chore(deps): October dependency refresh (#2557)

[cliffhall]

Closes #2557

The October dependency refresh, trimmed to what earns its place. The full reasoning — including everything deliberately not taken and when to revisit each — is in the analysis on #2557, written so next month's sweep can reuse it.

npm audit showed zero advisories on the previous versions, so nothing here is a security fix.

Commit 1: in-range refresh

• Every "wanted" (in-range) bump across root, web, tui, cli and mcpdo, applied with targeted npm update <pkg …>. A bare npm update re-resolved transitives and hoisted ajv 6 / typescript 6 / commander 4 into client installs, so it was reverted. Peer and transitive copies (eslint, react, zod) were then aligned so verify:dep-lockstep passes.
• web overrides["@types/node"]: "^24.12.4": @types/express depends on @types/node: *, so web's copy floated to 26.x. This is the same pin clients/cli already carries.
• ink-form 2.0.2 fixes the "competed" typo upstream (Typo in the incomplete-form hint: "competed" should be "completed" lukasbach/ink-form#14). The TUI's build-time label patch is designed to fail once the typo is gone, and it did. This removes the patch, its tests and its README section, and raises the floor to ^2.0.2 so no install resolves the misspelled release.

Commit 2: two majors

• @napi-rs/keyring 1 → 2. v1 resolved a locked, inaccessible or permission-denied keychain as null/false, the same result as "nothing stored". core/auth/node/secret-store.ts was written assuming those failures throw (getStrict, probeKeyringAvailable, delete), and v2 makes that true. The API surface is unchanged. The tests mock the binding, so I also ran a real set/get/find/delete round trip against the macOS keychain on 2.1.1.
• commander 13 → 15 (14 is now maintenance-only). It is ESM-only and needs Node ≥22.12, both fine for us. Its --no-* default change only affects paired options, and our one --no-revoke is unpaired. This also moves mcpdo's overrides.sucrase.commander, which keeps sucrase's copy on the root's major.

Not in this PR

prettier 3.9, pino 10, jest-dom 7, happy-dom 21, @dnd-kit/sortable 10, vitest 5, Mantine 9, ink 7/8, chokidar 5, open 11, TypeScript 7, @types/node 26, and the claude-code-action pin. Each one's reason is in the #2557 analysis. Vitest 5 is the notable one: it silently cut web coverage from 418 files to 11 while the gate stayed green, which is now #2709.

Verification

npm run local:gate is green on this exact HEAD: all suites, coverage, smokes (chromium + firefox), Storybook 123/123, verify:dep-lockstep OK. Coverage file counts were checked against the expected scope: web 419, cli 20, tui 41, mcpdo 31, launcher 1.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Broad lockfile churn and two runtime major upgrades, including a native dependency, warrant final human review.

0 open findings

What changed in this PR

Refreshes October dependencies while preserving lockstep across Inspector clients.

Changes:

• Applies targeted in-range dependency updates.
• Upgrades keyring and Commander majors.
• Removes the obsolete ink-form typo patch.

File	Description
package.json	Raises keyring and Commander ranges.
package-lock.json	Resolves root dependency updates.
clients/​web/​package.json	Pins Node types to major 24.
clients/​tui/​tsup.config.ts	Removes the obsolete label patch.
clients/​tui/​README.md	Removes patch documentation.
clients/​tui/​package.json	Raises the ink-form floor.
clients/​tui/​package-lock.json	Resolves TUI updates.
clients/​tui/​__tests__/​tsupConfig.test.ts	Removes patch-specific tests.
clients/​mcpdo/​package.json	Aligns Commander override.
clients/​mcpdo/​package-lock.json	Resolves mcpdo updates.
clients/​cli/​package-lock.json	Aligns Node type packages.

Files not reviewed (4)

• clients/cli/package-lock.json: Generated file
• clients/mcpdo/package-lock.json: Generated file
• clients/tui/package-lock.json: Generated file
• clients/web/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[cliffhall]

Copilot review loop closed after round 1: clean (0 findings, no inline comments, no suppressed comments). The round's headline flags the broad lockfile churn and the two runtime majors, including the native @napi-rs/keyring, for final human review. Both are covered in the PR body and the #2557 analysis, including the real-keychain round trip on keyring 2.1.1.

[cliffhall]

✅ Verdict: mergeable

Smoke tested at 4442499f. Every check passed, nothing blocks merge, and the PR merges cleanly onto current v2/main (ae4bca46). There is one note at the bottom; it doesn't block.

Setup

I made a fresh worktree and ran a root npm install, then npm run build. Both exited 0. The only install warning is the known server-legacy deprecation (#2519). The installed versions are what this PR claims: commander 15.0.0, @napi-rs/keyring 2.1.1, and ink-form 2.0.2. ink-form is installed only in clients/tui.

Smoke suites (host: macOS 27, Node 26.10)

Suite	Result
smoke:launcher	✅ Mode dispatch; --version / -V in every mode
smoke:cli	✅ Catalog/config, headers, JSON error envelopes, exit codes 1 and 3
smoke:mcpdo	✅ connect → call → elicitation park/resume → disconnect → daemon stop
smoke:tui	✅ Rendered in 196 ms and stayed up
smoke:web + :chromium + :tabs	✅ Boot, MCP App via sandbox proxy plus a dedicated origin, elicitation, Tools/Resources/Prompts
smoke:web:firefox (Docker, #2625)	✅ browser, app, elicit

Targeted checks on what the PR changes

commander 13 → 15 (cli, mcpdo, launcher)

• One-shot CLI over stdio: tools/list and tools/call work, --tool-arg handles variadic pairs, and repeated -e works.
• --no-revoke without --relogin still gives its intended usage error, so the unpaired negation still parses as false.
• allowUnknownOption() still applies, and the PR doesn't change it.
• mcpdo:
  • HTTP connects with the modern era (2026-07-28) and stdio connects with the legacy era.
  • --connection and --conn both work.
  • --format json and --plain both work.
  • connections/list and connections/show work.
  • A tool error returns exit 5.
  • An unknown option or command fails with the usage envelope.
  • Disconnect works.

@napi-rs/keyring 1 → 2

• I ran the real KeyringSecretStore against the macOS login keychain, using a throwaway server ID that I cleaned up afterwards.
• These all behave correctly:
  • the probe reports the keychain available
  • an absent entry returns null from both get and getStrict
  • set followed by get returns the value
  • an empty-string value round-trips
  • delete works, and deleting a missing entry doesn't throw
  • deleteAllForServer works
• The host web smokes report Secrets: OS keychain.
• Inside the Linux Docker Firefox run there is no Secret Service, and it degrades to Memory … fell back from the OS keychain as designed.

ink-form 2.0.2 / patch removal

• The built TUI bundle has 0 hits for the old "not competed yet" typo and 1 for upstream's "not completed yet".
• The ^2.0.2 floor is what now stops a misspelled release from being resolved.

Dependency hygiene

• verify:dep-lockstep passes: 2 install-crossing and 19 declared packages agree across 6 installs.
• verify:bundle-externals passes.
• npm audit reports 0 vulnerabilities at every severity in root, web, cli, tui and mcpdo.

Note (not blocking)

This branch was cut before #2711 merged, so its CI never ran the new verify:coverage-scope guard. Your manual counts (web 419, cli 20, tui 41, mcpdo 31, launcher 1) are what that guard enforces, and this PR doesn't touch vitest or the coverage config. The guard will run for real on the first v2/main CI after merge.