@@ -44,13 +44,63 @@
       // Git & Version Control
       "Bash(git add *)",
       "Bash(git branch *)",
+      "Bash(git checkout *)",
       "Bash(git commit *)",
       "Bash(git diff *)",
       "Bash(git log *)",
+      "Bash(git mv *)",
       "Bash(git push)",
       "Bash(git remote get-url origin)",
       "Bash(git rev-parse *)",
       "Bash(git status *)",
+      // Github
+      "Bash(gh issue list *)",
+      "Bash(gh issue view *)",
+      "Bash(gh run download *)",
+      "Bash(gh run list *)",
+      "Bash(gh run view *)",
+      "Bash(gh run watch *)",
+      "Bash(gh search *)",
+      "Bash(gh pr view *)",
+      "Bash(gh pr diff *)",
+      // Local app interaction
+      // Claude currently has terrible support for this: https://github.com/anthropics/claude-code/issues/338    using `:*` as a pattern is not allowed (doesn't error, just doesn't really work), so have to specify _something_ between the colon and asterisk.
+      "Bash(curl http://localhost:1*)",
+      "Bash(curl http://localhost:2*)",
+      "Bash(curl http://localhost:3*)",
+      "Bash(curl http://localhost:4*)",
+      "Bash(curl http://localhost:5*)",
+      "Bash(curl http://localhost:6*)",
+      "Bash(curl http://localhost:7*)",
+      "Bash(curl http://localhost:8*)",
+      "Bash(curl http://localhost:9*)",
+      "Bash(curl -s http://localhost:1*)",
+      "Bash(curl -s http://localhost:2*)",
+      "Bash(curl -s http://localhost:3*)",
+      "Bash(curl -s http://localhost:4*)",
+      "Bash(curl -s http://localhost:5*)",
+      "Bash(curl -s http://localhost:6*)",
+      "Bash(curl -s http://localhost:7*)",
+      "Bash(curl -s http://localhost:8*)",
+      "Bash(curl -s http://localhost:9*)",
+      "Bash(curl \"http://localhost:1*)",
+      "Bash(curl \"http://localhost:2*)",
+      "Bash(curl \"http://localhost:3*)",
+      "Bash(curl \"http://localhost:4*)",
+      "Bash(curl \"http://localhost:5*)",
+      "Bash(curl \"http://localhost:6*)",
+      "Bash(curl \"http://localhost:7*)",
+      "Bash(curl \"http://localhost:8*)",
+      "Bash(curl \"http://localhost:9*)",
+      "Bash(curl -s \"http://localhost:1*)",
+      "Bash(curl -s \"http://localhost:2*)",
+      "Bash(curl -s \"http://localhost:3*)",
+      "Bash(curl -s \"http://localhost:4*)",
+      "Bash(curl -s \"http://localhost:5*)",
+      "Bash(curl -s \"http://localhost:6*)",
+      "Bash(curl -s \"http://localhost:7*)",
+      "Bash(curl -s \"http://localhost:8*)",
+      "Bash(curl -s \"http://localhost:9*)",
       // Misc
       "Bash(amp *)",
       "Bash(atuin *)",
@@ -64,8 +114,7 @@
       "Bash(zk *)",
       // Node.js
       "Bash(pnpm list *)",
-      "Bash(pnpm test-unit *)",
-      "Bash(pnpm test-e2e *)",
+      "Bash(pnpm test*)",
       "Bash(pnpm view *)",
       // Python
       "Bash(uv run pytest *)",
@@ -83,10 +132,6 @@
       // Search
       "Bash(rg *)",
       // Research
-      "Bash(gh issue list *)",
-      "Bash(gh search *)",
-      "Bash(gh pr view *)",
-      "Bash(gh pr diff *)",
     ],
     "ask": [
       // let's hold off before we let it use the github CLI in any free running allow mode...I don't want it somehow approving PRs with the user's credentials
@@ -95,11 +140,7 @@
       "Bash(gh secret *)",
       "Bash(gh ruleset *)",
       "Bash(aws *)", // let's hold off before we let it use AWS CLI in any free running allow mode. We need to be very sure we don't have any access to staging or production credentials in our dev environment (...which we shouldn't...but we need to double check that or consider any other safeguards first)
-      "Bash(curl *)",
-      "Bash(ln *)",
       "WebFetch",
-      // Git & Version Control
-      "Bash(git reset --hard *)",
     ],
     "deny": [
       // Exceptions to generally allowed AI tooling
 
