chore: consolidate pending notes and refresh dependency patches

[steipete]

Collect the complete ordered Unreleased notes and contributor credit for the prepared model, Web Search, browser recovery, Deep Research plan, and localization changes. Merge this PR after the implementation PRs.

Update Sweet Cookie 0.4.2 → 0.4.3 and TokenTally 0.1.4 → 0.1.5 consistently in the manifest and lockfile. Both releases were more than 48 hours old when installed; Node >=24 and the two-day release-age policy remain intact. A fresh outdated check reports no remaining updates.

Validation: build and check passed; the full suite passed 2,230 tests / 45 skipped after building the CLI. The built CLI with the updated dependencies completed a real API request and returned ORACLE_DEPS_OK. Local and final branch P0–P2 autoreview are clean. Exact-head CI is green: https://github.com/steipete/oracle/actions/runs/34178931052.

No version bump, tag, release, or publication is included. The implementation entries describe the proposed merged state and must not land ahead of their code.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 7, 2026, 10:22 PM ET / September 8, 2026, 02:22 UTC.

ClawSweeper review

What this changes

Consolidates Unreleased notes and contributor credits, and updates Sweet Cookie to 0.4.3 and TokenTally to 0.1.5.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open: this is useful, owner-directed release preparation with no identified patch defect. The explicit prerequisite merge order still applies; current main and v0.19.0 retain the older dependencies.

Priority: P3
Reviewed head: d7f228bb8c61772cdd467c6c0be68b485b7bf4b1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, consistent maintenance patch with reported runtime validation and no identified correctness defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The external-contributor gate does not apply to this owner-authored PR. Its captured evidence reports a built-CLI API success with the upgraded dependencies and integrated signed-in browser success; it does not independently demonstrate Sweet Cookie extraction.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The external-contributor gate does not apply to this owner-authored PR. Its captured evidence reports a built-CLI API success with the upgraded dependencies and integrated signed-in browser success; it does not independently demonstrate Sweet Cookie extraction.
Evidence reviewed	9 items	Policy and repository identity: The origin identifies steipete/oracle. Read the full root AGENTS.md; its grouped changelog guidance applies. All changed paths are at repository root, and .agents/maintainer-notes is absent. Complete introduced change: The pinned base-to-head diff contains only nine added changelog lines and consistent version, integrity, and snapshot updates for two existing dependencies; no application code, lifecycle hooks, registry settings, or permissions change. Runtime dependency boundary: src/browser/cookies.ts imports Sweet Cookie and calls getCookies with explicit origins, names, Chrome profile, and timeout before applying cookies through Chrome. src/oracle/run.ts uses TokenTally for response cost calculation, and modelResolver.ts uses its pricing normalization. These are direct dependency contracts; their call sites are unchanged.
Findings	None	None.
Security	None	None.

How this fits together

Oracle uses Sweet Cookie to read browser cookies and TokenTally to calculate consultation costs. Its manifest and lockfile select these runtime dependencies, while the changelog describes user-facing changes.

flowchart TD
  A[Package manifest] --> B[Locked dependency versions]
  B --> C[Browser cookie reading]
  B --> D[Consultation cost calculation]
  E[Implementation PRs] --> F[Unreleased notes]
  F --> G[User release information]

Loading

Before merge

• Resolve merge risk (P1) - Landing the notes before their five prerequisite implementations would advertise unavailable behavior; their captured state is open.
• Resolve merge risk (P1) - Dependency package internals and publication timestamps were not independently inspected; the release-age and runtime validation claims come from the owner's captured evidence.
• Complete next step (P2) - Confirm fix(browser): recognize Chinese Deep Research controls #428, feat(models): support Astra API and Latest browser selection #465, feat(browser): add explicit Web Search selection #468, fix(browser): retire owned tabs after recovery #469, and fix(browser): capture Deep Research plans without changing session status #444 have merged before landing, or adjust the notes for any held implementation.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency scope	2 patch upgrades; 0 added dependencies	The runtime refresh is bounded and keeps the existing installation policy.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the dependency refresh synchronized and publish only Unreleased entries whose implementations have landed, retaining contributor credit.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the dependency refresh synchronized and publish only Unreleased entries whose implementations have landed, retaining contributor credit.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR prepares release notes and dependency updates rather than reporting a reproducible defect.

Is this the best way to solve the issue?

Yes: the bounded manifest/lockfile refresh and consolidated notes fit the existing repository pattern, provided the stated implementation sequence is respected.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fe2c8d990562.

Labels

Label justifications:

• P3: This is routine release-note consolidation and dependency maintenance without an established urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor gate does not apply to this owner-authored PR. Its captured evidence reports a built-CLI API success with the upgraded dependencies and integrated signed-in browser success; it does not independently demonstrate Sweet Cookie extraction.

Evidence

What I checked:

• Policy and repository identity: The origin identifies steipete/oracle. Read the full root AGENTS.md; its grouped changelog guidance applies. All changed paths are at repository root, and .agents/maintainer-notes is absent. (AGENTS.md, d7f228bb8c61)
• Complete introduced change: The pinned base-to-head diff contains only nine added changelog lines and consistent version, integrity, and snapshot updates for two existing dependencies; no application code, lifecycle hooks, registry settings, or permissions change. (package.json:64, d7f228bb8c61)
• Runtime dependency boundary: src/browser/cookies.ts imports Sweet Cookie and calls getCookies with explicit origins, names, Chrome profile, and timeout before applying cookies through Chrome. src/oracle/run.ts uses TokenTally for response cost calculation, and modelResolver.ts uses its pricing normalization. These are direct dependency contracts; their call sites are unchanged. (src/browser/cookies.ts:173, d7f228bb8c61)
• Existing installation safeguards: Node >=24 and minimumReleaseAge: 2880 remain unchanged, as do dependency build permissions and registry configuration. (pnpm-workspace.yaml:13, d7f228bb8c61)
• Main and release comparison: Both fetched main and v0.19.0 specify Sweet Cookie ^0.4.2 and TokenTally ^0.1.4, so this dependency refresh is not already present in either inspected revision. (package.json:64, 2d664c1a60a9)
• Owner-directed merge order and validation: The captured final-head comment reports a real built-CLI API response of ORACLE_DEPS_OK, 2,230 passing tests, and combined-tree browser validation. It explicitly requires fix(browser): recognize Chinese Deep Research controls #428, feat(models): support Astra API and Latest browser selection #465, feat(browser): add explicit Web Search selection #468, fix(browser): retire owned tabs after recovery #469, and fix(browser): capture Deep Research plans without changing session status #444 to land first, or the notes to be adjusted. Source: chore: consolidate pending notes and refresh dependency patches #470 (comment). (d7f228bb8c61)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-08T02:08:45.893Z sha d7f228b :: blocked before merge. :: none

[steipete]

Final-head proof for d7f228bb8c61772cdd467c6c0be68b485b7bf4b1:

• npm publication metadata was checked: Sweet Cookie 0.4.3 was published 2026-09-05T20:05:08.454Z; TokenTally 0.1.5 was published 2026-09-05T18:43:09Z. Both exceeded the existing 48-hour release-age policy; manifest and lockfile agree, Node >=24 remains unchanged, and the outdated check is empty.
• Build/check passed and the full suite passed 2,230 tests / 45 skipped after building the CLI. The real API CLI with the new dependencies returned ORACLE_DEPS_OK.
• Local and committed-branch P0–P2 autoreview are scoped-clean.
• Exact-head CI passed all four jobs: https://github.com/steipete/oracle/actions/runs/34178931052.
• The combined implementation/dependency tree built and passed 2,328 tests / 45 skipped, docs, and check. Its signed-in Latest/Pro Web Search returned both bundled attachment markers, an official Node.js citation, and ORACLE_INTEGRATED_OK; the built recovery matrix passed too.

Merge only after #428, #465, #468, #469, and #444. Adjust the notes if any implementation is held. No version, tag, release, or publication action is included.