@aayambansal/squint 0.8.1 → 0.9.0

package/dist/{App-HXOPKQKZ.js → App-22JCZNP6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   App
-} from "./chunk-CY34VHDM.js";
-import "./chunk-32I2JTFS.js";
+} from "./chunk-IANXZQ6Z.js";
+import "./chunk-ZPX5FADM.js";
 import "./chunk-YKEAKVIS.js";
 import "./chunk-LNJ7O5O4.js";
-import "./chunk-MG4OPCQO.js";
+import "./chunk-3ZHETLUC.js";
 import "./chunk-UBADCBPT.js";
 import "./chunk-IEQGTVWN.js";
 import "./chunk-AUJJGMZG.js";
@@ -16,10 +16,10 @@ import "./chunk-K5QJMSJH.js";
 import "./chunk-WAJXATCO.js";
 import "./chunk-62JNF5M2.js";
 import "./chunk-7CAGWFAQ.js";
-import "./chunk-ZQRBBX7G.js";
+import "./chunk-4DZAWPS2.js";
 import "./chunk-55JZKI2M.js";
 import "./chunk-HIUQ4FXO.js";
-import "./chunk-DAXGJ57E.js";
+import "./chunk-6RMF4NAW.js";
 export {
   App
 };

package/dist/{cdp-4FWGQ3JR.js → cdp-6YBMFE7M.js}

@@ -6,7 +6,7 @@ import {
   pixelDiffPct,
   runFlow,
   summarizeSoftNav
-} from "./chunk-ZQRBBX7G.js";
+} from "./chunk-4DZAWPS2.js";
 export {
   cdpCapture,
   hasWebSocket,

package/dist/{checks-JNJST4ET.js → checks-GTKPEQ2L.js}

@@ -2,7 +2,7 @@
 import {
   loadChecks,
   runIntervalSweep
-} from "./chunk-DAXGJ57E.js";
+} from "./chunk-6RMF4NAW.js";
 export {
   loadChecks,
   runIntervalSweep

package/dist/{chunk-MG4OPCQO.js → chunk-3ZHETLUC.js}

@@ -5,14 +5,14 @@ import {
 import {
   cdpCapture,
   hasWebSocket
-} from "./chunk-ZQRBBX7G.js";
+} from "./chunk-4DZAWPS2.js";
 import {
   findChrome,
   screenshot
 } from "./chunk-55JZKI2M.js";
 import {
   loadChecks
-} from "./chunk-DAXGJ57E.js";
+} from "./chunk-6RMF4NAW.js";
 
 // src/preview/preview.ts
 import fs from "fs";
@@ -139,13 +139,13 @@ async function probeRuntime(url, cwd) {
 async function comparePulse(previous, current) {
   const chrome = findChrome();
   if (!chrome || !hasWebSocket()) return null;
-  const { pixelDiffPct } = await import("./cdp-4FWGQ3JR.js");
+  const { pixelDiffPct } = await import("./cdp-6YBMFE7M.js");
   return pixelDiffPct(chrome, previous, current);
 }
 async function comparePulseAttributed(previous, current, url, outPath) {
   const chrome = findChrome();
   if (!chrome || !hasWebSocket()) return null;
-  const { pixelDiffAttributed } = await import("./cdp-4FWGQ3JR.js");
+  const { pixelDiffAttributed } = await import("./cdp-6YBMFE7M.js");
   return pixelDiffAttributed(chrome, previous, current, url, outPath);
 }
 function buildRuntimeFixPrompt(report) {

