Skip to content

chore(deps): bump the cargo group across 1 directory with 47 updates - #10

Closed
dependabot[bot] wants to merge 2293 commits into
mainfrom
dependabot/cargo/cargo-19ac277467
Closed

chore(deps): bump the cargo group across 1 directory with 47 updates#10
dependabot[bot] wants to merge 2293 commits into
mainfrom
dependabot/cargo/cargo-19ac277467

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown

Bumps the cargo group with 47 updates in the / directory:

Package From To
anyhow 1.0.100 1.0.104
async-trait 0.1.89 0.1.92
axum 0.8.8 0.8.9
chrono 0.4.44 0.4.45
clap 4.5.54 4.5.60
clap_complete 4.5.65 4.6.9
reqwest 0.13.1 0.13.4
rig-core 0.39.0 0.42.0
rusqlite 0.32.1 0.40.2
serde 1.0.228 1.0.229
serde_json 1.0.150 1.0.151
thiserror 2.0.18 2.0.20
tokio 1.52.3 1.53.1
toml 0.9.11+spec-1.1.0 1.0.6+spec-1.1.0
sha2 0.10.9 0.11.0
ignore 0.4.25 0.4.32
tree-sitter 0.25.10 0.26.12
tower-http 0.6.8 0.7.0
tracing-appender 0.2.4 0.2.5
uuid 1.19.0 1.25.0
futures-util 0.3.32 0.3.34
tokio-util 0.7.18 0.7.19
flate2 1.1.5 1.1.9
libc 0.2.186 0.2.189
regex 1.12.2 1.13.1
shlex 1.3.0 2.0.1
similar 2.7.0 3.2.0
tempfile 3.24.0 3.27.0
tokio-tungstenite 0.28.0 0.29.0
shellexpand 3.1.1 3.1.2
tower 0.5.2 0.5.3
inventory 0.3.21 0.3.24
base64 0.22.1 0.23.1
pdf-extract 0.7.12 0.12.0
objc2 0.6.3 0.6.4
schemaui 0.12.0 0.12.4
colored 3.0.0 3.1.1
crossterm 0.28.1 0.29.0
ratatui 0.30.0 0.30.2
rustyline 15.0.0 17.0.2
schemars 1.2.1 1.2.2
unicode-width 0.2.0 0.2.2
unicode-segmentation 1.12.0 1.13.3
zeroize 1.8.2 1.9.0
image 0.25.9 0.25.10
windows 0.60.0 0.62.2
vt100 0.15.2 0.16.2

Updates anyhow from 1.0.100 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

  • Update syn dev-dependency to version 3

1.0.103

  • Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

1.0.102

1.0.101

Commits
  • 1dbe186 Release 1.0.104
  • f6479f8 Update to syn 3
  • 5bdb0e2 Release 1.0.103
  • e621bd3 Merge pull request #452 from dtolnay/downcast
  • 6e8c000 Eliminate pointer->reference->pointer during downcast
  • 67c4abd Add regression test for issue 451
  • 917a169 Update actions/upload-artifact@v6 -> v7
  • d9dc3fa Update actions/checkout@v6 -> v7
  • 841522b Raise minimum tested compiler to rust 1.85
  • 5c657b3 Release 1.0.102
  • Additional commits viewable in compare view

Updates async-trait from 0.1.89 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

  • Resolve double_must_use clippy lint in generated code (#303)

0.1.91

  • Update to syn 3 (#299)
  • Fix mutability for by-reference receivers (#301)

0.1.90

(yanked)

Commits
  • 82e7e9e Release 0.1.92
  • 9a35cb8 Merge pull request #303 from dtolnay/mustuse
  • 875ceec Resolve double_must_use clippy lint
  • 62993a5 Raise minimum tested compiler to rust 1.88
  • d049ee0 Release 0.1.91
  • 7a0961f Merge pull request #301 from dtolnay/mutability
  • 740f86f Ignore mut_mut pedantic clippy lint in test
  • 4699cd3 Fix mutability for by-reference receivers
  • 6dd3573 Add regression test for issue 300
  • 2371797 Release 0.1.90
  • Additional commits viewable in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

Commits
  • 1703382 Prepare 0.4.45 release
  • 881f9ab tz_data: fix tzdata locations on Android
  • f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
  • c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
  • 120686c Bump codecov/codecov-action from 5 to 6
  • See full diff in compare view

Updates clap from 4.5.54 to 4.5.60

Release notes

Sourced from clap's releases.

v4.5.60

[4.5.60] - 2026-02-19

Fixes

  • (help) Quote empty default values, possible values

v4.5.59

[4.5.59] - 2026-02-16

Fixes

  • Command::ignore_errors no longer masks help/version on subcommands

v4.5.58

[4.5.58] - 2026-02-11

v4.5.57

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)

v4.5.56

[4.5.56] - 2026-01-29

Fixes

  • On conflict error, don't show conflicting arguments in the usage

v4.5.55

[4.5.55] - 2026-01-27

Fixes

  • Fix inconsistency in precedence between positionals with a value_terminator("--") and escapes (--) where ./foo -- bar means the first arg is empty, rather than escaping future args
Changelog

Sourced from clap's changelog.

[4.5.60] - 2026-02-19

Fixes

  • (help) Quote empty default values, possible values

[4.5.59] - 2026-02-16

Fixes

  • Command::ignore_errors no longer masks help/version on subcommands

[4.5.58] - 2026-02-11

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)

[4.5.56] - 2026-01-29

Fixes

  • On conflict error, don't show conflicting arguments in the usage

[4.5.55] - 2026-01-27

Fixes

  • Fix inconsistency in precedence between positionals with a value_terminator("--") and escapes (--) where ./foo -- bar means the first arg is empty, rather than escaping future args
Commits
  • 33d24d8 chore: Release
  • 9332409 docs: Update changelog
  • b7adce5 Merge pull request #6166 from fabalchemy/fix-dynamic-powershell-completion
  • 009bba4 fix(clap_complete): Improve powershell registration
  • d89d57d chore: Release
  • f18b67e docs: Update changelog
  • 9d218eb Merge pull request #6165 from epage/shirt
  • 126440c fix(help): Correctly calculate padding for short-only args
  • 9e3c05e test(help): Show panic with short, valueless arg
  • c9898d0 test(help): Verify short with value
  • Additional commits viewable in compare view

Updates clap_complete from 4.5.65 to 4.6.9

Release notes

Sourced from clap_complete's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Commits
  • 715b812 chore: Release
  • 89e6e9b docs: Update changelog
  • 3918cb4 Merge pull request #6468 from sjh9714/fix-bash-posix-fn-name
  • 526c819 Merge pull request #6469 from latent-9/docs/fix-derive-reference-link
  • b2bd685 docs(clap_derive): Fix derive reference link
  • ecee8a4 fix(complete): Name the function after fn_name
  • 6dd2e5a test(complete): Show POSIX bash will not source
  • 4684d7a chore: Release
  • 51d50ad docs: Update changelog
  • 3bc3622 Merge pull request #6457 from bl4ck4t/master
  • Additional commits viewable in compare view

Updates reqwest from 0.13.1 to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

v0.13.3

tl;dr

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.4

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

v0.13.3

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

  • Fix HTTP/2 and native-tls ALPN feature combinations.
  • Fix HTTP/3 to send h3 ALPN.
  • (wasm) fix RequestBuilder::json() from override previously set content-type.
Commits
  • 11489b3 v0.13.4
  • d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
  • 79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
  • fb7bf6a fix: remove unwrap in hickory initialization (#3041)
  • 3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
  • c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
  • 9cbb65b chore: clean up minimal-versions CI job (#3039)
  • 17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
  • 03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
  • 4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
  • Additional commits viewable in compare view

Updates rig-core from 0.39.0 to 0.42.0

Changelog

Sourced from rig-core's changelog.

0.42.0 - 2026-08-17

Added

Fixed

Other

... (truncated)

Commits
  • d5a3498 chore(release): publish v0.42.0 from main, including everything merged since ...
  • 9f74bbc chore(deps): lower dependency floors to what rig needs and stop raising them ...
  • 93b1fd0 chore(deps): bump redis from 1.2.1 to 1.5.0 (#2361)
  • 4487ba2 feat(agent): restore raw provider response access at the agent level, on both...
  • 2da0303 chore: release v0.42.0 (#2221)
  • 57b4ad2 fix(providers): survive truncated tool calls and preserve DeepSeek wire data ...
  • d525224 fix(doubleword): report the embedding width Doubleword actually returns (#2356)
  • 8ea03a2 fix(openrouter): surface chat-completions refusals, and map the reasoning sha...
  • 4232abd docs: reconcile the changelogs and the migration guide with what actually mer...
  • 854b765 fix(rig): exclude test cassettes from the published crate (#2350)
  • Additional commits viewable in compare view

Updates rusqlite from 0.32.1 to 0.40.2

Release notes

Sourced from rusqlite's releases.

