fix: catch styled remote-control steps and align vitest coverage provider

[elkaix]

Related Issue

Follow-up to #301 (release PR for @pymodel/pythinker-code@1.13.0). No linked issue — maintainer-authored hygiene fixes surfaced during the release loop.

Problem

Two defects left behind by the release commit ce945e1:

1. The remote-control output test asserted the absence of a third setup step with /^\s*3\.\s/m against raw CLI output. formatRemoteControlOutput wraps step numbers in chalk.bold.hex (label()), so any real third step renders as <ESC>[1m<ESC>[38;5;Nm3.<ESC>... and the line-start anchor never matches — the assertion cannot catch the regression it exists for (and its previous form, a plain not.toContain('3.'), false-failed on the 1.13.0 version banner).
2. The vitest 4.1.9 -> 4.1.11 security bump left @vitest/coverage-v8 pinned at 4.1.9. The installed coverage provider requires the same exact vitest version and vitest warns that mixed provider/test-runner versions are unsupported. Plain test runs do not exercise this path.

What changed

• apps/pythinker-code/test/cli/web/remote-control.test.ts: moved the third-step assertion below the existing ANSI/OSC stripping and retargeted it to plain, so a styled 3. step is caught after escapes are removed. Verified by temporarily injecting a styled third step through the same label() path — the test fails as required; reverted afterwards.
• package.json + pnpm-lock.yaml: aligned @vitest/coverage-v8 to 4.1.11; focused --coverage run loads the v8 provider with no mixed-version warning.
• flake.nix: refreshed the pnpmDeps fixed-output hash for the lockfile change.
• Restaged dist-web/.web-bundle-manifest.json (root package.json is a web build input).

No changeset: nothing here changes published manifests or user-visible behavior. No doc update needed.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: the issue must have a maintainer's /approve). N/A — internal follow-up PR.
• I have added tests that prove my feature works. Existing suite covers the assertion; rejection of a styled third step proven by temporary injection.
• Ran gen-changesets skill, or this PR needs no changeset. Needs none.
• Ran gen-docs skill, or this PR needs no doc update. Needs none.

Summary by CodeRabbit

• Tests

  • Improved validation of remote-control output, including complete URLs, formatting cleanup, and expected setup-step visibility.

• Chores

  • Updated web build metadata and project maintenance configuration to keep generated assets and development workflows current.
  • Refreshed development tooling configuration to support consistent coverage reporting and reproducible builds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 582aa433-bd64-4aee-9ec6-5dac30ed668e

📥 Commits

Reviewing files that changed from the base of the PR and between 2b87df2 and dcd7fee.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• apps/pythinker-code/dist-web/.web-bundle-manifest.json
• flake.nix

🚧 Files skipped from review as they are similar to previous changes (1)

• flake.nix

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The pull request updates remote-control output assertions and refreshes the web bundle hash, pnpm fetch hash, and @vitest/coverage-v8 version.

Changes

Remote-control test and metadata updates

Layer / File(s)	Summary
Remote-control output assertions apps/pythinker-code/test/cli/web/remote-control.test.ts	The test strips hyperlink and ANSI escape sequences before validating plain-text output. It checks the full URL, no truncation, and no third setup step.
Build and dependency metadata apps/pythinker-code/dist-web/.web-bundle-manifest.json, flake.nix, package.json	The web bundle source hash and pnpm fetch hash are updated. @vitest/coverage-v8 changes from 4.1.9 to 4.1.11.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to dcd7f

This change updates test assertions and dependency/build metadata without identified user-facing or production risk, so it is ready to merge with normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title uses the required fix: prefix and imperative wording, but it is 73 characters long and exceeds the 72-character limit.	Shorten the title to 72 characters or fewer while preserving its meaning, for example: "fix: catch styled steps and align vitest coverage provider".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes all required sections, explains both defects and their fixes, documents testing, and explains why no changeset or documentation update is needed. It references issue #301 and …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@pymodel/pythinker-code@dcd7fee

npx https://pkg.pr.new/@pymodel/pythinker-code@dcd7fee

commit: dcd7fee