package/dist/{chunk-ZQRBBX7G.js → chunk-4DZAWPS2.js}

@@ -211,10 +211,11 @@ function summarizeSoftNav(entries) {
   });
 }
 async function runFlow(chromePath, baseUrl, flow, outDir) {
-  const { stepExpression } = await import("./flows-3PMJYMDM.js");
+  const { stepExpression } = await import("./flows-4QS2ER6N.js");
   const { child, wsUrl, profileDir } = await launchChrome(chromePath);
   const shots = [];
   let transitions = [];
+  const leaks = [];
   let connection = null;
   try {
     connection = await CdpConnection.connect(wsUrl, 1e4);
@@ -259,7 +260,7 @@ async function runFlow(chromePath, baseUrl, flow, outDir) {
       );
       const value = result?.value;
       if (!value?.ok) {
-        return { ok: false, failedStep: stepNumber, detail: value?.detail ?? "step failed", shots, transitions };
+        return { ok: false, failedStep: stepNumber, detail: value?.detail ?? "step failed", shots, transitions, leaks };
       }
       await new Promise((resolve) => setTimeout(resolve, 300));
     }
@@ -272,9 +273,27 @@ async function runFlow(chromePath, baseUrl, flow, outDir) {
       if (Array.isArray(result?.value)) transitions = summarizeSoftNav(result.value);
     } catch {
     }
-    return { ok: true, shots, transitions };
+    try {
+      const { detachedNodes } = await connection.send("DOM.getDetachedDomNodes", {}, sessionId);
+      const names = /* @__PURE__ */ new Map();
+      let total = 0;
+      for (const retained of detachedNodes ?? []) {
+        const walk = (node) => {
+          total++;
+          const name = (node.nodeName ?? "?").toLowerCase();
+          names.set(name, (names.get(name) ?? 0) + 1);
+        };
+        walk(retained.treeNode ?? retained);
+      }
+      if (total >= 10) {
+        const top = [...names.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([n, c]) => `${n} \xD7${c}`).join(", ");
+        leaks.push(`leak: ${total} detached DOM subtree(s) retained after the journey (${top}) \u2014 something holds references to removed nodes`);
+      }
+    } catch {
+    }
+    return { ok: true, shots, transitions, leaks };
   } catch (err) {
-    return { ok: false, detail: err instanceof Error ? err.message : String(err), shots, transitions };
+    return { ok: false, detail: err instanceof Error ? err.message : String(err), shots, transitions, leaks };
   } finally {
     connection?.close();
     child.kill("SIGKILL");
@@ -800,6 +819,52 @@ var LOCALE_AUDIT = `(async () => {
   }
   return findings;
 })()`;
+var DECEPTION_AUDIT = `(() => {
+  const out = [];
+  const label = (el) => {
+    let s = el.tagName.toLowerCase();
+    if (el.id) s += '#' + el.id; else if (el.classList[0]) s += '.' + el.classList[0];
+    return s;
+  };
+  // 1. Preselected consent
+  for (const box of document.querySelectorAll('input[type="checkbox"]:checked')) {
+    const scope = (box.closest('label') || box.parentElement || box);
+    const text = (scope.textContent || '').slice(0, 160);
+    if (/subscribe|newsletter|marketing|offers|promotions|updates|share my|third.part/i.test(text)) {
+      out.push('deceptive: preselected consent checkbox \u2014 "' + text.trim().slice(0, 60) + '" starts opted in');
+    }
+    if (out.length >= 6) return out;
+  }
+  // 2. Urgency countdowns
+  for (const el of document.querySelectorAll('body *')) {
+    if (el.children.length > 0) continue;
+    const text = (el.textContent || '').trim();
+    if (text.length > 0 && text.length < 80 && /\bd{1,2}:d{2}(:d{2})?\b/.test(text) && /only|hurry|left|expires|ends|limited|last chance/i.test(text)) {
+      out.push('deceptive: urgency countdown on <' + label(el) + '> ("' + text.slice(0, 50) + '") \u2014 verify it is real, not theater');
+      break;
+    }
+  }
+  // 3 + 4. Buried decline / confirmshaming inside consent surfaces
+  for (const surface of document.querySelectorAll('[role="dialog"], [class*="modal"], [class*="cookie"], [class*="consent"], [class*="banner"]')) {
+    const buttons = [...surface.querySelectorAll('button, a, [role="button"]')];
+    const accept = buttons.find((b) => /accept|agree|allow|got it|yes/i.test(b.textContent || ''));
+    const decline = buttons.find((b) => /decline|reject|refuse|no thanks|later|manage/i.test(b.textContent || ''));
+    if (accept && decline) {
+      const ar = accept.getBoundingClientRect(), dr = decline.getBoundingClientRect();
+      const aSize = parseFloat(getComputedStyle(accept).fontSize), dSize = parseFloat(getComputedStyle(decline).fontSize);
+      if ((dr.width * dr.height) < (ar.width * ar.height) * 0.55 || dSize < aSize - 2) {
+        out.push('deceptive: <' + label(decline) + '> is visually buried next to <' + label(accept) + '> \u2014 equal choices deserve equal weight');
+      }
+    }
+    for (const b of buttons) {
+      if (/no thanks,? i (don.?t|hate|prefer)|i don.?t want to (save|improve|protect)/i.test(b.textContent || '')) {
+        out.push('deceptive: confirmshaming copy on <' + label(b) + '> ("' + (b.textContent || '').trim().slice(0, 50) + '")');
+      }
+    }
+    if (out.length >= 6) break;
+  }
+  return out.slice(0, 6);
+})()`;
 async function cdpCapture(chromePath, url, outDir, viewports, settleMs = 2500, audit = false, checks = []) {
   const { child, wsUrl, profileDir } = await launchChrome(chromePath);
   const report = { consoleErrors: [], pageErrors: [], failedRequests: [] };
@@ -971,6 +1036,15 @@ async function cdpCapture(chromePath, url, outDir, viewports, settleMs = 2500, a
         if (Array.isArray(result?.value)) phantoms = result.value.map(String);
       } catch {
       }
+      try {
+        const { result } = await connection.send(
+          "Runtime.evaluate",
+          { expression: DECEPTION_AUDIT, returnByValue: true },
+          sessionId
+        );
+        if (Array.isArray(result?.value)) slop.push(...result.value.map(String));
+      } catch {
+      }
       try {
         const { result } = await connection.send(
           "Runtime.evaluate",

