chore(deps): bump @openclaw/carapace from v0.6.1 to v0.6.2 in the npm group across 1 directory

[dependabot]

Bumps the npm group with 1 update in the / directory: @openclaw/carapace.

Updates @openclaw/carapace from v0.6.1 to v0.6.2

Release notes

Sourced from @​openclaw/carapace's releases.

v0.6.2

0.6.2 — 2026-08-09

Highlight: a broad component-quality pass from @​vyctorbrzezowski — light-theme contrast now meets AA, every preview image has documented rights, and the overlay primitives (Toast, Tooltip, Dropdown, Menu Bar, Banner) behave correctly under focus, hover competition and constrained viewports.

Accessibility and rights

• Restored AA contrast for light-theme primary actions while keeping modal backdrops visually isolating. Thanks @​vyctorbrzezowski.
• Replaced preview portraits without redistribution records with deterministic generated identities, and documented the rights for every remaining preview image. Thanks @​vyctorbrzezowski.
• Made Banner dismissal return focus safely while preserving generic narrow-screen action layout. Thanks @​vyctorbrzezowski.

Overlay and notification behavior

• Completed semantic Toast variants with canonical Error persistence, interaction-paused timers, race-safe dismissal, and notification-layer stacking. Thanks @​vyctorbrzezowski.
• Coordinated one active Tooltip per view, and restored a still-focused tooltip after a temporary hover competitor closes. Thanks @​vyctorbrzezowski.
• Kept Dropdown and Menu Bar actions inside constrained viewports, and introduced shared popover/notification layer roles. Thanks @​vyctorbrzezowski.

Component states

• Completed rendered invalid, active, and disabled form-control states while removing speculative state selectors and binders. Thanks @​vyctorbrzezowski.
• Kept native Date Picker values legible on light preview canvases without losing accent-colored focus feedback. Thanks @​vyctorbrzezowski.
• Added hover feedback for available panel tabs on hover-capable pointers while preserving selected and disabled states. Thanks @​vyctorbrzezowski.
• Aligned the Button Lab with Action states and kept its accessible icon-only specimen compact. Thanks @​vyctorbrzezowski.

Preview studies and documentation

• Added bounded Table and disabled/loading Search studies, including a busy state on the updating table region. Thanks @​vyctorbrzezowski.
• Added an opt-in full-height Dialog layout study for the simulated narrow viewport without changing the shared modal runtime. Thanks @​vyctorbrzezowski.
• Clarified semantic, product, and component stylesheet ownership, and moved preview status labels onto the canonical Badge primitive. Thanks @​vyctorbrzezowski.

Maintenance

• Update the preview dependency toolchain (lucide, Vite).

Changelog

Sourced from @​openclaw/carapace's changelog.

0.6.2 — 2026-08-09

Highlight: a broad component-quality pass from @​vyctorbrzezowski — light-theme contrast now meets AA, every preview image has documented rights, and the overlay primitives (Toast, Tooltip, Dropdown, Menu Bar, Banner) behave correctly under focus, hover competition and constrained viewports.

Accessibility and rights

• Restored AA contrast for light-theme primary actions while keeping modal backdrops visually isolating. Thanks @​vyctorbrzezowski.
• Replaced preview portraits without redistribution records with deterministic generated identities, and documented the rights for every remaining preview image. Thanks @​vyctorbrzezowski.
• Made Banner dismissal return focus safely while preserving generic narrow-screen action layout. Thanks @​vyctorbrzezowski.

Overlay and notification behavior

• Completed semantic Toast variants with canonical Error persistence, interaction-paused timers, race-safe dismissal, and notification-layer stacking. Thanks @​vyctorbrzezowski.
• Coordinated one active Tooltip per view, and restored a still-focused tooltip after a temporary hover competitor closes. Thanks @​vyctorbrzezowski.
• Kept Dropdown and Menu Bar actions inside constrained viewports, and introduced shared popover/notification layer roles. Thanks @​vyctorbrzezowski.

Component states

• Completed rendered invalid, active, and disabled form-control states while removing speculative state selectors and binders. Thanks @​vyctorbrzezowski.
• Kept native Date Picker values legible on light preview canvases without losing accent-colored focus feedback. Thanks @​vyctorbrzezowski.
• Added hover feedback for available panel tabs on hover-capable pointers while preserving selected and disabled states. Thanks @​vyctorbrzezowski.
• Aligned the Button Lab with Action states and kept its accessible icon-only specimen compact. Thanks @​vyctorbrzezowski.

Preview studies and documentation

• Added bounded Table and disabled/loading Search studies, including a busy state on the updating table region. Thanks @​vyctorbrzezowski.
• Added an opt-in full-height Dialog layout study for the simulated narrow viewport without changing the shared modal runtime. Thanks @​vyctorbrzezowski.
• Clarified semantic, product, and component stylesheet ownership, and moved preview status labels onto the canonical Badge primitive. Thanks @​vyctorbrzezowski.

Maintenance

• Update the preview dependency toolchain (lucide, Vite).

0.6.0 — 2026-07-29

Shared utility primitives and canonical application themes.

Changes

• Added the plain badge and theme-toggle primitives for consumer identity and appearance controls.
• Promoted the preview site's neutral OKLCH light and dark roles into themes.css, including input roles, so consumers no longer need to copy a local palette overlay.

Fixes

• Removed the preview-only semantic theme overrides so the reference site now proves the same exported contract consumers receive.

0.2.0 — 2026-07-24

... (truncated)

Commits

• 6c38d2a chore(release): prepare v0.6.2
• 0f8c505 chore(deps): update preview dependencies (#70)
• 53f66ff Merge pull request #56 from openclaw/dependabot/github_actions/actions-ce612e...
• ca8c1ba build(deps): bump the actions group with 2 updates
• b1b4972 Merge pull request #55 from openclaw/dependabot/bun/development-6f8ec73aa0
• 584f464 build(deps-dev): bump the development group with 2 updates
• bd1fdf6 Merge pull request #49 from openclaw/dependabot/github_actions/actions/stale-...
• 57111c1 build(deps): bump actions/stale from 10.4.0 to 11.0.0
• 697ae98 Merge pull request #68 from openclaw/brzezowski/audit-toast
• bdd8375 fix(preview): normalize Toast lifecycle state
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawd-bot	Ready	Preview	Aug 14, 2026 4:34pm
openclaw.ai	Ready	Preview	Aug 14, 2026 4:34pm

[clawsweeper]

Codex review: found issues before merge. Reviewed August 15, 2026, 6:40 PM ET / 22:40 UTC.

ClawSweeper review

What this changes

This PR updates the public website’s direct Carapace design-system dependency from v0.6.1 to v0.6.2.

Merge readiness

⛔ Blocked by patch quality or review findings - 5 items remain

This PR remains necessary but is not merge-ready: it changes the declared Carapace release without updating Bun’s committed resolution, leaving reproducible installs unable to obtain the requested version.

Priority: P2
Reviewed head: fab654856a8e225005aea1d84fd5fc7ea029fe33

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	5 items	PR changes only the manifest: The submitted commit changes package.json from the v0.6.1 Git tag to v0.6.2 and does not update bun.lock. Current lock remains at the old release: Current main declares v0.6.1 in Bun’s workspace dependency list and resolves Carapace to Git revision 3a8bcfb. Reproducible install is documented: The contributor setup explicitly uses bun install --frozen-lockfile, so manifest and lockfile consistency is required.
Findings	1 actionable finding	[P1] Regenerate the committed Bun lockfile
Security	None	None.

How this fits together

The Astro public site consumes Carapace through Bun. The package manifest requests the dependency and the committed lockfile pins the exact source used by reproducible installs and builds.

flowchart LR
  A[Website source] --> B[Package manifest]
  B --> C[Bun lockfile]
  C --> D[Frozen dependency install]
  D --> E[Astro website build]

