chore(deps): big-bang bump (consolidates dependabot PRs)

.agor.yml

@@ -1,146 +1,62 @@
-# Agor's own .agor.yml — dogfoods the v2 variant schema.
-#
-# Variants cover the common development / testing topologies:
-#   - sqlite  (default): single-user dev, SQLite, no RBAC. Fastest to boot.
-#   - postgres:          PostgreSQL-backed dev. Closer to multi-user prod layout.
-#   - full:              production-like — PostgreSQL + worktree RBAC + strict
-#                        Unix user impersonation.
-#   - docs:              Nextra docs site (apps/agor-docs). No daemon, no DB —
-#                        just `next dev` for previewing /guide/* edits.
-#
-# postgres/full override start/stop/nuke so every docker compose call loads
-# docker-compose.override.postgres.yml (otherwise docker auto-loads only
-# docker-compose.override.yml, which has no postgres config). logs / health /
-# app are inherited via `extends: sqlite`. Single-level extends only — chains
-# are rejected at parse time.
-#
-# Ports derive from {{worktree.unique_id}} so multiple worktrees run side-by-side
-# without colliding. The `docs` variant uses {{host.ip_address}} for the app URL
-# so the dev server is reachable from your laptop, not just localhost on the
-# daemon host. Override the autodetected IP via `daemon.host_ip_address` in
-# ~/.agor/config.yaml or `template_overrides.host.ip_address` per-repo.
-
 environment:
   default: sqlite
-
   variants:
-    sqlite:
-      description: Single-user dev with SQLite. No RBAC. Fastest to boot.
-      # AGOR_BUILD_SHA / AGOR_BUILT_AT are injected by Agor's
-      # spawnEnvironmentCommand from the host-side worktree gitdir; no need to
-      # capture them here. See packages/core/src/unix/environment-command-spawn.ts.
-      #
-      # UID/GID are passed explicitly so docker-compose.override.yml's
-      # `user: '${UID:-1000}:${GID:-1000}'` resolves to the host's actual
-      # identity (and the `args: { UID, GID }` build args do too on rebuild).
-      # Bash's $UID/$GID are readonly but not exported, so without this prefix
-      # compose silently falls through to 1000:1000 — and once the image and
-      # runtime UIDs disagree, the container's UID has no /etc/passwd entry
-      # and the entrypoint dies on `sudo: you do not exist in the passwd
-      # database`. TODO: lift this into spawnEnvironmentCommand alongside
-      # AGOR_BUILD_SHA so every Docker-based .agor.yml gets it for free.
-      start: >-
-        UID=$(id -u) GID=$(id -g)
-        DAEMON_PORT={{add 3000 worktree.unique_id}}
-        UI_PORT={{add 5000 worktree.unique_id}}
-        docker compose -p agor-{{worktree.name}} up -d
-      stop: docker compose -p agor-{{worktree.name}} down
-      nuke: docker compose -p agor-{{worktree.name}} down -v
-      logs: docker compose -p agor-{{worktree.name}} logs --tail=100
-      health: http://localhost:{{add 3000 worktree.unique_id}}/health
-      app: http://localhost:{{add 5000 worktree.unique_id}}
-
-    postgres:
-      extends: sqlite
-      description: Dev with PostgreSQL. RBAC off. Closer to multi-user prod layout.
-      # Explicit -f flags: without them, docker compose auto-loads
-      # docker-compose.override.yml (UID/GID only) and skips the postgres
-      # override. Listing both files explicitly replaces that default.
-      start: >-
-        UID=$(id -u) GID=$(id -g)
-        DAEMON_PORT={{add 3000 worktree.unique_id}}
-        UI_PORT={{add 5000 worktree.unique_id}}
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        up -d
-      stop: >-
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        down
-      nuke: >-
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        down -v
-
     docs:
-      description: >-
-        Nextra docs site (apps/agor-docs) for previewing documentation edits.
-        Runs `next dev` in a self-contained Docker container — no daemon,
-        no database, no host-side `pnpm install` needed. Port =
-        {{add 7000 worktree.unique_id}}; app URL uses {{host.ip_address}}
-        so it's reachable from outside the daemon host.
       start: >-
-        PORT={{add 7000 worktree.unique_id}}
-        docker compose
-        -f apps/agor-docs/docker-compose.yml
-        -p agor-docs-{{worktree.name}}
-        up -d --build
-      stop: >-
-        docker compose
-        -f apps/agor-docs/docker-compose.yml
-        -p agor-docs-{{worktree.name}}
