@cmetech/otto 1.2.5 → 1.2.6

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-509dc2f42084b696
+4baa0132ee073a5c

package/dist/resources/extensions/coworker-scratchpad/scratchpad-tool.js

@@ -44,17 +44,17 @@ export function registerScratchpadTool(pi, deps) {
     pi.registerTool({
         name: 'cw_scratchpad',
         label: 'Co-worker scratchpad',
-        description: 'USE FOR: loading or analyzing files (CSV, Excel, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
+        description: 'USE FOR: loading or analyzing files (CSV, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
             'DO NOT USE FOR: simple arithmetic, lookups answerable from reasoning alone, pure prose, code review, or one-off calculations with no file or data source involved. ' +
             'IF the user explicitly names this tool ("use cw_scratchpad", "run this in the scratchpad", "exec a cell"), use it regardless of the rules above. ' +
             'IF UNSURE whether a request belongs here, ASK the user once: "Do you want me to run this in cw_scratchpad so you can inspect the cells via /sp view, or answer inline?" Wait for their reply before deciding. ' +
             'Runs TypeScript cells in a persistent JS kernel scoped to a named scratchpad. State persists across cells via globalThis.* and across Otto sessions via on-disk kernel.db + namespace.json. ' +
-            'Pre-bound libs in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
+            'Pre-bound libs in every cell: polars, DuckDB, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
             'Actions: exec (run a TypeScript cell), view (return the last N cells). ' +
             'Distinct from the analyst extension\'s SQL-only `scratchpad` tool — this one runs arbitrary TypeScript.',
-        promptSnippet: 'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/Excel/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
+        promptSnippet: 'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
         promptGuidelines: [
-            'Trigger criteria: the request involves loading a file (CSV/Excel/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
+            'Trigger criteria: the request involves loading a file (CSV/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
             'Skip the tool for: trivial arithmetic, lookups you can answer from reasoning, prose generation, code review, and pure-explanation tasks.',
             'If the user names the tool explicitly (e.g. "use cw_scratchpad", "in the scratchpad", "exec a cell"), always honor that request and skip the unsure-prompt.',
             'IF UNSURE whether a request fits the trigger criteria, ask the user once before deciding: "Do you want me to run this in cw_scratchpad (you can inspect the cells via /sp view) or answer inline?" Wait for the user\'s reply before either calling the tool or answering inline.',
@@ -62,7 +62,7 @@ export function registerScratchpadTool(pi, deps) {
             'The cell body is wrapped in (async () => { ... })(). let/const/var are local to the cell. To persist, assign to globalThis.foo = ...',
             'For DuckDB tables that survive across Otto sessions, use `await otto.duckdb.connect()`. For ephemeral in-memory, use `DuckDB.DuckDBInstance.create(":memory:")`.',
             'For polars→DuckDB: prefer `otto.duckdb.registerDf(name, df)` over manual API discovery. If inference picks the wrong column type, pass `{ schema: { col: \'TYPE\' } }` as the third argument. Falls back to polars\' own SQL (`df.sql(...)`) for one-off aggregations.',
-            'Pre-bound libs available in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. No imports needed.',
+            'Pre-bound libs available in every cell: polars, DuckDB, dateFns, lodash, zod, axios. No imports needed.',
             'Use otto.collectors.list() to discover data sources and otto.collectors.open(uri) to load one.',
             'The `name` parameter defaults to the currently attached scratchpad. Omit it unless you want to operate on a different one (this does NOT switch the user attachment).',
             'A returned string that looks markdown-shaped will appear in the response as text/markdown automatically. Return a markdown table or heading to render it.',

