feat(security): add property-based fuzzing tests with fast-check (#62)

Add comprehensive fuzzing tests using fast-check library for property-based
testing. This helps discover edge cases and potential security vulnerabilities
in input validation code.
Changes:
- Add validation.fuzz.test.ts with 13 fuzzing tests (~4,650 test runs)
- Install fast-check v4.5.3 as dev dependency
- Integrate fuzzing into existing security test suite
- Update security.yml workflow comment for clarity
Test coverage:
- validateIdentity(): crash resistance, return type, dangerous patterns
- validateIdentities(): large array handling
- isPathSafe(): path traversal, shell metacharacters
- Field-specific: GPG key ID (hex), SSH host (hostname pattern)

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)


Model-Raw: claude-opus-4-5-20251101

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/security.yml

@@ -111,7 +111,7 @@ jobs:
       - name: Compile TypeScript
         run: npm run compile
 
-      - name: Run security tests
+      - name: Run security tests (includes fuzzing)
         run: npm run test:security
 
   codeql-analysis:

extensions/git-id-switcher/package-lock.json

@@ -260,6 +260,7 @@
     "lint": "eslint src --ext ts",
     "test": "npm run compile && node out/test/runTests.js",
     "test:security": "npm run compile && node out/test/runTests.js",
+    "test:fuzz": "npm run compile && node -e \"require('./out/test/validation.fuzz.test').runFuzzingTests()\"",
     "package": "vsce package",
     "publish": "echo '❌ Do not use vsce publish directly. Push a tag instead: git tag git-id-switcher-vX.X.X && git push --tags' && exit 1",
     "generate:readme": "node scripts/generate-root-readme.js"
@@ -271,6 +272,7 @@
     "@typescript-eslint/parser": "^7.0.0",
     "@vscode/vsce": "^3.0.0",
     "eslint": "^8.57.0",
+    "fast-check": "^4.5.3",
     "typescript": "^5.3.0"
   },
   "repository": {

extensions/git-id-switcher/package.json

@@ -12,6 +12,7 @@ import { runSshKeyFormatTests } from './sshKeyFormat.test';
 import { runValidatorsCommonTests } from './validatorsCommon.test';
 import { runVSCodeLoaderTests } from './vscodeLoader.test';
 import { runFileLogWriterTests } from './fileLogWriter.test';
+import { runFuzzingTests } from './validation.fuzz.test';
 
 async function main(): Promise<void> {
   console.log('╔════════════════════════════════════════════╗');
@@ -43,6 +44,9 @@ async function main(): Promise<void> {
     // Run FileLogWriter tests
     await runFileLogWriterTests();
 
+    // Run fuzzing tests (property-based testing)
+    runFuzzingTests();
+
     console.log('╔════════════════════════════════════════════╗');
     console.log('║   🎉 All Security Tests Passed!            ║');
     console.log('╚════════════════════════════════════════════╝\n');