-        down
+        PORT={{add 7000 worktree.unique_id}} docker compose -f apps/agor-docs/docker-compose.yml -p
+        agor-docs-{{worktree.name}} up -d --build
+      stop: docker compose -f apps/agor-docs/docker-compose.yml -p agor-docs-{{worktree.name}} down
+      description: >-
+        Nextra docs site (apps/agor-docs) for previewing documentation edits. Runs `next dev` in a
+        self-contained Docker container — no daemon, no database, no host-side `pnpm install`
+        needed. Port = {{add 7000 worktree.unique_id}}; app URL uses {{host.ip_address}} so it's
+        reachable from outside the daemon host.
       nuke: >-
-        docker compose
-        -f apps/agor-docs/docker-compose.yml
-        -p agor-docs-{{worktree.name}}
-        down -v --rmi local
+        docker compose -f apps/agor-docs/docker-compose.yml -p agor-docs-{{worktree.name}} down -v
+        --rmi local
       logs: >-
-        docker compose
-        -f apps/agor-docs/docker-compose.yml
-        -p agor-docs-{{worktree.name}}
-        logs --tail=100
+        docker compose -f apps/agor-docs/docker-compose.yml -p agor-docs-{{worktree.name}} logs
+        --tail=100
       health: http://localhost:{{add 7000 worktree.unique_id}}
       app: http://{{host.ip_address}}:{{add 7000 worktree.unique_id}}
-
     full:
-      extends: sqlite
+      start: >-
+        UID=$(id -u) GID=$(id -g) DAEMON_PORT={{add 3000 worktree.unique_id}} UI_PORT={{add 5000
+        worktree.unique_id}} AGOR_RBAC_ENABLED=true AGOR_UNIX_USER_MODE=strict docker compose -f
+        docker-compose.yml -f docker-compose.override.postgres.yml -p agor-{{worktree.name}}
+        --profile postgres up -d
+      stop: >-
+        docker compose -f docker-compose.yml -f docker-compose.override.postgres.yml -p
+        agor-{{worktree.name}} --profile postgres down
       description: >-
-        Production-like: PostgreSQL + worktree RBAC + strict Unix user
-        impersonation (each Agor user runs sessions as their own Unix identity).
-        Requires the sudoers config shipped under docker/sudoers/.
+        Production-like: PostgreSQL + worktree RBAC + strict Unix user impersonation (each Agor user
+        runs sessions as their own Unix identity). Requires the sudoers config shipped under
+        docker/sudoers/.
+      extends: sqlite
+      nuke: >-
+        docker compose -f docker-compose.yml -f docker-compose.override.postgres.yml -p
+        agor-{{worktree.name}} --profile postgres down -v
+    sqlite:
       start: >-
-        UID=$(id -u) GID=$(id -g)
-        DAEMON_PORT={{add 3000 worktree.unique_id}}
-        UI_PORT={{add 5000 worktree.unique_id}}
-        AGOR_RBAC_ENABLED=true
-        AGOR_UNIX_USER_MODE=strict
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        up -d
+        UID=$(id -u) GID=$(id -g) DAEMON_PORT={{add 3000 worktree.unique_id}} UI_PORT={{add 5000
+        worktree.unique_id}} docker compose -p agor-{{worktree.name}} up -d --build
+      stop: docker compose -p agor-{{worktree.name}} down
+      description: Single-user dev with SQLite. No RBAC. Fastest to boot.
+      nuke: docker compose -p agor-{{worktree.name}} down -v
+      logs: docker compose -p agor-{{worktree.name}} logs --tail=100
+      health: http://localhost:{{add 3000 worktree.unique_id}}/health
+      app: http://{{host.ip_address}}:{{add 5000 worktree.unique_id}}
+    postgres:
+      start: >-
+        UID=$(id -u) GID=$(id -g) DAEMON_PORT={{add 3000 worktree.unique_id}} UI_PORT={{add 5000
+        worktree.unique_id}} docker compose -f docker-compose.yml -f
+        docker-compose.override.postgres.yml -p agor-{{worktree.name}} --profile postgres up -d
+        --build
       stop: >-
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        down
+        docker compose -f docker-compose.yml -f docker-compose.override.postgres.yml -p
+        agor-{{worktree.name}} --profile postgres down
+      description: Dev with PostgreSQL. RBAC off. Closer to multi-user prod layout.
+      extends: sqlite
       nuke: >-
-        docker compose
-        -f docker-compose.yml
-        -f docker-compose.override.postgres.yml
-        -p agor-{{worktree.name}}
-        --profile postgres
-        down -v
+        docker compose -f docker-compose.yml -f docker-compose.override.postgres.yml -p
+        agor-{{worktree.name}} --profile postgres down -v

