chore(deps): refresh dependencies across packages

[homagcc78-blip]

Why

Several package roots were behind current dependency releases, and the sync hub still depended on Cloudflare's deprecated Vitest pool package.

What changed

• Updated direct dependencies and lockfiles across the root, plugin, sync API, sync hub, and OpenClaw packages.
• Migrated the sync hub test setup to the maintained @cloudflare/vitest-plugin package.
• Kept TypeScript and Vitest on versions supported by the Cloudflare plugin and typescript-eslint peer ranges.
• Adjusted the BullMQ Redis connection option type to accommodate the newer ioredis retry strategy type without changing runtime connection behavior.

Validation

• Root TypeScript checks passed.
• OpenClaw tests passed (47).
• Sync hub tests passed (141), including WebSocket tests (9); lint passed.
• Sync API tests require PostgreSQL, which was unavailable locally.
• The full root test suite ran but failed on Windows-specific path/SQLite assumptions and tests requiring external services or executables absent from this environment.

[greptile-apps]

Confidence Score: 2/5

[High impact] Dependency updates across multiple packages and services.

Not safe to merge as-is: missing Tree-sitter checksums, the incompatible TypeScript compiler API, and the incompatible Miniflare constructor break existing flows and must be corrected. The plugin generator consistency concern is non-blocking.

Findings

1.  Smart file tools stay disabled ▶
2.  Comment-removal commands fail ▶
3.  Local sync hub cannot start ▶
4.  Build undoes dependency updates ▶

T-Rex evidence

Executed validation driver

• This executed driver extracts disposable base fixtures and captures real test and provisioning output, making the comparison reproducible.

Executed missing-executable provisioning harness

• This executed harness calls the real provisioning function with a controlled installer and default checksum lookup, isolating the missing-version rejection.

Checksum tests before the version bump

• Ran the narrow checksum test against base-commit files; all three tests passed.

Checksum tests after the version bump

• Ran the same narrow test against the current checkout; platform checksum coverage failed for the newly locked version.

Missing-executable provisioning with version 0.26.9

• Called the real provisioning function for 0.26.9; checksum lookup succeeded and execution reached the deliberately failing installer.

Missing-executable provisioning with version 0.27.1

• Called the same function for 0.27.1; it rejected the absent checksum before installer execution and left the CLI unusable.

Manifest, checksum, and provisioning source evidence

• Captured numbered source, the scoped diff, and worktree status; the version bump lacks checksum updates and tracked files remain unchanged.

Repair call chain and installed package source

• Captured the repair call and package lifecycle source; repair uses the same provisioning path with abort severity.

Executed validation harness

• The executed Python harness creates isolated revision fixtures and captures real generator and installer behavior, making the verification reproducible.

Executed manifest writer

• This executed script contains the verbatim manifest-generation block from build-hooks.js:330–387, preserving the actual dependency-writing behavior.

Executed manifest and lock comparison

• This executed probe prints actual dependency specifications, resolved versions, and lock hashes, exposing the generated mismatch.

Checked-in source with exact line numbers

• A command captured the relevant head source files with line numbers, including the complete generators that were exercised.

Setup instructions and candidate diff

• Commands captured the setup instructions, revision diff, tool versions, and original hashes, establishing the validation inputs.

Full build attempt on PR head

• The unchanged npm run build was executed in a copied checkout and stopped at the attribution preflight, limiting full-build coverage.

Base generator behavior with Bun

• Both generators and a frozen install ran against the base revision with Bun available, showing a consistent manifest and lock.

PR generator behavior with Bun

• Both generators and a frozen install ran against PR head with Bun available, showing the exact-version upgrades being reverted.

Base generator behavior without Bun

• The base manifest writer and no-Bun lock fallback ran before a real frozen install, showing that the retained base lock remained compatible.

PR generator behavior without Bun

• The PR manifest writer and no-Bun lock fallback ran before a real frozen install, showing the unchanged new lock and decisive installation failure.

Tracked-file safety check after validation

• Git status, tracked diff, and source hashes were captured after testing, showing that tracked files remained unchanged.

Complete validation command output

• The authored harness was executed and its complete output captured with command, working directory, and exit code, preserving the end-to-end research record.

Executable validation harness

• Creates disposable JS/TS fixtures, invokes the unchanged script through all three commands, and asserts outputs and file contents to verify the regression safely.

Commands and output capture runner

• Runs the authored validation harness and saves actual output with the command, working directory, and exit code to make both runs reproducible.

Exact comment-stripping source executed in both runs

• Preserves the byte-identical base/head script copied into both disposable packages, showing that the compiler dependency—not a script edit—changed the result.

Three command results with TypeScript 6.0.3

• Captured all three commands against disposable JS/TS fixtures with TypeScript 6.0.3, showing successful stripping and expected check and dry-run behavior.

