[trotterdylan]

Replaces #41, Dependabot's grouped npm update. It keeps Dependabot's commit and adds what it took to get CI green.

Runtime changes in deployed plugins (what bb-server installs with npm ci --omit=dev --legacy-peer-deps):

• zod 4.6.5 → 4.6.7, and @radix-ui/react-slot → 1.5.0.
• stewards: its runtime @get-bb/plugin-sdk moves 0.6.15 → 0.6.37, to match the SDK bundled in bb at BB_REF.
• stewards: its production install shrinks from about 70 packages to 19. Main's stewards lock marked about 37 dev-only packages (better-sqlite3, hono, react, cron-parser, …) as production, so bb-server was installing them by accident. Nothing at runtime needed them: stewards imports better-sqlite3 for types only, and its UI gets react from bb's host, the same as every other deployed plugin.

Everything else is dev tooling: TypeScript 7, vitest 5, better-sqlite3 13 (tests only), @types/node 26, and others.

What it needed on top:

• vitest 5 requires vite as a peer. CI installs with --legacy-peer-deps, so every vitest plugin now declares vite ^8.3.4. workstreams imports esbuild, which used to arrive through vite, so it declares that too.
• TypeScript 7 has no JS compiler API. The html-preview and image-copy tests now transpile with esbuild.transform. diff-explorer's tests walk the TS AST, so it stays on TypeScript 5.9.3 (it isn't deployed).
• @get-bb/plugin-sdk stays at 0.6.37. That's the SDK bundled in the bb that bb-server runs (BB_REF=desktop-v0.46.0). Dependabot's 0.6.52 would typecheck against APIs live servers don't have. workstreams stays on 0.5.9 because it uses APIs later SDKs removed. dependabot.yml now ignores the SDK, which should move by hand with BB_REF.
• stewards: one ?? chain reshaped that TypeScript 7 reports as always nullish (TS2871). Same lazy evaluation as before.
• workstreams: @typesafe-ai/sdk 0.7 reports token counts as nullable, so they're coerced to 0.

Tested locally: typecheck and tests pass in all 13 plugins, and npm ci --omit=dev succeeds for the 7 deployed plugins.

Lane: owner-reviewed (new dependencies: vite, esbuild).

Merging moves the bb-plugins pin, builds a new bb-server image and stages a restart on every developer's server.

🤖 Generated with Claude Code

— from bb thread thr_ypm3k9grni

[trotterdylan]

Independent review running in bb thread @thread:thr_yfjbecp749.

— from bb thread thr_ypm3k9grni

[trotterdylan]

Review round 1 (GLM 5.3, at fb4e55b)

Owner review required: yes — new dependencies (vite, esbuild in the vitest/test toolchain), and the dependabot.yml policy change for @get-bb/plugin-sdk. @trotterdylan, this one needs your approval.

Blockers

1. PR body (runtime-changes line) — "Runtime changes in deployed plugins (only these reach bb-server …): zod …, @radix-ui/react-slot …" is incomplete. Two more things reach bb-server for stewards:
   • its runtime @get-bb/plugin-sdk moves 0.6.15 → 0.6.37 (its declared dependencies; correct and required to match BB_REF, but it is a runtime dependency change, not "dev tooling");
   • its npm ci --omit=dev install shrinks from ~70 to 19 packages — main's stewards lock had ~37 dev-only packages un-flagged as prod, so bb-server was accidentally installing better-sqlite3@12, hono, react, cron-parser, … into production. The regenerated lock fixes that (all runtime imports still resolve: zod/yaml/SDK from the plugin's own tree, react/better-sqlite3 from bb's bundled runtime, same as every other deployed plugin) — but the owner is approving this line, so it must say so. Also note installed zod moves 4.6.5 → 4.6.7 (specs moved ^4.3.6 → ^4.6.7). Please correct the body; no code change needed.

Suggestions

• plugins/stewards/package.json keeps "zod": "^4.3.6" while every other plugin moved its spec to ^4.6.7 (the lock already resolves 4.6.7, so behavior is identical). Align it for consistency, or the next Dependabot run will churn the spec alone.
• npm ci --omit=dev without --legacy-peer-deps now fails in the deployed plugins (SDK 0.6.37's peerOptional @types/better-sqlite3@^7.6.12 vs the bumped devDep @types/better-sqlite3@^9.6.0); it passed on main. Not blocking because every real install path passes the flag — bb-server's Dockerfile (npm ci --omit=dev --legacy-peer-deps) and CI both do — but worth knowing the unflagged command regressed.

Checked

• Ran: npm install --include=dev --legacy-peer-deps + typecheck + test in plugins/linear, plugins/multi-repo, plugins/repo-dashboard (pass; not in the CI matrix — the plugins workflow covers only the other 9). Ran diff-explorer's full suite per the repo AGENTS.md: node scripts/check-dependencies.mjs, pnpm install --frozen-lockfile, typecheck, test (pass — the Check dependency pins failure at be84d7d is resolved by the fb4e55b lock refresh; CI is 20/20 green).
• Ran: npm ci --omit=dev --legacy-peer-deps (bb-server's exact install command, docker/bb-server/Dockerfile) for all seven deployed plugins, at fb4e55b and at main, and diffed the installed production trees: the only runtime changes are zod 4.6.5 → 4.6.7, @radix-ui/react-slot → 1.5.0, and the stewards items in the blocker above (SDK 0.6.15 → 0.6.37; accidental devDep installs gone).
• Verified against ticket: bb at BB_REF=desktop-v0.46.0 bundles @get-bb/plugin-sdk 0.6.37 — every plugin's pin matches (workstreams deliberately stays 0.5.9, dev-only and not deployed). SDK remains a runtime dependency where main had it (stewards, multi-repo). All 13 plugins typecheck and test green (9 by CI, diff-explorer by CI + locally, 3 by me).

— from bb thread thr_yfjbecp749

[trotterdylan]

Round 1 response, head now a507a47:

• Blocker (PR body runtime line): fixed. The body now lists stewards' runtime SDK move 0.6.15 → 0.6.37 and the production-install shrink. I checked that the shrink is safe: better-sqlite3 is import type only (store.ts), and react is only used by the app.tsx UI, which bb's host supplies, as it does for linear and github-watcher.
• Suggestion (stewards zod spec): taken in a507a47, now ^4.6.7. The lock already resolved 4.6.7, and stewards' 224 tests pass.
• Suggestion (npm ci --omit=dev without --legacy-peer-deps): declined for this PR. Every real install path (the bb-server Dockerfile and CI) passes the flag. The conflict is the pinned SDK 0.6.37's optional peer @types/better-sqlite3@^7, and it goes away when the SDK moves with BB_REF.

— from bb thread thr_ypm3k9grni

[trotterdylan]

Review round 2 (GLM 5.3, at a507a47)

Owner review required: yes — new dependencies (vite, esbuild in the vitest/test toolchain), and the dependabot.yml policy change for @get-bb/plugin-sdk. @trotterdylan, this one needs your approval; from my side it is ready.

Resolved since round 1

• Blocker 1 (PR body's runtime-changes line): resolved — the body now lists zod 4.6.5 → 4.6.7, @radix-ui/react-slot → 1.5.0, stewards' runtime SDK move 0.6.15 → 0.6.37, and the production-install shrink with its cause. I verified its new claim too: stewards' only better-sqlite3 import is import type Database in store.ts — types only, erased at compile; react comes from bb's host like every other deployed plugin.
• Suggestion (stewards zod spec): adopted at a507a47 (^4.6.7); the lock's resolved set is unchanged, so the production install is byte-identical.
• Suggestion (unflagged npm ci --omit=dev ERESOLVE): not adopted, as expected — informational only; every install path (bb-server Dockerfile, CI) passes --legacy-peer-deps.

Checked

• Ran: fb4e55b → a507a47 touches only the stewards zod spec in package.json and the matching lock root line — no behavior change. Re-ran npm ci --omit=dev --legacy-peer-deps (lock still zod 4.6.7, SDK 0.6.37), typecheck and tests in plugins/stewards locally: pass.
• CI: 20/20 green at a507a47.
• Round 1's checks stand for the rest: 13/13 plugins typecheck and test green (linear, multi-repo, repo-dashboard and diff-explorer run by me, not in the CI matrix), the seven deployed plugins install with bb-server's exact command, production trees change only by the bumps now listed in the body, and the @get-bb/plugin-sdk 0.6.37 pin matches what bb at BB_REF=desktop-v0.46.0 bundles.

— from bb thread thr_yfjbecp749

[trotterdylan]

LGTM

[trotterdylan]

Merging: owner-reviewed lane. Approved at a507a47 by the reviewer (round 2) and the owner (LGTM); checks are green on that head, which is unchanged.

This moves the bb-plugins pin, builds a new bb-server image and stages a restart for every developer's server (Restart now, or the 03:00–05:00 ET quiet window).

— from bb thread thr_ypm3k9grni