nibble-scanlisted

# nibble-scan Bite 2 of the Nibble loop. Review the code the way a senior systems engineer reviews an unfamiliar codebase under a threat model: assume inputs are hostile, environments differ, and the happy path is already covered. Report genuine defects only. Ignore formatting, naming, and cosmetic lint. Do not write fixes yet. ## Step 0: deterministic pre-pass Before reviewing by hand, run the bundled scanner from this skill's folder: ``` bash "$(dirname "$0")/scan-repo.sh" . # or point it at a subpath ``` It always runs a regex baseline (`ripgrep`, or `grep`) that covers every check, and adds a higher-precision `ast-grep` pass on top when that tool is installed, for structural bugs like `eval`, dynamic `RegExp`, wildcard `postMessage`, or unguarded environment globals. The results are candidates, not verdicts: confirm each one in the review below. If the script cannot run at all, skip it and rely on the manual review; the skill still works. ## Diagnostic focus areas These patterns recur across languages. Translate each to the language in front of you. - **Environment and global leakage (reliability).** Direct use of environment-specific globals or ambient state without a guard or fallback, in code meant to run in more than one environment. Examples: `window`, `document`, `localStorage`, `process` in JavaScript; `os.environ` or a hard-coded path in Python; a global mutable singleton in Go or Java; assuming a TTY, a filesystem, or a specific OS. - **Trust boun