Fix launch readiness automation

.github/workflows/ci.yml

@@ -89,7 +89,7 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
-      - run: npx vitest run --reporter=verbose --reporter=junit --outputFile.junit=test-results.xml
+      - run: npm test -- --reporter=verbose --reporter=junit --outputFile.junit=test-results.xml
       - uses: actions/upload-artifact@v4
         if: always()
         with:

.github/workflows/release.yml

@@ -28,12 +28,12 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 22
-          cache: npm
+          node-version: 24
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
       - run: npm ci
@@ -42,6 +42,4 @@ jobs:
         run: npm run build
 
       - name: Publish
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

SECURITY.md

@@ -8,7 +8,7 @@ Security fixes are provided for the latest published version of REA. Upgrade to
 
 Do not disclose vulnerabilities, proof-of-concept exploits, credentials, private binaries, or Hopper documents in a public issue.
 
-If private vulnerability reporting is available in the repository's **Security** tab, use **Report a vulnerability**. Otherwise, open a minimal issue asking the maintainer to establish a private contact channel; include no sensitive technical details in that issue.
+Use **Report a vulnerability** in the repository's **Security** tab to submit the report privately. Do not open a public issue to request a private contact channel.
 
 Include the affected REA version, macOS and Hopper versions, impact, reproduction conditions, and any suggested mitigation in the private report. Remove credentials, proprietary binaries, Hopper documents, socket capability tokens, and unrelated local paths from logs or examples.
 

tests/integration/configIntegration.test.ts

@@ -25,7 +25,11 @@ describe("configuration parsing integration", () => {
     if (!result.ok) throw new Error("unreachable");
     expect(result.value.hopperTargetPath).toBe("/usr/bin/true");
     expect(result.value.hopperTargetKind).toBe("executable");
-    expect(result.value.hopperLoaderArgs).toEqual(["-l", "Mach-O", "--aarch64"]);
+    expect(result.value.hopperLoaderArgs).toEqual([
+      "-l",
+      "Mach-O",
+      "--aarch64",
+    ]);
   });
 
   it("rejects target kind values outside the enum", () => {

tests/integration/serverIntegration.test.ts

@@ -82,10 +82,13 @@ describe("full MCP integration with multi-tool sequences", () => {
   });
 
   it("preserves the complete 42-tool inventory with a session", async () => {
-    const session = new BinarySession((_path) => ({
-      callTool: () => Promise.resolve(ok(null)),
-      close: () => Promise.resolve(),
-    } satisfies BinaryClient));
+    const session = new BinarySession(
+      (_path) =>
+        ({
+          callTool: () => Promise.resolve(ok(null)),
+          close: () => Promise.resolve(),
+        }) satisfies BinaryClient,
+    );
     const server = createServer(
       { callTool: () => Promise.resolve(ok(null)) },
       session,