chore(deps): update toolchain and security actions

[steipete]

Summary

• update pnpm, Node typings, oxfmt, and oxlint to their latest stable releases
• make the checked-in packageManager field the single pnpm version source for CI, Crabbox, and release workflows
• update the immutable CodeQL pin to 4.37.4
• update both the TruffleHog action and its explicit scanner input to 3.96.0
• reconcile the unreleased changelog

This supersedes #166: that branch stops at CodeQL 4.37.3 and updates the TruffleHog action wrapper without updating the explicit 3.95.9 scanner input.

I intentionally left actions/stale on v10. Version 11 is the only remaining newer major, and its live behavior mutates repository issues and pull requests; this sweep does not have a safe non-mutating live proof for that major.

Proof

• pnpm 11.18.0 installed the frozen lockfile and passed its 140-entry supply-chain policy check
• pnpm outdated --format json: {}
• oxfmt 0.61.0 format check: pass
• oxlint 1.76.0 lint: pass
• TypeScript type-check with Node typings 26.1.2: pass
• full test suite: 894 passed, 1 skipped
• production build: pass
• actionlint: pass
• built CLI 0.7.1: real init, heuristic map of 37 features, and status run; zero locks and zero findings
• hosted CI/package smoke, TypeScript and Actions CodeQL, dependency review, and both TruffleHog scans: pass
• independent full-branch autoreview: no actionable findings, 0.99 confidence
• secret scan and public model-identifier gate: clean

The GitHub checks on this PR provide the live hosted proof for the updated CodeQL and TruffleHog actions.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 2:05 AM ET / 06:05 UTC.

ClawSweeper review

What this changes

The PR updates pnpm and development-tool versions, advances immutable CodeQL and TruffleHog pins, and makes CI, release, and Crabbox hydration read the pnpm version from package.json.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This is a focused, technically sound dependency and workflow update with passing hosted CI and security checks. It should remain open for maintainer review because it changes pnpm selection in the release and Crabbox hydration paths, which have not been directly exercised in the supplied proof.

Priority: P3
Reviewed head: 81701439eaa9fa282c302ea14dbf4383fbde7559
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The PR is focused, uses immutable security-action pins, and has strong hosted validation; direct operational confirmation for release and Crabbox would further reduce merge risk.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR supplies a real built-CLI smoke result, while the provided hosted checks successfully execute the updated CodeQL and TruffleHog actions; release and Crabbox proof remains useful operational evidence rather than a missing central proof gate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR supplies a real built-CLI smoke result, while the provided hosted checks successfully execute the updated CodeQL and TruffleHog actions; release and Crabbox proof remains useful operational evidence rather than a missing central proof gate.
Evidence reviewed	5 items	Focused workflow and dependency diff: The branch removes three explicit pnpm version inputs, updates the manifest declaration to pnpm 11.18.0, and advances CodeQL and TruffleHog immutable pins without changing workflow permissions. Release path checks out the manifest before setup: The release workflow checks out the release tag before pnpm setup, so the action has the release tag's package.json available when resolving its version. Crabbox hydration checks out the requested ref before setup: The hydration workflow checks out its requested ref before pnpm setup and prints pnpm --version after the frozen install, providing a natural runtime assertion point.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch workflows provision pnpm and Node before installing dependencies and running CI, release publishing, or Crabbox remote-environment hydration. This PR centralizes the pnpm version declaration in the checked-in package manifest and updates the security scanners those workflows invoke.

flowchart LR
  Manifest[Package manifest]
  CI[CI workflow]
  Release[Release workflow]
  Crabbox[Crabbox hydration]
  Setup[pnpm setup action]
  Validation[Install and validation]
  Security[CodeQL and secret scan]
  Manifest --> CI
  Manifest --> Release
  Manifest --> Crabbox
  CI --> Setup
  Release --> Setup
  Crabbox --> Setup
  Setup --> Validation
  Security --> Validation

Loading

Decision needed

Question	Recommendation
Is the passing CI run plus matching checkout-before-setup structure sufficient to accept manifest-based pnpm resolution for release publishing and Crabbox hydration, or should those two paths receive direct runtime proof before merge?	Request direct operational proof: Ask for redacted release-workflow and Crabbox hydration output that visibly shows pnpm 11.18.0 before merging.

Why: The code change is small and the exact CI path passes, but release publishing and self-hosted hydration have different execution environments and operational consequences that are not fully settled by unit checks.

