[dependabot]

Refresh oxfmt, oxlint, and Playwright, align the Vitest ranges with their locked patch releases, and keep local/CI/release setup on the maintained pnpm 11 line at 11.28.4. Thanks @dependabot for the original formatter/linter update.

The release check uncovered six advisories in implicitly selected Vite test-server dependencies. Declare patched Vite 8.3.5 explicitly so peer resolution cannot select vulnerable 8.3.0–8.3.2 releases. Keep the two-day cooldown, patched Node CI versions, public exports, and pinned Ghostty runtime unchanged.

Validation: independent P0–P3 Codex review is clean. On AWS Crabbox, frozen pnpm 11.28.4 install, pnpm run check:release (140 unit tests, 9 real Ghostty/WASM browser tests, build, portable type checks, lint, formatting, package checks), and pnpm audit --audit-level=low all passed with zero advisories. Exact updated-head multi-platform CI remains required before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates oxfmt from 0.73.0 to 0.74.0 and the locked oxlint version from 1.88.0 to 1.89.0, including their platform bindings.

Example: A contributor installs dependencies with the frozen lockfile and runs pnpm check.

• Before: Formatting uses oxfmt 0.73.0 and linting uses oxlint 1.88.0.
• After: Formatting uses oxfmt 0.74.0 and linting uses oxlint 1.89.0.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused maintenance with consistent dependency snapshots, passing platform checks, and no concrete correctness or security finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored development dependency refresh is outside the ordinary contributor proof gate; existing head-specific CI supports validation without being treated as separate live behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors otherwise retain older formatter and linter releases with upstream fixes available.
Reason: This follows the repository's configured minor-update maintenance policy without adding runtime behavior, public API, or configuration.

Merge readiness

✅ Ready for maintainer review

Keep this PR open for landing: the tooling updates are absent from main, the changes are focused, and no actionable defect was found.

Priority: P3
Reviewed head: 8faffd59c348d971566e693a5c7b1964d8f390f2

Before merge

None.

Findings

None.

Agent review details

How this fits together

These development tools read repository files and produce formatting and lint diagnostics through package scripts; they are separate from the published terminal runtime dependencies.

flowchart LR
  A[Package manifest] --> B[Frozen lockfile]
  B --> C[Platform bindings]
  C --> D[Formatter and linter]
  E[Repository source] --> D
  D --> F[Development checks]

Loading

Technical review

Best possible solution:

Land the focused tooling refresh through the existing dependency maintenance workflow.

Do we have a high-confidence way to reproduce the issue?

This is a dependency maintenance PR without a reported repository bug to reproduce; the version changes are directly verified in the pinned diff.

Is this the best way to solve the issue?

The manifest and lockfile update is the smallest complete refresh, preserves existing runtime and package-manager constraints, and has passing checks for the reviewed head.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 1d80a0d43d30.

Provenance checked

• Formatter and linter dependency versions keeps the original intent (72452c7: The prior merged tooling refresh selected oxfmt 0.73 and oxlint 1.88 while preserving the cooldown and supported Node floors.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff changes only the oxfmt manifest range and the formatter/linter lockfile versions, integrity hashes, and corresponding platform snapshots. (package.json:97, 8faffd59c348)
• Main still uses previous tooling: The base manifest requires oxfmt ^0.73.0 and its lockfile resolves oxfmt 0.73.0 and oxlint 1.88.0; the exact update is not implemented on the reviewed main revision. (pnpm-lock.yaml:33, 1d80a0d43d30)
• Existing maintenance direction: The merged build(deps): refresh tooling and patch source-map-js #108 refreshed the same tools while preserving Node floors and the two-day cooldown; this PR preserves those constraints and pnpm 11.28.2. (package.json:97, 72452c77728f)
• Checks cover the reviewed head: GitHub reports 13 successful checks and two skipped dispatch jobs at the reviewed head, including all seven Node/platform check jobs and browser smoke; the CI workflow installs with the frozen lockfile and runs pnpm check. (.github/workflows/ci.yml, 8faffd59c348)
• Discussion and merge state: The full body and both comments were retrieved; the comments contain review status only, reviews are empty, and GitHub reports the pinned head as mergeable with a clean merge state. (8faffd59c348)
• Repository policy applied: The full root AGENTS.md was read; no scoped ancestor policy, maintainer notes, or pr-simplify skill exists for these root files. No helper, install, build, or test was run, and the checkout remained clean. (AGENTS.md, 8faffd59c348)

Likely related people:

• Peter Steinberger: Raw commit 19206c9 adds package.json:98 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 19206c9629c5; files: package.json)
• Vincent Koc: Raw commit c8ff7e3 adds package.json:85 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: c8ff7e3cc762; files: package.json)

Labels

Label changes:

• add P3: Routine development dependency maintenance with passing checks and no established user-facing runtime defect.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development dependency maintenance with passing checks and no established user-facing runtime defect.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 1:27 PM ET / 17:27 UTC.

[steipete]

Merged as fd1ff8f. PR CI/CodeQL passed, and every post-merge Linux, Windows, Xcode 27, browser-smoke, and CodeQL job passed: https://github.com/openclaw/libterminal/actions/runs/39946129914.

The current-version (0.3.10), no-publication release rehearsal passed: https://github.com/openclaw/libterminal/actions/runs/39946130691. Remote validation also passed the full release check with 140 unit tests and 9 actual Ghostty/WASM browser tests, plus a zero-finding dependency audit. Final independent P0–P3 review was clean.

The first extra audit exposed six existing Vite advisories; explicitly requiring patched Vite 8.3.5 fixed automatic peer selection and the repeated release checks passed. No runtime/API change, release, tag, or package-version bump. The cloud lease is stopped and the task worktree removed; main is clean. The separate Ghostty adoption issue #41 remains under its existing upstream hold.