Loading

Before merge

• Regenerate the committed Bun lockfile (P1) - This remains unresolved from earlier reviews. The changed manifest requests v0.6.2, but bun.lock still records v0.6.1 and revision 3a8bcfb; the documented --frozen-lockfile install therefore cannot reproducibly install the requested release.
• Resolve merge risk (P1) - Merging would declare v0.6.2 while the committed lockfile still pins v0.6.1 and revision 3a8bcfb, breaking the documented reproducible-install contract.
• Resolve merge risk (P1) - No after-fix frozen-install and website-build evidence shows that the new Carapace release remains compatible with this site.
• Complete next step (P2) - The contributor must supply the matching lockfile and real setup proof; automation cannot establish that contributor-side evidence on its behalf.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P1] Regenerate the committed Bun lockfile — package.json:24

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency resolution coverage	manifest +1/-1, lockfile 0	The sole manifest update lacks the corresponding committed resolution required by the documented frozen install.

Merge-risk options

Maintainer options:

1. Commit the matching lockfile and prove the install (recommended)
   Regenerate bun.lock for v0.6.2 and attach redacted output from bun install --frozen-lockfile plus the website build before merge.
2. Pause this update
   Leave the current v0.6.1 declaration in place if a compatible locked v0.6.2 resolution cannot be demonstrated.

Technical review

Best possible solution:

Regenerate and commit bun.lock for v0.6.2, then provide redacted terminal evidence that a frozen install and site build complete successfully.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection establishes the mismatch: the PR requests v0.6.2 while bun.lock remains at v0.6.1, contrary to the documented frozen-install workflow.

Is this the best way to solve the issue?

No—the version change must include Bun’s regenerated lockfile and an after-fix frozen-install/build result to be a maintainable dependency update.

Full review comments:

• [P1] Regenerate the committed Bun lockfile — package.json:24
  This remains unresolved from earlier reviews. The changed manifest requests v0.6.2, but bun.lock still records v0.6.1 and revision 3a8bcfb; the documented --frozen-lockfile install therefore cannot reproducibly install the requested release.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 834f7ea7b1c8.

Labels

Label justifications:

• P2: This direct production dependency update has a bounded but merge-blocking reproducibility defect.
• merge-risk: 🚨 compatibility: The update changes the site-wide design-system runtime and currently leaves declared and locked versions inconsistent.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• PR changes only the manifest: The submitted commit changes package.json from the v0.6.1 Git tag to v0.6.2 and does not update bun.lock. (package.json:24, fab654856a8e)
• Current lock remains at the old release: Current main declares v0.6.1 in Bun’s workspace dependency list and resolves Carapace to Git revision 3a8bcfb. (bun.lock:10, 834f7ea7b1c8)
• Reproducible install is documented: The contributor setup explicitly uses bun install --frozen-lockfile, so manifest and lockfile consistency is required. (README.md:17, 834f7ea7b1c8)
• Current-main and PR comparison: The three-way comparison confirms current main still carries v0.6.1 while the PR’s only change is the manifest version; no lockfile update is present. (package.json:24, fab654856a8e)
• Feature-history routing: Carapace entered this site in Patrick Erichsen’s migration commit, and Peter Steinberger most recently refreshed site dependencies on main. (package.json:24, b17a2577d83e)

Likely related people:

• Peter Steinberger: Recent main history includes the site dependency refresh and subsequent package maintenance. (role: recent dependency-area contributor; confidence: medium; commits: 9ee6dab34710, e4ff1f862283; files: package.json, bun.lock)
• Patrick Erichsen: Introduced the site’s Carapace migration in current feature history. (role: Carapace integration introducer; confidence: medium; commits: b17a2577d83e; files: package.json, bun.lock)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-08-14T16:37:56.634Z sha fab6548 :: needs changes before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T07:04:53.639Z sha fab6548 :: needs changes before merge. :: [P1] Regenerate bun.lock for the new Git ref
• reviewed 2026-08-15T09:11:11.659Z sha fab6548 :: found issues before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T10:43:24.592Z sha fab6548 :: found issues before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T11:06:32.760Z sha fab6548 :: needs changes before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T15:53:52.470Z sha fab6548 :: needs changes before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T17:53:29.028Z sha fab6548 :: needs changes before merge. :: [P1] Regenerate the committed Bun lockfile
• reviewed 2026-08-15T20:42:06.304Z sha fab6548 :: found issues before merge. :: [P1] Regenerate the committed Bun lockfile