fix(security): gate landing dependency audit

scripts/release-boss.mjs

@@ -181,6 +181,7 @@ async function main() {
 
   const repo = await getRepoInfo();
   await ensureRemoteBuildPrerequisites(repo);
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? currentVersion;

scripts/release-local-mac.mjs

@@ -138,6 +138,7 @@ async function main() {
   process.env.AGENTCOMPANY_ELECTRON_PUBLISH = "never";
 
   validatePreflight();
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? (options.bump ? bumpPatchVersion(currentVersion) : currentVersion);

scripts/release-local-winlinux.mjs

@@ -140,6 +140,7 @@ async function main() {
   if (nextVersion !== pkgVersion) {
     console.log(`[release-local-winlinux] version override: ${pkgVersion} -> ${nextVersion}`);
   }
+  await run("pnpm", ["audit:deps"]);
 
   await rm(localReleaseDir, { recursive: true, force: true });
   await rm(buildReleaseDir, { recursive: true, force: true });

scripts/release-local.mjs

@@ -51,7 +51,7 @@ function printHelp() {
 
 Options:
   --platforms=mac,win,linux   Comma-separated platform list (default: all)
-  --skip-verify               Skip pnpm verify before release builds
+  --skip-verify               Skip dependency audit and pnpm verify before release builds
   --no-upload                 Build artifacts locally without publishing
   --help                      Show this help
 
@@ -251,6 +251,7 @@ async function main() {
 
   await rm(localReleaseDir, { recursive: true, force: true });
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
   if (options.platforms.includes("mac")) {

scripts/release-public-cloudflare.mjs

@@ -95,7 +95,7 @@ function printHelp() {
 
 Options:
   --version=x.y.z          Explicit version. Defaults to current patch + 1.
-  --skip-verify            Skip local pnpm verify before packaging.
+  --skip-verify            Skip local dependency audit and pnpm verify before packaging.
   --delete-remote-branch   Delete the GitHub snapshot branch after success.
   --keep-transport-release Keep the temporary draft GitHub release after success.
   --help                   Show this help.
@@ -280,6 +280,7 @@ async function main() {
   await resetReleaseStaging();
 
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
 

scripts/release-website.mjs

@@ -103,6 +103,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   await prepareR2ReleaseHost({ rootDir });
+  await runPlain("pnpm", ["audit:deps"]);
 
   const version = (await readPackageJson()).version;
   console.log(`[release-website] regenerating landing for version ${version}`);

scripts/resume-release-public.mjs

@@ -83,6 +83,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   const repo = await getRepoInfo();
+  await run("pnpm", ["audit:deps"]);
 
   await uploadWinAndLinuxToR2();
   await run("node", ["scripts/generate-landing-release-links.mjs"]);