package/dist/{chunk-B7T5DYRM.js → chunk-53DPUAXN.js}

@@ -143,8 +143,8 @@ function stepExpression(step) {
 async function suggestFlows(cwd, baseUrl, chromePath) {
   const fs2 = await import("fs");
   const path2 = await import("path");
-  const { cdpCapture } = await import("./cdp-4FWGQ3JR.js");
-  const { loadRoutes } = await import("./preview-YD27QUDE.js");
+  const { cdpCapture } = await import("./cdp-6YBMFE7M.js");
+  const { loadRoutes } = await import("./preview-UV67QLVI.js");
   const dir = path2.join(cwd, ".squint", "flows");
   fs2.mkdirSync(dir, { recursive: true });
   const created = [];

package/dist/{chunk-DAXGJ57E.js → chunk-6RMF4NAW.js}

@@ -44,7 +44,7 @@ async function runIntervalSweep(cwd, url, lastRun) {
   const chrome = findChrome();
   if (!chrome) return [];
   const os = await import("os");
-  const { cdpCapture } = await import("./cdp-4FWGQ3JR.js");
+  const { cdpCapture } = await import("./cdp-6YBMFE7M.js");
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "squint-interval-"));
   try {
     const result = await cdpCapture(chrome, url, tmp, [], 800, false, due);

package/dist/{chunk-CY34VHDM.js → chunk-IANXZQ6Z.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   Session
-} from "./chunk-32I2JTFS.js";
+} from "./chunk-ZPX5FADM.js";
 import {
   completeCommand
 } from "./chunk-LNJ7O5O4.js";

package/dist/{chunk-ASZUQJPE.js → chunk-RXVMB47Q.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   Session
-} from "./chunk-32I2JTFS.js";
+} from "./chunk-ZPX5FADM.js";
 
 // src/daemon/client.ts
 import net from "net";
@@ -57,7 +57,7 @@ function socketPath(cwd) {
   const hash = crypto.createHash("sha256").update(cwd).digest("hex").slice(0, 12);
   return path.join(os.tmpdir(), `squint-${hash}.sock`);
 }
-function startDaemon(opts) {
+async function startDaemon(opts) {
   const session = new Session(opts);
   const sock = socketPath(opts.cwd);
   fs.mkdirSync(path.dirname(sock), { recursive: true });
@@ -122,7 +122,7 @@ function startDaemon(opts) {
     const state = session.getState();
     if (!state.devUrl || state.running) return;
     try {
-      const { runIntervalSweep } = await import("./checks-JNJST4ET.js");
+      const { runIntervalSweep } = await import("./checks-GTKPEQ2L.js");
       const failures = await runIntervalSweep(opts.cwd, state.devUrl, lastRun);
       if (failures.length > 0) {
         session.note(`\u23F0 interval check(s) failing:
@@ -132,6 +132,54 @@ ${failures.join("\n")}`);
     }
   }, opts.intervalSweepMs ?? 6e4);
   sweep.unref?.();
+  let relayServer = null;
+  let relayUrl;
+  let relayUnsub = null;
+  if (opts.approvalWebhook) {
+    const http = await import("http");
+    const crypto2 = await import("crypto");
+    const tokens = /* @__PURE__ */ new Map();
+    relayServer = http.createServer((req, res) => {
+      const token = (req.url ?? "").replace(/^\//, "");
+      const verdict = tokens.get(token);
+      if (!verdict) {
+        res.writeHead(404).end("unknown or already-used token");
+        return;
+      }
+      tokens.clear();
+      session.command(verdict === "yes" ? "/yes approved via webhook" : "/no rejected via webhook");
+      res.writeHead(200, { "content-type": "text/plain" });
+      res.end(verdict === "yes" ? "approved \u2014 the engine proceeds" : "rejected \u2014 the engine stands down");
+    });
+    await new Promise((resolve) => relayServer?.listen(opts.relayPort ?? 0, "127.0.0.1", resolve));
+    const addr = relayServer.address();
+    relayUrl = `http://127.0.0.1:${addr.port}`;
+    let lastSeen = null;
+    relayUnsub = session.subscribe(() => {
+      const pending = session.getState().pendingApproval;
+      if (!pending || pending === lastSeen) {
+        if (!pending) lastSeen = null;
+        return;
+      }
+      lastSeen = pending;
+      const approve = crypto2.randomBytes(16).toString("hex");
+      const reject = crypto2.randomBytes(16).toString("hex");
+      tokens.clear();
+      tokens.set(approve, "yes");
+      tokens.set(reject, "no");
+      fetch(opts.approvalWebhook, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          text: `squint approval requested: ${pending}`,
+          summary: pending,
+          approveUrl: `${relayUrl}/${approve}`,
+          rejectUrl: `${relayUrl}/${reject}`
+        }),
+        signal: AbortSignal.timeout(5e3)
+      }).catch(() => null);
+    });
+  }
   const unsubscribe = session.subscribe(() => {
     const payload = serialize();
     for (const client of clients) {
@@ -143,9 +191,12 @@ ${failures.join("\n")}`);
     server.listen(sock, () => {
       resolve({
         session,
+        relayUrl,
         clientCount: () => clients.length,
         close: () => {
           clearInterval(sweep);
+          relayUnsub?.();
+          relayServer?.close();
           unsubscribe();
           for (const client of clients) client.destroy();
           server.close();

package/dist/{chunk-32I2JTFS.js → chunk-ZPX5FADM.js}

@@ -12,7 +12,7 @@ import {
   comparePulseAttributed,
   probeRuntime,
   runtimeSummary
-} from "./chunk-MG4OPCQO.js";
+} from "./chunk-3ZHETLUC.js";
 import {
   enrich
 } from "./chunk-UBADCBPT.js";
@@ -117,6 +117,7 @@ var Session = class {
       engineId: opts.engineId,
       model: opts.model,
       devState: "stopped",
+      pendingApproval: null,
       devUrl: null,
       totals: { costUsd: 0, turns: 0 },
       queue: [],
@@ -155,7 +156,6 @@ var Session = class {
   checkpoints = [];
   fixAttempts = 0;
   reviewTipShown = false;
-  pendingApproval = null;
   goal = null;
   laneEnabled = false;
   inLane = false;
@@ -496,7 +496,7 @@ ${question}`,
           const req = JSON.parse(fs2.readFileSync(reqPath, "utf8"));
           fs2.rmSync(reqPath, { force: true });
           if (typeof req?.summary === "string" && req.summary.length > 0) {
-            this.pendingApproval = req.summary;
+            this.notify({ pendingApproval: req.summary });
             const shot = typeof req.screenshot === "string" ? path2.resolve(this.execCwd(), req.screenshot) : null;
             if (shot && fs2.existsSync(shot)) this.push("image", shot);
             this.push("status", `\u23F8 approval requested: ${req.summary}
@@ -812,7 +812,7 @@ squint verifies every turn \u2014 gates, runtime probe, page audits. Do not decl
       this.push("image", pulsePath);
       return null;
     }
-    const { previewDir } = await import("./preview-YD27QUDE.js");
+    const { previewDir } = await import("./preview-UV67QLVI.js");
     const diff = await comparePulseAttributed(
       previous,
       current,
@@ -1069,12 +1069,12 @@ every ask now carries it; auto-fix presses to ${MAX_GOAL_FIX_ATTEMPTS} attempts
       }
       case "yes":
       case "no": {
-        if (!this.pendingApproval) {
+        if (!this.state.pendingApproval) {
           this.push("status", `nothing awaiting approval \u2014 /${name} answers an engine's approval request`);
           break;
         }
-        const summary = this.pendingApproval;
-        this.pendingApproval = null;
+        const summary = this.state.pendingApproval;
+        this.notify({ pendingApproval: null });
         const approved = name === "yes";
         appendDecision(this.opts.cwd, {
           decision: `${approved ? "approved" : "rejected"}: ${summary}${arg ? ` \u2014 ${arg}` : ""}`,
@@ -1190,7 +1190,7 @@ every ask now carries it; auto-fix presses to ${MAX_GOAL_FIX_ATTEMPTS} attempts
               this.push("error", "no Chrome/Chromium found");
               return;
             }
-            const { suggestFlows } = await import("./flows-3PMJYMDM.js");
+            const { suggestFlows } = await import("./flows-4QS2ER6N.js");
             this.push("status", "drafting flows from the live routes\u2026");
             const { created, skipped } = await suggestFlows(this.opts.cwd, this.state.devUrl, chrome);
             if (created.length > 0) this.push("status", `drafted ${created.length} flow(s): ${created.join(", ")} \u2014 edit .squint/flows/*.flow or ask the engine to deepen them`);
@@ -1200,7 +1200,7 @@ every ask now carries it; auto-fix presses to ${MAX_GOAL_FIX_ATTEMPTS} attempts
           break;
         }
         void (async () => {
-          const { loadFlows } = await import("./flows-3PMJYMDM.js");
+          const { loadFlows } = await import("./flows-4QS2ER6N.js");
           const flows = loadFlows(this.opts.cwd);
           if (flows.length === 0) {
             this.push("status", "no flows \u2014 add .squint/flows/<name>.flow (goto/click/fill/press/expect/shot lines), or ask the engine to write one");
@@ -1211,8 +1211,8 @@ every ask now carries it; auto-fix presses to ${MAX_GOAL_FIX_ATTEMPTS} attempts
             this.push("error", "no Chrome/Chromium found for flows");
             return;
           }
-          const { runFlow } = await import("./cdp-4FWGQ3JR.js");
-          const { previewDir } = await import("./preview-YD27QUDE.js");
+          const { runFlow } = await import("./cdp-6YBMFE7M.js");
+          const { previewDir } = await import("./preview-UV67QLVI.js");
           this.push("status", `replaying ${flows.length} flow(s)\u2026`);
           this.notify({ running: true, runStartedAt: Date.now() });
           const failures = [];
@@ -1223,6 +1223,7 @@ every ask now carries it; auto-fix presses to ${MAX_GOAL_FIX_ATTEMPTS} attempts
             if (result.ok) {
               this.push("status", `\u2713 flow ${flow.name} \xB7 ${flow.steps.length} steps${result.shots.length > 0 ? ` \xB7 ${result.shots.length} shot(s)` : ""}`);
               if (result.transitions.length > 0) this.push("status", result.transitions.map((t) => `  ${t}`).join("\n"));
+              if (result.leaks.length > 0) this.push("error", result.leaks.join("\n"));
               for (const shot of result.shots) this.push("image", shot);
             } else {
               const where = result.failedStep ? ` at step ${result.failedStep}` : "";

