chore(deps-dev): bump the tooling group across 1 directory with 3 updates

.agents/skills/pr-visual-evidence/SKILL.md

@@ -1,10 +1,7 @@
 ---
+
 name: pr-visual-evidence
-description:
-  'Create requested PR visual evidence for Roamgate: a leading screenshot and
-  scripted video for animation, transitions, or multi-step interactions. Use
-  when the user requests PR screenshots, before/after, video evidence, or visual
-  guidance. UI changes alone do not require capture or upload.'
+description: "Create requested PR visual evidence for Roamgate: a leading screenshot and scripted video for animation, transitions, or multi-step interactions. Use when the user requests PR screenshots, before/after, video evidence, or visual guidance. UI changes alone do not require capture or upload."
 ---
 
 # Roamgate PR visual evidence
@@ -24,12 +21,12 @@ Read the diff and identify the visible behavior to prove. A backend, CI, docs,
 or tooling change that renders identically needs no image. For visible changes,
 choose the smallest relevant case:
 
-| Roamgate change | Evidence |
-| --- | --- |
-| Layout, theme, copy, file preview or diff rendering | Focused screenshot; labeled before/after when comparison helps. |
-| Dialog, menu, inspector resize, terminal composer or multi-step workflow | Screenshot of the result plus a scripted video of the interaction. |
-| Terminal streaming, connection recovery, agent history or Ranger state | Real Herdr-backed state; preserve relevant loading and reconnect behavior. |
-| Mobile layout or keyboard behavior | Narrow viewport capture; real device verification for platform keyboard, IME, and touch behavior. |
+| Roamgate change                                                          | Evidence                                                                                          |
+| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
+| Layout, theme, copy, file preview or diff rendering                      | Focused screenshot; labeled before/after when comparison helps.                                   |
+| Dialog, menu, inspector resize, terminal composer or multi-step workflow | Screenshot of the result plus a scripted video of the interaction.                                |
+| Terminal streaming, connection recovery, agent history or Ranger state   | Real Herdr-backed state; preserve relevant loading and reconnect behavior.                        |
+| Mobile layout or keyboard behavior                                       | Narrow viewport capture; real device verification for platform keyboard, IME, and touch behavior. |
 
 Keep evidence on the PR's current revision. Record the commit, any uncommitted
 changes, route, browser, viewport, and scenario with the local artifacts. Do not

.github/copilot-instructions.md

@@ -3,7 +3,6 @@
 ## Project overview
 
 Roamgate is an independent community Web and PWA client for Herdr. It has two parts:
-
 - `server/src`: Bun-powered local bridge server (HTTP + WebSocket) that talks
   to the local Herdr socket.
 - `web/src`: React + Vite frontend. Reusable UI lives in `web/src/components`,
@@ -19,7 +18,6 @@ build artifacts; they must not be edited or committed.
 ## Review priorities
 
 When reviewing pull requests, focus on:
-
 - Correctness of the Bun bridge: HTTP/WebSocket message handling, socket
   lifecycle, reconnection and error paths, and cleanup of listeners, timers,
   and subprocesses.
@@ -50,7 +48,6 @@ Install all workspace dependencies once with `bun install --frozen-lockfile`
 from the repo root. The root `bun.lock` is authoritative.
 
 Changes are expected to pass, from the repo root:
-
 - `bun run format:check`
 - `bun run lint`
 - `bun run test`

.github/dependabot.yml

@@ -1,63 +1,63 @@
 version: 2
 
 updates:
-    - package-ecosystem: bun
-      directory: /
-      schedule:
-          interval: weekly
-          day: monday
-          time: "06:00"
-          timezone: Etc/UTC
-      open-pull-requests-limit: 5
-      # Bun groups use package patterns, not unsupported dependency-type filters.
-      # Major upgrades stay separate except for coupled React and xterm families.
-      groups:
-          codemirror:
-              patterns: ["@codemirror/*", "@lezer/*", "codemirror"]
-              update-types: [minor, patch]
-          syntax-highlighting:
-              patterns: ["@shikijs/*", "shiki"]
-              update-types: [minor, patch]
-          diff-highlighting:
-              patterns: ["diff2html", "highlight.js"]
-              update-types: [minor, patch]
-          radix-ui:
-              # cmdk shares Radix primitives with the popover runtime.
-              patterns: ["@radix-ui/*", "cmdk"]
-              update-types: [minor, patch]
-          react:
-              # Runtime, DOM renderer, and types must move together, including majors.
-              # Keep manual review for compatibility and bundle size; never auto-merge.
-              patterns: ["react", "react-dom", "@types/react", "@types/react-dom"]
-          xterm-core-fit:
-              # No update-types filter: same-core beta bumps are neither minor
-              # nor patch to Dependabot. Review this coupled pair together,
-              # including any future major upgrades; never auto-merge it.
-              patterns: ["@xterm/xterm", "@xterm/addon-fit"]
-          xterm-addons:
-              patterns: ["@xterm/*"]
-              exclude-patterns: ["@xterm/xterm", "@xterm/addon-fit"]
-              update-types: [minor, patch]
-          tooling:
-              patterns:
-                  - "@biomejs/*"
-                  - "@vitejs/*"
-                  - "bun-types"
-                  - "happy-dom"
-                  - "oxlint"
-                  - "typescript"
-                  - "vite"
-              update-types: [minor, patch]
+  - package-ecosystem: bun
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    # Bun groups use package patterns, not unsupported dependency-type filters.
+    # Major upgrades stay separate except for coupled React and xterm families.
+    groups:
+      codemirror:
+        patterns: ["@codemirror/*", "@lezer/*", "codemirror"]
+        update-types: [minor, patch]
+      syntax-highlighting:
+        patterns: ["@shikijs/*", "shiki"]
+        update-types: [minor, patch]
+      diff-highlighting:
+        patterns: ["diff2html", "highlight.js"]
+        update-types: [minor, patch]
+      radix-ui:
+        # cmdk shares Radix primitives with the popover runtime.
+        patterns: ["@radix-ui/*", "cmdk"]
+        update-types: [minor, patch]
+      react:
+        # Runtime, DOM renderer, and types must move together, including majors.
+        # Keep manual review for compatibility and bundle size; never auto-merge.
+        patterns: ["react", "react-dom", "@types/react", "@types/react-dom"]
+      xterm-core-fit:
+        # No update-types filter: same-core beta bumps are neither minor
+        # nor patch to Dependabot. Review this coupled pair together,
+        # including any future major upgrades; never auto-merge it.
+        patterns: ["@xterm/xterm", "@xterm/addon-fit"]
+      xterm-addons:
+        patterns: ["@xterm/*"]
+        exclude-patterns: ["@xterm/xterm", "@xterm/addon-fit"]
+        update-types: [minor, patch]
+      tooling:
+        patterns:
+          - "@biomejs/*"
+          - "@vitejs/*"
+          - "bun-types"
+          - "happy-dom"
+          - "oxlint"
+          - "typescript"
+          - "vite"
+        update-types: [minor, patch]
 
