full quality audit: findings for dispatch

[jongio]

full quality audit

• [MEDIUM] actions/upload-artifact@v4 in .github/workflows/ci.yml (line 91) is not pinned to a full commit SHA - every other GitHub Action in all three workflow files uses a full SHA pin, making this the sole exception and a supply-chain security gap inconsistent with the project's own policy
• [LOW] fetchLatestVersion in internal/update/check.go decodes the GitHub Releases API response body without a size limit (json.NewDecoder(resp.Body).Decode()) - unlike checksum and binary downloads in the same package which use io.LimitReader; a malicious or oversized response could cause unbounded memory consumption
• [LOW] glamour transitively requires charmbracelet/lipgloss v1 while the rest of the codebase depends on lipgloss v2, creating a split dependency tree; acknowledged in go.mod with a comment referencing issue chore(deps): glamour v1.0.0 pulls in lipgloss v1 alongside direct lipgloss v2 dependency #59 but unresolved
• [LOW] ChronicleReindex in internal/data/chronicle.go uses fragile PTY terminal output substring matching ("reindexed", "sessions") to determine success, with a final fallback that silently returns nil (success) if neither string appears - genuine CLI failures can be swallowed without error
• [LOW] Four TUI functions (Model.hiddenCount, Model.launchNewSession, IconHidden, IconList) are compiled into the production binary but unreachable from any production code path; they are in the dead-code allowlist as "pending production use" and should either be wired up or removed

Automated analysis - 5 finding(s)

[jongio]

Resolved by swarm session 2026-06-07. 3 of 5 findings addressed (upload-artifact deferred to PR #117, glamour skipped): io.LimitReader on version fetch, improved ChronicleReindex matching, removed 4 dead functions.