Repository navigation
build(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #679
Merged
Merged
Conversation
…dates Bumps the npm_and_yarn group with 2 updates in the / directory: [zod](https://github.com/colinhacks/zod) and [fast-uri](https://github.com/fastify/fast-uri). Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `fast-uri` from 3.1.8 to 3.1.9 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.8...v3.1.9) --- updated-dependencies: - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
benbrandt
added a commit
that referenced
this pull request
Oct 26, 2026
## Scope: standalone live core Fifth incremental extraction from #655, on current `main` (`091f9b2`), after #676, #677, #680, and #681 landed. This is the larger atomic feature slice discussed in the split plan: **43 files, +2,898/-181**, including 1,573 added test/snapshot lines and 1,301 added runtime lines. No dependency or generated app-server files change. ### Included - Standard associations for opted-in non-AIR v1 clients and non-AIR v2 clients. AIR retains its existing opt-ins, private updates, generation identities, and fallback. - One opaque conversation ID across assignments, idle work, and handler replacement. Announce immediate parents before children; buffer unresolved ancestry rather than flattening it. - Child-owned streamed-item/tool state, plans, titles, permissions, and elicitation. Accepted URL completion state survives parent attachment changes; late approval replies are rejected locally when actual work ends. - Empty child capabilities and an allowlist boundary for all client mutations, including private extensions and raw provider IDs. Known raw IDs are restricted even while announcement publication is backpressured. Parent cancellation cascades to observed live children; an actual ending produces idle, observability loss produces unknown. - Association-only replay and safe reattachment: current provider parentage must match through known ancestors, inactive owned children receive future events without loading them, and copied forks cannot steal the original runtime. Parent history still replays normally; an explicit advisory says recorded child transcripts are not included. - Current child snapshots follow the real successful wire write, including complete JSON-RPC batches. Same-parent setup execution is serialized without waiting on each other's shared batch delivery. Closing a parent fences queued reopen attempts. - Preserve the model reporting already landed in #678: reuse its source priority and read-only model option helper. Model observations are not guessed from spawn arguments or parent values; buffered older settings cannot replace newer observations. ### Explicitly deferred No recursive child transcript replay, history/live item reconciliation, recorded historical work outcomes, new configuration readback/effort reporting, directed-session messages, or child mutation controls. Those remain separate changes after this live core is reviewed and landed. The current RFD explicitly allows live support without complete child history. Recoverable associations are replayed truthfully; omitted transcripts are not silently presented as complete. ## Review order 1. Contract selection, connection-owned identities/restrictions, and ACP mutation dispatch. 2. Live router admission, child-owned rendering/work/request state, and existing model reporting. 3. Provider subscriptions and ownership verification; no parent cwd/MCP/instruction overrides when rejoining a child. 4. Conversation-owned interaction handlers and request cancellation scopes. 5. Session setup lane, batch-write freshness boundary, and association-only replay. 6. Behavior-focused tests and wire snapshots for both versions. The async queue-completion gap found while planning the split is fixed here: a session transition waits for async callbacks and propagates rejection without breaking the notification lane. A regression reproduces both ordering and rejection behavior. The old #655 reference helper must not be copied back over this implementation. ## Validation Final validation used main's latest lockfile (including #679): - `npm run typecheck` - `npm run build` - `npm test`: **1,959 passed**, 38 skipped - Focused live/wire/queue suites: **44 passed**, 2 v2-only cases skipped on v1 - `npm run test:integration`: **15 passed** — eight new real-Codex 0.164.0 cases cover active-child reattachment, fork identity/ownership isolation, parent cancel/close, and child terminal output/exit across later parent prompts, on v1 and v2, using a local scripted model - `npm run bundle:all`: all six targets compile - Real live-model no-tool smoke completed with `end_turn` - `git diff --check` Existing AIR and parent-session golden files are unchanged. The fixed-command terminal fixture alone uses full-access mode to avoid CI hosts without sandbox namespace support; production sandbox settings are unchanged. The full live-model E2E suite and execution of every OS bundle were not run. ## References - ACP specification at `8aa92106feba5cdd0da210a87a39dfee4dc24f13`: [identity, announcement, and automatic routing](https://github.com/agentclientprotocol/agent-client-protocol/blob/8aa92106feba5cdd0da210a87a39dfee4dc24f13/docs/rfds/subagents.mdx#L166-L246), [best-effort replay and response freshness](https://github.com/agentclientprotocol/agent-client-protocol/blob/8aa92106feba5cdd0da210a87a39dfee4dc24f13/docs/rfds/subagents.mdx#L713-L840). - Official TypeScript SDK checkout `c7e07388feed7a530f8211d0dae4951cb6d26d09` and published 2.0.2 for transport/runtime evidence; normative behavior comes from the spec, not the SDK implementation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the / directory: zod and fast-uri.
Updates
zodfrom 4.6.5 to 4.6.6Release notes
Sourced from zod's releases.
Commits
9c21983ci: stage at verbose so a failed OIDC token exchange says why529f78d4.6.6a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)a2ba4a6fix(types): declare record output and input as members, not base type argumen...c42596brelease: hold the run on the release-approval environment until the staged ve...bacad51docs: square the Code for Japan logo to match the other bronze tiles8fb2fafdocs: crop the Code for Japan logo and list it first in bronzeb2ef983docs: add Code for Japan to bronze sponsors74304cerelease: stage npm versions instead of publishing them (#6622)34a626fdocs: tighten the z.locales tree-shaking noteUpdates
fast-urifrom 3.1.8 to 3.1.9Release notes
Sourced from fast-uri's releases.
Commits
0def703Bumped v3.1.9a1d0da2test: generate only relative path references9eb8759fix: preserve relative paths in suffix and relative resolution54c30f7docs: note suffix-reference authority ambiguity39e6493fix: escape a first-segment colon in suffix references745183ctest: cover first-segment colon in suffix referencesddfc6a5fix(SEC-03): reject non reg-name characters in domain hostsd86a8d2fix: keep a colon-first segment behind "./" in relative normalizationeb483b5test: cover colon-first relative references in normalizationb110a35fix(SEC-02): preserve meaning of relative references during normalizationMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.