harden: address actionable Hypatia advisory findings (#41)

Resolve the clearly-actionable, low-risk items from the Hypatia
neurosymbolic scan. Genuine false positives are intentionally left in
place and documented in the PR description rather than mangled.

- instant-sync.yml: presence-gate the repository-dispatch step on
  FARM_DISPATCH_TOKEN. The `secrets` context is unavailable in `if:`,
  so the token is mapped to a job-level env var and both steps skip
  when it is unset (e.g. on forks) instead of invoking the
  secret-consuming action with an empty token.
- scorecard.yml: declare explicit least-privilege job permissions
  (contents:read, security-events:write, id-token:write) matching the
  scopes the reusable Scorecard workflow declares/needs.
- codeql.yml: add the `actions` language to the analysis matrix so the
  workflow files themselves are scanned.
- run.js / Justfile: replace `deno run --allow-all` with scoped
  `--allow-read --allow-run --allow-env` (run.js needs no net/write).
- fli-editable.js: clear the cell via replaceChildren() instead of
  `innerHTML = ''`.


Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -33,6 +33,10 @@ jobs:
         include:
           - language: javascript-typescript
             build-mode: none
+          # Scan the GitHub Actions workflows themselves (CodeQL `actions`
+          # language). (Hypatia workflow_audit: codeql_missing_actions_language)
+          - language: actions
+            build-mode: none
 
     steps:
       - name: Checkout

.github/workflows/instant-sync.yml

@@ -15,11 +15,18 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    # Presence gate: the `secrets` context is not available in `if:`, so map
+    # the token to a job-level env var and skip the dispatch when it is unset
+    # (e.g. on forks) rather than invoking the secret-consuming action with an
+    # empty token. (Hypatia workflow_audit: secret_action_without_presence_gate)
+    env:
+      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
     steps:
       - name: Trigger Propagation
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
-          token: ${{ secrets.FARM_DISPATCH_TOKEN }}
+          token: ${{ env.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm
           event-type: propagate
           client-payload: |-
@@ -31,4 +38,5 @@ jobs:
             }
 
       - name: Confirm
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.github/workflows/scorecard.yml

@@ -12,5 +12,14 @@ permissions: read-all
 
 jobs:
   analysis:
+    # Explicit least-privilege permissions for the reusable Scorecard call:
+    # contents:read to check out, security-events:write to upload the SARIF,
+    # id-token:write to publish results to the OpenSSF API. Matches the scopes
+    # declared by scorecard-reusable.yml@5a93d9d5.
+    # (Hypatia workflow_audit: scorecard_wrapper_missing_job_permissions)
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
     secrets: inherit

Justfile

@@ -671,8 +671,10 @@ lint:
 # ═══════════════════════════════════════════════════════════════════════════════
 
 # Launch GSA (platform-detect, self-heal, git cycle)
+# Scoped Deno permissions (read source/stat, run subprocesses, read env) —
+# run.js needs no network or write capability of its own.
 run:
-    deno run --allow-all run.js
+    deno run --allow-read --allow-run --allow-env run.js
 
 # Run the GSA binary directly (status probe, config, etc.)
 run-admin *args: build-ffi

run.js

@@ -5,9 +5,9 @@
 // for Game Server Admin (GSA)
 //
 // Usage:
-//   deno run --allow-all run.js          # auto-detect and launch
-//   deno run --allow-all run.js --help   # show usage
-//   deno run --allow-all run.js --reflect
+//   deno run --allow-read --allow-run --allow-env run.js          # auto-detect and launch
+//   deno run --allow-read --allow-run --allow-env run.js --help   # show usage
+//   deno run --allow-read --allow-run --allow-env run.js --reflect
 
 // ─────────────────────────────────────────────────────────────────────────────
 // REGISTRY — homoiconic data; the script reads this at runtime via reflect()
@@ -248,7 +248,7 @@ if (import.meta.main) {
 ${c.bold}${REGISTRY.identity.display} — run.js${c.reset}
 ${REGISTRY.identity.license} | ${REGISTRY.identity.repo}
 
-Usage: deno run --allow-all run.js [OPTIONS]
+Usage: deno run --allow-read --allow-run --allow-env run.js [OPTIONS]
 
 Options:
   --help, -h       Show this help

src/gui/fli/fli-editable.js

@@ -216,8 +216,9 @@
       + 'border:1px solid var(--link-color,#58a6ff);border-radius:4px;outline:none;'
       + 'box-shadow:0 0 0 2px rgba(88,166,255,0.2);';
 
-    // Replace content with input
-    element.innerHTML = '';
+    // Replace content with input (replaceChildren clears without an
+    // innerHTML re-parse — no markup interpretation, no injection surface).
+    element.replaceChildren();
     element.appendChild(input);
     input.focus();
     if (input.select) input.select();