[zrm625]

Refresh dependencies from the synchronized main branch, preserving the authentication fixes from #6. This replaces the earlier pre-sync dependency patch with a fresh compatible graph resolution and qualified direct/catalog updates.

• Update React 19.2.8, Vite 8.2.2, Vitest 4.1.11, Tailwind 4.3.3, Shiki 4.4.3, Sentry 10.73, OpenTelemetry 2.11, AJV 8.20 and compatible runtime/UI/build helpers. Keep catalog references and coherent families.
• Qualify Babel parser 8 and jose 6. Use jose's public inferred key/resolver types; existing parser, JWT verification, key rotation and authentication regressions pass. Update worker-bundler 0.2.1 → 0.2.3 and qualify the packaged self-host runtime.
• Retarget the Cloudflare Vite credentials patch to the already-used 1.32.3 request-forwarding block. Preserve all seven patches, add a contextual installed-content sentinel and a negative regression.
• Keep Better Auth/core/API-key 1.6.12 together because 1.7 removes the MCP plugin. Supply its documented empty device schema customization for newer Zod; the default database schema is unchanged and real CLI device authorization passes.
• Regenerate the MCP result schema and smoke harness with owner generators. The only MCP schema difference makes seconds explicit in the existing RFC3339 date-time annotation; accepted valid timestamps remain unchanged. Add timestamp contract coverage.
• Bind marketing plugins to Astro 6's Vite 7 peer instead of the apps' Vite 8. Fix the standalone MCP Apps fixture's obsolete --artifacts flag; artifacts are now served by default.

Deferred with compatibility barriers: TanStack's removal of the not-found match field used by org canonicalization; Better Auth's MCP migration; SDK 1.30 versus patched agents' exact 1.29 type graph; Oxlint's new React behavior diagnostics; Effect/compiler beta and Vitest 5 migrations; Cloudflare/workerd, QuickJS/WASM, Electron/native packaging and other unqualified major/0.x cohorts. Existing runtime pins remain. No blanket transitive major override.

Validation uses Bun 1.3.11 and Node 24, with concurrency two:

• Clean frozen install, owner bootstrap, formatting, lint, 45 typecheck tasks and 39 native test tasks; self-host retains all 179 passing tests.
• All seven installed patches reverse-apply; three runtime sentinels, negative patch regression and route-tree checks pass.
• Four browser tests cover published local-emulator OIDC/SSO coexistence, explicit linking, MCP denial recovery/consent/PKCE, CLI device authorization and org routing.
• Eight standalone MCP Apps browser tests cover both supported host simulations, interaction, dark theme, inline delivery and reopening saved artifacts.
• Production self-host frontend, packaged self-host runtime and marketing build pass.

Hosted CI status is separate from these local results. No release, package/image publication or deployment is included. Existing issuer-scoped identity and authenticated legacy relinking behavior from #6 remains unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T15:03:58.819424Z	52a8129	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52a8129f46

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Replace the AI-attributed commit identity

The target commit records both its author and committer as Codex <codex@openai.com>, explicitly adding AI attribution to commit metadata. Replace those identities with the appropriate non-AI author and committer before this commit is published.

AGENTS.md reference: AGENTS.md:L41-L42

Useful? React with 👍 / 👎.