@opencode/browse 0.0.6-dev.27 → 0.0.6-dev.32

package/dist/{runtime-update-gteb0gp8.mjs → runtime-update-tksdpg29.mjs}

@@ -1,4 +1,4 @@
-import"./main-vp3devjb.mjs";
+import"./main-k9drabmz.mjs";
 import {
   cliCommand,
   installCommand,
@@ -17,18 +17,29 @@ import {
   installVersion,
   pruneVersions,
   switchVersion
-} from "./main-a6mpfd6z.mjs";
+} from "./main-ea9djgtm.mjs";
 import"./main-3gthmkzw.mjs";
 import {
   Service,
   layerFetch,
   restartRelay,
   startManagedRelay
-} from "./main-xzc7qp1c.mjs";
-import"./main-bq8az9yr.mjs";
+} from "./main-aqzas8ts.mjs";
+import"./main-30dkfffj.mjs";
+import {
+  succeed6,
+  suspend2,
+  sync2,
+  void_3,
+  gen,
+  andThen,
+  result,
+  catch_,
+  provide3,
+  runPromise
+} from "./main-9z6jbwdp.mjs";
 
 // src/update/runtime-update.ts
-import { Effect } from "effect";
 import { existsSync } from "node:fs";
 var log = (line) => process.stdout.write(line + `
 `);
@@ -38,13 +49,13 @@ async function switchTo(layout, version, options) {
     return `${version} isn't installed`;
   const before = readCurrent(layout);
   let switched = false;
-  const point = Effect.sync(() => {
+  const point = sync2(() => {
     switchVersion(layout, version, options.previous);
     switched = true;
   });
-  const program = Effect.gen(function* () {
+  const program = gen(function* () {
     const relay = yield* Service;
-    const running = yield* Effect.result(relay.version);
+    const running = yield* result(relay.version);
     if (running._tag === "Failure") {
       yield* point;
       return;
@@ -55,12 +66,12 @@ async function switchTo(layout, version, options) {
       force: options.force,
       otherBuild: true,
       onShutdownAccepted: point,
-      start: Effect.suspend(() => switched ? Effect.void : point).pipe(Effect.andThen(startManagedRelay(entry)))
+      start: suspend2(() => switched ? void_3 : point).pipe(andThen(startManagedRelay(entry)))
     });
     const now = yield* relay.version;
     return now.version === version ? undefined : `a relay of version ${now.version} started first`;
-  }).pipe(Effect.provide(layerFetch));
-  const refused = await Effect.runPromise(program.pipe(Effect.catch((error) => Effect.succeed(error.message ?? String(error)))));
+  }).pipe(provide3(layerFetch));
+  const refused = await runPromise(program.pipe(catch_((error) => succeed6(error.message ?? String(error)))));
   if (refused && switched && before)
     writeCurrent(layout, before);
   return refused;

package/dist/{setup-zka6z53q.mjs → setup-92ht2epc.mjs}

@@ -1,6 +1,6 @@
 import {
   opencodeBrowserVersion2
-} from "./main-vp3devjb.mjs";
+} from "./main-k9drabmz.mjs";
 import {
   dataRoot,
   oldStoreMarker,
@@ -25,10 +25,10 @@ import {
   installVersion,
   pruneVersions,
   switchVersion
-} from "./main-a6mpfd6z.mjs";
+} from "./main-ea9djgtm.mjs";
 import {
   relayAuthorization
-} from "./main-bq8az9yr.mjs";
+} from "./main-30dkfffj.mjs";
 import {
   parseHostname,
   readRelayConfig,
@@ -45,47 +45,17 @@ import {
   legacyPairingCode,
   removeLegacyPairingCode,
   syncDevExtension
-} from "./main-3g2t8jtq.mjs";
+} from "./main-3w449766.mjs";
 import {
   unpackedExtensionId,
   extensionProtocolSkew,
   extensionProtocolAdvice
 } from "./main-3gthmkzw.mjs";
-import { createRequire } from "node:module";
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+import {
+  __toESM,
+  __commonJS,
+  __require
+} from "./main-yf9xhpn4.mjs";
 
 // node_modules/sisteransi/src/index.js
 var require_src = __commonJS(function(exports, module) {
@@ -12081,7 +12051,7 @@ async function runSetup(command, args) {
   if (command === "set")
     return set(args);
   if (command === "rollback") {
-    const { runRollback } = await import("./runtime-update-gteb0gp8.mjs");
+    const { runRollback } = await import("./runtime-update-tksdpg29.mjs");
     return runRollback(args);
   }
 }

package/dist/{skill-text-kyjcembk.mjs → skill-text-rc6te209.mjs}

@@ -581,81 +581,6 @@ secret in a session without an allowlist adds a loud warning: set one first.
 Once typed, the value is in the page, so don't read it back or copy it
 elsewhere.
 
-### Signing in with Deadbolt
-
-When the user connected browse to Deadbolt (\`opencode-browser deadbolt
-connect\`), you can sign in with the logins they granted to agents, without
-seeing any value. \`secrets_list\` shows them for the session's allowed sites:
-title, username, \`granted\`, which \`fields\` (username, password, totp) and
-whether \`passkeys\` are allowed, plus the site's passkey accounts (\`username\`,
-\`displayName\`). Only the user grants, in Deadbolt: \`deadbolt agents allow
-<site>\` (everything for that site's logins: username, password, one-time code
-and passkeys, unless narrowed with \`--login\`, \`--fields\`, \`--no-passkeys\`,
-\`--expires\`) or
-\`deadbolt agents allow --all\` (every login).
-Never try to grant, pair or unlock yourself; Deadbolt refuses AI callers.
-
-Prefer the whole sign-in in one call (the \`signin\` tool, or in execute):
-
-\`\`\`js
-await page.goto("https://github.com/login")
-const result = await secrets.signIn()            // or { site: "github.com", username: "me@example.com" }
-// { status: "signed_in" | "needs_user" | "not_granted" | "failed", step, reason }
-\`\`\`
-
-It fills the username, submits, waits, fills the password, types an
-authenticator (TOTP) code when the site asks for one (single field or split
-boxes), follows "Use password instead", and follows Sign in with Google when
-Deadbolt grants a Google login, all inside the relay. Then:
-
-- \`signed_in\`: carry on.
-- \`needs_user\`: a captcha, a code sent by SMS or email, a push approval, a
-  new-device or "verify it's you" check, or Deadbolt is locked. Call
-  \`handoff("Finish signing in, then click Continue")\` so the user does it.
-  Don't retry in a loop.
-- \`needs_choice\`: several passkeys can sign in; \`choices\` lists their
-  \`username\` / \`displayName\`. Ask the user which one if it isn't obvious, then
-  call again with \`{ username }\`.
-- \`not_granted\`: tell the user what to allow (the reason names the site and
-  login).
-- \`failed\`: the reason says why (no form found, wrong password, the page didn't
-  move on). Don't loop.
-
-It doesn't handle security questions, image or canvas keypads, closed shadow
-roots, or sign-in providers other than Google; those return \`needs_user\` or
-\`failed\`. When it stops after a fill it empties the password and code fields
-first. For a form it misreads, type one value at a time: a username on its
-own, a password or code only with \`{ submit: true }\`, which types it, submits
-the form, waits for the page to move on and empties password and code fields
-in that frame, all in the same call:
-
-\`\`\`js
-await secrets.type("#login", "deadbolt:github.com/me@example.com", { field: "username" })
-await secrets.type("#password", "deadbolt:github.com/me@example.com", { submit: true })   // field defaults to "password"
-\`\`\`
-
-The same origin checks as stored secrets apply (the field's frame must be on
-the login's site and in the session allowlist; Deadbolt checks again), and
-values never appear in what you get back. Errors start with the code:
-\`submit_required\`, \`domain_not_allowed\`, \`not_granted\`, \`locked\`, \`forbidden\`
-(the user must reconnect), \`rate_limited\`, \`page_hooks\`. \`page_hooks\` means
-this session's code set up request interception or listeners
-(\`page.route\`, \`page.on("request")\`, \`waitForRequest\`...), init scripts,
-exposed functions or a CDP session: Deadbolt passwords and codes aren't typed
-then. Sign in first, in a fresh session (\`session_reset\`), and set those up
-afterwards. Never try to read or capture a value that was typed: the user
-grants logins on the understanding that you don't. Set a session allowlist
-before signing in.
-
-Passkeys: in tabs you opened, a site's passkey sign-in
-(\`navigator.credentials.get\`) is answered by Deadbolt when the grant allows
-passkeys. \`signIn({ username })\` picks that account's passkey; to choose one
-before your own click on a "Sign in with a passkey" button, call
-\`await secrets.usePasskey({ site: "example.com", username: "me@example.com" })\`
-(it applies to the tab's next passkey request, once). Deadbolt never verifies the user, so sites that require that fall back to
-other methods. Otherwise the request fails with NotAllowedError, as if the user
-dismissed it. WebAuthn CDP methods are blocked.
-
 For destructive UI work, use a two-phase **read, confirm, verify** flow:
 
 1. Read candidates and return exact stable identifiers or row text.

package/dist/{supervisor-w6hs0gbw.mjs → supervisor-0afrkpjb.mjs}

@@ -1,9 +1,9 @@
-import"./main-vp3devjb.mjs";
+import"./main-k9drabmz.mjs";
 import {
   versionEntry,
   readCurrent,
   npmRuntime
-} from "./main-a6mpfd6z.mjs";
+} from "./main-ea9djgtm.mjs";
 
 // src/mcp/supervisor.ts
 import { spawn } from "node:child_process";
@@ -14,7 +14,7 @@ async function runBinaryMcp(args) {
   const runtime = npmRuntime();
   if (!runtime) {
     process.env[directEnvironmentVariable] = "1";
-    const { runCli } = await import("./cli-n0qhph13.mjs");
+    const { runCli } = await import("./cli-pazs0vgt.mjs");
     return runCli();
   }
   const { layout } = runtime;

package/dist/{update-pj25xbh4.mjs → update-vv7x6c6j.mjs}

@@ -4,10 +4,10 @@ import {
   updateNotice2,
   createUpdateWatcher2,
   runUpdateCommand2
-} from "./main-x96gxahz.mjs";
-import"./main-a6mpfd6z.mjs";
-import"./main-vp3devjb.mjs";
+} from "./main-yxvg4ms6.mjs";
 import"./main-3gthmkzw.mjs";
+import"./main-ea9djgtm.mjs";
+import"./main-k9drabmz.mjs";
 export {
   createUpdateWatcher2 as createUpdateWatcher,
   formatUpdateNotice2 as formatUpdateNotice,

package/dist/{version-1hb8s8jj.mjs → version-pvx4s3qg.mjs}

@@ -1,7 +1,7 @@
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-vp3devjb.mjs";
+} from "./main-k9drabmz.mjs";
 export {
   opencodeBrowserBuildId2 as opencodeBrowserBuildId,
   opencodeBrowserVersion2 as opencodeBrowserVersion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencode/browse",
-  "version": "0.0.6-dev.27",
+  "version": "0.0.6-dev.32",
   "description": "browse: connect the extension to opencode, and drive your browser from any agent (CLI, MCP, Playwright).",
   "type": "module",
   "license": "MIT",
@@ -28,9 +28,7 @@
     "prepublishOnly": "bun build.ts"
   },
   "dependencies": {
-    "@effect/platform-node": "4.0.1",
     "acorn": "8.18.0",
-    "effect": "4.0.1",
     "pixelmatch": "7.2.0",
     "patchright-core": "1.63.0",
     "pngjs": "7.0.0",
@@ -39,12 +37,15 @@
   "devDependencies": {
     "@clack/core": "1.5.1",
     "@clack/prompts": "1.8.1",
+    "@effect/platform-node": "4.0.1",
+    "@effect/platform-node-shared": "4.0.1",
     "@types/bun": "1.4.0",
     "@types/chrome": "0.3.4",
     "@types/node": "26.6.4",
     "@types/pngjs": "6.0.5",
     "@types/ws": "8.18.2",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
+    "effect": "4.0.1",
     "jsonc-parser": "3.3.1",
     "smol-toml": "1.9.1",
     "yaml": "2.9.1"

package/skills/browse/SKILL.md

@@ -580,81 +580,6 @@ secret in a session without an allowlist adds a loud warning: set one first.
 Once typed, the value is in the page, so don't read it back or copy it
 elsewhere.
 
-### Signing in with Deadbolt
-
-When the user connected browse to Deadbolt (`opencode-browser deadbolt
-connect`), you can sign in with the logins they granted to agents, without
-seeing any value. `secrets_list` shows them for the session's allowed sites:
-title, username, `granted`, which `fields` (username, password, totp) and
-whether `passkeys` are allowed, plus the site's passkey accounts (`username`,
-`displayName`). Only the user grants, in Deadbolt: `deadbolt agents allow
-<site>` (everything for that site's logins: username, password, one-time code
-and passkeys, unless narrowed with `--login`, `--fields`, `--no-passkeys`,
-`--expires`) or
-`deadbolt agents allow --all` (every login).
-Never try to grant, pair or unlock yourself; Deadbolt refuses AI callers.
-
-Prefer the whole sign-in in one call (the `signin` tool, or in execute):
-
-```js
-await page.goto("https://github.com/login")
-const result = await secrets.signIn()            // or { site: "github.com", username: "me@example.com" }
-// { status: "signed_in" | "needs_user" | "not_granted" | "failed", step, reason }
-```
-
-It fills the username, submits, waits, fills the password, types an
-authenticator (TOTP) code when the site asks for one (single field or split
-boxes), follows "Use password instead", and follows Sign in with Google when
-Deadbolt grants a Google login, all inside the relay. Then:
-
-- `signed_in`: carry on.
-- `needs_user`: a captcha, a code sent by SMS or email, a push approval, a
-  new-device or "verify it's you" check, or Deadbolt is locked. Call
-  `handoff("Finish signing in, then click Continue")` so the user does it.
-  Don't retry in a loop.
-- `needs_choice`: several passkeys can sign in; `choices` lists their
-  `username` / `displayName`. Ask the user which one if it isn't obvious, then
-  call again with `{ username }`.
-- `not_granted`: tell the user what to allow (the reason names the site and
-  login).
-- `failed`: the reason says why (no form found, wrong password, the page didn't
-  move on). Don't loop.
-
-It doesn't handle security questions, image or canvas keypads, closed shadow
-roots, or sign-in providers other than Google; those return `needs_user` or
-`failed`. When it stops after a fill it empties the password and code fields
-first. For a form it misreads, type one value at a time: a username on its
-own, a password or code only with `{ submit: true }`, which types it, submits
-the form, waits for the page to move on and empties password and code fields
-in that frame, all in the same call:
-
-```js
-await secrets.type("#login", "deadbolt:github.com/me@example.com", { field: "username" })
-await secrets.type("#password", "deadbolt:github.com/me@example.com", { submit: true })   // field defaults to "password"
-```
-
-The same origin checks as stored secrets apply (the field's frame must be on
-the login's site and in the session allowlist; Deadbolt checks again), and
-values never appear in what you get back. Errors start with the code:
-`submit_required`, `domain_not_allowed`, `not_granted`, `locked`, `forbidden`
-(the user must reconnect), `rate_limited`, `page_hooks`. `page_hooks` means
-this session's code set up request interception or listeners
-(`page.route`, `page.on("request")`, `waitForRequest`...), init scripts,
-exposed functions or a CDP session: Deadbolt passwords and codes aren't typed
-then. Sign in first, in a fresh session (`session_reset`), and set those up
-afterwards. Never try to read or capture a value that was typed: the user
-grants logins on the understanding that you don't. Set a session allowlist
-before signing in.
-
-Passkeys: in tabs you opened, a site's passkey sign-in
-(`navigator.credentials.get`) is answered by Deadbolt when the grant allows
-passkeys. `signIn({ username })` picks that account's passkey; to choose one
-before your own click on a "Sign in with a passkey" button, call
-`await secrets.usePasskey({ site: "example.com", username: "me@example.com" })`
-(it applies to the tab's next passkey request, once). Deadbolt never verifies the user, so sites that require that fall back to
-other methods. Otherwise the request fails with NotAllowedError, as if the user
-dismissed it. WebAuthn CDP methods are blocked.
-
 For destructive UI work, use a two-phase **read, confirm, verify** flow:
 
 1. Read candidates and return exact stable identifiers or row text.