fix(deps): update all non-major dependencies (patch)

[shunkakinoki]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	^2.1.215 → ^2.1.217			dependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-darwin-arm64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-darwin-x64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-linux-arm64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-linux-arm64-musl	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-linux-x64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-linux-x64-musl	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-win32-arm64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@​anthropic-ai/claude-code-win32-x64	^2.1.215 → ^2.1.217			optionalDependencies	patch	2.1.220 (+2)
@biomejs/biome (source)	^2.5.4 → ^2.5.5			dependencies	patch	2.5.6
@github/copilot	^1.0.71 → ^1.0.73			dependencies	patch	1.0.75 (+1)
@oh-my-pi/pi-coding-agent (source)	^17.0.5 → ^17.0.7			dependencies	patch	17.0.9 (+1)
@oh-my-pi/pi-natives (source)	^17.0.5 → ^17.0.7			dependencies	patch	17.0.9 (+1)
@openai/codex-darwin-arm64 (source)	0.144.6-darwin-arm64 → 0.144.6			optionalDependencies	patch
@openai/codex-darwin-x64 (source)	0.144.6-darwin-x64 → 0.144.6			optionalDependencies	patch
@openai/codex-linux-arm64 (source)	0.144.6-linux-arm64 → 0.144.6			optionalDependencies	patch
@openai/codex-linux-x64 (source)	0.144.6-linux-x64 → 0.144.6			optionalDependencies	patch
@openai/codex-win32-arm64 (source)	0.144.6-win32-arm64 → 0.144.6			optionalDependencies	patch
@openai/codex-win32-x64 (source)	0.144.6-win32-x64 → 0.144.6			optionalDependencies	patch
@​pencil.dev/cli	^0.2.8 → ^0.2.9			dependencies	patch
@railway/cli (source)	^5.27.0 → ^5.27.2			dependencies	patch
@sentry/cli (source)	^3.6.0 → ^3.6.1			dependencies	patch	3.6.2
agent-browser (source)	^0.32.2 → ^0.32.3			dependencies	patch	0.32.4
ccusage (source)	^20.0.17 → ^20.0.18			dependencies	patch	20.0.19
cline (source)	^3.0.45 → ^3.0.46			dependencies	patch	3.0.47
croniter	>=6.2.3,<7 → >=6.2.4,<7			dependency-groups	patch
deepsec (source)	^2.2.3 → ^2.2.6			dependencies	patch	2.2.9 (+2)
droid (source)	^0.175.0 → ^0.175.1			dependencies	patch
fastapi (changelog)	>=0.139.0 → >=0.139.2			dependency-groups	patch
graphifyy	>=0.9.12 → >=0.9.23			dependency-groups	patch	0.9.29 (+5)
hunkdiff	^0.17.2 → ^0.17.3			dependencies	patch	0.17.7 (+3)
nvitop	>=1.7.0 → >=1.7.1			dependency-groups	patch
renovatebot/github-action	v46.1.18 → v46.1.20			action	patch	v46.1.21
ruff (source, changelog)	>=0.15.20 → >=0.15.22			dependency-groups	patch
transformers	>=5.13.0 → >=5.13.1			dependency-groups	patch
vllm	>=0.25.0 → >=0.25.1			dependency-groups	patch

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.217

Compare Source

• Added emoji shortcode autocomplete in the prompt input: type :heart: to insert ❤️, or :hea for suggestions — disable with the emojiCompletionEnabled setting
• Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
• Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
• Fixed Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically
• Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
• Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and /compact failing once over the limit
• Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
• Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts
• Fixed managed settings that set OTEL_EXPORTER_OTLP_ENDPOINT not governing all signals — lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint
• Fixed --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry
• Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared
• Fixed background shells sometimes becoming impossible to stop after a session is sent to the background (/background or ←) or when the session exits on a heavily loaded machine, most visible on Windows
• Fixed a CLAUDE.md or SKILL.md paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded
• Fixed the transcript preview sitting flush against the input area when attaching to a starting background session; it now leaves the same one-line gap as the live layout, so the transcript no longer shifts when the session takes over
• Improved footer PR badge links to be clickable hyperlinks even when terminal support can't be detected (e.g. over ssh/tmux); set FORCE_HYPERLINK=0 to opt out
• Changed the login-expiry warning to appear 3 days before expiry instead of 5
• Capped the frontend-design plugin suggestion tip at 3 lifetime impressions instead of repeating indefinitely
• Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message can't fan out unbounded background agents
• Changed subagents to no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
• Fixed --max-budget-usd not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted

v2.1.216

Compare Source

• Added sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control
• Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
• Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
• Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
• Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
• Fixed @​-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of c-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
• Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
• Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE
• Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project
• Fixed background sessions whose worktree has no git repository being undeletable
• Fixed claude daemon stop --any potentially terminating an unrelated process via a stale legacy daemon lockfile
• Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks
• Fixed Bash command permission checking for compound statements with redirects inside && lists or negations
• Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died
• Fixed background subagents getting cancelled when a high-priority message arrives during their startup window
• Fixed mouse and focus garbage in the terminal while a GUI editor from /memory, /plan, /keybindings, or Ctrl+G is open; /memory no longer waits for the editor to close
• Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope
• Fixed workflow saves and scheduled-task writes following a symlink at .claude, which could redirect writes outside the project
• Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command
• Fixed read-only commands on Windows accessing network paths without a permission prompt
• Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries
• Fixed PowerShell tool permission validation of commands containing invisible Unicode characters
• Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel
• Fixed the /config settings list in fullscreen mode clipping its keyboard-hint footer
• Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns
• Fixed the Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) emitting invalid # UNIT lines
• Fixed skills and commands changed during a session not appearing in the slash menu until restart
• Fixed plugin skills with a name frontmatter field losing their plugin prefix in slash-command autocomplete
• Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections
• Improved the /fork confirmation to one line with the new session's name, claude attach id, and a note when the copy shares your checkout
• Improved validation of git and gh command arguments in the PowerShell tool
• Improved the /ultrareview diff-too-large error to show configured limits, measured diff size, and largest contributing files
• Improved /code-review ultra empty-diff message to name the exact base ref and suggest passing an explicit base
• Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected
• /context now shows an explicit warning when the conversation exceeds the context window, and a failed /compact displays as an error
• /rewind no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped
• Background sessions: /mcp and /install-github-app now park a "needs input" request in the agent view when no client is attached
• Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts
• [VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code
• Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive

biomejs/biome (@​biomejs/biome)

v2.5.5

Compare Source

Patch Changes

• #​10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

  declare const value: 1n | 2n;
  switch (value) {
    case 1n:
      break;
  }

• #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

  type Recursive = Recursive;
  declare const value: Recursive;
  
  String(value);
  value || "fallback";

• #​10977 0bf7486 Thanks @​ematipico! - Fixed #​10922: the action useSortedAttributes no longer triggers for HTML instructions.

• #​10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

• #​10983 edc0ed7 Thanks @​ayaangazali! - Fixed #​10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

  Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

• #​10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

  - A:HOVER { COLOR: INITIAL; }
  + A:hover { color: initial; }
  - @​KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
  + @​keyframes :GLOBAL KeepFrames { from { color: RED; } }
  - @​CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
  + @​container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

• #​10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

  -a { color: /* before */ /* after */ red !important; }
  +a { color: /* before */ red /* after */ !important; }

• #​10993 b7a9694 Thanks @​denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.

  -.before > /* comment */ .after {}
  +.before /* comment */ > .after {}

  It now also keeps selectors with escaped newlines in attribute values inline when they fit.

  -div
  -  span[foo="bar\
  +div span[foo="bar\
   value"] {}

• #​10978 8ebafe1 Thanks @​ematipico! - Fixed #​10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".

• #​10901 68c10e6 Thanks @​Socialpranker! - Fixed #​10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

  This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.

• #​10936 7df46f5 Thanks @​ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.

