feat(tests): add Stryker mutation testing to VS Code extension

- Install @stryker-mutator/core v9.6.1 as a devDependency
- Add stryker.config.mjs targeting compiled JS in out/src/ to avoid
  a TypeScript recompile step per mutant:
  - Mutates 7 core logic files (tokenEstimation, sessionParser,
    maturityScoring, usageAnalysis, utils/*)
  - Runs 9 explicit unit test files (no shell globs for cross-platform safety)
  - coverageAnalysis: off with command runner (node:test built-in)
  - concurrency: 2, timeoutMS: 15000
  - Threshold break: 0 (informational during rollout)
  - HTML report written to reports/mutation/report.html
- Add test:mutation npm script: compile-tests then npx stryker run
- Add mutation-testing CI job in ci.yml:
  - Only runs on pull_request events (not push to main)
  - Depends on build job (tests must pass first)
  - continue-on-error: true to keep it non-blocking
  - Hard cap at 20 minutes
  - Uploads HTML report artifact (14-day retention)
- Add .stryker-tmp and reports/mutation/ to .gitignore

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rajbos

.github/workflows/ci.yml

@@ -83,6 +83,51 @@ jobs:
           vscode-extension/out/
         retention-days: 7
 
+  mutation-testing:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'pull_request'
+    # Informational — does not block the PR. A failing mutation score
+    # is visible in the artifact but does not block merging during rollout.
+    continue-on-error: true
+
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+      with:
+        egress-policy: audit
+
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+    - name: Setup Node.js
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      with:
+        node-version: '20.x'
+        cache: 'npm'
+        cache-dependency-path: vscode-extension/package-lock.json
+
+    - name: Install dependencies
+      working-directory: vscode-extension
+      run: npm ci
+
+    - name: Compile tests
+      working-directory: vscode-extension
+      run: npm run compile-tests
+
+    - name: Run mutation tests
+      working-directory: vscode-extension
+      run: npx stryker run
+      timeout-minutes: 20
+
+    - name: Upload mutation report
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      if: always()
+      with:
+        name: mutation-report
+        path: vscode-extension/reports/mutation/
+        retention-days: 14
+
   package:
     runs-on: ubuntu-latest
     needs: build

.gitignore

@@ -4,6 +4,8 @@ node_modules
 .vscode-test/
 *.vsix
 *.backup
+.stryker-tmp
+reports/mutation/
 .github/scripts/models.txt
 .github/scripts/scraper.log
 .github/scripts/scraped-models.json