Keep real socket event ordering and activity publication while replacing timing guesses with response barriers and fixture readiness.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Refresh OpenAI 7.20.0, Pi TUI 0.86.1, tsx 4.23.15, native TypeScript 7.1.0-dev.20260920.1, Tauri 2.11.6, single-instance 2.4.5, rand 0.10.3, and SimSlim 0.10.0 under the fixed 2026-09-20T18:25:54Z cutoff. Align companion manifests, native locks, Docker tooling, and SimSlim qualification. Preserve existing patches, overrides, the updater fork, and compatibility holds.
Validation includes 303 npm consumer cases, 148 Rust core cases, 63 desktop cases, 86 SimSlim cases, actual Linux container and SDK transport proof, four typecheck lanes, 102 npm lock mirrors, and cutoff/integrity audits. Synthetic terminal comparisons are attached to the PR and verified rendered. Independent reviews are clean through P2.
Land under explicit maintainer approval for proven pre-existing CI failures. Run 36376168824 exposed three unchanged Windows checkout-fixture inventory failures already repaired on main by #160024 (b9cd492ac6). The dependency delta does not touch that workflow/helper/test closure. No green full-CI result is claimed. No third-party PR, release, or deployment.
* chore(deps): refresh dependencies with a seven-day cutoff
* fix(deps): preserve Teams and jsdom integration contracts
Use the Teams SDK public token and processing APIs while keeping SSO sender
checks ahead of native token operations. Remove obsolete ambient declarations
and route workarounds, and cover the SDK routing with real processing tests.
Adapt the test environment to jsdom private-field bindings, preserve file bytes
and registry cleanup, and preload it through native Node and Bun workers.
* fix(test): preserve jsdom window and fixture contracts
* fix(ci): keep typecheck cache reuse within matching inputs
* chore(deps): refresh dependencies with seven-day cutoff
Advance eligible runtime, native, release, and development dependencies published by 2026-09-14T07:00:00Z. Preserve compatibility holds and existing reviewed newer pins. Synchronize release integrity checks and scoped overrides; remove the superseded mailparser override.
Preserve Clack cancellation inference with its precise sentinel type and isolate the Vertex proxy fixture from ambient credentials. Timestamp and checksum audits, targeted consumers, native builds/tests, and independent review validate the refresh; required hosted CI remains the landing gate.
* fix(deps): preserve Clack cancellation types in exported prompts
Give styled configure prompts the exact upstream return types so plugin SDK declaration emission can name the new cancellation sentinel. Runtime behavior and generic option values are unchanged.
* fix(deps): preserve release tooling and Android test contracts
Regenerate Ruby lock metadata with pinned Bundler 2.6.9, grant Robolectric 4.17 its documented module access only in Android test JVMs, and keep the precise cancellation type without growing an over-cap source file.
Both previously failing Ruby lock guards, the line-cap and core type checks, all three configured Android test-task JVM arguments, and the actual Robolectric interceptor before/after probe pass. Independent review found no actionable P0/P1 issues.
* fix(deps): close Rustls advisory and align mock session clocks
Rustls 0.23.45 has now completed the seven-day cooldown; update only the shared crate pin and lock to the existing security-fixed desktop version.
Advance accepted mock Gateway writes on the synthetic fixture timeline and correlate permission tests with the actual mutation and refresh. This repairs a reproduced CI fixture race without changing production behavior or weakening assertions.
Validation: 36 Rust gateway-client tests including four TLS handshakes, 50 fixture tests, nine browser cases, scoped changed checks, and independent P0/P1 review passed.
* test(ui): keep external session updates on the committed timeline
* test: stabilize approval and desktop CI fixtures
* build(workboard): refresh assets after dependency rebase
Adds the bounded authenticated sidecar bridge on the merged Rust node runtime. The unique sidecar delta passed focused Rust and process proof, and exact-head ClawSweeper review found no actionable code or security issue.
Adds the bounded embeddable Rust node lifecycle on the merged shared-client foundation. The unique runtime delta passed focused Rust gates and exact-head ClawSweeper review found no actionable code or security issue.
Adds the unpublished shared Gateway client and bounded node-host foundation, with Linux Tauri as the first consumer. Exact-head CI and ClawSweeper review are clean.
