@ivoryheart/herdr-world-darwin-arm64 0.2.3 → 0.2.5

package/DEPENDENCY_LICENSES.md

@@ -14,22 +14,23 @@ Manifest author metadata is retained here when provided.
 - `@aws-sdk/credential-provider-http@3.972.74` — AWS SDK for JavaScript Team (https://aws.amazon.com/sdk-for-javascript/)
 - `@aws-sdk/credential-provider-login@3.972.79` — AWS SDK for JavaScript Team (https://aws.amazon.com/sdk-for-javascript/)
 - `@aws-sdk/nested-clients@3.997.46` — AWS SDK for JavaScript Team (https://aws.amazon.com/sdk-for-javascript/)
-- `@earendil-works/chord@1.0.2` — Earendil Works
-- `@earendil-works/pi-agent-core@1.0.4` — Mario Zechner
-- `@earendil-works/pi-ai@1.0.2` — Mario Zechner
-- `@earendil-works/pi-ai@1.0.4` — Mario Zechner
-- `@earendil-works/pi-codemode@1.0.4` — Earendil Works
-- `@earendil-works/pi-coding-agent@1.0.2` — Mario Zechner
-- `@earendil-works/pi-durable@1.0.2` — Earendil Works
-- `@earendil-works/pi-mcp@1.0.4` — Earendil Works
-- `@earendil-works/pi-telemetry@1.0.4` — Mario Zechner
-- `@earendil-works/pi-tui@1.0.4` — Mario Zechner
+- `@earendil-works/chord@1.1.0` — Earendil Works
+- `@earendil-works/pi-agent-core@1.2.0` — Mario Zechner
+- `@earendil-works/pi-ai@1.1.0` — Mario Zechner
+- `@earendil-works/pi-ai@1.2.0` — Mario Zechner
+- `@earendil-works/pi-codemode@1.1.0` — Earendil Works
+- `@earendil-works/pi-coding-agent@1.1.0` — Mario Zechner
+- `@earendil-works/pi-durable@1.1.0` — Earendil Works
+- `@earendil-works/pi-mcp@1.2.0` — Earendil Works
+- `@earendil-works/pi-telemetry@1.2.0` — Mario Zechner
+- `@earendil-works/pi-tui@1.2.0` — Mario Zechner
 - `@lobehub/icons-static-svg@1.95.1` — LobeHub <i@lobehub.com>
 - `@pixi/colord@2.9.6` — Vlad Shilov <omgovich@ya.ru>
-- `bun-types@1.4.2`
+- `bun-types@1.4.3`
 - `data-uri-to-buffer@4.0.1` — Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)
 - `http_ece@1.2.0` — Martin Thomson <martin.thomson@gmail.com>
 - `proxy-agent-negotiate@1.1.0` — Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)
+- `qrcode-generator@2.0.4` — Kazuhiko Arase
 - `react-remove-scroll-bar@2.3.8` — Anton Korzunov <thekashey@gmail.com>
 - `saxes@6.0.0` — Louis-Dominique Dubeau <ldd@lddubeau.com>
 - `standardwebhooks@1.1.1` — Standard Webhooks
@@ -1741,6 +1742,22 @@ Sources:
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
 
+### 2a1aeeaa88b5ac43
+
+Sources:
+
+- `unique-names-generator@4.7.1` — `LICENSE`
+
+    MIT License
+
+    Copyright (c) 2018-2022 AndreaSonny <andreasonny83@gmail.com> (https://github.com/andreasonny83)
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 ### 2a5eba72d61bd1ed
 
 Sources:
@@ -4072,7 +4089,7 @@ Sources:
 Sources:
 
 - `@oxc-project/types@0.152.0` — `LICENSE`
-- `oxlint@1.86.0` — `LICENSE`
+- `oxlint@1.87.0` — `LICENSE`
 
     MIT License
 
@@ -5495,7 +5512,7 @@ Sources:
 
 Sources:
 
-- `happy-dom@20.14.5` — `LICENSE`
+- `happy-dom@20.14.6` — `LICENSE`
 
     MIT License
 
@@ -6667,12 +6684,13 @@ Sources:
 - `@codemirror/lang-sql@6.10.0` — `LICENSE`
 - `@codemirror/lang-vue@0.1.3` — `LICENSE`
 - `@codemirror/lang-xml@6.1.0` — `LICENSE`
-- `@codemirror/language@6.12.4` — `LICENSE`
-- `@codemirror/legacy-modes@6.5.4` — `LICENSE`
+- `@codemirror/language@6.13.1` — `LICENSE`
+- `@codemirror/legacy-modes@6.5.5` — `LICENSE`
 - `@codemirror/lint@6.9.7` — `LICENSE`
 - `@codemirror/search@6.7.2` — `LICENSE`
 - `@codemirror/state@6.7.6` — `LICENSE`
-- `@codemirror/view@6.43.13` — `LICENSE`
+- `@codemirror/streamparser@6.0.0` — `LICENSE`
+- `@codemirror/view@6.43.14` — `LICENSE`
 - `codemirror@6.0.2` — `LICENSE`
 
     MIT License
@@ -9647,7 +9665,7 @@ Sources:
 
 Sources:
 
-- `vite@8.3.3` — `LICENSE.md`
+- `vite@8.3.4` — `LICENSE.md`
 
     # Vite core license
     Vite is released under the MIT license:
@@ -12345,7 +12363,6 @@ Sources:
 
 - `undici-types@8.11.2` — `LICENSE`
 - `undici-types@8.3.0` — `LICENSE`
-- `undici@8.10.2` — `LICENSE`
 - `undici@8.11.2` — `LICENSE`
 
     MIT License

package/DEPENDENCY_NOTICES.md

@@ -52,28 +52,29 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | @codemirror/lang-vue | 0.1.3 | MIT |
 | @codemirror/lang-xml | 6.1.0 | MIT |
 | @codemirror/lang-yaml | 6.1.3 | MIT |
-| @codemirror/language | 6.12.4 | MIT |
-| @codemirror/legacy-modes | 6.5.4 | MIT |
+| @codemirror/language | 6.13.1 | MIT |
+| @codemirror/legacy-modes | 6.5.5 | MIT |
 | @codemirror/lint | 6.9.7 | MIT |
 | @codemirror/search | 6.7.2 | MIT |
 | @codemirror/state | 6.7.6 | MIT |
-| @codemirror/view | 6.43.13 | MIT |
+| @codemirror/streamparser | 6.0.0 | MIT |
+| @codemirror/view | 6.43.14 | MIT |
 | @csstools/color-helpers | 6.1.2 | MIT-0 |
 | @csstools/css-calc | 3.4.3 | MIT |
 | @csstools/css-color-parser | 4.2.6 | MIT |
 | @csstools/css-parser-algorithms | 4.0.2 | MIT |
 | @csstools/css-syntax-patches-for-csstree | 1.1.15 | MIT-0 |
 | @csstools/css-tokenizer | 4.0.2 | MIT |
-| @earendil-works/chord | 1.0.2 | MIT |
-| @earendil-works/pi-agent-core | 1.0.4 | MIT |
-| @earendil-works/pi-ai | 1.0.2 | MIT |
-| @earendil-works/pi-ai | 1.0.4 | MIT |
-| @earendil-works/pi-codemode | 1.0.4 | MIT |
-| @earendil-works/pi-coding-agent | 1.0.2 | MIT |
-| @earendil-works/pi-durable | 1.0.2 | MIT |
-| @earendil-works/pi-mcp | 1.0.4 | MIT |
-| @earendil-works/pi-telemetry | 1.0.4 | MIT |
-| @earendil-works/pi-tui | 1.0.4 | MIT |
+| @earendil-works/chord | 1.1.0 | MIT |
+| @earendil-works/pi-agent-core | 1.2.0 | MIT |
+| @earendil-works/pi-ai | 1.1.0 | MIT |
+| @earendil-works/pi-ai | 1.2.0 | MIT |
+| @earendil-works/pi-codemode | 1.1.0 | MIT |
+| @earendil-works/pi-coding-agent | 1.1.0 | MIT |
+| @earendil-works/pi-durable | 1.1.0 | MIT |
+| @earendil-works/pi-mcp | 1.2.0 | MIT |
+| @earendil-works/pi-telemetry | 1.2.0 | MIT |
+| @earendil-works/pi-tui | 1.2.0 | MIT |
 | @exodus/bytes | 1.16.0 | MIT |
 | @fission-ai/openspec | 1.12.0 | MIT |
 | @floating-ui/core | 1.7.5 | MIT |
@@ -236,7 +237,7 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | braces | 3.0.3 | MIT |
 | buffer-equal-constant-time | 1.0.1 | BSD-3-Clause |
 | buffer-image-size | 0.6.4 | MIT |
-| bun-types | 1.4.2 | MIT |
+| bun-types | 1.4.3 | MIT |
 | ccount | 2.0.1 | MIT |
 | chalk | 5.6.2 | MIT |
 | chalk | 6.0.0 | MIT |
@@ -295,7 +296,7 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | google-logging-utils | 1.1.3 | Apache-2.0 |
 | graceful-fs | 4.2.11 | ISC |
 | grok-mermaid | 0.2.3 | Apache-2.0 |
-| happy-dom | 20.14.5 | MIT |
+| happy-dom | 20.14.6 | MIT |
 | hast-util-to-html | 9.0.5 | MIT |
 | hast-util-whitespace | 3.0.0 | MIT |
 | highlight.js | 11.12.0 | BSD-3-Clause |
@@ -359,7 +360,7 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | oniguruma-to-es | 4.3.6 | MIT |
 | openai | 7.19.0 | Apache-2.0 |
 | ora | 9.4.1 | MIT |
-| oxlint | 1.86.0 | MIT |
+| oxlint | 1.87.0 | MIT |
 | p-retry | 4.6.2 | MIT |
 | parse-svg-path | 0.2.0 | MIT |
 | parse5 | 8.0.1 | MIT |
@@ -375,6 +376,7 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | protobufjs | 7.6.6 | BSD-3-Clause |
 | proxy-agent-negotiate | 1.1.0 | MIT |
 | punycode | 2.3.1 | MIT |
+| qrcode-generator | 2.0.4 | MIT |
 | queue-microtask | 1.2.3 | MIT |
 | quickjs-wasi | 3.6.2 | MIT |
 | react-dom | 18.3.1 | MIT |
@@ -426,8 +428,8 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | typescript | 7.0.2 | Apache-2.0 |
 | undici-types | 8.11.2 | MIT |
 | undici-types | 8.3.0 | MIT |
-| undici | 8.10.2 | MIT |
 | undici | 8.11.2 | MIT |
+| unique-names-generator | 4.7.1 | MIT |
 | unist-util-is | 6.0.1 | MIT |
 | unist-util-position | 5.0.0 | MIT |
 | unist-util-stringify-position | 4.0.0 | MIT |
@@ -437,7 +439,7 @@ are reproduced in `DEPENDENCY_LICENSES.md`.
 | use-sidecar | 1.1.3 | MIT |
 | vfile-message | 4.0.3 | MIT |
 | vfile | 6.0.3 | MIT |
-| vite | 8.3.3 | MIT |
+| vite | 8.3.4 | MIT |
 | w3c-keyname | 2.2.8 | MIT |
 | w3c-xmlserializer | 6.0.0 | MIT |
 | web-push | 3.6.7 | MPL-2.0 |

package/LICENSES/HERDR-DROVR-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bassim Shahidy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/THIRD_PARTY_NOTICES.md

@@ -13,6 +13,15 @@ under the MIT License, Copyright (c) 2026 Arthur. The retained MIT terms are in
 [LICENSE](LICENSE).
 Roamgate is source lineage, not a separately installed World dependency.
 
+## herdr-drovr
+
+Town's desk move replays a tab's split layout in the order used by
+[`AVGVSTVS96/herdr-drovr`](https://github.com/AVGVSTVS96/herdr-drovr)
+(`server/src/world/desk-move.ts`): the first pane opens a new tab, then each
+split's second region is carved out of the pane filling it. herdr-drovr is
+licensed under the MIT License, Copyright (c) 2026 Bassim Shahidy. The licence is
+retained in [`LICENSES/HERDR-DROVR-MIT.txt`](LICENSES/HERDR-DROVR-MIT.txt).
+
 ## Claw-Empire character assets
 
 The character sprites under `web/public/world/characters` originate from

package/UPSTREAM.md

@@ -6,22 +6,55 @@ separately installed [`herdrdev/herdr`](https://github.com/herdrdev/herdr) runti
 
 Current synchronization points:
 
-- Roamgate source: main at `d703e6f6b94bdd418186a8daaaea77bceb78d26c`
-  (6 October 2026), including v0.7.15 and subsequent fixes. This synchronization
-  records that exact source head as a Git merge parent; the prior source record
-  was v0.7.11, `b60a1843579311d830e026fb89ab917052fbaee8`.
-- Herdr compatibility: Herdr 0.9.0, terminal protocol 22.
+- Roamgate source: v0.8.5, `5ce1d8d620549226de76321303e7bffa911ae371`
+  (16 October 2026). This integration records the exact head as a Git merge
+  parent, following `503a6f565e3432cee651a456bcc0d9800be52a37`.
+- Herdr compatibility: Herdr 0.9.4, terminal protocol 22. Windows SSH hosts
+  additionally require a running Herdr 0.9.1+ session and Windows PowerShell.
 
