More AGENTS.md instructions

.devcontainer/devcontainer.json

@@ -35,7 +35,7 @@
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
         "github.copilot-chat@0.38.2026022704",
-        "anthropic.claude-code@2.1.61",
+        "anthropic.claude-code@2.1.74",
         // Python
         "ms-python.python@2026.2.2026021801",
         "ms-python.vscode-pylance@2026.1.1",
@@ -71,5 +71,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 2fb97fb0 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): eb7c79fa # spellchecker:disable-line
 }

.devcontainer/install-ci-tooling.py

@@ -5,7 +5,7 @@
 import subprocess
 import sys
 
-UV_VERSION = "0.10.8"
+UV_VERSION = "0.10.9"
 COPIER_VERSION = "9.12.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "0.3.3"
 PRE_COMMIT_VERSION = "4.5.1"

AGENTS.md

@@ -5,24 +5,29 @@
 - Always include type hints for pyright in Python
 - Respect the pyright rule reportUnusedCallResult; assign unneeded return values to `_`
 - Prefer keyword-only parameters (unless a very clear single-argument function): use `*` in Python signatures and destructured options objects in TypeScript.
+- When disabling a linting rule with an inline directive, provide a comment at the end of the line (or on the line above for tools that don't allow extra text after an inline directive) describing the reasoning for disabling the rule.
 
 ## Testing
 - Always run tests with an explicit path (e.g. uv run pytest tests/unit) — test runners discover all types by default.
 - Test coverage requirements are usually at 100%, so when running a subset of tests, always disable test coverage to avoid the test run failing for insufficient coverage.
 - Avoid magic values in comparisons in tests in all languages (like ruff rule PLR2004 specifies)
 - Prefer using random values in tests rather than arbitrary ones (e.g. the faker library, uuids, random.randint) when possible.
+- Avoid loops in tests — assert each item explicitly so failures pinpoint the exact element.
+- Key `data-testid` selectors off unique IDs (e.g. UUIDs), not human-readable names which may collide or change.
 
 ### Python Testing
 - When using `mocker.spy` on a class-level method (including inherited ones), the spy records the unbound call, so assertions need `ANY` as the first argument to match self:  `spy.assert_called_once_with(ANY, expected_arg)`
 - Before writing new mock/spy helpers, check the `tests/unit/` folder for pre-built helpers in files like `fixtures.py` or `*mocks.py`
+- When a test needs a fixture only for its side effects (not its return value), use `@pytest.mark.usefixtures(fixture_name.__name__)` instead of adding an unused parameter with a noqa comment
+- Use `__name__` instead of string literals when referencing functions/methods (e.g., `mocker.patch.object(MyClass, MyClass.method.__name__)`, `pytest.mark.usefixtures(my_fixture.__name__)`). This enables IDE refactoring tools to catch renames.
 
 
 ## Tooling
 - Always use `uv run python` instead of `python3` or `python` when running Python commands.
 - Check .devcontainer/devcontainer.json for tooling versions (Python, Node, etc.) when reasoning about version-specific stdlib or tooling behavior.
-- For frontend work, run commands via `pnpm` scripts from `frontend/package.json`
-<!-- Allows better automated utilization of command allow/deny list -->
-- When running terminal commands, execute exactly one command per tool call. Do not chain commands with &&, ||, ;, or & unless the user explicitly asks for it. Pipes (|) are allowed for output transformation (e.g., head, tail, grep). If two sequential commands are needed, run them in separate tool calls.
+- For frontend work, run commands via `pnpm` scripts from `frontend/package.json`. ✅ pnpm test-unit  ❌ pnpm vitest ... or npx vitest ...
+- When running terminal commands, execute exactly one command per tool call. Do not chain commands with &&, ||, ;, or & unless the user explicitly asks for it. Pipes (|) are allowed for output transformation (e.g., head, tail, grep). If two sequential commands are needed, run them in separate tool calls. Chained commands break the permission allow-list matcher and cause unnecessary permission prompts
+- Never use backslash line continuations in shell commands — always write the full command on a single line. Backslashes break the permission allow-list matcher.
 
 <!-- BEGIN BEADS INTEGRATION -->
 ## Issue Tracking with bd (beads)

extensions/context.py

@@ -11,25 +11,25 @@ class ContextUpdater(ContextHook):
     @override
     def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         # These are duplicated in the install-ci-tooling.py script in this repository
-        context["uv_version"] = "0.10.8"
+        context["uv_version"] = "0.10.9"
         context["pre_commit_version"] = "4.5.1"
         # These also in pyproject.toml
         context["copier_version"] = "==9.12.0"
         context["copier_template_extensions_version"] = "==0.3.3"
         #######
-        context["pnpm_version"] = "10.30.3"
+        context["pnpm_version"] = "10.32.1"
         # These are duplicated in the pyproject.toml of this repository
         context["pyright_version"] = ">=1.1.408"
         context["pytest_version"] = ">=9.0.2"
         context["pytest_randomly_version"] = ">=4.0.1"
         context["pytest_cov_version"] = ">=7.0.0"
-        context["ty_version"] = ">=0.0.19"
+        context["ty_version"] = ">=0.0.23"
         #######
         context["sphinx_version"] = "9.0.4"
-        context["pulumi_version"] = ">=3.223.0"
-        context["pulumi_aws_version"] = ">=7.20.0"
-        context["pulumi_aws_native_version"] = ">=1.54.0"
-        context["pulumi_command_version"] = ">=1.2.0"
+        context["pulumi_version"] = ">=3.226.0"
+        context["pulumi_aws_version"] = ">=7.23.0"
+        context["pulumi_aws_native_version"] = ">=1.57.0"
+        context["pulumi_command_version"] = ">=1.2.1"
         context["pulumi_github_version"] = ">=6.12.1"
         context["pulumi_okta_version"] = ">=6.2.3"
         context["boto3_version"] = ">=1.42.53"

pyproject.toml

@@ -9,7 +9,7 @@ dependencies = [
     "pytest-cov>=7.0.0",
     "pytest-randomly>=4.0.1",
     "pyright[nodejs]>=1.1.408",
-    "ty>=0.0.19",
+    "ty>=0.0.23",
     "copier==9.12.0",
     "copier-template-extensions==0.3.3"
 ]

template/.devcontainer/devcontainer.json.jinja-base

@@ -12,7 +12,7 @@
     "ghcr.io/devcontainers/features/aws-cli:1.1.2": {
       // https://github.com/devcontainers/features/blob/main/src/aws-cli/devcontainer-feature.json
       // view latest version https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst
-      "version": "2.32.6",
+      "version": "2.32.6"
     },{% endraw %}{% endif %}{% raw %}
     "ghcr.io/devcontainers/features/python:1.8.0": {
       // https://github.com/devcontainers/features/blob/main/src/python/devcontainer-feature.json
@@ -40,7 +40,7 @@
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
         "github.copilot-chat@0.38.2026022704",{% endraw %}{% if install_claude_cli %}{% raw %}
-        "anthropic.claude-code@2.1.61",{% endraw %}{% endif %}{% raw %}
+        "anthropic.claude-code@2.1.74",{% endraw %}{% endif %}{% raw %}
 
         // Python
         "ms-python.python@2026.2.2026021801",