chore(deps): refresh Node types and patch nanoid

[steipete]

Summary

• update @types/node from 26.1.2 to 26.2.0
• refresh the eligible tinyexec transitive dependency from 1.2.4 to 1.3.0
• override nanoid to patched 3.3.18 at the pnpm workspace boundary, clearing GHSA-2v37-7h3g-55p8

Testing

• pnpm install --frozen-lockfile
• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm test (900 passed, 1 skipped)
• pnpm build
• pnpm pack:smoke
• pnpm website:smoke
• pnpm audit --audit-level high
• built CLI live proof: init, map, and JSON status in a temporary Git repository
• autoreview: clean, no accepted/actionable findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 10, 2026, 2:46 AM ET / 06:46 UTC.

ClawSweeper review

What this changes

Updates Node type definitions, refreshes tinyexec in the lockfile, and overrides the transitive nanoid dependency to version 3.3.18.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep this PR open: the dependency graph change is narrow and internally consistent, but the claimed built-CLI validation has no inspectable after-fix output or artifact yet.

Priority: P2
Reviewed head: a6775ef8417cf7f56cce390ef5a871e4a720be85

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is tightly scoped and consistent, but inspectable real-behavior proof remains a merge gate.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR body claims a built-CLI live check but provides no inspectable after-fix terminal output, recording, or linked artifact. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body claims a built-CLI live check but provides no inspectable after-fix terminal output, recording, or linked artifact. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Resolved dependency graph: The proposed lockfile records nanoid 3.3.18 and makes postcss 8.5.25 depend on that version; it also resolves tinyexec 1.3.0 and @types/node 26.2.0. Current-main comparison: The branch is one commit ahead of current main, so this dependency refresh is neither on main nor in the current v0.7.2 source state. Dependency-area history: Current-main history shows Peter Steinberger repeatedly maintaining the workspace, package manifest, and lockfile, including the latest dependency refresh on main.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch is a TypeScript CLI built with pnpm; its workspace manifest and lockfile control the dependency graph used by building, testing, packaging, and running the CLI. The workspace override feeds pnpm’s resolver, which records the final transitive versions in the lockfile.

flowchart LR
  A[Workspace configuration] --> B[pnpm resolver]
  B --> C[Locked dependency graph]
  C --> D[Build and test tooling]
  D --> E[Packaged CLI]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR body claims a built-CLI live check but provides no inspectable after-fix terminal output, recording, or linked artifact. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The asserted built-CLI validation is not accompanied by terminal output, a recording, or a linked artifact, so the after-fix result cannot yet be independently checked.
• Complete next step (P2) - No code repair is needed; the contributor must add real behavior proof before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	3 files affected; 25 added, 23 removed	The patch is confined to the manifest, workspace resolution policy, and matching lockfile.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the workspace override and matching lockfile resolution, with redacted evidence that the built CLI commands succeed using this graph.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the workspace override and matching lockfile resolution, with redacted evidence that the built CLI commands succeed using this graph.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates resolved package versions rather than reporting a reproducible product failure.

Is this the best way to solve the issue?

Yes: a pnpm workspace override with a synchronized lockfile is the narrow maintainable way to replace the vulnerable transitive nanoid version.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 439d9e42b891.

Labels

Label changes:

• add P2: This is a bounded dependency-security maintenance update affecting the development and packaging dependency graph.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body claims a built-CLI live check but provides no inspectable after-fix terminal output, recording, or linked artifact. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded dependency-security maintenance update affecting the development and packaging dependency graph.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body claims a built-CLI live check but provides no inspectable after-fix terminal output, recording, or linked artifact. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Resolved dependency graph: The proposed lockfile records nanoid 3.3.18 and makes postcss 8.5.25 depend on that version; it also resolves tinyexec 1.3.0 and @types/node 26.2.0. (pnpm-lock.yaml:1353, a6775ef8417c)
• Current-main comparison: The branch is one commit ahead of current main, so this dependency refresh is neither on main nor in the current v0.7.2 source state. (pnpm-workspace.yaml:5, a6775ef8417c)
• Dependency-area history: Current-main history shows Peter Steinberger repeatedly maintaining the workspace, package manifest, and lockfile, including the latest dependency refresh on main. (pnpm-lock.yaml:1, 439d9e42b891)
• Patch hygiene: The three-file dependency diff has no whitespace errors. (pnpm-workspace.yaml:6, a6775ef8417c)

Likely related people:

• steipete: Current-main history shows repeated maintenance of the package manifest, pnpm lockfile, and workspace configuration, including the latest dependency refresh. (role: recent dependency-area contributor; confidence: high; commits: 439d9e42b891, a81435d851e1, 3c2a1a4e2d04; files: package.json, pnpm-lock.yaml, pnpm-workspace.yaml)
• Vincent Koc: Introduced the pnpm release-age policy governing the workspace file changed by this PR. (role: release-age policy contributor; confidence: medium; commits: 0baa929f32e1; files: pnpm-workspace.yaml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted terminal output or a screenshot showing the built CLI init, map, and JSON status checks succeeding; remove private paths and credentials.
• After adding proof, update the PR body for a fresh review or ask a maintainer to comment @clawsweeper re-review if needed.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.