chore(deps): refresh Go tooling and prepare patch notes

[steipete]

Refresh the dependencies used by the CLI and its development tools while retaining Go 1.26.7 and Node.js 24 as the supported minimums. jose2go 1.11.0 adds ECDH ephemeral-key validation; go-runewidth 0.0.30 corrects grapheme wrapping. Also update Ultraviolet, Go support modules, gofumpt 0.12.0, and pnpm 12.4.1 with regenerated checksums and lockfile.

This branch starts independently from main and carries the complete Unreleased notes, including the credential-store test isolation and documentation correction in #88. Merge #88 first, then this PR. No tagged version or released changelog section changes.

Validation completed locally:

• Full uncached tests with Go 1.26.8 and Go 1.26.7, using only test(client): stop the suite writing to the developer's real Keychain #88's TestMain through a Go overlay to protect the developer's credential stores while exercising the combined result. This PR's CI runs its own branch without that overlay.
• golangci-lint: zero issues; gofumpt clean; go mod verify and pnpm frozen-lockfile installation pass.
• Real CLI built through pnpm 12.4.1; help and version commands pass.
• Standalone integration: real file-backed token cache persisted, reopened, decrypted, and cleared synthetic data. Updated runewidth preserves a complete emoji grapheme at width two.
• GoReleaser single-target snapshot built successfully; both version commands match artifact metadata.
• Release metadata consistency and release-preflight regression scripts pass.
• Final branch Codex autoreview found no actionable findings through P2. CI is green on head 15d75ef337127d4a7c6e7eb9d685aeb62d0aa0c6: https://github.com/steipete/eightctl/actions/runs/34660802185.

Go 1.27 remains deferred to preserve the current macOS source-build compatibility choice. Other GitHub Actions and stable GoReleaser pins are current. Remaining upstream-only module graph entries were left to their owning dependencies.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[steipete]

Maintainer verification completed on head 15d75ef337127d4a7c6e7eb9d685aeb62d0aa0c6.

CI is green on this exact head. It ran the branch independently, including Go 1.26.7 compatibility, full tests, coverage, install smoke, release metadata/preflight checks, and artifact smoke.

Local proof on macOS arm64:

• Full uncached test suites with Go 1.26.8 and Go 1.26.7 pass. These local runs included test(client): stop the suite writing to the developer's real Keychain #88's TestMain through a Go overlay solely to keep synthetic test authentication out of the developer's persistent credential stores; no production source was overlaid.
• GOTOOLCHAIN=go1.26.8 pnpm run build, followed by the built CLI's --version and --help, passes with pnpm 12.4.1.
• A separately built integration executable exercised the real file-backed fallback: persist a synthetic token, reopen and decrypt it, delete it, and confirm it no longer loads. The same executable verified runewidth.Wrap preserves an emoji-plus-modifier grapheme at width two.
• go mod verify, the pnpm frozen-lockfile install, gofumpt, golangci-lint, release metadata checks, and release-preflight regression tests pass.
• GoReleaser's single-target snapshot builds; both version commands match its artifact metadata.
• Final branch autoreview against origin/main is scoped-clean through P2. Git's merge-tree check confirms this branch combines cleanly with test(client): stop the suite writing to the developer's real Keychain #88.

Prepared for squash merge after #88. This PR owns the complete Unreleased notes. Patch 0.2.6 is recommended after the merged main is green and release metadata is finalized; nothing has been tagged or published.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 11, 2026, 8:13 PM ET / September 12, 2026, 00:13 UTC.

ClawSweeper review

What this changes

Updates Go dependencies, gofumpt, and pnpm, synchronizes checksums and development documentation, and adds Unreleased notes covering this refresh and the separate credential-store test fix.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This remains useful dependency maintenance absent from current main. No actionable patch defect was found; the owner-authored PR also falls outside automatic cleanup under this repository’s profile.

Priority: P2
Reviewed head: 15d75ef337127d4a7c6e7eb9d685aeb62d0aa0c6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent refresh with relevant reported validation and no actionable defect found.
Proof confidence	🌊 off-meta tidepool	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate, and no material authority change triggers additional proof. Its body separately reports real file-cache and grapheme checks relevant to the updated dependencies.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate, and no material authority change triggers additional proof. Its body separately reports real file-cache and grapheme checks relevant to the updated dependencies.
Evidence reviewed	7 items	Verified scope and current-main comparison: The pinned introduction changes six files, with 137 additions and 73 deletions; no application or test source changes. Current main retains the older dependency versions, and v0.2.5 retains pnpm 12.3.4. The refresh therefore remains distinct work. Explicit prerequisite remains open: The captured PR body requests merging #88 first. GitHub confirms that prerequisite is still open and unmerged; its diff supplies the TestMain isolation and README correction described by this branch’s Unreleased notes. Validation scope: The complete captured body reports both supported Go test suites using the prerequisite’s TestMain overlay, lint, module verification, frozen pnpm installation, CLI and release-artifact smoke checks, a real file-cache round trip, and a grapheme-width check. These are author-reported results; this read-only review did not execute builds or tests. CLI help alone was not treated as proof of cache or Unicode behavior.
Findings	None	None.
Security	None	None.

How this fits together

eightctl is a Go CLI for controlling Eight Sleep Pods through cloud APIs. Its dependencies support terminal rendering and encrypted token caching, while Go tooling and optional pnpm scripts build and validate the executable.

flowchart LR
  A[Dependency pins and checksums] --> B[Go build and tooling]
  C[Optional pnpm scripts] --> B
  B --> D[eightctl executable]
  D --> E[Terminal output]
  D --> F[Encrypted token cache]
  D --> G[Eight Sleep cloud API]

Loading

Before merge

• Complete next step (P2) - Merge test(client): stop the suite writing to the developer's real Keychain #88 first, as requested by the author, so the credential-store fix precedes its Unreleased note.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the supported toolchain minimums and existing cache format while landing the refreshed dependencies with release notes that match the combined implementation.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency refresh, and no introduced failing behavior was established by source review.

Is this the best way to solve the issue?

Yes: updating the existing pins and lockfiles preserves the implementation and supported minimums without creating a competing code path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against db84b936e0ba.

Labels

Label changes:

• add P2: This is bounded dependency maintenance including upstream cryptographic hardening, with no demonstrated urgent eightctl failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate, and no material authority change triggers additional proof. Its body separately reports real file-cache and grapheme checks relevant to the updated dependencies.

Label justifications:

• P2: This is bounded dependency maintenance including upstream cryptographic hardening, with no demonstrated urgent eightctl failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate, and no material authority change triggers additional proof. Its body separately reports real file-cache and grapheme checks relevant to the updated dependencies.

Evidence

What I checked:

• Verified scope and current-main comparison: The pinned introduction changes six files, with 137 additions and 73 deletions; no application or test source changes. Current main retains the older dependency versions, and v0.2.5 retains pnpm 12.3.4. The refresh therefore remains distinct work. (go.mod:19, 15d75ef33712)
• Explicit prerequisite remains open: The captured PR body requests merging test(client): stop the suite writing to the developer's real Keychain #88 first. GitHub confirms that prerequisite is still open and unmerged; its diff supplies the TestMain isolation and README correction described by this branch’s Unreleased notes. (CHANGELOG.md:13, 15d75ef33712)
• Validation scope: The complete captured body reports both supported Go test suites using the prerequisite’s TestMain overlay, lint, module verification, frozen pnpm installation, CLI and release-artifact smoke checks, a real file-cache round trip, and a grapheme-width check. These are author-reported results; this read-only review did not execute builds or tests. CLI help alone was not treated as proof of cache or Unicode behavior. (15d75ef33712)
• Actual cryptography dependency boundary: The target imports keyring in internal/tokencache/tokencache.go. keyring v1.2.2 file.go imports jose2go, encrypts with PBES2-HS256+A128KW and A256GCM, and decodes cached files with a password. This establishes the relevant dependency contract; the ECDH update does not change the cache’s stored encryption format. (file.go)
• Upstream security change inspected: The v1.10.0-to-v1.11.0 comparison adds malformed ephemeral-key and curve checks in ECDH unwrapping with regression coverage; it does not alter the password-based encryption used by eightctl’s file cache. (ecdh.go)
• Package-manager supply-chain consistency: Official npm metadata for pnpm 12.4.1 identifies pnpm/pnpm as its repository, matches the lockfile’s pnpm integrity and fourteen optional platform packages, and retains the same lifecycle script declarations and Node engine range as 12.3.4.

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.