[clavery]

Summary

Fixes the actionable code scanning and Dependabot findings.

• API Browser (VS Code): the webview's fetch interceptor matched commercecloud.salesforce.com anywhere in the URL, and the extension-host proxy forwarded any URL it was given. That let a request reach other hosts and get around the webview's connect-src policy. Both now require HTTPS and a *.commercecloud.salesforce.com hostname.
• API key logging: the TypeScript and Python SDKs logged the first 8 characters of an API key at debug level, or the whole key when it was short. They now log only the header name.
• mrt-reference-app: the outbound loop test built its target from ?path=, so an absolute URL could make the app fetch any host. It now returns 400 unless the target stays on the external domain. The app is private and not published.
• Regexes and scaffold merge (SDK): replaced regexes that can backtrack badly on crafted input (CIP host, SCAPI API filter, skill name sanitizing, skill frontmatter, scaffold path templates). Scaffold JSON merging now rejects __proto__/constructor/prototype path segments and skips __proto__ keys in merged content.
• Direct dependencies:
  • zod 4.5.4 → 4.6.7 in b2c-dx-mcp (memory exhaustion validating oversized collections).
  • http-proxy-middleware 3.0.5 → 3.0.7 in mrt-utilities. The workspace override hid this in the repo, but npm consumers still resolved 3.0.5.
• Transitive dependencies: raised or added overrides for vulnerable transitive packages (ajv, body-parser, browserslist, baseline-browser-mapping, esbuild, fast-uri, js-yaml, source-map-js, vite, vue, yaml, @humanfs/node). Each override stays within the range its parent declares.
  • Still open and documented as accepted in pnpm-workspace.yaml: diff@7 (via mocha 11), uuid@8 (via @vscode/vsce) and http-cache-semantics (no patched release). All three are dev-only.
• Workflows: added permissions: contents: read to e2e-tests.yml, e2e-shell-tests.yml and test-actions.yml. Removed the CLI e2e step that opened an issue when a scheduled run failed. It needed issues: write and had stopped working when the default token became read-only.

Testing

• pnpm run lint:agent, pnpm run typecheck:agent and pnpm run build pass.
• pnpm -r run test:agent passes in every package except the SDK, where auth/oauth-implicit / auth/oauth-pkce fail with EADDRINUSE under --parallel. This is an existing race in getAvailablePort(): the port changes every run, and those files pass when run on their own.
• Python SDK: 1201 pytest tests pass and ruff is clean. tests/test_notebooks.py was not run because nbformat isn't installed locally.
• Manual: in the VS Code API Browser, open a SCAPI contract and confirm "Try it out" requests still go through the proxy.