Security, perf, and robustness hardening (audit-driven) + README refresh

[aletc1]

Summary

Two commits shipped off a security/correctness/performance audit of src/main/**. Every finding was verified by direct source reads — a few initial agent claims were dismissed (see commit body).

Security (P0)

• Shell-injection hardening — voice.ts and claude/env.ts no longer interpolate $SHELL into a shell string; they now use execFileSync(shell, [...argv]) with a safe-shell allowlist. claude-token.ts drops shell: true and resolves the claude CLI to an absolute path via which/where before spawning.
• OAuth deep-link CSRF fix — The /auth handler now requires an in-flight flow initiated by startAuthFlow(). A per-flow state nonce is generated, attached to the auth URL, and verified with constant-time compare on callback. Drive-by deep links (twentyfirst-agents://auth?code=... from a malicious page) are rejected.

Performance (P1)

• PRAGMA synchronous = NORMAL under WAL — cuts fsync load during streaming persistence.
• FK indexes on chats.project_id, sub_chats.chat_id, and sub_chats.stream_id (previously full-table scans). New migration drizzle/0009_wise_rumiko_fujikawa.sql.
• text-delta coalescing — 24 ms buffer in the Claude streaming subscription, keyed by text id. Non-delta chunks flush first so ordering is preserved. Reduces tRPC/IPC churn and renderer re-render pressure on long responses.

Robustness (P2)

• Migration failure recovery — the DB file is quarantined to agents.db.broken-<timestamp> and a fresh DB initialized, so corrupt-DB state can't brick app launch anymore.
• Bounded cleanupGitWatchers() on quit (1.5 s) so a hung chokidar instance can't block shutdown.

Docs

• README refresh — Fork Additions now reflects commits fix(stability): remaining crash/hang fixes from stability pass #18–feat: drag-to-split, queue reorder, Cmd+Shift+T, PR auto-refresh #26 and is grouped into Workflow & UI, Git/PRs/Worktrees, Models, and Stability & Polish for readability.

Out of scope / dismissed during audit

• sandbox: false in webPreferences is intentional for electron-trpc (contextIsolation remains on) — defense-in-depth, not a critical gap.
• activeSessions cleanup is already wired in both the stream's finally and the observable's unsubscribe handler.
• The long async IIFE in claude.ts is wrapped in try/catch/finally; no unhandled-rejection path.
• Project deletion is atomic under SQLite FK cascade with foreign_keys=ON.

Test plan

• Set SHELL='/bin/zsh; echo pwned > /tmp/pwn', trigger the voice and shell-env bootstrap paths, confirm /tmp/pwn is not written.
• Run open "twentyfirst-agents-dev://auth?code=foo" without clicking Sign In first → rejected in log, no exchange attempted.
• Click Sign In, complete OAuth → login still works end-to-end.
• After migration lands, EXPLAIN QUERY PLAN SELECT * FROM sub_chats WHERE chat_id=? → uses sub_chats_chat_id_idx.
• Stream a long (>2 k token) response, profile the renderer main thread — emit count drops ~10× with identical final output.
• Truncate agents.db to simulate corruption → relaunch produces a fresh DB with agents.db.broken-* sibling.
• Open a project, quit the app, relaunch → no stale file handles on the project dir.
• Smoke: bun run dev, create chat, send message in Plan and Agent mode, rollback, fork, switch sub-chats.