fix: patch tooling redirect credential advisory

docs/reviews/2026-10-31-follow-redirects-patch.md

@@ -0,0 +1,15 @@
+# Redirect dependency security review
+
+One fresh read-only gpt-6-astra/high whole-change review on59e2e19..708d120 found no Critical, Important or Minor issues. No material fix pass or re-review was needed. The reviewer independently checked the complete patch, all locked resolutions and registry integrity, and ran the owned loopback old/new harness. Full workspace checks and audit remain coordinator evidence.
+
+Baseline CI reported GHSA-mrwp-f3q8-3g9p: one high plus four moderate findings. The existing Nx override minimum now excludes1.16.1; the generated lock changes only follow-redirects to1.16.2 and its Axios/http-proxy/Nx edges. No audit policy, permissions or runtime source changed. The advisory did not reproduce through Axios1.20.0; this tooling finding is not proof of an observed credential incident or published-product exposure.
+
+Fresh Node24.22.1/pnpm9.12.0 verification:
+
+- Exact registry1.16.1 failed two cross-realm custom-header confidentiality cases; same-realm controls passed. Registry1.16.2 passed all four object/array-header and same/cross-realm cases, preserving a harmless header and removing built-in Authorization. Only synthetic headers and owned loopback servers were used. The temporary harness is local dependency-correction evidence, not an application regression test.
+- Unmodified `pnpm install --frozen-lockfile` passed.
+- `pnpm audit --audit-level=high` exited0: high/critical0, moderate4 remain. JSON audit reports all severities and exited1; retain that raw result rather than claiming a clean audit.
+- `NX_DAEMON=false pnpm exec nx run-many -t lint test build typecheck --exclude domscribe-test-fixtures --parallel=2 --skip-nx-cache` passed17 projects and9 dependency tasks:2225tests/129files. Existing fixture non-null warnings and expected fault-injection logs remain; no failures were suppressed.
+- Seven unchanged mirror tests, package/plan Prettier and diff whitespace checks passed. An extra generated-lock Prettier check stopped the first wrapper; original main's lock also fails it. Preserve the minimal generated delta; subsequent configured checks above passed. A later documentation write initially lacked its new directory; creating that directory corrected the command before any commit/push.
+
+Required latest-head hosted CI remains mandatory. No package publication, deployment, customer workload, inference or credential action occurred. Separate moderate advisories and hosted/runtime qualification remain open.

docs/superpowers/plans/2026-10-31-follow-redirects-patch.md

@@ -0,0 +1,17 @@
+# Repair the tooling redirect dependency
+
+Native execution under the user's continuous-build instruction. Always use this isolated worktree; preserve primary checkouts. No publication, deployment, credentials or account changes.
+
+## Contract
+
+CI audit on unchanged main dependencies reports GHSA-mrwp-f3q8-3g9p: follow-redirects 1.16.1. Upstream fixes it in 1.16.2. Nx is a root development dependency; no direct application import was found. Do not claim an observed credential incident, shipped exposure, or that Axios reproduces the advisory. Keep the four separate moderate findings visible.
+
+### Task 1: Compatible patch and verified delivery
+
+- Preserve baseline high-audit evidence. In owned temporary directories, exercise exact registry artifacts with real loopback redirects and a synthetic custom header: same-realm and cross-realm sensitiveHeaders, preserving a harmless header. The cross-realm old artifact must fail the intended confidentiality assertion before the dependency update.
+- Raise the existing Nx override minimum to ^1.16.2 and update only follow-redirects resolution, reviewing the full lockfile delta. Verify the patched artifact, frozen install, high-level audit, affected configured checks and unchanged mirror-helper baseline. Do not add an application test that only tests upstream mechanics; retain the temporary harness as evidence.
+- Obtain one independent whole-change review; resolve material findings with a regression-backed pass. Push a focused ready PR, attach it, require all latest-head checks, then merge under existing OSS authority. Refresh/rebase the separately reviewed helper PR only after security delivery. No failing-audit bypass.
+
+## Review focus
+
+Every vulnerable resolution is removed; the patch remains compatible and no unrelated package drifts. Distinguish source dependencies from published artifacts and fresh evidence from assumptions. Preserve all audit checks and existing permissions.

package.json

@@ -136,7 +136,7 @@
   "pnpm": {
     "overrides": {
       "nx>axios": "^1.20.0",
-      "nx>follow-redirects": "^1.16.1",
+      "nx>follow-redirects": "^1.16.2",
       "nx>brace-expansion": "^5.0.12",
       "nx>smol-toml": "^1.9.1",
       "postcss-selector-parser@<7.1.6": "^7.1.7",