[leehack]

Summary

• Patch the private legacy npm interoperability fixture: Hono adapter 2.1.3, glob 14.0.2, and minimatch 11.0.1.
• Preserve the legacy MCP SDK 1.32.1, filesystem server 2026.8.31, existing development-tool pins, public Dart APIs, package versions, and minimum Dart requirements.
• Add focused dependency and public CLI filesystem compatibility regressions, plus a Linux/macOS/Windows CI matrix and override rationale/removal conditions.

Security and footprint

The existing graph is affected by GHSA-rmxm-3fg6-px4f, GHSA-3g3m-2fjr-6pw4, and GHSA-g3hv-75wg-m249. The resolved patched graph reports zero npm audit vulnerabilities.

The explicitly approved major overrides also update path-scurry to 3.0.0 and lru-cache to 11.5.3, and add one transitive package: @isaacs/nonrecursive-glob-match 1.0.3 (BlueOak-1.0.0, 380,111 unpacked bytes, no runtime dependencies or consumer install hooks). Lockfile entries increase from 207 to 208. Node 24 remains supported.

npm audit covers the resolved dependency graph, not arbitrary third-party source bundled into upstream artifacts. The separate modern TypeScript 2.4.0 upgrade remains on hold and is not included here.

Verification

• Standard npm ci, TypeScript build, lint and format check: passed.
• Dependency compatibility checks: 4 passed, including actual ESLint file selection, glob abort behavior, and bounded minimatch optimization.
• Before-fix controls with glob 13.0.6/minimatch 10.2.5: ordinary selection passes; cancellation fails with two reads instead of one, and amplification fails with 256 patterns against a cap of 16.
• Root formatting: 322 files, zero changes; analysis clean; 2,030 tests passed.
• CLI analysis clean; 134 tests passed, with five local skips because the Python MCP SDK is absent.
• Exact CI=true public CLI filesystem regression: passed, including exclusions, dotfiles, path denials, malformed tool arguments, denial-payload disclosure checks, and same-session recovery.
• Four legacy interoperability suites: 26 passed.
• Workflow YAML and both CLI-only workflow path triggers validated; git diff --check passed.
• Independent review: no remaining findings.

Hosted checks, including the new three-platform matrix, must pass before merge. This is not a release-prep PR; no merge or publication is authorized by creating it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.91%. Comparing base (aca076b) to head (c0ba918).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #452   +/-   ##
=======================================
  Coverage   85.91%   85.91%           
=======================================
  Files          82       82           
  Lines       20564    20564           
=======================================
+ Hits        17667    17668    +1     
+ Misses       2897     2896    -1     

Flag	Coverage Δ
cli	78.11% <ø> (ø)
unittests	88.36% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.