build(deps): refresh scanner runtime and toolchains

[steipete]

Refresh the bundled scanner and command-line tools, update Go to 1.27.1 and x/text to 0.42.0, and align the Docker runtime with CI’s Node.js 24 LTS. Keep the packaged CLI’s Node.js >=18 requirement. Refresh Docker, Pages, and CodeQL Action pins to their current patch/minor releases; other Action majors are already current.

The Go module files were regenerated with Go’s package manager. Registry engine requirements support Node 24, and SkillSpector stays on the latest stable tagged release, 2.11.2.

Validation: full Go tests and vet, all npm/script tests, universal npm pack/install/CLI smoke, and an initial Docker build plus executable probes passed on AWS Crabbox. Independent Codex review is clean through P2. The final Node 24 image and real ClawScan scanner-adapter smoke are checked before merge, followed by exact-head CI including the multi-platform runtime image build.

Final Node 24 validation passed: the Docker image built successfully, all bundled tool version/help probes passed, and ClawScan ran both SkillSpector and Cisco against a synthetic skill through the Docker adapter with both scanner statuses completed. No provider credentials were used. The initial smoke attempt had a temporary binary/report-directory name collision in the test harness; distinct paths fixed the harness and the rerun passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 22, 2026, 5:45 AM ET / 09:45 UTC.

ClawSweeper review

What this changes

Updates bundled scanner and judge tools, moves the Docker runtime to Node.js 24, raises the Go requirement to 1.27.1, and refreshes dependency and GitHub Action pins.

Merge readiness

⛔ Blocked before merge - 2 items remain

The refresh remains useful: current main and v0.1.8 retain the older dependencies. No concrete patch defect was found, but the reported runtime validation needs inspectable output before merge.

Priority: P2
Reviewed head: 569c4ccc832025c76171eeb099f3f607c9a19c5b

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and has no identified correctness defect, but runtime validation remains a reported result without inspectable output.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The body reports the relevant after-change scenario: the Node 24 image running a synthetic skill through ClawScan's real SkillSpector and Cisco Docker adapters on AWS Crabbox. It reports completed statuses but supplies no inspectable transcript or artifact. Attach redacted terminal output or logs from that run; a terminal screenshot or recording also counts. Remove credentials, private endpoints, IP addresses, and other private details. Updating the body should trigger review; otherwise ask a maintainer for @clawsweeper re-review. No stored-data contract changes are introduced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The body reports the relevant after-change scenario: the Node 24 image running a synthetic skill through ClawScan's real SkillSpector and Cisco Docker adapters on AWS Crabbox. It reports completed statuses but supplies no inspectable transcript or artifact. Attach redacted terminal output or logs from that run; a terminal screenshot or recording also counts. Remove credentials, private endpoints, IP addresses, and other private details. Updating the body should trigger review; otherwise ask a maintainer for @clawsweeper re-review. No stored-data contract changes are introduced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	11 items	Pinned introduced change: The reviewed delta contains eight files and only dependency pins, the Node runtime selection, and corresponding prerequisite/release documentation. No adapter, authorization, sandbox mount, credential, or persisted-format implementation changes are introduced. Still necessary on main: The pinned main Dockerfile still uses Node.js 22 and the older six tool versions. The latest release's go.mod also retains Go 1.27.0 and x/text v0.41.0. The recent merged dependency refresh at #51 therefore does not supersede this update. Latest release comparison: v0.1.8 predates the proposed Go and x/text versions.
Findings	None	None.
Security	None	None.

How this fits together

ClawScan runs external scanners and judge commands inside its bundled Docker runtime and collects their reports. The changed build configuration supplies those tools and the workflows that build, analyze, and publish the project.

flowchart LR
  A[Skill files] --> B[ClawScan adapters]
  C[Updated Docker runtime] --> B
  B --> D[Scanner JSON reports]
  D --> E[Run artifacts and optional judge]
  F[Build and release workflows] --> C

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The body reports the relevant after-change scenario: the Node 24 image running a synthetic skill through ClawScan's real SkillSpector and Cisco Docker adapters on AWS Crabbox. It reports completed statuses but supplies no inspectable transcript or artifact. Attach redacted terminal output or logs from that run; a terminal screenshot or recording also counts. Remove credentials, private endpoints, IP addresses, and other private details. Updating the body should trigger review; otherwise ask a maintainer for @clawsweeper re-review. No stored-data contract changes are introduced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Attach inspectable, redacted output from the reported final Node 24 Docker scanner-adapter validation before merge.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain this focused dependency refresh with documented source-build prerequisites and inspectable evidence that the updated image runs the existing scanner adapters.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, and no concrete existing-behavior bug is alleged or established.

Is this the best way to solve the issue?

Yes: updating the existing pins and prerequisite documentation is the narrow approach, and inspection found no competing implementation or concrete regression.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b3b45886ae45.

Labels

Label changes:

• add P2: This is a bounded refresh of the default scanner runtime and build dependencies, without an established urgent regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The body reports the relevant after-change scenario: the Node 24 image running a synthetic skill through ClawScan's real SkillSpector and Cisco Docker adapters on AWS Crabbox. It reports completed statuses but supplies no inspectable transcript or artifact. Attach redacted terminal output or logs from that run; a terminal screenshot or recording also counts. Remove credentials, private endpoints, IP addresses, and other private details. Updating the body should trigger review; otherwise ask a maintainer for @clawsweeper re-review. No stored-data contract changes are introduced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded refresh of the default scanner runtime and build dependencies, without an established urgent regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The body reports the relevant after-change scenario: the Node 24 image running a synthetic skill through ClawScan's real SkillSpector and Cisco Docker adapters on AWS Crabbox. It reports completed statuses but supplies no inspectable transcript or artifact. Attach redacted terminal output or logs from that run; a terminal screenshot or recording also counts. Remove credentials, private endpoints, IP addresses, and other private details. Updating the body should trigger review; otherwise ask a maintainer for @clawsweeper re-review. No stored-data contract changes are introduced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Pinned introduced change: The reviewed delta contains eight files and only dependency pins, the Node runtime selection, and corresponding prerequisite/release documentation. No adapter, authorization, sandbox mount, credential, or persisted-format implementation changes are introduced. (docker/clawscan-runtime/Dockerfile:4, 569c4ccc8320)
• Still necessary on main: The pinned main Dockerfile still uses Node.js 22 and the older six tool versions. The latest release's go.mod also retains Go 1.27.0 and x/text v0.41.0. The recent merged dependency refresh at chore(deps): refresh toolchains and scanner runtime #51 therefore does not supersede this update. (docker/clawscan-runtime/Dockerfile:4, b3b45886ae45)
• Latest release comparison: v0.1.8 predates the proposed Go and x/text versions. (go.mod:3, 6190d96d7fc4)
• Runtime proof supplied in the body: The complete supplied body reports an AWS Crabbox Docker build, bundled executable probes, and a synthetic skill scanned through the real Docker adapters with SkillSpector and Cisco statuses reported as completed. This is relevant after-change validation, but the body contains no command/output transcript, logs, or linked artifact to inspect. The live body read matched the supplied text; no omitted body ranges were involved. (569c4ccc8320)
• Production integration and compatibility boundary: The Cisco adapter requires a JSON output file; the SkillSpector adapter likewise reads and validates its report. Existing tests cover report preservation and Docker output-directory handling. The npm wrapper retains Node >=18, CI derives Go from go.mod, and CONTRIBUTING.md explicitly documents the new source-build prerequisite. No stored-data migration is introduced. (internal/runner/cisco_scanner.go:14, 569c4ccc8320)
• CodeQL pin provenance: The proposed CodeQL reference is the upstream v4.38.1 annotated tag object, resolving to commit 1c5b675653bb5c22dbe9b12b556ec555138e09fd. (1c5b675653bb)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach the redacted command/output transcript or artifact from the reported final Node 24 Docker adapter run.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.