Three command failures with TypeScript 7.0.2

• Captured the version-only import and all three command runs with TypeScript 7.0.2, showing JS/TS API errors and exit code 1 in every mode.

Source locations and unchanged tracked worktree

• Captured numbered dependency and API source lines, matching source hashes, and Git status after validation, showing the cause and absence of tracked modifications.

Helper and server startup before the Miniflare upgrade

• Executed the base helper and npm server with disposable settings and attempted two HTTP requests; v4 accepted the constructor but failed later during Worker runtime startup.

Helper and server startup after the Miniflare upgrade

• Executed the head helper and npm server with the same disposable settings and attempted two HTTP requests; v5 rejected the constructor options and the server exited before serving.

Executed startup and HTTP request script

• The authored Python harness invokes the actual helper and npm server, captures source and exit codes, and makes real HTTP requests; it enables reproduction of both captures.

Executed direct helper invocation script

• The authored JavaScript script imports the repository helper with safe disposable inputs and captures its exception stack; it exposes the exact constructor failure.

Executed scripts, endpoint source, and unchanged tracked files

• Captured the authored scripts, relevant endpoint source, installed v5 workers schema, and empty tracked diffs with a command header and exit code; the validation is reproducible without tracked edits.

Evidence from the check

• This executed driver extracts disposable base fixtures and captures real test and provisioning output, making the comparison reproducible.

Evidence from the check

• This executed harness calls the real provisioning function with a controlled installer and default checksum lookup, isolating the missing-version rejection.

Command output from the check

• Ran the narrow checksum test against base-commit files; all three tests passed.

Command output from the check

• Ran the same narrow test against the current checkout; platform checksum coverage failed for the newly locked version.

Command output from the check

• Called the real provisioning function for 0.26.9; checksum lookup succeeded and execution reached the deliberately failing installer.

Command output from the check

• Called the same function for 0.27.1; it rejected the absent checksum before installer execution and left the CLI unusable.

Command output from the check

• Captured numbered source, the scoped diff, and worktree status; the version bump lacks checksum updates and tracked files remain unchanged.

Command output from the check

• Captured the repair call and package lifecycle source; repair uses the same provisioning path with abort severity.

Evidence from the check

• The executed Python harness creates isolated revision fixtures and captures real generator and installer behavior, making the verification reproducible.

Evidence from the check

• This executed script contains the verbatim manifest-generation block from build-hooks.js:330–387, preserving the actual dependency-writing behavior.

Evidence from the check

• This executed probe prints actual dependency specifications, resolved versions, and lock hashes, exposing the generated mismatch.

Command output from the check

• A command captured the relevant head source files with line numbers, including the complete generators that were exercised.

Command output from the check

• Commands captured the setup instructions, revision diff, tool versions, and original hashes, establishing the validation inputs.

Command output from the check

• The unchanged npm run build was executed in a copied checkout and stopped at the attribution preflight, limiting full-build coverage.

Command output from the check

• Both generators and a frozen install ran against the base revision with Bun available, showing a consistent manifest and lock.

Command output from the check

• Both generators and a frozen install ran against PR head with Bun available, showing the exact-version upgrades being reverted.

Command output from the check

• The base manifest writer and no-Bun lock fallback ran before a real frozen install, showing that the retained base lock remained compatible.

Command output from the check

• The PR manifest writer and no-Bun lock fallback ran before a real frozen install, showing the unchanged new lock and decisive installation failure.

Command output from the check

• Git status, tracked diff, and source hashes were captured after testing, showing that tracked files remained unchanged.

Command output from the check

• The authored harness was executed and its complete output captured with command, working directory, and exit code, preserving the end-to-end research record.

Evidence from the check

• Creates disposable JS/TS fixtures, invokes the unchanged script through all three commands, and asserts outputs and file contents to verify the regression safely.

Evidence from the check

• Runs the authored validation harness and saves actual output with the command, working directory, and exit code to make both runs reproducible.

Evidence from the check

• Preserves the byte-identical base/head script copied into both disposable packages, showing that the compiler dependency—not a script edit—changed the result.

Command output from the check

• Captured all three commands against disposable JS/TS fixtures with TypeScript 6.0.3, showing successful stripping and expected check and dry-run behavior.

Command output from the check

• Captured the version-only import and all three command runs with TypeScript 7.0.2, showing JS/TS API errors and exit code 1 in every mode.

Command output from the check

• Captured numbered dependency and API source lines, matching source hashes, and Git status after validation, showing the cause and absence of tracked modifications.

Command output from the check

• Executed the base helper and npm server with disposable settings and attempted two HTTP requests; v4 accepted the constructor but failed later during Worker runtime startup.

Command output from the check

• Executed the head helper and npm server with the same disposable settings and attempted two HTTP requests; v5 rejected the constructor options and the server exited before serving.

Evidence from the check

• The authored Python harness invokes the actual helper and npm server, captures source and exit codes, and makes real HTTP requests; it enables reproduction of both captures.

Evidence from the check

• The authored JavaScript script imports the repository helper with safe disposable inputs and captures its exception stack; it exposes the exact constructor failure.

Command output from the check

• Captured the authored scripts, relevant endpoint source, installed v5 workers schema, and empty tracked diffs with a command header and exit code; the validation is reproducible without tracked edits.

Summary

This PR refreshes dependencies across five packages, migrates the sync hub to @cloudflare/vitest-plugin, and narrows the Redis connection type without changing its runtime fields.

Three compatibility failures must be corrected before merging:

• The app and its packages use refreshed dependency versions.
• Sync-hub tests use Cloudflare’s maintained Vitest plugin.
• Redis queue settings keep the same values with a narrower type.

The plugin manifest generator also retains the old dependency specifications. This non-blocking consistency concern reverses exact-version upgrades during generation and leaves an incompatible manifest and lock when generation runs without Bun.

The Cloudflare plugin's test type export and supported Vitest range remain compatible.

_{Reviews (1) · Last reviewed commit: "chore(deps): refresh dependencies across..." · Reviewed by Greptile}

[greptile-apps]

Smart file tools stay disabled

tree-sitter-cli is now pinned to 0.27.1, but TREE_SITTER_EXECUTABLE_SHA256 only contains 0.26.9. Fresh installs disable package install scripts, so ensureTreeSitterCliBinary must download the executable itself. It rejects the new version because its expected checksum is missing, leaving smart_search and smart_outline without a usable executable. Repair uses the same provisioning function and cannot recover this condition. The checksum coverage test also fails against the new lockfile.

Add verified executable checksums for every supported platform before merging this bump.

Artifacts

Executed validation driver

• This executed driver extracts disposable base fixtures and captures real test and provisioning output, making the comparison reproducible.

Executed missing-executable provisioning harness

• This executed harness calls the real provisioning function with a controlled installer and default checksum lookup, isolating the missing-version rejection.

Checksum tests before the version bump

• Ran the narrow checksum test against base-commit files; all three tests passed.

Checksum tests after the version bump

• Ran the same narrow test against the current checkout; platform checksum coverage failed for the newly locked version.

Missing-executable provisioning with version 0.26.9

• Called the real provisioning function for 0.26.9; checksum lookup succeeded and execution reached the deliberately failing installer.

Missing-executable provisioning with version 0.27.1

• Called the same function for 0.27.1; it rejected the absent checksum before installer execution and left the CLI unusable.

Manifest, checksum, and provisioning source evidence

• Captured numbered source, the scoped diff, and worktree status; the version bump lacks checksum updates and tracked files remain unchanged.

Repair call chain and installed package source

• Captured the repair call and package lifecycle source; repair uses the same provisioning path with abort severity.

_{Ran code and verified through T-Rex}

[greptile-apps]

Build undoes dependency updates

The manifest writer used by npm run build still generates tree-sitter-cli 0.26.9, shell-quote 1.9.0, and zod ^4.4.3, overwriting the updated plugin dependency specifications. Executing that writer and the lockfile generator confirmed both outcomes:

• With Bun available, the generated lock downgrades the two exact-version dependencies. Zod remains resolved to 4.6.6, which satisfies the old range.
• Without Bun, the generator retains the new committed lock beside the old manifest; a frozen installation then fails because they disagree.

This is a non-blocking generated-file consistency concern. Update the canonical generator alongside the generated manifest and lockfile so subsequent generation preserves the intended dependency refresh.

Knowledge Base Used: Installation and NPX CLI

Artifacts

Executed validation driver

• This executed driver extracts disposable base fixtures and captures real test and provisioning output, making the comparison reproducible.

Executed missing-executable provisioning harness

• This executed harness calls the real provisioning function with a controlled installer and default checksum lookup, isolating the missing-version rejection.

Checksum tests before the version bump

• Ran the narrow checksum test against base-commit files; all three tests passed.

Checksum tests after the version bump

• Ran the same narrow test against the current checkout; platform checksum coverage failed for the newly locked version.

Missing-executable provisioning with version 0.26.9

• Called the real provisioning function for 0.26.9; checksum lookup succeeded and execution reached the deliberately failing installer.

Missing-executable provisioning with version 0.27.1

• Called the same function for 0.27.1; it rejected the absent checksum before installer execution and left the CLI unusable.

Manifest, checksum, and provisioning source evidence

• Captured numbered source, the scoped diff, and worktree status; the version bump lacks checksum updates and tracked files remain unchanged.

