Scheduled Maintenance Report — 2026-03-06

[github-actions]

Scheduled Maintenance Report

Date: 2026-03-06 08:34 UTC
Checks run: 16
Errors: 0

Status Summary

• Audit: 1 critical/high vulnerabilities
• Dependencies: 6 safe updates, 0 major updates
• Dep changes: 35 added, 61 removed
• Duplicates: 0 removable
• Lock file: in sync
• Install size: 1157.9 MB
• Versions: aligned | Protocol: ok (npm — * is correct)
• Engine: Node.js 20 (LTS)
• Lint: clean
• TypeScript: clean
• Markers: 4 total (0 urgent: FIXME/HACK/WORKAROUND)
• Bundle: 1 files over 500 KB
• Build: all passing (39.8s total)
• Coverage: 2 package(s) below 70%
• Branches: 5 merged, 0 stale updates, 0 stale
• CI: see trends above

Action Items

7 total: 2 automatable (🤖 auto), 2 need review (👀 review), 3 dedicated effort (📋 project)

• 🤖 auto Fix 1 critical/high security vulnerabilities — run npm audit fix
• 🤖 auto Update 6 safe dependencies — run npm update
• 👀 review Review 35 new dependencies — check for bloat or supply-chain risk
• 📋 project Investigate 1 large bundle file(s) — consider code-splitting or lazy-loading
• 📋 project Improve test coverage — add tests to packages below 70% threshold
• 👀 review Delete 5 merged branches — run git push origin --delete <branch>
• 📋 project CI pass rate below 80% — investigate flaky tests or recurring failures

---

Security Vulnerabilities (npm audit)

1 vulnerabilities found across ? packages.

Severity	Count
High	1

Action items (critical + high):

• tar (high) — fix available

Status: Audit: 1 critical/high vulnerabilities

Check: npm audit
Fix: npm audit fix — or npm audit fix --force for breaking major updates

---

Dependency Freshness

6 packages not on latest (6 safe updates, 0 major).

Safe updates — patch/minor (6) — run `npm update`

Package	Current	Wanted	Latest
@github/copilot-sdk	0.1.29	0.1.30	0.1.30
electron	40.6.1	40.6.1	40.8.0
eslint-plugin-playwright	2.8.0	2.9.0	2.9.0
eslint-plugin-react-hooks	7.1.0-canary-e0cc7202-20260227	7.1.0-canary-fd524fe0-20251121	7.0.1
globals	17.3.0	17.4.0	17.4.0
lucide-react	0.575.0	0.575.0	0.577.0

Status: Dependencies: 6 safe updates, 0 major updates

Check: npm outdated
Fix (patch/minor): npm update — safe, respects semver ranges
Fix (major): npm install <package>@latest — test thoroughly after upgrade

---

Dependency Changes (last 7 days)

35 added, 61 removed since 1c1c3c4.

Added (35)

• @eslint/config-array/node_modules/balanced-match
• @eslint/config-array/node_modules/brace-expansion
• @eslint/config-array/node_modules/minimatch
• @fastify/otel
• @fastify/otel/node_modules/@opentelemetry/api-logs
• @fastify/otel/node_modules/@opentelemetry/instrumentation
• @fastify/otel/node_modules/balanced-match
• @fastify/otel/node_modules/brace-expansion
• @fastify/otel/node_modules/minimatch
• @standard-schema/spec
• @supabase/auth-js
• @supabase/functions-js
• @supabase/postgrest-js
• @supabase/realtime-js
• @supabase/storage-js
• @supabase/supabase-js
• @types/esrecurse
• @types/phoenix
• @types/ws
• @typescript-eslint/typescript-estree/node_modules/balanced-match
• accepts/node_modules/mime-db
• accepts/node_modules/mime-types
• electron/node_modules/undici-types
• eslint/node_modules/balanced-match
• eslint/node_modules/brace-expansion
• ... and 10 more

Removed (61)

• @apm-js-collab/code-transformer
• @apm-js-collab/tracing-hooks
• @electron/windows-sign
• @electron/windows-sign/node_modules/fs-extra
• @electron/windows-sign/node_modules/jsonfile
• @electron/windows-sign/node_modules/universalify
• @eslint/eslintrc
• @eslint/eslintrc/node_modules/globals
• @sentry/node/node_modules/brace-expansion
• @sentry/node/node_modules/minimatch
• @tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core
• @tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime
• @tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads
• @tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime
• @tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util
• @tailwindcss/oxide-wasm32-wasi/node_modules/tslib
• @types/prop-types
• @types/react
• @types/react-dom
• @typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys
• accepts/node_modules/negotiator
• array-flatten
• body-parser/node_modules/debug
• body-parser/node_modules/ms
• cac
• ... and 36 more

Status: Dep changes: 35 added, 61 removed

Review: Check unexpected additions for bloat or supply-chain risk
Check: diff <(git show HEAD~N:package-lock.json | jq '.packages | keys') <(jq '.packages | keys' package-lock.json)

---

Duplicate Dependencies (npm dedupe)

Running npm dedupe would:

• Change 3 package versions

Status: Duplicates: 0 removable

Check: npm dedupe --dry-run
Fix: npm dedupe && npm ci — then run npm run verify to confirm nothing broke

---

Lock File Integrity

package-lock.json is in sync with package.json.

Status: Lock file: in sync

---

Package Install Size

Total node_modules: 1157.9 MB

Per-package dist output (10 packages)

Package	Dist Size
electron	1.1 MB
frontend	1.1 MB
core	0.5 MB
shared	0.4 MB
agent-manager	0.0 MB
agent-core	0.0 MB
agent-runtime	0.0 MB
server	0.0 MB
agent-registry	0.0 MB
agent-from-md	0.0 MB

Status: Install size: 1157.9 MB

Check: du -sh node_modules/
Fix: Remove unused dependencies, use npm dedupe, consider lighter alternatives

---

Workspace Version Alignment

All 11 workspace packages are at version 2.1.37.

Cross-workspace references use * — this is correct for npm workspaces (npm does not support the workspace:* protocol).

Status: Versions: aligned | Protocol: ok (npm — * is correct)

---

Engine Versions

Engine	Current	Required
Node.js	v20.20.0	>=20.0.0
npm	10.8.2	>=10.0.0

Newer LTS available: Node.js 24. Current: 20.

Status: Engine: Node.js 20 (LTS)

Check: node --version && npm --version
Fix: Update Node.js via nvm install --lts or update the CI workflow / Dockerfile base image

---

Lint Health

All 9 packages pass linting.

Package	Errors	Status
@agentage/agent-core	0	passing
@agentage/agent-from-md	0	passing
@agentage/agent-registry	0	passing
@agentage/agent-runtime	0	passing
@agentage/core	0	passing
@agentage/electron	0	passing
@agentage/frontend	0	passing
@agentage/server	0	passing
@agentage/shared	0	passing

Status: Lint: clean

---

TypeScript Health

Clean — no @ts-ignore or as any found (excluding tests).

Pattern	Count	Severity
as unknown	14	info
// eslint-disable	31	info

Status: TypeScript: clean

Check: grep -rn 'as any' packages/ --include='*.ts' --include='*.tsx' | grep -v test
Fix: Replace as any with proper types; replace @ts-ignore with @ts-expect-error

---

Code Markers (TODO / FIXME / HACK)

4 markers found across the codebase.

Marker	Count
TODO	4

Status: Markers: 4 total (0 urgent: FIXME/HACK/WORKAROUND)

Check: grep -rn 'TODO\|FIXME\|HACK' packages/ --include='*.ts' --include='*.tsx'
Fix: Address each marker — resolve FIXMEs and HACKs first, then TODOs

---

Bundle Size

Total bundle: 1134.7 KB (JS: 1068.6 KB, CSS: 65.3 KB, Other: 0.8 KB)

1 files over 500 KB:

File	Size
assets/main-BtWCBr35.js	552.2 KB

Top 10 JS chunks

File	Size
assets/main-BtWCBr35.js	552.2 KB
assets/markdown-_Dy2zPzC.js	100.8 KB
assets/shared-pJqHc2xv.js	70.0 KB
assets/lucide-Cnjf9-ol.js	52.9 KB
assets/ProjectsPage-BFY4fsXq.js	44.5 KB
assets/ProjectDetailsPage-BTaxD2uZ.js	43.9 KB
assets/index-nyaxDEFw.js	34.7 KB
assets/ChatPage-CSelYRyQ.js	21.7 KB
assets/hljs-Db82yE7y.js	20.3 KB
assets/AgentsPage-v1MV7L7B.js	18.0 KB

Status: Bundle: 1 files over 500 KB

Check: du -sh packages/frontend/dist/
Fix: Code-split large chunks, lazy-load routes, tree-shake unused imports

---

Build Time

Total build time: 39.8s across 10 packages.

