@hraness/ghostget 0.18.3 → 0.18.5

package/CHANGELOG.md

@@ -7,6 +7,23 @@ Historical entries retain their original delivery coordinates.
 
 ## Unreleased
 
+## 0.18.5
+
+- Remove the website footer's Cloudflare Turnstile gate through the shared
+  footer: newsletter signups post directly to the accounts endpoint behind a
+  honeypot field, and the geo-gated consent note joins the public pages.
+  Package commands, provider operations, and archive contracts stay unchanged.
+- Port the desktop control panel onto the shared menu-bar foundation and
+  harden menu refreshes while preserving unknown approval status.
+
+## 0.18.4
+
+- Show a compact ASCII ghost before interactive root help. Piped output,
+  machine-readable commands, version output, and command help stay unchanged.
+- Refine the shared marketing surfaces and use the ghost identity consistently.
+  Provider operations, account authority, and immutable archive contracts remain
+  unchanged.
+
 ## 0.18.3
 
 - Apply the shared Lantern material to the homepage: luminous grid glass behind

package/README.md

@@ -21,7 +21,7 @@ Bring the model, planner, and tool loop you prefer. Ghostget supplies precise we
 capabilities with local custody and explicit evidence. Its native macOS control
 panel manages accounts, operation permissions, human approvals, editable OpenAPI
 interfaces, and a searchable local web request log. See the
-[control panel guide](docs/control-panel.md) and [native source build](https://github.com/hraness/ghostget/blob/v0.18.3/desktop/README.md).
+[control panel guide](docs/control-panel.md) and [native source build](https://github.com/hraness/ghostget/blob/v0.18.5/desktop/README.md).
 
 The separate public web gateway admits exact HTTPS retrieval URLs under human
 domain and path rules. Use `ghostget web request <url>` with the app open, and
@@ -51,7 +51,7 @@ ghostget plugin list
 
 ## Built-in provider catalog
 
-This v0.18.3 source tree supports executable actions for 20 services: Beeper,
+This v0.18.5 source tree supports executable actions for 20 services: Beeper,
 Bluesky, ClasificadosOnline, Facebook, Facebook Groups, Facebook Marketplace,
 GitHub, Gmail, Hacker News, Instagram, iMessage, LinkedIn, Reddit, Substack,
 Threads, TikTok, Twitch, WhatsApp, X, and YouTube.
@@ -116,7 +116,7 @@ owns the narrow capability boundary that can sit beneath them.
 Wrench is now Ghostget. The package name is `@hraness/ghostget`, and the CLI
 command is `ghostget`. Read the [migration guide](docs/ghostget-migration.md)
 before updating an existing installation. After its optional npm mirror is
-verified public, `@hraness/ghostget@0.18.3` is also available from the registry.
+verified public, `@hraness/ghostget@0.18.5` is also available from the registry.
 
 This README describes the package version in this source tree. Its versioned
 GitHub archive and Agent Skill become a supported public release after the
@@ -127,9 +127,9 @@ The optional npm mirror can follow later without delaying canonical delivery.
 Install the single Ghostget Agent Skill with either runner:
 
 ```sh
-npx skills add hraness/ghostget#v0.18.3
+npx skills add hraness/ghostget#v0.18.5
 # or
-bunx skills add hraness/ghostget#v0.18.3
+bunx skills add hraness/ghostget#v0.18.5
 ```
 
