chore(deps): consolidate dependency updates

[snimu]

Summary

Consolidates the dependency updates from #602, #601, #558, #557, #556, #555, #554, and now also #571, #599, #713, and #714:

• undici 7.28.0 → 7.29.0 in packages/ai and packages/coding-agent
• transitive postcss 8.5.15 → 8.5.25
• marked 15.0.12 → 18.0.7 in packages/coding-agent and packages/tui
• @aws-sdk/client-bedrock-runtime 3.1083.0 → 3.1095.0
• @biomejs/biome 2.3.5 → 2.5.5, including config migration and formatter output required by 2.5.5
• @types/diff 7.0.2 → 8.0.0
• vitest 4.1.9 → 4.1.10 in packages/agent, packages/ai, and packages/coding-agent
• brace-expansion 5.0.7 → 5.0.9 (transitive, lockfile only; chore(deps): bump brace-expansion from 5.0.7 to 5.0.9 #571)
• ip-address 10.2.0 → 10.4.0 (transitive, lockfile only; chore(deps): bump ip-address from 10.2.0 to 10.4.0 #599)
• typebox ^1.1.24 → ^1.3.9 in packages/agent, packages/ai, and packages/coding-agent (lockfile resolves 1.3.10, released 2026-08-02; chore(deps): bump typebox from 1.1.38 to 1.3.9 #713)
• typescript ^5.9.2/^5.7.3 → ^7.0.2 (dev-only; all builds and checks in this repo run through tsgo, nothing invokes tsc; chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #714)

Intentionally NOT included: undici 8.9.0 from #712 — undici 8 requires Node >= 22.19.0 while this package declares engines.node >= 22.8.0, so the major bump would silently drop supported Node versions. undici stays on 7.29.0.

All included versions are past the repository's seven-day minimum release age (.npmrc min-release-age=7).

Validation

Latest main is merged in (through #852). All validation rerun on the final tree.

Local:

• npx --yes npm@11.17.0 install --package-lock-only --ignore-scripts --dry-run — up to date
• npx --yes npm@11.17.0 ci — clean install from the consolidated lockfile
• npm run build and npm run check — passed (pre-commit hook rerun also passed)

Headless, in a fresh cloud sandbox (node:22-bookworm, isolated from this machine):

• npm ci from the consolidated lockfile; verified installed versions: typescript 7.0.2, typebox 1.3.10, undici 7.29.0, brace-expansion 5.0.9, ip-address 10.4.0
• npm run build, tsgo --noEmit, biome check --error-on-warnings — all passed
• packages/tui: 742 tests passed
• packages/ai: 315 passed / 727 skipped (provider-key suites)
• packages/agent: 69 passed
• packages/coding-agent: full suite in CI's 3 shards, diffed against a main-tree control build in the same sandbox: failure sets are identical between main and this branch on every shard (the sandbox-environment failures — kernel/uv suites, EACCES-as-root tests, install-path tests — reproduce byte-for-byte on main; the two single-test diffs in shard 2 were flakes that passed on re-run)
• process-stress tagged suite (real daemon supervisor + worker processes): 8 passed
• ACP suites: 22 passed
• Direct offline CLI smoke with isolated PRIME_AGENT_HOME and the faux provider:
  • text mode exited 0 and printed upgrade response 1 (stderr: telemetry notice only)
  • JSON mode exited 0 and emitted JSONL session/turn/message events with upgrade response 1, empty stderr
  • RPC mode exited 0 and returned a successful get_state response, empty stderr
  • no provider/API calls in any mode

Supersedes #602, #601, #558, #557, #556, #555, #554, #571, #599, #713, and #714. Leaves #712 open deliberately (see above).

---

Note

Medium Risk
TypeScript 7 and marked 18 are major-ish toolchain/library jumps alongside a large lockfile refresh, though scope is mostly dev deps and validated tests/smoke paths rather than core auth or payment logic.

Overview
This PR consolidates several Dependabot-style bumps into one lockfile and aligns tooling with Biome 2.5.5 and TypeScript 7.0.2 at the repo root.

Runtime / library updates include undici ^7.29.0, @aws-sdk/client-bedrock-runtime ^3.1095.0, marked ^18.0.7, typebox ^1.3.9, and vitest ^4.1.10 across agent, ai, and coding-agent. packages/coding-agent also moves @types/diff to ^8.0.0.

Biome migrates biome.json from recommended: true to preset: "recommended" and turns off useOptionalChain and noUnsafeOptionalChaining so existing optional-access patterns stay valid. Formatter output drives widespread test-only reshaping of Vitest it() calls (options object style); behavior is unchanged per PR validation.

Minor import/export ordering in coding-agent (sdk.ts, keybindings.ts, extensions/types.ts) matches Biome; no functional API changes there.

^{Reviewed by Cursor Bugbot for commit 8b44b1f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Upgrade Biome to 2.5.5 and TypeScript to 7.0.2 across the monorepo

• Updates @biomejs/biome from 2.3.5 to 2.5.5 and typescript from 5.x to 7.0.2 in root and all packages.
• Updates marked to 18.x, typebox to 1.3.9, undici to 7.29.x, and @aws-sdk/client-bedrock-runtime to 3.1095.x.
• Adjusts biome.json to use the new preset: "recommended" syntax and disables complexity.useOptionalChain and correctness.noUnsafeOptionalChaining rules.
• Reformats it() test signatures and minor export ordering across several files to satisfy updated Biome lint rules; no logic changes.

^{Macroscope summarized 8b44b1f.}

[snimu]

Status update: the remaining Test (ai) CI failure is not caused by this PR — it is upstream catalog drift that currently fails on every branch. packages/ai regenerates models.generated.ts from live provider catalogs during the CI build, and the opencode-go zen catalog moved deepseek-v4-flash to anthropic-messages, invalidating the high/xhigh expectation in test/supports-xhigh.test.ts. Verified by reproducing the identical failure on a pristine main checkout after npm run generate-models.

Fix is in #1218. Once that merges I'll merge main into this branch and CI here should go green.