@cmetech/otto 1.3.0 → 1.3.1

package/node_modules/xlsx/xlsxworker.js

@@ -0,0 +1,14 @@
+/* xlsx.js (C) 2013-present SheetJS -- http://sheetjs.com */
+importScripts('dist/shim.min.js');
+/* uncomment the next line for encoding support */
+importScripts('dist/cpexcel.js');
+importScripts('xlsx.js');
+postMessage({t:"ready"});
+
+onmessage = function (evt) {
+  var v;
+  try {
+    v = XLSX.read(evt.data.d, {type: evt.data.b, codepage: evt.data.c});
+postMessage({t:"xlsx", d:JSON.stringify(v)});
+  } catch(e) { postMessage({t:"e",d:e.stack||e}); }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmetech/otto",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Terminal-based developer chat assistant. Permanent hard fork of gsd-pi with LangFlow flow triggers, a flow builder, and optional gateway routing for compliance environments.",
   "keywords": [
     "ai",
@@ -30,6 +30,9 @@
   "bin": {
     "otto": "dist/loader.js"
   },
+  "bundleDependencies": [
+    "xlsx"
+  ],
   "files": [
     "dist",
     "packages",
@@ -199,11 +202,11 @@
   },
   "optionalDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.83",
-    "@cmetech/otto-engine-darwin-arm64": "1.3.0",
-    "@cmetech/otto-engine-darwin-x64": "1.3.0",
-    "@cmetech/otto-engine-linux-arm64-gnu": "1.3.0",
-    "@cmetech/otto-engine-linux-x64-gnu": "1.3.0",
-    "@cmetech/otto-engine-win32-x64-msvc": "1.3.0",
+    "@cmetech/otto-engine-darwin-arm64": "1.3.1",
+    "@cmetech/otto-engine-darwin-x64": "1.3.1",
+    "@cmetech/otto-engine-linux-arm64-gnu": "1.3.1",
+    "@cmetech/otto-engine-linux-x64-gnu": "1.3.1",
+    "@cmetech/otto-engine-win32-x64-msvc": "1.3.1",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/contracts",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Shared public contracts for OTTO workspace boundaries",
   "license": "MIT",
   "otto": {

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/daemon",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "OTTO daemon — background process for project monitoring and Discord integration",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@otto-build/contracts": "^1.3.0",
-    "@otto-build/rpc-client": "^1.3.0",
+    "@otto-build/contracts": "^1.3.1",
+    "@otto-build/rpc-client": "^1.3.1",
     "discord.js": "^14.25.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.0"

package/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/mcp-server",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "MCP server exposing OTTO orchestration tools for compatible clients",
   "license": "MIT",
   "otto": {
@@ -34,8 +34,8 @@
     "test": "npm run build:test && node --test dist/mcp-server.test.js dist/remote-questions.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.3.0",
-    "@otto-build/rpc-client": "^1.3.0",
+    "@otto-build/contracts": "^1.3.1",
+    "@otto-build/rpc-client": "^1.3.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },

package/packages/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/native",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Native Rust bindings for OTTO — high-performance native modules via N-API",
   "type": "commonjs",
   "otto": {

package/packages/pi-agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-agent-core",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "General-purpose agent core (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-ai",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Unified LLM API (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-coding-agent",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "otto": {
@@ -28,7 +28,7 @@
     "copy-assets": "node scripts/copy-assets.cjs"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.3.0",
+    "@otto-build/contracts": "^1.3.1",
     "@mariozechner/jiti": "^2.6.2",
     "@silvia-odwyer/photon-node": "^0.3.4",
     "chalk": "^5.5.0",

package/packages/pi-tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-tui",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Terminal User Interface library (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/rpc-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/rpc-client",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Standalone RPC client SDK for OTTO — zero internal dependencies",
   "license": "MIT",
   "otto": {
@@ -34,7 +34,7 @@
     "test": "node --test dist/rpc-client.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.3.0"
+    "@otto-build/contracts": "^1.3.1"
   },
   "engines": {
     "node": ">=22.0.0"

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loop24/client",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "piConfig": {
     "_comment": "AUTO-SYNCED from root package.json by scripts/sync-piconfig.mjs (runs on prebuild). Do not edit this block directly — edit root package.json and re-run `npm run build` or `npm run sync-piconfig`.",
     "name": "otto",

package/src/resources/extensions/otto/commands/release-notes/_data.ts

@@ -33,13 +33,21 @@ export interface ReleaseNotesManifest {
 
 export const RELEASE_NOTES_MANIFEST: ReleaseNotesManifest = {
 	truncated: false,
-	total: 16,
+	total: 17,
 	oldestBundled: '1.0.0',
-	newestBundled: '1.3.0',
+	newestBundled: '1.3.1',
 	historyUrl: 'https://github.com/cmetech/otto-cli/blob/main/CHANGELOG.md',
 };
 
 export const RELEASE_NOTES: ReleaseNote[] = [
+	{
+		version: '1.3.1',
+		date: '2026-06-04',
+		headline: 'Windows-install hotfix on top of 1.3.0: the vendored xlsx tarball now ships pre-extracted via `bundleDependencies`, working around an npm bug that prevented `file:` deps in published global packages from resolving on Windows.',
+		fixed: [
+			'**`npm i -g @cmetech/otto@1.3.0` failed on Windows** with `npm warn tarball … seems to be corrupted` followed by `ENOENT … \\vendor\\xlsx-0.20.3.tgz`. Root cause: npm\'s `file:` protocol resolution for deps inside a globally-installed published package is broken on Windows — the inner tarball never gets read even though it ships correctly inside the outer `@cmetech/otto` tarball (byte-identical SHA-256 verified). Switched from `file:`-based vendoring to `bundleDependencies: ["xlsx"]`, which ships the pre-extracted `node_modules/xlsx/` directory (26 files) directly inside the published `@cmetech/otto` tarball. End-user installs no longer go through the `file:` resolver — npm sees `xlsx` already populated in `node_modules` and skips dep resolution entirely. The `file:vendor/xlsx-0.20.3.tgz` dep spec is preserved so local dev installs still work; the SHA-drift guard test and prepublish verifier are unchanged. SheetJS is pure JavaScript (`os: any`, `cpu: any`, no native bindings) so one bundled copy works on Windows / Linux / macOS.',
+		],
+	},
 	{
 		version: '1.3.0',
 		date: '2026-06-03',