chore(deps): update tsx to 4.23.5

[steipete]

Summary

• update the only stale direct dependency, tsx, from 4.23.1 to 4.23.5
• refresh the pnpm lockfile peer-resolution snapshots
• confirm every declared dependency now matches its latest registry release

Proof

• pnpm outdated --format json filtered to latest != wanted — []
• pnpm exec tsx --version — tsx v4.23.5, Node 24.18.0
• pnpm run check
• pnpm run docs:check — 76 flags, 6 files
• pnpm run docs:site
• pnpm run test — 1,675 passed, 43 skipped
• pnpm run build
• pnpm run test:packed-cli — packed CLI help smoke passed
• built CLI --version — 0.16.1
• built CLI API dry-run exited 0
• autoreview clean: no accepted/actionable findings

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 11:08 PM ET / August 3, 2026, 03:08 UTC.

ClawSweeper review

What this changes

Updates the development dependency tsx from 4.23.1 to 4.23.5 and refreshes every affected pnpm lockfile resolution and peer snapshot.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

The patch is a coherent, correctly scoped dependency update with no actionable code-review findings. It remains open for normal owner review because this PR is authored by an OWNER, so automated cleanup must not close it.

Priority: P3
Reviewed head: 3ce717a3fc9479e2cf10b3990506bc1b5303f9c5
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The patch is narrowly scoped, lockfile-consistent, and backed by substantial reported validation, with no correctness or supply-chain concern found.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored maintenance PR is outside the external-contributor proof gate; its body nevertheless reports real command validation including test, build, packed-CLI, and API dry-run checks.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored maintenance PR is outside the external-contributor proof gate; its body nevertheless reports real command validation including test, build, packed-CLI, and API dry-run checks.
Evidence reviewed	4 items	Focused manifest update: The PR changes the sole direct tsx development-dependency declaration from ^4.23.1 to ^4.23.5; Oracle invokes it for documentation checks, browser scripts, and test/CLI entrypoints. Lockfile graph is internally consistent: The lockfile resolves tsx@4.23.5 and consistently rewrites the affected Vite/Vitest peer-resolution keys to the same version; git diff --check reported no whitespace errors. Recent dependency-maintenance provenance: Current main's latest commit touching these dependency files is Peter Steinberger's dependency update, indicating shared recent ownership of this maintenance surface.
Findings	None	None.
Security	None	None.

How this fits together

Oracle uses tsx to run TypeScript-based CLI entrypoints, documentation tooling, browser scripts, and integration tests. package.json declares the tool version, while pnpm-lock.yaml pins the exact dependency and peer-resolution graph consumed by developer and CI installs.

flowchart LR
  A[Developer and CI commands] --> B[Package manifest]
  B --> C[pnpm lockfile]
  C --> D[tsx runtime]
  D --> E[CLI scripts and tests]
  E --> F[Build and packaged CLI checks]

Loading

Decision needed

Question	Recommendation
Should this owner-authored tsx dependency update merge once the remaining macOS and Windows build checks have completed successfully?	Merge after platform checks: Merge this narrow lockfile-consistent update once the pending platform builds are green.

Why: The patch is technically sound, but repository policy requires explicit maintainer judgment rather than automated closure for work authored by an OWNER.

Before merge

• Complete next step (P2) - No repair lane is needed: this owner-authored PR has no actionable review defect and should proceed through normal review and check completion.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	2 files affected; 1 direct dependency changed; +15/-15 lines	All lockfile churn is attributable to the single tsx version replacement and its Vite/Vitest peer snapshots.

Technical review

Best possible solution:

Merge the focused manifest-and-lockfile update after normal owner review and the remaining macOS and Windows build checks complete successfully.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is routine dependency maintenance, not a report of broken existing behavior. The affected execution paths are covered by the CLI, documentation, browser-script, and test commands cited in the PR body.

Is this the best way to solve the issue?

Yes. Updating the existing direct dependency and regenerating only the affected pnpm lockfile resolutions is the narrowest maintainable approach; no application-code change or parallel tool path is needed.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 4f7085421c30.

Labels

Label changes:

• add P3: This is routine, low-risk development-dependency maintenance with no reported user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored maintenance PR is outside the external-contributor proof gate; its body nevertheless reports real command validation including test, build, packed-CLI, and API dry-run checks.

Label justifications:

• P3: This is routine, low-risk development-dependency maintenance with no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored maintenance PR is outside the external-contributor proof gate; its body nevertheless reports real command validation including test, build, packed-CLI, and API dry-run checks.

Evidence

What I checked:

• Focused manifest update: The PR changes the sole direct tsx development-dependency declaration from ^4.23.1 to ^4.23.5; Oracle invokes it for documentation checks, browser scripts, and test/CLI entrypoints. (package.json:97, 3ce717a3fc94)
• Lockfile graph is internally consistent: The lockfile resolves tsx@4.23.5 and consistently rewrites the affected Vite/Vitest peer-resolution keys to the same version; git diff --check reported no whitespace errors. (pnpm-lock.yaml:122, 3ce717a3fc94)
• Recent dependency-maintenance provenance: Current main's latest commit touching these dependency files is Peter Steinberger's dependency update, indicating shared recent ownership of this maintenance surface. (package.json:97, 877af9db4ab0)
• Submitted validation evidence: The PR body reports successful checks, documentation validation, build, packed-CLI smoke, and a full test run with 1,675 passing and 43 skipped tests; two platform builds were still queued or running in the supplied check state. (package.json:31, 3ce717a3fc94)

Likely related people:

• steipete: The PR commit is authored by Peter Steinberger, and current main's most recent commit touching the same manifest and lockfile pair is also authored by Peter Steinberger. (role: recent dependency maintainer; confidence: high; commits: 3ce717a3fc94, 877af9db4ab0; files: package.json, pnpm-lock.yaml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed as af488548953d9c03abf768afb61fb8ff64b41fc7 after exact-head CI passed on 3ce717a3fc9479e2cf10b3990506bc1b5303f9c5.

Proof:

• pnpm outdated --format json filtered to latest != wanted returned []
• pnpm exec tsx --version reported tsx v4.23.5 on Node 24.18.0
• pnpm run check
• pnpm run docs:check — 76 flags, 6 files
• pnpm run docs:site
• pnpm run test — 1,675 passed, 43 skipped
• pnpm run build
• pnpm run test:packed-cli — packed CLI help smoke passed
• built CLI --version reported 0.16.1 and an API dry-run exited 0
• autoreview: clean, no accepted/actionable findings
• CI run: https://github.com/steipete/oracle/actions/runs/30780891396 — macOS, Windows, Ubuntu, CDP proof, and GitGuardian all passed

macOS waited about 12 minutes for runner capacity, then completed successfully without a retry.