[classeve-public]

Repairs main, red since 2026-09-08 (last green ae9c94d). Four causes:

Audit dependencies — hono (moderate) and js-yaml (high). npm audit fix, lockfile-only; npm audit reports 0 vulnerabilities.

Sandbox: repository commands never ran on Debian or Ubuntu — /bin/sh there is dash, which has no ulimit -u (dash spells the process ceiling -p). The ulimit chain stopped and sh exited 2 before exec, on every such host since the first release; the exactly-once test added in 2.15.0 was the first to assert the exit code. The process ceiling now tries -u, then -p, and nothing runs if neither sets it. -f is given in 512-byte blocks, the unit every POSIX sh uses (KB had halved the configured size). The process ceiling applies inside the new user namespace only: RLIMIT_NPROC counts every task the user owns, so outside one it stops the target's own threads on any busy host. A new Linux test reads /proc/self/limits from the sandboxed process and checks each ceiling.

workspace-parse-cache — Jest re-evaluates tree-sitter's JS wrapper in every test file but loads its native addon once per worker. The second evaluation captures its own rootNode getter instead of the native method, so every later tree in that worker has no root node. A server process evaluates the wrapper once and is unaffected. A test shim now evaluates it once per worker. Without the shim, the six parsing suites in one process fail 1 test; with it, 114 of 114 pass.

Docker install path — 2.15.0 moved the migration count behind authentication at /ready_detail. The check still asked /ready.

Local: typecheck, lint, and npm run test:ci (1941 passed, coverage thresholds met).