@forwardimpact/outpost 3.8.1 → 3.10.0

package/templates/.claude/skills/deck-create/SKILL.md

@@ -32,18 +32,18 @@ Run when the user asks to create a presentation, slide deck, or pitch deck.
 
 ## Workflow
 
-1.  Check `Knowledge/` for relevant context about the company, product, team,
-    etc.
-2.  Ensure Playwright is installed:
-    `bun install playwright && bunx playwright install chromium`
-3.  Create an HTML file at `/tmp/outpost-presentation.html` with slides
-    (1280x720px each)
-4.  Include the required CSS from [references/slide.css](references/slide.css)
-5.  Run the conversion script:
+1. Check `Knowledge/` for relevant context about the company, product, team,
+   etc.
+2. Ensure Playwright is installed:
+   `bun install playwright && bunx playwright install chromium`
+3. Create an HTML file at `/tmp/outpost-presentation.html` with slides
+   (1280x720px each)
+4. Include the required CSS from [references/slide.css](references/slide.css)
+5. Run the conversion script:
 
         node scripts/convert-to-pdf.mjs
 
-6.  Tell the user: "Your presentation is ready at ~/Desktop/presentation.pdf"
+6. Tell the user: "Your presentation is ready at ~/Desktop/presentation.pdf"
 
 **Do NOT show HTML code to the user. Just create the PDF and deliver it.**
 
@@ -82,28 +82,29 @@ selecting/copying text on a slide, and typing into overlay tools (e.g. the
 2. **No click-to-advance.** Do NOT add click regions on the slide/stage that
    navigate (e.g. "click left/right third"). They fire on the mouse-up that ends
    a text-selection drag and jump the slide unexpectedly.
-3. **No spacebar, PageUp/PageDown, or other global key bindings.** Space conflicts
-   with typing in overlay inputs; the rest are redundant and surprising.
-4. **A progress indicator may be clickable**, but it must live in the footer/chrome
-   and never overlap slide content.
+3. **No spacebar, PageUp/PageDown, or other global key bindings.** Space
+   conflicts with typing in overlay inputs; the rest are redundant and
+   surprising.
+4. **A progress indicator may be clickable**, but it must live in the
+   footer/chrome and never overlap slide content.
 5. **Expose `window.deckGoto(index)`** (0-based) right after the slide-show
-   function, so review/overlay tools can jump to a slide without simulating clicks
-   or keys:
+   function, so review/overlay tools can jump to a slide without simulating
+   clicks or keys:
 
         function go(n) { /* ...show slide n... */ }
         window.deckGoto = go;
 
-6. **Keep the hint honest** — the on-screen nav hint should read `← → to navigate`
-   (don't advertise click/space).
+6. **Keep the hint honest** — the on-screen nav hint should read
+   `← → to navigate` (don't advertise click/space).
 7. **Use stable structural hooks.** Make each slide one element with class
    `.slide`, and put the slide-number label (if any) in a `.slide-num` element.
    The review overlay defaults to these selectors to detect and index slides.
 
-These rules keep decks compatible with the **`deck-review`** skill, which installs
-the `slide-annotator.js` review overlay (highlight text on a slide → sidecar JSON
-of feedback that an agent acts on). After producing an interactive HTML deck, you
-can offer to run `deck-review` to make it reviewable; see that skill for the
-install steps and the sidecar JSON schema.
+These rules keep decks compatible with the **`deck-review`** skill, which
+installs the `slide-annotator.js` review overlay (highlight text on a slide →
+sidecar JSON of feedback that an agent acts on). After producing an interactive
+HTML deck, you can offer to run `deck-review` to make it reviewable; see that
+skill for the install steps and the sidecar JSON schema.
 
 ## Constraints
 

package/templates/.claude/skills/deck-review/SKILL.md

@@ -8,9 +8,10 @@ compatibility: Standalone HTML deck opened in a Chromium-based browser (Chrome/E
 
 Install the self-contained `slide-annotator.js` overlay onto an HTML deck so the
 user can **highlight text on a slide and save the feedback as a sidecar JSON**.
-Each annotation carries a robust anchor (exact text + surrounding context + slide)
-and, once the folder is connected, the resolved **source line, column and context
-lines** — so an agent can locate and edit the exact text in small iterations.
+Each annotation carries a robust anchor (exact text + surrounding context +
+slide) and, once the folder is connected, the resolved
+**source line, column and context lines** — so an agent can locate and edit the
+exact text in small iterations.
 
 This is the companion to **`deck-create`**: decks produced by `deck-create`
 already follow the navigation/structure standards this overlay needs, and this
@@ -19,8 +20,8 @@ overlay is designed to drop onto them with one script tag.
 ## Trigger
 
 Run when the user asks to add review / annotation / highlight / comment / markup
-capability to a deck, "make this deck reviewable", or to set up a feedback loop on
-slides.
+capability to a deck, "make this deck reviewable", or to set up a feedback loop
+on slides.
 
 ## Inputs
 
@@ -46,10 +47,10 @@ slides.
    - **Slide selector** — each slide is one element with a stable class
      (default `.slide`). If the deck uses a different class, note it for step 4.
    - **Navigation hook** — the deck exposes `window.deckGoto(index)` (0-based).
-     If it has a slideshow function (e.g. `go(n)`) but no hook, add one line right
-     after it: `window.deckGoto = go;`. Without it the overlay still works (the
-     panel's *Go* button falls back to `scrollIntoView`), but it can't jump to a
-     hidden slide precisely.
+     If it has a slideshow function (e.g. `go(n)`) but no hook, add one line
+     right after it: `window.deckGoto = go;`. Without it the overlay still works
+     (the panel's *Go* button falls back to `scrollIntoView`), but it can't jump
+     to a hidden slide precisely.
    - Optionally a slide-number label element (default `.slide-num`) for nicer
      labels in the panel — purely cosmetic.
 
@@ -57,8 +58,8 @@ slides.
    **same directory as the deck**. Resolve `~` to `$HOME`; pass the Write/copy a
    full path.
 
-4. **Inject the script tag** immediately before `</body>` (idempotent — skip if a
-   `slide-annotator` script tag is already present):
+4. **Inject the script tag** immediately before `</body>` (idempotent — skip if
+   a `slide-annotator` script tag is already present):
 
    ```html
    <!-- Review overlay: highlight text on a slide → sidecar JSON. Self-contained, optional. -->
@@ -86,21 +87,23 @@ follow:
 | Navigation hook | `window.deckGoto(index)` (0-based) | panel "Go" jumps to the right slide |
 | Arrow-keys-only navigation, **no** click-to-advance / spacebar | — | text selection + typing in the overlay must not move slides |
 
-If a deck violates the last row (has click-to-advance), the overlay's click guard
-only suppresses the click that ends a text-selection drag, so it degrades
+If a deck violates the last row (has click-to-advance), the overlay's click
+guard only suppresses the click that ends a text-selection drag, so it degrades
 gracefully — but the correct fix is to make the deck arrow-keys-only per
 `deck-create`'s *Navigation & Event Standards*.
 
 ## Using the overlay (tell the user)
 
 1. Open the deck in Chrome and click **✎ Review** (bottom-left).
-2. **Select text** on a slide → a popover lets you add an optional note → **Add**.
-   The highlight appears and **autosaves to `localStorage`** immediately.
-3. Click **Connect folder** once and pick the deck's folder. From then on **Save**
-   writes a real `‹deck›.annotations.json` next to the deck, and the tool reads the
-   deck's own source to fill in **source line / column / context** for each
-   highlight. (If the browser blocks folder access on `file://`, **Save**
-   downloads the JSON instead — move it next to the deck.)
+2. **Select text** on a slide → a popover lets you add an optional note →
+   **Add**. The highlight appears and **autosaves to `localStorage`**
+   immediately.
+3. Click **Connect folder** once and pick the deck's folder. From then on
+   **Save** writes a real `‹deck›.annotations.json` next to the deck, and the
+   tool reads the deck's own source to fill in
+   **source line / column / context** for each highlight. (If the browser blocks
+   folder access on `file://`, **Save** downloads the JSON instead — move it
+   next to the deck.)
 4. Navigation while reviewing is the deck's normal **← / →** (the overlay's own
    keystrokes never leak to the deck).
 
@@ -143,14 +146,15 @@ When the user says "work the annotations":
 
 ## Removing the overlay (for final delivery)
 
-To hand off a clean presentation, delete the injected `<script src="slide-annotator.js" …>`
-line and the `slide-annotator.js` file. Leaving the `window.deckGoto = go;` line in
-the deck is harmless.
+To hand off a clean presentation, delete the injected
+`<script src="slide-annotator.js" …>` line and the `slide-annotator.js` file.
+Leaving the `window.deckGoto = go;` line in the deck is harmless.
 
 ## Constraints
 
 - Keep `slide-annotator.js` **dependency-free and host-agnostic** — it must work
   on any static HTML page, not just `deck-create` output.
-- Edit the tool **here** (`assets/slide-annotator.js`) as the source of truth, then
-  re-install onto decks. Don't fork per-deck copies with divergent behavior.
+- Edit the tool **here** (`assets/slide-annotator.js`) as the source of truth,
+  then re-install onto decks. Don't fork per-deck copies with divergent
+  behavior.
 - Never auto-send or upload annotations anywhere — the sidecar JSON stays local.

package/templates/.claude/skills/doc-create/SKILL.md

@@ -34,22 +34,23 @@ submission, brief, or any multi-page PDF that is not a slide deck.
 
 ## Workflow
 
-1.  Check `Knowledge/` for relevant context about the company, product, team,
-    projects, or people mentioned.
-2.  Ensure Playwright is installed:
-    `bun install playwright && bunx playwright install chromium`
-3.  Create a self-contained HTML file with all CSS inlined. The HTML must handle
-    its own page layout — see **HTML Document Rules** below.
-4.  Run the conversion script:
-
-        node .claude/skills/doc-create/scripts/convert-to-pdf.mjs <input.html> [output.pdf]
-
-    If output is omitted, the PDF is written alongside the HTML file with the
-    same name.
-
-5.  Read the PDF back to visually verify it renders correctly. Check each page
-    for overflow, clipped content, and correct page breaks. Fix and re-render if
-    needed.
+1. Check `Knowledge/` for relevant context about the company, product, team,
+   projects, or people mentioned.
+2. Ensure Playwright is installed:
+   `bun install playwright && bunx playwright install chromium`
+3. Create a self-contained HTML file with all CSS inlined. The HTML must handle
+   its own page layout — see **HTML Document Rules** below.
+4. Run the conversion script:
+
+   ```text
+    node .claude/skills/doc-create/scripts/convert-to-pdf.mjs <input.html> [output.pdf]
+   ```
+
+   If output is omitted, the PDF is written alongside the HTML file with the
+   same name.
+5. Read the PDF back to visually verify it renders correctly. Check each page
+   for overflow, clipped content, and correct page breaks. Fix and re-render if
+   needed.
 
 **Do NOT show HTML code to the user. Just create the PDF and deliver it.**
 

package/templates/.claude/skills/extract-entities/SKILL.md

@@ -76,7 +76,8 @@ writes.
 ### 0. Load context and pick the batch
 
 Read the user's identity from `~/.cache/fit/outpost/state/identity.md` (run the
-`person-identify` skill first if it is missing or stale). Find new/changed files:
+`person-identify` skill first if it is missing or stale). Find new/changed
+files:
 
 ```bash
 node scripts/state.mjs check
@@ -151,7 +152,8 @@ filler or meta-commentary.
   domain-lead inference):
   [references/recruitment.md](references/recruitment.md).
 - **Priority links** (Step 7c): rules in
-  [references/links.md](references/links.md#priorities-step-7c). **Never auto-create.**
+  [references/links.md](references/links.md#priorities-step-7c).
+  **Never auto-create.**
 - **Conditions** (cross-cutting states affecting ≥ 3 entities):
   [references/conditions.md](references/conditions.md).
 

package/templates/.claude/skills/meeting-prep/SKILL.md

@@ -25,7 +25,8 @@ meetings.
 - `Knowledge/People/*.md` — attendee context
 - `Knowledge/Organizations/*.md` — company context
 - `Knowledge/Projects/*.md` — project context
-- `Knowledge/Priorities/*.md` — active priorities and strategic context for framing
+- `Knowledge/Priorities/*.md` — active priorities and strategic context for
+  framing
 - `Knowledge/Candidates/*/brief.md` — candidate context (for interview meetings)
 - `Knowledge/Roles/*.md` — role/requisition context (for interview meetings)
 

package/templates/.claude/skills/organize-files/SKILL.md

@@ -61,7 +61,9 @@ Run when the user asks to find, organize, clean up, or tidy files on their Mac.
 
 Get an overview of both directories:
 
-    node scripts/summarize.mjs
+```text
+node scripts/summarize.mjs
+```
 
 ## Finding Files
 
@@ -79,8 +81,10 @@ find ~/Desktop -maxdepth 1 \( -name "Screenshot*" -o -name "Screen Shot*" \)
 Organize a directory into type-based subdirectories (Documents, Images,
 Archives, Installers, Screenshots):
 
-    node scripts/organize-by-type.mjs ~/Downloads
-    node scripts/organize-by-type.mjs ~/Desktop
+```text
+node scripts/organize-by-type.mjs ~/Downloads
+node scripts/organize-by-type.mjs ~/Desktop
+```
 
 The script creates subdirectories and moves matching files. It does NOT delete
 anything.
@@ -106,7 +110,7 @@ After organizing, collect the paths of document files and invoke the
 
 **Plan:**
 
-```
+```text
 Organization Plan: Desktop & Downloads Cleanup
 
 Found 47 files to organize:
@@ -123,7 +127,7 @@ Should I proceed?
 
 **Results:**
 
-```
+```text
 Organization Complete
 
 Moved 47 files:

package/templates/.claude/skills/person-identify/SKILL.md

@@ -98,7 +98,7 @@ Key attributes returned (names per Active Directory schema):
 
 - To look up **someone else**, use the sibling `person-lookup` skill — it takes
   free-text input (email or name), searches the Global Catalog forest-wide
-  (`ldap://$dc:3268 -b ''`), handles multiple matches, and does **not** touch the
-  identity cache.
+  (`ldap://$dc:3268 -b ''`), handles multiple matches, and does **not** touch
+  the identity cache.
 - Not Active Directory? The same `ldapsearch -Y GSSAPI` shape works against any
   Kerberos-backed LDAP directory; only the attribute names differ.

package/templates/.claude/skills/person-lookup/SKILL.md

@@ -86,9 +86,9 @@ The argument is free text: an email, a full name, or just a surname.
   since the OU convention is organization-specific. Narrow with an email for an
   exact hit.
 - **Silent partial results.** Under load the directory occasionally returns an
-  entry's DN with no attributes (exit 0, no error). Every attribute fetch retries
-  with backoff, so a throttled response never masquerades as a person with a
-  blank title or email.
+  entry's DN with no attributes (exit 0, no error). Every attribute fetch
+  retries with backoff, so a throttled response never masquerades as a person
+  with a blank title or email.
 - **No cache.** This skill prints and exits. It never touches
   `~/.cache/fit/outpost/state/identity.md` — that file is owned solely by
   `person-identify`.

package/templates/.claude/skills/req-forget/references/report-template.md

@@ -62,6 +62,6 @@ rg "{Name}" Knowledge/ ~/.cache/fit/outpost/
 
 Expected: no matches except this erasure report.
 
-```
+```text
 
 ```

package/templates/.claude/skills/req-scan/references/fallbacks.md

@@ -18,7 +18,7 @@ limits.
 
 Search by skill + availability:
 
-```
+```text
 WebFetch URL: https://api.github.com/search/users?q=%22data+engineering%22+%22open+to+work%22&per_page=30&sort=joined&order=desc
 WebFetch URL: https://api.github.com/search/users?q=%22full+stack%22+%22available+for+hire%22&per_page=30&sort=joined&order=desc
 WebFetch URL: https://api.github.com/search/users?q=%22devops%22+%22looking+for%22&per_page=30&sort=joined&order=desc
@@ -26,7 +26,7 @@ WebFetch URL: https://api.github.com/search/users?q=%22devops%22+%22looking+for%
 
 Search repos with README signals:
 
-```
+```text
 WebFetch URL: https://api.github.com/search/repositories?q=%22hire+me%22+in:readme&sort=updated&order=desc&per_page=10
 ```
 
@@ -38,7 +38,7 @@ Manchester, Edinburgh.
 Try broader tags: `jobsearch`, `career`, `remotework`, `job`, `hiring`. Or pull
 from a tag and filter by title/description:
 
-```
+```text
 WebFetch URL: https://dev.to/api/articles?tag=career&per_page=25
 ```
 

package/templates/.claude/skills/req-scan/references/sources.md

@@ -6,14 +6,14 @@ Reference for `req-scan` Step 2 (fetch & scan). One source per wake cycle.
 
 Monthly thread, posted on the 1st.
 
-```
+```text
 WebFetch URL: https://hn.algolia.com/api/v1/search?query=%22Who+wants+to+be+hired%22&tags=ask_hn&hitsPerPage=5
 ```
 
 The first hit whose title matches "Who wants to be hired?" with `created_at` in
 the current or previous month is the target thread.
 
-```
+```text
 WebFetch URL: https://hn.algolia.com/api/v1/items/{objectID}
 ```
 
@@ -34,7 +34,7 @@ WebFetch URL: https://hn.algolia.com/api/v1/items/{objectID}
 
 Search by location (rotate one query per wake):
 
-```
+```text
 WebFetch URL: https://api.github.com/search/users?q=%22open+to+work%22+location:UK&per_page=30&sort=joined&order=desc
 WebFetch URL: https://api.github.com/search/users?q=%22open+to+work%22+location:Europe&per_page=30&sort=joined&order=desc
 WebFetch URL: https://api.github.com/search/users?q=%22looking+for+work%22+location:remote&per_page=30&sort=joined&order=desc
@@ -47,7 +47,7 @@ Alternate bio phrases to rotate across wakes: `"available for hire"`,
 
 Fetch each promising candidate's full profile:
 
-```
+```text
 WebFetch URL: https://api.github.com/users/{login}
 ```
 
@@ -60,7 +60,7 @@ profiles per wake (1 search + 5 profile fetches = 6 requests).
 
 ## 3. dev.to
 
-```
+```text
 WebFetch URL: https://dev.to/api/articles?tag=opentowork&per_page=25
 WebFetch URL: https://dev.to/api/articles?tag=lookingforwork&per_page=25
 ```

package/templates/.claude/skills/req-track/SKILL.md

@@ -71,8 +71,8 @@ Process **10 files per run**.
 ### 1. Load context and pick the batch
 
 Read the user's name, email, and domain from
-`~/.cache/fit/outpost/state/identity.md` (run the `person-identify` skill first if
-it is missing or stale). List new or changed source files:
+`~/.cache/fit/outpost/state/identity.md` (run the `person-identify` skill first
+if it is missing or stale). List new or changed source files:
 
 ```bash
 node .claude/skills/extract-entities/scripts/state.mjs check

package/templates/.claude/skills/req-workday/references/status-mapping.md

@@ -30,7 +30,7 @@ Empty or unrecognized step → default to `new`.
 The raw `step` value is always preserved in the parser's JSON output and must be
 stored in the candidate brief's `## Pipeline` section, e.g.
 
-```
+```text
 - **2026-02-10**: Applied via LinkedIn — Step: Manager Request to Move Forward (HS)
 ```
 

package/templates/.claude/skills/sync-apple-calendar/SKILL.md

@@ -41,7 +41,9 @@ Run the sync as a single Node.js script with embedded SQLite. This avoids N+1
 process invocations (one per event for attendees) and handles all data
 transformation in one pass:
 
-    node scripts/sync.mjs [--days N]
+```text
+node scripts/sync.mjs [--days N]
+```
 
 - `--days N` — how many days back to sync (default: 30)
 
@@ -101,7 +103,9 @@ Each `{event_id}.json` file:
 After syncing, use the query script to filter events by date or time window.
 **Agents should use this script instead of writing bespoke calendar parsers.**
 