-    - package-ecosystem: github-actions
-      directory: /
-      schedule:
-          interval: weekly
-          day: monday
-          time: "06:30"
-          timezone: Etc/UTC
-      open-pull-requests-limit: 3
-      groups:
-          actions:
-              patterns: ["*"]
-              update-types: [minor, patch]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/ci.yml

@@ -1,27 +1,27 @@
 name: CI
 
 on:
-    pull_request:
-    workflow_dispatch:
+  pull_request:
+  workflow_dispatch:
 
 permissions:
-    contents: read
+  contents: read
 
 jobs:
-    validate:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-              with:
-                  persist-credentials: false
-            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-              with:
-                  bun-version: "1.4.4"
-                  no-cache: true
-            - run: bun install --frozen-lockfile
-            - run: bun run format:check
-            - run: bun run lint
-            - run: bun run typecheck
-            - run: bun run typecheck:bun
-            - run: bun run build:site
-            - run: bun run test:quick
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.4.4"
+          no-cache: true
+      - run: bun install --frozen-lockfile
+      - run: bun run format:check
+      - run: bun run lint
+      - run: bun run typecheck
+      - run: bun run typecheck:bun
+      - run: bun run build:site
+      - run: bun run test:quick

.github/workflows/codeql.yml

@@ -1,43 +1,43 @@
 name: CodeQL
 
 on:
-    pull_request:
-        branches: [main]
-    push:
-        branches: [main]
-    schedule:
-        - cron: "23 4 * * 1"
-    workflow_dispatch:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
 
 permissions: {}
 
 concurrency:
-    group: codeql-${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-    analyze:
-        name: Analyze (${{ matrix.language }})
-        runs-on: ubuntu-latest
-        timeout-minutes: 30
-        permissions:
-            contents: read
-            security-events: write
-        strategy:
-            fail-fast: false
-            matrix:
-                language: [javascript-typescript, actions]
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-              with:
-                  persist-credentials: false
-            # Neither language needs a build or dependency installation. Keep
-            # untrusted PR code out of executable steps in this upload job.
-            - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
-              with:
-                  languages: ${{ matrix.language }}
-                  build-mode: none
-            # The default query suite is used for both languages.
-            - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
-              with:
-                  category: "/language:${{ matrix.language }}"
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      # Neither language needs a build or dependency installation. Keep
+      # untrusted PR code out of executable steps in this upload job.
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      # The default query suite is used for both languages.
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dependency-audit.yml

@@ -1,37 +1,37 @@
 name: Dependency Audit
 
 on:
-    pull_request:
-        paths:
-            - "**/package.json"
-            - "bun.lock"
-            - "**/bunfig.toml"
-            - "**/.npmrc"
-            - ".github/workflows/dependency-audit.yml"
-    schedule:
-        - cron: "41 4 * * 1"
-    workflow_dispatch:
+  pull_request:
+    paths:
+      - "**/package.json"
+      - "bun.lock"
+      - "**/bunfig.toml"
+      - "**/.npmrc"
+      - ".github/workflows/dependency-audit.yml"
+  schedule:
+    - cron: "41 4 * * 1"
+  workflow_dispatch:
 
 permissions:
-    contents: read
+  contents: read
 
 concurrency:
-    group: dependency-audit-${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
+  group: dependency-audit-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-    audit:
-        runs-on: ubuntu-latest
-        timeout-minutes: 10
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-              with:
-                  persist-credentials: false
-            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-              with:
-                  bun-version: "1.4.4"
-                  no-cache: true
-            # Audit the lockfile directly, including dev dependencies, without
-            # installing packages or running lifecycle scripts. JSON retains
-            # lower-severity findings; high/critical findings fail the job.
-            - run: bun audit --json --audit-level=high
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.4.4"
+          no-cache: true
+      # Audit the lockfile directly, including dev dependencies, without
+      # installing packages or running lifecycle scripts. JSON retains
+      # lower-severity findings; high/critical findings fail the job.
+      - run: bun audit --json --audit-level=high