package/dist/cli.js

@@ -3,14 +3,14 @@ import {
   connectDaemon,
   socketPath,
   startDaemon
-} from "./chunk-ASZUQJPE.js";
+} from "./chunk-RXVMB47Q.js";
 import {
   App
-} from "./chunk-CY34VHDM.js";
-import "./chunk-32I2JTFS.js";
+} from "./chunk-IANXZQ6Z.js";
+import "./chunk-ZPX5FADM.js";
 import "./chunk-YKEAKVIS.js";
 import "./chunk-LNJ7O5O4.js";
-import "./chunk-MG4OPCQO.js";
+import "./chunk-3ZHETLUC.js";
 import "./chunk-UBADCBPT.js";
 import "./chunk-IEQGTVWN.js";
 import "./chunk-AUJJGMZG.js";
@@ -25,13 +25,13 @@ import {
 } from "./chunk-WAJXATCO.js";
 import "./chunk-62JNF5M2.js";
 import "./chunk-7CAGWFAQ.js";
-import "./chunk-ZQRBBX7G.js";
+import "./chunk-4DZAWPS2.js";
 import "./chunk-55JZKI2M.js";
 import {
   detectEngines,
   getEngine
 } from "./chunk-HIUQ4FXO.js";
-import "./chunk-DAXGJ57E.js";
+import "./chunk-6RMF4NAW.js";
 
 // src/cli.tsx
 import { Command } from "commander";
@@ -66,7 +66,9 @@ var ConfigSchema = z.object({
   /** Cheaper model used for auto-fix and /fix turns (mechanical work). */
   fixModel: z.string().optional(),
   /** TUI theme name (amber, ocean, moss, rose, mono). */
-  theme: z.string().optional()
+  theme: z.string().optional(),
+  /** POSTed when an engine requests visual approval under squint serve. */
+  approvalWebhook: z.string().url().optional()
 });
 function defaultPaths(cwd) {
   const xdg = process.env.XDG_CONFIG_HOME;
@@ -114,6 +116,8 @@ function setConfigValue(file, key, value) {
       throw new Error(`"${key}" must be true or false`);
     }
     next = { ...current, [key]: value === "true" };
+  } else if (key === "approvalWebhook") {
+    next = { ...current, approvalWebhook: value };
   } else if (key === "budgetUsd") {
     const budget = Number.parseFloat(value);
     if (!Number.isFinite(budget) || budget <= 0) {
@@ -126,7 +130,7 @@ function setConfigValue(file, key, value) {
     next = { ...current, models: { ...current.models, [engineId]: value } };
   } else {
     throw new Error(
-      `Unknown config key "${key}". Supported: engine, theme, autoDev, autoFix, autoProbe, autoCheck, autoReview, bell, budgetUsd, fixModel, models.<engineId>`
+      `Unknown config key "${key}". Supported: engine, theme, autoDev, autoFix, autoProbe, autoCheck, autoReview, bell, budgetUsd, fixModel, approvalWebhook, models.<engineId>`
     );
   }
   fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -173,6 +177,7 @@ function registerDaemon(program2) {
       autoReview: config.autoReview,
       fixModel: config.fixModel,
       budgetUsd: config.budgetUsd,
+      approvalWebhook: config.approvalWebhook,
       onQuit: () => {
         daemon.close();
         process.exit(0);
@@ -180,6 +185,7 @@ function registerDaemon(program2) {
     });
     console.log(`squint daemon on ${socketPath(cwd)} (engine: ${engineId})`);
     console.log("attach from another terminal with: squint attach");
+    if (daemon.relayUrl) console.log(`approval relay on ${daemon.relayUrl} \u2192 ${config.approvalWebhook}`);
     const stop = () => {
       daemon.close();
       process.exit(0);
@@ -188,18 +194,18 @@ function registerDaemon(program2) {
     process.on("SIGTERM", stop);
   });
   program2.command("mcp").description("serve the gates as MCP tools over stdio (check, shot, flows, context)").action(async () => {
-    const { runMcpServer } = await import("./server-57MLWLK6.js");
+    const { runMcpServer } = await import("./server-IIIH4OZZ.js");
     runMcpServer(process.cwd());
   });
   program2.command("attach").description("attach this terminal to a running squint daemon (full TUI; --plain for line mode)").option("--plain", "line-mode attach instead of the full TUI").action(async (opts) => {
     const cwd = process.cwd();
     if (!opts.plain) {
       try {
-        const { RemoteSession } = await import("./remote-SZPZH5RL.js");
+        const { RemoteSession } = await import("./remote-WHMW4CGK.js");
         const remote = await RemoteSession.connect(cwd);
         const config = loadConfig(defaultPaths(cwd));
         const { render: render2 } = await import("ink");
-        const { App: App2 } = await import("./App-HXOPKQKZ.js");
+        const { App: App2 } = await import("./App-22JCZNP6.js");
         const React = await import("react");
         render2(
           React.createElement(App2, {
@@ -316,7 +322,7 @@ function registerEnv(program2) {
       }
     }
     const { findChrome } = await import("./chrome-BQ4WOCOH.js");
-    const { hasWebSocket } = await import("./cdp-4FWGQ3JR.js");
+    const { hasWebSocket } = await import("./cdp-6YBMFE7M.js");
     const chrome = findChrome();
     console.log(
       chrome ? `${pc3.green("\u2713")} Chrome ${pc3.dim(chrome)}` : `${pc3.yellow("\u25CB")} Chrome ${pc3.dim("\u2014 screenshots and runtime probing disabled")}`
@@ -552,7 +558,7 @@ function registerQuality(program2) {
     report.gates = gateResults.map((r) => ({ id: r.gate.id, ok: r.ok, durationMs: r.durationMs, outputTail: r.ok ? void 0 : r.outputTail }));
     if (gateResults.some((r) => !r.ok)) failed = true;
     if (opts.url) {
-      const { captureViewports, runtimeSummary, previewDir } = await import("./preview-YD27QUDE.js");
+      const { captureViewports, runtimeSummary, previewDir } = await import("./preview-UV67QLVI.js");
       const capture = await captureViewports(cwd, opts.url);
       if (!capture) {
         console.log(pc5.red("\u2717 audit: capture failed (Chrome missing or URL unreachable)"));
@@ -584,14 +590,14 @@ function registerQuality(program2) {
           console.log(`${pc5.green("\u2713")} audit ${pc5.dim(`(${advisories.a11y.length} a11y, ${advisories.slop.length} slop, ${advisories.jank.length} jank advisories)`)}`);
         }
       }
-      const { loadFlows } = await import("./flows-3PMJYMDM.js");
+      const { loadFlows } = await import("./flows-4QS2ER6N.js");
       const flows = loadFlows(cwd);
       if (flows.length > 0) {
         const { findChrome } = await import("./chrome-BQ4WOCOH.js");
         const chrome = findChrome();
         const flowReport = [];
         if (chrome) {
-          const { runFlow } = await import("./cdp-4FWGQ3JR.js");
+          const { runFlow } = await import("./cdp-6YBMFE7M.js");
           for (const flow of flows) {
             const result = await runFlow(chrome, opts.url, flow, previewDir(cwd));
             flowReport.push({ name: flow.name, ok: result.ok, detail: result.ok ? void 0 : `step ${result.failedStep}: ${result.detail}` });
@@ -605,7 +611,7 @@ function registerQuality(program2) {
     report.ok = !failed;
     report.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
-      const { writeReceipt } = await import("./receipts-HN5HGWMT.js");
+      const { writeReceipt } = await import("./receipts-JE6WVFYH.js");
       console.log(pc5.dim(`receipt \u2192 ${writeReceipt(cwd, report)}`));
     } catch {
     }
@@ -617,7 +623,7 @@ function registerQuality(program2) {
     if (failed) process.exitCode = 1;
   });
   program2.command("shot").description("Screenshot a running app at mobile/tablet/desktop viewports (+ .squint/routes)").argument("<url>", "URL of the running app (e.g. http://localhost:5173)").action(async (url) => {
-    const { captureViewports } = await import("./preview-YD27QUDE.js");
+    const { captureViewports } = await import("./preview-UV67QLVI.js");
     const result = await captureViewports(process.cwd(), url);
     if (!result) {
       console.error(pc5.red("\u2717 no Chrome/Chromium found"));
@@ -804,7 +810,7 @@ function registerTui(program2) {
 }
 
