build(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /web - #17

…hardening

…metrics

… block, 13 language packs

…s (v0.17.0)

…tstrap actually install deps

- web/tsconfig.json excludes test files; new tsconfig.test.json typechecks them
- HITLPopup.test.tsx: type mocks against the real PendingResponse<T>; drop an
  invented ShellAsk.reason field the server never sends
- Makefile: web-deps target with npm ci -> npm install fallback for the stale
  lockfile; bootstrap no longer short-circuits on a stale ui/assets directory
- cmd/slmcode/ui is now build output only (.gitkeep tracked); the placeholder
  page moved into Go so building the UI cannot dirty a tracked file
- release workflow verifies a real Studio bundle is embedded, strips sourcemaps,
  installs golangci-lint, and validates the tag against version.go
- install scripts: real checksum verification on Windows, no sudo for --user
  installs, loud warning when SHA256SUMS is unavailable
- slmcode update: fix the Windows asset name, downgrade guard, --user/--system
- RELEASE.md, changelog breaking-changes table, docs

…gs (config was already v2, tool was v1)�[0m

�[38;5;243m   2�[0m
�[38;5;243m   3�[0m   �[38;5;249m`.golangci.yml` is v2-format but the installed golangci-lint binary was�[0m
�[38;5;243m   4�[0m   �[38;5;249mv1.64, so `make check` silently never ran the real lint gate. Upgrading to�[0m
�[38;5;243m   5�[0m   �[38;5;249mv2.13.1 surfaced 95 findings: 66 staticcheck QF1012 (WriteString(Sprintf)�[0m
�[38;5;243m   6�[0m   �[38;5;249m-> Fprintf, auto-fixed) and 28 gosec findings reviewed per-file and either�[0m
�[38;5;243m   7�[0m   �[38;5;249mfixed or annotated with a `//nolint:gosec // reason` matching this repo's�[0m
�[38;5;243m   8�[0m   �[38;5;249mexisting convention.�[0m

…e reachable through a symlink mismatch�[0m

�[38;5;243m   2�[0m
�[38;5;243m   3�[0m   �[38;5;249ms.rootDir() returns the configured root as-is, but every path derived from�[0m
�[38;5;243m   4�[0m   �[38;5;249mworkspacePath()/resolveWorkspacePath() is passed through EvalSymlinks. On�[0m
�[38;5;243m   5�[0m   �[38;5;249mmacOS $TMPDIR (and thus every t.TempDir() workspace root) is itself a�[0m
�[38;5;243m   6�[0m   �[38;5;249msymlink into /private, so filepath.Rel(s.rootDir(), resolvedPath) never�[0m
�[38;5;243m   7�[0m   �[38;5;249mmatched — silently defeating every ".slmcode/ harness state" check built on�[0m
�[38;5;243m   8�[0m   �[38;5;249mtop of it:�[0m
�[38;5;243m   9�[0m
�[38;5;243m  10�[0m   �[38;5;249m  - GET /api/workspace/file?path=.slmcode/auth.json served the operator's�[0m
�[38;5;243m  11�[0m   �[38;5;249m    provider API keys over HTTP.�[0m
�[38;5;243m  12�[0m   �[38;5;249m  - GET /api/workspace/tree advertised auth.json in the listing.�[0m
�[38;5;243m  13�[0m   �[38;5;249m  - The review queue could both display and apply a write into�[0m
�[38;5;243m  14�[0m   �[38;5;249m    .slmcode/hooks.json (arbitrary-bash-on-next-run) via a crafted�[0m
�[38;5;243m  15�[0m   �[38;5;249m    .slmcode/pending/*.patch.json entry.�[0m
�[38;5;243m  16�[0m
�[38;5;243m  17�[0m   �[38;5;249mAdded Server.realRootDir(), which applies the same EvalSymlinks-or-fallback�[0m
�[38;5;243m  18�[0m   �[38;5;249mresolution as resolveWorkspacePath, and routed the three affected�[0m
�[38;5;243m  19�[0m   �[38;5;249mfilepath.Rel(s.rootDir(), ...) call sites through it.�[0m
�[38;5;243m  20�[0m
�[38;5;243m  21�[0m   �[38;5;249mCaught by pkg/server/adversarial_secrets_test.go�[0m
�[38;5;243m  22�[0m   �[38;5;249m(TestAdvNoAPIKeyLeakOverHTTP, TestAdvPendingQueueCannotTargetHarnessState),�[0m
�[38;5;243m  23�[0m   �[38;5;249mwhich were failing on main before this change.�[0m

