fix(deps): resolve remaining Trivy dependency findings

Author: matanyall

.github/workflows/checks.yml

@@ -35,11 +35,12 @@ jobs:
       - name: Typecheck
         run: npm run typecheck
 
-      - name: Lint
-        run: npm run lint
+      - parallel:
+          - name: Lint
+            run: npm run lint
 
-      - name: Test
-        run: npm run test
+          - name: Test
+            run: npm run test
 
       - name: Build
         run: npm run build

.github/workflows/install-smoke.yml

@@ -1,5 +1,5 @@
 # Real install smoke: installs the CLI through the PRODUCTION installer at
-# polylane.com/install, pinned to a given release, in a throwaway HOME.
+# polylane.com/setup, pinned to a given release, in a throwaway HOME.
 #
 # Why this exists: the GitHub release's asset list is a contract with the
 # installer. Shipping checksums.txt in v0.2.20 broke every curl install for
@@ -55,7 +55,7 @@ jobs:
           node-version: 20.x
 
       - name: Fetch the production installer
-        run: curl -fsSL --retry 3 --connect-timeout 10 -m 60 https://polylane.com/install -o /tmp/install.sh
+        run: curl -fsSL --retry 3 --connect-timeout 10 -m 60 https://polylane.com/setup -o /tmp/install.sh
 
       # Fresh HOME, no PATH or shell-config mutation, no telemetry, agent
       # wiring skipped. A piped run is EXPECTED to exit non-zero at the

.github/workflows/release.yml

@@ -111,7 +111,7 @@ jobs:
             release-artifacts/checksums.txt
 
   # Real install of the just-published release through the production
-  # installer (polylane.com/install), API-digest and checksums.txt legs both.
+  # installer (polylane.com/setup), API-digest and checksums.txt legs both.
   # Catches a release that breaks the installer contract within minutes of
   # publishing instead of at polylanedotcom's daily install-bytes cron — the
   # class of failure that took installs down for 15 minutes on v0.2.20 (RCA:

AGENTS.md

@@ -27,7 +27,7 @@ also carries the LGTM verdict contract the auto-approve workflow depends on.
 - JSON when piped, text in TTY; `--output` always overrides.
 - Every error ends with the exact command that fixes it.
 - The full API surface lives under `polylane api call <operationId>` as an escape hatch — wrap an op only when it earns a first-class command.
-- **The install script is a thin shim over this CLI.** `curl polylane.com/install | sh` (polylanedotcom `src/assets/install.sh`) only bootstraps: download, PATH, sign-in prompts, then `polylane setup`. Everything that knows about coding agents — detection, config paths, ids — lives in `src/agents/registry.ts` and is exposed for the installer to *call* (`polylane setup --list-detected --ids skills-sh` hands skills.sh its agent list; the polylane→skills.sh id table is `SKILLS_SH_IDS` here), never re-implemented in shell — not even an id map. When installer work needs new agent knowledge, add the flag or command here first.
+- **The install script is a thin shim over this CLI.** `curl polylane.com/setup | sh` (polylanedotcom `src/assets/setup.sh`) only bootstraps: download, PATH, sign-in prompts, then `polylane setup`. Everything that knows about coding agents — detection, config paths, ids — lives in `src/agents/registry.ts` and is exposed for the installer to *call* (`polylane setup --list-detected --ids skills-sh` hands skills.sh its agent list; the polylane→skills.sh id table is `SKILLS_SH_IDS` here), never re-implemented in shell — not even an id map. When installer work needs new agent knowledge, add the flag or command here first.
 
 ## Commands (build, lint, test)
 

ERRORS.md

@@ -123,7 +123,7 @@ Hint: polylane workspace use <id>
 
 These are the non-obvious command-level behaviours an agent should know about. Specific error strings are subject to change — use these as categories you can rely on.
 
-### Destructive operations (`auth logout`, `integration disconnect`, `cloud disconnect`, `memory delete`, …)
+### Destructive operations (`auth logout`, `integration disconnect`, `cloud disconnect`, …)
 
 - Prompt for confirmation in interactive mode.
 - Require `--yes` in non-interactive mode, else exit `2`.

README.md

@@ -1,7 +1,7 @@
 # polylane
 
 <p><strong>Agent-focused CLI for the <a href="https://polylane.com">Polylane</a> platform.</strong><br>
-Investigate production issues, explore cloud infrastructure, search code, and drive threads — from any agent or terminal.</p>
+Investigate production issues, explore cloud infrastructure, find the repositories behind a service, and drive threads — from any agent or terminal.</p>
 
 <p>Your coding agent writes the code. It can't see production. Polylane is the missing sense.</p>
 
@@ -35,10 +35,10 @@ Pick whichever channel fits your system. All install the same Node-based bundle
 
 ```bash
 # macOS / Linux — curl
-curl -fsSL https://polylane.com/install.sh | bash
+curl -fsSL https://polylane.com/setup.sh | bash
 
 # Windows — PowerShell
-irm https://polylane.com/install.ps1 | iex
+irm https://polylane.com/setup.ps1 | iex
 
 # Homebrew (tap: coreplanelabs/tap)
 brew install coreplanelabs/tap/polylane
@@ -55,10 +55,27 @@ bun add -g @coreplane/polylane
 Version-pin the curl / PowerShell installers with:
 
