audit: comprehensive src audit findings

[avoidwork]

Audit Summary

Comprehensive audit of ./src for bugs, security vulnerabilities, and performance issues.

Findings

Medium: Sync FS in async functions (2 locations)

File	Line	Issue	Severity
src/scheduler/scheduler.js	89	existsSync() inside async runNow()	Medium
src/tools/cron.js	22, 41, 46	existsSync() inside async findSkillScript()	Medium

Recommendation: Replace existsSync() with fs.promises.exists() in async contexts to avoid blocking the event loop.

Low: Silent catch in streaming callback (1 location)

File	Line	Issue	Severity
src/tui/app.js	779	catch (_cbErr) silently ignores streaming callback errors	Low

Note: Intentional for streaming callbacks, but consider logging at debug level for troubleshooting.

Info: readFileSync in non-async functions (12 locations)

All use readFileSync() in synchronous utility functions — acceptable per AGENTS.md §1.1:

File	Line	Function
src/logger.js	27	getLogDirectory()
src/agent/agents/code-review.js	16	getPrompt()
src/agent/agents/coding.js	16	getPrompt()
src/agent/agents/debug.js	16	getPrompt()
src/agent/agents/documentation.js	16	getPrompt()
src/agent/agents/performance.js	16	getPrompt()
src/agent/agents/research.js	16	getPrompt()
src/agent/agents/search.js	16	getPrompt()
src/agent/agents/security-audit.js	16	getPrompt()
src/agent/agents/testing.js	16	getPrompt()
src/config/loader.js	147, 169	loadConfig(), saveConfig()
src/memory/context.js	38, 66	loadContext()
src/memory/profile.js	67, 92	loadProfile(), saveProfile()
src/memory/reader.js	49	readEntry()
src/memory/writer.js	57	writeEntry()
src/session/loader.js	49	loadSession()
src/skills/discoverer.js	130	discoverSkills()
src/skills/registry.js	140	getSkillBody()
src/sandbox/runner.js	46	detectShebang()
src/scheduler/autoSchedule.js	66	saveSchedule()

Clean Areas

• ✅ No eval(), new Function(), or __import__()
• ✅ No wildcard exports (export * from)
• ✅ No hardcoded secrets or API keys
• ✅ No SQL injection vectors
• ✅ No infinite loops (while(true))
• ✅ All fetch() calls have proper timeout coverage via AbortController
• ✅ No mutation during iteration issues (backwards iteration in gc.js is correct pattern)
• ✅ No silent catch blocks (false positives from grep pattern matching)

[avoidwork]

Fixed in #622.