fix(deps): remove vulnerable ShellJS production dependency chain

[konard]

Installing the published command-stream@2.0.0 in a clean npm project resolves shelljs and @types/shelljs into fast-glob → micromatch → braces@3.0.3, producing six high severity production audit findings. This PR removes that consumer dependency chain while preserving the ShellJS command API. A clean install of the packed fix reports zero production vulnerabilities, without overrides or advisory exclusions.

Fixes #221.

• Bundle the pinned ShellJS 0.10 command source and matching declarations with their BSD/MIT licenses. Use command-stream's existing dependency-free glob engine and the existing current Execa runtime; keep the upstream packages only as development references.
• Preserve shared ESM/CommonJS/main ShellJS configuration, commands, argument handling, ShellString pipelines and error behavior. Add command-stream/shelljs/plugin for plugins using the bundled instance. A separately installed upstream ShellJS package has separate state; plugin authors use the documented new subpath.
• Compare glob configuration and syntax against the pinned engine, including quote delimiters, literal quotes, character classes, disabled globstar and exclusions. Preserve filesystem overrides and the existing input-depth guard; use iterative brace expansion with a 10,000-pattern limit.
• Preserve the ESM entry on Node 22.0.0 without require(esm) and merge the Deno loader fix from main. The Deno HTTP smoke test covers core commands, ShellJS commands/globs and depth protection; esm.sh imports use target=denonext&conditions=node to select Execa's Node filesystem exports. Deduplicate builtin import bindings in the CDN harness. A future published npm/CDN artifact is not verified by this PR.
• Extend the existing Node 22/24/26 production-install CI matrix to audit clean consumers, check absent compatibility dependencies, exercise runtime commands/plugins, and compile ESM/CommonJS declarations without upstream ShellJS types.
• Add a JavaScript patch changeset. The dependency refresh fixing the initial CI failure is also present in the merged main branch; no duplicate Rust release fragment remains in this PR.

The repository development audit exception remains only for tooling and upstream reference packages. Packed production consumers are audited without it. The parity-exempt label applies because npm packaging and the JavaScript-only compatibility boundary have no Rust runtime equivalent; executable JavaScript/Rust feature parity is still checked.

Reproduction and validation

js/tests/production-dependencies.test.mjs failed all three assertions before implementation, covering the runtime manifest, production lockfile graph and declaration imports. experiments/issue-221/consumer-audit.mjs reproduces the published release and packed fix in isolated npm projects. Reproduction instructions and before/after evidence are committed.

Local validation:

• Full Bun suite plus focused dependency, ShellJS compatibility, plugin, ESM, glob and bounded-input regressions.
• bun run check: ESLint, Prettier, duplicate-code threshold and strict TypeScript checks; frozen Bun lockfile and direct-dependency freshness checks.
• Node core integration tests, the complete zx suite, and Execa suites; Node 22.0 ESM consumer probe and Deno HTTP/CDN-resolution smoke test.
• Packed local/global consumer installs on Node 22, 24 and 26, including isolated declaration compilation and audits. Build tools are excluded from PATH locally; the existing CI matrix uses clean Node slim containers.
• Rust all-features tests, benchmark tests, formatting, Clippy with warnings denied, and the three changed release-script test suites.
• All 29 executable JavaScript/Rust feature parity checks and generated-documentation validation.

The initial CI failure was run 38094949858 at head 04f5dac: downloaded log lines 640–646 identify the stale serde_json versions. The refreshed direct-dependency check reports 89 checked and zero stale.

Final CI validation at 413979d passes the production-install matrix, Node 22/24/26 suites, Linux/macOS/Windows Bun suites, Deno HTTP/CDN imports, security checks, dependency freshness, repository quality and executable language parity.

The first Windows attempt in run 38097686334 timed out in the existing PowerShell get-host smoke test. Downloaded job-log lines 6712–6741 show Bun killing the dangling process and its delayed SIGTERM rejection being attributed to the following test. Those tests passed on main in run 38096709358 and in the same-commit rerun. The exact cause of the first timeout was not established; the process launcher, smoke tests and their timeouts are unchanged.

[konard]

Working session summary

PR #223 is updated and ready for review.

Removed the vulnerable production dependency chain while preserving ShellJS compatibility. Clean consumer audits report zero vulnerabilities.

Local tests pass, and CI shows 42 passing checks. Changes are pushed, latest main is included, and the working tree is clean. The patch release is prepared.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-6.1 Sol
• Provider: OpenAI
• Public pricing estimate: $6.928797

📊 Context and tokens usage:

• 541.8K input tokens across requests (cumulative, larger than the 200K context window, so not one request's context), 117.5K / 128K (92%) output tokens

Total: (541.8K + 15.0M cached) input tokens, 117.5K output tokens, $6.928797 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-6.1-sol
• Thinking level: xhigh (~31999 tokens)
• Model: GPT-6.1 Sol (gpt-6.1-sol)

📎 Log file uploaded as Gist (9433KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed