fix: inspect-graph type safety + npm audit CI job

[flyingrobots]

Summary

• inspect-graph.ts: replaced unsafe as { label; nodeId }[] inline cast with toNeighborEntries() runtime guard, matching all other adapters
• CI: added audit job running npm audit --omit=dev to catch known vulnerabilities in production dependencies

Test plan

• npm run build passes
• npm run lint passes
• npm audit --omit=dev — 0 vulnerabilities
• All CI jobs go green

Summary by CodeRabbit

• Bug Fixes

  • Enhanced type safety in graph operations with improved runtime validation.

• Chores

  • Added automated security audits to the CI pipeline to monitor production dependencies.

• Tests

  • Added integration tests for concurrent claim resolution scenarios.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2481a92 and 49e9cc1.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• CHANGELOG.md
• src/inspect-graph.ts
• test/integration/ConcurrentClaim.test.ts

---

📝 Walkthrough

Walkthrough

This pull request adds an npm audit job to the CI workflow, improves type safety in inspect-graph.ts by replacing unsafe type casting with a runtime guard, documents these changes in the CHANGELOG, and introduces an integration test for concurrent quest claims with last-writer-wins conflict resolution.

Changes

Cohort / File(s)	Summary
CI/Workflow Enhancement .github/workflows/ci.yml	Adds a new audit job that runs npm audit --omit=dev on production dependencies after the test job, mirroring existing job structure with npm caching and 5-minute timeout.
Documentation Update CHANGELOG.md	Documents the new CI audit step and the type safety fix in inspect-graph.ts.
Type Safety Fix src/inspect-graph.ts	Replaces unsafe inline type casting by introducing toNeighborEntries() helper function, adding a runtime guard while preserving existing logging behavior for neighbor iteration.
Integration Test test/integration/ConcurrentClaim.test.ts	Adds comprehensive integration test for deterministic concurrent claim resolution on quests, simulating two independent agents claiming the same quest and verifying convergence with last-writer-wins ordering (Lamport timestamp → writerId → patchSha → opIndex).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Audit checks and types secured with care,
Concurrent claims now tested everywhere,
No unsafe casts in this rabbit's lair,
CI runs true with npm's watchful stare, ✨

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/inspect-graph-audit-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}