Bump dependencies and tighten pr-open command

.claude/commands/pnpm-update.md

@@ -1,6 +1,6 @@
 ---
 description: Triage outdated pnpm packages, research what each upgrade entails, then update the approved set
-allowed-tools: Bash(pnpm outdated:*), Bash(pnpm up:*), Bash(pnpm typecheck:*), Bash(pnpm lint:*), Bash(pnpm test:*), Bash(pnpm build:*), Bash(git status:*), Bash(git diff:*), Bash(cat:*), Bash(jq:*), Read, WebSearch, WebFetch
+allowed-tools: Bash(pnpm outdated:*), Bash(pnpm up:*), Bash(pnpm typecheck:*), Bash(pnpm lint:*), Bash(pnpm test:*), Bash(pnpm build:*), Bash(git status:*), Bash(git diff:*), Bash(cat:*), Bash(jq:*), Read, WebSearch, WebFetch, AskUserQuestion
 argument-hint: [--dev | --prod]
 ---
 
@@ -73,11 +73,13 @@ pnpm up --latest -r <pkg1> <pkg2> ...
 
 If the list is empty (only `hold` rows), say so and stop — nothing to upgrade automatically.
 
-**Gate.** Ask exactly: `Run this update? (yes / edit / cancel)`. Wait for my reply.
+**Gate.** Call the `AskUserQuestion` tool with the question `Run this update?` and these three options (in this exact order):
 
-- `yes` → proceed.
-- `edit` → let me reclassify rows (e.g. "move <pkg> to hold", "add <pkg> back in"), then re-show the command and re-confirm.
-- `cancel` → stop without running anything.
+1. `Run update (Recommended)` — proceeds to section 6.
+2. `Edit list` — let the user reclassify rows (e.g. "move <pkg> to hold", "add <pkg> back in"), then re-show the command and re-ask.
+3. `Cancel` — stop without running anything.
+
+Do not run `pnpm up` without an affirmative answer from `AskUserQuestion`.
 
 ## 6. Apply (only after gate = yes)
 

.claude/commands/pr-address.md

@@ -1,6 +1,6 @@
 ---
 description: Triage PR review comments, fix the valid ones, then reply to each comment (manual commit + push)
-allowed-tools: Bash(gh pr view:*), Bash(gh pr checks:*), Bash(gh pr comment:*), Bash(gh api:*), Bash(gh repo view:*), Bash(gh run view:*), Bash(gh run list:*), Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git add:*), Bash(git commit:*), Bash(git push:*), Bash(git rev-parse:*), Bash(git branch:*), Bash(pnpm:*)
+allowed-tools: Bash(gh pr view:*), Bash(gh pr checks:*), Bash(gh pr comment:*), Bash(gh api:*), Bash(gh repo view:*), Bash(gh run view:*), Bash(gh run list:*), Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git add:*), Bash(git commit:*), Bash(git push:*), Bash(git rev-parse:*), Bash(git branch:*), Bash(pnpm:*), AskUserQuestion
 argument-hint: [PR-number]
 ---
 
@@ -62,9 +62,11 @@ Then propose a fix plan for everything classified `valid` or `ci-failure`:
 
 Group related fixes (same file or shared root cause) into a single edit when natural.
 
-**GATE 1.** Ask exactly: `Triage + fix plan look right? (yes / edit / cancel)`. Wait.
+**GATE 1.** Call `AskUserQuestion` with the question `Triage + fix plan look right?` and these three options (in this exact order):
 
-If `edit`: let me reclassify (e.g. "id 1234 is noise") or adjust the plan, then re-confirm.
+1. `Apply fixes (Recommended)` — proceeds to section 4.
+2. `Edit triage` — let the user reclassify (e.g. "id 1234 is noise") or adjust the plan, then re-ask.
+3. `Cancel` — stop without applying anything.
 
 ## 4. Apply fixes (only after Gate 1 = yes)
 
@@ -80,9 +82,13 @@ If `edit`: let me reclassify (e.g. "id 1234 is noise") or adjust the plan, then
    If any fail, STOP and show the failure. Do not commit broken code, do not post replies promising a non-existent fix.
 4. Show me the diff (`git diff`) for review.
 
-**GATE 2.** Ask: `Fixes look right? (yes / edit / cancel)`. Wait.
+**GATE 2.** Call `AskUserQuestion` with the question `Fixes look right?` and these three options (in this exact order):
 
-On `yes`, do NOT commit and do NOT push. Instead:
+1. `Looks good (Recommended)` — proceeds to draft commit message.
+2. `Edit fixes` — let the user request adjustments, then re-validate and re-ask.
+3. `Cancel` — stop; leave the working tree dirty for the user.
+
+On the affirmative answer, do NOT commit and do NOT push. Instead:
 
 5. Print a suggested commit message I can copy-paste:
 
@@ -109,7 +115,11 @@ Style: terse, one or two sentences max. Per-class template:
 
 Show all drafts in one block, grouped by comment id.
 
-**GATE 3.** Ask: `Post these replies (and resolve threads for fix-landed rows)? (yes / edit / cancel)`. Wait.
+**GATE 3.** Call `AskUserQuestion` with the question `Post these replies (and resolve threads for fix-landed rows)?` and these three options (in this exact order):
+
+1. `Post replies (Recommended)` — proceeds to section 6.
+2. `Edit drafts` — let the user revise specific replies, then re-ask.
+3. `Cancel` — stop without posting anything.
 
