chore: dependabot npm/uv patch updates and tooling sync

.claude/settings.json

@@ -1,7 +1,8 @@
 {
   "model": "opusplan",
   "env": {
-    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
+    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1",
+    "CLAUDE_CODE_SUBAGENT_MODEL": "sonnet"
   },
   "permissions": {
     "allow": [

.github/copilot-instructions.md

@@ -44,6 +44,7 @@ When responding to PR review feedback, do not directly apply reviewer suggestion
 - **Cross-stack cleanup discovered mid-PR**: If the PR exposes a problem it doesn't own (other stacks, shared tooling), file a cross-linked follow-up issue instead of expanding the diff. List filed issues with URLs in the session summary.
 - **Rule writing**: Every clause must be load-bearing (rule / non-obvious why / concrete example). Cut restatements, redundant adverbs, and self-evident "why" tails.
 - **PR body updates after push**: Fetch the current body and modify in place via `gh pr edit <pr> --body-file` — never rewrite from scratch — so HTML-comment marker blocks (e.g. `<!-- pr-human-guide -->`) survive.
+- **Process new bot review feedback after each push to an open PR**: After pushing to a PR branch, check for new bot review comments the push may have triggered and address them before reporting the push complete.
 
 ## When in Doubt
 - Mirror existing implementations; prefer incremental changes with tests.

.github/dependabot.yml

@@ -9,3 +9,42 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"
+        update-types: [
+          "version-update:semver-major",
+          "version-update:semver-minor"
+        ]
+    cooldown:
+      semver-patch-days: 2
+
+  - package-ecosystem: "uv"
+    directory: "/fastapi"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"
+        update-types: [
+          "version-update:semver-major",
+          "version-update:semver-minor"
+        ]
+    cooldown:
+      semver-patch-days: 2
+
+  - package-ecosystem: "gomod"
+    directory: "/go-api"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"
+        update-types: [
+          "version-update:semver-major",
+          "version-update:semver-minor"
+        ]
+    cooldown:
+      semver-patch-days: 2

.gitignore

@@ -173,10 +173,12 @@ Thumbs.db
 # Claude settings
 .claude/settings.local.json
 .claude/scheduled_tasks.lock
+.claude/worktrees/
 
 # Externally-sourced skills (tracked via skills-lock.json, re-install with: npx skills add)
 .agent/skills/
 .agents/skills/
+.claude/skills/dev
 .claude/skills/js-deps
 .claude/skills/learn
 .claude/skills/mermaid-diagrams

