@opencode/browse 0.0.6-dev.17 → 0.0.6-dev.18

package/dist/{cli-b4sbkefj.mjs → cli-z00ttket.mjs}

@@ -8,7 +8,7 @@ import {
   devExtension,
   installCommand,
   autoUpdateStatus
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   defaultPort2,
   isValidSessionId2,
@@ -27,11 +27,17 @@ import {
   ensureExtensionConnected,
   stoppedRelayStatus,
   statusCollections
-} from "./main-3qpkwaa7.mjs";
+} from "./main-jjny7bmm.mjs";
+import"./main-9y22cffn.mjs";
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ppz7sv9s.mjs";
+import {
+  defaultJournalBaseDir,
+  readJournalEntries,
+  formatJournalEntry
+} from "./main-d7rbre73.mjs";
 import {
   addSecret,
   listSecrets,
@@ -43,18 +49,12 @@ import {
   unpair,
   settingKeys,
   formatSettings
-} from "./main-e4stqtf2.mjs";
-import {
-  defaultJournalBaseDir,
-  readJournalEntries,
-  formatJournalEntry
-} from "./main-kvmxefp1.mjs";
+} from "./main-fkhwazsm.mjs";
 import {
   updateJson2,
   formatUpdateNotice2,
   updateNotice2
-} from "./main-4p2p9eey.mjs";
-import"./main-4bht27ry.mjs";
+} from "./main-w5sta7hq.mjs";
 
 // src/cli.ts
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
@@ -211,10 +211,9 @@ var createDoctorReport = Effect2.fn("Doctor.createReport")(function* (options) {
     }
   })));
   const fileExists = (relativePath) => fs.exists(path.join(options.packageRoot, relativePath)).pipe(Effect2.orElseSucceed(() => false));
-  const [packageResult, distCliExists, distMcpExists, currentResult] = yield* Effect2.all([
+  const [packageResult, distCliExists, currentResult] = yield* Effect2.all([
     probe(readPackageInfo),
     fileExists("dist/cli.mjs"),
-    fileExists("dist/cli.mjs"),
     probe(store.read)
   ]);
   const expectedExtensionVersion = packageResult.ok ? { ok: true, value: extensionManifestVersion(packageResult.value.version) } : packageResult;
@@ -248,7 +247,7 @@ var createDoctorReport = Effect2.fn("Doctor.createReport")(function* (options) {
     return session.connected && session.id !== current;
   });
   const artifacts = [
-    { path: "dist/cli.mjs", exists: distCliExists && distMcpExists }
+    { path: "dist/cli.mjs", exists: distCliExists }
   ];
   const checks = buildDoctorChecks({
     packageResult,
@@ -811,7 +810,7 @@ function errorJsonEnvelope(error) {
   return { ok: false, isError: true, text: message, value: null, valueUnavailable: true, error: errorValue, logs: [], warnings: [] };
 }
 var serve = Command.make("serve", {}, Effect3.fn("Cli.serve")(function* () {
-  const [{ startRelay }, { parseAdditionalExtensionOrigins }] = yield* Effect3.promise(() => Promise.all([import("./relay-ns525pms.mjs"), import("./relay-helpers-pjcbxs7p.mjs")]));
+  const [{ startRelay }, { parseAdditionalExtensionOrigins }] = yield* Effect3.promise(() => Promise.all([import("./relay-zs96tkfm.mjs"), import("./relay-helpers-6a2vvzx9.mjs")]));
   const port = yield* portConfig;
   const additionalExtensionOrigins = parseAdditionalExtensionOrigins(yield* extensionOriginsConfig);
   yield* Effect3.scoped(Effect3.gen(function* () {
@@ -1681,7 +1680,7 @@ var settingsSet = Command.make("set", {
 })).pipe(Command.withDescription("Change settings (validated strictly; the extension's options page updates live)"));
 var settings = Command.make("settings").pipe(Command.withDescription("Read or change the user's settings (the extension's options page). Security switches are environment-only"), Command.withSubcommands([settingsGet, settingsSet]));
 var mcp = Command.make("mcp", {}, Effect3.fn("Cli.mcp")(function* () {
-  const { runMcpServer } = yield* Effect3.promise(() => import("./mcp-2smdsn8z.mjs"));
+  const { runMcpServer } = yield* Effect3.promise(() => import("./mcp-qh25n9s0.mjs"));
   yield* runMcpServer;
 })).pipe(Command.withDescription("Run the Browse MCP server over stdio"));
 var opencodeBrowser = Command.make("opencode-browser").pipe(Command.withDescription("Control the user's existing browser through the Browse extension"), Command.withSubcommands([serve, relay, execute, session, tabs, settings, status, network, secrets, deadbolt, recording, flightRecorder, journal, doctor, skill, mcp]));

package/dist/cli.mjs

@@ -2,26 +2,26 @@
 
 // src/main.ts
 import path from "node:path";
-var embeddedVersion = "0.0.6-dev.17";
+var embeddedVersion = "0.0.6-dev.18";
 var setupCommands = new Set(["install", "uninstall", "extension", "pair", "rollback", "set"]);
 var command = process.argv[2];
 var invokedAs = path.basename(process.argv[1] ?? "");
 if (command === "--version" || command === "-v") {
-  const opencodeBrowserVersion = embeddedVersion ?? (await import("./version-wrebjhy7.mjs")).opencodeBrowserVersion;
+  const opencodeBrowserVersion = embeddedVersion ?? (await import("./version-6g6gtnra.mjs")).opencodeBrowserVersion;
   process.stdout.write(`${opencodeBrowserVersion}
 `);
-} else if (invokedAs === "opencode-browser-mcp") {
+} else if (invokedAs === "opencode-browser-mcp" || command === "mcp" && process.argv.length === 3) {
   const { NodeRuntime } = await import("@effect/platform-node");
-  const { runMcpServer } = await import("./mcp-2smdsn8z.mjs");
+  const { runMcpServer } = await import("./mcp-qh25n9s0.mjs");
   runMcpServer.pipe(NodeRuntime.runMain);
 } else if (command === "runtime-install" || command === "runtime-switch") {
-  const { runRuntimeInstall, runRuntimeSwitch } = await import("./runtime-update-0mddkfy5.mjs");
+  const { runRuntimeInstall, runRuntimeSwitch } = await import("./runtime-update-8wte78jj.mjs");
   await (command === "runtime-install" ? runRuntimeInstall : runRuntimeSwitch)(process.argv.slice(3));
 } else if (command === "update") {
-  const { runUpdateCommand } = await import("./update-cyy1grjj.mjs");
+  const { runUpdateCommand } = await import("./update-st5c8grg.mjs");
   await runUpdateCommand(process.argv.slice(3));
 } else if (command && setupCommands.has(command)) {
-  const { runSetup } = await import("./setup-f2qjnvre.mjs");
+  const { runSetup } = await import("./setup-cqjdfcy0.mjs");
   await runSetup(command, process.argv.slice(3));
 } else {
   if (!command || command === "--help" || command === "-h") {
@@ -55,9 +55,9 @@ if (command === "--version" || command === "-v") {
 `);
   }
   if (command === "status" && !process.argv.includes("--json")) {
-    const { printSetupStatus } = await import("./setup-f2qjnvre.mjs");
+    const { printSetupStatus } = await import("./setup-cqjdfcy0.mjs");
     printSetupStatus();
   }
-  const { runCli } = await import("./cli-b4sbkefj.mjs");
+  const { runCli } = await import("./cli-z00ttket.mjs");
   runCli();
 }

package/dist/{main-zwe0c783.mjs → main-0egy8naa.mjs}

@@ -1,11 +1,11 @@
 import {
-  ensurePrivateDirectory
-} from "./main-4bht27ry.mjs";
+  writePrivateJsonFileSync
+} from "./main-9y22cffn.mjs";
 import {
   dataRoot,
   devExtensionUrl,
   devExtensionFolder
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 
 // src/browser-pairing.ts
 import crypto from "node:crypto";
@@ -45,7 +45,7 @@ function writePendingCodes(root, pending) {
     fs.rmSync(pairingCodesPath(root), { force: true });
     return;
   }
-  writePrivateJson(pairingCodesPath(root), pending);
+  writePrivateJsonFileSync(pairingCodesPath(root), pending, { ensureParent: true });
 }
 function mintPairingCode(root = dataRoot(), options = {}) {
   const now = options.now ?? Date.now();
@@ -71,7 +71,7 @@ function recordPairingFailure(root = dataRoot(), now = Date.now()) {
   return exhausted && pending.codes.length > 0;
 }
 function writeExtensionPairing(extensionDirectory, code) {
-  writePrivateJson(path.join(extensionDirectory, extensionPairingFileName), { code });
+  writePrivateJsonFileSync(path.join(extensionDirectory, extensionPairingFileName), { code });
 }
 function readBrowserPairings(root = dataRoot()) {
   try {
@@ -84,8 +84,7 @@ function readBrowserPairings(root = dataRoot()) {
   }
 }
 function writeBrowserPairings(root, pairings) {
-  ensurePrivateDirectory(root);
-  writePrivateJson(browserTokensPath(root), pairings);
+  writePrivateJsonFileSync(browserTokensPath(root), pairings, { ensureParent: true });
 }
 function browserToken(key, root = dataRoot()) {
   return readBrowserPairings(root)[key]?.token;
@@ -155,12 +154,6 @@ function wrapToken(sessionKey, token) {
   const mask = crypto.createHmac("sha256", sessionKey).update(`${context}|wrap`).digest();
   return Buffer.from(Buffer.from(token, "base64url").map((byte, index) => byte ^ mask[index])).toString("base64url");
 }
-function writePrivateJson(file, value) {
-  const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-  fs.renameSync(temporary, file);
-}
 
 // src/dev-extension.ts
 import { createHash } from "node:crypto";
@@ -299,12 +292,7 @@ function readRelayConfig(root = dataRoot()) {
   }
 }
 function writeRelayConfig(config, root = dataRoot()) {
-  fs2.mkdirSync(root, { recursive: true, mode: 448 });
-  const file = relayConfigPath(root);
-  const temporary = `${file}.${process.pid}.tmp`;
-  fs2.writeFileSync(temporary, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-  fs2.renameSync(temporary, file);
+  writePrivateJsonFileSync(relayConfigPath(root), config, { ensureParent: true });
 }
 var relayHostname = (root = dataRoot()) => readRelayConfig(root).hostname ?? "127.0.0.1";
 function isLocalPeer(socket) {

package/dist/main-9y22cffn.mjs

@@ -0,0 +1,130 @@
+import {
+  dataRoot
+} from "./main-ha5bnd77.mjs";
+
+// src/relay-secrets.ts
+import crypto2 from "node:crypto";
+import fs2 from "node:fs";
+import path2 from "node:path";
+
+// src/fs-durability.ts
+import { Predicate } from "effect";
+import crypto from "node:crypto";
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+var unsupportedDirectorySyncCodes = new Set(["EPERM", "EINVAL", "ENOTSUP"]);
+function isNodeError(error) {
+  return error instanceof Error && "code" in error;
+}
+function isUnsupportedDirectorySyncError(error) {
+  return isNodeError(error) && Predicate.isString(error.code) && unsupportedDirectorySyncCodes.has(error.code);
+}
+async function writeJsonFileAtomically(filePath, value, options = {}) {
+  const directory = path.dirname(filePath);
+  await fs.mkdir(directory, {
+    recursive: true,
+    ...options.dirMode === undefined ? {} : { mode: options.dirMode }
+  });
+  if (options.dirMode !== undefined) {
+    await fs.chmod(directory, options.dirMode);
+  }
+  const temporaryPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  let renamed = false;
+  try {
+    await fs.writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+    await fs.rename(temporaryPath, filePath);
+    renamed = true;
+    await fs.chmod(filePath, 384);
+  } finally {
+    if (!renamed)
+      await fs.rm(temporaryPath, { force: true }).catch(() => {});
+  }
+}
+function ensurePrivateDirectorySync(directory) {
+  fsSync.mkdirSync(directory, { recursive: true, mode: 448 });
+  if (process.platform !== "win32")
+    fsSync.chmodSync(directory, 448);
+}
+function writePrivateJsonFileSync(filePath, value, options = {}) {
+  if (options.ensureParent)
+    ensurePrivateDirectorySync(path.dirname(filePath));
+  const temporaryPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  let renamed = false;
+  try {
+    fsSync.writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+    fsSync.renameSync(temporaryPath, filePath);
+    renamed = true;
+    if (process.platform !== "win32")
+      fsSync.chmodSync(filePath, 384);
+  } finally {
+    if (!renamed)
+      fsSync.rmSync(temporaryPath, { force: true });
+  }
+}
+
+// src/relay-secrets.ts
+var relayTokenQueryParam = "opencodeBrowserToken";
+var tokenPattern = /^[A-Za-z0-9_-]{43}$/;
+function relayTokenPath(root = dataRoot()) {
+  return path2.join(root, "relay-token");
+}
+function relayToken(root = dataRoot()) {
+  return readOrCreateSecret(relayTokenPath(root), () => crypto2.randomBytes(32).toString("base64url"), (value) => tokenPattern.test(value));
+}
+function relayAuthorization(root = dataRoot()) {
+  return `Bearer ${relayToken(root)}`;
+}
+function secretsEqual(expected, actual) {
+  if (actual === undefined)
+    return false;
+  const a = crypto2.createHash("sha256").update(expected).digest();
+  const b = crypto2.createHash("sha256").update(actual).digest();
+  return crypto2.timingSafeEqual(a, b) && expected.length === actual.length;
+}
+function readOrCreateSecret(file, generate, valid) {
+  const existing = readSecret(file);
+  if (existing !== undefined && valid(existing))
+    return existing;
+  ensurePrivateDirectory(path2.dirname(file));
+  const temporary = `${file}.${process.pid}.${crypto2.randomUUID()}.tmp`;
+  fs2.writeFileSync(temporary, `${generate()}
+`, { mode: 384 });
+  try {
+    if (existing === undefined) {
+      try {
+        fs2.linkSync(temporary, file);
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+    } else {
+      fs2.renameSync(temporary, file);
+    }
+  } finally {
+    fs2.rmSync(temporary, { force: true });
+  }
+  const created = readSecret(file);
+  if (created === undefined || !valid(created))
+    throw new Error(`Could not create ${file}`);
+  return created;
+}
+function readSecret(file) {
+  try {
+    const stat = fs2.statSync(file);
+    if (process.platform !== "win32" && (stat.mode & 63) !== 0)
+      fs2.chmodSync(file, 384);
+    return fs2.readFileSync(file, "utf8").trim();
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+}
+function ensurePrivateDirectory(directory = dataRoot()) {
+  ensurePrivateDirectorySync(directory);
+}
+
+export { isNodeError, isUnsupportedDirectorySyncError, writeJsonFileAtomically, ensurePrivateDirectorySync, writePrivateJsonFileSync, relayTokenQueryParam, relayToken, relayAuthorization, secretsEqual, ensurePrivateDirectory };

package/dist/{main-kvmxefp1.mjs → main-d7rbre73.mjs}

@@ -1,12 +1,12 @@
 import {
   isNodeError
-} from "./main-e4stqtf2.mjs";
+} from "./main-9y22cffn.mjs";
 import {
   dataRoot
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   isValidSessionId2
-} from "./main-3qpkwaa7.mjs";
+} from "./main-jjny7bmm.mjs";
 
 // src/session-journal.ts
 import fs from "node:fs";

package/dist/{main-e4stqtf2.mjs → main-fkhwazsm.mjs}

@@ -1,19 +1,23 @@
+import {
+  isNodeError,
+  writeJsonFileAtomically
+} from "./main-9y22cffn.mjs";
 import {
   dataRoot,
   cliCommand
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 
 // src/site-secrets.ts
-import crypto2 from "node:crypto";
-import fs3 from "node:fs/promises";
-import path3 from "node:path";
+import crypto from "node:crypto";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
 import { Effect as Effect2, Schema as Schema2 } from "effect";
 
 // src/auth-profile.ts
 import { Effect, Schema, Semaphore } from "effect";
 import { spawn } from "node:child_process";
-import fs2 from "node:fs/promises";
-import path2 from "node:path";
+import fs from "node:fs/promises";
+import path from "node:path";
 
 // src/child-process.ts
 async function terminateChildProcess(options) {
@@ -45,43 +49,8 @@ function signalChildProcess(child, signal) {
   child.kill(signal);
 }
 