• #​10941 f787725 Thanks @​siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.

• #​10969 72d309b Thanks @​ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.

• e62f6b6 Thanks @​ematipico! - Fixed #​10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.

• #​10931 899c60d Thanks @​ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.

• #​10904 ceee4f4 Thanks @​qzwxsaedc! - Fixed #​10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:

  import type Types from "./types";
  
  declare function parse(): Types.Result<string>;
  const result = parse();
  if (!result.success) {
  }

• #​10962 f0a67f2 Thanks @​ematipico! - Biome no longer removes embedded styles and scripts in HTML files.

• #​11000 5039a1e Thanks @​ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.

• #​10957 cf263c4 Thanks @​dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.

• #​10992 4bf9b21 Thanks @​ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

  For example, the following callback is now reported.

  declare function consume(...args: [number, () => void]): void;
  const prefix: [number] = [1];
  
  consume(...prefix, async () => {});

• #​10915 b3b12b3 Thanks @​Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

  The rule provides an unsafe fix that flips the operator.

  // Invalid
  !foo === bar;
  !foo !== bar;
  
  // Valid
  foo !== bar;
  foo === bar;

• #​10970 bd1038b Thanks @​ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:

  declare function consume(kind: "async", callback: () => Promise<void>): void;
  declare function consume(kind: "sync", callback: () => void): void;
  consume("sync", async () => {});

• #​10933 48a4abb Thanks @​ematipico! - Fixed useArrayFind to recognize bigint zero indexes.

• #​10931 899c60d Thanks @​ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.

• #​10969 72d309b Thanks @​ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.

• #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:

  declare const value: unknown;
  
  async function consume() {
    await value;
  }

github/copilot-cli (@​github/copilot)

v1.0.73

Compare Source

• Anthropic subagents continue working when additional directories are configured
• Resolve relative links in custom agent instructions from the agent file location

