline worktree that demands 1.25.8 (see
+// .github/workflows/skill-eval.yml). Tidy with
 // `go mod tidy -modfile=tools/go.mod`; the require list is a
 // superset of go.mod because an alternate modfile still covers the
 // repository's own packages.
 go 1.25.8
 
 tool (
-	github.com/charmbracelet/vhs
 	github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 	github.com/rillig/gobco
 )
@@ -54,20 +55,16 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/MirrexOne/unqueryvet v1.4.0 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
-	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/alecthomas/chroma/v2 v2.21.1 // indirect
 	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.0.1 // indirect
 	github.com/alfatraining/structtag v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/alingse/nilnesserr v0.2.0 // indirect
-	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
 	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
@@ -77,37 +74,23 @@ require (
 	github.com/breml/errchkjson v0.4.1 // indirect
 	github.com/butuzov/ireturn v0.4.0 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
-	github.com/caarlos0/env/v11 v11.4.0 // indirect
 	github.com/catenacyber/perfsprint v0.10.1 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.11 // indirect
-	github.com/charmbracelet/bubbletea v1.3.4 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/glamour v1.0.0 // indirect
-	github.com/charmbracelet/keygen v0.5.4 // indirect
 	github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834 // indirect
-	github.com/charmbracelet/log v0.4.1 // indirect
-	github.com/charmbracelet/ssh v0.0.0-20250128164007-98fd5ae11894 // indirect
-	github.com/charmbracelet/vhs v0.11.0 // indirect
-	github.com/charmbracelet/wish v1.4.7 // indirect
 	github.com/charmbracelet/x/ansi v0.10.2 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
-	github.com/charmbracelet/x/conpty v0.1.0 // indirect
-	github.com/charmbracelet/x/errors v0.0.0-20240904165849-e8e43e13f84b // indirect
-	github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/charmbracelet/x/termios v0.1.0 // indirect
 	github.com/ckaznocha/intrange v0.3.1 // indirect
 	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
-	github.com/creack/pty v1.1.24 // indirect
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
 	github.com/daixiang0/gci v0.13.7 // indirect
 	github.com/dave/dst v0.27.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
@@ -116,8 +99,6 @@ require (
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/ghostiam/protogetter v0.3.18 // indirect
 	github.com/go-critic/go-critic v0.14.3 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-rod/rod v0.116.2 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -144,7 +125,6 @@ require (
 	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/gordonklaus/ineffassign v0.2.0 // indirect
-	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.5.0 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
@@ -179,23 +159,14 @@ require (
 	github.com/maratori/testableexamples v1.0.1 // indirect
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
+	github.com/matryer/is v1.4.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
 	github.com/mgechev/revive v1.13.0 // indirect
-	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
-	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/go-app-paths v0.2.2 // indirect
-	github.com/muesli/mango v0.2.0 // indirect
-	github.com/muesli/mango-cobra v1.3.0 // indirect
-	github.com/muesli/mango-pflag v0.1.0 // indirect
-	github.com/muesli/reflow v0.3.0 // indirect
-	github.com/muesli/roff v0.1.0 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
@@ -223,6 +194,7 @@ require (
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
 	github.com/securego/gosec/v2 v2.22.11 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/sonatard/noctx v0.4.0 // indirect
@@ -251,13 +223,6 @@ require (
 	github.com/yagipy/maintidx v1.0.0 // indirect
 	github.com/yeya24/promlinter v0.3.0 // indirect
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
-	github.com/ysmood/fetchup v0.2.3 // indirect
-	github.com/ysmood/goob v0.4.0 // indirect
-	github.com/ysmood/got v0.40.0 // indirect
-	github.com/ysmood/gson v0.7.3 // indirect
-	github.com/ysmood/leakless v0.9.0 // indirect
-	github.com/yuin/goldmark v1.7.13 // indirect
-	github.com/yuin/goldmark-emoji v1.0.6 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.14.0 // indirect
 	go-simpler.org/sloglint v0.11.1 // indirect
@@ -267,11 +232,8 @@ require (
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
-	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect