@hraness/ghostget 0.18.12 → 0.18.14

package/CHANGELOG.md

@@ -7,6 +7,35 @@ Historical entries retain their original delivery coordinates.
 
 ## Unreleased
 
+## 0.18.14
+
+- Pin `@hraness/site-footer` v0.13.0 so every public page's shared footer
+  carries the package-owned "Built by Hraness" organization attribution. The
+  static build keeps the framework-neutral renderer, which tests prove is the
+  same `HranessSiteFooter` contract, and the homepage maker biography remains
+  product-owned page content rather than footer attribution.
+- Admit Beeper as a third messaging automation provider beside iMessage and
+  WhatsApp. Adapter `beeper-local` 2.5.0 declares two scoped owner-automation
+  permissions — `messaging.automation.read` and `messaging.automation.send.text` —
+  served only through the owner-driven `ghostget messaging automation` host.
+  Sessions bind one exact account realm, preserve the realm's canonical Matrix
+  self identity beside the bridge-scoped account id, and keep every send
+  behind an explicit reviewed grant with no retry after an uncertain dispatch.
+  Realm-wide conversation listing excludes chats owned by accounts outside
+  the bound realm instead of failing the whole projection.
+
+## 0.18.13
+
+- Move the menu companion onto the shared desktop-foundation runner, retaining
+  its revision-checked account controls and bounded local output listing.
+- Add explicit menu links for free Ghostget updates and optional paid development
+  support. Hraness Accounts owns the browser confirmation; the menu sends no
+  local account details or email address.
+- Add the shared optional support link to the static website footer, retaining
+  the existing production-only Ghostget newsletter form.
+- Retain timeout escalation until the direct iMessage RPC process group exits,
+  including descendants that ignore termination and close inherited pipes.
+
 ## 0.18.12
 
 - Make optional updates and support discoverable to agents after successful CLI

package/README.md

@@ -18,7 +18,7 @@ implementation, and risk level. If those facts drift, the operation stops. It
 does not silently fall back to general browser control.
 
 Bring the model, planner, and tool loop you prefer. Ghostget supplies precise web
-capabilities with local custody and explicit evidence. Its standalone macOS menu-bar companion browses local output files and opens CLI guidance. Account, approval, and interface administration are not exposed in this companion. See the [menu-bar companion guide](docs/menubar-release.md).
+capabilities with local custody and explicit evidence. Its menu-bar companion reviews accounts, pending approvals, and operation permissions through the shared desktop-foundation runner, and browses local output files with CLI guidance. See the [menu-bar companion guide](docs/menubar-release.md).
 
 The separate public web gateway admits exact HTTPS retrieval URLs under human
 domain and path rules. Use `ghostget web request <url>` with an authorized local control client running, and
@@ -48,6 +48,10 @@ ghostget plugin list
 
 ## Optional updates and support
 
+The website footer and menu companion offer the same optional support. The menu
+also links to free Ghostget product updates. Select a link to open Hraness
+Accounts, then review and confirm signup or payment in the browser.
+
 Ghostget stays free to use. After useful standalone work, the CLI may write a
 compact discovery notice to stderr, including when stdout is JSON or piped.
 It preserves the result on stdout and does not claim an invitation or inspect
@@ -75,7 +79,7 @@ The protocol and [Agent Skill](skills/ghostget/SKILL.md) describe the handoff.
 
 ## Built-in provider catalog
 
-This v0.18.12 source tree supports executable actions for 20 services: Beeper,
+This v0.18.14 source tree supports executable actions for 20 services: Beeper,
 Bluesky, ClasificadosOnline, Facebook, Facebook Groups, Facebook Marketplace,
 GitHub, Gmail, Hacker News, Instagram, iMessage, LinkedIn, Reddit, Substack,
 Threads, TikTok, Twitch, WhatsApp, X, and YouTube.
@@ -90,7 +94,10 @@ Beeper is Ghostget's first provider adapter with a pinned local-CLI transport. I
 manage reactions, drafts, reminders, and conversation state; and preview and
 confirm sends, edits, group changes, and presence. Of those, 26 operations use
 the authoritative `@beeper/cli` 0.6.2 executable; six reads use fixed Beeper
-Desktop loopback endpoints. Ghostget binds one Desktop target and does not expose
+Desktop loopback endpoints. Adapter 2.5.0 adds two scoped owner-automation
+permissions, `messaging.automation.read` and `messaging.automation.send.text`,
+served only through the owner-driven `ghostget messaging automation` host with
+sends behind an explicit bounded grant. Ghostget binds one Desktop target and does not expose
 a generic command runner. Submission is not a claim of network delivery.
 
 ```sh
@@ -151,9 +158,9 @@ The optional npm mirror can follow later without delaying canonical delivery.
 Install the single Ghostget Agent Skill with either runner:
 
 ```sh
-npx skills add hraness/ghostget#v0.18.12
+npx skills add hraness/ghostget#v0.18.14
 # or
-bunx skills add hraness/ghostget#v0.18.12
+bunx skills add hraness/ghostget#v0.18.14
 ```
 
 The skill teaches Codex, Claude Code, Cursor, and other compatible coding
@@ -163,7 +170,7 @@ install the CLI if it is missing. Start a new agent session after installation.
 After the matching immutable Release exists, install this exact canonical archive:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.12/hraness-ghostget-0.18.12.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.14/hraness-ghostget-0.18.14.tgz
 ghostget adapter sync-bundled --json
 ghostget doctor
 ```
@@ -191,7 +198,7 @@ For that same released coordinate, install Ghostget in an agent or application
 that owns its own model, planning, tool loop, approvals, and interface:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.12/hraness-ghostget-0.18.12.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.14/hraness-ghostget-0.18.14.tgz
 ```
 
 ```ts
@@ -803,7 +810,9 @@ absorbed into explicit account IDs; `targets status`, `version`, and top-level
 `export` are internal; `accounts add`, `accounts remove`, and `messages delete`
 are R4 and unavailable to provider dispatch; and plain `status` is among the
 53 unsupported paths. None of those three R4 paths appears in the selected
-32-operation provider adapter. Ghostget does not turn administrative,
+32-operation provider adapter. Two additional scoped permission descriptors —
+`messaging.automation.read` and `messaging.automation.send.text` — belong only
+to the owner-driven automation host and admit no generic invocation. Ghostget does not turn administrative,
 destructive, caller-selected network, or arbitrary-filesystem commands into
 agent authority.
 

package/dist/apple-photos-client.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-9ayntqrw.js";
+} from "./index-g6na3p6k.js";
 import {
   canonicalJson,
   sha256

package/dist/beeper-client.js

@@ -4,7 +4,7 @@ import {
 } from "./index-26yq8q16.js";
 import {
   GHOSTGET_VERSION
-} from "./index-9ayntqrw.js";
+} from "./index-g6na3p6k.js";
 import {
   canonicalJson,
   sha256
@@ -27,7 +27,7 @@ import {
 var wrench_web_adapter_default = {
   schemaVersion: 6,
   id: "beeper-local",
-  version: "2.4.0",
+  version: "2.5.0",
   displayName: "Beeper (Pinned Local CLI)",
   surfaceId: "beeper",
   origins: [
@@ -1521,6 +1521,42 @@ var wrench_web_adapter_default = {
         timeoutMs: 120000,
         maxOutputBytes: 10485760
       }
+    },
+    "messaging.automation.read": {
+      description: "Scoped owner automation permission; use ghostget messaging automation serve --stdio. Generic invocation is unavailable.",
+      risk: "R1",
+      sideEffect: "none",
+      idempotency: "none",
+      dedupeWindowMs: 0,
+      input: {
+        properties: {},
+        required: []
+      },
+      localCli: {
+        surface: "beeper",
+        action: "messaging.automation.read",
+        contractVersion: 1,
+        timeoutMs: 30000,
+        maxOutputBytes: 8388608
+      }
+    },
+    "messaging.automation.send.text": {
+      description: "Scoped owner automation permission; use ghostget messaging automation serve --stdio. Generic invocation is unavailable.",
+      risk: "R3",
+      sideEffect: "Submit one exact action through an enrolled conversation and an unexpired bounded owner grant; delivery remains unknown.",
+      idempotency: "local-at-most-once",
+      dedupeWindowMs: 86400000,
+      input: {
+        properties: {},
+        required: []
+      },
+      localCli: {
+        surface: "beeper",
+        action: "messaging.automation.send.text",
+        contractVersion: 1,
+        timeoutMs: 30000,
+        maxOutputBytes: 8388608
+      }
     }
   }
 };
@@ -2762,7 +2798,7 @@ function beeperLocalSurfaceInputType(value) {
   return value;
 }
 var adapterOperations = wrench_web_adapter_default.operations;
-var BEEPER_LOCAL_OPERATION_INPUT_TYPES = Object.freeze(Object.fromEntries(Object.keys(adapterOperations).sort().map((operation) => [
+var BEEPER_LOCAL_OPERATION_INPUT_TYPES = Object.freeze(Object.fromEntries([...BEEPER_LOCAL_OPERATION_NAMES].sort().map((operation) => [
   operation,
   Object.freeze(Object.fromEntries(Object.keys(adapterOperations[operation].input.properties).sort().map((field) => [
     field,
@@ -3774,9 +3810,9 @@ var BEEPER_CLI_V062_SURFACE_CONTRACT = defineLocalCliSurfaceContractV1({
   sdk: BEEPER_DESKTOP_API_PIN,
   runtime: {
     providerPluginId: "beeper-linked-device",
-    providerPluginVersion: "2.4.0",
+    providerPluginVersion: "2.5.0",
     adapterId: "beeper-local",
-    adapterVersion: "2.4.0",
+    adapterVersion: "2.5.0",
     operationContractVersions: BEEPER_LOCAL_OPERATION_CONTRACT_VERSIONS,
     operationInputTypes: BEEPER_LOCAL_OPERATION_INPUT_TYPES,
     target: BEEPER_DESKTOP_TARGET,
@@ -3790,7 +3826,7 @@ var BEEPER_CLI_V062_SURFACE_CONTRACT = defineLocalCliSurfaceContractV1({
 var BEEPER_CLI_V062_UPSTREAM_SURFACE_SHA256 = "74297df1af30fe89cf1596a0670983e79cf85c0768c2f68e9bc3d386be640836";
 var BEEPER_CLI_V062_CLASSIFICATION_SHA256 = "bcd411af1544e5cd618cd3c04f2852a797bd804d92b7fe4cd226374b61c57d08";
 var BEEPER_CLI_V062_SEMANTIC_PROFILES_SHA256 = "fb7ea5f70f004dd8090c3e6e0996bfa00b0bab8ea5639203e2d1027602450ffe";
-var BEEPER_CLI_V062_WHOLE_SURFACE_SHA256 = "72201ac5eb3532f7c159583f19009f547d7d313e86388466b57c135bd2dc4944";
+var BEEPER_CLI_V062_WHOLE_SURFACE_SHA256 = "bedc3063a7a792686e351c78e7ba3ed2a5fc0cc6efd3d88a23d9b7ae777765e2";
 var BEEPER_CLI_V062_PUBLIC_MANUAL_SEMANTIC_PROFILE_SHA256 = Object.freeze({
   setup: "cd432e2649e5724d70398e739a2d1c0c21557a23820aaa14562575a5fe689406",
   "install desktop": "478f4cc022b1d51d4016a319efea17e4523c55e3168560c99fdf7779347ae78a",

package/dist/{imessage-direct-install-2gm3kge7.js → imessage-direct-install-5nftwc6p.js}

@@ -2,7 +2,7 @@
 import {
   ensureImsgNativeResources,
   verifyImsgNativeResources
-} from "./index-en5hycxp.js";
+} from "./index-kaav16fd.js";
 import {
   ensurePrivateStateDirectory,
   ghostgetStateHome

package/dist/{index-9ayntqrw.js → index-g6na3p6k.js}

@@ -1,5 +1,5 @@
 // @bun
 // src/version.ts
-var GHOSTGET_VERSION = "0.18.12";
+var GHOSTGET_VERSION = "0.18.14";
 
 export { GHOSTGET_VERSION };

package/dist/{index-en5hycxp.js → index-kaav16fd.js}

@@ -147,6 +147,8 @@ async function ensureImsgNativeResources(installDirectory, environment) {
 async function installBundledMessagingRuntime(provider, environment = process.env) {
   if (process.platform !== "darwin" || process.arch !== "arm64")
     throw new Error("Bundled messaging runtimes require Apple silicon macOS");
+  if (provider === "beeper")
+    throw new Error("Beeper has no bundled messaging runtime; the pinned local CLI and running Beeper Desktop are installed separately");
   if (provider !== "imessage" && provider !== "whatsapp")
     throw new Error("Unknown messaging runtime");
   const bytes = await readBundledMessagingAsset(provider), directory = await mkdtemp(join(await realpath(tmpdir()), "wrench-messaging-install-"));
@@ -160,11 +162,11 @@ async function installBundledMessagingRuntime(provider, environment = process.en
       await file.close();
     }
     if (provider === "imessage") {
-      const { installReviewedImsgBinary } = await import("./imessage-direct-install-2gm3kge7.js");
+      const { installReviewedImsgBinary } = await import("./imessage-direct-install-5nftwc6p.js");
       const result = await installReviewedImsgBinary(path, environment);
       return { version: result.version, sha256: result.executableSha256, alreadyPresent: result.alreadyPresent };
     }
-    const { installReviewedWhatsAppAutomationBinary } = await import("./whatsapp-automation-runtime-hgh1e9rm.js");
+    const { installReviewedWhatsAppAutomationBinary } = await import("./whatsapp-automation-runtime-ke1dx91p.js");
     return await installReviewedWhatsAppAutomationBinary(path, environment);
   } finally {
     await unlink(path);

package/dist/{index-2ymnp8xv.js → index-qcf2f6wm.js}

@@ -59,6 +59,10 @@ function parseAutomationCoordinate(value) {
       throw new Error("Only exact iMessage conversations are supported.");
     return Object.freeze({ provider, chatGuid, service: "iMessage", observedChatRowId: automationInteger(r2.observedChatRowId, 1, Number.MAX_SAFE_INTEGER) });
   }
+  if (provider === "beeper") {
+    const r2 = automationRecord(value, ["provider", "accountId", "conversationId"]);
+    return Object.freeze({ provider, accountId: automationText(r2.accountId, 512), conversationId: automationText(r2.conversationId, 2048) });
+  }
   const r = automationRecord(value, ["provider", "conversationJid"]);
   if (provider !== "whatsapp" || typeof r.conversationJid !== "string" || !/^(?:[1-9][0-9]{4,14}@s\.whatsapp\.net|[1-9][0-9]{4,19}@lid)$/u.test(r.conversationJid))
     throw new Error("Only exact individual WhatsApp conversations are supported.");
@@ -66,7 +70,7 @@ function parseAutomationCoordinate(value) {
 }
 function parseAutomationIdentity(value) {
   const r = automationRecord(value, ["provider", "authId", "accountIdentity", "accountSubject", "implementationIdentity", "sourceGeneration"]);
-  if (r.provider !== "imessage" && r.provider !== "whatsapp")
+  if (r.provider !== "imessage" && r.provider !== "whatsapp" && r.provider !== "beeper")
     throw new Error("Messaging provider is invalid.");
   return Object.freeze({ provider: r.provider, authId: automationId(r.authId), accountIdentity: automationDigest(r.accountIdentity), accountSubject: automationText(r.accountSubject, 512), implementationIdentity: automationDigest(r.implementationIdentity), sourceGeneration: automationText(r.sourceGeneration, 256) });
 }

package/dist/{messaging-automation-j4274hvc.js → messaging-automation-58s1366z.js}

@@ -13,7 +13,7 @@ import {
   parseAutomationCoordinate,
   parseAutomationIdentity,
   parseAutomationMessage
-} from "./index-2ymnp8xv.js";
+} from "./index-qcf2f6wm.js";
 import {
   ensurePrivateStateDirectory,
   ghostgetStateHome,

package/dist/messaging-automation-api.js

@@ -8,11 +8,11 @@ import {
 
 // src/messaging-automation-api.ts
 async function createMessagingAutomationHost(providers, environment) {
-  const { MessagingAutomationHost } = await import("./messaging-automation-j4274hvc.js");
+  const { MessagingAutomationHost } = await import("./messaging-automation-58s1366z.js");
   return new MessagingAutomationHost(providers, environment);
 }
 async function installBundledMessagingRuntime(provider, environment) {
-  return (await import("./messaging-native-install-8w1j36ah.js")).installBundledMessagingRuntime(provider, environment);
+  return (await import("./messaging-native-install-c90nv501.js")).installBundledMessagingRuntime(provider, environment);
 }
 export {
   installBundledMessagingRuntime,

package/dist/{messaging-native-install-8w1j36ah.js → messaging-native-install-c90nv501.js}

@@ -4,7 +4,7 @@ import {
   installBundledMessagingRuntime,
   readBundledMessagingAsset,
   verifyImsgNativeResources
-} from "./index-en5hycxp.js";
+} from "./index-kaav16fd.js";
 import"./index-yq6maz71.js";
 import"./index-gwk7rbyj.js";
 import"./index-z1w83f81.js";

package/dist/{whatsapp-automation-runtime-hgh1e9rm.js → whatsapp-automation-runtime-ke1dx91p.js}

@@ -3,7 +3,7 @@ import {
   automationDigest,
   automationRecord,
   automationText
-} from "./index-2ymnp8xv.js";
+} from "./index-qcf2f6wm.js";
 import {
   assertSafeStatePath,
   captureProcessOwnerIdentity,

package/docs/messaging-automation.md

@@ -1,7 +1,8 @@
 # Owner messaging host
 
 `ghostget messaging automation serve --stdio` is the trusted owner control port
-for enrolled iMessage and WhatsApp conversations. It is never an agent tool.
+for enrolled iMessage, WhatsApp, and Beeper conversations. It is never an agent
+tool.
 All configuration, targets, message bodies and assets arrive on stdin; stdout
 contains only protocol responses. Do not run it in a terminal or record its
 streams in general logs. It does not pair accounts or start synchronization on
@@ -15,11 +16,13 @@ must enforce their own exact permissions and cleanup. Use the stdio host above
 for Ghostget's built-in accounts and managed registry; its session factory is
 internal and is not part of the SDK.
 
-Install the current bundled `imessage-direct` or `whatsapp-web` adapter, bind an
-explicit existing Ghostget account, and enable managed operation permissions in
-Ghostget. Grant `allow` separately to `messaging.automation.read`, the required
-`messaging.automation.send.<kind>` operations, and (WhatsApp only)
-`messaging.automation.sync`. An old `messaging.send` allow does not authorize this
+Install the current bundled `imessage-direct`, `whatsapp-web`, or `beeper-local`
+adapter, bind an explicit existing Ghostget account, and enable managed
+operation permissions in Ghostget. Grant `allow` separately to
+`messaging.automation.read`, the required `messaging.automation.send.<kind>`
+operations, and (WhatsApp only) `messaging.automation.sync`. Beeper admits exact
+text sends only: `messaging.automation.send.text` is its sole send permission.
+An old `messaging.send` allow does not authorize this
 host. `ask`, `deny`, and an unmanaged policy do not provide unattended authority.
 Updated manifests and automatic implementation closures invalidate old grants.
 These catalog entries cannot dispatch through generic `invoke` or `confirm`.
@@ -31,6 +34,10 @@ ghostget imessage transport install --json
 ghostget whatsapp automation install --json
 ```
 
+Beeper has no bundled runtime: its transport is the separately installed pinned
+`beeper` CLI against the running Beeper Desktop local API on its fixed loopback
+target.
+
 The default installs the exact compressed runtime included in the Ghostget package. An optional `--binary /absolute/reviewed-file` selects an explicit source instead. Only exact pinned bytes are accepted. Installation starts no helper. The
 WhatsApp binary is the reviewed wacli build with durable events and exact action
 claims; a stock wacli does not qualify. Existing account pairing and macOS
@@ -46,7 +53,7 @@ responses can arrive before a pending ordinary response.
 
 | Method | Exact params | Result |
 | --- | --- | --- |
-| initialize | providers: 1–2 `{provider,authId}`, distinct networks | `{initialized:true}` |
+| initialize | providers: 1–3 `{provider,authId}`, distinct networks | `{initialized:true}` |
 | status | provider | Current identity and permissions-intersected capabilities |
 | start | provider | Current status; WhatsApp sync starts explicitly |
 | conversations | provider, limit (1–200) | Current individual conversations |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/ghostget",
-  "version": "0.18.12",
+  "version": "0.18.14",
   "description": "Open-source CLI and TypeScript SDK for precise web capabilities for AI agents: page capture, verified media archives, encrypted reads, and typed provider operations.",
   "license": "MIT",
   "type": "module",
@@ -108,6 +108,7 @@
     "src/assets/adapters/beeper/wrench-web-adapter.v2.1.0.json",
     "src/assets/adapters/beeper/wrench-web-adapter.v2.2.0.json",
     "src/assets/adapters/beeper/wrench-web-adapter.v2.3.0.json",
+    "src/assets/adapters/beeper/wrench-web-adapter.v2.4.0.json",
     "src/assets/adapters/imessage/wrench-web-adapter.json",
     "src/assets/adapters/bluesky/wrench-web-adapter.json",
     "src/assets/adapters/bluesky/wrench-web-adapter.v1.0.0.json",
@@ -275,6 +276,7 @@
     "src/cli.ts",
     "src/cli-intro.ts",
     "src/support.ts",
+    "src/support-profile.ts",
     "src/cursor-token.ts",
     "src/derive-command-helper.ts",
     "src/derivation-dnr-readiness.ts",
@@ -330,6 +332,7 @@
     "src/providers/imessage-automation.ts",
     "src/providers/whatsapp-automation.ts",
     "src/providers/whatsapp-automation-runtime.ts",
+    "src/providers/beeper-automation.ts",
     "src/providers/messaging-native-install.ts",
     "src/providers/messaging-native-artifacts.ts",
     "src/assets/messaging-runtime",
@@ -584,6 +587,8 @@
     "src/control/credential-helper.ts",
     "src/control/account-revision.ts",
     "src/control/interface-cli.ts",
+    "src/control/menubar-cli.ts",
+    "src/control/menubar-icon.ts",
     "src/control/bundled-interfaces.ts"
   ],
   "scripts": {
@@ -609,15 +614,14 @@
     "check:static": "bun run typecheck && bun run check:effect && bun run website:check && bun run test:npm-release",
     "check:package": "bun run build && bun run test:package",
     "check:macos": "bun run ./scripts/ci-macos-check.ts",
-    "check": "bun run check:static && bun run check:package && bun run test && bun run test:standalone",
+    "check:cost-surfaces": "bun ./scripts/check-cost-surfaces.mjs",
+    "check": "bun run check:cost-surfaces && bun run check:static && bun run check:package && bun run test && bun run test:standalone",
     "kb:refresh": "bunx --bun github:hraness/kb#v0.15.2 refresh --root kb",
     "kb:check:lane": "bunx --bun github:hraness/kb#v0.15.2 check --root kb --no-catalog",
     "kb:check": "bunx --bun github:hraness/kb#v0.15.2 check --root kb && bunx --bun github:hraness/kb#v0.15.2 agents check --root kb --repo .",
     "kb:catalog": "bunx --bun github:hraness/kb#v0.15.2 catalog --root kb",
     "prepack": "bun run check",
-    "check:effect": "bun scripts/check-effect-architecture.ts",
-    "menubar:build": "bun scripts/build-menubar.ts",
-    "menubar:check": "bun scripts/check-menubar.ts"
+    "check:effect": "bun scripts/check-effect-architecture.ts"
   },
   "dependencies": {
     "@hraness/kb": "https://github.com/hraness/kb/releases/download/v0.19.6/hraness-kb-0.19.6.tgz",
@@ -628,11 +632,12 @@
     "source-map": "0.6.1",
     "source-map-support": "0.5.21",
     "typescript": "6.0.3",
-    "@1password/sdk": "0.5.0"
+    "@1password/sdk": "0.5.0",
+    "@hraness/desktop-foundation": "https://github.com/hraness/desktop-foundation/releases/download/v0.7.0/hraness-desktop-foundation-0.7.0.tgz"
   },
   "devDependencies": {
     "@hraness/design-kit": "github:hraness/design-kit#v0.8.0",
-    "@hraness/site-footer": "github:hraness/site-footer#v0.11.2",
+    "@hraness/site-footer": "github:hraness/site-footer#v0.13.0",
     "@hraness/ui": "github:hraness/ui#v0.5.13",
     "@steipete/sweet-cookie": "0.4.3",
     "@types/bun": "^1.3.14",

package/skills/ghostget/SKILL.md

@@ -19,7 +19,7 @@ description: >-
 
 # Ghostget
 
-Ghostget supplies bounded CLI and SDK capabilities with a menu-bar companion for local outputs and CLI guidance. Use it from the caller's own agent loop; Ghostget does not run a model.
+Ghostget supplies bounded CLI and SDK capabilities with a menu-bar companion for account, approval, and permission review plus local outputs and CLI guidance. Use it from the caller's own agent loop; Ghostget does not run a model.
 
 ## Install or verify Ghostget
 

package/skills/ghostget/references/install.md

@@ -17,34 +17,34 @@ If Bun is missing, stop and direct the user to the official
 [Bun installation guide](https://bun.sh/docs/installation). Do not switch
 package managers or pipe an unreviewed installer into a shell.
 
-This reference is authored for the exact v0.18.12 release coordinate. Use it
+This reference is authored for the exact v0.18.14 release coordinate. Use it
 only from the matching release-bound Agent Skill after its canonical archive and
 immutable GitHub Release exist. If the coordinate is not public, stop instead
 of substituting `main`, another tag, or a different package version. Install
 that exact release and its reviewed bundled adapter manifests:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.12/hraness-ghostget-0.18.12.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.14/hraness-ghostget-0.18.14.tgz
 ghostget adapter sync-bundled --json
 ghostget --help
 ghostget doctor --json
 ```
 