package/dist/resources/extensions/otto/commands/release-notes/_data.js

@@ -9,12 +9,23 @@
 // runtime command surfaces a link when a requested version isn't bundled.
 export const RELEASE_NOTES_MANIFEST = {
     truncated: false,
-    total: 14,
+    total: 15,
     oldestBundled: '1.0.0',
-    newestBundled: '1.2.5',
+    newestBundled: '1.2.6',
     historyUrl: 'https://github.com/cmetech/otto-cli/blob/main/CHANGELOG.md',
 };
 export const RELEASE_NOTES = [
+    {
+        version: '1.2.6',
+        date: '2026-06-03',
+        headline: 'Second Windows-install hotfix on top of 1.2.5: better-sqlite3 native install no longer requires Visual Studio on Node 24, and the entire exceljs transitive-dep chain (glob@7 / inflight / rimraf@2 / fstream / lodash.isequal) is removed at the source by dropping the library itself.',
+        fixed: [
+            '**`better-sqlite3` install fails on Windows + Node 24** with `gyp ERR! find VS / Could not find any Visual Studio installation to use`. The pinned `^11.7.0` from 1.2.5 has no prebuilt binary for `NODE_MODULE_VERSION 137` (Node 24), so npm fell through to `node-gyp rebuild`, which requires a C++ toolchain. Bumped to `^12.10.0` in both root `dependencies` and `packages/coworker-memory/package.json`; v12.10.0 ships a `v137-win32-x64` prebuild that installs cleanly.',
+        ],
+        changed: [
+            '**`exceljs@4.4.0` dropped from the scratchpad data-lib bindings.** Upstream is dormant (last commit Jan 2024) and the package\'s transitive deps generate eight `npm warn deprecated` messages on every install — `glob@7.2.3` (CVE), `inflight@1.0.6` (memory leak), `rimraf@2.7.1`, `fstream@1.0.12`, `lodash.isequal@4.5.0`, plus old `uuid@8/9` chains. Removed from `package.json`, `packages/coworker-scratchpad/src/kernel-bindings.ts` import + spread, `kernel-entry.ts` binding-names list, and both test files; the LLM-facing tool description in `src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts` no longer claims `ExcelJS` as a pre-bound lib. Cell code that depended on `new ExcelJS.Workbook()` now throws `ReferenceError`. xlsx-capability replacement (likely `xlsx-populate@1.21.0`) is tracked in `docs/superpowers/notes/2026-06-01-coworker-roadmap.md` § Out-of-scope.',
+        ],
+    },
     {
         version: '1.2.5',
         date: '2026-06-03',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmetech/otto",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Terminal-based developer chat assistant. Permanent hard fork of gsd-pi with LangFlow flow triggers, a flow builder, and optional gateway routing for compliance environments.",
   "keywords": [
     "ai",
@@ -156,13 +156,12 @@
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "axios": "^1.16.1",
-    "better-sqlite3": "^11.7.0",
+    "better-sqlite3": "^12.10.0",
     "chalk": "^5.6.2",
     "chokidar": "^5.0.0",
     "date-fns": "^4.4.0",
     "diff": "^8.0.2",
     "echarts": "^5.6.0",
-    "exceljs": "^4.4.0",
     "extract-zip": "^2.0.1",
     "file-type": "^21.1.1",
     "glob": "^13.0.1",
@@ -197,11 +196,11 @@
   },
   "optionalDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.83",
-    "@cmetech/otto-engine-darwin-arm64": "1.2.5",
-    "@cmetech/otto-engine-darwin-x64": "1.2.5",
-    "@cmetech/otto-engine-linux-arm64-gnu": "1.2.5",
-    "@cmetech/otto-engine-linux-x64-gnu": "1.2.5",
-    "@cmetech/otto-engine-win32-x64-msvc": "1.2.5",
+    "@cmetech/otto-engine-darwin-arm64": "1.2.6",
+    "@cmetech/otto-engine-darwin-x64": "1.2.6",
+    "@cmetech/otto-engine-linux-arm64-gnu": "1.2.6",
+    "@cmetech/otto-engine-linux-x64-gnu": "1.2.6",
+    "@cmetech/otto-engine-win32-x64-msvc": "1.2.6",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/contracts",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Shared public contracts for OTTO workspace boundaries",
   "license": "MIT",
   "otto": {

package/packages/coworker-memory/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@otto/coworker-utils": "*",
-    "better-sqlite3": "^11.7.0",
+    "better-sqlite3": "^12.10.0",
     "uuid": "^11.0.0",
     "yaml": "^2.8.2"
   },

package/packages/coworker-scratchpad/dist/kernel-bindings.d.ts

@@ -3,6 +3,11 @@ import { type AuditLog } from '@otto/coworker-utils';
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export declare function buildDataLibBindings(): Record<string, unknown>;
 /** SQL column type string passed straight into CREATE TABLE (e.g. VARCHAR, BIGINT). */