 // src/cli.tsx
-var VERSION = true ? "0.8.1" : "0.0.0-dev";
+var VERSION = true ? "0.9.0" : "0.0.0-dev";
 var program = new Command();
 program.name("squint").description("Lovable for your terminal \u2014 a frontend harness on top of Claude Code, Codex, and friends.").version(VERSION);
 registerRun(program);

package/dist/{flows-3PMJYMDM.js → flows-4QS2ER6N.js}

@@ -4,7 +4,7 @@ import {
   parseFlow,
   stepExpression,
   suggestFlows
-} from "./chunk-B7T5DYRM.js";
+} from "./chunk-53DPUAXN.js";
 export {
   loadFlows,
   parseFlow,

package/dist/{preview-YD27QUDE.js → preview-UV67QLVI.js}

@@ -11,12 +11,12 @@ import {
   probeRuntime,
   routeShotName,
   runtimeSummary
-} from "./chunk-MG4OPCQO.js";
+} from "./chunk-3ZHETLUC.js";
 import "./chunk-7CAGWFAQ.js";
-import "./chunk-ZQRBBX7G.js";
+import "./chunk-4DZAWPS2.js";
 import "./chunk-55JZKI2M.js";
 import "./chunk-HIUQ4FXO.js";
-import "./chunk-DAXGJ57E.js";
+import "./chunk-6RMF4NAW.js";
 export {
   VIEWPORTS,
   buildReviewPrompt,

package/dist/{receipts-HN5HGWMT.js → receipts-JE6WVFYH.js}

@@ -31,7 +31,7 @@ function buildReceipt(cwd, report) {
     }
   }
   const unsigned = {
-    version: true ? "0.8.1" : "0.0.0-dev",
+    version: true ? "0.9.0" : "0.0.0-dev",
     node: process.version,
     gitHead,
     report,

package/dist/{remote-SZPZH5RL.js → remote-WHMW4CGK.js}

@@ -2,10 +2,10 @@
 import {
   connectDaemon,
   socketPath
-} from "./chunk-ASZUQJPE.js";
-import "./chunk-32I2JTFS.js";
+} from "./chunk-RXVMB47Q.js";
+import "./chunk-ZPX5FADM.js";
 import "./chunk-YKEAKVIS.js";
-import "./chunk-MG4OPCQO.js";
+import "./chunk-3ZHETLUC.js";
 import "./chunk-UBADCBPT.js";
 import "./chunk-IEQGTVWN.js";
 import "./chunk-AUJJGMZG.js";
@@ -16,10 +16,10 @@ import "./chunk-K5QJMSJH.js";
 import "./chunk-WAJXATCO.js";
 import "./chunk-62JNF5M2.js";
 import "./chunk-7CAGWFAQ.js";
-import "./chunk-ZQRBBX7G.js";
+import "./chunk-4DZAWPS2.js";
 import "./chunk-55JZKI2M.js";
 import "./chunk-HIUQ4FXO.js";
-import "./chunk-DAXGJ57E.js";
+import "./chunk-6RMF4NAW.js";
 
 // src/daemon/remote.ts
 var noteId = 0;
@@ -38,7 +38,8 @@ var RemoteSession = class _RemoteSession {
       queue: [],
       mode: "safe",
       problems: [],
-      sandbox: false
+      sandbox: false,
+      pendingApproval: null
     };
     client.onMessage((msg) => {
       if (msg.type === "state" && msg.state) {

package/dist/{server-57MLWLK6.js → server-IIIH4OZZ.js}

@@ -7,7 +7,7 @@ import {
   captureViewports,
   previewDir,
   runtimeSummary
-} from "./chunk-MG4OPCQO.js";
+} from "./chunk-3ZHETLUC.js";
 import "./chunk-UBADCBPT.js";
 import "./chunk-IEQGTVWN.js";
 import "./chunk-WAJXATCO.js";
@@ -18,13 +18,13 @@ import {
 import "./chunk-7CAGWFAQ.js";
 import {
   loadFlows
-} from "./chunk-B7T5DYRM.js";
-import "./chunk-ZQRBBX7G.js";
+} from "./chunk-53DPUAXN.js";
+import "./chunk-4DZAWPS2.js";
 import {
   findChrome
 } from "./chunk-55JZKI2M.js";
 import "./chunk-HIUQ4FXO.js";
-import "./chunk-DAXGJ57E.js";
+import "./chunk-6RMF4NAW.js";
 
 // src/mcp/server.ts
 import readline from "readline";
@@ -77,13 +77,14 @@ ${list.join("\n")}`);
       if (flows.length === 0) return "no flows declared \u2014 add .squint/flows/<name>.flow";
       const chrome = findChrome();
       if (!chrome) return "no Chrome/Chromium found";
-      const { runFlow } = await import("./cdp-4FWGQ3JR.js");
+      const { runFlow } = await import("./cdp-6YBMFE7M.js");
       const lines = [];
       for (const flow of flows) {
         const result = await runFlow(chrome, url, flow, previewDir(cwd));
         lines.push(
           result.ok ? `\u2713 ${flow.name} (${flow.steps.length} steps)${result.transitions.length > 0 ? `
-${result.transitions.map((t) => `  ${t}`).join("\n")}` : ""}` : `\u2717 ${flow.name} at step ${result.failedStep}: ${result.detail}`
+${result.transitions.map((t) => `  ${t}`).join("\n")}` : ""}${result.leaks.length > 0 ? `
+${result.leaks.map((l) => `  ${l}`).join("\n")}` : ""}` : `\u2717 ${flow.name} at step ${result.failedStep}: ${result.detail}`
         );
       }
       return lines.join("\n");
@@ -96,7 +97,7 @@ ${result.transitions.map((t) => `  ${t}`).join("\n")}` : ""}` : `\u2717 ${flow.n
     async run(args, cwd) {
       const chrome = findChrome();
       if (!chrome) return "no Chrome/Chromium found";
-      const { suggestFlows } = await import("./flows-3PMJYMDM.js");
+      const { suggestFlows } = await import("./flows-4QS2ER6N.js");
       const { created, skipped } = await suggestFlows(cwd, String(args.url ?? ""), chrome);
       return [
         created.length > 0 ? `drafted: ${created.join(", ")}` : "nothing drafted",
@@ -111,7 +112,7 @@ ${result.transitions.map((t) => `  ${t}`).join("\n")}` : ""}` : `\u2717 ${flow.n
     async run(args, cwd) {
       const fs = await import("fs");
       const path = await import("path");
-      const { verifyReceipt } = await import("./receipts-HN5HGWMT.js");
+      const { verifyReceipt } = await import("./receipts-JE6WVFYH.js");
       const file = path.isAbsolute(String(args.path)) ? String(args.path) : path.join(cwd, String(args.path));
       let receipt;
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aayambansal/squint",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Lovable for your terminal \u2014 a frontend harness on top of Claude Code, Codex, and other coding agents.",
   "type": "module",
   "license": "MIT",