Package	Time	Status
@agentage/shared	3.2s	ok
@agentage/agent-core	1.8s	ok
@agentage/agent-from-md	1.1s	ok
@agentage/agent-runtime	1.4s	ok
@agentage/agent-registry	1.3s	ok
@agentage/agent-manager	1.3s	ok
@agentage/core	3.2s	ok
@agentage/frontend	12.1s	ok
@agentage/server	1.5s	ok
@agentage/electron	13.0s	ok

Status: Build: all passing (39.8s total)

Check: time npm run build -w <package>
Fix: Enable incremental TypeScript builds, reduce barrel exports, check for circular deps

---

Test Coverage

Overall: Lines 69.37% | Branches 47.11% | Functions 61.76% | Statements 68.43%
Threshold: 70%

Below threshold: Lines (69.37%), Branches (47.11%), Functions (61.76%)

Per-package line coverage (8 packages)

Package	Line Coverage	Status
shared	56.3%	below
agent-runtime	58.4%	below
core	79.9%	ok
frontend	81.3%	ok
agent-registry	90.0%	ok
agent-manager	97.7%	ok
agent-core	100.0%	ok
agent-from-md	100.0%	ok

Status: Coverage: 2 package(s) below 70%

Check: npm run test:coverage
Fix: Add unit tests for uncovered packages, focus on packages below threshold

---

Stale Branches

5 merged branches can be deleted:

• origin/chore/maintenance-2026-02-27
• origin/claude/fix-all-github-issues-ijI6K
• origin/claude/rebase-download-artifact-7YJoI
• origin/fix/ci-auto-20260301
• origin/release/auto-v2.1.35

Check: git branch -r --merged origin/master and git for-each-ref --sort=committerdate refs/remotes/
Fix (merged): git push origin --delete <branch-name> for each merged branch
Fix (stale): Confirm with the author, then git push origin --delete <branch-name>

Status: Branches: 5 merged, 0 stale updates, 0 stale

---

CI Pipeline Trends (4 weeks)

Master CI Pass/Fail & Duration:

Week	Runs	Pass	Fail	Rate	Avg Duration
2026-02-08	8	6	2	75%	10.3m
2026-02-15	66	58	8	88%	11.0m
2026-02-22	20	17	3	85%	10.0m
2026-03-01	6	6	0	100%	9.8m

PR Merge Velocity:

Week	PRs Merged	Avg Time-to-Merge
2026-02-01	7	2.2h
2026-02-08	14	3.9h
2026-02-15	16	6.0h
2026-02-22	8	5.1h
2026-03-01	6	2.0h

Release Cadence:

Week	Releases	Tags
2026-02-01	2	v2.1.20, v2.1.19
2026-02-08	4	v2.1.24, v2.1.23, v2.1.22, v2.1.21
2026-02-15	7	v2.1.31, v2.1.30, v2.1.29, v2.1.28, v2.1.27, v2.1.26, v2.1.25
2026-02-22	4	v2.1.35, v2.1.34, v2.1.33, v2.1.32
2026-03-01	2	v2.1.37, v2.1.36

Status: CI: see trends above

Source: GitHub Actions API + Pull Requests API + Releases API
Fix (low pass rate): Investigate flaky tests, improve pre-merge checks
Fix (slow merges): Reduce review bottlenecks, automate more checks

---

Expected Outcome

1. Create a draft PR implementing all 🤖 auto items
2. Add a PR comment mapping each action item with status icons:
   • ✅ Done — with verification command output
   • 🟡 Partial — with explanation of what remains
   • ⏳ Not done — with reason (needs review / dedicated effort / author input)
   • ⛔ Not applicable — with explanation
3. Ensure CI passes on the PR
4. Items tagged 👀 review and 📋 project should be listed as "not done" with context, not attempted

Generated by scripts/maintenance/run-all.js