build(deps): refresh formatter with Node 25 support

[vincentkoc]

What Problem This Solves

Resolves a development-install compatibility problem where the formatter update from #43 also upgraded the bundler to a release that rejects Node 25 under the repository's strict engine checks.

Why This Change Was Made

Updates oxfmt to 0.71 while retaining the established tsdown 0.22 dependency graph. This preserves the declared Node support contract and keeps the formatter refresh.

User Impact

This affects development tooling only. Contributors can continue using every declared Node version, including Node 25, without frozen-install failures.

Evidence

• Node 25.9.0: pnpm install --frozen-lockfile
• Node 25.9.0: pnpm run check
• 9 test files and 58 tests passed
• package build and import validation passed
• git diff --check

Supersedes #43 because its Dependabot branch is not maintainer-editable and the exact-head ClawSweeper review found the Node 25 regression.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vincentkoc]

/allow-dependencies-change

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/36860989867
• Updated: 2026-10-01T12:20:02.992Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 1, 2026, 8:11 AM ET / 12:11 UTC.

ClawSweeper review

What this changes

Updates the development formatter to oxfmt 0.71 and refreshes its locked dependencies while retaining tsdown 0.22.14.

Merge readiness

✅ Ready for maintainer review

This remains a useful, focused formatter refresh that preserves the established Node-compatible build toolchain. No introduced defect was found, and the change is absent from the reviewed main and latest release. The member-authored PR also requires maintainer handling.

Priority: P2
Reviewed head: 29a2c04428847ad7ca219f6413bba06cbf19632b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with compatible engine metadata, reported Node 25 validation, and no actionable patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary external-contributor proof gate does not apply to this member-authored PR. The captured body reports the changed formatter/install path passing on Node 25.9.0; no stored-data or authority boundary changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary external-contributor proof gate does not apply to this member-authored PR. The captured body reports the changed formatter/install path passing on Node 25.9.0; no stored-data or authority boundary changes.
Evidence reviewed	9 items	Pinned introduced change: The complete introduced diff changes only the formatter requirement, its native bindings, and tinypool. The tsdown requirement and dependency graph are unchanged. Existing support contract: The package declares Node ^22.18.0 || >=24.11.0, which includes Node 25. pnpm-workspace.yaml enables strict engine checks. The formatter is development-only, and no public exports, runtime dependencies, or stored-data contracts change. Main and release comparison: The pinned main, also identified by the supplied repository context as v0.1.2, still requires oxfmt ^0.70.0. This formatter refresh is not already implemented there.
Findings	None	None.
Security	None	None.

How this fits together

The development toolchain formats, builds, and validates this standalone TypeScript router. Its dependency engine requirements determine which supported Node versions contributors can use to install and check the package.

flowchart LR
  A[Contributor Node version] --> B[Frozen dependency install]
  C[Package and lockfile] --> B
  B --> D[Engine compatibility checks]
  D --> E[Formatter]
  D --> F[Existing build toolchain]
  E --> G[Package quality checks]
  F --> G

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Root-cause cluster

Relationship: canonical
Canonical: #48
Summary: This is the explicitly proposed narrower landing path for the formatter update; the related proposal additionally updates other tools.

Members:

• partial_overlap: build(deps-dev): bump the development group with 3 updates #43 - Both refresh the formatter, but the broader proposal also changes the linter and bundler.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep the formatter refresh isolated from bundler upgrades so development installs continue to honor the declared Node support range.

Do we have a high-confidence way to reproduce the issue?

Not applicable to a current-main bug: this PR avoids the incompatible bundler upgrade in the related proposal. The author reports successful frozen installation and full validation on Node 25.9.0.

Is this the best way to solve the issue?

Yes. Updating only the formatter and its required dependencies is a narrow way to retain the tooling refresh without changing the established bundler or Node support contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cd289d3d3d30.

Labels

Label changes:

• add P2: This bounded development-tooling update preserves supported contributor installs without changing router runtime behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary external-contributor proof gate does not apply to this member-authored PR. The captured body reports the changed formatter/install path passing on Node 25.9.0; no stored-data or authority boundary changes.

Label justifications:

• P2: This bounded development-tooling update preserves supported contributor installs without changing router runtime behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary external-contributor proof gate does not apply to this member-authored PR. The captured body reports the changed formatter/install path passing on Node 25.9.0; no stored-data or authority boundary changes.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff changes only the formatter requirement, its native bindings, and tinypool. The tsdown requirement and dependency graph are unchanged. (package.json:54, 29a2c0442884)
• Existing support contract: The package declares Node ^22.18.0 || >=24.11.0, which includes Node 25. pnpm-workspace.yaml enables strict engine checks. The formatter is development-only, and no public exports, runtime dependencies, or stored-data contracts change. (package.json:62, 29a2c0442884)
• Main and release comparison: The pinned main, also identified by the supplied repository context as v0.1.2, still requires oxfmt ^0.70.0. This formatter refresh is not already implemented there. (package.json:54, cd289d3d3d30)
• Formatter dependency contract and registry identity: Read-only npm registry metadata for oxfmt 0.71.0 identifies oxc-project/oxc as its source repository, requires Node ^20.19.0 || >=22.12.0, and declares tinypool 2.2.0 plus matching native binding versions. Its published integrity matches the lockfile. The dependency contract is relevant because package.json directly executes oxfmt through the format scripts.
• Transitive dependency compatibility: Read-only npm registry metadata verifies tinypool ownership, Node ^20.0.0 || >=22.0.0 support, and a published integrity matching the lockfile. No install lifecycle hook is declared in the inspected metadata.
• Discussion and reported validation: The captured PR body reports a frozen install and the full package check on Node 25.9.0, including 58 passing tests and package import validation. The member author explicitly approved dependency changes. Supplied checks also show all six Node 22/24 operating-system checks passing; reviewer-side install and build execution was excluded by the read-only contract. (29a2c0442884)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.