 The skill teaches Codex, Claude Code, Cursor, and other compatible coding
@@ -139,7 +139,7 @@ install the CLI if it is missing. Start a new agent session after installation.
 After the matching immutable Release exists, install this exact canonical archive:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.3/hraness-ghostget-0.18.3.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.5/hraness-ghostget-0.18.5.tgz
 ghostget adapter sync-bundled --json
 ghostget doctor
 ```
@@ -167,7 +167,7 @@ For that same released coordinate, install Ghostget in an agent or application
 that owns its own model, planning, tool loop, approvals, and interface:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.3/hraness-ghostget-0.18.3.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.5/hraness-ghostget-0.18.5.tgz
 ```
 
 ```ts

package/dist/apple-photos-client.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-cnbz0gws.js";
+} from "./index-30bdb2y9.js";
 import {
   canonicalJson,
   sha256

package/dist/beeper-client.js

@@ -4,7 +4,7 @@ import {
 } from "./index-26yq8q16.js";
 import {
   GHOSTGET_VERSION
-} from "./index-cnbz0gws.js";
+} from "./index-30bdb2y9.js";
 import {
   canonicalJson,
   sha256

package/dist/{index-cnbz0gws.js → index-30bdb2y9.js}

@@ -1,5 +1,5 @@
 // @bun
 // src/version.ts
-var GHOSTGET_VERSION = "0.18.3";
+var GHOSTGET_VERSION = "0.18.5";
 
 export { GHOSTGET_VERSION };

package/docs/control-panel.md

@@ -9,7 +9,7 @@ and capabilities refresh when you return to the app, after changes made in the
 app, or when you choose Refresh. Permission decisions always validate current
 account and integration state.
 
-Build instructions and native qualification live in [desktop/README.md](https://github.com/hraness/ghostget/blob/v0.18.3/desktop/README.md).
+Build instructions and native qualification live in [desktop/README.md](https://github.com/hraness/ghostget/blob/v0.18.5/desktop/README.md).
 The CLI's canonical five-file GitHub Release contract is unchanged. A source
 build is not a signed or notarized public macOS installer.
 
@@ -123,7 +123,7 @@ User and imported interfaces are distinguished from bundled interfaces. Remote
 references, executable import hooks, arbitrary HTTP templates, and unsupported
 input-schema constructs are rejected or remain visibly inert as appropriate.
 An interface without an executor does not become executable by importing it.
-Use the existing [provider plugin protocol](https://github.com/hraness/ghostget/blob/v0.18.3/docs/plugins.md) when a new executor is
+Use the existing [provider plugin protocol](https://github.com/hraness/ghostget/blob/v0.18.5/docs/plugins.md) when a new executor is
 needed. OpenAPI import does not grant it account access.
 
 Middleware and LLM approval are future extensions. Future hooks may propose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/ghostget",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "Open-source CLI and TypeScript SDK for precise web capabilities for AI agents: page capture, verified media archives, encrypted reads, and typed provider operations.",
   "license": "MIT",
   "type": "module",
@@ -274,6 +274,7 @@
     "src/client-types.ts",
     "src/client.ts",
     "src/cli.ts",
+    "src/cli-intro.ts",
     "src/cursor-token.ts",
     "src/derive-command-helper.ts",
     "src/derivation-dnr-readiness.ts",
@@ -637,9 +638,9 @@
     "@1password/sdk": "0.5.0"
   },
   "devDependencies": {
-    "@hraness/design-kit": "github:hraness/design-kit#v0.5.2",
-    "@hraness/site-footer": "github:hraness/site-footer#v0.6.1",
-    "@hraness/ui": "github:hraness/ui#v0.5.7",
+    "@hraness/design-kit": "github:hraness/design-kit#v0.8.0",
+    "@hraness/site-footer": "github:hraness/site-footer#v0.9.2",
+    "@hraness/ui": "github:hraness/ui#v0.5.13",
     "@steipete/sweet-cookie": "0.4.3",
     "@types/bun": "^1.3.14",
     "@types/react": "19.2.14",

package/skills/ghostget/references/control-panel.md

@@ -40,4 +40,4 @@ Unsupported executors remain inert. Follow the existing provider-plugin
 authoring protocol to add an executor; do not synthesize arbitrary authenticated
 HTTP or broaden an existing grant. Interface changes invalidate exact grants.
 
-The product reference is the [Ghostget control panel guide](https://github.com/hraness/ghostget/blob/v0.18.3/docs/control-panel.md).
+The product reference is the [Ghostget control panel guide](https://github.com/hraness/ghostget/blob/v0.18.5/docs/control-panel.md).

package/skills/ghostget/references/install.md

@@ -17,34 +17,34 @@ If Bun is missing, stop and direct the user to the official
 [Bun installation guide](https://bun.sh/docs/installation). Do not switch
 package managers or pipe an unreviewed installer into a shell.
 
-This reference is authored for the exact v0.18.3 release coordinate. Use it
+This reference is authored for the exact v0.18.5 release coordinate. Use it
 only from the matching release-bound Agent Skill after its canonical archive and
 immutable GitHub Release exist. If the coordinate is not public, stop instead
 of substituting `main`, another tag, or a different package version. Install
 that exact release and its reviewed bundled adapter manifests:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.3/hraness-ghostget-0.18.3.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.5/hraness-ghostget-0.18.5.tgz
 ghostget adapter sync-bundled --json
 ghostget --help
 ghostget doctor --json
 ```
 
-The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.3` is an optional npm
+The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.5` is an optional npm
 mirror only after verified registry publication. Canonical installation does not
 wait for registry publication.
 
 When upgrading from Wrench, use `ghostget` for new commands and
 `GHOSTGET_STATE_HOME` for an explicit state root. Existing state is selected in
 place; do not rename, copy, or delete a state directory as part of the upgrade.
-The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.3/docs/ghostget-migration.md)
+The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.5/docs/ghostget-migration.md)
 explains the retained state aliases and durable protocol names.
 
 Do not clone the repository merely to run the CLI. Importing the SDK is a
 separate project dependency and does not install a global command:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.3/hraness-ghostget-0.18.3.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.5/hraness-ghostget-0.18.5.tgz
 ```
 
 `ghostget adapter sync-bundled` upgrades exact bundled baselines, including an

package/src/beeper-client-types.ts

@@ -96,7 +96,7 @@ export type BeeperContactInteractionExportReceipt = Readonly<{
   implementation: Readonly<{
     producer: Readonly<{
       package: "@hraness/ghostget";
-      version: "0.18.3";
+      version: "0.18.5";
     }>;
     officialCli: Readonly<{
       implementation: "github.com/beeper/cli";

package/src/cli-intro.ts

@@ -0,0 +1,5 @@
+/** Compact ASCII identity for interactive root help; never command output. */
+export function terminalIntro(terminal: Readonly<{ isTTY: boolean | undefined; columns: number | undefined; term: string | undefined }>): string {
+  if (terminal.isTTY !== true || terminal.term === "dumb" || (terminal.columns ?? 80) < 48) return "";
+  return "  .---.\n / o o \\   ghostget\n |     |   Get useful context for your agents.\n |/|/|/\n\n";
+}

package/src/cli.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 
 import { ghostgetUsage } from "./usage";
+import { terminalIntro } from "./cli-intro";
 import { GHOSTGET_VERSION } from "./version";
 import type {
   GhostgetCatalogCommand,
@@ -164,6 +165,7 @@ export async function runGhostgetCliProcess(
   loadKnowledgeCli: () => Promise<PublicKbCliModule> = loadPublicKbCli,
 ): Promise<void> {
   if (isImmediateGhostgetHelpRequest(rawArguments)) {
+    if (output === defaultOutput) output.stdout(terminalIntro({ isTTY: process.stdout.isTTY, columns: process.stdout.columns, term: process.env.TERM }));
     output.stdout(ghostgetUsage);
     process.exitCode = 0;
     return;
@@ -194,6 +196,11 @@ export async function runGhostgetCliProcess(
       process.exitCode = runInterfaceCommand(rawArguments, process.env, resolvedOutput);
       return;
     }
+    if (rawArguments[0] === "menubar") {
+      const { runMenubarCommand } = await import("./control/menubar-cli");
+      process.exitCode = await runMenubarCommand(rawArguments, process.env, resolvedOutput);
+      return;
+    }
   } catch {
     resolvedOutput.stderr("Ghostget gateway-only policy blocks this command, or its policy state is unavailable. Review the native app.\n");
     process.exitCode = 1;

package/src/control/helper.ts

@@ -30,7 +30,7 @@ async function handleAgent(value:unknown,service:ControlService,signal:AbortSign
   throw new Error("invalid action");
 }
 function socketLive(path:string):Promise<boolean> {
-  return new Promise((resolve,reject)=>{const socket=connect({path});const timer=setTimeout(()=>{socket.destroy();reject(new Error("socket state unknown"));},1000);socket.once("connect",()=>{clearTimeout(timer);socket.destroy();resolve(true);});socket.once("error",error=>{clearTimeout(timer);socket.destroy();if((error as NodeJS.ErrnoException).code==="ECONNREFUSED")resolve(false);else reject(new Error("socket state unknown"));});});