 ```bash
-POLYLANE_VERSION=v0.1.0 curl -fsSL https://polylane.com/install.sh | bash
-$env:POLYLANE_VERSION='v0.1.0'; irm https://polylane.com/install.ps1 | iex
+POLYLANE_VERSION=v0.1.0 curl -fsSL https://polylane.com/setup.sh | bash
+$env:POLYLANE_VERSION='v0.1.0'; irm https://polylane.com/setup.ps1 | iex
 ```
 
+The CLI checks for updates after successful commands, at most once per day,
+and updates the active install without a prompt. npm, Bun, and Homebrew installs
+use their own package manager. Standalone installs verify the release checksum
+and version before replacing the bundle. The current command finishes on its
+original version; the next command uses the update. Progress goes to stderr.
+
+Automatic updates require CLI `0.2.50` or later. Upgrade earlier versions once
+with the package manager or installer that owns your current install.
+
+Run `polylane update` to update now, or `polylane update --dry-run` to inspect
+the detected install and available update. Set `POLYLANE_NO_AUTO_UPDATE=1` to
+disable automatic updates. Keep `POLYLANE_VERSION` set when running the CLI to
+retain a version pin. Homebrew pins are also respected. CI, development,
+prerelease, and unrecognized installs do not update automatically. An automatic
+update failure does not change the command's result; `polylane update` reports
+update errors and exits nonzero.
+
 ### Wire it into your coding agents
 
 ```bash
@@ -113,7 +130,7 @@ polylane issue note <issue-id> "rolled back deploy"
 polylane service logs <service> --since 1h --grep error
 polylane tools run findNodes --params '{"query":"api"}'
 polylane thread ask "<prompt>"
-polylane memory save "<finding>"
+polylane memory list                              # what the agent has learned (git-backed)
 ```
 
 ## Discovering commands

build.ts

@@ -36,6 +36,8 @@ async function main(): Promise<void> {
     'POLYLANE_ONBOARDING_RUN',
     'POLYLANE_TELEMETRY_NOTICE_ACK',
     'POLYLANE_TERMS_NOTICE_ACK',
+    'POLYLANE_NO_AUTO_UPDATE',
+    'POLYLANE_VERSION',
   ]);
   // Bake every other POLYLANE_* env var visible at build time into the bundle, so
   // the produced binary works without needing those vars set at runtime.

codegen/parse-spec.ts

@@ -10,17 +10,16 @@ import { schemaToTypescript, type TypeGenOptions } from './type-utils';
 
 const CLIENT_OPTS: TypeGenOptions = { refPrefix: 'T.' };
 
-// The automations and scan reports features are retired; drop their endpoints
+// The automations feature is retired; drop its endpoints
 // and schemas from the generated client even while the API still serves them.
-const EXCLUDED_PATH = /\/(automations|scan_reports)(\/|$)/;
+const EXCLUDED_PATH = /\/automations(\/|$)/;
 const EXCLUDED_SCHEMAS = new Set([
   'Automation',
   'AutomationExecution',
   'AutomationNotification',
   'AutomationActionExecution',
   'TriggerAutomationBody',
   'CreateAutomationFromTemplateBody',
-  'Scan Report',
 ]);
 
 export function parseSpec(spec: OpenAPISpec): ParsedSpec {

features/README.md

@@ -0,0 +1,3 @@
+# Verification paths
+
+- [OAuth login](oauth-login.md): browser consent, Google sign-in, and device authorization.

features/oauth-login.md

@@ -0,0 +1,60 @@
+# OAuth login
+
+## User outcome
+
+A user signs in, approves the registered CLI permissions, and receives an OAuth
+grant. Google sign-in carries the same consent request through the provider
+redirect. Retired scopes are absent from both browser and device requests.
+
+## Entry points and prerequisites
+
+`polylane auth login` uses browser consent. `polylane auth login --no-browser`
+uses device authorization. The interactive login offers Google sign-in.
+Use a released binary with its registered OAuth client, or a local build with
+`POLYLANE_OAUTH_CLIENT_ID` and `POLYLANE_OAUTH_CLIENT_SECRET` from the target
+environment's secret store. The user needs a verified account and workspace
+membership. Use a test account and a separate operating-system user for manual
+checks: the CLI stores credentials under that user's `~/.polylane` directory.
+
+## Local checks
+
+From the CLI repository, run `npm ci`, `npm run typecheck`, `npm run lint`,
+`npm run test`, and `npm run build`. Typecheck regenerates the live API types.
+The default scope list must satisfy `OAuthClient.scopes`; a retired scope
+must cause a type error.
+
+`test/onboarding-run.test.ts` checks the Google redirect without a browser or
+network request. It requires that the nested consent URL omit all three
+`datasets:*` scopes. `test/oauth-client.test.ts` preserves the issue, agent
+tool, and page permissions. The type error and Google regression both fail
+when the retired dataset scopes are restored.
+
+## Manual sign-in
+
+Check `polylane --version` and `polylane auth status` before using the released
+build. Start browser login under the test operating-system user, select Google, finish
+sign-in, and approve consent. Expect the CLI to finish sign-in without
+`Invalid scopes requested`. Confirm `polylane auth status` and
+`polylane workspace list`. Repeat with `--no-browser` to check device consent.
+Confirm the grant's scopes stay within the registered client allowlist.
+
+Use an account you own. Keep credentials out of proof logs and run
+`polylane auth logout` after the check. This attempts access-token revocation
+and removes local credentials; it does not revoke the refresh token.
+
+## Boundaries and proof status
+
+The server rejects a scope outside the registered client allowlist. Keep that
+refusal; removing a product permission does not permit restoring it for login.
+The offline checks prove request construction and the generated API contract.
+They do not prove Google acceptance, the token exchange, or a customer login.
+Live browser and device sign-in on a released build remain a manual check.
+Record the tested revision, build, environment, result, and sanitized evidence
+in the pull request before claiming that user outcome passed.
+
+## Source anchors
+
+- `src/auth/oauth.ts`: requested scopes, browser URLs, and device requests.
+- `src/commands/auth/login.ts`: login entry point and coordination.
+- `src/auth/credentials.ts`: credential persistence.
+- `src/generated/types.ts`: generated OAuth client scope contract.