v1.0.72

Compare Source

• An agentStop hook that always blocks no longer loops indefinitely: the CLI now ends the turn after 8 consecutive blocks, and agentStop hooks receive a stop_hook_active flag so they can detect a forced continuation and self-limit
• Add opt-in git and gh authentication inside the OS sandbox
• Sandbox macOS keychain access now defaults off for tighter isolation; re-enable it in /sandbox if a command needs it
• Lifecycle and subagent hook commands run in the current session directory after /cd
• Deleting an MCP server with /mcp delete stops its running background process
• Toggling /sandbox restarts only local MCP servers and leaves remote servers connected
• Command approvals no longer carry over to another repository after you switch with /cd
• The GitHub tab's Open in web action now reliably launches your browser on Windows
• Preserve pasted prompt content when changing models through Ctrl+X /model
• Corrected the added-line count shown when creating a file so files ending in a trailing newline no longer report one extra line
• /worktree and /move no longer fail to create a worktree for an auto-generated branch name when many similarly-named branches or a leftover worktree directory already exist: the numeric-suffix search is no longer capped at 5 and now skips stale unregistered worktree directories (an explicitly supplied branch name still errors on a collision)
• /worktree no longer intermittently runs the kickoff task in the main repo instead of the new worktree
• /worktree and /move now propagate folder trust to the new worktree before switching when the source is already trusted (avoiding a spurious folder-trust prompt in that case), /move addresses its git stash precisely so a concurrent stash can't misplace changes, and worktree creation skips a leftover directory instead of failing
• Show the exit resume hint for a renamed session with no messages when its workspace is only available as a cached snapshot
• Show a connected message after a slow MCP server eventually connects
• Add update/uninstall verbs to /plugins, let enable/disable/remove target plugins, MCP servers, or skills via --plugin/--mcp/--skill flags or a positional kind, and support installing skills with /plugins install --skill
• Add a /plugins help command plus skill, MCP, and marketplace management for full /plugin parity
• Session exports keep angle brackets intact in inline code and top-level fenced code blocks
• Show MCP server status correctly for names like constructor and proto
• Keep the session highlight on the nearest live row when closing a session, in both the Sessions split view and the standalone Sessions tab
• Pad inline hex color swatches once inside Markdown lists
• Type $ at the prompt to open an interactive shell in the current session directory (enable it with /settings shellShortcut on; off by default)
• Nested markdown lists render correctly in buffered output (-p --stream off and detail screens): sub-bullets are no longer glued onto the parent item's line or flattened, and are indented under their parent
• copilot skill list now strips terminal control characters from skill names and descriptions, so a crafted skill can no longer inject ANSI escape sequences into the listing output.
• Install skills from the CLI with copilot plugins install --skill <file, URL, or directory> (add --scope project to a file or URL install to install into the repository)
• Show default values in /settings and let booleans cycle back to default
• Require SSO for remote control when managed settings demand it
• Mask secret values in /settings show output
• Show hex color codes written as inline code (e.g. #FF0000) as color swatches, and add a renderHexColors setting (on by default) to toggle hex-color swatches
• Add /model --session (-s) to change the model, reasoning effort, or context window for just the current session, leaving global settings unchanged.
• Detect VS Code, Cursor, and Windsurf through parent processes in /terminal-setup
• The Sessions sidebar is now navigable with the keyboard and mouse (arrows open and focus it and move the selection, and Enter or a click switches to a session; press n to spawn a session or x twice to close one from the keyboard); /settings can disable it or stop restoring remembered sessions
• Add --plugin, --mcp, and --skill flags for plugin mutations
• Add skill removal support to copilot plugins remove --skill
• Wrap ask-user and elicitation inputs in the split-pane chat view
• Modified vim keys (Ctrl+K, uppercase J/K) no longer move the selection in tool-permission prompts and other text-input select menus; only unmodified j/k, the arrow keys, and Ctrl+P/Ctrl+N navigate.
• /terminal-setup now refuses to modify a VS Code keybindings.json that contains a JSON syntax error (instead of rewriting it and reporting success), matching its documented invalid-JSON handling.
• Reveal full file paths when expanding compact editing rows
• Make the plan-approval menu deterministic across models
• Keep /add-dir directories visible in the agent context across turns
• Multi-turn subagents are always enabled, so you can send follow-up messages to running agents
• Enable tool search for Claude Haiku 4.5+
• Emoji shortcodes like 🎉 no longer render with a spurious trailing space in printed and PR/issue/gist output
• Deliver scheduled prompts as steering messages when the agent is busy

can1357/oh-my-pi (@​oh-my-pi/pi-coding-agent)

v17.0.7

Compare Source

Fixed

• Fixed Portkey/gateway custom models whose ids start with @ (e.g. @modal/GLM-5-2-FP8) being rewritten to unrelated bundled wire ids (e.g. glm-5-2), which caused 400 responses requiring x-portkey-config or x-portkey-provider.

v17.0.6

Compare Source

• Fixed failed plan-mode exits leaving the session on the restored execution model while plan mode remained active and silently changing ambient xd:// tool presentation; rollback now restores the plan model, thinking level, and exact top-level-versus-mounted tool partition so exit can be retried safely (#​6013).

Added

• Added native Warp CLI-agent events for rich session status, tool approvals, and completion notifications (#​5592 by @​metaphorics).
• Added Codex (ChatGPT subscription) support to generate_image. The tool now resolves a connected openai-codex OAuth credential and drives OpenAI's hosted image_generation tool through the ChatGPT backend (chatgpt.com/backend-api/codex/responses, chatgpt-account-id header) independent of the active chat model — so image generation works on a ChatGPT/Codex subscription with no metered OPENAI_API_KEY, even when the active model is Claude/Gemini/etc. A new providers.image: "openai-codex" option forces it; auto now auto-detects a connected subscription (priority: active GPT image tool > Codex subscription > Antigravity > xAI > OpenRouter > Gemini), and the openai preference falls back to it when no OPENAI_API_KEY/active GPT model is present.
• Added an optional provider parameter to generate_image (auto | openai | openai-codex | antigravity | xai | gemini | openrouter) that overrides the providers.image setting for a single request — so "generate this using gemini / codex / xai" routes per-call without changing the global setting. Absent → the providers.image setting applies, unchanged; the named provider uses the same resolution semantics (falls back to auto-detect if it has no credentials). File: tools/image-gen.ts (imageProviderSchema, findImageApiKey preference arg).
• Added OpenTelemetry log and metric export alongside the existing trace export. When OTEL_EXPORTER_OTLP_LOGS_ENDPOINT (or the shared OTEL_EXPORTER_OTLP_ENDPOINT) is set, omp registers a LoggerProvider and forwards every centralized-logger event as an OTLP log record (severity + attributes + active span context for log↔trace correlation, min level via OTEL_LOG_LEVEL, plus a structured agent run completed summary event). When OTEL_EXPORTER_OTLP_METRICS_ENDPOINT (or the shared endpoint) is set, it registers a MeterProvider with a PeriodicExportingMetricReader and records GenAI-semconv gen_ai.client.token.usage plus pi.omp.agent.* counters/histograms (runs, steps, chat/tool calls by name+status+finish reason, latencies, estimated cost, errors) from the agent run summary and per-chat usage hooks. Each signal honors its own OTEL_*_EXPORTER=none kill switch, the global OTEL_SDK_DISABLED, and declines non-http/protobuf protocols independently (#​4604).
• retry.fallbackChains wildcards now support id-prefixed targets and keys: a chain entry like "openrouter/google/*" re-prefixes the failing model's bare id (google-antigravity/gemini-x → openrouter/google/gemini-x), a plain "provider/*" entry falling back from an aggregator strips the vendor prefix when the target provider only knows the bare id (openrouter/google/x → google-vertex/x), and an id-prefixed key ("openrouter/google/*") scopes a chain to that provider's ids under the prefix.
• The session tree selector (/tree, /branch) now supports Shift+Enter to summarize-and-switch in one step: it forks from the selected entry with a branch summary, with no extra prompt and regardless of branchSummary.enabled. Plain Enter keeps the current behavior (direct switch by default; the summary prompt only when branchSummary.enabled is on). (#​5152)
• Added the turn's local timestamp (YYYY-MM-DD HH:mm:ss, down to the second) to the per-turn token-usage row shown under assistant messages when display.showTokenUsage is enabled.

Changed

• Reduced concurrent subagent update CPU by reconstructing recent output only at progress emission boundaries. (#​5936)
• Fixed docs/advisor-watchdog.md overstating advisor delivery for a normal yield: the severity table listed concern as unconditionally interrupting and the prose promised a self-ended run could always be steered/resumed. Documented the #​4840 terminal-answer exception (concern becomes a passive card while blocker normally steers, #​5628) plus the plan-mode and deferred-ACP constraints that preserve would-be steers until the user resumes (#​5913).
• Fixed subagent (task) sessions triggering an unnecessary tiny-model session-title generation call on todo init. Subagent sessions in a non-interactive host (print/RPC/ACP/eval/SDK/CI) have no operator-visible title and now skip the replan title refresh; interactive hosts keep it, since a live subagent focused from the Agent Hub renders its session name in the status line (#​5910).
• Fixed tab.scroll() timing out after a queued wheel event waits too long for a busy renderer's acknowledgement (#​5905).
• Made the hashline seen-line guard opt-in and off by default (see edit.enforceSeenLines), and stopped excluding column-clipped (>512-char) lines from a snapshot's seen set: a displayed line now counts as seen even when its display was column-truncated, so single-line edits on long lines found via read/grep apply without a separate full-width re-read.
• Changed the default astGrep.enabled setting to false
• Batched todo operations with real tool calls to prevent solo todo turns and extra round trips
• Changed every bundled TTSR rule to warn without interrupting generation.
• Renamed the system prompt's project-context section wrapper from <context> to <repo-rules> to stop it colliding with the task tool's context parameter under in-band XML tool dialects: models were closing <parameter name="context"> with a stray </context> (primed by the ambient section tag) and emitting sibling params as bare <tasks> elements, so tasks arrived missing.
• Rendered read xd:// calls in the compact grouped read view instead of a full tool-execution card; other internal URLs (skill://, agent://, …) still render full so their resolved content stays visible.

