fix(examples): pin browser npm dependencies

examples/browser/.gitignore

@@ -1,5 +1,2 @@
 node_modules/
 dist/
-# Relaxed on purpose: no committed lockfile, so `pnpm install` always resolves
-# the latest published @everruns/bashkit-wasm (see knowledge/operations/maintenance.md).
-pnpm-lock.yaml

examples/browser/README.md

@@ -7,12 +7,12 @@ A sandboxed Bash interpreter running entirely in the browser via WebAssembly.
 ## Quick Start
 
 ```bash
-pnpm install
+pnpm install --frozen-lockfile
 pnpm start
 ```
 
-Open http://localhost:5173. No Rust toolchain, no build step — `pnpm install`
-pulls the prebuilt wasm.
+Open http://localhost:5173. No Rust toolchain, no build step — pnpm verifies and
+installs the lockfile-pinned prebuilt wasm package.
 
 ## How It Works
 

examples/browser/dependency-security.test.js

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import test from "node:test";
+
+const packageJson = JSON.parse(
+  readFileSync(new URL("package.json", import.meta.url), "utf8"),
+);
+
+test("dependencies are reproducible", () => {
+  for (const [name, version] of Object.entries({
+    ...packageJson.dependencies,
+    ...packageJson.devDependencies,
+  })) {
+    assert.match(version, /^\d+\.\d+\.\d+$/, `${name} must use an exact version`);
+  }
+
+  assert.ok(
+    existsSync(new URL("pnpm-lock.yaml", import.meta.url)),
+    "pnpm-lock.yaml must be committed",
+  );
+});

examples/browser/package.json

@@ -5,14 +5,14 @@
   "scripts": {
     "start": "vite",
     "dev": "vite",
-    "test": "node --test browser-local.test.js",
+    "test": "node --test *.test.js",
     "build": "vite build",
     "preview": "vite preview"
   },
   "dependencies": {
-    "@everruns/bashkit-wasm": "latest"
+    "@everruns/bashkit-wasm": "0.14.3"
   },
   "devDependencies": {
-    "vite": "^6.4.3"
+    "vite": "6.4.3"
   }
 }