.worktreeinclude

@@ -0,0 +1,2 @@
+.env
+**/.env

CLAUDE.md

@@ -164,7 +164,8 @@ Additional notes:
 - **npm cache permission error (EPERM)**: If `npm` fails with `Your cache folder contains root-owned files` (can recur after `sudo npm install -g`), pass `--cache /tmp/npm-cache-$$` to redirect to a writable temp dir (e.g. `npm outdated --cache /tmp/npm-cache-$$`). Permanent fix: `sudo chown -R 501:20 ~/.npm`
 - **Subagent `cd` does not persist across Bash calls**: Shell working directory resets between Bash tool calls. Never instruct a subagent to `cd <dir>` in one call and `npm install` in the next — npm will run in the wrong directory (typically the main repo root), silently modifying the wrong `package.json`. Always use `npm install --prefix <absolute-path>` so no `cd` is needed. **`npm run` `--prefix` syntax**: the flag must come before the script name — `npm --prefix /path run <script>`, NOT `npm run <script> --prefix /path` (the latter is silently ignored).
 - **Edit and Write tools both blocked on GitHub Actions workflow files**: A security hook blocks both the Edit and Write tools on `.github/workflows/*.yml` and `.github/workflows/*.yaml` files. The only reliable workaround is `cat > "$TMPDIR/workflow.yml" << 'EOF' ... EOF && mv "$TMPDIR/workflow.yml" .github/workflows/...` — do not use `sed` for multi-block YAML rewrites, it silently duplicates content into the wrong sections.
-- **`.claude/settings.json` edits need explicit per-edit auth**: Harness blocks Edit/Write to it even from an active skill. Auth must name the file AND the specific change (e.g., `Yes, edit .claude/settings.json to change X to Y`); `y`/`auto` is rejected. Surface the diff first; don't retry blindly.
+- **`.claude/settings.json` edits need explicit per-edit auth**: Harness blocks Edit/Write to it even from an active skill. Auth must name the file AND the specific change (e.g., `Yes, edit .claude/settings.json to change X to Y`); `y`/`auto` is rejected. Surface the diff first; don't retry blindly. Same block also breaks `git stash`/`checkout`/`reset` of this file — leaves a phantom stash and dirty tree; keep edits in the tree across branch switches when the file is unchanged between branches.
+- **zsh `status` is readonly** — `status=$?` errors. Use `rc=$?`.
 - **Hook deny on `@file` refs**: `gh api ... -F body=@<path>` / `-F query=@<path>` may be denied with "wasn't shown being created in the transcript" even right after Write. Fix: Read the file first (so its content appears) or `cat` it into a variable and pass `-f field="$VAR"`.
 - **`GH_TOKEN` env var overrides keyring for `gh` CLI**: If `GH_TOKEN` is set (e.g., a fine-grained PAT without PR write permissions), it takes precedence over the keyring token, causing `gh api` write calls to fail with 403. Run `unset GH_TOKEN` before any `gh pr create`, `gh pr edit`, or `gh api` calls that require write access.
 - **GitHub CLI pager fallback in VS Code**: If `gh` opens the alternate buffer or exits 130 despite `GH_PAGER=cat PAGER=cat`, redirect output to a temp file and inspect it in the editor or with CLI tools like `cat`, `sed`, or `rg` (for example, `TMP=$(mktemp ...); gh pr view ... > "$TMP"`).
@@ -181,6 +182,7 @@ Additional notes:
 - **Interactive sessions**: Do not commit unless explicitly asked
 - **Worktree/subagent sessions**: Auto-commit before returning (worktree is ephemeral)
 - **After every push to a PR branch**: Update the PR body via `gh pr edit <pr> --body-file` to reflect all commits. Fetch the current body and modify in place — never rewrite from scratch — so HTML-comment marker blocks (e.g. `<!-- pr-human-guide -->`) survive.
+- **After every push to an open PR**: Run `/pr-comments` to process any new bot review feedback the push may have triggered, before reporting the push complete.
 - **Spec status**: When a feature has a spec file in `specs/`, update its `Status` to `Complete` before merging the PR
 - **Wait for CI before merging**: Always check `gh pr checks <number>` and wait for all checks to pass before squash merging. Do not use `--admin` to bypass branch protection unless explicitly asked.
 - **Post-merge cleanup**: After squash merging a PR, immediately switch to main, pull, and delete the local branch (`git checkout main && git pull && git branch -d <branch>`). Never commit cleanup work (e.g. spec status updates) directly to local main — branch protection will reject the push, and the resulting squash PR will diverge from the local commit, causing a merge commit on the next pull instead of a fast-forward. Then ask the user: "Would you like me to review if there are any learnings from this session that I should persist going forward?"

angular-spring-ui/package.json

@@ -46,6 +46,7 @@
     "typescript-eslint": "8.56.1"
   },
   "overrides": {
-    "vite": "7.3.2"
+    "vite": "7.3.2",
+    "fast-uri": "3.1.2"
   }
 }

angular-ui/package.json

@@ -46,6 +46,7 @@
     "typescript-eslint": "8.56.1"
   },
   "overrides": {
-    "vite": "7.3.2"
+    "vite": "7.3.2",
+    "fast-uri": "3.1.2"
   }
 }

api/package.json

@@ -54,5 +54,8 @@
     "tsx": "^4.21.0",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.56.1"
+  },
+  "overrides": {
+    "fast-uri": "3.1.2"
   }
 }

cspell.config.yaml

@@ -9,6 +9,7 @@ words:
   - beforeunload
   - bufbuild
   - choco
+  - cooldown
   - debugpy
   - dedup
   - Dedup
@@ -21,6 +22,7 @@ words:
   - GHSA
   - githubcopilot
   - golangci
+  - gomod
   - gopath
   - GOPATH
   - gotest

go-api/go.mod

@@ -1,6 +1,6 @@
 module github.com/user/application-tracker/go-api
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/gin-gonic/gin v1.10.1

lambda-api/cdk/lib/lambda-api-stack.ts

@@ -39,6 +39,8 @@ export class LambdaApiStack extends cdk.Stack {
 
     this.fn = new nodejs.NodejsFunction(this, 'ApiHandler', {
       entry: path.join(__dirname, '../../src/handler.ts'),
+      projectRoot: path.join(__dirname, '../..'),
+      depsLockFilePath: path.join(__dirname, '../../package-lock.json'),
       handler: 'handler',
       runtime: lambda.Runtime.NODEJS_22_X,
       bundling: {

lambda-api/cdk/package.json

@@ -24,7 +24,10 @@
     "vitest": "4.1.5"
   },
   "dependencies": {
-    "aws-cdk-lib": "2.248.0",
+    "aws-cdk-lib": "2.254.0",
     "constructs": "10.6.0"
+  },
+  "overrides": {
+    "fast-uri": "3.1.2"
   }
 }