fix(deps): update brace-expansion security patches

docs/branch-review-ledger.md

@@ -329,6 +329,11 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-07-31 | claude/root-dir-coverage-gate-v2 | 398660144d93aeefc2e5649c156948a68925cb64 | docs:check-index repo-root coverage, stale script counts, ledger correction | MERGED as PR #1458 (squash 907fd9f4a). Root-directory coverage pass for docs:check-index, red-then-green proven (flagged .cursor/.design-sync/.vscode, then 49 entries vs 31). Main landed an equivalent pass independently in #1480, so the two overlapped; no duplication reached main. Row not recorded at the time - appended retrospectively | verify:cheap exit 0, 435 test files / 4574 tests pass; codebase-index-coverage 10/10 incl 4 new root cases; eslint clean; docs gates green; prettier clean |
 | 2026-07-31 | claude/pre-commit-fail-open | 7b96a09b8500adc917cf5549b1c61142b2244b39 | pre-commit hook fail-open when the inventory script is absent | MERGED as PR #1494 (squash 387c3b653). Resolves ledger #153: core.hooksPath is absolute to the primary checkout, so the hook ran in worktrees lacking scripts/update-docs-inventory.mjs and aborted with MODULE_NOT_FOUND. Guard drops the inventory task and re-checks the all-tasks-empty exit; grep carries \|\| true because set -e treats a fully-filtering grep as failure | isolated-repo probe with the script genuinely absent: prints skipping inventory sync, commit succeeds; sh -n clean; no-op when the script is present; prettier does not parse shell so format:check skips it |
 | 2026-07-31 | claude/ledger-relanding | 30ec06964e4235d9f0b4bb782f357e6b4fb59430 | re-land the three session findings lost when PR #1490 was closed | MERGED as PR #1508 (squash 7b551abc4). Ledger-only: #151 corrects the claim that CI is unreadable (PAT has Actions:read though not Checks:read), #152 re-lands the at-risk worktree inventory with the four preservation snapshots, #153 archives the hook fix. Verified landed by content on main, not by PR state or row id | CI, PR Policy, PR mergeability, SAST, Secret Scan all completed/success via the Actions API; check:outstanding-issues 151 rows 45 open unique ids next-id=154; docs:check-links 1414 refs; prettier clean |
+| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503 reopen-ready | approved: #098 next-action (b) prohibits wholesale collapse; main synced clean; docs-only delta; PR stays closed | format:check; check:outstanding-issues; check:branch-review-ledger; merge-tree clean; bugbot+codex P2 fixed |
+| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503-review | re-reviewed: Codex P2 fixed; merge-tree clean vs origin/main; docs-only; no Bugbot/P0-P1; PR remains CLOSED (GitHub headRefOid may lag closed PR) | merge-tree+diff-vs-main+#098-text; no push/reopen |
+| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | e8de1aebd1b32d5e901853a3473a792a66aa82cf | pr-1503 reopen-ready | approved: #098 collapse ban kept after main sync; merge-tree clean; docs-only; PR stays closed | format:check; check:outstanding-issues; merge-tree clean; codex P2 fixed; bugbot clean |
+| 2026-07-31 | claude/latency-findings-impl-s8g01v | 7056a3e73c568c0dd4cf8d43ab98f47eb9a63acc | PR #1505 docs #147 CLS attribution | ready-for-reopen: main synced, CI was green on prior head, no Bugbot threads; fixed P2 mis-attribution of /therapy-compass to overlay reserve (collapse-motion exception); left PR closed | check:outstanding-issues; prettier --check docs/outstanding-issues.md; git merge-tree clean; bugbot-style review no prior threads; diff-review P2 fixed |
+| 2026-07-31 | claude/ci-testing-review-2l8klp | fa304a5332443f544a676bdf35d813797154f87c | PR #1466 reopen-prep | READY: main merged (clean), phoneContract sibling arm fixed+pinned, Codex Cloud origin inspect uses configured URL (insteadOf-safe), prior Codex/Copilot/CodeRabbit threads resolved, no cursor[bot] Bugbot findings, PR left CLOSED | verify:cheap PASS (444 files / 4652 passed, 4 skipped); prettier --check . PASS; check:ci-scope PASS; verify-phone-chrome+codex-cloud-setup+test-runner-safety+playwright-project-isolation 59/59; merge-tree clean before merge; Bugbot none |