package/packages/coworker-scratchpad/dist/kernel-bindings.js

@@ -1,5 +1,4 @@
 import pl from 'nodejs-polars';
-import ExcelJS from 'exceljs';
 import lodash from 'lodash';
 import axios from 'axios';
 import { z } from 'zod';
@@ -9,12 +8,16 @@ import { SecretScanner } from '@otto/coworker-utils';
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export function buildDataLibBindings() {
     return {
         polars: pl,
         DuckDB,
-        ExcelJS,
         dateFns,
         lodash,
         zod: z,

package/packages/coworker-scratchpad/dist/kernel-entry.js

@@ -22,7 +22,6 @@ const KNOWN_BOUND_KEYS = new Set([
     'clearInterval',
     'polars',
     'DuckDB',
-    'ExcelJS',
     'dateFns',
     'lodash',
     'zod',

package/packages/coworker-scratchpad/src/child-process-runtime.test.ts

@@ -160,14 +160,13 @@ describe('data-lib bindings inside a live kernel', () => {
     await rm(ws, { recursive: true, force: true });
   });
 
-  it('polars / lodash / zod / date-fns / exceljs / axios / DuckDB are bound', async () => {
+  it('polars / lodash / zod / date-fns / axios / DuckDB are bound', async () => {
     rt = new ChildProcessRuntime({ workspace: ws, inactivityTimeoutMs: 20_000, cellTimeoutMs: 20_000 });
     await rt.start();
     assert.equal((await rt.runCell('return polars.DataFrame({ a: [1, 2, 3] }).height;')).value, 3);
     assert.equal((await rt.runCell('return lodash.chunk([1, 2, 3, 4], 2).length;')).value, 2);
     assert.equal((await rt.runCell('return zod.string().parse("hi");')).value, 'hi');
     assert.equal((await rt.runCell('return dateFns.format(new Date(1970, 0, 1), "yyyy");')).value, '1970');
-    assert.equal((await rt.runCell('const wb = new ExcelJS.Workbook(); wb.addWorksheet("s"); const buf = await wb.xlsx.writeBuffer(); return buf.byteLength > 0;')).value, true);
     assert.equal((await rt.runCell('return typeof axios.get;')).value, 'function');
     assert.equal((await rt.runCell('return typeof DuckDB.DuckDBInstance;')).value, 'function');
   });

package/packages/coworker-scratchpad/src/kernel-bindings.test.ts

@@ -9,9 +9,9 @@ import { buildDataLibBindings, redactForJournal } from './kernel-bindings.js';
 import { ChildProcessRuntime } from './child-process-runtime.js';
 
 describe('kernel-bindings', () => {
-  it('exposes all seven pre-bound data libraries', () => {
+  it('exposes all six pre-bound data libraries', () => {
     const b = buildDataLibBindings();
-    for (const key of ['polars', 'DuckDB', 'ExcelJS', 'dateFns', 'lodash', 'zod', 'axios']) {
+    for (const key of ['polars', 'DuckDB', 'dateFns', 'lodash', 'zod', 'axios']) {
       assert.ok(key in b, `missing binding: ${key}`);
       assert.notEqual(b[key], undefined, `binding is undefined: ${key}`);
     }
@@ -24,7 +24,6 @@ describe('kernel-bindings', () => {
     assert.equal(typeof b.dateFns.format, 'function');
     assert.equal(typeof b.lodash.chunk, 'function');
     assert.equal(typeof b.axios.get, 'function');
-    assert.equal(typeof b.ExcelJS.Workbook, 'function');
   });
 });
 

package/packages/coworker-scratchpad/src/kernel-bindings.ts

@@ -1,5 +1,4 @@
 import pl from 'nodejs-polars';
-import ExcelJS from 'exceljs';
 import lodash from 'lodash';
 import axios from 'axios';
 import { z } from 'zod';
@@ -11,12 +10,16 @@ import { SecretScanner, type AuditLog, type AuditRecord } from '@otto/coworker-u
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export function buildDataLibBindings(): Record<string, unknown> {
   return {
     polars: pl,
     DuckDB,
-    ExcelJS,
     dateFns,
     lodash,
     zod: z,

package/packages/coworker-scratchpad/src/kernel-entry.ts

@@ -38,7 +38,6 @@ const KNOWN_BOUND_KEYS = new Set([
   'clearInterval',
   'polars',
   'DuckDB',
-  'ExcelJS',
   'dateFns',
   'lodash',
   'zod',

