chore(deps): refresh browser tooling and CI dependencies - #38

Refresh the browser helper's dependency graph and CI tools, preserving the existing Bun root / npm transcript-helper split. The compiled helper passes a real Chrome navigation and DOM evaluation. Full local checks also caught a stale npm authentication fixture; it now asserts the existing environment-based registry contract and exact command arguments, while retaining the token-isolation assertions.

Dependency changes

Regenerated bun.lock with bun update --latest. npm update left the transcript package manifest/lockfile unchanged. Commander 15.0.0 and youtube-transcript-plus 2.0.1 are already current; checkout v7 and setup-bun v2 already track the latest release majors. No direct dependencies were added or removed. Node 24 remains the CI compatibility baseline; local validation used Node 26.8.1 and Bun 1.4.0.

Major review: setup-node v7 migrates the action to ESM; this workflow uses supported inputs and does not rely on the removed dummy authentication variable. The transitive string-width v8 requires Node 20, below our existing runtime baseline. Puppeteer release notes and Bun 1.4 release notes were checked. No declared dependency major was skipped.

Local validation

$ bun install --frozen-lockfile
Done! Checked 26 packages (no changes) [255.00ms]

$ bun build scripts/browser-tools.ts --compile --target bun --outfile node_modules/.deps-refresh/browser-tools
 [516ms]  bundle  309 modules
[2.582s] compile  node_modules/.deps-refresh/browser-tools

$ bun test
 18 pass
 0 fail
 16 expect() calls
Ran 18 tests across 4 files. [5.08s]

$ scripts/validate-skills
Validated 57 skill(s).

$ /bin/bash scripts/test-sync-skills
sync-skills tests: ok (Bash 3.2.57(1)-release)

$ skills/clawsweeper-status/scripts/clawsweeper-status.test.sh
PASS: high-volume snapshot, row caps/order, and bounded requests
PASS: producer-failure exited 37 with diagnostic
PASS: required-fetch-failure exited 38 with diagnostic
PASS: malformed-input exited 5 with diagnostic
PASS: renderer-failure exited 5 with diagnostic
clawsweeper-status tests passed

$ scripts/test-maintainer-orchestrator-policy
Validated maintainer-orchestrator activation, worker, public-action, and monitoring boundaries.

$ bash skills/fleet-maintenance/scripts/test-fleet-profile.sh
fleet-profile tests: ok
$ bash skills/fleet-maintenance/scripts/test-agent-cli-audit.sh
agent-cli-audit tests: ok
$ bash skills/fleet-maintenance/scripts/test-octopool-audit.sh
octopool-audit tests: ok
$ ruby skills/codex-huge-context/scripts/preflight.test.rb
codex huge-context preflight tests passed
$ bash skills/npm/scripts/npm-auth.test.sh
npm auth isolation and token handling: ok
$ env -u OP_SERVICE_ACCOUNT_TOKEN -u MOLTY_OP_SERVICE_ACCOUNT_TOKEN bash skills/release-mac-app/scripts/mac-release.test.sh
mac release 1Password tests passed

Shell syntax validation passed for 26 scripts. In skills/video-transcript-downloader, npm ci reported zero vulnerabilities, the dynamic import confirmed YoutubeTranscript.fetchTranscript is a function, and ./scripts/vtd.js transcript --help printed its expected usage. Release tests use mock credentials/tools; inherited service credentials were removed for the fixture run. That test emits a pre-existing grep diagnostic about treating command text as a filename, but exits successfully.

The project-structure self-test passed all five checks with its documented external TypeScript prerequisite supplied through npm exec --yes --package=typescript@6.0.3 and NODE_PATH, without adding a repository dependency. Follow-up for Peter: TypeScript 7.0.2 no longer exposes createSourceFile/ScriptTarget; the optional mapper produces an empty TypeScript map with it. Recommend retaining TypeScript 6 for this helper until a separate compiler-API migration is designed. This is outside the declared dependency graph and was not changed here.

Live proof

Launched a fresh headless Chrome with puppeteer.launch, the installed Chrome executable, and --remote-debugging-port=0; closed it in finally. These are the actual compiled-binary commands and outputs from that session:

$ node_modules/.deps-refresh/browser-tools nav https://example.com --port 52472
✓ Navigated current tab to: https://example.com
$ node_modules/.deps-refresh/browser-tools eval 'JSON.stringify({title:document.title,heading:document.querySelector("h1").textContent})' --port 52472
{"title":"Example Domain","heading":"Example Domain"}
Live compiled CLI navigation + DOM evaluation: PASS

The harness parsed the returned JSON and asserted both values were Example Domain. Chrome used a fresh temporary profile; no existing browser session was used.

CI reasoning

Default-branch CI was green before this change: run 33337744072. The repository has one build/test/smoke workflow and no scheduled operations/monitoring workflows. All existing jobs and assertions remain enabled. The broader local suite exceeds the workflow's current smoke coverage.

Codex autoreview completed with scoped-clean, no accepted/actionable findings at its requested default P0 threshold. This is internal dependency maintenance with no intentional CLI behavior change, so no changelog entry is needed. PR is for maintainer review; do not merge automatically.

PR CI is now green: run 33368061945 passed on commit 594d91ec453199efe0ffeaa228ec9e1b1065a708, verifying setup-node v7, Bun 1.4.0, the compiled browser helper, all existing CI tests, and transcript-helper installation/smoke checks on Ubuntu. No CI reruns or weakened checks were needed. Default main was not modified or merged.