Fixed

• Fixed the interactive !/!! shell shortcut spawning fish as a login shell (fish -l -c …), which fired status is-login blocks in user config (agent/keychain setup, PATH mutation) on every command. fish is now started with -i instead — interactive shells source the same config.fish/conf.d files (so aliases and functions from #​1816 keep working) without login-shell side effects. zsh behavior (-l -i) is unchanged.
• Fixed the status-line tok/s badge ignoring vibe worker sessions: in /vibe mode the director is often idle while workers stream, so the badge showed a stale/zero rate while parallel work was actively generating tokens. The rate now aggregates the main session's live tok/s with every live vibe worker's tok/s, and falls back to the main session's own cached rate when no workers are streaming.
• Fixed plan.defaultOnStartup being ignored by headless omp -p sessions, so the initial prompt now runs in plan mode and the persisted session remains in plan mode for later review (#​6017).
• Fixed resuming an active plan session replacing its journal-restored model with the current modelRoles.plan setting (#​6015).
• Fixed --model <role> resolving a bare configured modelRoles key.
• Browser tool selectors now accept bare snapshot refs (tab.click("e501"), @e501) everywhere aria-ref=e501 works — previously the tab-worker backend fell through to a CSS tag selector that could never match, burning the 2s zero-match watchdog with a misleading "matches no elements" hint. tab.select, tab.uploadFile, tab.press({ selector }), tab.screenshot({ selector }), and tab.drag now resolve refs too. Unknown/stale refs fail immediately with the "refresh refs" error.
• tab.select no longer double-reports the previously selected option of a single <select>: the returned selection is read back after the full assignment pass instead of mid-loop.
• Fixed transcript blocks being visibly duplicated during streaming (whole tool boxes and assistant paragraphs recommitted below their first copy on the terminal tape) by removing transcript committed-prefix compaction entirely. Dropping committed rows from the transcript's local frame shifted the frame under the engine's committed-prefix ledger, so the audit re-anchored and recommitted rows the tape already held. The transcript now always keeps its full local frame; committed finalized blocks still skip render() via the segment reuse bypass. Reverts the compaction half of #​5930's fix (compose keeps the render bypass; the local frame is no longer truncated).
• Fixed tmux pane growth during a live response blanking finalized chat history re-exposed from native scrollback by rebasing the in-place repaint's commit seam to the resized viewport tail (#​6011).
• Fixed classifier refusals (e.g. Anthropic stop_reason: "refusal") ending the turn with no visible error. Two independent regressions: (1) session events reached subscribers out of order when a turn's provider events landed in one tick — extension emits only await for event types with registered handlers, so the assistant message_end overtook its own message_start and the TUI skipped the error render entirely (no pinned banner, no inline Error: line); subscriber fan-out is now serialized in emission order. (2) Refusal turns are pruned from active context at settle (#​3591), which also erased them from state.messages before prompt() resolved — print mode printed nothing and exited 0, and the task executor's getLastAssistantMessage() saw the previous turn. The pruned refusal is now retained until the next run starts, getLastAssistantMessage() reports it, and print mode reads the settled assistant via that accessor (exit 1 + refusal message on stderr). Additionally, #lastAssistantMessage is now set synchronously on message_end to prevent agent_end maintenance from reading a stale assistant turn when tool results and stops land in the same tick.
• Fixed before_provider_request extension contexts exposing the primary session model for cross-provider Advisor requests instead of the request model (#​6006).
• Fixed isolated task subagents mutating the parent checkout and stacking parallel task branches. Copy isolation backends (reflink/apfs/btrfs/zfs/block-clone/rcopy) materialise the worktree by duplicating its .git verbatim; when the parent is a linked git worktree its `.g

✂ Note

PR body was truncated to here.