-// src/fs-durability.ts
-import { Predicate } from "effect";
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import path from "node:path";
-var unsupportedDirectorySyncCodes = new Set(["EPERM", "EINVAL", "ENOTSUP"]);
-function isNodeError(error) {
-  return error instanceof Error && "code" in error;
-}
-function isUnsupportedDirectorySyncError(error) {
-  return isNodeError(error) && Predicate.isString(error.code) && unsupportedDirectorySyncCodes.has(error.code);
-}
-async function writeJsonFileAtomically(filePath, value, options = {}) {
-  const directory = path.dirname(filePath);
-  await fs.mkdir(directory, {
-    recursive: true,
-    ...options.dirMode === undefined ? {} : { mode: options.dirMode }
-  });
-  if (options.dirMode !== undefined) {
-    await fs.chmod(directory, options.dirMode);
-  }
-  const temporaryPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  let renamed = false;
-  try {
-    await fs.writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-    await fs.rename(temporaryPath, filePath);
-    renamed = true;
-    await fs.chmod(filePath, 384);
-  } finally {
-    if (!renamed)
-      await fs.rm(temporaryPath, { force: true }).catch(() => {});
-  }
-}
-
 // src/network-redaction.ts
-import { Predicate as Predicate2 } from "effect";
+import { Predicate } from "effect";
 var secretNamePattern = /auth(?:orization)?|cookie|credential|csrf|xsrf|token|secret|session|password|passwd|pwd|passcode|otp|(?:^|[-_.])code(?:$|[-_.])|(?:api|access|refresh)[-_.]?key|signature|(?:^|[-_.])sig(?:$|[-_.])/i;
 var oneTimeFieldPattern = /pass(?:word|wd|code|phrase)|(?:^|[-_.])pwd(?:$|[-_.])|otp|totp|(?:^|[-_.])(?:mfa_?|2fa_?|verification_?|auth_?)?code(?:$|[-_.])|(?:^|[-_.])pin(?:$|[-_.])/i;
 var referencePattern = String.raw`BC_(?:SECRET|REDACTED)_\d+`;
@@ -188,7 +157,7 @@ class SecretCollector {
     return redactKnownValue(value, this.redactionSlots());
   }
   redactExactValue(value, minimumLength) {
-    if (!Predicate2.isString(value) && !Predicate2.isNumber(value) && !Predicate2.isBoolean(value))
+    if (!Predicate.isString(value) && !Predicate.isNumber(value) && !Predicate.isBoolean(value))
       return value;
     const serialized = String(value);
     if (serialized.length < minimumLength)
@@ -279,7 +248,7 @@ class SecretCollector {
     if (Array.isArray(value)) {
       return value.map((item, index) => this.protectJson(item, location, [...path, String(index)], inSecret));
     }
-    if (Predicate2.isObject(value)) {
+    if (Predicate.isObject(value)) {
       return Object.fromEntries(Object.entries(value).map(([key, item]) => [
         key,
         this.protectJson(item, location, [...path, key], inSecret || secretNamePattern.test(key))
@@ -473,15 +442,15 @@ function redactKnownValues(text, slots) {
   return [...slots].sort((left, right) => right.value.length - left.value.length).reduce((output, slot) => replaceOutsideReferences(output, slot.value, `\${${slot.ref}}`), text);
 }
 function redactKnownValue(value, slots) {
-  if (Predicate2.isString(value))
+  if (Predicate.isString(value))
     return redactKnownValues(value, slots);
-  if (Predicate2.isNumber(value) || Predicate2.isBoolean(value)) {
+  if (Predicate.isNumber(value) || Predicate.isBoolean(value)) {
     const slot = slots.find((candidate) => candidate.value === String(value));
     return slot ? `\${${slot.ref}}` : value;
   }
   if (Array.isArray(value))
     return value.map((item) => redactKnownValue(item, slots));
-  if (!Predicate2.isObject(value))
+  if (!Predicate.isObject(value))
     return value;
   return Object.fromEntries(Object.entries(value).map(([key, item]) => [
     key,
@@ -491,7 +460,7 @@ function redactKnownValue(value, slots) {
 function redactSecretValue(value) {
   if (Array.isArray(value))
     return value.map(redactSecretValue);
-  if (Predicate2.isObject(value)) {
+  if (Predicate.isObject(value)) {
     return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactSecretValue(item)]));
   }
   return value === null || value === "" ? value : "[REDACTED]";
@@ -516,7 +485,7 @@ function jwtExpiration(value) {
     return;
   try {
     const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    return Predicate2.isNumber(payload.exp) ? new Date(payload.exp * 1000).toISOString() : undefined;
+    return Predicate.isNumber(payload.exp) ? new Date(payload.exp * 1000).toISOString() : undefined;
   } catch {
     return;
   }
@@ -550,7 +519,7 @@ class AuthProfileError extends Schema.TaggedError()("AuthProfile.Error", {
   cause: Schema.optionalKey(Schema.Defect())
 }) {
 }
-var defaultBaseDir = () => path2.join(dataRoot(), "secrets");
+var defaultBaseDir = () => path.join(dataRoot(), "secrets");
 var writeLock = Semaphore.makeUnsafe(1);
 var profileLockTimeoutMs = 30000;
 var staleProfileLockMs = 60000;
@@ -559,7 +528,7 @@ var maximumTimeoutMs = 2147483647;
 var read = Effect.fn("AuthProfile.read")(function* (name, options = {}) {
   const filePath = yield* profilePath(options.baseDir ?? defaultBaseDir(), name);
   const text = yield* Effect.tryPromise({
-    try: () => fs2.readFile(filePath, "utf8"),
+    try: () => fs.readFile(filePath, "utf8"),
     catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new AuthProfileError({ message: `Auth profile not found: ${name}`, operation: "read", reason: "not-found", cause }) : new AuthProfileError({ message: `Could not read auth profile: ${name}`, operation: "read", reason: "read-failed", cause })
   });
   return yield* Schema.decodeUnknownEffect(StoredAuthProfile)(yield* Effect.try({
@@ -577,12 +546,12 @@ function withLock(name, options, effect) {
     const lockPath = `${filePath}.lock`;
     yield* Effect.tryPromise({
       try: async () => {
-        await fs2.mkdir(baseDir, { recursive: true, mode: 448 });
-        await fs2.chmod(baseDir, 448);
+        await fs.mkdir(baseDir, { recursive: true, mode: 448 });
+        await fs.chmod(baseDir, 448);
         const deadline = Date.now() + profileLockTimeoutMs;
         while (true) {
           try {
-            const handle = await fs2.open(lockPath, "wx", 384);
+            const handle = await fs.open(lockPath, "wx", 384);
             let written = false;
             try {
               await handle.writeFile(`${process.pid}
@@ -591,17 +560,17 @@ function withLock(name, options, effect) {
             } finally {
               await handle.close();
               if (!written)
-                await fs2.unlink(lockPath).catch(() => {});
+                await fs.unlink(lockPath).catch(() => {});
             }
             return;
           } catch (cause) {
             if (!isNodeError(cause) || cause.code !== "EEXIST")
               throw cause;
-            const stat = await fs2.stat(lockPath).catch(() => {
+            const stat = await fs.stat(lockPath).catch(() => {
               return;
             });
             if (stat && Date.now() - stat.mtimeMs > staleProfileLockMs) {
-              await fs2.unlink(lockPath).catch(() => {});
+              await fs.unlink(lockPath).catch(() => {});
               continue;
             }
             if (Date.now() >= deadline)
@@ -615,7 +584,7 @@ function withLock(name, options, effect) {
     return lockPath;
   });
   return Effect.acquireUseRelease(acquire, () => effect, (lockPath) => Effect.tryPromise({
-    try: () => fs2.unlink(lockPath).catch(() => {}).then(() => {}),
+    try: () => fs.unlink(lockPath).catch(() => {}).then(() => {}),
     catch: (cause) => new AuthProfileError({ message: `Could not release auth profile lock: ${name}`, operation: "lock", reason: "write-failed", cause })
   }));
 }
@@ -701,7 +670,7 @@ function summary(profile) {
   };
 }
 function profilePath(baseDir, name) {
-  return /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name) ? Effect.succeed(path2.join(baseDir, `${name}.json`)) : Effect.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
+  return /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name) ? Effect.succeed(path.join(baseDir, `${name}.json`)) : Effect.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
 }
 function sameSlots(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
@@ -1018,10 +987,10 @@ class SiteSecretError extends Schema2.TaggedError()("SiteSecret.Error", {
   cause: Schema2.optionalKey(Schema2.Defect())
 }) {
 }
-var defaultSiteSecretsDir = () => path3.join(dataRoot(), "site-secrets");
+var defaultSiteSecretsDir = () => path2.join(dataRoot(), "site-secrets");
 var namePattern = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 function secretPath(baseDir, name) {
-  return namePattern.test(name) ? Effect2.succeed(path3.join(baseDir, `${name}.json`)) : Effect2.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
+  return namePattern.test(name) ? Effect2.succeed(path2.join(baseDir, `${name}.json`)) : Effect2.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
 }
 function summary2(secret) {
   return { name: secret.name, kind: secret.kind, allowedOrigins: [...secret.allowedOrigins], createdAt: secret.createdAt, updatedAt: secret.updatedAt };
@@ -1029,7 +998,7 @@ function summary2(secret) {
 var readSecret = Effect2.fn("SiteSecrets.read")(function* (name, options = {}) {
   const filePath = yield* secretPath(options.baseDir ?? defaultSiteSecretsDir(), name);
   const text = yield* Effect2.tryPromise({
-    try: () => fs3.readFile(filePath, "utf8"),
+    try: () => fs2.readFile(filePath, "utf8"),
     catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new SiteSecretError({ message: `Secret not found: ${name}. Ask the user to add it with \`opencode-browser secrets add ${name} --origin <origin>\`.`, reason: "not-found" }) : new SiteSecretError({ message: `Could not read secret ${name}`, reason: "read-failed", cause })
   });
   return yield* Effect2.try({
@@ -1071,7 +1040,7 @@ var addSecret = Effect2.fn("SiteSecrets.add")(function* (options) {
 var listSecrets = Effect2.fn("SiteSecrets.list")(function* (options = {}) {
   const baseDir = options.baseDir ?? defaultSiteSecretsDir();
   const names = yield* Effect2.tryPromise({
-    try: () => fs3.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
+    try: () => fs2.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
     catch: (cause) => new SiteSecretError({ message: "Could not list secrets", reason: "read-failed", cause })
   });
   const secrets = [];
@@ -1086,7 +1055,7 @@ var removeSecret = Effect2.fn("SiteSecrets.remove")(function* (name, options = {
   const baseDir = options.baseDir ?? defaultSiteSecretsDir();
   const filePath = yield* secretPath(baseDir, name);
   return yield* withLock(name, { baseDir }, Effect2.tryPromise({
-    try: () => fs3.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
+    try: () => fs2.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
     catch: (cause) => new SiteSecretError({ message: `Could not remove secret ${name}`, reason: "write-failed", cause })
   })).pipe(Effect2.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
 });
@@ -1128,7 +1097,7 @@ function totpCode(seed, now = Date.now()) {
   const { key, digits, period, algorithm } = totpParameters(seed);
   const counter = Buffer.alloc(8);
   counter.writeBigUInt64BE(BigInt(Math.floor(now / 1000 / period)));
-  const hmac = crypto2.createHmac(algorithm, key).update(counter).digest();
+  const hmac = crypto.createHmac(algorithm, key).update(counter).digest();
   const offset = hmac[hmac.length - 1] & 15;
   const binary = (hmac.readUInt32BE(offset) & 2147483647) % 10 ** digits;
   return String(binary).padStart(digits, "0");
@@ -1139,11 +1108,11 @@ function secretText(secret) {
 
 // src/deadbolt.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
-import crypto3 from "node:crypto";
-import fs4 from "node:fs";
+import crypto2 from "node:crypto";
+import fs3 from "node:fs";
 import net2 from "node:net";
 import os from "node:os";
-import path4 from "node:path";
+import path3 from "node:path";
 class DeadboltError extends Error {
   name = "DeadboltError";
   code;
@@ -1156,16 +1125,16 @@ class DeadboltError extends Error {
 }
 var clientFileName = "deadbolt-client.json";
 function clientFilePath(root = dataRoot()) {
-  return path4.join(root, clientFileName);
+  return path3.join(root, clientFileName);
 }
 function readClientFile(root = dataRoot()) {
   let text;
   try {
     const file = clientFilePath(root);
-    const stat = fs4.statSync(file);
+    const stat = fs3.statSync(file);
     if (process.platform !== "win32" && (stat.mode & 63) !== 0)
-      fs4.chmodSync(file, 384);
-    text = fs4.readFileSync(file, "utf8");
+      fs3.chmodSync(file, 384);
+    text = fs3.readFileSync(file, "utf8");
   } catch {
     return;
   }
@@ -1193,9 +1162,9 @@ async function saveClient(client, root = dataRoot()) {
 }
 function removeClient(root = dataRoot()) {
   const file = clientFilePath(root);
-  if (!fs4.existsSync(file))
+  if (!fs3.existsSync(file))
     return false;
-  fs4.rmSync(file, { force: true });
+  fs3.rmSync(file, { force: true });
   return true;
 }
 function computedSocketPath(env = process.env) {
@@ -1204,13 +1173,13 @@ function computedSocketPath(env = process.env) {
   const suffix = deadboltHome ? `-${blake3Hex(Buffer.from(deadboltHome, "utf8")).slice(0, 8)}` : "";
   const uid = typeof process.getuid === "function" ? process.getuid() : 0;
   const runtime = nonEmpty("XDG_RUNTIME_DIR") ?? userRuntimeDir(uid);
-  const directory = runtime ? path4.join(runtime, `deadbolt${suffix}`) : path4.join(nonEmpty("TMPDIR") ?? os.tmpdir(), `deadbolt${suffix}-${uid}`);
-  return path4.join(directory, "agent.sock");
+  const directory = runtime ? path3.join(runtime, `deadbolt${suffix}`) : path3.join(nonEmpty("TMPDIR") ?? os.tmpdir(), `deadbolt${suffix}-${uid}`);
+  return path3.join(directory, "agent.sock");
 }
 function userRuntimeDir(uid) {
   const directory = `/run/user/${uid}`;
   try {
-    const stat = fs4.statSync(directory);
+    const stat = fs3.statSync(directory);
     return stat.isDirectory() && stat.uid === uid ? directory : undefined;
   } catch {
     return;
@@ -1519,7 +1488,7 @@ function isBase64Url(value, maxLength = 8192) {
   return typeof value === "string" && value.length <= maxLength && /^[A-Za-z0-9_-]*$/.test(value);
 }
 function randomName(prefix) {
-  return `${prefix}${crypto3.randomBytes(12).toString("hex")}`;
+  return `${prefix}${crypto2.randomBytes(12).toString("hex")}`;
 }
 var blake3Iv = [1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225];
 var blake3Permutation = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
@@ -1695,4 +1664,4 @@ function formatSettings(settings) {
   });
 }
 
-export { terminateChildProcess, isNodeError, isUnsupportedDirectorySyncError, writeJsonFileAtomically, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText, DeadboltError, readClient, socketPath, connect, parseDeadboltName, originOnSite, pickLogin, originsFromPatterns, listLogins, pickPasskey, pair, unpair, isBase64Url, randomName, settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings };
+export { terminateChildProcess, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText, DeadboltError, readClient, socketPath, connect, parseDeadboltName, originOnSite, pickLogin, originsFromPatterns, listLogins, pickPasskey, pair, unpair, isBase64Url, randomName, settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings };

package/dist/{main-g5mke6rn.mjs → main-ha5bnd77.mjs}

@@ -147,7 +147,7 @@ function storeConfig(env = process.env, baked = { id: "mfnicocicmmlkpjnaffgihfjh
   return id ? { id } : {};
 }
 var RELEASE_SERVICE = "https://anoma.ly/release";
-function devExtension(baked = { file: "browse-extension-0.0.6-dev.17.zip", sha256: "8bf258faf0bd4ea3e14dc6fa69efc1c553b8490f22bc7883e9016673521169d3", size: 38398 }) {
+function devExtension(baked = { file: "browse-extension-0.0.6-dev.18.zip", sha256: "2f8f69b9022f9835f564f96ccc5fd07c48ad78e95488eeb2a83f253d8fafbb49", size: 38413 }) {
   return baked && /^[0-9a-f]{64}$/.test(baked.sha256) && /^[\w.-]+\.zip$/.test(baked.file) ? baked : undefined;
 }
 var devExtensionUrl = (extension, env = process.env) => `${(env.OPENCODE_BROWSER_RELEASE_SERVICE || RELEASE_SERVICE).replace(/\/+$/, "")}/browse/files/${extension.sha256}/${extension.file}`;
@@ -728,4 +728,4 @@ function spawnRuntimeChild(layout, entry, args, onExit, env = process.env) {
   }
 }
 
-export { extensionProtocolVersion, minExtensionProtocolVersion, unpackedExtensionId, unpackedReloadAdvice, checkoutReloadPrefix, extensionReconnectAlarmPeriodMs, extensionProtocolCompatibility, extensionProtocolSkew, extensionProtocolAdvice, makePageStatus, parseJsonObject, isCdpRequest, isExtensionResponse, isExtensionEvent, isJsonObject, dataRoot, oldStoreMarker, fromCheckout, checkoutRoot, cliCommand, storeConfig, devExtension, devExtensionUrl, devExtensionFolder, storeUrl, installCommand, autoUpdateModes, runtimeLayout, versionEntry, channelOf, UPDATE_VERSION, compareVersions, readCurrent, writeCurrent, readState, updateState, npmRuntime, autoUpdateOverride, storedMode, setStoredMode, autoUpdateStatus, describeAutoUpdate, registryUrl, fetchPublished, installVersion, pruneVersions, switchVersion, createAutoUpdater };
+export { extensionProtocolVersion, minExtensionProtocolVersion, unpackedExtensionId, unpackedReloadAdvice, checkoutReloadPrefix, extensionReconnectAlarmPeriodMs, extensionProtocolCompatibility, extensionProtocolSkew, extensionProtocolAdvice, makePageStatus, parseJsonObject, isCdpRequest, isExtensionResponse, isExtensionEvent, isJsonObject, dataRoot, oldStoreMarker, fromCheckout, checkoutRoot, cliCommand, storeConfig, devExtension, devExtensionUrl, devExtensionFolder, storeUrl, installCommand, autoUpdateModes, runtimeLayout, versionEntry, channelOf, UPDATE_VERSION, compareVersions, readCurrent, writeCurrent, updateState, npmRuntime, autoUpdateOverride, storedMode, effectiveMode, setStoredMode, autoUpdateStatus, describeAutoUpdate, registryUrl, fetchPublished, installVersion, pruneVersions, switchVersion, createAutoUpdater };

package/dist/{main-3qpkwaa7.mjs → main-jjny7bmm.mjs}

@@ -6,13 +6,13 @@ import {
   cliCommand,
   installCommand,
   npmRuntime
-} from "./main-g5mke6rn.mjs";
-import {
-  opencodeBrowserBuildId2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   relayAuthorization
-} from "./main-4bht27ry.mjs";
+} from "./main-9y22cffn.mjs";
+import {
+  opencodeBrowserBuildId2
+} from "./main-ppz7sv9s.mjs";
 
 // src/relay-helpers.ts
 import crypto from "node:crypto";
@@ -1408,7 +1408,7 @@ function managedRelayLaunch(entrypoint = loadedCliEntrypoint, executable = proce
 }
 function managedRelayEntrypoint(entrypoint) {
   const name = path.basename(entrypoint);
-  if (name === "mcp-main.ts" || name === "index.ts" || name === "opencode-browser-client.ts" || name === "cli.ts")
+  if (name === "index.ts" || name === "opencode-browser-client.ts" || name === "cli.ts")
     return path.join(path.dirname(entrypoint), "main.ts");
   return entrypoint;
 }

package/dist/main-ppz7sv9s.mjs

@@ -0,0 +1,4 @@
+// src/version.ts
+var opencodeBrowserVersion2 = "0.0.6-dev.18";
+var opencodeBrowserBuildId2 = "2026-11-04T14:16:07.180Z";
+export { opencodeBrowserVersion2, opencodeBrowserBuildId2 };

package/dist/{main-4p2p9eey.mjs → main-w5sta7hq.mjs}

@@ -6,7 +6,7 @@ import {
   compareVersions,
   npmRuntime,
   autoUpdateStatus
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 
 // src/update.ts
 import { execFile, spawnSync } from "node:child_process";
@@ -312,7 +312,7 @@ function runUpdate(args, deps) {
 async function runUpdateCommand2(args) {
   const log = (line) => process.stdout.write(line + `
 `);
-  const { runNpmUpdate } = await import("./runtime-update-0mddkfy5.mjs");
+  const { runNpmUpdate } = await import("./runtime-update-8wte78jj.mjs");
   if (await runNpmUpdate(args))
     return;
   if (args.includes("--check")) {

package/dist/{mcp-2smdsn8z.mjs → mcp-qh25n9s0.mjs}

@@ -1,6 +1,6 @@
 import {
   autoUpdateStatus
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   parseTargetSelection2,
   getObject2,
@@ -10,22 +10,22 @@ import {
   relayBuildProblem,
   ensureRelay,
   ensureExtensionConnected
-} from "./main-3qpkwaa7.mjs";
+} from "./main-jjny7bmm.mjs";
+import"./main-9y22cffn.mjs";
 import {
   opencodeBrowserVersion2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ppz7sv9s.mjs";
 import {
   listSecrets,
   readClient,
   settingKeys,
   settingSpecs,
   securityVariables
-} from "./main-e4stqtf2.mjs";
+} from "./main-fkhwazsm.mjs";
 import {
   updateJson2,
   createUpdateWatcher2
-} from "./main-4p2p9eey.mjs";
-import"./main-4bht27ry.mjs";
+} from "./main-w5sta7hq.mjs";
 
 // src/mcp.ts
 import { NodeStdio } from "@effect/platform-node";

package/dist/{relay-helpers-pjcbxs7p.mjs → relay-helpers-6a2vvzx9.mjs}

@@ -31,7 +31,7 @@ import {
   isRestrictedTarget2,
   isRestrictedUrl2,
   dataUrlDocument2
-} from "./main-3qpkwaa7.mjs";
+} from "./main-jjny7bmm.mjs";
 export {
   HttpRouteError2 as HttpRouteError,
   chromeExtensionOriginForPath2 as chromeExtensionOriginForPath,

package/dist/{relay-ns525pms.mjs → relay-zs96tkfm.mjs}

@@ -25,7 +25,7 @@ import {
   setStoredMode,
   autoUpdateStatus,
   createAutoUpdater
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   ExecuteRequest,
   SessionAdoptRequest,
@@ -75,7 +75,18 @@ import {
   isRestrictedTarget2,
   isRestrictedUrl2,
   dataUrlDocument2
-} from "./main-3qpkwaa7.mjs";
+} from "./main-jjny7bmm.mjs";
+import {
+  isNodeError,
+  isUnsupportedDirectorySyncError,
+  writeJsonFileAtomically,
+  ensurePrivateDirectorySync,
+  writePrivateJsonFileSync,
+  relayTokenQueryParam,
+  relayToken,
+  secretsEqual,
+  ensurePrivateDirectory
+} from "./main-9y22cffn.mjs";
 import {
   context,
   pendingPairingCodeKeys,
@@ -97,12 +108,9 @@ import {
   syncDevExtension,
   relayHostname,
   isLocalPeer
-} from "./main-zwe0c783.mjs";
+} from "./main-0egy8naa.mjs";
 import {
   terminateChildProcess,
-  isNodeError,
-  isUnsupportedDirectorySyncError,
-  writeJsonFileAtomically,
   SecretCollector,
   looksLikeTokenSegment,
   AuthProfileError,
@@ -138,26 +146,20 @@ import {
   settingsToExtension,
   describeSettings,
   describeChanges
-} from "./main-e4stqtf2.mjs";
+} from "./main-fkhwazsm.mjs";
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ppz7sv9s.mjs";
 import {
   defaultJournalBaseDir,
   makeJournalEntry,
   appendJournalEntry,
   startJournalRetention
-} from "./main-kvmxefp1.mjs";
+} from "./main-d7rbre73.mjs";
 import {
   createUpdateWatcher2
-} from "./main-4p2p9eey.mjs";
-import {
-  relayTokenQueryParam,
-  relayToken,
-  secretsEqual,
-  ensurePrivateDirectory
-} from "./main-4bht27ry.mjs";
+} from "./main-w5sta7hq.mjs";
 
 // src/relay.ts
 import http4 from "node:http";
@@ -858,9 +860,7 @@ function managedRelayLogPath(home = os.homedir()) {
 function appendManagedRelayProcessLog(message, home = os.homedir()) {
   try {
     const logPath = managedRelayLogPath(home);
-    const directory = path.dirname(logPath);
-    fs.mkdirSync(directory, { recursive: true, mode: 448 });
-    fs.chmodSync(directory, 448);
+    ensurePrivateDirectorySync(path.dirname(logPath));
     const entry = `${new Date().toISOString()} ${message.slice(0, maxEntryCharacters)}
 `;
     const stat = fs.statSync(logPath, { throwIfNoEntry: false });
@@ -1341,23 +1341,19 @@ class BrowserLinks {
       id = `${base}-${n}`;
     known[key] = { id, name };
     try {
-      fs2.mkdirSync(path2.dirname(this.file), { recursive: true, mode: 448 });
-      fs2.writeFileSync(this.file, `${JSON.stringify(known, null, 2)}
-`, { mode: 384 });
+      writePrivateJsonFileSync(this.file, known, { ensureParent: true });
     } catch {}
     return id;
   }
   connect(options) {
     const replaced = this.links.get(options.key);
-    if (replaced) {
+    if (replaced)
       this.disconnect(replaced.socket);
-      replaced.rpc.rejectPending(new Error("Extension replaced"));
-    }
     const link = {
       key: options.key,
       id: this.identify(options.key, options.name),
       name: options.name,
-      rpc: this.options.rpc?.() ?? new ExtensionRpc,
+      rpc: new ExtensionRpc,
       socket: options.socket,
       generation: ++this.generation,
       connectedAt: Date.now(),
@@ -1538,7 +1534,7 @@ class CdpRouter {
       clientSessionId,
       targetOwnerSessionId: target.opencodeBrowserSessionId,
       targetOwner: target.owner,
-      clientHasOwnedTarget: clientSessionId !== undefined && this.registry.listRootTargets().some((candidate) => candidate.opencodeBrowserSessionId === clientSessionId)
+      clientHasOwnedTarget: clientSessionId !== undefined && target.opencodeBrowserSessionId === undefined && target.owner !== "user" && this.registry.listRootTargets().some((candidate) => candidate.opencodeBrowserSessionId === clientSessionId)
     });
   }
   canSeeTab(client, tabId) {
@@ -7141,7 +7137,7 @@ async function waitForProgress(page, field, timeoutMs) {
   return false;
 }
 async function clearSecretInputs(frames, fields = []) {
-  const clearScript = (nodes) => {
+  const clearScript = () => {
     const own = (element) => {
       const input = element;
       if (!(input instanceof HTMLInputElement) || !input.value)
@@ -7154,7 +7150,7 @@ async function clearSecretInputs(frames, fields = []) {
       input.dispatchEvent(new Event("input", { bubbles: true }));
       input.dispatchEvent(new Event("change", { bubbles: true }));
     };
-    const all = [...nodes];
+    const all = [];
     const walk = (root) => {
       for (const element of Array.from(root.querySelectorAll("input"))) {
         const input = element;
@@ -7182,7 +7178,7 @@ async function clearSecretInputs(frames, fields = []) {
   for (const frame of new Set(frames)) {
     if (frame.isDetached())
       continue;
-    await frame.evaluate(clearScript, []).catch(() => {});
+    await frame.evaluate(clearScript).catch(() => {});
   }
 }
 async function submit(read, field) {
@@ -7470,10 +7466,8 @@ var probeSelectors = [
   "#challenge-running",
   "#challenge-stage",
   "#cf-challenge-running",
-  "#cf-please-wait",
   ".cf-turnstile",
   "#cf-error-details",
-  "#cf-wrapper .cf-error-type",
   "#sec-if-cpt-container",
   "#sec-cpt-if",
   "#sec-text-if",
@@ -13416,8 +13410,7 @@ var RelayLifecycleEvent = Schema8.TaggedUnion({
 });
 function appendRelayLifecycleEvent(filePath, event) {
   const directory = path9.dirname(filePath);
-  fs8.mkdirSync(directory, { recursive: true, mode: 448 });
-  fs8.chmodSync(directory, 448);
+  ensurePrivateDirectorySync(directory);
   const entry = `${JSON.stringify({ ...Schema8.encodeSync(RelayLifecycleEvent)(event), timestamp: new Date().toISOString() })}
 `;
   const file = fs8.openSync(filePath, "a+", 384);
@@ -13466,15 +13459,21 @@ class RelayShutdown {
   get stopping() {
     return State.$is("Stopping")(this.state) || State.$is("Closing")(this.state);
   }
-  close() {
+  drainAndSettle() {
     const control = this;
     return Effect9.gen(function* () {
-      control.state = State.Closing();
       yield* Effect9.all([control.options.drain, control.idle.await], { concurrency: "unbounded" });
       yield* control.idle.await;
       yield* control.options.settle;
     });
   }
+  close() {
+    const control = this;
+    return Effect9.gen(function* () {
+      control.state = State.Closing();
+      yield* control.drainAndSettle();
+    });
+  }
   track(effect) {
     const control = this;
     return Effect9.acquireUseRelease(Effect9.suspend(() => {
@@ -13516,9 +13515,7 @@ class RelayShutdown {
           const busy = control.options.busy();
           if (busy)
             return yield* control.busyError(busy);
-          yield* Effect9.all([control.options.drain, control.idle.await], { concurrency: "unbounded" });
-          yield* control.idle.await;
-          yield* control.options.settle;
+          yield* control.drainAndSettle();
           const remaining = control.options.busy();
           if (remaining)
             return yield* control.busyError(remaining);
@@ -14295,7 +14292,7 @@ function guardStorageAccess(context) {
   });
   if (outside === undefined)
     return null;
-  return `Browse blocked ${context.method}: site storage can only be used for the hosts of this session's attached pages (${hosts.length > 0 ? hosts.join(", ") : "none"}), not ${outside}. Set ${allowAllStorageEnvironmentVariable}=1 on the relay to allow it.`;
+  return `Browse blocked ${context.method}: site storage can only be used for the hosts of this session's attached pages (${formatAllowedHosts(hosts)}), not ${outside}. Set ${allowAllStorageEnvironmentVariable}=1 on the relay to allow it.`;
 }
 var restrictedNavigationSchemes = new Set([
   "file:",
@@ -14358,13 +14355,16 @@ function cookieDomainOf(cookie) {
   }
   return typeof domain === "string" ? domain : undefined;
 }
+function formatAllowedHosts(hosts) {
+  return hosts.length > 0 ? hosts.join(", ") : "none";
+}
 function guardCookieWrite(context) {
   const cookies = context.method === "Network.setCookie" ? [context.params] : Array.isArray(context.params?.cookies) ? context.params.cookies : [];
   const hosts = pageHosts(context.pageUrls?.() ?? []);
   for (const cookie of cookies) {
     const domain = cookieDomainOf(cookie);
     if (!domain || !hosts.some((host) => cookieAppliesToHost(domain, host))) {
-      return `Browse blocked ${context.method}: cookies can only be set for the hosts of this session's attached pages (${hosts.length > 0 ? hosts.join(", ") : "none"}), not ${domain ?? "a cookie without a domain or url"}. Set ${allowAllCookiesEnvironmentVariable}=1 on the relay to allow it.`;
+      return `Browse blocked ${context.method}: cookies can only be set for the hosts of this session's attached pages (${formatAllowedHosts(hosts)}), not ${domain ?? "a cookie without a domain or url"}. Set ${allowAllCookiesEnvironmentVariable}=1 on the relay to allow it.`;
     }
   }
   return null;
@@ -14398,7 +14398,7 @@ function guardCdpMethod(context) {
     const hosts = pageHosts(context.pageUrls?.() ?? []);
     const host = typeof url === "string" ? pageHosts([url])[0] : undefined;
     if (host === undefined || !hosts.includes(host)) {
-      return `Browse blocked Network.loadNetworkResource: it loads URLs with the user's credentials outside the page's same-origin policy, so only the hosts of this session's attached pages (${hosts.length > 0 ? hosts.join(", ") : "none"}) are allowed. Set ${allowAllStorageEnvironmentVariable}=1 on the relay to allow it.`;
+      return `Browse blocked Network.loadNetworkResource: it loads URLs with the user's credentials outside the page's same-origin policy, so only the hosts of this session's attached pages (${formatAllowedHosts(hosts)}) are allowed. Set ${allowAllStorageEnvironmentVariable}=1 on the relay to allow it.`;
     }
   }
   if (context.readOnly && readOnlyBlockedPrefixes.some((prefix) => context.method.startsWith(prefix))) {

package/dist/{runtime-update-0mddkfy5.mjs → runtime-update-8wte78jj.mjs}

@@ -8,24 +8,23 @@ import {
   compareVersions,
   readCurrent,
   writeCurrent,
-  readState,
   updateState,
   npmRuntime,
-  autoUpdateOverride,
+  effectiveMode,
   registryUrl,
   fetchPublished,
   installVersion,
   pruneVersions,
   switchVersion
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
 import {
   Service,
   layerFetch,
   restartRelay,
   startManagedRelay
-} from "./main-3qpkwaa7.mjs";
-import"./main-y7c1atbf.mjs";
-import"./main-4bht27ry.mjs";
+} from "./main-jjny7bmm.mjs";
+import"./main-9y22cffn.mjs";
+import"./main-ppz7sv9s.mjs";
 
 // src/runtime-update.ts
 import { Effect } from "effect";
@@ -129,7 +128,7 @@ async function runNpmUpdate(args, layout) {
   const current = readCurrent(lay);
   const refused = await switchTo(lay, published.version, { previous: current.version, force: args.includes("--force") });
   if (refused) {
-    const automatic = (autoUpdateOverride() ?? readState(lay).mode ?? "on") === "on";
+    const automatic = effectiveMode(lay) === "on";
     log(`! Installed ${published.version}, but the relay didn't restart (${refused}).`);
     log(automatic ? "  It switches to the new version by itself once no agent is using the browser." : `  When no agent is using the browser, run \`${cliCommand("update")}\` again.`);
     return true;

package/dist/{setup-f2qjnvre.mjs → setup-cqjdfcy0.mjs}

@@ -21,7 +21,10 @@ import {
   installVersion,
   pruneVersions,
   switchVersion
-} from "./main-g5mke6rn.mjs";
+} from "./main-ha5bnd77.mjs";
+import {
+  relayAuthorization
+} from "./main-9y22cffn.mjs";
 import {
   pairingCodeTtlMs,
   bundledPairingCodeTtlMs,
@@ -38,13 +41,10 @@ import {
   parseHostname,
   readRelayConfig,
   writeRelayConfig
-} from "./main-zwe0c783.mjs";
+} from "./main-0egy8naa.mjs";
 import {
   opencodeBrowserVersion2
-} from "./main-y7c1atbf.mjs";
-import {
-  relayAuthorization
-} from "./main-4bht27ry.mjs";
+} from "./main-ppz7sv9s.mjs";
 import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -11310,7 +11310,7 @@ async function runSetup(command, args) {
   if (command === "set")
     return set(args);
   if (command === "rollback") {
-    const { runRollback } = await import("./runtime-update-0mddkfy5.mjs");
+    const { runRollback } = await import("./runtime-update-8wte78jj.mjs");
     return runRollback(args);
   }
 }

package/dist/{update-cyy1grjj.mjs → update-st5c8grg.mjs}

@@ -4,8 +4,8 @@ import {
   updateNotice2,
   createUpdateWatcher2,
   runUpdateCommand2
-} from "./main-4p2p9eey.mjs";
-import"./main-g5mke6rn.mjs";
+} from "./main-w5sta7hq.mjs";
+import"./main-ha5bnd77.mjs";
 export {
   createUpdateWatcher2 as createUpdateWatcher,
   formatUpdateNotice2 as formatUpdateNotice,

package/dist/{version-wrebjhy7.mjs → version-6g6gtnra.mjs}

@@ -1,7 +1,7 @@
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ppz7sv9s.mjs";
 export {
   opencodeBrowserBuildId2 as opencodeBrowserBuildId,
   opencodeBrowserVersion2 as opencodeBrowserVersion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencode/browse",
-  "version": "0.0.6-dev.17",
+  "version": "0.0.6-dev.18",
   "description": "Browse: connect the extension to opencode, and drive your browser from any agent (CLI, MCP, Playwright).",
   "type": "module",
   "license": "MIT",

package/dist/main-4bht27ry.mjs

@@ -1,72 +0,0 @@
-import {
-  dataRoot
-} from "./main-g5mke6rn.mjs";
-
-// src/relay-secrets.ts
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-var relayTokenQueryParam = "opencodeBrowserToken";
-var tokenPattern = /^[A-Za-z0-9_-]{43}$/;
-function relayTokenPath(root = dataRoot()) {
-  return path.join(root, "relay-token");
-}
-function relayToken(root = dataRoot()) {
-  return readOrCreateSecret(relayTokenPath(root), () => crypto.randomBytes(32).toString("base64url"), (value) => tokenPattern.test(value));
-}
-function relayAuthorization(root = dataRoot()) {
-  return `Bearer ${relayToken(root)}`;
-}
-function secretsEqual(expected, actual) {
-  if (actual === undefined)
-    return false;
-  const a = crypto.createHash("sha256").update(expected).digest();
-  const b = crypto.createHash("sha256").update(actual).digest();
-  return crypto.timingSafeEqual(a, b) && expected.length === actual.length;
-}
-function readOrCreateSecret(file, generate, valid) {
-  const existing = readSecret(file);
-  if (existing !== undefined && valid(existing))
-    return existing;
-  ensurePrivateDirectory(path.dirname(file));
-  const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(temporary, `${generate()}
-`, { mode: 384 });
-  try {
-    if (existing === undefined) {
-      try {
-        fs.linkSync(temporary, file);
-      } catch (error) {
-        if (error.code !== "EEXIST")
-          throw error;
-      }
-    } else {
-      fs.renameSync(temporary, file);
-    }
-  } finally {
-    fs.rmSync(temporary, { force: true });
-  }
-  const created = readSecret(file);
-  if (created === undefined || !valid(created))
-    throw new Error(`Could not create ${file}`);
-  return created;
-}
-function readSecret(file) {
-  try {
-    const stat = fs.statSync(file);
-    if (process.platform !== "win32" && (stat.mode & 63) !== 0)
-      fs.chmodSync(file, 384);
-    return fs.readFileSync(file, "utf8").trim();
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return;
-    throw error;
-  }
-}
-function ensurePrivateDirectory(directory = dataRoot()) {
-  fs.mkdirSync(directory, { recursive: true, mode: 448 });
-  if (process.platform !== "win32")
-    fs.chmodSync(directory, 448);
-}
-
-export { relayTokenQueryParam, relayToken, relayAuthorization, secretsEqual, ensurePrivateDirectory };

package/dist/main-y7c1atbf.mjs

@@ -1,4 +0,0 @@
-// src/version.ts
-var opencodeBrowserVersion2 = "0.0.6-dev.17";
-var opencodeBrowserBuildId2 = "2026-11-03T15:29:35.727Z";
-export { opencodeBrowserVersion2, opencodeBrowserBuildId2 };