npm audit gates miss HIGH dev-dependency advisories in plugins/*/tools

[SUaDtL]

Surfaced while vetting dependabot #418 (postcss 8.5.15 -> 8.5.23 in plugins/ca-sandbox/tools).

The blind spot

That bump cleared GHSA-r28c-9q8g-f849 — PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure, severity HIGH.

No repo gate saw it. tech-stack.md configures npm audit --omit=dev --audit-level=critical, which reported 0 vulnerabilities against both the vulnerable 8.5.15 lockfile and the fixed 8.5.23 one. Two independent reasons it was invisible:

1. --omit=dev — postcss is a devDependency there.
2. --audit-level=critical — the advisory is HIGH, below the threshold.

The only reason it surfaced at all is that dependabot happened to file the bump. That is luck, not a control.

This is the same class of gap #421 just closed for site/, and #403/#432 are tightening for the docs pipeline — but plugins/*/tools dev trees remain uncovered.

Why dev-only still matters here

These are not idle dev deps. plugins/ca-sandbox/tools builds sandbox.js, the driver that clones untrusted repositories into containers; plugins/ca/tools builds farm.js, the dispatcher that executes model-authored work. A build-time compromise in either lands in a committed, shipped esbuild artifact. "Dev dependency" understates the blast radius when the dev dependency's output is the product.

Suggested direction

• Extend the audit sweep to the plugins/*/tools dev trees, not just production deps.
• Reconcile the threshold: --audit-level=critical is now inconsistent with the high gate fix(ci): add a pinned secret scan, gate the site deps, reach the parity fixture #432 introduces for the site. Pick one policy and state it in tech-stack.md.
• Whatever is chosen, update tech-stack.md — it currently documents the critical setting as the standard.

Acceptance criteria

• AC-1: A HIGH advisory in a plugins/*/tools dev dependency fails CI.
• AC-2: The threshold is consistent across every audit gate in the repo, and tech-stack.md matches what CI actually runs.
• AC-3: Re-running the gate against the pre-chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 in /plugins/ca-sandbox/tools #418 lockfile (postcss 8.5.15) reproduces a failure — i.e. the new gate is proven against a known-vulnerable state rather than only against a clean one.