 | 2026-07-30 | PR-1490 | 0a44df55532fcea3cf3b8cad28526ff8805d803b | PR #1490 consolidated session follow-ups | reviewed; consolidated accurate provider-token, preserved-worktree, install-parity, CodeRabbit, hook, and physical-device findings; resolved concurrent documentation conflict without lost rows | check:outstanding-issues pass; check:branch-review-ledger pass; docs:check-links pass; git diff --check pass |
 | 2026-07-30 | PR-1492 | 4fdc4ba99f94a369702c747b104fa4eaf48cb53e | PR #1492 exact-head branch-sync anti-churn review | approved after P2 repair; current helper fails closed on Actions lookup errors and defers only behind branches with queued or running exact-head CI; operator guidance and tests match | focused Vitest 9 tests passed on reviewed implementation; hosted static checks passed; exact-head coverage in progress at review; merge-tree audit clean |
 | 2026-07-30 | PR-1495 | 99c62cf3bd6f2a47d13b6602d54de1f8f73123e1 | PR #1495 hydration documentation correction | approved after correcting unrelated issue #101 label and appending a resolvable landed-SHA hydration review record; content consolidated into PR #1490 | outstanding-issues and ledger guards previously passed; documentation-only diff reviewed; no provider checks required |
@@ -345,10 +350,10 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-07-31 | PR-1510 | eed59358ffdb588c3015ef317de4587d14ea00cf | PR #1510 reopen-ready evidence correction | FIXED: removed false #098 canary attribution; NOTES #154->#157 and restored 7/4/3 token accounting; mockup tokens unchanged | check:outstanding-issues PASS; check:branch-review-ledger PASS; check:design-system-contract PASS; format:changed PASS; canary ancestry vs origin/main/work verified |
 | 2026-07-31 | PR-1510 | 61d25fd7727c2345fabb9631d604b1632bc0df6d | post-1513 concurrency-note reconciliation | no actionable findings; preserved main 155, renumbered withdrawn guard to 158, and advanced next-id to 159 | outstanding-issues, branch-review-ledger, design-system-contract, changed-format, diff-check |
 | 2026-07-31 | PR-1510 | 2e8821c77fcadaa283d8a0033b1a6af815458d79 | PR #1510 CodeRabbit + evidence reopen-ready | FIXED: CodeRabbit computed-value-time wording, unique #033 queue order, deduped #098 Done block; prior false canary attribution already corrected | check:outstanding-issues PASS; format:changed PASS; contains origin/main |
+| 2026-07-31 | claude/search-results-mockups-iz7owo (PR #1514) | 1daa6b3d7979f2aed8e50b8a4661690bde5c1073 | closed-PR reopen prep | Synced origin/main (behind 68, merge-tree clean, no conflicts). No unresolved Codex/Bugbot/Copilot/human threads. Tip review: no P0-P2 (phone forms presentation only; clinicalRisk false, not RAG). Pathway guard narrowed intentionally; page-level exact guard intact. Ready for reopen; leave CLOSED. Fresh mergeability/CI count only after reopen. | ledger:lookup NOT REVIEWED; git fetch origin/main; merge-tree clean; git merge origin/main; gh reviewThreads=0; classifyPullRequestFiles clinicalRisk=false ragRanking=false; tip-vs-base review (no local suites; closed-PR CI treated stale; no provider-backed checks) |
 | 2026-07-31 | cursor/ci-followups-093-138-1bf5 | 299698480cb120483ea16895b9265ad2abf5d595 | closed-PR reopen prep | ready-for-reopen; merge-clean vs origin/main after resolving outstanding-issues; no open review threads; no P0-P2 findings; PR left CLOSED | check:outstanding-issues,check:ci-triage,check:github-actions,merge-tree-clean |
 | 2026-07-30 | codex/moderate-batch-20260730 | 1addcece5a2b7122c5898584830109f617421a3a | document accordion, auth-safe catalogue refetch, comparison contract, operator preflight | P1 late identity response race fixed; no remaining findings | verify:cheap static through owner-scope; lint; typecheck; full Vitest; Chromium UI; production-readiness |
 | 2026-07-31 | codex/moderate-batch-20260730 | d582c49fe3a2f01bad179d06f84484754b639458 | PR #1485 accordion/catalogues | APPROVE after Bugbot/CodeRabbit triage; fixed differential LRU soft-success on Retry and credential/error pulses; no open review threads; merge-tree clean vs main | vitest catalog DOM 12/12; check:outstanding-issues; merge-tree clean; Bugbot: no cursor[bot] threads; CodeRabbit threads resolved |