Before merge

• Resolve merge risk (P1) - Merging changes pnpm version resolution for release publishing and self-hosted Crabbox hydration; CI proves the manifest path for one workflow, but direct evidence for those two operational paths is not included.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Automation version-source change	3 workflows changed	CI, release publishing, and Crabbox hydration stop pinning pnpm independently and use the manifest declaration.
Patch scope	8 files affected; 246 added, 251 removed	Most churn is lockfile resolution from a narrowly scoped toolchain update.
Security action updates	2 action integrations updated	CodeQL and TruffleHog remain immutable SHA-pinned while advancing their versions.

Root-cause cluster

Relationship: canonical
Canonical: #174
Summary: This PR incorporates and advances the related security-action dependency update while also aligning TruffleHog’s explicit scanner input and shared pnpm version source.

Members:

• superseded: build(deps): bump the github-actions group with 3 updates #166 - The related open PR updates a subset of the same CodeQL and TruffleHog dependencies to earlier versions, while this PR uses newer pins and resolves the scanner-input mismatch.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Prove release and hydration resolution (recommended)
   Before merge, capture redacted logs from release validation and Crabbox hydration that show pnpm resolves to the manifest-declared version.
2. Accept CI-backed action behavior
   Merge with the operational risk accepted because all three workflows check out the manifest before invoking pnpm/action-setup and CI already executes the same resolution model.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Add redacted release validation and Crabbox hydration output showing pnpm resolves to the checked-in packageManager version; do not change unrelated workflow behavior.

Technical review

Best possible solution:

Keep package.json as the single pnpm version source, and retain the existing workflow structure after a maintainer accepts or obtains a redacted release and Crabbox hydration run showing the resolved version.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR maintains dependency and automation configuration rather than repairing a reported runtime defect. The supplied hosted CI and security checks provide a concrete after-change validation path for the central CI and scanning behavior.

Is this the best way to solve the issue?

Yes for the version-source consolidation: using the checked-in packageManager field avoids three independently maintained pnpm values. The remaining question is operational proof for the release and Crabbox consumers, not an alternative code design.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4a5028c27f01.

Labels

Label justifications:

• P3: This is a focused dependency and automation-maintenance change with successful hosted checks and no user-facing regression demonstrated.
• merge-risk: 🚨 automation: The patch changes how CI, release, and remote hydration choose their package-manager runtime.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR supplies a real built-CLI smoke result, while the provided hosted checks successfully execute the updated CodeQL and TruffleHog actions; release and Crabbox proof remains useful operational evidence rather than a missing central proof gate.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR supplies a real built-CLI smoke result, while the provided hosted checks successfully execute the updated CodeQL and TruffleHog actions; release and Crabbox proof remains useful operational evidence rather than a missing central proof gate.

Evidence

What I checked:

• Focused workflow and dependency diff: The branch removes three explicit pnpm version inputs, updates the manifest declaration to pnpm 11.18.0, and advances CodeQL and TruffleHog immutable pins without changing workflow permissions. (package.json:46, 81701439eaa9)
• Release path checks out the manifest before setup: The release workflow checks out the release tag before pnpm setup, so the action has the release tag's package.json available when resolving its version. (.github/workflows/release.yml:39, 81701439eaa9)
• Crabbox hydration checks out the requested ref before setup: The hydration workflow checks out its requested ref before pnpm setup and prints pnpm --version after the frozen install, providing a natural runtime assertion point. (.github/workflows/crabbox-hydrate.yml:41, 81701439eaa9)
• Current workflow ownership history: The current main versions of the CI, release, and Crabbox hydration workflows all trace to the v0.7.1 release commit by Peter Steinberger, indicating a shared owner trail for the affected automation surface. (.github/workflows/release.yml:62, f6e00010cc2a)
• Hosted checks and contributor proof: The provided PR context records successful CI, CodeQL, dependency-review, and two TruffleHog scans; the PR body also reports a real built-CLI initialization, mapping, and status smoke run. (.github/workflows/ci.yml:17, 81701439eaa9)

Likely related people:

• steipete: The matching current-main release commit is authored by Peter Steinberger, and this account authored the three commits that update the same CI, release, Crabbox, and security-workflow surface. (role: current workflow owner and recent area contributor; confidence: high; commits: f6e00010cc2a, e6ba6c2ebc44, 56887fdc5984; files: .github/workflows/ci.yml, .github/workflows/release.yml, .github/workflows/crabbox-hydrate.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide redacted release-validation and Crabbox hydration output showing that pnpm resolves from package.json.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-02T06:02:33.857Z sha 8170143 :: needs maintainer review before merge. :: none