PiClaw v2.14.0 — “The White Rider”

PiClaw v2.14.0 — “The White Rider”

There came back to Piclaw a runtime clothed in white, bearing a new lockfile and expecting every road, forge and baggage cart to recognise it at once.

Bun 1.4.0 now governs the live service, local installation, CI, E2E, integration, Docker builds and portable releases. The repository and core E2E lockfiles have crossed into lockfile version 2; Bun 1.3 cannot read them. This is a minor release because the runtime beneath the application has changed, not because someone found a larger numeral and wished to see it used.

Around that change marched a considerable company: TypeScript 7, OpenAI 7, updated web and test dependencies, repaired protected recovery, visible upload progress, failed-draft preservation, security overrides, translated documentation, and the departure of the old bundled M365 experiment. The exact range v2.13.3..97ad9f8463177dea2e6389cf0549b312b90d4dfa contains 52 commits, 23 merged PRs and 108 changed files, with 5,429 insertions and 10,824 deletions. The deletions owe much to sending M365 out by the proper add-on gate rather than keeping a private wing of Orthanc in the runtime tree.

Book I — The White Rider

The old grey runtime did honourable work. It could not read the new tablets.

Bun 1.4 throughout the realm

• BUN_VERSION now fixes the release runtime at 1.4.0. The same value feeds CI, E2E, the reusable integration gate, Docker builds, portable artefact builders and smoke-test expectations.
• bun-types is pinned exactly at 1.4.0, keeping compile-time declarations aligned with the executable that runs the service.
• Root, Playwright and core E2E lockfiles use Bun lockfile version 2. Bun 1.3.14 rejects these files with Unknown lockfile version; operators must upgrade Bun before installing from this source tree.
• CI resolves BUN_VERSION through setup-bun’s supported bun-version input. Whitespace is removed before the value crosses the workflow boundary, since even the White Council may be defeated by a trailing newline if YAML is allowed to chair the meeting.
• Core E2E dependencies now have their own committed lockfile and frozen installation path. Browser evidence no longer depends on whichever transitive versions happened to be wandering near the runner that morning.
• Build-style vendor outputs are normalised before their hashes and metadata are written. Bun 1.4.0 may minify a line with trailing spaces; the release no longer preserves those spaces as sacred artefacts and then fails its own formatter gate.
• The active Piclaw service and the exact-main hosted run both use Bun 1.4.0. The runtime upgrade therefore has local and hosted execution evidence, rather than a declaration file wearing the runtime’s cloak.

Lacho calad! Drego morn! — Sindarin: “Flame light! Flee night!”, attested in Unfinished Tales. A fair summary of replacing a runtime, its locks and several vulnerable dependencies before asking the test suite whether dawn has actually improved matters.

Book II — The Muster of Dependencies

The White Rider did not come alone. Behind him followed packages in such number that even Théoden might have asked whether all possessed valid transitive papers.

Runtime and compiler changes

• OpenAI advances from 6.40.0 to 7.5.0 after the intermediate 7.4.0 update and the final OpenAI/TypeBox alignment.
• TypeScript advances to exact 7.0.2; the build and external syntax probes were updated for the new compiler behaviour.
• TypeBox advances from 1.3.7 to 1.3.16.
• Routine runtime updates include cron-parser 5.10.0, js-yaml 5.3.0, KaTeX 0.18.4, Marked 18.0.10, Preact 10.29.8 and the current CodeMirror, signals, ESLint and build-tool releases.
• Playwright moves to 1.62.1; @playwright/test is pinned at 1.62.1; Playwright BDD advances to 9.2.0; Cucumber advances to 13.2.1. Their locks and generated feature paths were refreshed together.
• GitHub Actions dependencies advance as well, including actions/checkout 7.0.1, actions/github-script 9.0.0 and docker/setup-buildx-action 4.3.0.

Security work

• Direct dependency alerts were cleared, including the DOMPurify and WebSocket updates completed before the broader dependency refresh.
• Exact transitive overrides now cover fast-xml-parser 5.7.3, body-parser 2.3.0, @hono/node-server 1.19.15, ip-address 10.3.1, protobufjs 8.6.6, @protobufjs/utf8 1.1.1, brace-expansion 5.0.9, fast-uri 3.1.5, hono 4.12.34, qs 6.15.2 and ws 8.21.0, alongside the existing CodeMirror overrides.
• The dependency policy remains exact pins only: no ^ or ~ ranges in the root runtime contract.
• bun audit --production reports no vulnerabilities across 403 packages on Bun 1.4.0.
• Weekly Dependabot groups now cover the root Bun dependencies, GitHub Actions, E2E packages and Playwright tooling. The gates have been reopened, though the visitors are expected to arrive with tests and not merely genealogy.

Book III — Repairs upon the Road

A changed runtime is of limited comfort if uploads vanish, drafts burn and recovery walks in circles after compaction.

Upload progress and failure recovery

• Classic and Visual compose surfaces share a common upload-transfer module.
• Attachment uploads report percentage progress through an accessible progress bar with the current value exposed to assistive technology.
• A message is sent only after every upload succeeds.
• If an upload fails, the exact draft text and existing attachments return to the compose box; no message POST is attempted.
• If message submission fails after an upload succeeded, the draft and uploaded attachment remain available for retry.
• Workspace uploads use the same progress mechanism rather than maintaining a second, subtly different account of how percentages work.
• E2E coverage exercises progress display, all-upload completion, upload failure and failed-submission restoration. The former approach—optimism followed by an empty compose box—has left by the same gate as several weaker counsellors.

Protected recovery after compaction

• Protected recovery now carries a one-based handoff_depth through its typed control intent.
• Automatic handoffs stop at depth 2, preventing a continuation from founding a hereditary line of continuations.
• Compaction or rotation may complete before handoff without losing the recovery chain.
• Web callers persist the handoff for durable ordering with cursor and terminal-message state; non-web callers consume the same bounded contract directly.
• Tests cover compaction before continuation, typed authority, handoff limits and resumed tool-enabled execution.

Book IV — The Gates Reopened

The temporary submission pause banner has been removed. English, Simplified Chinese and Japanese READMEs once again describe the same current feature set and contribution policy.

The bundled experimental M365 extension has also departed the main runtime. Its implementation, package, skills, tests, status hints and private dependency estate—46 files and more than seven thousand deleted lines—have been removed. Microsoft 365 integration remains available through the maintained external add-on at https://rcarmo.github.io/piclaw-addons/addons/m365/.

This is less an exile than a proper division of realms. The core distribution no longer carries an experimental court whose dependencies, auth paths and release cadence belonged elsewhere. Those who need M365 may install the add-on; everyone else is spared its baggage train.

Book V — The Muster-Roll

Exact-main hosted CI at 97ad9f8463177dea2e6389cf0549b312b90d4dfa is green:

• 4,208 passed;
• three baseline skips;
• zero failures;
• 21,900 assertions across 4,211 tests and 606 files;
• 23 feature tests passed; and
• nine frontend tests passed.

Dependency pins, Actions workflow shape, environment surface, circular dependencies and local test entrypoints also pass. The release cut will still run its own versioned local, UX, integration, package and publication gates; a victorious muster-roll from main does not exempt the tagged army from appearing on the field.

Known Shadows

• Bun 1.4.0 is now the minimum source-install runtime because lockfile version 2 is unreadable by Bun 1.3. Upgrade Bun before running bun install from this release.
• The Earendil runtime family remains aligned at 0.84.2. Harness v3 remains latent and inactive; this release does not alter that boundary.
• Three pre-prompt compaction tests remain baseline-skipped and are excluded from the 4,208 passes.
• The M365 feature is no longer bundled. Existing users must install and configure the external add-on.
• The root production audit is clean. Development and add-on dependency surfaces retain their own locks and gates; the statement does not appoint one audit command Warden of every repository in Middle-earth.

Upgrade

• Upgrade from 2.13.3 to 2.14.0.
• Upgrade the host runtime to Bun 1.4.0 before installing; Bun 1.3 cannot consume the v2 lockfiles.
• No SQLite or session-data migration is required.
• Keep Earendil packages aligned at 0.84.2.
• Operators using the former bundled M365 extension should install @rcarmo/piclaw-addon-m365 from the Piclaw Add-ons catalogue and preserve their existing credentials/configuration during the move.
• Preserve the database backup and v2.13.3 rollback artefact through the normal canary, restart and delayed verification gates.

The Rider has returned in white. The lockfiles recognise him. The tests, being less impressionable than the Rohirrim, still require proof.