Use exact-pinned esbuild so the committed bundle is reproducible across CI runners, generate and ship complete dependency licenses, keep the bundle under a size ceiling, and route degraded scans through the shared operational-failure exit handling.
AI assistance: Codex audited PR #693 and implemented this hardening.
Greptile caught that editing the bundle entry did not refresh the committed vendor file, and neither build nor the detector suite would notice. --check compares a fresh rebuild, bun run build runs that check, and the detector suite now triggers on the entry.
AI-assisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skill and plugin copies of the detector had no htmlparser2/css-select/css-tree/domutils, so HTML scans silently fell back to regex and exited 0. Bundle those parsers into the engine tree and exit 1 if the fallback still fires.
AI assistance: Cursor Grok 4.6 implemented this change.
Co-authored-by: Cursor <cursoragent@cursor.com>
Paul Bakaus