Repair call chain and installed package source

• Captured the repair call and package lifecycle source; repair uses the same provisioning path with abort severity.

Executed validation harness

• The executed Python harness creates isolated revision fixtures and captures real generator and installer behavior, making the verification reproducible.

Executed manifest writer

• This executed script contains the verbatim manifest-generation block from build-hooks.js:330–387, preserving the actual dependency-writing behavior.

Executed manifest and lock comparison

• This executed probe prints actual dependency specifications, resolved versions, and lock hashes, exposing the generated mismatch.

Checked-in source with exact line numbers

• A command captured the relevant head source files with line numbers, including the complete generators that were exercised.

Setup instructions and candidate diff

• Commands captured the setup instructions, revision diff, tool versions, and original hashes, establishing the validation inputs.

Full build attempt on PR head

• The unchanged npm run build was executed in a copied checkout and stopped at the attribution preflight, limiting full-build coverage.

Base generator behavior with Bun

• Both generators and a frozen install ran against the base revision with Bun available, showing a consistent manifest and lock.

PR generator behavior with Bun

• Both generators and a frozen install ran against PR head with Bun available, showing the exact-version upgrades being reverted.

Base generator behavior without Bun

• The base manifest writer and no-Bun lock fallback ran before a real frozen install, showing that the retained base lock remained compatible.

PR generator behavior without Bun

• The PR manifest writer and no-Bun lock fallback ran before a real frozen install, showing the unchanged new lock and decisive installation failure.

Tracked-file safety check after validation

• Git status, tracked diff, and source hashes were captured after testing, showing that tracked files remained unchanged.

Complete validation command output

• The authored harness was executed and its complete output captured with command, working directory, and exit code, preserving the end-to-end research record.

_{Ran code and verified through T-Rex}

[greptile-apps]

Comment-removal commands fail

typescript 7.0.2 no longer exposes the compiler API through import ts from 'typescript'; that import exports only version information. scripts/strip-comments.ts still reads ts.ScriptKind and calls ts.createSourceFile and the comment helpers. All three strip-comments commands fail on JavaScript and TypeScript files and exit unsuccessfully instead of processing them. This was reproduced with both file types in every command mode; the identical script worked with TypeScript 6.0.3.

Keep an API-compatible TypeScript dependency for this script, or migrate its parser before merging the root version update.

Artifacts

Executable validation harness

• Creates disposable JS/TS fixtures, invokes the unchanged script through all three commands, and asserts outputs and file contents to verify the regression safely.

Commands and output capture runner

• Runs the authored validation harness and saves actual output with the command, working directory, and exit code to make both runs reproducible.

Exact comment-stripping source executed in both runs

• Preserves the byte-identical base/head script copied into both disposable packages, showing that the compiler dependency—not a script edit—changed the result.

Three command results with TypeScript 6.0.3

• Captured all three commands against disposable JS/TS fixtures with TypeScript 6.0.3, showing successful stripping and expected check and dry-run behavior.

Three command failures with TypeScript 7.0.2

• Captured the version-only import and all three command runs with TypeScript 7.0.2, showing JS/TS API errors and exit code 1 in every mode.

Source locations and unchanged tracked worktree

• Captured numbered dependency and API source lines, matching source hashes, and Git status after validation, showing the cause and absence of tracked modifications.

_{Ran code and verified through T-Rex}

[greptile-apps]

Local sync hub cannot start

Miniflare 5 requires a workers array in its constructor options, but createSyncHubMiniflare still passes version-4 top-level options directly to new Miniflare. Unlike the new Vitest plugin, this helper does not call convertV4MiniflareOptions. Running e2e:serve with the required settings throws ERR_VALIDATION for the missing worker list and rejected legacy options, then exits before the hub can serve requests.

Convert the existing options or rewrite the helper for version 5 before merging the dependency update.

Artifacts

Helper and server startup before the Miniflare upgrade

• Executed the base helper and npm server with disposable settings and attempted two HTTP requests; v4 accepted the constructor but failed later during Worker runtime startup.

Helper and server startup after the Miniflare upgrade

• Executed the head helper and npm server with the same disposable settings and attempted two HTTP requests; v5 rejected the constructor options and the server exited before serving.

Executed startup and HTTP request script

• The authored Python harness invokes the actual helper and npm server, captures source and exit codes, and makes real HTTP requests; it enables reproduction of both captures.

Executed direct helper invocation script

• The authored JavaScript script imports the repository helper with safe disposable inputs and captures its exception stack; it exposes the exact constructor failure.

Executed scripts, endpoint source, and unchanged tracked files

• Captured the authored scripts, relevant endpoint source, installed v5 workers schema, and empty tracked diffs with a command header and exit code; the validation is reproducible without tracked edits.

_{Ran code and verified through T-Rex}