chore(deps): refresh patches after dependency upgrades

[me2seeks]

Summary

Supersedes Dependabot PR #5833. Its dependency upgrades leave the repository's local patch files targeting older package versions, which makes clean installs fail.

• Regenerates the four affected dependency patches and updates package-version, license, and notice references.
• Pins undici 7.29.1 under @jackwener/opencli@1.8.8 to address GHSA-3wwx-pv8p-q78v: GHSA-3wwx-pv8p-q78v.
• Updates the install-script allowlist for the upgraded packages.

Verification

Passed: npm ci (including patch application), npm run build, npm run check:release (211 passed, 1 skipped), npm run lint, npm run format:check, npm run typecheck, npm audit signatures, and the shipped-dependency audit (0 moderate-or-higher advisories).

The local full workspace integration run is not green in this sandbox. A focused ACP startup failure reproduces because temporary test workspaces are created below /tmp, where this environment has an invalid /tmp/.git; workspace identity detection then invokes Git and fails before the test reaches the changed dependencies. The original broader run also had Host/Desktop timeouts. Hosted CI on a clean runner is still required.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex regenerated the dependency patches, updated the transitive security override and notices, and ran the listed validation.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[hqhq1025]

The dependency refresh and regenerated patches install and build successfully, but the required test check is failing on the Astryx surface inventory. I found one blocking issue; the remaining focused patch/integration checks passed. The macOS ZIP behavior was not exercised locally (hosted macOS packaging succeeded). This is not a merge approval.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[jackwener]

Reviewed head d0960b78a4557f51ce1181b6154701943757ed28, which supersedes #5833. Clean install now works (package, package-linux, windows_recovery and audit are green). test is still red, so this is not ready yet.

Blocker (P1, mechanical): test stops at the Astryx surface-inventory check. It fails with "astryx surface inventory is stale; run: npm run astryx:surface-inventory:write": docs/astryx-surface-file-inventory.md records the @astryxdesign/core version it was generated against, and that version is now 0.6.3. The job ends there, so the UI, Desktop and Storybook suites have not run on this head. That matters because of the next point.

The @astryxdesign/core patch is a real re-port, not a re-anchor. pi-tui, @modelcontextprotocol/client and app-builder-lib only move context lines; their added lines are unchanged. The Astryx patch's added lines differ substantively, because upstream 0.6.3 reworked the Markdown path (parseMarkdown → parseMarkdownAst, new countBlockTextLength / countInlineTextLength helpers, a parsedText === '' early return). The behaviors in patches/README.md need their guarding tests and stories to pass on this head before merging: the tokenizer caching only valid languages, CodeBlock geometry, the composer layout-effect sync, and the host-owned trigger and anchor state. In particular that means the app-shell submission stories and the 1,200-line CodeBlock geometry run.

Other checks:

• overrides["@jackwener/opencli@1.8.8"].undici = "7.29.1" clears GHSA-3wwx-pv8p-q78v; the shipped-dependency audit is green.
• The install-script allowlist moves to esbuild@0.28.2 and @jackwener/opencli@1.8.8, and LICENSE and the notices follow the new versions.

P3: in app-builder-lib 26.17.0, the Maka hunk that forces the system zip for macOS update ZIPs now sits after upstream's new storedPaths is not supported with the native zip fallback guard, so a mac ZIP with storedPaths would bypass that guard. Today only the NSIS target sets storedPaths, so nothing is affected. Moving the Maka override above the guard would keep it fail-closed if a mac caller ever appears.

Not run locally.

[hqhq1025]

The prior Astryx inventory failure is fixed: the committed inventory now names core 0.6.3 and the generator check passes. This revision also regenerates the theme artifacts and adjusts the Astryx Spinner and macOS archive patches. A clean install, test build, focused patch/inventory tests, theme check, notices, and license checks pass locally; I found no substantiated P0–P3 issue in the reviewed paths. The current-head hosted test job is still running, so this is not a readiness or merge approval. I did not exercise the macOS ZIP path or a packaged Desktop locally.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[jackwener]

Approving at ff72d4a00135ba00dacbcbb4b50dd05bf658606e: every hosted check is green, including the full test job, so the UI, Desktop and Storybook suites guarding the re-ported Astryx patch now pass.