 The integration adopts Ranger workspace chat, background and scheduled tasks,
 monitoring alerts, Git commit history and file-preview tabs, tab pinning and
 reordering, pane movement, terminal input/font/upload improvements, instance
-settings, login throttling and mandatory login with 15–1024-character passwords.
+settings, login throttling and mandatory login with 8–1024-character passwords.
 Ranger and uploads are adapted to captured World connection generations.
+The v0.8.1 refresh added structured workspace and agent mentions, quick model
+and thinking controls, custom thinking effort, explicit all-workspace consent in
+High mode, and Open worktree actions. It also fixes terminal composition and
+shortcut identity and adds independently stored session signing keys and
+optional `HERDR_WORLD_PIN` login. World uses Bun 1.4.3 with standard and native
+type checks; its full-check script remains separate from Bun's native checker.
+The v0.8.2 refresh adds Ranger task-management and close previews, reorganized
+settings and chat history, a minimap below compact conversations, and service-owned
+SSH bridges to Windows Herdr sessions. Remote Windows file and Git tools remain
+unavailable; terminal and native Herdr workspace operations retain qualified
+connection ownership.
+
+The v0.8.4 refresh adds installation-management CLI commands, worktree pull-request
+badges, File Explorer mutations and selection, mobile terminal input shortcuts,
+Windows privilege diagnostics, safer workspace paths and atomic file moves,
+and Ranger provider/error handling fixes. The bundled Herdr setup target is 0.9.4.
+CLI configuration and service inspection use World-owned state only.
+
+The v0.8.5 refresh adds a searchable desktop shortcut cheat sheet, readable
+asynchronous workspace/worktree name suggestions and corrected IME positioning
+when terminal cursors are hidden. The owner approved the 8-character password
+minimum; startup retains the recommendation for 15+ characters. The handoff demo
+is attributed as upstream UI, alongside World screenshots. Documentation and local
+checks retain World contracts, navigation, formatting and behavioral verification.
 
 World retains its identity, local/SSH connection ownership, same-origin access,
 session-bound push revocation, aggregate visual views, isolated browser storage,
 and browser regression coverage. World-specific service, packaging, release,
-site and agent tooling remain downstream. Upstream's legacy service migration
+site and agent tooling remain downstream. The v0.8.4 Bun-free plugin installation
+is [adapted and accepted](docs/upstream-follow-ups.md#bun-free-plugin-installation)
+in PR #194: released plugin installation uses native World installers and commands,
+while preserving cached launcher actions, verified standalone archives, npm/Homebrew
+channels, downstream update ownership and explicit Bun source builds.
+Upstream workflow/action changes remain a separately reviewed control divergence.
+The [disposition ledger](upstream/dispositions.json) accounts for every incoming
+commit; [adoption policy](docs/upstream-policy.md) requires human approval of new
+or changed exceptions and reconsideration of outstanding work each source sync.
+Upstream's legacy service migration
 and browser-test removal are excluded; World already checks macOS listener
 conflicts before installing a service. React and React DOM remain on 18.3.1:
 upstream's React 19 upgrade stalls terminal input during World's dense topology
@@ -29,6 +62,9 @@ refresh. Dialog callback freshness is adapted without that dependency upgrade.
 
 Future source refreshes should merge from the recorded upstream head, resolve
 World-specific conflicts explicitly, and update this record and the changelog.
+The opt-in [upstream automation](docs/upstream-automation.md) checks stable
+releases hourly, freezes one target per PR, and separates Codex integration from
+independent revision-bound review and protected merging.
 World does not depend on a separately installed Roamgate process, data directory,
 service, or private API. Ranger is configured within World and uses its own
 workspace permissions and model credentials.

package/bin/herdr-world

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/herdr-world
-size: 91898978 bytes
-sha256: e59ab43967324ce4529fa27df6e557a47def1d08b492d929e76fc1d45a5814d9
+size: 101145458 bytes
+sha256: abbc7376275f479a6ccad638009951db4649ab01cb512b80724fe47893af100c

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ivoryheart/herdr-world-darwin-arm64",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Herdr World binary for darwin-arm64",
   "license": "MIT",
   "os": [