[indent-zero]

PR Summary

Automated Renovate PR that bumps several non-major dependencies across pyproject.toml, package.json (with cascading bun.lock updates), and the Renovate GitHub Action. The @openai/codex-* regression flagged previously is still present in this force push — those six optionalDependencies entries continue to point at npm:@openai/codex@0.144.6 without the required -<platform> suffix.

• Bumps renovatebot/github-action from v46.1.18 to v46.1.20 in .github/workflows/renovate.yml
• Bumps npm dependencies in package.json: @anthropic-ai/claude-code (2.1.215 → 2.1.217), @biomejs/biome (2.5.4 → 2.5.5), @github/copilot (1.0.71 → 1.0.73), @oh-my-pi/pi-coding-agent and pi-natives (17.0.5 → 17.0.7), @pencil.dev/cli (0.2.8 → 0.2.9), @railway/cli (5.27.0 → 5.27.2), @sentry/cli (3.6.0 → 3.6.1), agent-browser (0.32.2 → 0.32.3), ccusage (20.0.17 → 20.0.18), cline (3.0.45 → 3.0.46), deepsec (2.2.3 → 2.2.6), droid (0.175.0 → 0.175.1), hunkdiff (0.17.2 → 0.17.3)
• Bumps the eight @anthropic-ai/claude-code-* platform variants in optionalDependencies to 2.1.217
• Still rewrites the six @openai/codex-* aliases in optionalDependencies from npm:@openai/codex@0.144.6-<triple> to npm:@openai/codex@0.144.6 (see reported issue — regresses PR fix(codex): install real native binary for aliased optional deps #1982)
• Bumps graphifyy (0.9.12 → 0.9.23), nvitop (1.7.0 → 1.7.1), ruff (0.15.20 → 0.15.22), transformers (5.13.0 → 5.13.1), and vllm (0.25.0 → 0.25.1) in the tools group of pyproject.toml
• Bumps croniter (6.2.3 → 6.2.4, keeping the <7 upper bound) and fastapi[standard] (0.139.0 → 0.139.2) in the hermes group of pyproject.toml

Issues

1 potential issue found:

• Renovate dropped the -<platform> suffix from every @openai/codex-* alias in package.json (e.g. npm:@openai/codex@0.144.6-darwin-arm64 → npm:@openai/codex@0.144.6), regressing the explicit fix from PR fix(codex): install real native binary for aliased optional deps #1982 ("fix(codex): install real native binary for aliased optional deps"). Re-pin the suffixed versions (or add a Renovate packageRules entry to freeze the shape) so bun install resolves the native binary tarball instead of the generic JS wrapper. → Autofix

CI Checks

All CI checks passing on SHA 8a4647a.

---

[mesa-dot-dev]

You do not have enough credits to review this pull request. Please purchase more credits to continue.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates JavaScript and Python dependency versions, retargets Codex platform aliases to the base package, and advances the Renovate GitHub Action from v46.1.18 to v46.1.20.

Changes

Dependency maintenance

Layer / File(s)	Summary
Package and Python dependency updates package.json, pyproject.toml	Selected JavaScript and Python dependency constraints are updated, and Codex platform aliases now target @openai/codex@0.144.6.
Renovate action update .github/workflows/renovate.yml	The Renovate job now uses renovatebot/github-action@v46.1.20.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• shunkakinoki/dotfiles#1955: Updates the Renovate action and related dependency versions.
• shunkakinoki/dotfiles#1916: Updates the same Codex optional dependency mappings.
• shunkakinoki/dotfiles#2125: Changes the same Codex platform alias targets.