-The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.12` is an optional npm
+The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.14` is an optional npm
 mirror only after verified registry publication. Canonical installation does not
 wait for registry publication.
 
 When upgrading from Wrench, use `ghostget` for new commands and
 `GHOSTGET_STATE_HOME` for an explicit state root. Existing state is selected in
 place; do not rename, copy, or delete a state directory as part of the upgrade.
-The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.12/docs/ghostget-migration.md)
+The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.14/docs/ghostget-migration.md)
 explains the retained state aliases and durable protocol names.
 
 Do not clone the repository merely to run the CLI. Importing the SDK is a
 separate project dependency and does not install a global command:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.12/hraness-ghostget-0.18.12.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.14/hraness-ghostget-0.18.14.tgz
 ```
 
 `ghostget adapter sync-bundled` upgrades exact bundled baselines, including an

package/src/assets/adapters/beeper/wrench-web-adapter.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 6,
   "id": "beeper-local",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "displayName": "Beeper (Pinned Local CLI)",
   "surfaceId": "beeper",
   "origins": [
@@ -1495,6 +1495,42 @@
         "timeoutMs": 120000,
         "maxOutputBytes": 10485760
       }
+    },
+    "messaging.automation.read": {
+      "description": "Scoped owner automation permission; use ghostget messaging automation serve --stdio. Generic invocation is unavailable.",
+      "risk": "R1",
+      "sideEffect": "none",
+      "idempotency": "none",
+      "dedupeWindowMs": 0,
+      "input": {
+        "properties": {},
+        "required": []
+      },
+      "localCli": {
+        "surface": "beeper",
+        "action": "messaging.automation.read",
+        "contractVersion": 1,
+        "timeoutMs": 30000,
+        "maxOutputBytes": 8388608
+      }
+    },
+    "messaging.automation.send.text": {
+      "description": "Scoped owner automation permission; use ghostget messaging automation serve --stdio. Generic invocation is unavailable.",
+      "risk": "R3",
+      "sideEffect": "Submit one exact action through an enrolled conversation and an unexpired bounded owner grant; delivery remains unknown.",
+      "idempotency": "local-at-most-once",
+      "dedupeWindowMs": 86400000,
+      "input": {
+        "properties": {},
+        "required": []
+      },
+      "localCli": {
+        "surface": "beeper",
+        "action": "messaging.automation.send.text",
+        "contractVersion": 1,
+        "timeoutMs": 30000,
+        "maxOutputBytes": 8388608
+      }
     }
   }
 }