fix(agent-plugin): repair release CI

Author: benlesh

docs/rxjs-next/PROJECT_PLAN.md

@@ -421,3 +421,21 @@ ordinary agent tools.
 - No model, paid-token, authenticated, or credit-consuming evaluation ran.
 - Marked P7.11 complete and advanced four-package beta.1 publication and the
   RxJS 7 documentation backport as the sole `NEXT` item.
+
+### 2026-08-17 — P7.12 pull-request CI repair
+
+- Replaced the migration MCP path validator's lint-rejected control-character
+  regular expression with equivalent character-code validation and expanded
+  deterministic refusal coverage to all 33 ASCII control characters.
+- Restored pnpm 10 override enforcement by moving the policy to
+  `pnpm-workspace.yaml`; updated the release-tooling paths to fixed `js-yaml`
+  and `nanoid` versions and a Less version that no longer carries the
+  vulnerable `image-size` dependency.
+- Re-ran the pinned OSV 2.3.8 scan and path-aware npm audit. All 264 remaining
+  findings are isolated to the excluded legacy documentation workspace; the
+  generated 185-ID exception baseline is owned, tracked, and expires within 90
+  days.
+- Deterministic evidence: all four package lint, build, test, type, import, and
+  packed-artifact gates passed; the plugin passed 146 tests and its 124-file
+  packed MCP gate; the runtime contract, workflow formatting, and all 40
+  release checks passed. P7.12 remains the sole `NEXT` item.

docs/security/LEGACY_DOCS_VULNERABILITIES.md

@@ -1,8 +1,8 @@
 # Legacy documentation dependency vulnerability backlog
 
-Last reviewed: 2026-08-02. Owner: Ben Lesh (`benlesh`). Next mandatory review: 2026-10-31.
+Last reviewed: 2026-08-17. Owner: Ben Lesh (`benlesh`). Next mandatory review: 2026-11-15.
 
-The inherited `apps/rxjs.dev` Angular 13 toolchain is outside the RxJS 9 package, test, qualification, and publication paths. It is intentionally not changed by the RxJS Next project. A path-aware npm audit on 2026-08-02 classified 253 remaining advisory paths as reachable only from that workspace after all release-reachable findings were removed.
+The inherited `apps/rxjs.dev` Angular 13 toolchain is outside the RxJS 9 package, test, qualification, and publication paths. It is intentionally not changed by the RxJS Next project. A path-aware npm audit on 2026-08-17 classified 264 remaining advisory paths as reachable only from that workspace after all release-reachable findings were removed. Fixable root-tooling findings were removed by restoring pnpm 10 override enforcement and updating `js-yaml`, `nanoid`, and Less; the remaining findings are isolated to legacy documentation tooling.
 
 The matching OSV IDs are temporarily recorded in the root `osv-scanner.toml`. Each exception expires within 90 days. The isolated release-train scan never loads these exceptions. A new or changed advisory path that reaches the repository root or a release package fails CI.
 

osv-scanner.toml

@@ -61,39 +61,6 @@
       "path": "cz-conventional-changelog"
     }
   },
-  "pnpm": {
-    "overrides": {
-      "@babel/core": "7.29.7",
-      "@babel/helpers": "7.29.7",
-      "@babel/plugin-transform-modules-systemjs": "7.29.8",
-      "@babel/runtime": "7.29.7",
-      "ajv@6": "6.14.0",
-      "ajv@8": "8.18.0",
-      "axios": "1.18.0",
-      "brace-expansion@1": "1.1.18",
-      "brace-expansion@2": "2.1.4",
-      "brace-expansion@5": "5.0.9",
-      "braces": "3.0.3",
-      "cross-spawn": "7.0.6",
-      "diff@4": "4.0.4",
-      "ejs": "3.1.10",
-      "flatted": "3.4.2",
-      "follow-redirects": "1.16.0",
-      "form-data": "4.0.6",
-      "glob@10": "10.5.0",
-      "immutable@4": "4.3.9",
-      "js-yaml@3": "3.15.0",
-      "js-yaml@4": "4.3.0",
-      "micromatch": "4.0.8",
-      "minimatch@3": "3.1.4",
-      "minimatch@5": "5.1.8",
-      "minimatch@9": "9.0.7",
-      "picomatch@2": "2.3.2",
-      "rollup": "4.59.0",
-      "tmp": "0.2.7",
-      "yaml@1": "1.10.3"
-    }
-  },
   "lint-staged": {
     "*.js": "eslint --cache --fix",
     "(src|spec)/**/*.ts": [