+  return new Promise((resolve,reject)=>{const socket=connect({path});const timer=setTimeout(()=>{socket.destroy();reject(new Error("socket state unknown"));},1000);socket.once("connect",()=>{clearTimeout(timer);socket.destroy();resolve(true);});socket.once("error",error=>{clearTimeout(timer);socket.destroy();const code=(error as NodeJS.ErrnoException).code;if(code==="ECONNREFUSED"||code==="ENOENT")resolve(false);else reject(new Error("socket state unknown"));});});
 }
 function acquireOwner(environment:ControlEnvironment):()=>void {
   const directory=join(ghostgetStateHome(environment),"control");ensurePrivateStateDirectory(directory,environment);
@@ -59,7 +59,7 @@ export async function runControlHelper(environment:ControlEnvironment=process.en
       started=true;const work=(async()=>{let response:unknown;try{if(newline!==buffer.length-1)throw new Error();response=await handleAgent(JSON.parse(buffer.subarray(0,newline).toString("utf8")),service!,controller.signal);}catch(error){response=controlFailure(error);}if(!socket.destroyed)socket.end(`${JSON.stringify(response)}\n`);})();active.add(work);void work.then(()=>active.delete(work),()=>{active.delete(work);process.exitCode=1;process.stdin.destroy();});
     });
   });
-  const shutdown=async()=>{if(closing)return;closing=true;for(const socket of clients)socket.destroy();service?.beginShutdown();await Promise.allSettled(active);service?.close();if(server.listening)await new Promise<void>(resolve=>server.close(()=>resolve()));if(ownedSocket!==undefined){snapshotPrivateStateDirectory(directory,environment,directoryIdentity);try{const stat=lstatSync(socketPath);if(stat.isSocket()&&stat.dev===ownedSocket.dev&&stat.ino===ownedSocket.ino)unlinkSync(socketPath);}catch(error){if((error as NodeJS.ErrnoException).code!=="ENOENT")throw error;}}releaseOwner();};
+  const shutdown=async()=>{if(closing)return;closing=true;const closes:Promise<void>[]=[];for(const socket of clients){if(socket.closed)continue;closes.push(new Promise<void>(resolve=>socket.once("close",resolve)));socket.destroy();}await Promise.all(closes);service?.beginShutdown();await Promise.allSettled(active);service?.close();if(server.listening)await new Promise<void>(resolve=>server.close(()=>resolve()));if(ownedSocket!==undefined){snapshotPrivateStateDirectory(directory,environment,directoryIdentity);try{const stat=lstatSync(socketPath);if(stat.isSocket()&&stat.dev===ownedSocket.dev&&stat.ino===ownedSocket.ino)unlinkSync(socketPath);}catch(error){if((error as NodeJS.ErrnoException).code!=="ENOENT")throw error;}}releaseOwner();};
   const termination=()=>{process.stdin.destroy();};process.once("SIGTERM",termination);process.once("SIGINT",termination);
   try {
     if(Buffer.byteLength(socketPath)>100)throw new ControlError("CONTROL_PATH_TOO_LONG","Choose a shorter Ghostget state-home path for the native app.");

package/src/control/web-policy.ts

@@ -50,7 +50,7 @@ export function checkWebRequest(method:"GET"|"HEAD", rawUrl:string, environment:
 export function assertGatewayCommandAllowed(args: readonly string[], environment:ControlEnvironment=process.env): void {
   if(!readWebPolicy(environment).gatewayOnly) return;
   const first=args[0];
-  if(first==="web" || first==="capabilities" || first==="--version" || first==="help" || first==="--help" || first==="-h" || args.length===0) return;
+  if(first==="web" || first==="capabilities" || first==="menubar" || first==="--version" || first==="help" || first==="--help" || first==="-h" || args.length===0) return;
   if((first==="plugin"||first==="plugins") && ["list","show"].includes(args[1]??"")) return;
   throw new ControlError("GATEWAY_ONLY","This state home permits web gateway requests only. Use ghostget web request or change the mode in the native app.");
 }

package/src/providers/x-web-runtime.ts

@@ -153,8 +153,8 @@ const viewerEvidence = Object.freeze({
   operationName: "Viewer",
   operationType: "query" as const,
   queryId: "9t128XgFic52jPUEkJMf6w",
-  sourceChunk: "main.cd39a626fdb81748a.js",
-  observedOn: "2026-09-09",