• 078bc9b3b regenerates the surface inventory (@astryxdesign/core@0.6.3) and the generated theme headers. The 0.6.3 theme builder also emits a :scope { font-family: var(--font-family-body) } rule.
• ff72d4a00 completes the Astryx re-port. The spinner re-pin now follows 0.6.3's rotation host: it listens on the host span, filters to its own animationstart, and ships the matching keyframes. It also closes my P3: the Maka override in app-builder-lib now runs before upstream's storedPaths native-zip guard, so that guard stays fail-closed.
• As reviewed in #5839 (review): the pi-tui, MCP client and app-builder-lib patches keep their added lines, the undici 7.29.1 override clears GHSA-3wwx-pv8p-q78v, and the allowlist and notices follow the new versions.

Not run locally.

[Astro-Han]

Reviewed exact head ff72d4a00135ba00dacbcbb4b50dd05bf658606e as a second reviewer, focusing on the patch set and the lockfile.

All 14 patches apply to the locked versions. The build passes and the notices are consistent. The pi-tui, MCP client, app-builder-lib and Astryx Markdown patches keep their original intent. The lockfile adds no new install scripts or license changes. The two major bumps (tinyclip, obug) and the new verkit come in via astro, which only the website uses. undici 7.29.1 is the fixed version for GHSA-3wwx-pv8p-q78v.

P2: the Spinner re-port stacks two animations (inline on patches/@astryxdesign+core+0.6.3.patch). Astryx 0.6.3 no longer rotates the spinner. It now animates the arc's stroke-dashoffset (x1nlxm0d → x1wbvqyn-B, linear) and dropped the rotate keyframes. The patch re-adds a rotate keyframe (xqng64z-B) and a steps(16) rotation on the host span, but it leaves upstream's dash animation on the circle.

• In headless Chromium, the patched spinner reports two concurrent 0.73s animations: the host rotating in steps and the circle's dash moving linearly. The arc travels about two turns per cycle and mixes stepped with smooth motion.
• The patch's stated goal is to avoid per-frame SVG repaint on the main thread. The linear dash-offset animation still repaints every frame, so that goal is lost.
• The story in packages/ui/stories/functional-motion.stories.tsx still passes, because svg.getAnimations() without {subtree: true} doesn't see the circle's animation.
• repin only re-pins the host animation.
• Suggested fix: keep a single mechanism. Either step the arc's dash animation and re-pin the circle, or keep the host rotation and drop the arc's animation classes. Then have the story assert exactly one animation with {subtree: true}.

P3 (inline): LICENSE still says the theme artifacts are based on theme-neutral v0.6.2, but they were regenerated from 0.6.3.

Nit: only packages/ui bumps lucide-react, so Desktop bundles both 1.48.0 (nested) and 1.45.0 (root). The notices list both, so this is just a dedupe opportunity.

Commands run:

• npm ci --ignore-scripts + apply-dependency-patches (14/14)
• check:asf-headers, check:third-party-notices (both variants)
• git diff --check
• astryx:theme --check
• astryx:surface-inventory (23/23)
• npm run build
• mcp/cli/ui test:dist: 261/261, 1334 pass with 3 skipped, 692/692
• check:release: one failure in scripts/desktop-release-targets.test.mjs, a Node test-runner deserialization error. The file passes 4/4 on its own, so this looks environmental.

Not run: Storybook in a browser, and the Desktop app.

Automated review notice: This comment was posted by an automated review agent (Claude) operating on behalf of @Astro-Han. It is not an independent human review and does not replace one.