[mkbhardwas12]

What changed

Patch the dependencies blocking the full audit, keep browser requests cancellable until their response body finishes, and prevent an old account's delayed 401 from expiring a newer session. Pin CodeQL initialization and analysis to the same verified v4.38.1 commit.

• Update concurrently/shell-quote, source-map-js, Vite, Vitest and matching internals; update Fastify to 5.12.7 for its published header-validation security patch.
• Add seven request-lifetime and session regression tests. Four regressions fail against the original helper.
• Refresh the README verification evidence and include the full dependency audit in the PR checklist.

Why

The older dependency PRs each leave another audit finding unresolved. A fresh audit also identified Vite and Vitest findings, while Fastify's published advisory identifies an additional patch not reported by that audit. These targeted updates retain unrelated dependency versions.

The browser helper previously removed timeout/abort handling after headers arrived, before body consumption completed. It also dispatched a global expiry event for a previous account's 401. The new tests cover cancellation before sending and during body consumption, a stalled body, resource cleanup, stale/current sessions, and non-JSON HTTP errors.

The paired CodeQL pins address the version-mismatch failure observed in #32 without importing its unrelated workflow changes. This PR includes the dependency repairs covered separately by #36 and #37, plus the security-related subset of #38. Existing PRs remain available for separate review.

Evidence

Verified locally on macOS with Node.js 24.18.0 and npm 11.16.0:

• Clean npm ci from the committed lockfile
• npm run preflight: all typechecks, 267 tests (72 core / 133 API / 62 web), and production builds
• npm audit --audit-level=high: zero findings in the complete audit
• npm audit --omit=dev --audit-level=high: zero findings
• All three CI fuzz seeds: 7 properties × 3,000 runs × 3 seeds = 63,000 generated cases
• Docker API and web target builds; Compose configuration validation
• npm ls --all and git diff --check
• Existing allow/deny suites and new cancellation/session regressions
• Documentation evidence refreshed; only synthetic/public-safe material included

GitHub checks must validate this revision before merge.

Production-boundary check

PurposeMesh remains a technical preview. Local authorization policy and external adapter capability gates are unchanged. These fixes do not establish external adapter conformance, enterprise identity, or production readiness.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T01:14:39.176834Z	644f461	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.