Plan/daily driver

[queil]

No description provided.

[strix-security]

Strix Security Review

Warning

This pull request has 10 commits after the last Strix review (6913665). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

Reviewed all 71 changed files, focusing on the F# runtime source (Http.fs, Serve.fs, Eval.fs, Builtins.fs, Proc.fs, Script.fs, Check.fs, Repl.fs, Session.fs, Parser.fs, Program.fs, Complete.fs, Can.fs, Fmt.fs, Lsp.fs, SchemaTypes.fs). This PR is largely defensive security hardening — it introduces a typed HTTP client (redirect credential-drop, header-injection refusal, URL userinfo redaction) and a loopback-only HTTP server (body bounds, header-injection refusal, stream truncation), adds Secret argv masking, and refactors the init-file load/check into a shared path. Feature additions (Env.need/getOr, Seq.initInfinite, JSON Yaml nodes, anon record types, alias directives, LSP analysis cache) were traced source-to-sink against the project's stated trust model (a .weir script is as trusted as a shell script; untrusted input means malformed/hostile data). Two candidates were assessed and ruled out: jsonYamlNode's recursion is bounded by System.Text.Json.JsonDocument.Parse's default max depth of 64, and the #alias parser restricts names/chain-glyphs and resolves single-hop. No critical, high, medium, or low security findings requiring change were identified in the changed code.

_{Updated for 6913665.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}