fix(deps): patch runtime vulnerabilities and restore local gates

apps/desktop/runtime-dependencies/package.json

@@ -8,7 +8,7 @@
     "jszip": "3.10.1",
     "mammoth": "1.12.2",
     "playwright": "1.62.1",
-    "sanitize-html": "2.17.7",
-    "undici": "8.10.1"
+    "sanitize-html": "2.18.1",
+    "undici": "8.12.3"
   }
 }

lefthook.yml

@@ -3,9 +3,8 @@
 #
 # Adoption is incremental: Biome enforces only on the files a commit actually
 # touches (so the pre-existing lint backlog doesn't block work), while the fast
-# structural guards run every commit because they catch the class of bug that
-# ships green through the test runner — a broken CSS/JS template literal that is
-# never parsed in a browser by the suite. The full gate suite runs on push,
+# structural guards run every commit to protect the current app foundation,
+# retired dashboard boundary, and shipped YAML configuration. The full gate suite runs on push,
 # mirroring CI (see .github/workflows/ci-verify.yml's `qlty` and `knip` jobs).
 
 commit-msg:
@@ -21,10 +20,9 @@ pre-commit:
       run: npx biome check --write --no-errors-on-unmatched {staged_files}
       stage_fixed: true
     - name: structure-guards
-      # Cheap parse/structure checks the test suite would otherwise ship green:
-      # the embedded <style>/<script> template literals (never parsed in a
-      # browser) and every shipped YAML config. Sub-second; safe to run always.
-      run: node --test tests/styles.test.mjs tests/client-script.test.mjs tests/config-yaml-parses.test.mjs
+      # Fast source checks for the React app foundation, static dashboard
+      # retirement, and every shipped YAML config. No build or browser required.
+      run: node --test tests/chat-first-foundation-style.test.mjs tests/static-dashboard-retirement.test.mjs tests/config-yaml-parses.test.mjs
 
 # Piped (not parallel): fail fast in the order listed, cheapest checks first,
 # same order as CI's gate jobs.

package.json

@@ -137,7 +137,7 @@
     "export": "node src/cli/export.mjs",
     "lint:placeholders": "node src/cli/lint-placeholders.mjs",
     "check:install-scripts": "node scripts/check-install-scripts.mjs",
-    "test": "node --test 'tests/**/*.test.mjs'",
+    "test": "node --test --test-concurrency=2 'tests/**/*.test.mjs'",
     "scan:sourced": "node scripts/scan-sourced.mjs",
     "delta:sourced": "node scripts/delta-sourced.mjs",
     "capture:board": "node scripts/capture-board-snapshot.mjs",

tests/release-safety.test.mjs

@@ -79,6 +79,25 @@ test("every explicit workflow test path exists", async () => {
   assert.deepEqual(missing, [], `Workflow test paths must exist:\n${missing.join("\n")}`);
 });
 
+test("pre-commit guards reference tracked tests that still exist", async () => {
+  const hooks = await readFile(join(root, "lefthook.yml"), "utf8");
+  const preCommit = hooks.split(/^pre-commit:\s*$/m)[1]?.split(/^pre-push:/m)[0] || "";
+  const paths =
+    preCommit.match(
+      /\b(?:tests|apps\/[A-Za-z0-9._/-]+)\/[A-Za-z0-9._/-]+\.test\.(?:mjs|cjs|js|jsx|ts|tsx)\b/g
+    ) || [];
+  const tracked = new Set(
+    execFileSync("git", ["ls-files"], { cwd: root, encoding: "utf8" }).trim().split("\n")
+  );
+
+  assert.ok(paths.length > 0, "pre-commit must retain its structural guards");
+  assert.deepEqual(
+    paths.filter((path) => !tracked.has(path) || !existsSync(join(root, path))),
+    [],
+    "pre-commit must not keep paths removed by a product migration"
+  );
+});
+
 test("document export fonts stay packaged while the app bundles its own fonts", async () => {
   assert.equal(existsSync(join(root, "fonts")), false, "root fonts/ should not exist");
   for (const file of ["Geist-OFL.txt", "GeistMonoVF.woff2", "GeistVF.woff2"]) {