package.json

@@ -9,8 +9,8 @@
       "bytes": 2838
     },
     "dist/mcp-server.cjs": {
-      "sha256": "c7c666f7bdb11a9df3c2ce8547644827a23ff748de59647f3b45110dc5dcfb68",
-      "bytes": 11012820
+      "sha256": "dd0b977ef49d5d1cb71cd348e8a2880f73cf591db041902002dd21d85504b84f",
+      "bytes": 11013015
     },
     "skills/analyze-rxjs-performance/SKILL.md": {
       "sha256": "0128a2879643131cecfdfb920d8c0af4d7f1975b4e49788af2b7c9c94a4924ee",

packages/agent-plugin/claude-adapter/artifact-digests.json

@@ -240608,10 +240608,17 @@ function migrationOptions(batch, path) {
   };
 }
 function isRepositoryRelativePath(value) {
-  if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || /[\0-\x1f\x7f]/.test(value)) return false;
+  if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || hasAsciiControlCharacter(value)) return false;
   const segments = value.split(/[\\/]/);
   return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
+function hasAsciiControlCharacter(value) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
 function limits() {
   return { maxFiles: MAX_FILES, maxFileBytes: MAX_FILE_BYTES, maxTotalBytes: MAX_TOTAL_BYTES };
 }

packages/agent-plugin/claude-adapter/dist/mcp-server.cjs

@@ -240608,10 +240608,17 @@ function migrationOptions(batch, path) {
   };
 }
 function isRepositoryRelativePath(value) {
-  if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || /[\0-\x1f\x7f]/.test(value)) return false;
+  if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || hasAsciiControlCharacter(value)) return false;
   const segments = value.split(/[\\/]/);
   return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
+function hasAsciiControlCharacter(value) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
 function limits() {
   return { maxFiles: MAX_FILES, maxFileBytes: MAX_FILE_BYTES, maxTotalBytes: MAX_TOTAL_BYTES };
 }

packages/agent-plugin/dist/mcp-server.cjs

@@ -192,11 +192,19 @@ function migrationOptions(batch: z.output<typeof batchSchema>, path: string) {
 }
 
 function isRepositoryRelativePath(value: string): boolean {
-  if (value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value) || /[\0-\x1f\x7f]/.test(value)) return false;
+  if (value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value) || hasAsciiControlCharacter(value)) return false;
   const segments = value.split(/[\\/]/);
   return segments.every((segment) => segment.length > 0 && segment !== '.' && segment !== '..');
 }
 
+function hasAsciiControlCharacter(value: string): boolean {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+  return false;
+}
+
 function limits() {
   return { maxFiles: MAX_FILES, maxFileBytes: MAX_FILE_BYTES, maxTotalBytes: MAX_TOTAL_BYTES };
 }

packages/agent-plugin/src/mcp/service.ts

@@ -130,11 +130,7 @@ void operate;
     expect(result.files[0]?.reviewFlags).toEqual(
       expect.arrayContaining(['default-import', 'unknown-public-surface', 'namespace-import', 'deep-import'])
     );
-    expect(result.files[0]?.unsupportedConstructs).toEqual([
-      'rxjs:default',
-      'rxjs:notInRxjs782',
-      'rxjs/internal/util/lift:*',
-    ]);
+    expect(result.files[0]?.unsupportedConstructs).toEqual(['rxjs:default', 'rxjs:notInRxjs782', 'rxjs/internal/util/lift:*']);
   });
 
   it('validates schema separately from readiness', () => {
@@ -212,7 +208,6 @@ void operate;
     ['dot segment', { files: [{ path: './file.ts', source: '' }] }, 'invalid-path'],
     ['empty segment', { files: [{ path: 'src//file.ts', source: '' }] }, 'invalid-path'],
     ['Windows absolute path', { files: [{ path: 'C:\\src\\file.ts', source: '' }] }, 'invalid-path'],
-    ['control character', { files: [{ path: 'src/file\0.ts', source: '' }] }, 'invalid-path'],
     [
       'duplicate path',
       {
@@ -249,6 +244,10 @@ void operate;
   ])('refuses %s before producing partial output', (_name, input, code) => {
     expectRefusal(() => previewMigration(input), code as InputRefusal['refusal']['code']);
   });
+
+  it.each([...Array.from({ length: 0x20 }, (_, code) => code), 0x7f])('refuses ASCII control character U+%s in a path', (code) => {
+    expectRefusal(() => previewMigration({ files: [{ path: `src/file${String.fromCharCode(code)}.ts`, source: '' }] }), 'invalid-path');
+  });
 });
 
 function expectRefusal(operation: () => unknown, code: InputRefusal['refusal']['code']): void {