build(deps): refresh compatible Swift logging and configuration pins

[steipete]

Refresh the three tracked consumer locks to Swift Log 1.16.1 and Swift Configuration 1.2.2. This picks up fixes for multiplexed log metadata, nested metadata, and empty configuration values. Swift Log's Swift 6.2 floor matches Peekaboo's existing source requirement.

Keep Swift Collections at the required 1.6.0 runtime-compatible pin. Async Algorithms 1.1.6+ requires Collections 1.7.0 and is intentionally deferred; Swift Subprocess 1.0.1 is inside the repository's 48-hour dependency cooldown. Chrome DevTools MCP is already at the current 1.10.1 release. No product version or release changes.

Validation:

• bash scripts/test-release-package-resolution.sh passed locally.
• 60 lightweight docs and ambient-state tests passed locally under reduced priority.
• AWS Crabbox cbx_29e67ec9d782: frozen pnpm install and all 101 docs, MCP wrapper, guidance, and release-validation tests passed. The first run found missing submodule inputs; initializing and verifying the pinned submodules resolved that sync failure.
• Independent Codex review: no actionable P0–P2 findings.

Full native acceptance is the PR's ordinary macOS CI and CodeQL at this exact head.

Exact-head native result: all six jobs in macOS CI 38029863464 passed at 5ce3c32a67ca87a14bb8b2156554e73b81803342, including Core/CLI/Tachikoma tests, app builds, lint and formatting. CodeQL 38029863543 has passed Actions and JavaScript analysis; Swift analysis is still running. Landing remains gated on that completion.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[cursor]

PR Summary

Low Risk
Patch-level dependency pin updates only; behavior changes are limited to upstream logging and configuration bug fixes within existing Swift/macOS baselines.

Overview
Bumps the shared SwiftPM lockfiles for swift-log (1.15.1 → 1.16.1) and swift-configuration (1.2.1 → 1.2.2) in the Mac app, workspace, and PeekabooCore Package.resolved files so all consumers resolve the same revisions.

Documents the upgrade under Unreleased in CHANGELOG.md, citing fixes for multiplexed log metadata and empty configuration values. No application source or version changes in this diff.

^{Reviewed by Cursor Bugbot for commit 5ce3c32. Bugbot is set up for automated code reviews on this repo. Configure here.}

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates three SwiftPM locks to Swift Log 1.16.1 and Swift Configuration 1.2.2 and adds an Unreleased changelog entry.

Example: A multiplexed log event has provider metadata request_id=req-42.

• Before: Swift Log 1.15.1 can omit the multiplexer's provider metadata when forwarding the event.
• After: Swift Log 1.16.1 forwards request_id=req-42 while preserving explicit event metadata precedence.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, compatible dependency refresh with passing native validation and limited direct behavioral evidence.
Proof confidence	🦐 gold shrimp (3/6)	This collaborator-authored PR is outside the ordinary contributor proof gate; exact-head native builds and tests passed, but supplied evidence does not exercise the changed metadata behavior through a shipped entry point.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The currently pinned libraries retain upstream logging metadata and empty-value handling defects.
Reason: The collaborator and established dependency-area contributor selected a narrow compatible refresh without introducing options, APIs, or changed product defaults.

Merge readiness

✅ Ready for maintainer review

Keep open: this collaborator-authored dependency refresh is absent from main, preserves existing constraints, and has no actionable patch findings.

Priority: P3
Reviewed head: 5ce3c32a67ca87a14bb8b2156554e73b81803342

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The supplied validation does not demonstrate metadata forwarding through a native Peekaboo entry point; the previous suggestion for that run remains optional for this collaborator-authored maintenance PR.

Agent review details

How this fits together

SwiftPM reads the Core, Mac, and Xcode workspace locks to select logging and configuration implementations linked into Peekaboo consumers.

flowchart LR
  A[Package manifests] --> B[Three consumer locks]
  B --> C[SwiftPM resolution]
  C --> D[Swift Log]
  C --> E[Swift Configuration]
  D --> F[Peekaboo consumers]
  E --> F

Loading

Technical review

Best possible solution:

Retain the synchronized refresh with existing runtime constraints and complete the ordinary native acceptance gates.

Do we have a high-confidence way to reproduce the issue?

The upstream repairs are source-verifiable, but the submission establishes no specific failing Peekaboo scenario; no target code was executed during review.

Is this the best way to solve the issue?

Updating the existing synchronized locks is a focused solution that uses official releases and preserves the deliberately constrained dependency graph.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 81bce4043f53.

Provenance checked

• Synchronized Swift Configuration pins keeps the original intent (1fd5f88: The preceding refresh aligned consumer locks while preserving existing toolchain and operating-system minimums.)
• Synchronized Swift Log pins keeps the original intent (6e6ae6a: The preceding update repaired logging dispatch and toolchain compatibility while keeping all three locks aligned.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned diff changes only two dependency version/revision pairs in each of three locks and one changelog entry; package locations and all other pins remain unchanged. (Core/PeekabooCore/Package.resolved:63, 5ce3c32a67ca)
• Main and feature history: Main retains Configuration 1.2.1 and Log 1.15.1. Prior synchronized updates in build(deps): refresh Node, pnpm, and Swift dependencies #768 and chore(deps): update SwiftLog and prepare 4.3.4 notes #713 establish the same compatibility-preserving approach. History repeatedly identifies steipete as the dependency-area contributor; following older history eventually reaches an unavailable blob, leaving initial introduction unverified. (Core/PeekabooCore/Package.resolved:63, 81bce4043f53)
• Official logging release: The official 1.16.1 tag matches the selected revision and was published October 7. The upstream comparison verifies multiplexed provider metadata forwarding, nested metadata rendering repairs, and a Swift 6.2 floor matching Peekaboo's manifests. (Sources/Logging/Handlers/MultiplexLogHandler.swift:152, 4038b6a4f74a)
• Official configuration release: The official 1.2.2 tag matches the selected revision and was published October 5. Production changes preserve empty environment-file values and empty JSON/plist arrays and reject signed hexadecimal byte strings; no package manifest change appears in the comparison. (Sources/Configuration/Providers/EnvironmentVariables/EnvironmentFileParser.swift:77, 8bae88f79dbd)
• Compatibility and storage boundary: Swift Collections remains exactly 1.6.0. Peekaboo's configuration loader and writer continue using JSONCoding and getenv; this PR changes no stored format, migration, defaults, or configuration-writing behavior. (Core/PeekabooCore/Sources/PeekabooAutomation/Configuration/ConfigurationManager+Parsing.swift:22, 5ce3c32a67ca)
• Current native validation: All six jobs in https://github.com/openclaw/Peekaboo/actions/runs/38029863464 passed at the reviewed head. Actions and JavaScript CodeQL passed; Swift analysis remains in progress, with no failed check observed. The complete body reports AWS Crabbox cbx_29e67ec9d782 validation; that reported run was not independently executed during this review. (5ce3c32a67ca)

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is bounded dependency maintenance without an established urgent Peekaboo regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Optionally increase confidence with a native run exercising logging metadata delivery using the updated dependency graph.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-10T06:10:25.734Z sha 5ce3c32 :: needs maintainer review before merge. :: none

Reviewed October 10, 2026, 2:47 AM ET / 06:47 UTC (Revision 2).