0.40.2

What's Changed

  • Lower MSRV to 1.88.0

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.40.2

0.40.1

What's Changed

  • Fix clippy warnings #1852
  • Bump bundled SQLite version to 3.53.2 #1853
  • Bump hashlink version #1855
  • Fix SQL injection when SAVEPOINT name is tainted #1854

Full Changelog: rusqlite/rusqlite@v0.40.0...v0.40.1

0.40.0

What's Changed

  • Breaking changes: Replace VTab macros by constructors #1823
  • Breaking changes: Fix VTab::best_index #1824
  • Asserts on VTab::connect aux and args #1825
  • Breaking changes: Fix VTab::connect / create #1826
  • Breaking changes: Allow opting out of using sqlite-wasm-rs on wasm32-unknown-unknown #1828, #1829
  • Derive Default for SeriesTabCursor/ArrayTabCursor #1830
  • Update link to pre-update hook #1831
  • Breaking changes: Fix VTab::connect #1832
  • impl From for FromSqlError #1833
  • Breaking changes: Fix vtab::dequote #1835
  • Bump bundled SQLCipher to version 4.14.0 #1837
  • sqlite3_set_errmsg #1752
  • Bump sqlite3-parser version #1838
  • Fix UB in ToSqlOutput::from_rc #1839
  • Ensure miri doesn't complain #1840
  • Bump to actions/checkout@v6 #1842
  • Add support to UtcDateTime #1843, #1844
  • Bump bundled SQLite version to 3.53.1 #1848
  • Replace some cfg(not by cfg_select #1850

Full Changelog: rusqlite/rusqlite@v0.39.0...v0.40.0

0.39.0

What's Changed

  • Fix constraints on VTab Aux data #1778, #1771
  • Fix docs.rs generation #1779
  • Fix a small typo in rollback_hook docstring #1780
  • Fix some warnings from Intellij #1781
  • Minimal doc for features #1783
  • Clear hooks only for owning connections #1785, #1784
  • Fix link to SQLite C Interface, Prepare Flags #1787
  • Comment functions which are not usable from a loadable extension #1789
  • Factorize code #1792

... (truncated)

Commits

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates thiserror from 2.0.18 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)

2.0.19

  • Update to syn 3
Commits
  • b1d5db5 Release 2.0.20
  • c4c3ebd Merge pull request #454 from dtolnay/clippy
  • 2266152 Suppress redundant_field_names clippy lint
  • 2901cfd Raise minimum tested compiler to rust 1.88
  • aa9d91f Update ui tests for version 2.0.19
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

…untime

Move the cycle checkpoint-restart primitives (CycleConfig, ModelCycleConfig,
CycleBriefing, CycleArchiveHeader), the briefing pipeline (produce_briefing,
extract_carry_forward, enforce_briefing_cap, estimate_briefing_tokens,
build_seed_messages, should_advance_cycle), and the archive IO
(archive_cycle, open_archive, ArchiveMessageReader) from the tui binary
crate into codesmith-agent-runtime. 22 tests migrate with the code.

StructuredState stays in the tui because its snapshot sources
(SharedTodoList/SharedPlanState/SharedSubAgentManager/WorkingSet) are still
tui-local; the tui keeps a thin re-export shim plus StructuredState and its
2 tests. This unblocks the Event type (CycleBriefing dependency) for the
next Op/Event migration chunk.

Also copies prompts/cycle_handoff.md into agent-runtime for the
include_str! in produce_briefing, and reconciles Cargo.lock with the
uuid/shellexpand deps added to agent-runtime's Cargo.toml in an earlier
chunk.
Move BackgroundTaskType, BackgroundTaskStatus (enum + is_terminal),
BackgroundTaskNotification, BackgroundTaskSummary, and
format_notification_message from the tui binary crate into
codesmith-agent-runtime. 2 tests migrate with the code.

The From<ShellStatus>/From<SubAgentStatus> impls stay in the tui (orphan
rule: ShellStatus/SubAgentStatus are tui-local, so the impls on the
agent-runtime BackgroundTaskStatus remain valid in tui). The registry,
BackgroundTaskState/Extension (SubAgentType dep), and StallPattern/PollResult
also stay tui-local. The tui keeps a thin re-export shim. This unblocks the
Event type's background_task dependencies for the next Op/Event chunk.
Move the shared request_user_input payload types (UserInputOption,
UserInputQuestion, UserInputRequest + from_value/validate, UserInputAnswer,
UserInputResponse) from tui::tools::user_input into a new
agent-runtime::user_input module so the engine and host UI validate the
same shape. The tui file becomes a shim re-exporting the types and
keeping the TUI-local RequestUserInputTool ToolSpec impl + its test.

agent-runtime gains 2 tests (validates_request_shape,
rejects_too_many_questions); tui keeps tool_spec_validate_input_uses_request_shape.
Move IdleReason and InboxDispatch from tui::tools::team into a new
agent-runtime::team module so the engine (which consumes dispatch items)
and the TUI inbox poller (which produces them) share the same types.
The TUI keeps pub-use re-exports at the historical teammate_mailbox and
inbox_pollbox paths, so all crate::tools::team::{IdleReason,InboxDispatch}
references resolve unchanged.
Move CompactionConfig (struct + Default impl), MINIMUM_AUTO_COMPACTION_TOKENS,
and DEFAULT_TEXT_MODEL from tui into a new agent-runtime::compaction module so
the engine can reference CompactionConfig without depending on the TUI. The
TUI re-exports CompactionConfig/MINIMUM_AUTO_COMPACTION_TOKENS at
crate::compaction and DEFAULT_TEXT_MODEL at crate::config, so all 38
historical references resolve unchanged. The compaction implementation
(summary building, partial/micro compaction, etc.) stays in the TUI for now.
Move SubAgentType (enum + from_str/as_str/system_prompt/allowed_tools
impls), SubAgentStatus, and SubAgentAssignment from tui::tools::subagent
into a new agent-runtime::subagent module, including the per-type prompt
intro consts and the subagent_output_format.md prompt file (copied via
include_str!). The TUI keeps a pub-use re-export at the historical path
and the sub-agent implementation (spawn orchestration, result aggregation)
stays in the TUI for now.

The From<SubAgentStatus> for BackgroundTaskStatus impl moves to
agent-runtime::background_task (both types are now runtime-local, so the
orphan rule requires it to live there); it is globally available to the
TUI without re-export. SubAgentAssignment::new is widened to pub so TUI
call sites still construct it through the re-export.
…time

Move AgentMemoryScope (enum + as_str/Display/FromStr), AgentMemoryMetadata
(struct), and SubAgentResult from the TUI into agent-runtime::subagent so the
Event protocol can carry sub-agent results without a TUI dependency. A private
is_false helper moves alongside SubAgentResult for its serde skip attribute.

The TUI keeps pub-use re-exports at crate::agent_memory and
crate::tools::subagent, so AgentMemoryRequest, ResolvedAgentMemory, and the
From<&ResolvedAgentMemory> for AgentMemoryMetadata impl (which stays in the
TUI by the orphan rule) all resolve unchanged.
Move the full mailbox.rs (MailboxMessage enum, MailboxEnvelope, Mailbox,
MailboxInner, MailboxReceiver, SharedMailbox) from tui to
codesmith-agent-runtime, leaving a `pub use ...::*` re-export shim in
tui so existing `crate::tools::subagent::mailbox` references resolve.

Constructor helpers (started/progress/token_usage) widened from
pub(crate) to pub so the cross-crate TUI consumer can still build
messages. `use super::SubAgentType` becomes `use crate::subagent::SubAgentType`
and `crate::models::Usage` resolves via the agent-runtime re-export.

This unblocks the Op/Event migration: Event::SubAgentMailbox references
MailboxMessage, which now lives in the runtime.

Tests: agent-runtime mailbox (8) + tui mailbox/team (16) all green.
Move the `Op` and `CompactMode` enums from `tui/src/core/ops.rs` to
`codesmith-agent-runtime` as a new `ops` module, leaving a
`pub use codesmith_agent_runtime::ops::*` re-export shim in the TUI so
existing `crate::core::ops::{Op, CompactMode}` references resolve.

Import rewiring for the runtime home:
- `crate::tui::app::AppMode` / `crate::tui::approval::ApprovalMode`
  -> `crate::mode::{AppMode, ApprovalMode}` (already in the runtime)
- `Op::TeamInboxDispatch`'s `crate::tools::team::InboxDispatch`
  -> `crate::team::InboxDispatch`
- `crate::compaction::CompactionConfig` and `crate::models::{Message,
  SystemPrompt}` resolve unchanged via existing runtime modules/re-exports.

This is the first of the Op/Event pair (5.2.1): Event still references
MailboxMessage (now in the runtime) and will follow.
Move the `Event` and `TurnOutcomeStatus` enums (plus the inherent
`Event::error` / `Event::status` constructors) from
`tui/src/core/events.rs` to `codesmith-agent-runtime` as a new `events`
module, leaving a `pub use codesmith_agent_runtime::events::*`
re-export shim in the TUI so existing `crate::core::events::{Event,
TurnOutcomeStatus}` references resolve.

Import rewiring for the runtime home:
- `crate::core::coherence::CoherenceState` -> `crate::coherence::CoherenceState`
- `crate::tools::spec::{ToolError, ToolResult}` -> `codesmith_tools::{ToolError, ToolResult}`
- `crate::tools::subagent::SubAgentResult` -> `crate::subagent::SubAgentResult`
- `crate::tools::user_input::UserInputRequest` -> `crate::user_input::UserInputRequest`
- `Event::SubAgentMailbox`'s `crate::tools::subagent::MailboxMessage`
  -> `crate::mailbox::MailboxMessage`
- `Event::CycleAdvanced`'s `crate::cycle_manager::CycleBriefing` resolves
  unchanged (cycle_manager already lives in the runtime).
- background_task / error_taxonomy / models imports resolve unchanged.

