fix: close packaging and static-audit gaps

[pavelhov]

Audit/packaging fixes only. No Cursor OAuth/API-key changes. Proxy and GUI test runners were not reworked except where a test had to cover a fix.

1. macOS packaging copied the live working tree

Verified: scripts/build-macos-app.sh copied live src/, bin/, and ignored gui/dist. Untracked files under those trees could ship; a stale dashboard could ship.

Changed:

• Stage only git ls-files paths under src/ and bin/ (fail-fast inspect, then copy).
• Run a fresh GUI build before copying gui/dist.
• Scan the staged runtime with privacy-scan.ts --scan-root.
• Check bundled node_modules symlinks for absolute/escaping targets before archive.
• package:macos now fails on a dirty/untracked working tree. build:macos stays permissive for local dev.

2. Request limits after full arrayBuffer()

Verified: readBoundedJsonRequestBody rejected an honest Content-Length early, then called req.arrayBuffer() for missing/dishonest declarations, so the cap ran after the whole body was buffered.

Changed: Stream with getReader(), abort as soon as the byte cap is exceeded, and never call arrayBuffer().

3. Privacy scan leaked matches and skipped Swift/plist/gui/dist

Verified: Failures printed finding.value in full. Extensions did not include .swift/.plist. gui/dist/ was excluded (and is gitignored, so git ls-files never saw it).

Changed: Logs print [redacted N chars] only. Scan Swift, plist, and gui/dist when present. --scan-root walks a staged tree (used by the macOS packager). Fixture /Users/example/ under app/ remains allowlisted.

4. Uncaught URIError from malformed percent-encoding

Verified: decodeURIComponent on artifact ids (src/server/index.ts) and live call ids (src/server/live.ts) could throw and crash the request/process.

Changed: Fail closed: artifacts return 400 invalid artifact id encoding; live sideband parsing returns null.

5. Delegation Install/Update/Remove ignored confirmed-launch

Verified: Server PUT/DELETE /api/codex-delegation requires confirmed-gui-session (403 otherwise). The card enabled those buttons from local status alone.

Changed: Buttons stay disabled without a confirmed launch and show the launcher-required notice.

Also included (small and still real)

• ApiKeys.tsx catalog fetch moved from unauthenticated /v1/models (loopback bypass) to session-backed /api/models.
• Bundled node_modules symlink containment check (see packaging above).

Skipped (not trivial here)

• RELEASE_OUTPUT_DIR path containment
• Linux-only crash-restart tests
• Unsigned-vs-dist filename collision

Testing

Local (Linux):

• bun run typecheck
• bun run privacy:scan
• bun run test:parallel (606 files passed)
• cd gui && bun run test (868 tests / 139 files)
• cd gui && bun run lint
• cd gui && bun run lint:i18n
• cd gui && bun run build

Focused coverage for the fixes:

• tests/request-decompress.test.ts
• tests/privacy-scan.test.ts
• tests/package-tree-safety.test.ts
• tests/macos-build-script.test.ts (Darwin containment cases remain Darwin-gated)
• tests/server-live.test.ts
• tests/server-images.test.ts
• gui/tests/codex-delegation-setup.test.tsx
• gui/tests/subagents-classic.test.ts (launcherRequired i18n contract)
• gui/tests/api-access-models.test.ts plus ApiKeys mocks on /api/models

Waiting on GitHub ci for this branch before merging into development (not main).