chore(security): resolve code-scanning and Dependabot findings

- ci.yml: drop unused checks:write and pull-requests:write from the test
  and test-macos jobs. The actions that justified them (junit-report,
  test-reporter) are no longer present, so the permissions and their
  comments were stale; the jobs now run with contents:read only.
- Apply the refurb idiom fixes flagged by code scanning across 15 files
  (dict()/list() to .copy(), chained comparisons, operator.itemgetter, a
  list comprehension, and fluent-interface chaining). Behavior-preserving.
- Bump vscode dev dependencies: @babel/core to 7.29.7 and js-yaml to 4.2.0
  to clear the npm advisories (arbitrary file read; merge-key DoS).

Author: chernistry

.github/workflows/ci.yml

@@ -1305,14 +1305,6 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
-      # Required by mikepenz/action-junit-report to create check-run
-      # annotations surfaced in the PR Checks tab.
-      checks: write
-      # Required by ctrf-io/github-test-reporter to post the test-result
-      # summary comment on the PR that triggered the run. The action no-
-      # ops gracefully on push events; the workflow-level Step Summary
-      # is always populated.
-      pull-requests: write
     env:
       # Single source of truth for the shard count. The `--shard i/N`
       # denominator below and the per-shard slice both key off this; bump
@@ -1531,7 +1523,6 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
-      checks: write
     env:
       # Per-push macOS runs only shard 1 of this many - a deterministic
       # ~1/4 subset of the file list. ci-macos-nightly.yml runs the full

docs/operations/ci-topology.md

@@ -183,7 +183,7 @@ This report lists the workflow graph surfaces reviewers need to inspect when CI
 | .github/workflows/ci-gate-stub.yml | workflow: {"contents": "read"}<br>ci-gate: {"contents": "read"} | - |
 | .github/workflows/ci-macos-nightly.yml | workflow: {"contents": "read"}<br>open-failure-issue: {"contents": "read", "issues": "write"}<br>test-macos-nightly: {"checks": "write", "contents": "read"} | GITHUB_TOKEN |
 | .github/workflows/ci-weekly-digest.yml | digest: {"contents": "read", "issues": "write"} | - |
-| .github/workflows/ci.yml | workflow: {"contents": "read"}<br>actionlint: {"contents": "read"}<br>adapter-integration: {"contents": "read"}<br>adapter-integration-macos: {"contents": "read"}<br>autofix: {"contents": "write"}<br>bandit: {"contents": "read"}<br>beartype: {"contents": "read"}<br>ci-gate: {"contents": "read"}<br>close-ci-issues: {"contents": "read", "issues": "write"}<br>coverage-report: {"contents": "read"}<br>dead-code: {"contents": "read"}<br>determine-changes: {"contents": "read"}<br>diff-coverage: {"contents": "read"}<br>dist-size: {"contents": "read"}<br>install-smoke-pipx: {"contents": "read"}<br>install-smoke-uv: {"contents": "read"}<br>lineage-gate: {"contents": "read"}<br>lint: {"contents": "read"}<br>mutmut-diff: {"contents": "read"}<br>pip-audit: {"contents": "read"}<br>pr-summary: {"pull-requests": "write"}<br>property-tests: {"contents": "read"}<br>pyright-strict-zone: {"contents": "read"}<br>repo-hygiene: {"contents": "read"}<br>schemathesis-smoke: {"contents": "read"}<br>semgrep: {"contents": "read"}<br>snapshot-tests: {"contents": "read"}<br>spelling: {"contents": "read"}<br>test: {"checks": "write", "contents": "read", "pull-requests": "write"}<br>test-macos: {"checks": "write", "contents": "read"}<br>typecheck: {"contents": "read"} | CODECOV_TOKEN, GITHUB_TOKEN |
+| .github/workflows/ci.yml | workflow: {"contents": "read"}<br>actionlint: {"contents": "read"}<br>adapter-integration: {"contents": "read"}<br>adapter-integration-macos: {"contents": "read"}<br>autofix: {"contents": "write"}<br>bandit: {"contents": "read"}<br>beartype: {"contents": "read"}<br>ci-gate: {"contents": "read"}<br>close-ci-issues: {"contents": "read", "issues": "write"}<br>coverage-report: {"contents": "read"}<br>dead-code: {"contents": "read"}<br>determine-changes: {"contents": "read"}<br>diff-coverage: {"contents": "read"}<br>dist-size: {"contents": "read"}<br>install-smoke-pipx: {"contents": "read"}<br>install-smoke-uv: {"contents": "read"}<br>lineage-gate: {"contents": "read"}<br>lint: {"contents": "read"}<br>mutmut-diff: {"contents": "read"}<br>pip-audit: {"contents": "read"}<br>pr-summary: {"pull-requests": "write"}<br>property-tests: {"contents": "read"}<br>pyright-strict-zone: {"contents": "read"}<br>repo-hygiene: {"contents": "read"}<br>schemathesis-smoke: {"contents": "read"}<br>semgrep: {"contents": "read"}<br>snapshot-tests: {"contents": "read"}<br>spelling: {"contents": "read"}<br>test: {"contents": "read"}<br>test-macos: {"contents": "read"}<br>typecheck: {"contents": "read"} | CODECOV_TOKEN, GITHUB_TOKEN |
 | .github/workflows/cifuzz-pr.yml | workflow: {"contents": "read"}<br>cifuzz: {"contents": "read"} | GITHUB_TOKEN |
 | .github/workflows/cleanup-runs.yml | workflow: {"contents": "read"}<br>cleanup: {"actions": "write"} | GITHUB_TOKEN |
 | .github/workflows/cluster-e2e.yml | workflow: {"contents": "read"} | - |

packages/vscode/package-lock.json

@@ -935,7 +935,7 @@ def _read_envelopes_from_yaml(yaml_path: Path) -> dict[str, dict[str, Any]]:
     for name, payload in envelopes_block.items():
         if isinstance(payload, dict):
             payload_d = cast("dict[str, Any]", payload)
-            out[name] = dict(payload_d)
+            out[name] = payload_d.copy()
     return out
 
 

src/bernstein/cli/commands/cost.py

@@ -143,7 +143,7 @@ def telemetry_status(home: Path | None) -> None:
     dsn = os.environ.get(sidechannel.DSN_ENV) or "(unset)"
     from bernstein.core.telemetry.share import resolve_share_endpoint
 
-    share_endpoint_configured = resolve_share_endpoint(dict(os.environ)) is not None
+    share_endpoint_configured = resolve_share_endpoint(os.environ.copy()) is not None
     lines: list[str] = [
         f"enabled: {str(state.enabled).lower()}",
         f"source: {state.source.value}",

src/bernstein/cli/commands/telemetry_cmd.py

@@ -643,7 +643,7 @@ def _verify_determinism(
 
     fingerprint = fp.compute()
 
-    if expect is None and baseline_run_id is None:
+    if expect is None is baseline_run_id:
         # Bare mode: observe-only, byte-identical to the original surface.
         # The entry count is only displayed in this branch, so the second WAL
         # scan stays scoped here rather than running for every gated call.

src/bernstein/cli/commands/verify_cmd.py

@@ -318,7 +318,7 @@ def gc_cmd(workdir: Path, yes: bool, dry_run: bool, force_unsaved: bool) -> None
         console.print("[green]No reapable worktrees - nothing to do.[/green]")
         return
 
-    targets = list(reapable)
+    targets = reapable.copy()
     if force_unsaved:
         targets.extend(unsaved)
 

src/bernstein/cli/commands/worktrees_cmd.py

@@ -156,7 +156,7 @@ def from_dict(cls, data: str | dict[str, Any]) -> AgentInfo:
             role=str(data.get("role", "")),
             model=str(data.get("model", "")),
             status=str(data.get("status", "idle")),
-            task_ids=list(cast("list[str]", data.get("task_ids") or [])),
+            task_ids=cast("list[str]", data.get("task_ids") or []).copy(),
             runtime_s=float(data.get("runtime_s", 0.0)),
             abort_reason=str(data.get("abort_reason", "")),
             abort_detail=str(data.get("abort_detail", "")),

src/bernstein/cli/ui.py

@@ -96,8 +96,7 @@ def load_approval_config(workdir: Path | None = None) -> ApprovalConfig:
         return ApprovalConfig()
     if not isinstance(raw, dict):
         return ApprovalConfig()
-    raw_mapping = cast("dict[str, Any]", raw)
-    raw_section: object = raw_mapping.get("approvals")
+    raw_section: object = cast("dict[str, Any]", raw).get("approvals")
     if not isinstance(raw_section, dict):
         return ApprovalConfig()
     section = cast("dict[str, Any]", raw_section)

src/bernstein/core/approval/gate.py

@@ -208,8 +208,7 @@ def _load(self) -> dict[str, Any]:
 
     def load_raw(self) -> dict[str, object]:
         """Return raw persisted global settings without default expansion."""
-        data = self._load()
-        return dict(data)
+        return self._load().copy()
 
     def _save(self, data: dict[str, Any]) -> None:
         """Persist data to config.yaml, creating home dir if needed."""