[vsce-testing] Driver extension queue accepts arbitrary commands/paths — unauthenticated local RPC surface

Description

The driver-extension/extension.js queue poller in .github/skills/vsce-testing/ accepts any req-*.json file dropped into the queue directory and dispatches arbitrary step types including command, openFile, setDocumentText, replaceText, saveDocument, commandArgs, queryCompletions, queryHover, queryDefinition, and queryDiagnostics — without authentication or allowlisting.

This effectively creates an unauthenticated local RPC surface that can:

• Execute arbitrary VS Code commands via executeCommand
• Open, read, edit, and save arbitrary files via openTextDocument/replaceText/saveDocument
• Extract code intelligence data via queryCompletions/queryHover/queryDefinition

Impact

Any local process can drop a request JSON into the queue directory and gain full control over the VS Code instance's editing and command execution capabilities.

Recommendation

• Add a per-session secret or nonce to queue requests for authentication
• Allowlist step types and command IDs to the minimal harness set
• Reject file paths outside the opened workspace root
• Consider removing unused step types (queryCompletions, queryHover, queryDefinition, queryDiagnostics, setDocumentText, replaceText) that the harness doesn't currently exercise

Source

Identified during PR review of the vsce-testing skill move. Pre-existing in the original standalone harness.

Start with .github/skills/vsce-testing/driver-extension/extension.js and trace how req-*.json files are read and how each listed step is dispatched. Define the minimal harness operations and workspace boundary from the issue, then verify unauthenticated requests and out-of-root paths are rejected while required operations still work.