@bensandee/tooling 0.86.1 → 0.87.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.86.1",
+  "version": "0.87.1",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -34,7 +34,7 @@
     "@clack/prompts": "^1.8.1",
     "citty": "^0.2.2",
     "cross-spawn": "^7.0.6",
-    "dependency-cruiser": "^18.4.0",
+    "dependency-cruiser": "^18.5.0",
     "json5": "^2.2.3",
     "jsonc-parser": "^3.3.1",
     "picomatch": "^4.0.7",
@@ -49,7 +49,7 @@
     "@changesets/cli": "3.0.3",
     "@release-it/bumper": "8.0.1",
     "@types/cross-spawn": "6.0.6",
-    "@types/node": "24.13.5",
+    "@types/node": "24.19.1",
     "@types/picomatch": "4.0.3",
     "commit-and-tag-version": "13.2.1",
     "modern-web-guidance": "0.0.191",

package/tooling.schema.json

@@ -590,7 +590,7 @@
       "type": "object",
       "properties": {
         "strictTypeAware": {
-          "description": "Make `bst lint:types` (the type-aware oxlint gate, backed by oxlint-tsgolint) exit non-zero on any finding while the tooling is still in its report phase (default false; the enforce phase, a later tooling release, exits non-zero unconditionally). A missing oxlint-tsgolint binary is also a hard failure rather than a notice while this is set: arming the gate is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it.",
+          "description": "Make a missing oxlint-tsgolint binary a hard failure for `bst lint:types` (the type-aware oxlint gate) rather than a notice (default false): arming it is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it. Findings block in every repo regardless of this setting.",
           "type": "boolean"
         }
       },
@@ -650,6 +650,21 @@
           "description": "Whether the agent may route its own agent-note/human-triage-needed issues through the agent/analyze stage (default: off). Unlike agent.backlog, which defaults on, this defaults off: a backlog run batches every pending finding into one container, while triage routing spends one container per issue -- arming it is the reversible direction, not disarming it.",
           "type": "boolean"
         },
+        "egress": {
+          "description": "Extra egress hosts this repo's agent containers may reach. `browseHosts` joins the agent's browse lane (GET and HEAD only) on top of the hosts every run needs; the passthrough lane stays agent-owned. Each entry is a host pattern -- an exact host or a *.host wildcard, never a port. Read from the repo's DEFAULT BRANCH, never off a pull request's own tree, so a run can never widen its own egress: the declaration takes effect on the first container started after a human merges it. An entry whose pattern the agent cannot parse refuses the run rather than being dropped. Changing this block holds the pull request from automerge.",
+          "type": "object",
+          "properties": {
+            "browseHosts": {
+              "description": "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only.",
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          },
+          "additionalProperties": false
+        },
         "findingHolds": {
           "description": "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring.",
           "type": "object",