+  sourceChunk: "main.59435dbf6f40166da.js",
+  observedOn: "2026-09-13",
 });
 
 function isRecord(value: unknown): value is JsonRecord {

package/src/providers/x-web.ts

@@ -246,7 +246,7 @@ export const xWebQueryDescriptorEvidenceSnapshot = Object.freeze({
     { operationName: "HomeLatestTimeline", operationType: "query", queryId: "BLQWpfVqtgBqAqwRRJcJjA", sourceChunk: "shared~bundle.LoggedInMain~bundle.HomeTimeline.c12c8a9a.js", observedOn: "2026-08-20" },
     { operationName: "ListLatestTweetsTimeline", operationType: "query", queryId: "LV64djPRhnsVhGCK76s13w", sourceChunk: "shared~loader.Dock~bundle.BookmarkFolders~bundle.Bookmarks~bundle.Explore~bundle.HomeTimeline~bundle.Notifica.3b894e0a.js" },
     { operationName: "ListRankedTweetsTimeline", operationType: "query", queryId: "dPN7GrkxeMF4SUYCo9D9YA", sourceChunk: "shared~loader.Dock~bundle.BookmarkFolders~bundle.Bookmarks~bundle.Explore~bundle.HomeTimeline~bundle.Notifica.3b894e0a.js" },
-    { operationName: "Bookmarks", operationType: "query", queryId: "tF6KOjmZM0WGcB2Q0mfwhw", sourceChunk: "shared~bundle.BookmarkFolders~bundle.Bookmarks.433463ce78e2afaba.js", observedOn: "2026-09-09" },
+    { operationName: "Bookmarks", operationType: "query", queryId: "tF6KOjmZM0WGcB2Q0mfwhw", sourceChunk: "shared~bundle.BookmarkFolders~bundle.Bookmarks.42881d01aa4e5708a.js", observedOn: "2026-09-13" },
     { operationName: "BookmarkSearchTimeline", operationType: "query", queryId: "SpDsqmz6FfYESd1e7TPcAw", sourceChunk: "main.9929b02a.js" },
     { operationName: "SearchTimeline", operationType: "query", queryId: "hyPfJYJ_XAtDYoslQc-Rgg", sourceChunk: "main.ae82e9d02d3328bba.js", observedOn: "2026-09-06" },
     { operationName: "NotificationsTimeline", operationType: "query", queryId: "dDSNxYH-uWwVo2r3Y5VVqg", sourceChunk: "bundle.Notifications.eea6257a.js" },
@@ -268,7 +268,7 @@ export const xWebQueryDescriptorEvidenceSnapshot = Object.freeze({
     { operationName: "DmAllSearchSlice", operationType: "query", queryId: "zd0F6a_svKAXdlMGbCZDFg", sourceChunk: "bundle.DirectMessages.265735ba.js" },
     { operationName: "DmGroupSearchSlice", operationType: "query", queryId: "LxrvmqF3Lokl_BYZ1c83LA", sourceChunk: "bundle.DirectMessages.265735ba.js" },
     { operationName: "DmPeopleSearchSlice", operationType: "query", queryId: "c1MnRRmI-_Bggpntlq9-hQ", sourceChunk: "bundle.DirectMessages.265735ba.js" },
-    { operationName: "Viewer", operationType: "query", queryId: "9t128XgFic52jPUEkJMf6w", sourceChunk: "main.cd39a626fdb81748a.js", observedOn: "2026-09-09" },
+    { operationName: "Viewer", operationType: "query", queryId: "9t128XgFic52jPUEkJMf6w", sourceChunk: "main.59435dbf6f40166da.js", observedOn: "2026-09-13" },
     { operationName: "UserByScreenName", operationType: "query", queryId: "Gb-d6r0vxPOADdG62OEBpQ", sourceChunk: "main.dd6a5b6a.js", observedOn: "2026-08-21" },
     { operationName: "ArticleEntityDraftCreate", operationType: "mutation", queryId: "btD9FyMDa3_vydVp7fr87Q", sourceChunk: "bundle.TwitterArticles.305538ca.js", observedOn: "2026-08-14" },
     { operationName: "ArticleEntityUpdateContent", operationType: "mutation", queryId: "P5Nc3DYs9D4XqVthNrig8w", sourceChunk: "bundle.TwitterArticles.305538ca.js", observedOn: "2026-08-14" },

package/src/usage.ts

@@ -1,7 +1,7 @@
 /**
  * Static CLI help kept separate from the command implementation graph.
  *
- * The installed entrypoint imports only this module and the static release
+ * The installed entrypoint imports only static help, terminal identity, and release
  * identity for a valid help request, so help remains available even when an
  * optional provider runtime is broken.
  */

package/src/version.ts

@@ -1,2 +1,2 @@
 /** Canonical immutable Ghostget package release identity. */
-export const GHOSTGET_VERSION = "0.18.3" as const;
+export const GHOSTGET_VERSION = "0.18.5" as const;