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/daemon",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "OTTO daemon — background process for project monitoring and Discord integration",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@otto-build/contracts": "^1.2.5",
-    "@otto-build/rpc-client": "^1.2.5",
+    "@otto-build/contracts": "^1.2.6",
+    "@otto-build/rpc-client": "^1.2.6",
     "discord.js": "^14.25.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.0"

package/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/mcp-server",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "MCP server exposing OTTO orchestration tools for compatible clients",
   "license": "MIT",
   "otto": {
@@ -34,8 +34,8 @@
     "test": "npm run build:test && node --test dist/mcp-server.test.js dist/remote-questions.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.5",
-    "@otto-build/rpc-client": "^1.2.5",
+    "@otto-build/contracts": "^1.2.6",
+    "@otto-build/rpc-client": "^1.2.6",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },

package/packages/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/native",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Native Rust bindings for OTTO — high-performance native modules via N-API",
   "type": "commonjs",
   "otto": {

package/packages/pi-agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-agent-core",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "General-purpose agent core (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-ai",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Unified LLM API (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-coding-agent",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "otto": {
@@ -28,7 +28,7 @@
     "copy-assets": "node scripts/copy-assets.cjs"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.5",
+    "@otto-build/contracts": "^1.2.6",
     "@mariozechner/jiti": "^2.6.2",
     "@silvia-odwyer/photon-node": "^0.3.4",
     "chalk": "^5.5.0",

package/packages/pi-tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-tui",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Terminal User Interface library (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/rpc-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/rpc-client",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Standalone RPC client SDK for OTTO — zero internal dependencies",
   "license": "MIT",
   "otto": {
@@ -34,7 +34,7 @@
     "test": "node --test dist/rpc-client.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.5"
+    "@otto-build/contracts": "^1.2.6"
   },
   "engines": {
     "node": ">=22.0.0"

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loop24/client",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "piConfig": {
     "_comment": "AUTO-SYNCED from root package.json by scripts/sync-piconfig.mjs (runs on prebuild). Do not edit this block directly — edit root package.json and re-run `npm run build` or `npm run sync-piconfig`.",
     "name": "otto",

package/src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts

@@ -90,18 +90,18 @@ export function registerScratchpadTool(pi: ExtensionAPI, deps: ScratchpadToolDep
     name: 'cw_scratchpad',
     label: 'Co-worker scratchpad',
     description:
-      'USE FOR: loading or analyzing files (CSV, Excel, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
+      'USE FOR: loading or analyzing files (CSV, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
       'DO NOT USE FOR: simple arithmetic, lookups answerable from reasoning alone, pure prose, code review, or one-off calculations with no file or data source involved. ' +
       'IF the user explicitly names this tool ("use cw_scratchpad", "run this in the scratchpad", "exec a cell"), use it regardless of the rules above. ' +
       'IF UNSURE whether a request belongs here, ASK the user once: "Do you want me to run this in cw_scratchpad so you can inspect the cells via /sp view, or answer inline?" Wait for their reply before deciding. ' +
       'Runs TypeScript cells in a persistent JS kernel scoped to a named scratchpad. State persists across cells via globalThis.* and across Otto sessions via on-disk kernel.db + namespace.json. ' +
-      'Pre-bound libs in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
+      'Pre-bound libs in every cell: polars, DuckDB, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
       'Actions: exec (run a TypeScript cell), view (return the last N cells). ' +
       'Distinct from the analyst extension\'s SQL-only `scratchpad` tool — this one runs arbitrary TypeScript.',
     promptSnippet:
-      'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/Excel/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
+      'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
     promptGuidelines: [
-      'Trigger criteria: the request involves loading a file (CSV/Excel/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
+      'Trigger criteria: the request involves loading a file (CSV/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
       'Skip the tool for: trivial arithmetic, lookups you can answer from reasoning, prose generation, code review, and pure-explanation tasks.',
       'If the user names the tool explicitly (e.g. "use cw_scratchpad", "in the scratchpad", "exec a cell"), always honor that request and skip the unsure-prompt.',
       'IF UNSURE whether a request fits the trigger criteria, ask the user once before deciding: "Do you want me to run this in cw_scratchpad (you can inspect the cells via /sp view) or answer inline?" Wait for the user\'s reply before either calling the tool or answering inline.',
@@ -109,7 +109,7 @@ export function registerScratchpadTool(pi: ExtensionAPI, deps: ScratchpadToolDep
       'The cell body is wrapped in (async () => { ... })(). let/const/var are local to the cell. To persist, assign to globalThis.foo = ...',
       'For DuckDB tables that survive across Otto sessions, use `await otto.duckdb.connect()`. For ephemeral in-memory, use `DuckDB.DuckDBInstance.create(":memory:")`.',
       'For polars→DuckDB: prefer `otto.duckdb.registerDf(name, df)` over manual API discovery. If inference picks the wrong column type, pass `{ schema: { col: \'TYPE\' } }` as the third argument. Falls back to polars\' own SQL (`df.sql(...)`) for one-off aggregations.',
-      'Pre-bound libs available in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. No imports needed.',
+      'Pre-bound libs available in every cell: polars, DuckDB, dateFns, lodash, zod, axios. No imports needed.',
       'Use otto.collectors.list() to discover data sources and otto.collectors.open(uri) to load one.',
       'The `name` parameter defaults to the currently attached scratchpad. Omit it unless you want to operate on a different one (this does NOT switch the user attachment).',
       'A returned string that looks markdown-shaped will appear in the response as text/markdown automatically. Return a markdown table or heading to render it.',

package/src/resources/extensions/otto/commands/release-notes/_data.ts

@@ -33,13 +33,24 @@ export interface ReleaseNotesManifest {
 
 export const RELEASE_NOTES_MANIFEST: ReleaseNotesManifest = {
 	truncated: false,
-	total: 14,
+	total: 15,
 	oldestBundled: '1.0.0',
-	newestBundled: '1.2.5',
+	newestBundled: '1.2.6',
 	historyUrl: 'https://github.com/cmetech/otto-cli/blob/main/CHANGELOG.md',
 };
 
 export const RELEASE_NOTES: ReleaseNote[] = [
+	{
+		version: '1.2.6',
+		date: '2026-06-03',
+		headline: 'Second Windows-install hotfix on top of 1.2.5: better-sqlite3 native install no longer requires Visual Studio on Node 24, and the entire exceljs transitive-dep chain (glob@7 / inflight / rimraf@2 / fstream / lodash.isequal) is removed at the source by dropping the library itself.',
+		fixed: [
+			'**`better-sqlite3` install fails on Windows + Node 24** with `gyp ERR! find VS / Could not find any Visual Studio installation to use`. The pinned `^11.7.0` from 1.2.5 has no prebuilt binary for `NODE_MODULE_VERSION 137` (Node 24), so npm fell through to `node-gyp rebuild`, which requires a C++ toolchain. Bumped to `^12.10.0` in both root `dependencies` and `packages/coworker-memory/package.json`; v12.10.0 ships a `v137-win32-x64` prebuild that installs cleanly.',
+		],
+		changed: [
+			'**`exceljs@4.4.0` dropped from the scratchpad data-lib bindings.** Upstream is dormant (last commit Jan 2024) and the package\'s transitive deps generate eight `npm warn deprecated` messages on every install — `glob@7.2.3` (CVE), `inflight@1.0.6` (memory leak), `rimraf@2.7.1`, `fstream@1.0.12`, `lodash.isequal@4.5.0`, plus old `uuid@8/9` chains. Removed from `package.json`, `packages/coworker-scratchpad/src/kernel-bindings.ts` import + spread, `kernel-entry.ts` binding-names list, and both test files; the LLM-facing tool description in `src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts` no longer claims `ExcelJS` as a pre-bound lib. Cell code that depended on `new ExcelJS.Workbook()` now throws `ReferenceError`. xlsx-capability replacement (likely `xlsx-populate@1.21.0`) is tracked in `docs/superpowers/notes/2026-06-01-coworker-roadmap.md` § Out-of-scope.',
+		],
+	},
 	{
 		version: '1.2.5',
 		date: '2026-06-03',