.github/workflows/build-devcontainer.yml

@@ -46,7 +46,7 @@ jobs:
             type=ref,event=tag
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: .devcontainer/playground/Dockerfile

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
       - run: pnpm turbo run build --filter='!@agor/docs'
 
       - name: Save turbo cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: .turbo/cache
           key: ${{ env.TURBO_CACHE_KEY }}
@@ -65,7 +65,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Restore turbo cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .turbo/cache
           key: ${{ env.TURBO_CACHE_KEY }}
@@ -91,7 +91,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Restore turbo cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .turbo/cache
           key: ${{ env.TURBO_CACHE_KEY }}
@@ -119,7 +119,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Restore turbo cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .turbo/cache
           key: ${{ env.TURBO_CACHE_KEY }}
@@ -145,7 +145,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Restore turbo cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .turbo/cache
           key: ${{ env.TURBO_CACHE_KEY }}

apps/agor-cli/package.json

@@ -18,20 +18,20 @@
     "@agor/core": "workspace:*",
     "@agor/daemon": "workspace:*",
     "@agor-live/client": "workspace:*",
-    "@oclif/core": "^4.8.2",
+    "@oclif/core": "^4.8.3",
     "@oclif/plugin-help": "^6.2.37",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "inquirer": "^12.10.0"
   },
   "devDependencies": {
-    "@types/node": "^22.10.2",
+    "@types/node": "^24.6.0",
     "glob": "^11.1.0",
-    "oclif": "^4.22.81",
+    "oclif": "^4.23.0",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.5"
   },
   "oclif": {
     "bin": "agor",

apps/agor-daemon/package.json

@@ -37,22 +37,22 @@
     "jsonwebtoken": "^9.0.3",
     "multer": "^2.1.1",
     "socket.io": "^4.8.3",
-    "swagger-ui-dist": "^5.32.0"
+    "swagger-ui-dist": "^5.32.1"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.112",
     "@types/compression": "^1.8.1",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/multer": "^1.4.12",
-    "@types/node": "^22.10.2",
+    "@types/multer": "^2.1.0",
+    "@types/node": "^24.6.0",
     "concurrently": "^9.2.1",
     "glob": "^11.0.3",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.5",
     "zod": "^4.3.6"
   }
 }

apps/agor-docs/package.json

@@ -13,15 +13,15 @@
     "@tsparticles/engine": "^3.9.1",
     "@tsparticles/react": "^3.0.0",
     "@tsparticles/slim": "^3.9.1",
-    "katex": "^0.16.33",
+    "katex": "^0.16.39",
     "next": "^14.2.35",
     "nextra": "^3.2.0",
     "nextra-theme-docs": "^3.2.0",
     "react": "^18.3.0",
     "react-dom": "^18.3.0"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
+    "@types/node": "^24.6.0",
     "@types/react": "^18.3.0",
     "next-sitemap": "^4.2.3",
     "tsx": "^4.21.0",

apps/agor-ui/package.json

@@ -70,6 +70,6 @@
     "typescript": "~5.9.3",
     "vite": "^7.3.1",
     "vite-plugin-compression": "^0.5.1",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.5"
   }
 }

package.json

@@ -38,14 +38,14 @@
     "check:agor-live-deps": "node scripts/sync-agor-live-deps.mjs --check"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.4",
+    "@biomejs/biome": "2.4.4",
     "@google-analytics/admin": "^9.0.1",
     "husky": "^9.1.7",
     "knip": "^5.85.0",
-    "lint-staged": "^16.3.1",
-    "prettier": "^3.8.1",
+    "lint-staged": "^16.4.0",
+    "prettier": "^3.8.3",
     "tsx": "^4.21.0",
-    "turbo": "^2.9.6",
+    "turbo": "^2.9.7",
     "typescript": "^5.9.3"
   },
   "packageManager": "pnpm@9.15.1",

packages/agor-live/package.json

@@ -64,12 +64,12 @@
     "@iarna/toml": "^2.2.5",
     "@libsql/client": "^0.17.2",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@oclif/core": "^4.8.2",
+    "@oclif/core": "^4.8.3",
     "@oclif/plugin-help": "^6.2.37",
     "@octokit/auth-app": "^8.2.0",
     "@octokit/rest": "^22.0.1",
     "@openai/codex-sdk": "^0.124.0",
-    "@opencode-ai/sdk": "^1.2.15",
+    "@opencode-ai/sdk": "^1.2.20",
     "@slack/socket-mode": "^2.0.5",
     "@slack/web-api": "^7.14.1",
     "bcryptjs": "^2.4.3",
@@ -99,7 +99,7 @@
     "slackify-markdown": "^5.0.0",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
-    "swagger-ui-dist": "^5.32.0",
+    "swagger-ui-dist": "^5.32.1",
     "uuid": "^14.0.0",
     "uuidv7": "^1.1.0",
     "zod": "^4.3.6"

packages/client/package.json

@@ -43,7 +43,7 @@
   "devDependencies": {
     "@agor/core": "workspace:*",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.10.2",
+    "@types/node": "^24.6.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },