[dependabot]

Bumps the minor-and-patch group with 45 updates in the / directory:

Package	From	To
@ai-sdk/provider-utils	5.0.51	5.0.67
@astryxdesign/cli	0.6.3	0.7.3
@astryxdesign/core	0.6.3	0.7.3
@biomejs/biome	2.5.14	2.6.2
@electron/asar	4.3.0	4.3.1
@types/node	26.6.3	26.6.5
knip	6.38.0	6.42.1
marked	18.0.11	18.1.1
fs-native-extensions	1.5.1	1.5.2
@modelcontextprotocol/client	2.3.0	2.3.1
@modelcontextprotocol/node	2.1.0	2.1.1
@ai-sdk/anthropic	4.0.68	4.0.87
@ai-sdk/code-mode	1.0.79	1.0.107
@ai-sdk/cohere	4.0.52	4.0.68
@ai-sdk/google	4.0.85	4.0.104
@ai-sdk/open-responses	2.0.56	2.0.72
@ai-sdk/openai	4.0.80	4.0.101
@ai-sdk/openai-compatible	3.0.59	3.0.77
@ai-sdk/provider	4.0.19	4.0.33
@larksuiteoapi/node-sdk	1.74.0	1.76.0
@openai/agents-core	0.18.0	0.21.0
@slack/socket-mode	3.0.1	3.1.0
@slack/web-api	8.1.1	8.2.0
ai	7.0.122	7.0.150
linkedom	0.18.13	0.18.14
minimatch	10.2.5	10.2.6
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
@types/ws	8.18.1	8.18.2
systeminformation	5.33.13	5.33.16
katex	0.18.9	0.19.0
lucide-react	1.48.0	1.61.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
virtua	0.52.7	0.53.6
@playwright/test	1.63.0	1.64.1
electron-updater	6.8.9	6.8.11
opencli-mcp	0.0.22	0.0.31
@astryxdesign/theme-neutral	0.6.3	0.7.3
@storybook/react-vite	10.6.0	10.6.3
@vitejs/plugin-react	6.1.1	6.1.2
electron-builder	26.17.0	26.18.0
simple-icons	16.32.0	16.35.0
storybook	10.6.2	10.6.3
vite	8.3.1	8.3.5
astro	7.3.5	7.4.2

Updates @ai-sdk/provider-utils from 5.0.51 to 5.0.67

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.67

Patch Changes

• 8202f5b: feat(gateway): implement experimental streaming speech in the gateway provider

  GatewaySpeechModel implements Experimental_StreamingSpeechModelV4 and streams speech over the AI Gateway speech WebSocket (/speech-model, ai-gateway-speech.v1 subprotocol). @ai-sdk/provider-utils adds the experimental speech-stream envelope (experimental_parseSpeechStreamClientFrame, experimental_serializeSpeechStreamPart, experimental_parseSpeechStreamPart) shared by clients and servers, plus the EXPERIMENTAL_SPEECH_STREAM_* frame type constants and Experimental_SpeechStream* frame types. Text-delta frames carry each text part's voice and providerOptions; the start frame carries outputFormat as an audio format object. Adds gateway.experimental_speech, callable like speech(modelId), with a server-side getToken() that mints a speech-bound short-lived client secret for browser use.

• Updated dependencies [85d84a1]

  • @​ai-sdk/provider@​4.0.33

5.0.66

Patch Changes

• Updated dependencies [10026d1]
  • @​ai-sdk/provider@​4.0.32

5.0.65

Patch Changes

• b089ce8: Block .internal hostnames in download URL validation.
• 39a776b: Add a shared encodePathSegment helper and use it to encode provider-returned identifiers in credentialed follow-up request paths.

5.0.64

Patch Changes

• 0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.
• 200c47f: Avoid retaining oversized backing buffers when reading response bodies, reducing memory usage for responses delivered in small chunks on runtimes such as Deno.
• Updated dependencies [0c2a9de]
  • @​ai-sdk/provider@​4.0.31

5.0.63

Patch Changes

• Updated dependencies [60cc252]
  • @​ai-sdk/provider@​4.0.30

5.0.62

Patch Changes

• 0957554: Add box decision question type with image bounds for TypeSafe AI.
• Updated dependencies [0957554]
  • @​ai-sdk/provider@​4.0.29

5.0.61

... (truncated)

Commits

• 594495a Version Packages (#23857)
• 8202f5b feat(gateway): implement experimental streaming speech in the gateway provide...
• 401cadc Version Packages (#23785)
• e6230e4 Version Packages (#23638)
• b089ce8 fix(provider-utils): block .internal download hostnames (#23653)
• 39a776b fix: share URL path segment encoding (#23679)
• 0a5c786 Version Packages (#23572)
• 0c2a9de feat: add maxOutputTokens and reasoning to decide (#23590)
• 200c47f fix(provider-utils): avoid retaining backing buffers (#23474)
• eec6f49 fix(ci): package tsdown config (#23564)
• Additional commits viewable in compare view

Updates @astryxdesign/cli from 0.6.3 to 0.7.3

Release notes

Sourced from @​astryxdesign/cli's releases.

Astryx v0.7.3

Astryx 0.7.3 — every published @astryxdesign/* package ships at this version.

OLD_VERSION=0.7.2  # replace with the Core version your project uses today
npm install @astryxdesign/core@0.7.3 @astryxdesign/cli@0.7.3  # plus every other published @astryxdesign/* package you use, at 0.7.3
npx @astryxdesign/cli upgrade --from "$OLD_VERSION" --apply --path .

@​astryxdesign/core

New Features

• DropdownMenuSubMenu takes header and footer, as the root DropdownMenu does, so a sub-menu can have a filter field above its rows, or an action such as "New folder" below them, outside the sub-menu's menu itself. With either, the sub-menu's surface (the flyout, or the drilled-in view on a phone) is a modal dialog named by its row: the row says aria-haspopup="dialog", Tab and Shift+Tab walk the header, the rows and the footer and wrap, Escape returns to the row, and a pointer leaving the flyout closes it only once focus leaves too. A ContextMenu does not show a sub-menu's header or footer. Without them nothing changes.

   <DropdownMenuSubMenu
     label="Move to"
  +  header={<TextInput label="Filter folders" isLabelHidden value={query} onChange={setQuery} />}
  +  footer={<Button label="New folder" onClick={createFolder} />}
   >
     <DropdownMenuItem label="Folder A" onClick={() => move('a')} />
   </DropdownMenuSubMenu>

Fixes

• TimeInput's arrow keys ignore a fractional increment instead of writing a malformed time such as "14:30.5": adjustTime returns the time unchanged for a fractional minute delta (#7823).

• Screen readers now announce a Button that is first rendered with isLoading (for example after a remount). Its visually hidden loading live region mounts empty and gets "Loading" on the next frame, because screen readers skip a live region that already holds its text when it appears. A Button that becomes loading after it mounts is unchanged, and a Button mounted idle does no extra render.

• ChatComposer: screen readers now announce a status message, errors assertively and warnings politely, once per occasion: a rerender does not repeat it, and a status that clears and then returns is announced again. Before, the status bar mounted as a role="alert" or role="status" region already holding its text, which screen readers often skip. The message now goes through the shared announcement channel, and the visible bar no longer carries a live role. No API changes.

• ChatSystemMessage: a new chat notice inside a ChatMessageList now has one live region announcing it, the list's polite log, instead of also being a second live region nested in it (WCAG 2.2 SC 4.1.3). Its root no longer forces role="status", in either variant, so date and divider rows are no longer presented as status messages, and a role passed to the component reaches its root. Tests that found a system message by the status role should query it by its text instead.

• Keyboard and screen-reader users can now reach disabled CheckboxInput, CheckboxList items, Switch, Slider and FileInput, and hear that they are disabled. Before, they rendered the native disabled attribute unless a disabledMessage was set, so Tab skipped them. Now every disabled control exposes aria-disabled="true" and keeps the Tab stop it has when enabled, while toggling, selecting, dragging, opening the file picker and any onClick stay blocked, and its value is still left out of form submission. A focused disabled checkbox, switch, slider thumb or file input shows its keyboard focus indicator. No API changes.

• The agent guide that global mode writes to the home folder now tells agents to deliver a page built with Astryx, not only how to find things. Before, agents that found the right template could still build the page with a tool that cannot install packages and deliver a page with no Astryx in it. The guide now tells agents to work in a project folder (creating one if there is none); add @astryxdesign/core and @astryxdesign/cli to a new project or one without Core, or, in a project that already has @astryxdesign/core, the CLI at the same version; run astryx init there; follow the same template-first workflow and self-check the project agent docs give; and end by building the project and delivering that build. The guide stays version-free and names only commands every release keeps. The project agent docs are unchanged, and so is what @astryxdesign/core's install script prints: its copy of the shared agent-docs file only gains the same workflow lines.

  Also released in @astryxdesign/cli.

• Keyboard and screen-reader users can now reach a disabled ComplexSelector and hear that it is unavailable (WCAG 2.2 SC 2.1.1 and 4.1.2). Before, its trigger rendered the native disabled attribute, so Tab skipped it and a focused trigger lost focus when disabled; now it exposes aria-disabled="true", keeps focus, shows its keyboard focus outline, and still opens nothing. A press or key on it reaches no handler: not the toggle, not a caller's onClick or onKeyDown, and not an ancestor's click handler.

• Keyboard and screen-reader users can now reach a disabled Calendar day or Pagination dot and hear that it is disabled. Disabled TreeList rows' expand toggle and action button, disabled Pagination dots and disabled Calendar days expose aria-disabled="true" instead of the native disabled attribute, while clicks, Enter and Space still do nothing and arrow keys still skip disabled days as before. No API changes.

• DateInput: keyboard and screen-reader users can now reach a disabled date field and hear that it is disabled. A disabled or busy field no longer renders native disabled: its input and calendar button keep their place in the focus order and expose aria-disabled, while typing and opening stay blocked, and a focused disabled field shows its focus ring. Tests that query a disabled DateInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.

• DateRangeInput: keyboard and screen-reader users can now reach a disabled field or preset and hear that it is disabled. A disabled or busy field and a disabled preset no longer render native disabled: the trigger, calendar button and presets keep their place in the focus order and expose aria-disabled, while opening and selecting stay blocked, and a focused disabled field shows its focus ring. Tests that query them with toBeDisabled() or :disabled should check aria-disabled="true" instead (#7866).

• DateTimeInput: keyboard and screen-reader users can now reach a disabled or busy field and hear that it is disabled. It no longer renders native disabled on its text, native-picker or touch fields, or on its calendar and clock buttons: they keep their place in the focus order and expose aria-disabled, while typing, picking, opening and a caller's onClick stay blocked, and a focused disabled field shows its focus ring. TimeInput's native picker button, which shares the time segment and stays out of the tab order, also moves from disabled to aria-disabled and stays inert. Tests that query a disabled DateTimeInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.7.3

New Features

• astryx build names the right block first far more often. It ranks every block in the catalog by what the request means, read from each block's own name, description, and component, so a block that word matching missed can still come first, with its own score and reason; and the block picker's fixed values are refitted on a larger, more varied set of written example requests, which helps most with requests worded in a product's own terms. A block the request names by its exact name, and a block from an integration, keep their place. The kit never lists more blocks than before, and its fields, page call, start template, and alternatives are unchanged.

• astryx search puts the entry you are after first more often: it orders the matches inside each score band, every result keeps its match score and reason, and a query that is an entry's exact name still answers with that entry first (#7752).

• astryx doctor integration validate and astryx integration check check the component names a package's docs and blocks give, and list what they find as notes beside validate's issues, each with its fix. Nothing counts a note and integration check --strict does not fail on them; they become failing warnings in the next minor release:

  • doc_name_mismatch lists a component doc whose name is not the name the component is listed under when the module its printed import names (the doc's import, the published subpath, or the package root) provably does not export that name, so astryx component would print a broken import. The Fix: proposes the file name when that module exports it, otherwise the component it exports. A name that module's exports cannot prove or rule out (a re-export from another package, export =, a destructured binding, a namespace, an import that resolves to no file, or, when no import can be resolved, a source that only exports a default) is listed as not checked, with the reason, in validate's new docNames report.
  • unknown_block_component lists a name a template's exampleFor or componentsUsed gives that neither the package nor Core has (every doc astryx component resolves in Core counts) and the template does not import it. Imports the template's local helpers make count too, including through a barrel such as parts/index.ts. A name is judged only where the template reaches components solely through named imports and re-exports from Core, React, StyleX, local helpers read in full, or the package's own name (followed through its exports like a helper). Anything else is listed as not checked in validate's new blockComponents report: an import from another package, which may render other components; any default binding other than React's or StyleX's; a namespace import; an alias of or member read off an imported binding; a component held in a variable; require(); a dynamic import(); a file that does not parse cleanly; a local module this check cannot read; and, without Core installed, any name only Core could resolve.

  integration check --strict does not fail on anything listed as not checked.

• New @astryxdesign/cli/host entry for tools that carry the CLI: runHostedCli runs the CLI once per process, with the command name that tool's users type (printed commands start with it) and, when the tool skipped the project's own CLI, the reason, so that CLI is never run.

  import {runHostedCli} from '@astryxdesign/cli/host';
  const result = await runHostedCli({
  argv: ['search', 'button'],
  cliCommand: 'acme astryx',
  });

• astryx doctor integration validate now notes, from source and without a build, what an integration package tells apps to import that they cannot import, the way it lists an ignored cliCommand. Each note is in data.notes and names its fix, such as the exact exports entry to add. Notes are listed only: neither doctor integration validate nor astryx integration check --strict counts or fails on them in 0.7.3, and they become failing warnings in the next minor release, so fix them now. It notes:

  • a component's import (the doc's import, or the one the CLI derives when the doc has none) or a template's public import whose subpath package.json exports does not declare, or that names another package. A subpath is not declared by a missing key, a key whose only conditions an ES module import does not load (such as require or types), an exports that is a single string, a wildcard that does not match, or an empty exports map;
  • a component example that imports a subpath the package does not declare;
  • a template that imports a relative path outside the templates root, or a path its own package or Core does not export.

  A subpath is judged from its exports declaration alone, never by its target file, so exports may point at build output that does not exist yet; whether that module exports the names an import asks for is the next entry's check. Wildcards and condition objects with import or default pass. An import of a subpath whose exports entry has only types targets, or that an ES module import reaches only through types (such as types beside require), is never judged as a run-time import: it passes when it is import type, when every binding is an inline type, or when every name it imports is one the types file declares as a type, and is listed under unchecked otherwise. A types target under require does not count, and a package with no exports keeps its deep paths to files it ships. What it cannot judge (in a package with no exports, a deep path into build output not built yet, such as dist/; a template import of Core when @astryxdesign/core is not installed beside the package; every import of the package's own name when package.json has no name) is listed under unchecked in a new publicImports report on the result ({status: 'checked', findings: [], unchecked: [{file, specifier, reason}]}), which integration check counts as not compared.

• astryx doctor integration validate now also notes, from source and without a build, an import that names something its module does not export (in data.notes, each with its fix). These notes are listed only in 0.7.3 too, and become failing warnings in the next minor release. It notes:

  • a component's import (the doc's import, or the one the CLI derives) that leads to a module that does not export the component, naming the subpath that does or the exports entry to add;
  • a component example or a template that imports a name the package does not export;
  • a template source with no default export (astryx template still copies it, but its public import and anything that renders it get nothing), suggesting an exported PascalCase function, class or const, never a hook such as useAccount, a helper such as formatBalance, an ALL-CAPS constant or a type; with none, the fix stays generic.

  A name is judged only when a file the exports entry names is there to read in full. export * is followed, cycles included; a built module's declaration file (x.d.ts beside x.js, and the .d.ts files its export * names) is read for the types it exports; export import Alias = Inner.Value counts as an export; TypeScript source resolves a ./x.js specifier to ./x.ts; and a declaration file that is a module exports every top-level declaration unless it has an export list, export *, export = or a default export of an expression, as TypeScript does. Whatever the reader does not fully model is listed under unchecked in the publicImports report instead of as a note: a file the exports entry names that does not exist yet; a module whose list cannot be read in full (CommonJS, export * from another package); a declaration file with no import or export (a global script); a name missing from a JavaScript module with no declaration file, which may be a type; and every name it would report, other than a component doc's own component, while a TypeScript file in the package (outside node_modules) has a parsed declare module block for a relative path, the package's own name or a subpath of it, since that can add names to the module. The reason names that file; declare global, a wildcard spec such as '*.css', another package's name and a declare module in a comment do not count, and a file with declare module in its text that cannot be parsed counts. astryx docs authoring/ship/checks explains each check.

• A failed astryx component, template or docs lookup lists the entry you most likely meant first. Components that tie on match score are ordered by how early the name you typed appears in their keywords and by how close their names are, instead of alphabetically; among the suggestions offered, a component one of whose other names was typed (including another library's name for it, such as MUI TextField, with or without the library's name) comes first; a compound name that does not exist (a family part named with other words, or without one of its family's words) suggests the real part or its family. Templates are ordered by how closely their id or title matches the name you typed, and unknown docs routes by how closely the route matches. Suggestion lists never get longer, every suggestion is a real entry, and a name that resolved before still resolves to the same entry.

• Integration docs that tell readers to run an Astryx command through a package runner now get a runner_command note from doctor integration validate (and so integration check) in data.notes, with its file, line and the bare astryx <command> to write instead. A note fails nothing, so integration check --strict exits as before. The unscoped name after a download runner (npx astryx) always counts, because it fetches an unrelated package; the scoped npx @astryxdesign/cli, for install steps, does not.

Fixes

• astryx build starts from a page template its word weights do not list (an integration's template, or one added since the weights were fit) only when the request names as many words of that template's own display name, category and keywords (search's stopwords aside) as of the best listed template, or names that template's family (the first part of its category) before the listed template's family and at most two fewer of its words; otherwise it starts from that listed template and offers the other as the first alternative.
• The CLI finds the project's @astryxdesign/core from any folder inside the project, so component, hook, build, search, swizzle, theme targets and doctor now work five or more folders deep, in workspace members whose Core the workspace installs at its root, and in Yarn Plug'n'Play projects. They still search the folders they searched before, and past them continue up to the workspace root of the nearest folder whose package.json declares an Astryx package.
  • upgrade --from run from any folder in a project upgrades that project: the nearest folder whose package.json declares an Astryx package or that an Astryx workspace lists, found without passing a repository root or counting the home folder. It targets only the project's own Core (the one in its node_modules, or for a member its workspace lists, the one the workspace installs), scans the project's src by default, reads a --path you type from the folder you ran in, names the files in its --json result relative to that folder, refreshes the project's agent docs, and names the project root and the source folder it scans before it changes anything. With no such project, upgrade reads only the current folder, as before.
  • An upgrade run in a folder that installs Core but declares no Astryx package now upgrades the Astryx project above it instead of that folder alone, since such a folder was never a separate upgrade root. To keep a sub-folder that installs Core its own project, declare an Astryx package in that folder's package.json.
  • A packages/core folder that holds another package is no longer read as Core, and an integration named in astryx.config now loads when the workspace installs it at its root, as an autolinked one already did.
• The CLI's install advice no longer adds a package to a package.json that is not an Astryx project's. This covers the daily hint, the setup reminder, the update notice, astryx doctor's version-alignment and integration fixes, and astryx discover's install command for an integration installed for the computer. The project is the nearest folder whose package.json declares an Astryx package, or a member its workspace lists, never the home folder and never past a repository root.
  • From a folder inside such a project whose own package.json is not the project's, such as a tool folder that installs its own @astryxdesign/core, the daily hint that matches a project's CLI to its Core, the setup reminder and astryx doctor's version-alignment fix used to name a command that added the CLI to that folder's package.json, making it a separate Astryx project. They still compare the CLI with the Core the run reads, and when the two differ they say to run from the project's folder, or to declare an Astryx package in that folder; the update notice upgrades the project from its folder, with the project's release.
  • For an integration installed for the computer, astryx discover gives no install command from such a folder, and astryx doctor's fix says to run from the project's folder, where the command adds it for the project; in a folder that belongs to no project, neither names a command.

... (truncated)

Commits

• ca439c8 chore: version packages for v0.7.3 (#7928)
• 425f762 build: a template the word weights do not list competes on its own words (#7901)
• 2f47a4a [Component Audit] DropdownMenuRadioGroup: let builders reach the group root (...
• fba04ed search: find a template by its display name (#7895)
• 948e75d [Component Audit] DropdownMenuItem: make action states reviewable (#7907)
• 04c7468 fix(cli): the global skill names the install step when astryx is not found (#...
• e0afabe test(cli): wait for a SIGKILLed package manager to disappear before asserting...
• d421aed build: refit the block picker on more varied example requests (#7904)
• 6856cfa build: rank every block by what the request means, from its own docs (#7897)
• 296edaf feat(cli): put the likely entry first in failed-lookup suggestions (#7876)
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.6.3 to 0.7.3

Release notes

Sourced from @​astryxdesign/core's releases.

Astryx v0.7.3

Astryx 0.7.3 — every published @astryxdesign/* package ships at this version.

OLD_VERSION=0.7.2  # replace with the Core version your project uses today
npm install @astryxdesign/core@0.7.3 @astryxdesign/cli@0.7.3  # plus every other published @astryxdesign/* package you use, at 0.7.3
npx @astryxdesign/cli upgrade --from "$OLD_VERSION" --apply --path .

@​astryxdesign/core

New Features

• DropdownMenuSubMenu takes header and footer, as the root DropdownMenu does, so a sub-menu can have a filter field above its rows, or an action such as "New folder" below them, outside the sub-menu's menu itself. With either, the sub-menu's surface (the flyout, or the drilled-in view on a phone) is a modal dialog named by its row: the row says aria-haspopup="dialog", Tab and Shift+Tab walk the header, the rows and the footer and wrap, Escape returns to the row, and a pointer leaving the flyout closes it only once focus leaves too. A ContextMenu does not show a sub-menu's header or footer. Without them nothing changes.

   <DropdownMenuSubMenu
     label="Move to"
  +  header={<TextInput label="Filter folders" isLabelHidden value={query} onChange={setQuery} />}
  +  footer={<Button label="New folder" onClick={createFolder} />}
   >
     <DropdownMenuItem label="Folder A" onClick={() => move('a')} />
   </DropdownMenuSubMenu>

Fixes

• TimeInput's arrow keys ignore a fractional increment instead of writing a malformed time such as "14:30.5": adjustTime returns the time unchanged for a fractional minute delta (#7823).

• Screen readers now announce a Button that is first rendered with isLoading (for example after a remount). Its visually hidden loading live region mounts empty and gets "Loading" on the next frame, because screen readers skip a live region that already holds its text when it appears. A Button that becomes loading after it mounts is unchanged, and a Button mounted idle does no extra render.

• ChatComposer: screen readers now announce a status message, errors assertively and warnings politely, once per occasion: a rerender does not repeat it, and a status that clears and then returns is announced again. Before, the status bar mounted as a role="alert" or role="status" region already holding its text, which screen readers often skip. The message now goes through the shared announcement channel, and the visible bar no longer carries a live role. No API changes.

• ChatSystemMessage: a new chat notice inside a ChatMessageList now has one live region announcing it, the list's polite log, instead of also being a second live region nested in it (WCAG 2.2 SC 4.1.3). Its root no longer forces role="status", in either variant, so date and divider rows are no longer presented as status messages, and a role passed to the component reaches its root. Tests that found a system message by the status role should query it by its text instead.

• Keyboard and screen-reader users can now reach disabled CheckboxInput, CheckboxList items, Switch, Slider and FileInput, and hear that they are disabled. Before, they rendered the native disabled attribute unless a disabledMessage was set, so Tab skipped them. Now every disabled control exposes aria-disabled="true" and keeps the Tab stop it has when enabled, while toggling, selecting, dragging, opening the file picker and any onClick stay blocked, and its value is still left out of form submission. A focused disabled checkbox, switch, slider thumb or file input shows its keyboard focus indicator. No API changes.

• The agent guide that global mode writes to the home folder now tells agents to deliver a page built with Astryx, not only how to find things. Before, agents that found the right template could still build the page with a tool that cannot install packages and deliver a page with no Astryx in it. The guide now tells agents to work in a project folder (creating one if there is none); add @astryxdesign/core and @astryxdesign/cli to a new project or one without Core, or, in a project that already has @astryxdesign/core, the CLI at the same version; run astryx init there; follow the same template-first workflow and self-check the project agent docs give; and end by building the project and delivering that build. The guide stays version-free and names only commands every release keeps. The project agent docs are unchanged, and so is what @astryxdesign/core's install script prints: its copy of the shared agent-docs file only gains the same workflow lines.

