Audit and patch developer verification dependencies

.github/workflows/ci.yml

@@ -24,6 +24,9 @@ jobs:
       - name: Install (lockfile-pinned)
         run: npm ci
 
+      - name: Audit runtime and development dependencies
+        run: npm audit
+
       - name: Build (tsc typecheck + compile)
         run: npm run build
 

CHANGELOG/dependencies/developer-tool-audit.md

@@ -0,0 +1,36 @@
+# 2026-10-14 — Audit the tools coding agents actually execute
+
+A developer or coding agent could receive green CI while the test toolchain
+contained five affected packages. `npm ci` printed the advisories without
+failing, and `npm run check` audited only production dependencies—which this
+CLI does not have.
+
+Update eleven locked package records: Vitest and its seven coupled packages
+from 4.1.9 to 4.1.11; PostCSS 8.5.16 to 8.5.30; Nano ID 3.3.15 to 3.3.20; and
+source-map-js 1.2.1 to 1.2.2. The manifest declares the patched Vitest minimum.
+Other locked packages, including Vite 8.1.3, stay unchanged. No runtime
+dependency, app code or test assertion changes.
+
+Both `npm run check` and an explicit CI step now use full `npm audit`, so
+development advisories cause failure instead of an apparently clean result.
+No advisory suppression, override or force resolution is introduced.
+
+Before: full audit exited 1 with five affected packages (two moderate, three
+high), representing six advisories. After: a clean locked install and full
+audit pass with zero reported findings. The existing 364 scenario tests,
+compiler output and Node 20 CI provide behavior and compatibility checks.
+This is evidence about the known dependency graph, not a claim that all
+possible vulnerabilities are absent.
+
+Primary fixes: [Vitest](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9),
+[Nano ID negative size](https://github.com/advisories/GHSA-28wg-ghj8-5hjv)
+and [zero size](https://github.com/advisories/GHSA-2v37-7h3g-55p8),
+[PostCSS source maps](https://github.com/advisories/GHSA-r28c-9q8g-f849)
+and [follow-up fix](https://github.com/advisories/GHSA-fxqj-rqcc-2cmp),
+[source-map-js](https://github.com/advisories/GHSA-68fv-2mgg-jv7q).
+
+Vitest 4.1.11 is the patched supported line for the existing Node 20 tests;
+it is not the globally latest release. Vitest 5.0.4 modernization remains
+open and requires newer development Node/type peers plus explicit Node 20
+consumer proof. See the [migration requirements](https://vitest.dev/guide/migration/).
+The CLI's Node >=20 contract and zero-runtime-dependency promise remain.

docs/codebase/TESTING.md

@@ -4,6 +4,7 @@
 
 ```bash
 npm test                          # pretest builds (tsc), then vitest run
+npm run check                    # tests, then audit runtime AND development dependencies
 npx vitest run tests/gate.test.ts # one file
 npm run test:watch                # watch mode
 npm run proofloop:browser-proof   # the real-Chromium proof of the landing page
@@ -12,19 +13,24 @@ npm run proofloop:wig-review      # Web Interface Guidelines measurements, same
 node dist/cli.js gate             # the tool's own gate: npm run build && npm test
 ```
 
-Current state at the commit that ships this document: **28 files, 263 tests,
-0 failed**, measured 2026-08-14.
+The 2026-10-14 repair-loop baseline has **35 files, 364 tests, 0 failed**.
+The developer-tool security update reruns this unchanged suite with Vitest
+4.1.11. Read the current run's count: documentation anchors generate cases,
+so adding documentation can change it.
 
 `npm test` builds first — `pretest` runs `npm run build` — because two suites
 spawn the compiled `dist/cli.js` rather than importing TypeScript.
 
-The previous value on this line was 198 and was already stale before the commit
-that corrected it: the parent commit measures **260** on the same machine. All
-three extra cases are that commit's own, because the count is data-driven —
-`walkthrough.test.ts` generates one case per documentation anchor and one per
-markdown file under `docs/` and `promotion/`, and that commit added one anchor
-and two documents. Adding a document to this repository moves this number. Run
-the suite and read it; never assume it.
+`npm run check` and CI audit the full dependency graph because coding agents
+and developers execute the test tools too. Previously, `--omit=dev` excluded
+all installed packages in this zero-runtime-dependency project, while CI's
+install printed known vulnerabilities without failing. An advisory or an
+unavailable audit service now fails the audit step; it is not a clean result.
+
+The patched Vitest 4 line retains the existing Node 20 test environment.
+Vitest 5 modernization remains separate: it requires newer development Node
+and type peers, and must preserve explicit Node 20 consumer proof rather than
+silently raising the CLI's `>=20` runtime floor.
 
 Chromium is a separate install for the browser proof:
 `npx playwright install chromium`.

package.json

@@ -38,7 +38,7 @@
     "dev": "tsc -p tsconfig.json --watch",
     "demo": "npm run proofloop:doctor",
     "doctor": "npm run proofloop:doctor",
-    "check": "npm test && npm audit --omit=dev",
+    "check": "npm test && npm audit",
     "proof": "npm run proofloop:maturity",
     "build": "tsc -p tsconfig.json && node scripts/stamp-build-sha.mjs",
     "prepublishOnly": "npm run build",
@@ -65,6 +65,6 @@
     "@types/node": "^20.11.0",
     "playwright": "^1.62.1",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.11"
   }
 }