-| 2026-07-31 | claude/ci-testing-review-2l8klp | fa304a5332443f544a676bdf35d813797154f87c | PR #1466 reopen-prep | READY: main merged (clean), phoneContract sibling arm fixed+pinned, Codex Cloud origin inspect uses configured URL (insteadOf-safe), prior Codex/Copilot/CodeRabbit threads resolved, no cursor[bot] Bugbot findings, PR left CLOSED | verify:cheap PASS (444 files / 4652 passed, 4 skipped); prettier --check . PASS; check:ci-scope PASS; verify-phone-chrome+codex-cloud-setup+test-runner-safety+playwright-project-isolation 59/59; merge-tree clean before merge; Bugbot none |
 | 2026-07-31 | PR-1485 | f4f42fbc5b4a73d0037c8c275a358d265727e0fc | post-review document accordion and catalogue sync | APPROVE; post-review changes limited to differential refetch memoization and current-main sync; no remaining findings | installed-lock parity; focused catalogue/document suites 3 files 19 tests PASS; typecheck PASS; issue and review-ledger guards PASS; zero unresolved threads |
 | 2026-07-31 | PR-1515 | 239a2ce6d708f8e1a6ac891c997baefec67cd9ab | PR #1515 CI triage and visible Playwright roots | No high-confidence defects; default-enabled trusted CI triage and visible-owner Playwright helper reviewed | check:installed-lock-parity; check:ci-triage; check:github-actions; check:outstanding-issues; check:branch-review-ledger; typecheck |
 | 2026-07-30 | codex/repair-pr1416 | 9f5c32270ecc2d606c3a483ddfbeebe3081d3b5d | branch-cleanup | exact merged PR #1416 head; inactive clean worktree archived in verified batch1 bundle | GitHub merged exact head, clean status, no Git operation, no open PR claim, bundle verify ok SHA256 18D9CFFD334278987D8FCCBED5F34125148BFF98C83D39287268103A5326BD2A |
@@ -499,12 +504,10 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-07-31 | origin/claude/outstanding-issues-triage-24c8ow | d3c2a17a848be5458664355de4fd41d0933d2705 | branch-cleanup | safe remote delete: merged PR #1428 content and post-merge #122 disposition are superseded by later current-main issue records; archived batch19 | PR #1428 merged; post-merge tail inspection; current issue-row comparison; no local worktree; exact ls-remote SHA match; bundle verify |
 | 2026-07-31 | PR-1518 | 2fb0996e0208d3da04f941fdc1c1b4ab14d440d6 | PR #1518 archive validated issue 146 and add duplicated-list finding | APPROVE after current-main conflict repair; stale unvalidated claim corrected and unique issue 159 preserved | check:outstanding-issues PASS 157 rows 44 open 113 archived next-id 160; check:branch-review-ledger PASS; installed-lock parity PASS; diff check PASS |
 | 2026-07-31 | PR-1520 | 6e6998464a6996a66fdaaadcd482388e39af611e | PR #1520 branch and worktree reconciliation records | APPROVE; 146 historical cleanup dispositions retained as ledger-only evidence with no repository mutation | check:branch-review-ledger PASS 444 live 1206 archived; diff check PASS; current-main merge clean |
-| 2026-07-31 | cursor/mode-page-redesign-handoff-7830 | 0ae080b618c7f8c802083520ec3dee28bd56504d | mode-page-redesign-comps-handoff | pass-with-findings | check:outstanding-issues; comps+issues #160-162; PR #1521; no production UI change |
 | 2026-07-31 | claude/issues-133-evidence | 5bb1bc8d8b1d3ba8aebdce5c348887c596f6b8e6 | docs/outstanding-issues.md: re-land #154 (id-allocation hazard) and #155 (--med-accent-soft) after PR #1506 closed unmerged | Recorded. Branch synced to origin/main; main had since taken #151 so the hazard row moved to #154 and --med-accent-soft landed as #155 (its fifth renumber) - both self-demonstrating the row's own claim. PR #1506 to be reopened by the user. | check:outstanding-issues exit 0 (153 rows, 45 open, 108 archived, unique ids, next-id=156, no ids deleted from base); verified zero origin/main ids lost after taking main's table as canonical; pre-push guard passed on pushed commit |
 | 2026-07-31 | claude/issues-133-evidence | 37f71f02f731175e4fed500f95529c3ef9eb568f | PR #1506 reopen prep: sync main, renumber hazard to #155, supersede #112 residual | READY — conflict cleared vs origin/main; main #154 preserved; hazard=#155 with archived #112 residual cross-link; med-accent=#156; false #155 evidence clause removed; Codex P2 addressed; Bugbot P1/P2 fixed; PR left CLOSED | check:outstanding-issues 154 rows/46 open next-id=157; check:branch-review-ledger 277 live; merge-tree clean da0c63d0; format no-op |
-| 2026-07-31 | claude/search-results-mockups-iz7owo (PR #1514) | 1daa6b3d7979f2aed8e50b8a4661690bde5c1073 | closed-PR reopen prep | Synced origin/main (behind 68, merge-tree clean, no conflicts). No unresolved Codex/Bugbot/Copilot/human threads. Tip review: no P0-P2 (phone forms presentation only; clinicalRisk false, not RAG). Pathway guard narrowed intentionally; page-level exact guard intact. Ready for reopen; leave CLOSED. Fresh mergeability/CI count only after reopen. | ledger:lookup NOT REVIEWED; git fetch origin/main; merge-tree clean; git merge origin/main; gh reviewThreads=0; classifyPullRequestFiles clinicalRisk=false ragRanking=false; tip-vs-base review (no local suites; closed-PR CI treated stale; no provider-backed checks) |
-| 2026-07-31 | claude/latency-findings-impl-s8g01v | 7056a3e73c568c0dd4cf8d43ab98f47eb9a63acc | PR #1505 docs #147 CLS attribution | ready-for-reopen: main synced, CI was green on prior head, no Bugbot threads; fixed P2 mis-attribution of /therapy-compass to overlay reserve (collapse-motion exception); left PR closed | check:outstanding-issues; prettier --check docs/outstanding-issues.md; git merge-tree clean; bugbot-style review no prior threads; diff-review P2 fixed |
-| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503 reopen-ready | approved: #098 next-action (b) prohibits wholesale collapse; main synced clean; docs-only delta; PR stays closed | format:check; check:outstanding-issues; check:branch-review-ledger; merge-tree clean; bugbot+codex P2 fixed |
-| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503-review | re-reviewed: Codex P2 fixed; merge-tree clean vs origin/main; docs-only; no Bugbot/P0-P1; PR remains CLOSED (GitHub headRefOid may lag closed PR) | merge-tree+diff-vs-main+#098-text; no push/reopen |
-| 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | e8de1aebd1b32d5e901853a3473a792a66aa82cf | pr-1503 reopen-ready | approved: #098 collapse ban kept after main sync; merge-tree clean; docs-only; PR stays closed | format:check; check:outstanding-issues; merge-tree clean; codex P2 fixed; bugbot clean |
+| 2026-07-31 | codex/chat-frontend-skill-selection-0978 | cf9ed2d12a68f0577b755d540bdd8dde0ff6ddc1 | PR #1460 reopen readiness | READY for reopen as conflict-free tip; product brace-expansion patch already on main via #1456; remaining unique delta is one historical ledger row; no Bugbot findings; no P0-P2 findings | merge-tree clean; check:branch-review-ledger PASS; installed-lock-parity PASS; vitest installed-lock-parity 6/6; brace-expansion@1.1.18 maxLength present; npm audit not re-run; PR left CLOSED |
+| 2026-07-31 | codex/chat-frontend-skill-selection-0978 | 7cf0505be4423f6856e45a6a87e9433fcae72462 | PR #1460 review+bugbot+fix | no findings; sync cleared GitHub DIRTY (merge-tree was behind-but-clean); tip delta ledger-only; product brace-expansion already on main via #1456; no Bugbot/actionable threads | merge-tree clean; check:branch-review-ledger PASS; required CI pending after sync push; prior missing checks while DIRTY not green |
+| 2026-07-31 | cursor/mode-page-redesign-handoff-7830 | 0ae080b618c7f8c802083520ec3dee28bd56504d | mode-page-redesign-comps-handoff | pass-with-findings | check:outstanding-issues; comps+issues #160-162; PR #1521; no production UI change |
+| 2026-07-31 | codex/chat-frontend-skill-selection-0978 | c436387c49d37e65bca49429d2b74fffe61c0bfd | PR #1460 review+bugbot+fix | no findings; second sync after main advanced mid-pass; merge-tree clean; tip delta ledger-only; product already on main via #1456; no Bugbot/actionable threads | merge-tree clean; check:branch-review-ledger PASS; required CI expected after sync push |
 | 2026-07-31 | codex/chat-prompt-skill-review-e608 | e7b2b9ae864e4ca280761dc5e1dd23ea65afb520 | PR #1439 review+bugbot+fix | FIXED CONFLICTING: GitHub DIRTY was behind-but-clean; merged origin/main twice to current tip. Product delta: POSIX secondary-worktree bootstrap + consolidated skill contracts on main Cloud/status-hash verifier. Review+Bugbot: no P0/P1; 0 unresolved threads; no new Bugbot findings. Restored append-only ledger vs main (no historical row rewrite). | merge-tree clean; MERGEABLE; PR mergeability/policy/gitleaks success; Static/Unit/Safety in progress; isolation self-test 14/14; 0 unresolved threads |