Review held plugin: maplumex/archive-branch-cleanup

[boudra]

maplumex/archive-branch-cleanup remains excluded from the approved paseo.cafe import at commit 59bc5335e7cd3d5e61fc375565bb1fca9faee6da pending dependency review.

package-lock.json:34 resolves @babel/code-frame through registry.npmmirror.com. In total, 307 of 317 dependency entries use that mirror. All entries have integrity values, but these external artifacts have not received the separate dependency review required by REVIEW.md.

The pinned manifest declares no install or build command, the package has no install lifecycle hooks, and all locked entries are development dependencies. This finding is about the lockfile requirement, not an observed runtime download. A lockfile using the public npm registry would clear this remaining import finding; accepting the mirror requires reviewing the exact dependency artifacts and a maintainer decision.

The runtime behavior is purpose-explained: the workspace archive hook reads the persisted workspace record, skips protected branches and workspaces Paseo does not own, force-deletes the local branch, then fetches/prunes origin. The review was static; no plugin or dependency code was executed.

[boudra]

Completed the dependency review at 59bc5335e7cd3d5e61fc375565bb1fca9faee6da: all 317 lock integrity values match the exact versions in public npm metadata, including all 307 mirror resolutions. The Git plugin install path has no build or install commands, installs zero dependencies, and executes no dependency lifecycle scripts. Runtime imports are local modules and Node built-ins; SDK imports are type-only. The earlier hold described unfinished review, not a surviving finding. Cleared for the original commit import.