 ## 6. Post replies + resolve threads (only after Gate 3 = yes)
 

.claude/commands/pr-open.md

@@ -1,10 +1,10 @@
 ---
 description: Open a GitHub PR for the current branch with an auto-generated title and body
-allowed-tools: Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git rev-parse:*), Bash(git branch:*), Bash(git push:*), Bash(gh auth status:*), Bash(gh pr create:*), Bash(gh pr view:*), Bash(gh repo view:*)
+allowed-tools: Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git rev-parse:*), Bash(git branch:*), Bash(gh auth status:*), Bash(gh api:*), Bash(gh pr create:*), Bash(gh pr view:*), Bash(gh repo view:*), AskUserQuestion
 argument-hint: [--draft]
 ---
 
-Open a GitHub PR for the current branch. Generate the title + body, show them to me, confirm, then push + create.
+Open a GitHub PR for the current branch. Generate the title + body, show them to the user, get confirmation, then create the PR. The user pushes the branch themselves — never run `git push`.
 
 Arguments: `$ARGUMENTS` — if it contains `--draft`, create the PR as draft.
 
@@ -17,7 +17,8 @@ Stop with a clear message if any of these fail:
 3. Determine base branch: try `main`, fall back to `master`. If neither exists, stop.
 4. `git log <base>..HEAD --oneline` — if empty, stop ("nothing to PR").
 5. `gh pr view --json url,state` on the current branch — if a PR already exists, print its URL and stop. Do NOT create a duplicate.
-6. `git status --porcelain` — if there are uncommitted changes, warn me but do NOT commit them.
+6. `git status --porcelain` — if there are uncommitted changes, warn the user but do NOT commit them.
+7. Verify the branch is on the remote with `gh api repos/{owner}/{repo}/branches/<current-branch>` (or equivalent) — if it 404s, stop and tell the user to push first. Do NOT push for them.
 
 ## Generate
 
@@ -38,16 +39,19 @@ Run `git diff <base>...HEAD` and `git log <base>..HEAD --oneline`, then produce:
 
 ## Confirm
 
-Show me the title and body in two separate fenced code blocks. Then ASK explicitly: `Open this PR? (yes / edit / cancel)`. Wait for my reply. Do NOT push or create the PR without my confirmation.
+Show the user the title and body in two separate fenced code blocks. Then call the `AskUserQuestion` tool with the question `Open this PR?` and these three options (in this exact order):
 
-If I say "edit", let me edit, then re-confirm.
+1. `Open PR (Recommended)` — proceeds to the Create step.
+2. `Edit first` — let the user edit the title/body, then re-confirm.
+3. `Cancel` — stop without creating the PR.
+
+Do NOT create the PR without an affirmative answer from `AskUserQuestion`.
 
 ## Create
 
 On confirmation:
 
-1. Push the branch with `git push -u origin <current-branch>` (skip if `git status -sb` shows the branch is already published and up to date).
-2. Run `gh pr create --base <base> --title "<title>" --body "$(cat <<'EOF' ... EOF)"` — pass the body via heredoc so newlines survive. Add `--draft` if requested.
-3. Print the PR URL that `gh` returns.
+1. Run `gh pr create --base <base> --title "<title>" --body "$(cat <<'EOF' ... EOF)"` — pass the body via heredoc so newlines survive. Add `--draft` if requested.
+2. Print the PR URL that `gh` returns.
 
-Do not commit on my behalf. Do not push without confirmation. Do not skip the confirmation step.
+Do not commit on the user's behalf. Do not push under any circumstances — the user pushes the branch before invoking this command. Do not skip the confirmation step.

apps/operator/package.json

@@ -18,23 +18,23 @@
     "@repo/http-client": "workspace:*",
     "@repo/logger": "workspace:*",
     "drizzle-orm": "0.45.2",
-    "hono": "4.12.9",
+    "hono": "4.12.12",
     "node-html-markdown": "2.0.0",
-    "openai": "6.33.0",
+    "openai": "6.34.0",
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "4.20260317.1",
+    "@cloudflare/workers-types": "4.20260412.1",
     "@repo/eslint": "workspace:*",
     "@repo/prettier": "workspace:*",
     "@repo/typescript": "workspace:*",
-    "@types/node": "25.2.3",
+    "@types/node": "25.6.0",
     "drizzle-kit": "0.31.10",
     "eslint": "9.39.1",
-    "prettier": "3.8.1",
+    "prettier": "3.8.2",
     "tsx": "4.21.0",
-    "typescript": "5.9.3",
-    "vitest": "4.1.2",
-    "wrangler": "4.78.0"
+    "typescript": "6.0.2",
+    "vitest": "4.1.4",
+    "wrangler": "4.81.1"
   }
 }

package.json

@@ -21,7 +21,7 @@
   "devDependencies": {
     "@ianvs/prettier-plugin-sort-imports": "4.7.1",
     "@repo/prettier": "workspace:*",
-    "prettier": "3.8.1",
+    "prettier": "3.8.2",
     "prettier-plugin-tailwindcss": "0.7.2"
   }
 }

packages/http-client/package.json

@@ -21,9 +21,9 @@
     "@repo/prettier": "workspace:*",
     "@repo/typescript": "workspace:*",
     "eslint": "9.39.1",
-    "prettier": "3.8.1",
-    "typescript": "5.9.3",
-    "vitest": "4.1.2"
+    "prettier": "3.8.2",
+    "typescript": "6.0.2",
+    "vitest": "4.1.4"
   },
   "prettier": "@repo/prettier"
 }

packages/logger/package.json

@@ -17,9 +17,9 @@
     "@repo/prettier": "workspace:*",
     "@repo/typescript": "workspace:*",
     "eslint": "9.39.1",
-    "prettier": "3.8.1",
-    "typescript": "5.9.3",
-    "vitest": "4.1.2"
+    "prettier": "3.8.2",
+    "typescript": "6.0.2",
+    "vitest": "4.1.4"
   },
   "prettier": "@repo/prettier"
 }