…ed both reviewers, doubling real LLM calls�[0m

�[38;5;243m   2�[0m
�[38;5;243m   3�[0m   �[38;5;249mspeculate() cancels a losing slot's goroutine only before it reaches the�[0m
�[38;5;243m   4�[0m   �[38;5;249mexecutor; once dispatched, a fast/local executor runs it to completion�[0m
�[38;5;243m   5�[0m   �[38;5;249mregardless. reviewSlots() launched the primary reviewer and the strict�[0m
�[38;5;243m   6�[0m   �[38;5;249msecond reviewer fully concurrently with no head start, so against a fast�[0m
�[38;5;243m   7�[0m   �[38;5;249mexecutor both real LLM calls always completed before either could cancel�[0m
�[38;5;243m   8�[0m   �[38;5;249mthe other — the "1 race, up to 2 real requests" design always spent 2,�[0m
�[38;5;243m   9�[0m   �[38;5;249mnever 1.�[0m
�[38;5;243m  10�[0m
�[38;5;243m  11�[0m   �[38;5;249mThis doubled review calls per correction round, which both blew the�[0m
�[38;5;243m  12�[0m   �[38;5;249mcall-budget escalation threshold (14 real calls against a budget of 10) and�[0m
�[38;5;243m  13�[0m   �[38;5;249mduplicated review-prompt entries per round, misaligning correction-content�[0m
�[38;5;243m  14�[0m   �[38;5;249mchecks that expect one review per CORRECTOR-PASS-N.�[0m
�[38;5;243m  15�[0m
�[38;5;243m  16�[0m   �[38;5;249mAdded an optional per-slot Delay to SpecSlot, honored in speculate()'s�[0m
�[38;5;243m  17�[0m   �[38;5;249mdispatch loop: a delayed slot waits out the delay (or bails immediately if�[0m
�[38;5;243m  18�[0m   �[38;5;249mthe race is already won) before ever reaching the executor. reviewSlots()�[0m
�[38;5;243m  19�[0m   �[38;5;249mnow gives reviewer-strict a 20ms head start — well under real LLM latency,�[0m
�[38;5;243m  20�[0m   �[38;5;249mso production still races both reviewers as before, but long enough for a�[0m
�[38;5;243m  21�[0m   �[38;5;249mfast/local/test executor to let the primary win outright and skip the�[0m
�[38;5;243m  22�[0m   �[38;5;249msecond dispatch.�[0m
�[38;5;243m  23�[0m
�[38;5;243m  24�[0m   �[38;5;249mCaught by pkg/loop/retry_ladder_test.go�[0m
�[38;5;243m  25�[0m   �[38;5;249m(TestCorrectionRoundsSeeThePreviousCorrection,�[0m
�[38;5;243m  26�[0m   �[38;5;249mTestCallBudgetExhaustionEscalatesWithAUsefulState).�[0m

…he CSS bundle and its own SSE marker�[0m

�[38;5;243m   2�[0m
�[38;5;243m   3�[0m   �[38;5;249mdiscoverAssets() found the CSS <link> by taking a +-200-char window around�[0m
�[38;5;243m   4�[0m   �[38;5;249mrel="stylesheet" and grabbing the first href="/assets/..." in it. On a real�[0m
�[38;5;243m   5�[0m   �[38;5;249mVite build, the preceding <link rel="modulepreload" href="...js"> tags for�[0m
�[38;5;243m   6�[0m   �[38;5;249mroute chunks sit inside that window and their href comes first in document�[0m
�[38;5;243m   7�[0m   �[38;5;249morder, so the "CSS path" it returned was actually a JS chunk�[0m
�[38;5;243m   8�[0m   �[38;5;249m(assets/react-*.js) whenever the head had two or more modulepreload tags�[0m
�[38;5;243m   9�[0m   �[38;5;249mahead of the stylesheet link. Fixed to search only within the matched�[0m
�[38;5;243m  10�[0m   �[38;5;249m<link ...> tag's own boundaries.�[0m
�[38;5;243m  11�[0m
�[38;5;243m  12�[0m   �[38;5;249mSeparately, the JS-corpus marker list checked for the literal "/api/events"�[0m
�[38;5;243m  13�[0m   �[38;5;249msubstring, but createEventSource() builds that URL as `${BASE}/events`�[0m
�[38;5;243m  14�[0m   �[38;5;249m(BASE="/api"), so the two halves never appear contiguous in the bundle —�[0m
�[38;5;243m  15�[0m   �[38;5;249mevery other marker in the list is a bare path for the same reason (client.ts's�[0m
�[38;5;243m  16�[0m   �[38;5;249mrequest() prepends BASE separately). Changed the marker to "/events" to�[0m
�[38;5;243m  17�[0m   �[38;5;249mmatch.�[0m

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>