Override Sharp to 0.35.3 in the root and web lockfile graphs, eliminating the inherited libvips advisories without changing provider or runtime behavior.
Validated with clean npm installs, zero-vulnerability audits, web tests/lint/build, and a Wrangler smoke.
- Bump npm/codewhale wrapper to 0.8.66
- Add root package name to package.json / package-lock.json
- Update docs/INSTALL.md v0.8.66 current-lane wording
- Update docs/V0866_RELEASE_LEDGER.md with current SHA/status
- Add v0.8.66 contributor band to docs/CONTRIBUTORS.md
- Clippy cleanup: struct-update syntax in config/tui tests,
type alias for fleet_setup builder tuple, working_set fs::rename
Bump Wrangler in the root and web package manifests so Miniflare resolves patched Undici, update the VS Code extension lockfile's transitive Undici, and refresh the web DOMPurify lock entry. Verified npm audit is clean in root, web, and extensions/vscode.
Add the v0.8.60 website feature spotlight, refresh install copy, sync the TUI changelog, and pin esbuild 0.28.1 across root/web lockfiles for the Dependabot advisory.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #3163.
Adds the @codewhale/runtime-sdk workspace with typed fleet Runtime API helpers, protocol-shaped TypeScript declarations, JSON/SSE event fixture handling, and typed RuntimeCapabilityError failures for create/event-stream endpoints that the Rust API has not exposed yet.
Documents the SDK contract in docs/RUNTIME_API.md and wires npm workspace verification through npm test --workspace @codewhale/runtime-sdk.
CodeWhale Bot