@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.0.126
+_commit: v0.0.130
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 copier_answers_directory: .
 description: Copier template for creating Python libraries and executables
 
@@ -14,7 +14,7 @@
       "optimize": true
     },
     // https://github.com/anthropics/devcontainer-features/blob/main/src/claude-code/devcontainer-feature.json
-    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0.5": {}
+    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0.5": {},
   },
   "customizations": {
     "vscode": {
@@ -27,13 +27,13 @@
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
         "github.copilot-chat@0.44.2",
-        "anthropic.claude-code@2.1.143",
+        "anthropic.claude-code@2.1.145",
 
         // Python
         "ms-python.python@2026.5.2026032701",
         "ms-python.vscode-pylance@2026.2.100",
         "ms-vscode-remote.remote-containers@0.414.0",
-        "charliermarsh.ruff@2026.40.0",
+        "charliermarsh.ruff@2026.44.0",
 
         // Misc file formats
         "bierner.markdown-mermaid@1.29.0",
@@ -65,5 +65,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 06e5a5c0 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): ca20b755 # spellchecker:disable-line
 }
@@ -7,8 +7,8 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.11.14"
-PNPM_VERSION = "11.2.2"
+UV_VERSION = "0.11.17"
+PNPM_VERSION = "11.5.0"
 COPIER_VERSION = "==9.15.1"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "4.5.1"
 
@@ -68,6 +68,10 @@ docs/_build
 tests/**/snapshots/*_actual.png
 tests/**/snapshots/*_diff.png
 pytest.log
+test-screenshots/
+playwright-report/
+test-results/
+.vitest-attachments/
 
 # test coverage
 tests/__coverage__
@@ -83,6 +87,8 @@ prof/
 # NodeJS
 node_modules/
 .pnpm-store/
+# TypeScript incremental build cache
+*.tsbuildinfo
 
 
 # Nuxt
 
@@ -14,11 +14,12 @@ This project is a Copier template used to generate other copier templates. It is
 - Prefer keyword-only parameters (unless a very clear single-argument function): use `*` in Python signatures and destructured options objects in TypeScript.
 - When disabling a linting rule with an inline directive, provide a comment at the end of the line (or on the line above for tools that don't allow extra text after an inline directive) describing the reasoning for disabling the rule.
 - Avoid telling the type checker what a type is rather than letting it prove it. This includes type assertions (`as SomeType` in TypeScript, `cast()` in Python) and variable annotations that override inference. Prefer approaches that let the type checker verify the type itself: `isinstance`/`instanceof` narrowing, restructuring code so the correct type flows naturally, or using discriminated unions. When there is genuinely no alternative, add a comment explaining why the workaround is necessary and why it is safe.
+- Avoid `||` (TypeScript) or `or` (Python) in `if`/`elif` conditions, and avoid `x in ['a', 'b']`-style membership tests in implementation code — coverage tools treat these as a single branch, silently masking untested paths and producing false 100% branch coverage. Use separate `if`/`elif` branches instead so each condition is independently covered.
 
 ## Testing
 
 - Always run tests with an explicit path (e.g. uv run pytest tests/unit) — test runners discover all types (unit, integration, E2E...) by default.
-- When iterating on a single test, run that test in isolation first and confirm it is in the expected state (red or green) before widening to the full suite. Use the most targeted invocation available: a specific test function for Python (e.g. `uv run pytest path/to/test.py::test_name --no-cov`) or a file path and name filter for TypeScript (e.g. `pnpm test-unit -- path/to/test.spec.ts -t "test name" --no-coverage`). Only run the full suite once the target test behaves as expected.
+- When iterating on a single test, run that test in isolation first and confirm it is in the expected state (red or green) before widening to the full suite. Use the most targeted invocation available: a specific test function for Python (e.g. `uv run pytest path/to/test.py::test_name --no-cov`) or a file path and name filter for TypeScript (e.g. `pnpm test-unit path/to/test.spec.ts -t "test name" --no-coverage`). Only run the full suite once the target test behaves as expected.
 - Test coverage requirements are usually at 100%, so when running a subset of tests, always disable test coverage to avoid the test run failing for insufficient coverage.
 - Avoid magic values in comparisons in tests in all languages (like ruff rule PLR2004 specifies). Note: `1` and `0` are not magic numbers (according to PLR2004)
 - Prefer using random values in tests rather than arbitrary ones (e.g. the faker library, uuids, random.randint) when possible. For enums, pick randomly rather than hardcoding one value.
 
@@ -126,7 +126,7 @@ create_docs:
     help: Do you want to create documentation for this project?
     default: yes
 
-is_frozen_executable:
+deploy_as_executable:
     type: bool
     help: Is this project a frozen executable (instead of a PyPI-compatible library)?
     default: no
@@ -135,7 +135,7 @@ use_windows_in_exe_ci:
     type: bool
     help: Should CI in the instantiated template also use Windows runners for building and testing the executable?
     default: no
-    when: is_frozen_executable
+    when: deploy_as_executable
 
 use_codecov:
     type: bool
@@ -158,14 +158,23 @@ _tasks:
             --target-file .pre-commit-config.yaml
     when: "{{ not install_claude_cli }}"
   # Copier does not preserve executable permissions when instantiating the template, so we set them explicitly here.
+  # git update-index is also needed because with core.fileMode=false (common on WSL2) git ignores the on-disk exec bit,
+  # so a plain `git add` would not capture it. It is guarded on the file being tracked, since on an initial `copier copy`
+  # into a fresh repo the file is not in the index yet (the chmod alone covers that case).
   - command: |
         if [ -f scripts/delete_false_positive_rej.py ]; then
             chmod +x scripts/delete_false_positive_rej.py
+            if git ls-files --error-unmatch scripts/delete_false_positive_rej.py > /dev/null 2>&1; then
+                git update-index --chmod=+x scripts/delete_false_positive_rej.py
+            fi
         fi
   - command: |
         for script in .claude/skills/address-pr-comments/check-footer.py .claude/skills/address-pr-comments/fetch-pr-comments.py .claude/skills/address-pr-comments/post-reply.py; do
             if [ -f "$script" ]; then
                 chmod +x "$script"
+                if git ls-files --error-unmatch "$script" > /dev/null 2>&1; then
+                    git update-index --chmod=+x "$script"
+                fi
             fi
         done
   - command: |
 
@@ -12,16 +12,16 @@ class ContextUpdater(ContextHook):
     def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just creating the dict
         self, context: dict[Any, Any]
     ) -> dict[Any, Any]:
-        context["uv_version"] = "0.11.14"
-        context["pnpm_version"] = "11.2.2"
+        context["uv_version"] = "0.11.17"
+        context["pnpm_version"] = "11.5.0"
         context["npm_version"] = "11.13.0"
         context["nvm_version"] = "0.40.4"
         context["pre_commit_version"] = "4.5.1"
         context["pyright_version"] = ">=1.1.409"
         context["pytest_version"] = ">=9.0.3"
         context["pytest_randomly_version"] = ">=4.1.0"
         context["pytest_cov_version"] = ">=7.1.0"
-        context["ty_version"] = ">=0.0.38"
+        context["ty_version"] = ">=0.0.40"
         context["copier_version"] = "==9.15.1"
         context["copier_template_extensions_version"] = "==0.3.3"
         context["sphinx_version"] = "9.0.4"
@@ -37,44 +37,45 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["pyinstaller_version"] = ">=6.20.0"
         context["setuptools_version"] = "80.7.1"
         context["strawberry_graphql_version"] = ">=0.298.0"
-        context["fastapi_version"] = ">=0.136.1"
+        context["fastapi_version"] = ">=0.136.3"
         context["fastapi_offline_version"] = ">=1.7.4"
-        context["uvicorn_version"] = ">=0.47.0"
+        context["uvicorn_version"] = ">=0.48.0"
         context["lab_auto_pulumi_version"] = ">=0.2.0"
         context["ariadne_codegen_version"] = ">=0.18.0"
         context["pytest_mock_version"] = ">=3.15.1"
         context["uuid_utils_version"] = ">=0.16.0"
         context["syrupy_version"] = ">=5.2.0"
         context["structlog_version"] = ">=25.5.0"
         context["httpx_version"] = ">=0.28.1"
-        context["python_kiota_bundle_version"] = ">=1.10.1"
+        context["httpx2_version"] = ">=2.2.0"
+        context["python_kiota_bundle_version"] = ">=1.10.2"
         context["vcrpy_version"] = ">=8.1.1"
         context["pytest_recording_version"] = ">=0.13.4"
-        context["pytest_asyncio_version"] = ">=1.3.0"
+        context["pytest_asyncio_version"] = ">=1.4.0"
+        context["pytest_timeout_version"] = ">=2.4.0"
         context["pytest_reserial_version"] = ">=0.6.1"
         context["python_faker_version"] = ">=40.18.0"
 
         context["default_node_version"] = "24.11.1"
-        context["nuxt_ui_version"] = "^4.7.1"
-        context["nuxt_version"] = "^4.4.5"
+        context["nuxt_ui_version"] = "^4.8.1"
+        context["nuxt_version"] = "^4.4.6"
         context["nuxt_icon_version"] = "^2.2.1"
-        context["typescript_version"] = "^5.9.3"
+        context["typescript_version"] = "^6.0.2"
         context["playwright_version"] = "^1.60.0"
         context["vue_version"] = "^3.5.30"
-        context["vue_tsc_version"] = "^3.3.0"
+        context["vue_tsc_version"] = "^3.3.2"
         context["vue_devtools_api_version"] = "^8.1.0"
-        context["vue_router_version"] = "^5.0.3"
+        context["vue_router_version"] = "^5.1.0"
         context["dotenv_cli_version"] = "^11.0.0"
         context["faker_version"] = "^10.4.0"
-        context["vitest_version"] = "^4.1.6"
+        context["vitest_version"] = "^4.1.7"
         context["vitest_eslint_plugin_version"] = "^1.6.17"
         context["eslint_version"] = "^10.4.0"
         context["nuxt_eslint_version"] = "^1.15.1"
         context["zod_version"] = "^4.3.6"
         context["zod_from_json_schema_version"] = "^0.5.1"
         context["nuxt_apollo_version"] = "5.0.0-alpha.15"
         context["graphql_codegen_cli_version"] = "^6.3.0"
-        context["graphql_codegen_typescript_version"] = "^5.0.7"
         context["graphql_tools_mock_version"] = "^9.1.0"
         context["tailwindcss_version"] = "^4.2.0"
         context["iconify_vue_version"] = "^5.0.0"
@@ -85,7 +86,7 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["nuxt_test_utils_version"] = "^4.0.3"
         context["vue_eslint_parser_version"] = "^10.4.0"
         context["happy_dom_version"] = "^20.9.0"
-        context["node_kiota_bundle_version"] = "1.0.0-preview.100"
+        context["node_kiota_bundle_version"] = "1.0.0-preview.102"
 
         context["gha_checkout"] = "v6.0.2"
         context["gha_setup_python"] = "v6.2.0"
@@ -129,4 +130,5 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         # Kludge to be able to help symlinked jinja files in the child and grandchild templates
         context["template_uses_vuejs"] = False
         context["template_uses_typescript"] = False
+        context["template_uses_python"] = True
         return context
@@ -13,7 +13,12 @@ dependencies = [
     "pytest-cov>=7.1.0",
     "pytest-randomly>=4.1.0",
     "pyright[nodejs]>=1.1.409",
-    "ty>=0.0.38",
+    "ty>=0.0.40",
     "copier==9.15.1",
     "copier-template-extensions==0.3.3"
 ]
+
+[[tool.uv.index]]
+name = "pypi"
+url = "https://pypi.org/simple/"
+exclude-newer = "1 day"