Completes 5.2.1: the Op/Event protocol pair now lives in the runtime,
unblocking the Session / TurnContext / Engine migrations that follow.
… agent-runtime

Convert agent-runtime's single-file `compaction.rs` into a
`compaction/` module directory and move the four compaction *state*
submodules (`circuit_breaker`, `micro_compact`, `responsive_compact`,
`session_memory_compact`) plus the pure token-estimation cluster
(`estimate_tokens`, `estimate_tokens_for_message`,
`message_has_tool_use`, `estimate_text_tokens_conservative`,
`estimate_system_tokens_conservative`, `estimate_input_tokens_conservative`)
from tui's `compaction/mod.rs` into the runtime.

The heavy compaction *implementation* (summary building,
`should_compact`, partial/micro orchestration, attachment_reinject,
compact_prompt, post_compact_cleanup) stays in tui and re-exports the
moved modules/functions so `crate::compaction::<sub>::<Type>` and the
unqualified estimate helper calls keep resolving.

The estimate helpers are widened to `pub` in the runtime so the tui
engine can re-export them; the state submodule files copy verbatim
(imports already resolve via `crate::models` / `crate::compaction`).

This unblocks the Session migration: `Session` holds these four state
types as fields, and `working_set`'s tests reference `estimate_tokens`.

Tests: agent-runtime compaction (26) + tui compaction (107) all green.
Move the repo-aware working set module (`Workspace`, `WorkingSet`,
`WorkingSetEntry`, `WorkingSetConfig`, `WorkingSetSource` + impls and
tests) from `tui/src/working_set.rs` to `codesmith-agent-runtime`,
leaving a `pub use codesmith_agent_runtime::working_set::*` re-export
shim in the TUI.

The file copies verbatim: every `crate::` reference (`models`,
`workspace_discovery`, `test_support::assert_byte_identical`,
`compaction::estimate_tokens`) already resolves in the runtime, the
latter two unblocked by the preceding compaction keystone commit.

This is the second Session prerequisite: `Session` holds a `WorkingSet`
field and calls `WorkingSet::rebuild_from_messages` / `WorkingSet::default`.

Tests: agent-runtime working_set (21) + tui working_set (11) all green.
Move the workspace-trust and config-path-resolution helpers
(`is_workspace_trusted`, `default_config_path`, `home_config_path`,
`env_config_path`, `expand_path`, `expand_pathbuf`,
`workspace_trust_level_from_doc`, `is_trusted_level`,
`workspace_config_key`, `canonicalize_or_keep`) from tui's `config.rs`
into a new `codesmith_agent_runtime::workspace_trust` module.

The functions are widened to `pub` and re-exported back into tui's
`config.rs` (`pub(crate) use ...`) so the remaining config code
(`save_workspace_trust`, `resolve_load_config_path`, trust tests, etc.)
keeps calling them unqualified. The two helpers only ever used by the
moved functions (`canonicalize_or_keep`, `is_trusted_level`) are left
out of the tui re-export to avoid unused-import warnings; they stay
`pub` in the runtime as the single source of truth.

Deps all resolve in the runtime: `effective_home_dir` (already in
`utils`), `shellexpand`, `toml`, std.

This unblocks `project_context`, whose `check_trust_status` calls
`crate::config::is_workspace_trusted`.

Tests: tui config (208, incl. trust round-trips) + agent-runtime lib
(469) all green.
Move the project-context module (`ProjectContext` + loaders
`load_project_context`, `load_project_context_with_parents`,
`create_default_agents_md`, `merge_contexts`, `generate_project_context_pack`,
etc. and tests) from `tui/src/project_context.rs` to
`codesmith-agent-runtime`, leaving a `pub use ...::*` re-export shim.

Single import rewiring: `check_trust_status`'s
`crate::config::is_workspace_trusted` ->
`crate::workspace_trust::is_workspace_trusted` (moved in the prior
commit). The `crate::utils::summarize_project` / `project_tree` refs
resolve unchanged (utils already in the runtime); `use super::*` in
tests still points at the module itself.

This is the final Session prerequisite: `Session` holds a
`ProjectContext` field and `Session::new` calls
`load_project_context_with_parents`.

Tests: agent-runtime project_context (22) + tui project_context (3) green.
Move the engine session-state module (`Session`, `SessionUsage`,
`RecentReadFile` + impls and tests) from `tui/src/core/session.rs` to
`codesmith-agent-runtime`, leaving a `pub use ...::*` re-export shim.

Single import rewiring: `use crate::tui::approval::ApprovalMode` ->
`use crate::mode::ApprovalMode` (ApprovalMode already lives in the
runtime's `mode` module). Every other field/constructor dependency was
unblocked by the preceding prerequisite commits:
- compaction state submodules (`circuit_breaker`, `micro_compact`,
  `responsive_compact`, `session_memory_compact`)
- `project_context` (`load_project_context_with_parents`)
- `working_set` (`WorkingSet::default` / `rebuild_from_messages`)
- `prefix_cache::PrefixStabilityManager`, `cycle_manager::CycleBriefing`,
  `models`, `chrono`, `uuid`.

Completes 5.2.2: the engine's session core (history, usage, cycle +
compaction state, project context, working set) now lives in the
terminal-agnostic runtime. Unblocks TurnContext / Engine migrations.

Tests: agent-runtime session::tests (7) all green.
Move crates/tui/src/core/turn.rs verbatim to crates/agent-runtime/src/
turn.rs. All crate:: refs (models::Usage, snapshot::SnapshotRepo,
snapshot::DEFAULT_MAX_SNAPSHOTS) already resolve in agent-runtime;
uuid/serde_json/tracing deps present. Replace tui definition with a
re-export shim (pub use codesmith_agent_runtime::turn::*;) so the four
in-tree consumers (engine.rs, engine/capacity_flow.rs, engine/tests.rs,
engine/turn_loop.rs) keep resolving via crate::core::turn.
Move leaf config/prompt/sandbox/skills types that EngineConfig references
so EngineConfig can eventually live in agent-runtime without a tui dep:

- config_types.rs: DEFAULT_MAX_SUBAGENTS, SearchProvider (+impl),
  VisionModelConfig, WorkshopConfig (+impl), DEFAULT_LARGE_OUTPUT_THRESHOLD_TOKENS
- prompt_sources.rs: InstructionSource (+From impls), PromptAppendSource
  (+constructors +From impls)
- skills.rs: default_skills_dir()
- sandbox.rs: SandboxRuntimeConfig + SandboxFilesystemConfig +
  SandboxNetworkConfig + SandboxBackendKind + current_platform +
  managed_domains + is_managed_domain (SandboxDecision stays in tui —
  it references SandboxPolicy/SandboxType from the backend layer)

Each tui source file keeps a re-export shim so crate-local paths
(crate::config::SearchProvider, etc.) still resolve. All extracted types
are self-contained (std + serde only, no crate:: deps).
Split tools/todo.rs and tools/plan.rs: state types (TodoStatus, TodoList,
SharedTodoList, etc. / StepStatus, PlanState, SharedPlanState, etc.) move
to agent-runtime/src/tool_state/{todo,plan}.rs; tool implementations
(impl ToolSpec) stay in tui with a re-export shim. Fixed Mutex import to
use tokio::sync::Mutex (matching original) so .lock().await calls in tool
impls still resolve.
… to agent-runtime

Extract the remaining tool state value types from tui into
agent-runtime's tool_state module, leaving re-export shims in tui so
tool implementations continue to compile unchanged:

- plan_mode: PlanModeState, SharedPlanModeState, new_shared_plan_mode_state
- goal: GoalState, GoalStatus, GoalSnapshot, SharedGoalState, helpers
  (render_continuation_prompt stays in tui — needs prompts::GOAL_CONTINUATION_PROMPT)
- worktree: WorktreeSessionState, SharedWorktreeSessionState
- task_v2: TaskV2Status, TaskV2Record, TaskV2Manager, SharedTaskV2Manager,
  render_verification_nudge, should_emit_verification_nudge
  (VERIFICATION_NUDGE_THRESHOLD const + json! macro brought along)
- team: TeammateInfo, TeamContext, SharedTeamContext, new_shared_team_context

task_v2 unit tests (pure TaskV2Manager behaviour, 12 cases) move with the
type into agent-runtime where they retain private field access; the tui
shim drops its test module. from_str_opt widens to pub for cross-crate
tool-impl access.