  Also released in @astryxdesign/cli.

• Keyboard and screen-reader users can now reach a disabled ComplexSelector and hear that it is unavailable (WCAG 2.2 SC 2.1.1 and 4.1.2). Before, its trigger rendered the native disabled attribute, so Tab skipped it and a focused trigger lost focus when disabled; now it exposes aria-disabled="true", keeps focus, shows its keyboard focus outline, and still opens nothing. A press or key on it reaches no handler: not the toggle, not a caller's onClick or onKeyDown, and not an ancestor's click handler.

• Keyboard and screen-reader users can now reach a disabled Calendar day or Pagination dot and hear that it is disabled. Disabled TreeList rows' expand toggle and action button, disabled Pagination dots and disabled Calendar days expose aria-disabled="true" instead of the native disabled attribute, while clicks, Enter and Space still do nothing and arrow keys still skip disabled days as before. No API changes.

• DateInput: keyboard and screen-reader users can now reach a disabled date field and hear that it is disabled. A disabled or busy field no longer renders native disabled: its input and calendar button keep their place in the focus order and expose aria-disabled, while typing and opening stay blocked, and a focused disabled field shows its focus ring. Tests that query a disabled DateInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.

• DateRangeInput: keyboard and screen-reader users can now reach a disabled field or preset and hear that it is disabled. A disabled or busy field and a disabled preset no longer render native disabled: the trigger, calendar button and presets keep their place in the focus order and expose aria-disabled, while opening and selecting stay blocked, and a focused disabled field shows its focus ring. Tests that query them with toBeDisabled() or :disabled should check aria-disabled="true" instead (#7866).

• DateTimeInput: keyboard and screen-reader users can now reach a disabled or busy field and hear that it is disabled. It no longer renders native disabled on its text, native-picker or touch fields, or on its calendar and clock buttons: they keep their place in the focus order and expose aria-disabled, while typing, picking, opening and a caller's onClick stay blocked, and a focused disabled field shows its focus ring. TimeInput's native picker button, which shares the time segment and stays out of the tab order, also moves from disabled to aria-disabled and stays inert. Tests that query a disabled DateTimeInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.7.3

New Features

• DropdownMenuSubMenu takes header and footer, as the root DropdownMenu does, so a sub-menu can have a filter field above its rows, or an action such as "New folder" below them, outside the sub-menu's menu itself. With either, the sub-menu's surface (the flyout, or the drilled-in view on a phone) is a modal dialog named by its row: the row says aria-haspopup="dialog", Tab and Shift+Tab walk the header, the rows and the footer and wrap, Escape returns to the row, and a pointer leaving the flyout closes it only once focus leaves too. A ContextMenu does not show a sub-menu's header or footer. Without them nothing changes.

   <DropdownMenuSubMenu
     label="Move to"
  +  header={<TextInput label="Filter folders" isLabelHidden value={query} onChange={setQuery} />}
  +  footer={<Button label="New folder" onClick={createFolder} />}
   >
     <DropdownMenuItem label="Folder A" onClick={() => move('a')} />
   </DropdownMenuSubMenu>

Fixes

• TimeInput's arrow keys ignore a fractional increment instead of writing a malformed time such as "14:30.5": adjustTime returns the time unchanged for a fractional minute delta (#7823).
• Screen readers now announce a Button that is first rendered with isLoading (for example after a remount). Its visually hidden loading live region mounts empty and gets "Loading" on the next frame, because screen readers skip a live region that already holds its text when it appears. A Button that becomes loading after it mounts is unchanged, and a Button mounted idle does no extra render.
• ChatComposer: screen readers now announce a status message, errors assertively and warnings politely, once per occasion: a rerender does not repeat it, and a status that clears and then returns is announced again. Before, the status bar mounted as a role="alert" or role="status" region already holding its text, which screen readers often skip. The message now goes through the shared announcement channel, and the visible bar no longer carries a live role. No API changes.
• ChatSystemMessage: a new chat notice inside a ChatMessageList now has one live region announcing it, the list's polite log, instead of also being a second live region nested in it (WCAG 2.2 SC 4.1.3). Its root no longer forces role="status", in either variant, so date and divider rows are no longer presented as status messages, and a role passed to the component reaches its root. Tests that found a system message by the status role should query it by its text instead.
• Keyboard and screen-reader users can now reach disabled CheckboxInput, CheckboxList items, Switch, Slider and FileInput, and hear that they are disabled. Before, they rendered the native disabled attribute unless a disabledMessage was set, so Tab skipped them. Now every disabled control exposes aria-disabled="true" and keeps the Tab stop it has when enabled, while toggling, selecting, dragging, opening the file picker and any onClick stay blocked, and its value is still left out of form submission. A focused disabled checkbox, switch, slider thumb or file input shows its keyboard focus indicator. No API changes.
• The agent guide that global mode writes to the home folder now tells agents to deliver a page built with Astryx, not only how to find things. Before, agents that found the right template could still build the page with a tool that cannot install packages and deliver a page with no Astryx in it. The guide now tells agents to work in a project folder (creating one if there is none); add @astryxdesign/core and @astryxdesign/cli to a new project or one without Core, or, in a project that already has @astryxdesign/core, the CLI at the same version; run astryx init there; follow the same template-first workflow and self-check the project agent docs give; and end by building the project and delivering that build. The guide stays version-free and names only commands every release keeps. The project agent docs are unchanged, and so is what @astryxdesign/core's install script prints: its copy of the shared agent-docs file only gains the same workflow lines.
• Keyboard and screen-reader users can now reach a disabled ComplexSelector and hear that it is unavailable (WCAG 2.2 SC 2.1.1 and 4.1.2). Before, its trigger rendered the native disabled attribute, so Tab skipped it and a focused trigger lost focus when disabled; now it exposes aria-disabled="true", keeps focus, shows its keyboard focus outline, and still opens nothing. A press or key on it reaches no handler: not the toggle, not a caller's onClick or onKeyDown, and not an ancestor's click handler.
• Keyboard and screen-reader users can now reach a disabled Calendar day or Pagination dot and hear that it is disabled. Disabled TreeList rows' expand toggle and action button, disabled Pagination dots and disabled Calendar days expose aria-disabled="true" instead of the native disabled attribute, while clicks, Enter and Space still do nothing and arrow keys still skip disabled days as before. No API changes.
• DateInput: keyboard and screen-reader users can now reach a disabled date field and hear that it is disabled. A disabled or busy field no longer renders native disabled: its input and calendar button keep their place in the focus order and expose aria-disabled, while typing and opening stay blocked, and a focused disabled field shows its focus ring. Tests that query a disabled DateInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.
• DateRangeInput: keyboard and screen-reader users can now reach a disabled field or preset and hear that it is disabled. A disabled or busy field and a disabled preset no longer render native disabled: the trigger, calendar button and presets keep their place in the focus order and expose aria-disabled, while opening and selecting stay blocked, and a focused disabled field shows its focus ring. Tests that query them with toBeDisabled() or :disabled should check aria-disabled="true" instead (#7866).
• DateTimeInput: keyboard and screen-reader users can now reach a disabled or busy field and hear that it is disabled. It no longer renders native disabled on its text, native-picker or touch fields, or on its calendar and clock buttons: they keep their place in the focus order and expose aria-disabled, while typing, picking, opening and a caller's onClick stay blocked, and a focused disabled field shows its focus ring. TimeInput's native picker button, which shares the time segment and stays out of the tab order, also moves from disabled to aria-disabled and stays inert. Tests that query a disabled DateTimeInput with toBeDisabled() or :disabled should check aria-disabled="true" instead.
• Apps that use Core's prebuilt CSS without a StyleX build step now get the default data colors: the prebuilt CSS defines the canonical dataVars defaults, so compiled imports and raw CSS references paint correctly.
• Dialog, BottomSheet and BottomSheetSwitcher stay open when a file picker inside them is dismissed. A file input fires a bubbling cancel event when its picker closes without a choice, and all three took that event for a close request of their own and closed (a switcher closed its whole flow). They now act only on a cancel aimed at their own <dialog>, so Escape and platform close requests (the Android back gesture) behave as before. No API changes.
• DropdownMenuRadioGroup now forwards ref, and its docs explain controlled selection, how to name the group, when the menu closes, and how it composes inside a DropdownMenu.
• astryx init writes the agent docs at the project root, in files the project commits, so Codex, Gemini CLI, Copilot CLI and Claude Code all read the block from the project root or any folder below it (#7497). It no longer writes agent docs into a project's subfolder, the home folder, or a settings folder in it such as ~/.gemini.
  • AGENTS.md holds the block, created when missing. Before, a project with only CLAUDE.md got the block only there, so Codex and Gemini CLI never saw it.
  • Claude Code skips AGENTS.md in a folder that has a CLAUDE.md or .claude/CLAUDE.md, so the Claude Code file the project already has keeps a full copy: root CLAUDE.md, else .claude/CLAUDE.md. It keeps the copy even when it imports AGENTS.md, because Claude Code does not follow that import in a session started in a subfolder; started at the root, Claude Code then reads two. When both exist, the copy goes in root CLAUDE.md, which projects commit even when they ignore .claude/, and a block in .claude/CLAUDE.md is removed. Init creates no Claude file. astryx upgrade refreshes every copy, except in a project at the top of a home settings folder (see the next entry).
  • Gemini CLI reads only GEMINI.md: init adds a one-line import, @./AGENTS.md, creating GEMINI.md when it is missing. It adds none when GEMINI.md already imports AGENTS.md, inline or on its own line. It adds the import even when the project's .gemini/settings.json has Gemini read AGENTS.md through context.fileName: Gemini loads those settings only when it starts at the project root, so a session started in a subfolder would otherwise get no copy. Started at the root, Gemini then reads two.
  • The project root is the nearest folder at or above where init runs whose package.json declares an @astryxdesign package, else the nearest with any package.json. The search stops at a repository root and never counts the home folder. With no package.json found, init writes where it runs, as before. docsWritten still lists each file relative to where init ran, for example ../../AGENTS.md.
  • A GEMINI.md that resolves outside the project, for example a link to a shared file, is skipped and reported in docsError with one note (not an error line), in the default layout and in a project's own layout; the rest is written and init exits 0.
  • The managed block belongs to Astryx: init and astryx upgrade write, refresh, and remove only the block, whatever ignore rules or generated markers say, as 0.7.1 did, and never change the text around it. Every write stays inside the project: run in the folder 0.7.1 wrote, an agent file 0.7.1 wrote there whose path leaves the project still refuses the run with exit 1. The project's Claude Code file (root CLAUDE.md, or .claude/CLAUDE.md when there is no root one) that resolves outside the project and is a block-less import of an existing AGENTS.md, which 0.7.1 left alone, is skipped and reported in docsError with one note, and init exits 0. Run from a folder below the project root, where 0.7.1 wrote in that folder instead, a project-root file whose path leaves the project is skipped and reported in docsError with one note, the rest is written, and init exits 0.
  • While root CLAUDE.md is untracked and ignored by the repository's ignore rules (any ignore file from the repository root down, such as a monorepo's root .gitignore, the local exclude file, or configured excludes; init asks git, Sapling or Mercurial), a .claude/CLAUDE.md the project commits gets the copy too, so a fresh clone still gives Claude Code a copy; --agent claude and --agent all write it there as well. A file the repository tracks counts as committed whatever the ignore rules say, as git and Mercurial ignore only untracked files, and when the repository cannot answer, the copy is kept, on the first run as on later ones. Such a copy that resolves outside the project refuses the run with exit 1 where 0.7.1 wrote it too; one 0.7.1 did not write (the one --agent claude adds, or a block-less import of an existing AGENTS.md) is skipped and reported in docsError with one note, and init exits 0. So is a .claude/CLAUDE.md whose block --agent claude would remove beside a CLAUDE.md, since 0.7.1's claude preset wrote only CLAUDE.md there. Beside a committed root CLAUDE.md, with .claude linked outside the project, three cases that 0.7.1 refused now exit 0 with nothing written: the default with a .claude/CLAUDE.md of plain text, and --agent all with one of plain text or a block-less import of AGENTS.md; root CLAUDE.md holds the copy, so no write leaves the project. In a project that keeps its own layout, a GEMINI.md that imports no agent file now gets a copy, as the other agent files do.
  • The copy in .claude/CLAUDE.md is removed only once root CLAUDE.md holds the same block, and only the managed block between its markers: the rest of the file stays, and the file is deleted only when nothing but whitespace is left. astryx init --remove-agents deletes a file it created only when nothing but whitespace or init's own heading is left; 0.7.0 also deleted a file whose remaining text had a heading and any line with the word "guidance".
  • astryx init --remove-agents removes the block at the project root, where init writes it, and in the folder it runs in. Run from a subfolder, it removes what init wrote at the root, and a block an earlier version left in that subfolder; a root agent file with a block that resolves outside the project is left as it is with a note, and the run exits 0, as 0.7.1 did when it touched only the subfolder. Exit codes and the JSON shape are unchanged.
  • --agent claude and --agent all never leave a block in both CLAUDE.md and .claude/CLAUDE.md, unless the project ignores CLAUDE.md: when CLAUDE.md gets the block, a block in .claude/CLAUDE.md is removed. --agent all keeps the GEMINI.md import. The --agent help and the working-with-AI guide say so. --agent-docs-path writes where init runs, as before.
  • astryx doctor fails when the GEMINI.md import points at an AGENTS.md with no block. The setup check in the CLI and in @astryxdesign/core no longer counts that import as set up, and looks at GEMINI.md. The reminder to run init that commands print looks at the project root too, so it stops once init has run in a nested package.
• astryx init and astryx upgrade no longer write agent docs into your home folder, or into a settings folder in it such as ~/.gemini or ~/.claude outside a project. Agents read the files in those folders in every project, so a block there reached unrelated work. This follows the CLI's existing rules that no command writes agent docs into those folders and that a write outside a command's own folder is refused before anything is written.
  • Refused by init: the home folder itself, and the top of any folder in it whose name starts with a dot (every such folder is a settings folder), even when it holds a package.json. A folder below it with its own package.json is a project and is set up normally, such as an agent worktree in ~/.codex/worktrees/ or ~/.cursor/worktrees/, and astryx upgrade refreshes it. With --agent-docs-path, each file's own folder is checked: from the home folder, notes/AI.md is written as before, while AI.md or .claude/CLAUDE.md is refused.
  • What init does instead: it writes no agent docs, reports docsError as install-failed with the reason, and exits 0, as before.
  • Refused by upgrade: refreshing a block in a project whose root is the home folder or the top of a settings folder, such as ~/.dotfil...

    Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.