chore: bump deps, update CI artifacts, and clean up Claude Code settings

.claude/CLAUDE.md

@@ -6,10 +6,10 @@ The project uses British English - strictly.
 
 ## Tech Stack
 
-- **Framework**: Next.js 16 (React 19, App Router, React Compiler, TypeScript 6)
+- **Framework**: Next.js 16.2 (React 19, App Router, React Compiler, TypeScript 6)
 - **Styling**: Tailwind CSS 4
 - **Auth**: Clerk 7 (`@clerk/nextjs`, `@clerk/ui` shadcn theme)
-- **Testing**: Vitest 4 + Testing Library (unit), Playwright 1.58 (E2E)
+- **Testing**: Vitest 4.1 + Testing Library (unit), Playwright 1.59 (E2E)
 - **Quality**: Biome 2.4 (lint + format, replaces ESLint/Prettier)
 - **Git Hooks**: Lefthook 2.1 (pre-commit: lint, typecheck, unit; pre-push: E2E)
 - **Deployment**: Vercel (Preview on PR, Production on merge)

.claude/settings.json

@@ -1,47 +1,48 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
     "allow": [
-      "Bash(cat:*)",
-      "Bash(claude mcp get:*)",
+      "Bash(cat *)",
+      "Bash(claude mcp get *)",
       "Bash(claude mcp list)",
-      "Bash(echo:*)",
-      "Bash(find:*)",
-      "Bash(lsof:*)",
-      "Bash(ls:*)",
-      "Bash(sed:*)",
-      "Bash(tree:*)",
-      "Bash(wc:*)",
-      "Bash(xargs:*)",
-      "Bash(git diff:*)",
-      "Bash(git log:*)",
-      "Bash(gh pr checks:*)",
-      "Bash(gh pr list:*)",
-      "Bash(gh pr view:*)",
-      "Bash(gh run list:*)",
-      "Bash(gh run view:*)",
+      "Bash(echo *)",
+      "Bash(find *)",
+      "Bash(gh pr checks *)",
+      "Bash(gh pr list *)",
+      "Bash(gh pr view *)",
+      "Bash(gh run list *)",
+      "Bash(gh run view *)",
+      "Bash(git diff *)",
+      "Bash(git log *)",
+      "Bash(ls *)",
+      "Bash(lsof *)",
+      "Bash(npm ci)",
+      "Bash(npm ls *)",
+      "Bash(npm outdated *)",
       "Bash(npm run build)",
-      "Bash(npm run dev)",
-      "Bash(npm run start)",
       "Bash(npm run check)",
+      "Bash(npm run dev)",
       "Bash(npm run lint)",
-      "Bash(npm run lint:md:*)",
+      "Bash(npm run lint:md *)",
+      "Bash(npm run start)",
       "Bash(npm run test)",
-      "Bash(npm run test:e2e:*)",
-      "Bash(npm run test:unit:*)",
+      "Bash(npm run test:e2e *)",
+      "Bash(npm run test:unit *)",
       "Bash(npm run typecheck)",
-      "Bash(npx @biomejs/biome:*)",
-      "Bash(npx lefthook:*)",
-      "Bash(npx playwright:*)",
-      "Bash(npx vercel:*)",
+      "Bash(npx @biomejs/biome *)",
+      "Bash(npx lefthook *)",
+      "Bash(npx playwright *)",
+      "Bash(tree *)",
       "Bash(vercel --help)",
       "Bash(vercel env --help)",
-      "Bash(vercel env ls:*)",
+      "Bash(vercel env ls *)",
       "Bash(vercel git --help)",
       "Bash(vercel integration --help)",
-      "Bash(vercel list:*)",
+      "Bash(vercel list *)",
       "Bash(vercel open)",
-      "Bash(vercel project ls:*)",
+      "Bash(vercel project ls *)",
       "Bash(vercel whoami)",
+      "Bash(wc *)",
       "mcp__ide__getDiagnostics",
       "mcp__playwright__browser_click",
       "mcp__playwright__browser_close",
@@ -64,24 +65,15 @@
     "deny": ["Read(**/.env)", "Read(**/.envrc)", "Read(.xdocs/DONE/**)"],
     "ask": []
   },
-  "enabledPlugins": {
-    "shadcn-ui@my-claude-marketplace": true,
-    "feature-dev@claude-plugins-official": true,
-    "code-review@claude-plugins-official": true,
-    "code-simplifier@claude-plugins-official": true
-  },
   "extraKnownMarketplaces": {
     "my-claude-marketplace": {
       "source": {
         "source": "github",
         "repo": "michellepace/my-claude-marketplace"
       }
-    },
-    "claude-plugins-official": {
-      "source": {
-        "source": "github",
-        "repo": "anthropics/claude-plugins-official"
-      }
     }
+  },
+  "enabledPlugins": {
+    "git-utils@my-claude-marketplace": true
   }
 }

.github/workflows/test-e2e-vercel.yml

@@ -40,7 +40,7 @@ jobs:
     name: Run E2E Tests on Preview
     # Only run for repository_dispatch events (safety check)
     if: github.event_name == 'repository_dispatch'
-    timeout-minutes: 10
+    timeout-minutes: 15
     runs-on: ubuntu-latest
 
     steps:
@@ -83,7 +83,7 @@ jobs:
           E2E_TEST_OTP: ${{ secrets.E2E_TEST_OTP }}
 
       # Step: Upload test report
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: playwright-report-vercel-preview

.github/workflows/test-e2e.yml

@@ -20,7 +20,7 @@ on:
 jobs:
   e2e:
     name: Run E2E Tests
-    timeout-minutes: 10
+    timeout-minutes: 15
     runs-on: ubuntu-latest
 
     steps:
@@ -59,7 +59,7 @@ jobs:
         E2E_TEST_OTP: ${{ secrets.E2E_TEST_OTP }}
 
     # Step: Upload test report
-    - uses: actions/upload-artifact@v6
+    - uses: actions/upload-artifact@v7
       if: ${{ !cancelled() }}
       with:
         name: playwright-report

.markdownlint-cli2.yaml

@@ -3,6 +3,7 @@
 
 ignores:
   - "node_modules/**"
+  - ".xdocs/DONE/**"
 
 # Disable only the rules that interfere with practical markdown writing
 config:

e2e/authenticated.desktop.spec.ts

@@ -54,7 +54,8 @@ test.describe("Authenticated User Flow - Desktop", () => {
     }
 
     // Verify authenticated state - UserButton visible in left sidebar
-    await expect(userMenu).toBeVisible();
+    // Extended timeout: Clerk's dev-browser-sync handshake redirect is slow on CI WebKit
+    await expect(userMenu).toBeVisible({ timeout: 15_000 });
 
     // === MANAGE ACCOUNT ===
     await userMenu.click();