-    node scripts/query.mjs [options]
+```text
+node scripts/query.mjs [options]
+```
 
 ### Time filters (combinable)
 

package/templates/.claude/skills/sync-apple-mail/SKILL.md

@@ -48,7 +48,9 @@ their email.
 Run the sync as a single Node.js script with embedded SQLite. This avoids N+1
 process invocations and handles all data transformation in one pass:
 
-    node scripts/sync.mjs [--days N]
+```text
+node scripts/sync.mjs [--days N]
+```
 
 - `--days N` — how many days back to look on first sync (default: 30)
 

package/templates/.claude/skills/sync-apple-mail/references/SCHEMA.md

@@ -106,7 +106,7 @@ used by the `recipients` table.
 
 Attachment files on disk follow this path structure:
 
-```
+```text
 ~/Library/Mail/V10/.../Attachments/{message_ROWID}/{attachment_id}/{filename}
 ```
 

package/templates/.claude/skills/sync-teams/SKILL.md

@@ -48,7 +48,9 @@ their Teams chats.
 
 Run the sync as a single Node.js script:
 
-    node scripts/sync.mjs [--days N]
+```text
+node scripts/sync.mjs [--days N]
+```
 
 - `--days N` — only include messages from the last N days (default: 30)
 
@@ -144,6 +146,12 @@ Key conventions:
 - **Normalize names** from Teams format ("Last, First") to "First Last"
 - **Platform** line distinguishes Teams from email in downstream processing
 - **Plain text only** — HTML is stripped, mentions are preserved as plain text
+- **Attachments are not extracted** — files/images on a message are dropped from
+  the markdown. They are hosted on SharePoint/OneDrive, not in the local cache.
+  However, the user has **often manually downloaded** them, so an attachment
+  usually exists under `~/Downloads/` with the **same file name** shown in
+  Teams. When a message references an attachment and you need its contents, look
+  there first.
 - Skip system messages (calls, member adds/removes, topic changes)
 
 ## Error Handling
@@ -175,3 +183,7 @@ Key conventions:
 - Some V8-serialized records (~17% in testing) use formats that
   `v8.deserialize()` cannot decode. These are silently skipped — they are
   typically IndexedDB metadata, not conversation or message records.
+- **Attachments (files/images) are never synced into the markdown** — only the
+  message text is captured. The binaries live on SharePoint/OneDrive, but the
+  user frequently downloads them, so the same-named file is usually already in
+  `~/Downloads/`. Check there before trying to fetch from SharePoint.

package/templates/.claude/skills/sync-teams/scripts/idb-reader.mjs

@@ -31,56 +31,89 @@ function readIdbVarint(buf, offset) {
   return { value: result, bytesRead: pos - offset };
 }
 
+// Highest V8 serialization wire-format version Node's bundled v8.deserialize
+// accepts. Newer Teams/WebView2 builds write version 16, which Node rejects
+// outright even though the payload itself is wire-compatible. We patch the
+// version byte down to this value before deserializing. Bump if Node's V8
+// starts emitting/accepting a higher version natively.
+const V8_MAX_SUPPORTED_VERSION = 15;
+
+// Plausible V8 top-level value tags that immediately follow the
+// [0xFF <version>] header. Used to locate the real V8 payload start inside the
+// Blink envelope without relying on a fixed byte offset (newer envelopes carry
+// a 0xFE trailer that shifts the payload further in). We only ever ACT on a
+// candidate by attempting a deserialize, which validates it — so a stray match
+// just gets skipped.
+const V8_TOP_LEVEL_TAGS = new Set([
+  0x6f, // 'o' begin JS object
+  0x22, // '"' one-byte string
+  0x63, // 'c' two-byte string
+  0x44, // 'D' utf8 string
+  0x49, // 'I' int32
+  0x55, // 'U' uint32
+  0x4e, // 'N' number (double)
+  0x6c, // 'l' bigint
+  0x7b, // '{' begin map
+  0x41, // 'A' begin dense array
+  0x61, // 'a' begin sparse array
+  0x5f, // '_' undefined
+  0x54, // 'T' true
+  0x46, // 'F' false
+  0x30, // '0' null
+]);
+
+// Only the Blink envelope precedes the V8 payload, and it is always small.
+// Scanning a generous prefix keeps non-message records (which never decode)
+// cheap while comfortably covering every real envelope/trailer layout.
+const V8_START_SCAN_LIMIT = 256;
+
 /**
- * Try to deserialize from the second 0xFF marker within the first `limit` bytes.
- * The Blink envelope has: [varint wire_size] [0xFF blink_ver] [envelope...] [0xFF v8_ver] [V8 data]
- * We want the second 0xFF that starts valid V8 data.
+ * Deserialize the V8 payload starting at `off`. Tries the bytes as-is first,
+ * then — for records whose version byte is newer than Node supports — retries
+ * with the version patched down. The wire format is backward-compatible, so a
+ * supported version reads the newer payload correctly.
  */
-function deserializeFromSecondMarker(rawValue, limit) {
-  let ffCount = 0;
-  for (let i = 0; i < limit; i++) {
-    if (rawValue[i] !== 0xff) continue;
-    ffCount++;
-    if (ffCount >= 2) {
+function deserializeAt(rawValue, off) {
+  try {
+    return v8.deserialize(rawValue.subarray(off));
+  } catch {
+    // fall through to version patching
+  }
+
+  const version = rawValue[off + 1];
+  if (version > V8_MAX_SUPPORTED_VERSION) {
+    const patched = Buffer.from(rawValue.subarray(off));
+    for (let v = V8_MAX_SUPPORTED_VERSION; v >= 13; v--) {
+      patched[1] = v;
       try {
-        return v8.deserialize(rawValue.subarray(i));
+        return v8.deserialize(patched);
       } catch {
-        // keep scanning
+        // try the next-lower version
       }
     }
   }
   return null;
 }
 
-/**
- * Fallback: try deserializing from every 0xFF position within `limit` bytes.
- */
-function deserializeFromAnyMarker(rawValue, limit) {
-  for (let i = 0; i < limit; i++) {
-    if (rawValue[i] !== 0xff) continue;
-    try {
-      return v8.deserialize(rawValue.subarray(i));
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-
 /**
  * Try to deserialize a Chromium IndexedDB value.
- * Values have a Blink envelope before the V8 payload.
- * Scans for the V8 version tag (0xFF) and attempts deserialization.
+ *
+ * Values have a Blink envelope (and, in newer WebView2 builds, a 0xFE trailer)
+ * before the V8 payload. Locate the payload by scanning for a [0xFF <version>
+ * <top-level tag>] header, then decode it — patching the version byte down for
+ * records written with a V8 wire version newer than Node accepts.
  */
 function tryDeserialize(rawValue) {
   if (!rawValue || rawValue.length < 4) return null;
 
-  const headerLimit = Math.min(rawValue.length, 60);
-  const result = deserializeFromSecondMarker(rawValue, headerLimit);
-  if (result !== null) return result;
-
-  const fallbackLimit = Math.min(rawValue.length, 100);
-  return deserializeFromAnyMarker(rawValue, fallbackLimit);
+  const limit = Math.min(rawValue.length - 2, V8_START_SCAN_LIMIT);
+  for (let i = 0; i <= limit; i++) {
+    if (rawValue[i] !== 0xff) continue;
+    if (!V8_TOP_LEVEL_TAGS.has(rawValue[i + 2])) continue;
+    const obj = deserializeAt(rawValue, i);
+    if (obj !== null) return obj;
+  }
+  return null;
 }
 
 /**

package/templates/.claude/skills/upstream-instructions/SKILL.md

@@ -32,7 +32,8 @@ monorepo. "Instructions" means all three surfaces, treated equally:
 - `.claude/skills/*/SKILL.md` and reference files — skills.
 - `CHANGELOG.md` (root) — the existing changelog, for what's already recorded.
 - The changes made in the current working session — the source of truth for what
-  changed, since the KB lives on a synced filesystem and is not version-controlled.
+  changed, since the KB lives on a synced filesystem and is not
+  version-controlled.
 
 ## Outputs