Poem

A bunny checks each version pin,
Fresh dependency carrots spin.
Codex hops on one base track,
Renovate gets a newer pack.
All the updates settle in!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main change: non-major dependency updates across package, Python, and workflow files.
Description check	✅ Passed	The description is directly about the dependency update set and its release notes, so it matches the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/patch-all-minor-patch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates several dependency versions in pyproject.toml, including graphifyy, mistral-vibe, nvitop, ruff, transformers, and croniter. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[indent-zero]

Regression of PR #1982 codex fix. Commit 080e9d6 explicitly changed these six pins from npm:@openai/codex@<ver> to npm:@openai/codex@<ver>-<triple> because "a bare <base>@<ver> pin (no suffix) silently reinstalls the generic JS wrapper under the platform dir name -- no binary -- and the CLI dies with 'Missing optional dependency @openai/codex-darwin-arm64'" (see home-manager/modules/npm-globals/install-npm-globals.sh lines 417-440, which document the same requirement). Renovate here has stripped every -darwin-arm64 / -linux-x64 / etc. suffix, reverting to the exact shape that PR #1982 was fixing.

The shell installer still defensively reconstructs the suffixed spec at install time, so this may not break in production CI/deploys, but:

1. It undoes an explicit fix and re-introduces the exact bug someone will hit if they run plain bun install without the postinstall script.
2. Every deploy now installs the wrong wrapper first, then the shell script tears it down and reinstalls the correct suffixed tarball — wasted work on every run.

Suggested fixes: keep the suffixed pins (e.g. npm:@openai/codex@0.144.6-darwin-arm64), or add a packageRules entry in renovate.json that matches @openai/codex-* and either disables updates or preserves the current alias shape.

Suggested change

	"@openai/codex-darwin-arm64": "npm:@openai/codex@0.144.6",
	"@openai/codex-darwin-arm64": "npm:@openai/codex@0.144.6-darwin-arm64",
	"@openai/codex-darwin-x64": "npm:@openai/codex@0.144.6-darwin-x64",
	"@openai/codex-linux-arm64": "npm:@openai/codex@0.144.6-linux-arm64",
	"@openai/codex-linux-x64": "npm:@openai/codex@0.144.6-linux-x64",
	"@openai/codex-win32-arm64": "npm:@openai/codex@0.144.6-win32-arm64",
	"@openai/codex-win32-x64": "npm:@openai/codex@0.144.6-win32-x64"

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/renovate.yml (1)

17-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the Renovate action to an immutable commit.

This update still references a mutable tag. GitHub recommends full-length commit-SHA pinning because tags can be moved or deleted. (docs.github.com)

Proposed hardening

-        uses: renovatebot/github-action@v46.1.19
+        uses: renovatebot/github-action@<full-40-character-commit-sha> # v46.1.19

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/renovate.yml at line 17, Update the Renovate workflow’s
uses reference to pin renovatebot/github-action at the full 40-character commit
SHA corresponding to the intended v46.1.19 release, rather than the mutable
version tag, while preserving the existing action configuration.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/renovate.yml:
- Line 17: Update the Renovate workflow’s uses reference to pin
renovatebot/github-action at the full 40-character commit SHA corresponding to
the intended v46.1.19 release, rather than the mutable version tag, while
preserving the existing action configuration.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e9d65e0b-e970-4c68-95ef-58f6e81430d9

📥 Commits

Reviewing files that changed from the base of the PR and between 6a3a24a and b8eb382.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/renovate.yml
• package.json
• pyproject.toml

[mesa-dot-dev]

Mesa Description

TL;DR

Updates non-major and patch-level dependencies across GitHub Actions, Python, and npm/Bun environments to their latest versions.

What changed?

• .github/workflows/renovate.yml: Upgraded renovatebot/github-action from v46.1.18 to v46.1.20.
• pyproject.toml: Bumped Python package and tooling requirements, including graphifyy, nvitop, ruff, transformers, vllm, croniter, and fastapi.
• package.json: Updated various npm dependencies (such as @anthropic-ai/claude-code, @github/copilot, @oh-my-pi/pi-coding-agent, cline, and droid) and platform-specific optional dependency aliases for @openai/codex.
• bun.lock: Regenerated lockfile to update and resolve the exact dependency versions.

^{Description generated by Mesa. Update settings}