[dependabot]

Refresh development dependencies after the repository's two-day cooldown: Node.js types 26.6.4, Rolldown 1.2.12 and its platform bindings, Oxc types, and compatible test/build transitive patches. Align the Vitest and V8 coverage ranges with the already-locked 5.0.3 patch release.

The Ghostty runtime remains pinned at 0.4.0. The package version, supported Node.js floors, pnpm 11.28.0, and dependency cooldown are unchanged. Includes an Unreleased entry crediting @dependabot[bot].

Validation passed:

• Clean Linux frozen-lockfile install, pnpm check (140 unit tests), pnpm test:coverage (84.84% statements), and pnpm test:browser (9 tests).
• Independent Codex autoreview: scoped-clean with the repository's P0–P3 threshold; no findings.
• Exact-head GitHub Actions: Node.js 22/24 on Linux, macOS, and Windows; Node.js 26 on Linux; browser smoke, workflow lint, and CodeQL.

Verified head: 94b171a974c7287c6a1b2572430bbbd56bd5f3f2. CI and CodeQL passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 4:41 AM ET / 08:41 UTC (Revision 7).

ClawSweeper review

What this changes

Refreshes development dependencies and their lockfile resolutions, aligns Vitest ranges with the locked release, and records the update in the changelog.

Merge readiness

✅ Ready for maintainer review

The dependency refresh remains useful and is not on current main. No actionable defect or unresolved merge concern was found; all 14 check runs succeeded on the exact head.

Priority: P3
Reviewed head: 94b171a974c7287c6a1b2572430bbbd56bd5f3f2

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with consistent lockfile changes and successful exact-head validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: The bot-authored development-tooling update is exempt from contributor runtime proof; exact-head build, test, coverage, and browser checks provide supplemental validation. No persisted-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The bot-authored development-tooling update is exempt from contributor runtime proof; exact-head build, test, coverage, and browser checks provide supplemental validation. No persisted-data contract changes.
Evidence reviewed	7 items	Pinned head and inherited migration: Raw head records identify parents 7458d69 and 14d41a0. Comparing fetched main to the head leaves only CHANGELOG.md, package.json, and pnpm-lock.yaml; the autoreview migration matches existing main. Migration already merged independently: GitHub confirms #97 merged on 2026-10-06 with merge SHA 7458d69. Its shared-autoreview migration accounts for the large inherited deletion. Remaining update is necessary: Current main retains @types/node ^26.6.3 and Vitest/coverage ranges ^5.0.2. The head changes these to ^26.6.4 and ^5.0.3 and refreshes transitive tooling. Runtime dependencies, exports, scripts, package version, Node floors, and pnpm version are unchanged.
Findings	None	None.
Security	None	None.

How this fits together

The development toolchain compiles and tests libterminal’s shared terminal primitives for browser, Node.js, and Worker consumers. Dependency versions feed the build, type checking, coverage, and browser smoke checks.

flowchart LR
  A[Dependency ranges] --> C[Locked development tools]
  B[Terminal source and tests] --> D[Build and validation]
  C --> D
  D --> E[Published JavaScript and types]
  D --> F[Node and browser check results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changes beyond current main	3 files	The apparent 13-file diff includes an already-merged autoreview migration.
Exact-head checks	14 successful	Validation covers multiple Node versions and operating systems plus browser smoke and security analysis.

Technical review

Best possible solution:

Keep the development toolchain current while preserving the runtime pin, supported Node versions, and dependency cooldown.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency-maintenance PR does not report a runtime bug; exact-head CI validates the refreshed toolchain.

Is this the best way to solve the issue?

Yes: the package ranges and lockfile are updated together without changing public runtime contracts or introducing a parallel implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7458d69ed8ed.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is routine development-tooling maintenance without an identified user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The bot-authored development-tooling update is exempt from contributor runtime proof; exact-head build, test, coverage, and browser checks provide supplemental validation. No persisted-data contract changes.

Evidence

What I checked:

• Pinned head and inherited migration: Raw head records identify parents 7458d69 and 14d41a0. Comparing fetched main to the head leaves only CHANGELOG.md, package.json, and pnpm-lock.yaml; the autoreview migration matches existing main. (94b171a974c7)
• Migration already merged independently: GitHub confirms chore(autoreview): use the shared canonical skill #97 merged on 2026-10-06 with merge SHA 7458d69. Its shared-autoreview migration accounts for the large inherited deletion. (.agents/skills/autoreview/SKILL.md:8, 7458d69ed8ed)
• Remaining update is necessary: Current main retains @types/node ^26.6.3 and Vitest/coverage ranges ^5.0.2. The head changes these to ^26.6.4 and ^5.0.3 and refreshes transitive tooling. Runtime dependencies, exports, scripts, package version, Node floors, and pnpm version are unchanged. (package.json:92, 94b171a974c7)
• Exact-head validation: GitHub reports 14 successful completed checks at the pinned head, including seven Node/OS checks, browser smoke, workflow lint, and CodeQL. CI runs frozen-lockfile installs and pnpm check; Node 24 Linux additionally runs coverage. No local tests or bundled review helpers were executed. (.github/workflows/ci.yml, 94b171a974c7)
• npm integrity and release-age check: Read official registry.npmjs.org metadata for the eight refreshed non-platform package versions. Each published integrity value appears in the lockfile, and each publication predates the October 7 head by more than the configured 48-hour cooldown. Inspected package scripts showed no install lifecycle hook among these eight packages.
• Feature-history routing: Main history shows prior tooling refreshes by Peter Steinberger, including be91947, and release preparation by Vincent Koc. GitHub verifies steipete authored merged build(deps): refresh terminal development tooling #93 and vincentkoc authored merged chore(release): prepare 0.3.9 #99. Deeper blame/show inspection encountered unavailable historical objects, so no source-line introduction is claimed. (pnpm-lock.yaml, 7458d69ed8ed)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-10-05T17:18:53.488Z sha 14d41a0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T11:46:33.500Z sha 14d41a0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T17:18:09.980Z sha 14d41a0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T20:00:35.055Z sha 14d41a0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T02:44:47.872Z sha 14d41a0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T05:02:59.553Z sha 14d41a0 :: needs maintainer review before merge. :: none

[steipete]

Merged as fc0f565 after all checks passed on exact head 94b171a. The tested candidate and squash commit have identical Git trees.

Validation on a clean Linux machine: pnpm install --frozen-lockfile, pnpm check (format, build, portable type checks, lint, 140 unit tests, and package checks), pnpm test:coverage (84.84% statement coverage), and pnpm test:browser (9 tests, including Node/Worker asset paths and sustained terminal output). Independent Codex autoreview completed with no P0–P3 findings. Heavy checks ran remotely; local work was limited to dependency resolution and review preparation.

PR CI and post-merge main CI passed, including Node 22/24 on Linux, macOS, and Windows, Node 26 on Linux, browser smoke, and workflow lint. Post-merge CodeQL also passed. No CI reruns were needed.

Thanks @dependabot[bot]. The Ghostty runtime, package version, runtime floors, and cooldown remain unchanged; no release was performed.