@autono/pinbox-toolbar 0.17.0 → 0.19.0

package/README.md

@@ -33,7 +33,7 @@ Both plugin files are **guest-rule code** (`AGENTS.md`): they are evaluated insi
 
 - **Realtime** — `src/transport.ts` speaks the frozen WS protocol (`hello → catch-up → events`) against `GET /ws`, authenticating at upgrade only via the `pinbox.token.<token>` subprotocol, because a browser cannot set headers on an upgrade. It reconnects with jittered 1s→30s backoff and replays from its persisted cursor, so a dropped socket costs no events. Either side of an excluding protocol window closes `4400` with a clear upgrade message; a bad token closes `4401`.
 - **Offline mirror** — `src/transport/mirror.ts` keeps the cursor, the last-known pin list, and an outbox of pins drawn while offline in `localStorage`, namespaced per endpoint. Reconnect reconciles on one rule: **the hub wins on status, the client wins on new pins**. Storage writes never throw upward — private mode or a full quota degrades the mirror, never the toolbar.
-- **Attachments** — screenshots are cropped and webp-encoded **in the browser** (`createImageBitmap` → `OffscreenCanvas` → `convertToBlob`), POSTed to `/attachments`, and the pin then carries the returned **path — never bytes**. Capture is best-effort by design: with no `html2canvas`-class dependency allowed, `src/screenshot.ts` resolves `null` wherever the environment cannot capture, and the pin ships with structured capture alone.
+- **Attachments** — two capture modes, both webp-encoded **in the browser** and POSTed to `/attachments`; the pin then carries the returned **path — never bytes**. The default is a DOM snapshot of the pinned element (`src/screenshot-dom.ts`: clone, inline computed styles, SVG `foreignObject` → canvas; no permission prompt, images become neutral boxes). Tab capture (`src/screenshot.ts`, `getDisplayMedia` → `createImageBitmap` → `OffscreenCanvas`) is opt-in from the bar's camera button and prompts once per page load. Capture is best-effort and bounded (4 s): wherever the environment cannot capture, the pin ships with structured capture alone.
 
 The toolbar's copies of the `ws-protocol.ts` wire constants are mirrored, not imported (core is a **type-only** dependency here — that is what keeps the runtime zero-dependency, and fallow's `allowTypeOnly` enforces it). `e2e/toolbar.test.ts` drives this transport against a real `pinbox serve`, so drift between the two copies fails the build.
 
@@ -41,4 +41,4 @@ The toolbar's copies of the `ws-protocol.ts` wire constants are mirrored, not im
 
 **This package deliberately declares no `engines` field, and must not gain one.** It is the sole exception to the repo-wide `"engines": { "bun": ">=1.3.0" }` rule. The toolbar is browser code: Bun builds it here, but consumers install it into their own toolchain — a Vite/React app on npm under Node, most often. Declaring a Bun engine would make those installs warn, and refuse outright under `engine-strict`, for a package that never executes on a server runtime at all.
 
-Key behaviors (see spec): targeting adapters (`dom` hit-testing | `anchor` attributes for sandboxed-iframe hosts), move pins with before/after rects, live status badges over WS with the accept/reopen verification step, localStorage offline mirror with reconnect reconciliation, copy-as-markdown fallback, `Pinbox.init({ getToken })` auth passthrough — the toolbar never renders a login.
+Key behaviors (see spec): targeting adapters (`dom` hit-testing | `anchor` attributes for sandboxed-iframe hosts), a viewport-space overlay re-laid out per frame so pins hold their element through scrolling, sticky headers and inner scroll containers, two pin kinds on the draft (Ask agent / Note — a `comment` pin is never routed to an agent), pending stages (THINKING → WAITING FOR AGENT → NO RESPONSE with Nudge), resolve/unresolve from the inbox with PR-linked pins grouped, one action table behind the bar, the puck's fan menu and the keyboard (capture-phase, modifier-safe, `shortcuts` config), a draggable bar and puck, live status badges over WS with the accept/reopen verification step, localStorage offline mirror with reconnect reconciliation, copy-as-markdown fallback, `Pinbox.init({ getToken })` auth passthrough — the toolbar never renders a login.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autono/pinbox-toolbar",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -71,7 +71,7 @@
     }
   },
   "devDependencies": {
-    "@autono/pinbox-core": "0.17.0",
+    "@autono/pinbox-core": "0.19.0",
     "@types/react": "^19.2.0",
     "typescript": "^7.0.0",
     "tsdown": "^0.22.0",