All 12 agent-runtime tool_state tests pass; 192 tui tool tests pass.
…T_SUBAGENT_API_TIMEOUT_SECS) to agent-runtime

Two EngineConfig-referenced consts move to their canonical agent-runtime
homes (subagent.rs / config_types.rs) with re-export shims in tui so all
existing crate::tools::subagent::DEFAULT_MAX_SPAWN_DEPTH and
crate::config::DEFAULT_SUBAGENT_API_TIMEOUT_SECS call sites keep resolving.
Resolves the inherent-impl obstacle that previously kept LspConfig in tui:
the language registry (Language, detect_language, server_for) is std-only
and self-contained, so it moves wholesale to agent-runtime::lsp_registry.
With Language available locally, LspConfig + Default + resolve_command
move to agent-runtime::lsp_config — resolve_command widens to pub so the
tui LspManager (still in tui) can call it cross-crate via the re-export.

tui shims:
- lsp/registry.rs -> pub use codesmith_agent_runtime::lsp_registry::*;
- lsp/mod.rs LspConfig block -> pub use ...::lsp_config::LspConfig
  (unused serde::Deserialize import dropped)

10 agent-runtime lsp_registry tests + 20 tui lsp tests pass.
…-inject via EngineHost

EngineConfig previously held two heavy, terminal-coupled fields:
  - runtime_services: RuntimeToolServices (cascades into ~10k lines of
    TUI-local OS-bridging managers: ShellManager/TaskManager/AutomationManager/
    HandleStore/RlmSessionStore/BackgroundTaskRegistry)
  - hooks: Option<HookExecutor> (1730 lines, TUI-local)

These blocked the physical move of EngineConfig to codesmith-agent-runtime
(Step 5.2.5). Per the documented boundary in agent-runtime/background_task.rs
(the unified lifecycle/registry layer stays in the TUI), full physical
extraction of those field types was rejected as intractable.

Instead, shed both fields from EngineConfig and host-inject them via a new
concrete TUI struct EngineHost { runtime_services, hooks }. Engine::new and
Engine::new_with_client keep their signatures (default EngineHost) so the
~20 test sites using EngineConfig::default()/..Default::default() keep
working. Engine::new_with_host + spawn_engine(config, api_config, host)
serve production callers. When Engine moves to agent-runtime (5.2.7),
EngineHost becomes Arc<dyn HostServices>.

Construction sites updated: tui/ui.rs (build_engine_host helper, 5 spawn
sites), main.rs (2 sites), runtime_threads.rs (extracted runtime_services
local). All reads/mutations of config.runtime_services/config.hooks in
new_impl redirected to host.*.

Verified: cargo check --tests -p codesmith-tui -p codesmith-agent-runtime
clean; 3596 tui bin tests + 520 agent-runtime tests pass.
EngineConfig is now portable: after shedding runtime_services+hooks
(commit 6c4efd1), every field type already has a canonical home in
codesmith-agent-runtime (Features, CompactionConfig, CycleConfig,
CapacityControllerConfig, tool_state shared types, SandboxRuntimeConfig,
NetworkPolicyDecider, LspConfig, config_types::{SearchProvider,
VisionModelConfig, WorkshopConfig, ToolsConfig}, prompt_sources::{
InstructionSource, PromptAppendSource}, plus DEFAULT_TEXT_MODEL /
DEFAULT_MAX_SUBAGENTS / DEFAULT_SUBAGENT_API_TIMEOUT_SECS /
DEFAULT_MAX_SPAWN_DEPTH / DEFAULT_MAX_WORKSPACE_BYTES_FOR_SNAPSHOT).

Moved the struct + impl Default verbatim to a new
crates/agent-runtime/src/engine_config.rs module, with field paths
rewritten from TUI crate:: re-exports to the agent-runtime canonical
modules. The TUI's core/engine.rs now re-exports it via
'pub use codesmith_agent_runtime::engine_config::EngineConfig;'.

Cleaned up the 8 now-unused imports the move left in engine.rs
(HashMap/HashSet, CompactionConfig, DEFAULT_MAX_SUBAGENTS, CycleConfig,
Features, LlmClient, SandboxRuntimeConfig, new_shared_goal_state).

Verified: cargo check --tests -p codesmith-tui -p codesmith-agent-runtime
clean (no errors, no engine.rs unused-import warnings); 520 agent-runtime
+ 3596 tui bin tests pass.
First sub-increment of the engine-host decoupling (5.2.6/5.2.7 Phase A):
route post-edit LSP diagnostics through a host-injected trait so the
engine body no longer reaches the concrete TUI `LspManager`.

agent-runtime (new, portable contracts):
- `lsp_diagnostics`: move the pure-data `Severity`/`Diagnostic`/
  `DiagnosticBlock` + `render_blocks` (and 5 tests) out of the TUI so
  `pending_lsp_blocks` is portable. TUI keeps a re-export shim.
- `host_services`: define `LspManagerApi` (`config` +
  `diagnostics_for`) and the umbrella `HostServices` trait
  (`fn lsp(&self) -> &dyn LspManagerApi`). This mirrors the existing
  `ToolDispatcher`/`RuntimeUi`/`HookHost` trait-erasure bridges and is
  the continuation of the "shed heavy fields + host-inject" decision.

tui (host side):
- `EngineHost` gains a `pub lsp_manager: Arc<LspManager>` field
  (default: disabled manager); the three literal build sites use
  `..Default::default()`.
- `new_impl` now assigns `host.lsp_manager` from `config.lsp_config`
  and the `lsp_manager` field is removed from the `Engine` struct
  entirely.
- `runtime_traits`: `impl LspManagerApi for LspManager` (delegates to
  the inherent API) and `impl HostServices for EngineHost`.
- `lsp_hooks`: `self.lsp_manager.{config,diagnostics_for}` →
  `self.host.lsp().{config,diagnostics_for}` — body code is now
  host-agnostic and will not change when `host` becomes
  `Arc<dyn HostServices>`.
- `LspManager`: manual `Debug` (transports are `Arc<dyn LspTransport>`,
  not Debug) so `EngineHost` keeps its `derive(Debug)`.
- tests reach the test-only `install_test_transport` via
  `engine.host.lsp_manager` (the concrete host field).

The engine body is unchanged between this concrete-host phase and the
later `Arc<dyn HostServices>` phase, so each remaining service
(bg_registry, subagent_manager, seam_manager, shell/workshop) can be
converted the same way. Build + the 3 post-edit LSP tests pass.
… (Phase A)

Second sub-increment of the engine-host decoupling (5.2.6/5.2.7 Phase A):
route the background-task registry through a host-injected trait so the
engine body no longer reaches the concrete `SharedBackgroundTaskRegistry`.

agent-runtime (portable contracts):
- `background_task`: move `BackgroundTaskPollResult` (plain data) here and
  add `BackgroundTaskPollSnapshot`. TUI keeps the glob re-export shim.
- `host_services`: define `BgRegistryApi` — 8 `&self` async methods
  (`register_shell_task`, `cancel_task`, `list_tasks`, `read_output_delta`,
  `background_all`, `register_dream_task`, `update_task_status`,
  `poll_once`) returning portable `BackgroundTaskSummary`/poll types.
  `poll_once` collapses the poller's poll+drain+evict into one atomic
  snapshot so the lock is never held across `Event`-channel awaits.
- `HostServices` gains `fn bg_registry(&self) -> Arc<dyn BgRegistryApi>`
  (owned, cloneable handle so the spawned poller can capture it).

tui (host side):
- `runtime_traits`: `BgRegistryHost(SharedBackgroundTaskRegistry)` newtype
  (orphan rule forbids impl'ing a foreign trait for `Arc<Mutex<..>>`)
  with `impl BgRegistryApi` that locks internally and converts
  `BackgroundTaskState` → `BackgroundTaskSummary` via the existing
  `From` impl. `impl HostServices for EngineHost` returns
  `Arc::new(BgRegistryHost(...))` from `runtime_services.background_task_registry`
  (always seeded by `new_impl`).
- `Engine`: drop the `bg_registry` field; `new_impl` now *moves* the
  registry into `host.runtime_services` (no separate clone/field).
- `run()`: poller uses `self.host.bg_registry().poll_once().await`; the 8
  `Op::*BackgroundTask` handlers call `self.host.bg_registry().<method>()`
  directly — no more `self.bg_registry.lock().await` in the engine body.
- `HostServices` trait imported into the `engine` module so the body can
  call `self.host.{lsp,bg_registry}()` (lsp_hooks now gets it via `super::*`).

Behavior preserved: each Op handler still does one operation under one
lock; the poller still does poll+drain+evict atomically. Build + the 21
background_task + 3 post-edit LSP tests pass.
…t (Phase A)

Move the seam (layered-context) manager off the Engine struct onto
EngineHost, reached through HostServices::seam() -> Option<&dyn SeamManagerApi>.
This is the third HostServices accessor (after lsp and bg_registry) and
keeps the engine body free of the concrete SeamManager so the Engine can
later move to codesmith-agent-runtime.

The trait surface now covers every SeamManager method the engine body calls:
the 7 query/mutation methods plus the 3 production methods
(produce_soft_seam, recompact, produce_flash_briefing) whose signatures use
only portable types (Message, Path, String, usize, anyhow::Result). The impls
stay TUI-side in runtime_traits.rs, delegating to the inherent SeamManager
methods which remain TUI-coupled (they drive plan_compaction, cost_status,
cycle_manager, and the Flash LLM client).

SeamManager gains #[derive(Clone)]: its flash-client handle and active-seam
registry are both Arc-wrapped, so a clone is a shared handle to the same
state -- required for EngineHost's derive(Clone). A manual Debug impl already
existed (LlmClientHandle is not Debug).
…ispatcher trait (Phase A Stage 1)

Turn loop now takes the per-turn registry as Option<Arc<dyn ToolDispatcher>>
instead of Option<&ToolRegistry>. The dispatcher arrives as an owned Arc so
the early-tool-start tokio::spawn can clone it into a 'static task; the turn
body borrows it as Option<&dyn ToolDispatcher> via as_deref().

Touched:
- handle_deepseek_turn: signature -> Option<Arc<dyn ToolDispatcher>>; shadow
  tool_registry_arc (Arc) + tool_registry: Option<&dyn> = as_deref().
- early-tool-start spawn site: bind &tool_registry_arc, Arc::clone, &*registry;
  EarlyToolStart field uses explicit double-deref &**registry (field-level
  coercion from &Arc<dyn> to &dyn did not auto-apply).
- Sinks retyped to Option<&dyn ToolDispatcher> / &dyn ToolDispatcher:
  tool_hook_executor, EarlyToolStart.registry, execute_parallel_tool,
  execute_tool_with_lock, goal_continuation_message_if_needed,
  resolve_tool_definition, and 4 capacity_flow sinks.
- engine.rs call site wraps the concrete ToolRegistry in
  Arc::new(r) as Arc<dyn ToolDispatcher>.

This is step 1 of moving Engine to codesmith-agent-runtime: the turn loop no
longer references the concrete ToolRegistry type, only the ToolDispatcher
trait from agent-runtime.
Plain-data payload (Debug+Clone, two String fields) drained by the engine's
turn loop via rx_subagent_completion. The turn loop is terminal-agnostic, so
the item type must live in the runtime crate; the TUI re-exports it at the
historical crate::tools::subagent path.

Prep for Phase A Stage 2: makes tx_subagent_completion a portable channel so
the host turn-dispatcher factory can carry it in a portable request.
…st (Phase A Stage 2a)

Move four TUI-coupled Engine fields to EngineHost so the Engine struct
body inches closer to physical relocation into agent-runtime:

- shell_manager, subagent_manager, workshop_vars, sandbox_backend
  -> EngineHost fields (accessed via self.host.X)
- EngineHost::Default seeds the shared managers with dummy paths,
  overridden by new_impl; workshop_vars/sandbox_backend stay Option.
- SubAgentManager: add manual Debug impl (TUI-coupled fields).
- SandboxBackend trait: add Debug bound; OpenSandboxBackend: derive Debug.

All reference sites in engine.rs, turn_loop.rs, tests.rs retyped from
self.X / engine.X to self.host.X / engine.host.X. Verified: 994 tui
tests + 525 agent-runtime tests pass.
docs/HOOKS.md is the user-facing reference for the [hooks] system,
which previously had no dedicated doc: the [[hooks.hooks]] schema,
all eleven events with trigger timing and mutability (message_submit
transform/block, shell_env env injection, pre_compact preserved
context), condition matching, the DEEPSEEK_* env var table (ephemeral
SESSION_ID vs persistent THREAD_ID), stdin/stdout contracts, execution
semantics, security notes, recipes, and troubleshooting.

Fixes found while writing it:

- docs/CONFIGURATION.md pointed at an "existing hook-system
  documentation" that did not exist; it now links docs/HOOKS.md.
- /hooks events listed only 7 of 11 events; add shell_env,
  task_created, task_completed, and pre_compact with descriptions
  and extend the ordering test to pin all eleven.
- config.example.toml's hooks comment listed 8 events and omitted
  the message_submit/pre_compact stdout contracts; complete it.
- README.md documentation table gains a HOOKS.md row.
Skills were already self-service — dropping <name>/SKILL.md into any
discovery directory needs no registration — but the how-to was split
between a short README section and a GUIDE.md intro, with no dedicated
reference like MCP.md or EXTENSIONS.md.

docs/SKILLS.md covers:

- discovery directories and first-match-wins precedence (workspace
  .agents/.opencode/.claude/.cursor/.codesmith plus skills/, and the
  global ~/.agents, ~/.claude, ~/.codesmith, ~/.deepseek dirs)
- SKILL.md frontmatter fields, the plain-Markdown fallback, and
  conditional activation via `paths` globs
- the four activation paths: load_skill auto-selection, paths
  matching, /skill and /<skill-name> invocation, and the HTTP API
- the /skills command family and community installs (github:, direct
  tarball, registry) including the trust model for shell snippets
- companion files, bundled system skills, and troubleshooting

Cross-link from the README documentation table, the "Publishing Your
Own Skill" section, and GUIDE.md section 9.
Add *_cn.md counterparts for all 36 English .md files directly under
docs/ so Chinese-speaking users can read the documentation natively.
Prose is translated to Simplified Chinese while code blocks, commands,
config keys, env vars, and file paths stay verbatim; cross-doc links
still point to the original English files. step.md was already written
in Chinese, so step_cn.md is an unmodified copy.

Constraint: original English docs remain the canonical source
Directive: update the matching _cn.md when an English doc changes
Confidence: high
Scope-risk: narrow
Implements the four stages of docs/plans/agent-capability-strengthening.md,
the first direction of the 2026-08 review roadmap (docs/plans/README.md).

- edit_file: multi-match searches now fail with replace_all / occurrence
  (1-based) disambiguation guidance instead of silently replacing every
  occurrence; fuzzy-match paths unchanged (unique-match only).
- read-before-edit freshness validation: new
  agent-runtime/src/tools/freshness.rs (FileFreshnessTracker + catalog-
  neutral ToolSpec decorator) wraps read_file/edit_file/write_file/
  fim_edit/apply_patch (diff headers parsed for multi-file patches).
  Unread or externally-modified files are rejected with a re-read hint;
  post-write state is recorded so chained edits pass. Wired through
  EngineConfig.file_freshness_tracker, gated by [features].file_freshness
  (default on, all modes including Yolo).
- grep_files: ripgrep engine — ignore walker (gitignore now actually
  honoured, require_git(false), dotfiles still included) + grep-regex /
  grep-matcher kernel with a new multiline mode (whole-buffer matching,
  matches reported at starting line). Tool interface and output format
  unchanged; macOS root canonicalization handled for relative paths.
- exact token counting: new agent-runtime/src/tokenizer.rs TokenCounter
  (hf-tokenizer feature, HuggingFace tokenizers with fancy-regex), loaded
  from [context].tokenizer_path at startup with chars/3 heuristic
  fallback. compaction estimate helpers and the large-output router now
  route through the process-wide counter; budgets stay identical when no
  tokenizer is configured.

Also: fixes five pre-existing clippy violations in providers/extensions
that fire under rustc 1.90 (collapsible_if x3, FromStr impl, wildcard
pattern), and adds the docs/plans/ roadmap with cross-session execution
conventions (toolchain caveats, flaky-test handling, landed-capability
inventory).

Verification: tui 2898 / agent-runtime 1181 / tool-impls 247 / extensions
75 tests green; HF path smoke-tested against a real gpt2 tokenizer.json;
touched files are clippy-clean under rustc 1.90.
Implements §3 of docs/plans/context-engineering.md (capacity controller
model-adaptivity), on top of the centralized TokenCounter landed in the
agent-capability stage 4.

Root cause fixed — ordering inversion: the auto-compaction trigger (raw
counter units) sat above the capacity-preflight trip point (conservative
x3/2 units) on sub-200K windows, so cleanup always went through
emergency recovery or the provider's prompt-too-long rejection +
peel-retry instead of clean auto-compaction (128K: trigger 95,000 vs
trip point ~81,920 raw-equivalent).

- agent/models: new SMALL_CONTEXT_WINDOW_TOKENS (200K); windows below
  it tighten the trigger to (effective window - 13K) x 2/3 — the exact
  inverse of the conservative 3/2 estimator scale (128K example:
  95,000 -> 63,333). Mid-band (claude 200K / GLM 202K) and >=500K
  windows keep the existing formula byte-for-byte; unknown-model
  fallback 95,000 unchanged. TUI assembly points pick up the new values
  through the existing helper.
- agent-runtime/compaction: the 3/2 scale is extracted into shared
  constants (CONSERVATIVE_ESTIMATE_NUMERATOR/DENOMINATOR) used by both
  the estimator and the trigger derivation, so the two cannot drift.
- agent-runtime/engine/context: the local chars/3 estimator copy is
  removed in favour of re-exporting the tokenizer-backed compaction
  estimator — preflight, emergency recovery, and capacity observation
  now count the system prompt through TokenCounter as well (identical
  numbers under the default Heuristic counter; exact once a
  tokenizer.json is installed via [context].tokenizer_path).
- agent-runtime/engine/context: sub-200K preflight budgets reserve an
  extra window/100 headroom (128K: +1,280) so the preflight trips
  slightly before a hard-rejecting provider; >=200K budgets unchanged —
  the default deepseek 1M budget (736,832) is guarded by assertions.

Gate A (CapacityController) stays disabled by default per the confirmed
scope; the capacity preflight (Gate B) was already always-on.

Verification: agent 101 / agent-runtime 1184+27 / tui 2899+76 tests
green; new ordering proof (capacity_small_window_auto_compacts_before_
preflight_budget), acceptance test (engine_128k_window_long_session_
compacts_without_prompt_too_long), and deepseek-default regression
snapshots; touched regions rustfmt/clippy-clean under rustc 1.90.

docs/plans: context-engineering §3 marked done with implementation
notes and fact corrections ([providers.*] carries no window fields —
windows derive from model names incl. the _Nk suffix; preflight is
always-on, Gate A is the v0.8.11-disabled piece); README index updated.
Implements §1 of docs/plans/product-polish.md (native multimodal
input). Until now `/attach` and clipboard pastes only inserted a
`[Attached image: ... at <path>]` placeholder line and the model had
to round-trip through image_analyze / read_file OCR to see pixels;
vision-capable models can now receive the image inline.

- agent/models: `ContentBlock::Image { source: ImageSource }` with
  `File { path, media_type? }` (primary shape — clipboard pastes are
  already materialized under ~/.codesmith/clipboard-images/, so
  persisted sessions stay path-sized) and `Base64 { media_type, data }`.
  Internally-tagged serde, backward-compatible with old session files;
  `ImageSource::summary()` + IMAGE_BLOCK_ESTIMATED_TOKENS shared by
  every flattening/estimation site.
- providers/rig_adapter: user-side Image blocks map to rig
  `UserContent::Image` (base64-encoded at request-build time, media
  type from the file extension, png/jpeg/gif/webp only); rig-core
  assembles the OpenAI-compatible `image_url` data URI. Unreadable
  files and unsupported media types drop the block — the placeholder
  line in the user text remains as fallback. base64 added as an
  optional dep under the `rig` feature.
- agent-runtime: `Op::SendMessage.image_paths`; the engine appends
  Image blocks after the user text (`[turn_meta, text, image...]`).
  All 12 exhaustive `ContentBlock` matches gained Image arms: token
  estimators count the fixed ~1.2K tile cost, summarizers/RLM digests/
  purge listings flatten to a `[image: path]` placeholder, working-set
  path extraction keeps relying on the placeholder line.
- capability declaration: `ProviderCapability.vision_supported` with
  per-provider model-name heuristics (deepseek-vl*/Qwen-VL/GLM-V/
  llava, gpt-4o+, o3/o4, claude-*, mimo-v2.5); `[providers.*]` and
  `[[providers.custom]]` gain a `vision = true|false` override
  (custom gateways default to false — no static matrix entry).
  `Config::vision_supported_for_model()` resolves override-first.
- tui dispatch: attachment lines are parsed back to paths via
  `image_attachment_paths()`; vision-capable routes send the paths with
  the Op and mirror Image blocks into the local transcript, while
  non-vision routes keep the text-reference mode and append an
  `<attached_images>` note pointing the model at the existing
  image_analyze / read_file OCR chain (the documented fallback).
  History/session-picker/notifications/API surfaces render or serialize
  the new block explicitly.

docs: config.example.toml `vision` key + gateway example;
CONFIGURATION.md media-attachments section rewritten for the native
path and the fallback; product-polish §1 marked done (live acceptance
with a vision-configured provider still pending).

Verification: agent 104 / providers 40 / agent-runtime 1211 /
tui 2979 / tool-impls 247 tests green; staged tree compiles
workspace-wide in an isolated worktree; touched lines clippy- and
rustfmt-clean under rustc 1.90 (pre-existing deviations untouched).
First step of the host_executor.rs decomposition (codebase-health §1):
move the stream phase and the tool-batch phase of the turn loop into a
new engine/turn/ directory, behavior-preserving.

- turn/stream.rs: reduce_stream, stream_with_transparent_retry,
  try_recover_context_overflow, the EarlyToolTask/BlockBuild
  accumulators, the StreamReduceOutcome/StreamRoundOutcome enums, and
  the early_start_safe gate (plus its two unit tests; the behavior
  tests stay in host_executor::tests as parity guards).
- turn/batches.rs: the seam-3 tool dispatch extracted verbatim from
  run_inner as execute_tool_batches — planning, batch classification
  via plan_tool_execution_batches, FuturesUnordered parallel dispatch,
  serial approval path, and the sequential post-batch pass.
- host_executor.rs shrinks 17,169 -> 15,921 lines; fields and helpers
  the phases need are bumped to pub(crate) (engine-internal
  convention); the transparent-retry / early-tool-start gap
  inventories moved with the code; intra-doc links re-pointed.
- tests/protocol_recovery.rs: list the turn sources in ENGINE_SOURCES.

Parity: agent-runtime lib tests 1184 passed / 0 failed; clippy warning
set compared against the pre-split tree — no new diagnostics, four
stale ones fixed in the new files; rustdoc gains no broken links.
Second step of the host_executor.rs decomposition (codebase-health §1):
move the per-tool approval gate and the cross-cutting cancel/steer seams
into engine/turn/, behavior-preserving.

- turn/approval.rs: request_approval (incl. the cancel race), the static
  requires_approval capability gate, and the approval intent-summary
  extractor; the "Known gaps in approval" inventory moved with the code.
- turn/seams.rs: is_cancelled plus the steer push/flush/drain helpers
  (push_steer_message, flush_pending_steers, drain_steers,
  drain_stale_steers); the seven-checkpoint map moved into its module
  docs with cross-file pointers.
- host_executor.rs shrinks 15,921 -> 15,566 lines; the fields the moved
  impls need (event_tx, approval, turn_meta) are bumped to pub(crate)
  (engine-internal convention); guardrail 4/5/10 doc entries condensed
  to pointers; intra-doc links re-pointed.
- tests/protocol_recovery.rs: list the two new turn sources in
  ENGINE_SOURCES.

Behavior tests stay in host_executor::tests as parity guards (no pure
unit tests moved this batch — the moved items have none).

Parity: agent-runtime lib tests 1184 passed / 0 failed (one intermittent
mcp legacy-sse mock-server flake re-run clean, pre-existing); clippy
warning set compared against the pre-split worktree — no new diagnostics,
two stale ones (manual_contains, redundant map_or) fixed in the new
files; rustdoc warnings 76 -> 73, no unresolved links added.
Third step of the host_executor.rs decomposition (codebase-health §1),
completing the planned engine/turn/ module set: move the post-stream
helpers into engine/turn/postprocess.rs, behavior-preserving.

- turn/postprocess.rs: the sub-agent reaping gate
  (should_hold_turn_for_subagents), the sentinel builder
  (subagent_completion_runtime_message), the thinking-only clean-end
  predicate (should_emit_thinking_only_status), and the LSP diagnostics
  pair (collect_lsp_diagnostics / flush_pending_lsp_diagnostics, flush
  now pub(crate)); the "Known gaps in the LSP flush" inventory moved
  with the pair, with its doc links re-pointed.
- The post-stream drain / blocking hold (Checkpoint E's biased select!)
  and the thinking-only emit tail stay inline in run_inner — they are
  woven into the step-loop locals with three control-flow exits; only
  the standalone helpers moved. The "known gaps in thinking-only
  handling" / "known gaps in subagent" inventories stay with them.
- host_executor.rs shrinks 15,566 -> 15,361 lines; the lsp field and
  LspProbe's fields are bumped to pub(crate) (engine-internal
  convention; the probe type itself stays put — the wire-in in
  engine::mod constructs it); newly-unused imports (edit_file_paths,
  render_lsp_blocks as render_lsp_blocks) removed from the host side.
- turn/mod.rs: postprocess registered + re-exported, the "later step
  will add postprocess" note replaced by the module bullet.
- tests/protocol_recovery.rs: postprocess.rs added to ENGINE_SOURCES.

The two pure unit tests of the moved helpers moved with them
(should_emit_thinking_only_status_only_on_clean_end,
subagent_completion_handoff_is_internal_user_message); behavior tests
stay in host_executor::tests as parity guards.

Parity: agent-runtime lib tests 1184 passed / 0 failed (the known mcp
legacy-sse mock-server flake did not fire this run); clippy warning set
identical to the pre-split HEAD worktree (lib 62 / lib-test 81-82 by
count method, zero new, postprocess.rs clean); rustdoc warnings 73 -> 71
(two stale links retired with the moved gap section), no unresolved
links added.
Adds the `personality` config key ("calm", the default, or "playful")
selecting the voice-and-tone overlay layered into the assembled
system prompt. Presentation-only — it changes how the agent speaks,
never what it does; the overlay was previously hardcoded to Calm at
assembly time.

- agent-runtime/prompts: Personality::parse (case-insensitive,
  unknown values rejected); PromptSessionContext.personality flows
  into compose_mode_prompt_with_approval_and_model in place of the
  hardcoded Calm; EngineConfig.personality (default Calm) carries
  the resolved overlay into the engine's assembly call site.
- tui/config: Config.personality with startup validation (typos
  fail validate instead of silently degrading), a personality()
  resolver (calm fallback + warning), profile merge override, and
  the project-overlay string-override list in merge_project_config.
- call sites: TUI engine config, exec-mode agent, team teammate,
  and runtime threads resolve the effective personality.
- tests: config resolution / validation / profile-merge coverage;
  session-context personality flows into the bundle; parse accepts
  known values only; existing prompt tests pin Calm explicitly.
- docs: config.example.toml documents personality alongside the
  system_prompt / system_prompt_file / append_system_prompt layers;
  CONFIGURATION.md gains the project-overlay table row and a
  "System prompt customization" section.

Also folds in a rustfmt pass over the touched crates (import
ordering and line re-wrapping in capacity_flow.rs, engine/mod.rs,
main.rs, prompts.rs, tui/ui.rs) — no behavior change.

Verification: agent-runtime lib tests 1184 passed / 0 failed (3
ignored); tui suite 2903 passed / 0 failed (2 ignored) plus
integration binaries green; all staged files rustfmt-clean
(pre-existing deviations elsewhere untouched).
Sweep of all living docs against the codebase after the engine moved to
crates/agent-runtime; every change verified against the source before
editing. Chinese mirrors (docs/*_cn.md, README.zh-CN.md) updated in
lockstep. Historical records (CHANGELOG, ROADMAP, archive/rfcs/plans)
intentionally untouched.

- docs/ARCHITECTURE(.md/_cn.md): rewrite module map — engine now lives in
  crates/agent-runtime/src/engine/ (incl. the new turn/{stream,batches,
  approval,seams,postprocess}.rs split); delete references to the removed
  tui client.rs/turn_loop.rs; refresh tools/, sandbox/, and workspace-crate
  lists; fix the stale flat [[hooks]] example; LSP hook paths corrected
- README(.md/zh-CN): Landlock+seccomp and Windows Job Object are enforced
  (was "not yet enforced"); add the missing workspace `.codesmith/skills`
  discovery dir; drop the passed 2026-07-24 legacy-alias retirement date
- memory is on by default (code asserts it): fix MEMORY.md,
  CONFIGURATION.md, config.example.toml + mirrors (were "opt-in")
- MODES/TOOL_SURFACE: MCP tool naming canonicalized to `mcp__<server>__<tool>`;
  agent_spawn stays registered as the background/compat alias (SUBAGENTS
  was right, TOOL_SURFACE overstated its removal)
- locale list gains es-419 and vi; sub-agent role prompts now point at
  SubAgentType::system_prompt() in agent-runtime
- config.example.toml: add the missing [sandbox] (+filesystem/network),
  full [subagents] keys, [hooks] working_dir, [network] proxy, and
  [memory] kod/directory/excludes keys — README's "every option" claim
  now holds
- OPERATIONS_RUNBOOK + crates/tui/tests/README.md: RUST_LOG targets and
  cargo invocations updated to current binary/crate names
- RELEASE_RUNBOOK: document explicitly that agent-runtime/providers/
  tool-impls/index/extensions/release are not published (matches
  scripts/release/crates.sh)
- CONTRIBUTING: crate tree gains the eight missing workspace crates;
  ARCHITECTURE.md guardrail count six→ten; tui main.rs doc comment
  rebranded from "DeepSeek client"
…vel naming

Retire every project-level DeepSeek reference left over from the
pre-rebrand era. LLM-provider surfaces are intentionally untouched: the
deepseek provider factory, model IDs, api.deepseek.com hosts, the
DEEPSEEK_API_KEY credential, and billing/prefix-cache documentation.

Removed:
- `deepseek` / `deepseek-tui` deprecation shim binaries and the npm
  `deepseek-tui` placeholder package; release/CI/CNB no longer build or
  publish legacy assets, and the Homebrew formula flips to `codesmith`
- app-level `DEEPSEEK_*` environment aliases (~40 knobs);
  `codesmith_env()` now resolves `CODESMITH_` -> `CODEWHALE_` only
- `~/.deepseek` and `/etc/deepseek` path fallbacks (managed config now
  defaults to `/etc/codesmith`), `.deepseekignore` (-> `.codesmithignore`),
  the legacy secrets.json store, and the `deepseek` keychain service name
  (now `codesmith`)

Renamed with no fallback:
- hook env vars `DEEPSEEK_*` -> `CODESMITH_*`
- MCP tools `deepseek`/`deepseek-reply` -> `codesmith`/`codesmith-reply`
- runtime API auth header `x-deepseek-runtime-token` ->
  `x-codesmith-runtime-token`, plus the `DEEPSEEK_RUNTIME_TOKEN` env
- app-server identity `deepseek-app-server` -> `codesmith-app-server`
- theme module `deepseek_theme` -> `brand_theme`; palette constants
  `DEEPSEEK_{BLUE,SKY,INK,SLATE,RED}(_RGB)` -> `CODESMITH_*`
- skills registry URL -> `Hmbown/codesmith-skills`
- `DEEPSEEK_BUILD_SHA` -> `CODESMITH_BUILD_SHA`

Docs: rewrote the four README mirrors, docs/, CHANGELOG, ROADMAP and
config.example.toml onto the codesmith-first wording; REBRAND.md/_cn.md
now record that the compatibility layer has been removed; SECURITY.md
points at GitHub private vulnerability reporting instead of the legacy
email.

BREAKING CHANGE: users must migrate `~/.deepseek` to `~/.codesmith`,
re-authenticate against the renamed keychain service, and update hook
scripts, MCP client configs, `DEEPSEEK_*` env exports, `/etc/deepseek`
managed configs, and `X-DeepSeek-Runtime-Token` callers to the
codesmith names. `DEEPSEEK_API_KEY` continues to work as the official
DeepSeek provider credential.
Cut the shipped locale set down to the four target languages: English,
Simplified/Traditional Chinese, and Latin American Spanish stay, Hindi is
promoted from the planned-QA matrix to a fully shipped locale with complete
UI-chrome translations, and Japanese, Brazilian Portuguese, Vietnamese,
plus the entire planned Global South QA matrix are dropped. Configured
locales or LANG values for dropped languages now fall back to English.

The narrowing also fixes adjacent gaps: Spanish gains the missing
/translate target branch and native-script reinforcement bookends
(es-419 previously fell back to English on the prompt side), zh-Hant
becomes a real UiLocale variant, and the onboarding picker now lists
exactly the shipped locales, fixing the stale "Press 1-7" footer count.

Constraint: UI chrome and prompt-side bookends only; base prompts stay English and the latest user message still wins
Rejected: Keep dropped locale tables behind a feature flag | dead weight with no product path
Confidence: high
Scope-risk: moderate
Not-tested: Native-speaker review of the machine-generated Hindi strings
Apply the machine-applicable clippy suggestions across the TUI crate
(let-chains, redundant closures, map_flatten, useless_format, and
removal of re-exports that no longer have consumers).

Repair the fallout from `cargo clippy --fix --bin codesmith-tui --tests`:
rustfix compiles the bin once without cfg(test), so imports referenced
only by test code were flagged unused and deleted, breaking the test
targets with 181 errors. Restore those imports gated with #[cfg(test)]
(or moved into the test module) so the lint stays fixed without breaking
tests, and drop the ones even the tests no longer use (regex, fmt::Write,
Duration, HookHost, ...).

Verified with `cargo clippy --workspace --all-targets --all-features`
(0 errors) and `cargo test --workspace --all-features`.
- LICENSE: correct the leftover "DeepSeek CLI Contributors" copyright
  line to "CodeSmith Contributors" (missed in the rebrand cleanup).
- Add .github/dependabot.yml for weekly grouped updates across the
  cargo, npm, and github-actions ecosystems.
- Add SUPPORT.md with a support routing table, plus "Help & Support"
  sections in both READMEs.
- Move the root ARCHITECTURE.md design narrative to
  docs/DESIGN_INTERNALS.md — it complements docs/ARCHITECTURE.md
  rather than duplicating it. Fix its relative links, cross-link the
  two docs, update ROADMAP references, and list it in both README
  documentation tables.
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 25, 2026
camilesing and others added 3 commits August 25, 2026 09:47
Implements #2190's remaining valid motivation without the proposed
crate split: the real MCP client lives in agent-runtime, so OAuth
lands next to it (decision record in the rewritten RFC).

- new mcp_oauth module: device code flow (GitHub preset plus custom
  endpoints), token storage via codesmith-secrets (system keyring,
  permissioned-file fallback), refresh-token grant
- McpServerConfig gains an optional `oauth` table; connect resolves
  the stored token and injects Authorization unless `headers` already
  carries one
- Streamable HTTP and SSE transports refresh the token once on 401,
  mirroring the Claude.ai manual-refresh seam; a user-configured
  Authorization header is never overwritten
- new `codesmith mcp auth <server>` subcommand runs the interactive
  flow out-of-band and stores the token
- docs/MCP.md documents the config surface and behavior
- RFC 2189 (persistence SQLite): fill in the missing motivation, a
  target design (unified state.db + PRAGMA user_version, new tables,
  single-writer actor, read-only JSON import), a five-phase migration
  order, and open questions for review; records the completed
  state.db path fix as decided. No migration is implemented yet.
- architecture-parity RFC: annotate all six slices with their 2026-08
  status — slices 2/5 implemented with code pointers, slice 1 mostly
  complete with the deferred startup-helper extraction noted, slices
  3/4 accepted-as-is with explicit revisit triggers, slice 6 closed —
  and answer the open questions.
Bumps the cargo group with 47 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.104` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.92` |
| [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` |
| [clap](https://github.com/clap-rs/clap) | `4.5.54` | `4.5.60` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.5.65` | `4.6.9` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.1` | `0.13.4` |
| [rig-core](https://github.com/0xPlaygrounds/rig) | `0.39.0` | `0.42.0` |
| [rusqlite](https://github.com/rusqlite/rusqlite) | `0.32.1` | `0.40.2` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.20` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [toml](https://github.com/toml-rs/toml) | `0.9.11+spec-1.1.0` | `1.0.6+spec-1.1.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.25` | `0.4.32` |
| [tree-sitter](https://github.com/tree-sitter/tree-sitter) | `0.25.10` | `0.26.12` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.6.8` | `0.7.0` |
| [tracing-appender](https://github.com/tokio-rs/tracing) | `0.2.4` | `0.2.5` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.19.0` | `1.25.0` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.18` | `0.7.19` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.5` | `1.1.9` |
| [libc](https://github.com/rust-lang/libc) | `0.2.186` | `0.2.189` |
| [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.13.1` |
| [shlex](https://github.com/comex/rust-shlex) | `1.3.0` | `2.0.1` |
| [similar](https://github.com/mitsuhiko/similar) | `2.7.0` | `3.2.0` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.24.0` | `3.27.0` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.28.0` | `0.29.0` |
| [shellexpand](https://gitlab.com/ijackson/rust-shellexpand) | `3.1.1` | `3.1.2` |
| [tower](https://github.com/tower-rs/tower) | `0.5.2` | `0.5.3` |
| [inventory](https://github.com/dtolnay/inventory) | `0.3.21` | `0.3.24` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [pdf-extract](https://github.com/jrmuizel/pdf-extract) | `0.7.12` | `0.12.0` |
| [objc2](https://github.com/madsmtm/objc2) | `0.6.3` | `0.6.4` |
| [schemaui](https://github.com/yuniqueunic/schemaui) | `0.12.0` | `0.12.4` |
| [colored](https://github.com/mackwic/colored) | `3.0.0` | `3.1.1` |
| [crossterm](https://github.com/crossterm-rs/crossterm) | `0.28.1` | `0.29.0` |
| [ratatui](https://github.com/ratatui/ratatui) | `0.30.0` | `0.30.2` |
| [rustyline](https://github.com/kkawakam/rustyline) | `15.0.0` | `17.0.2` |
| [schemars](https://github.com/GREsau/schemars) | `1.2.1` | `1.2.2` |
| [unicode-width](https://github.com/unicode-rs/unicode-width) | `0.2.0` | `0.2.2` |
| [unicode-segmentation](https://github.com/unicode-rs/unicode-segmentation) | `1.12.0` | `1.13.3` |
| [zeroize](https://github.com/RustCrypto/utils) | `1.8.2` | `1.9.0` |
| [image](https://github.com/image-rs/image) | `0.25.9` | `0.25.10` |
| [windows](https://github.com/microsoft/windows-rs) | `0.60.0` | `0.62.2` |
| [vt100](https://github.com/doy/vt100-rust) | `0.15.2` | `0.16.2` |



Updates `anyhow` from 1.0.100 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.100...1.0.104)

Updates `async-trait` from 0.1.89 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.92)

Updates `axum` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9)

Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.44...v0.4.45)

Updates `clap` from 4.5.54 to 4.5.60
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.54...clap_complete-v4.5.60)

Updates `clap_complete` from 4.5.65 to 4.6.9
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.65...clap_complete-v4.6.9)

Updates `reqwest` from 0.13.1 to 0.13.4
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.1...v0.13.4)

Updates `rig-core` from 0.39.0 to 0.42.0
- [Release notes](https://github.com/0xPlaygrounds/rig/releases)
- [Changelog](https://github.com/0xPlaygrounds/rig/blob/main/CHANGELOG.md)
- [Commits](0xPlaygrounds/rig@v0.39.0...v0.42.0)

Updates `rusqlite` from 0.32.1 to 0.40.2
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](rusqlite/rusqlite@v0.32.1...v0.40.2)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `thiserror` from 2.0.18 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.20)

Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `toml` from 0.9.11+spec-1.1.0 to 1.0.6+spec-1.1.0
- [Commits](toml-rs/toml@toml-v0.9.11...toml-v1.0.6)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `ignore` from 0.4.25 to 0.4.32
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@ignore-0.4.25...ignore-0.4.32)

Updates `tree-sitter` from 0.25.10 to 0.26.12
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](tree-sitter/tree-sitter@v0.25.10...v0.26.12)

Updates `tower-http` from 0.6.8 to 0.7.0
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.8...tower-http-0.7.0)

Updates `tracing-appender` from 0.2.4 to 0.2.5
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-appender-0.2.4...tracing-appender-0.2.5)

Updates `uuid` from 1.19.0 to 1.25.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.19.0...1.25.0)

Updates `futures-util` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `tokio-util` from 0.7.18 to 0.7.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.18...tokio-util-0.7.19)

Updates `flate2` from 1.1.5 to 1.1.9
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.5...1.1.9)

Updates `libc` from 0.2.186 to 0.2.189
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.189/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.186...0.2.189)

Updates `regex` from 1.12.2 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.2...1.13.1)

Updates `shlex` from 1.3.0 to 2.0.1
- [Changelog](https://github.com/comex/rust-shlex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/comex/rust-shlex/commits)

Updates `similar` from 2.7.0 to 3.2.0
- [Changelog](https://github.com/mitsuhiko/similar/blob/main/CHANGELOG.md)
- [Commits](mitsuhiko/similar@2.7.0...3.2.0)

Updates `tempfile` from 3.24.0 to 3.27.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.24.0...v3.27.0)

Updates `tokio-tungstenite` from 0.28.0 to 0.29.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.28.0...v0.29.0)

Updates `shellexpand` from 3.1.1 to 3.1.2
- [Commits](https://gitlab.com/ijackson/rust-shellexpand/compare/shellexpand-3.1.1...shellexpand-3.1.2)

Updates `tower` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/tower-rs/tower/releases)
- [Commits](tower-rs/tower@tower-0.5.2...tower-0.5.3)

Updates `inventory` from 0.3.21 to 0.3.24
- [Release notes](https://github.com/dtolnay/inventory/releases)
- [Commits](dtolnay/inventory@0.3.21...0.3.24)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `pdf-extract` from 0.7.12 to 0.12.0
- [Commits](jrmuizel/pdf-extract@v0.7.12...v0.12.0)

Updates `objc2` from 0.6.3 to 0.6.4
- [Commits](madsmtm/objc2@objc2-0.6.3...objc2-0.6.4)

Updates `schemaui` from 0.12.0 to 0.12.4
- [Release notes](https://github.com/yuniqueunic/schemaui/releases)
- [Changelog](https://github.com/YuniqueUnic/schemaui/blob/main/CHANGELOG.md)
- [Commits](YuniqueUnic/schemaui@schemaui-v0.12.0...schemaui-v0.12.4)

Updates `colored` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/mackwic/colored/releases)
- [Changelog](https://github.com/colored-rs/colored/blob/master/CHANGELOG.md)
- [Commits](colored-rs/colored@v3.0.0...v3.1.1)

Updates `crossterm` from 0.28.1 to 0.29.0
- [Release notes](https://github.com/crossterm-rs/crossterm/releases)
- [Changelog](https://github.com/crossterm-rs/crossterm/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crossterm-rs/crossterm/commits/0.29)

Updates `ratatui` from 0.30.0 to 0.30.2
- [Release notes](https://github.com/ratatui/ratatui/releases)
- [Changelog](https://github.com/ratatui/ratatui/blob/main/CHANGELOG.md)
- [Commits](ratatui/ratatui@ratatui-v0.30.0...ratatui-v0.30.2)

Updates `rustyline` from 15.0.0 to 17.0.2
- [Release notes](https://github.com/kkawakam/rustyline/releases)
- [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md)
- [Commits](kkawakam/rustyline@v15.0.0...v17.0.2)

Updates `schemars` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/GREsau/schemars/releases)
- [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md)
- [Commits](GREsau/schemars@v1.2.1...v1.2.2)

Updates `unicode-width` from 0.2.0 to 0.2.2
- [Commits](unicode-rs/unicode-width@v0.2.0...v0.2.2)

Updates `unicode-segmentation` from 1.12.0 to 1.13.3
- [Commits](https://github.com/unicode-rs/unicode-segmentation/commits)

Updates `zeroize` from 1.8.2 to 1.9.0
- [Commits](RustCrypto/utils@zeroize-v1.8.2...zeroize-v1.9.0)

Updates `image` from 0.25.9 to 0.25.10
- [Changelog](https://github.com/image-rs/image/blob/v0.25.10/CHANGES.md)
- [Commits](image-rs/image@v0.25.9...v0.25.10)

Updates `windows` from 0.60.0 to 0.62.2
- [Release notes](https://github.com/microsoft/windows-rs/releases)
- [Commits](https://github.com/microsoft/windows-rs/commits)

Updates `vt100` from 0.15.2 to 0.16.2
- [Changelog](https://github.com/doy/vt100-rust/blob/main/CHANGELOG.md)
- [Commits](doy/vt100-rust@v0.15.2...v0.16.2)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap
  dependency-version: 4.5.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_complete
  dependency-version: 4.6.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: colored
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: crossterm
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: flate2
  dependency-version: 1.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: futures-util
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: ignore
  dependency-version: 0.4.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: image
  dependency-version: 0.25.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: inventory
  dependency-version: 0.3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: libc
  dependency-version: 0.2.189
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: objc2
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: pdf-extract
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: ratatui
  dependency-version: 0.30.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: reqwest
  dependency-version: 0.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: rig-core
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: rusqlite
  dependency-version: 0.40.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: rustyline
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: schemars
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: schemaui
  dependency-version: 0.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: shellexpand
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: shlex
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: similar
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: tempfile
  dependency-version: 3.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tokio-tungstenite
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tokio-util
  dependency-version: 0.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: toml
  dependency-version: 1.0.6+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: tower
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tower-http
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tracing-appender
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tree-sitter
  dependency-version: 0.26.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: unicode-segmentation
  dependency-version: 1.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: unicode-width
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: uuid
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: vt100
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: windows
  dependency-version: 0.62.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: zeroize
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the cargo group with 47 updates chore(deps): bump the cargo group across 1 directory with 47 updates Aug 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-19ac277467 branch from d25bbd8 to 7a3c1be Compare August 25, 2026 13:05
@camilesing camilesing closed this Aug 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-19ac277467 branch August 25, 2026 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant