Systematic code audit: 6 verified fixes (PRs), plus confirmed + candidate findings

Ran a systematic multi-agent audit of the codebase tonight and want to record the results so nothing is lost, and so the remaining real candidates get a second set of eyes.

Method

Every app source line was reviewed in overlapping chunks by a bug-hunting pass, then each finding went through: a skeptical verifier (refute-by-default, given the real code window), then a 2-lens adversarial pass (reproducibility + caller-contract, survive only if neither refutes), then my own manual verification with a mutation-checked test on anything I turned into a fix. Funnel: 553 raw -> 270 triaged -> 121 verify-confirmed -> 103 adversarial-unanimous survivors.

Key caveat for reviewers: the flash swarm kept known-false findings through all three automated stages (e.g. it insisted a SELECT DISTINCT ... ORDER BY <non-selected col> crashes SQLite - it does not; I confirmed empirically). Automated confirmation is NOT sufficient here; each survivor needs manual verification before it becomes a fix. That is exactly why the six fixes below each ship a mutation-checked test.

Fixed (PRs, each mutation-checked)

• #908 hardening: malformed request URL crashes the LAN share-server; invalid ts RangeError aborts a Cline-family session parse; a null entry in the remote LiteLLM JSON aborts the whole pricing load.
• #909 kiro: input tokens estimated from a 500-char slice of the last turn while output summed everything (cost undercount).
• #910 optimize: result-cache key collided on (project count, api-call sum), serving stale findings.
• #911 context-budget: skills and ~/.claude/CLAUDE.md double-counted when the project dir is the home dir.

Confirmed real, not yet fixed

• models.ts model-alias table: claude-4-sonnet-thinking aliases to claude-sonnet-4-5 (its non-thinking sibling maps to claude-sonnet-4). Zero money impact today because the two price identically, but it will misprice if they ever diverge. Worth a one-line correction.

Need a repro before I would touch them (plausible, subtle)

• parser.ts ~3805: a provider-filtered cold run may set the whole-cache completeness marker with out-of-scope providers unscanned.
• providers/antigravity.ts ~1098: the count-1 run skip interacting with the monotonic-delta snapshot logic.
• 2 Swift money-path items in the menubar credential/cache path (I can't run the Swift suite here).

The full 103-survivor list with per-item verdicts is captured; happy to paste any slice. I did NOT open PRs for unverified survivors - the false-positive rate even post-adversarial was high enough that only manually-confirmed, test-backed fixes should land.