@steipete/oracle 0.17.1 → 0.17.2

package/dist/src/browser/actions/thinkingTime.js

@@ -31,7 +31,11 @@ export async function ensureThinkingTime(Runtime, level, logger, desiredModel) {
     const capitalizedLevel = level.charAt(0).toUpperCase() + level.slice(1);
     const targetModelKind = inferThinkingTargetModelKind(desiredModel);
     const observedModelKind = result && "modelKind" in result ? result.modelKind : null;
-    const strictProEffort = (targetModelKind === "pro" || observedModelKind === "pro") && level === "extended";
+    // Pro is expensive and rate-limited, so a Pro request must never degrade quietly
+    // into a cheaper tier. Requesting it explicitly (level "pro") fails closed on its
+    // own, independently of the legacy Pro-model + "extended" combination.
+    const strictProEffort = level === "pro" ||
+        ((targetModelKind === "pro" || observedModelKind === "pro") && level === "extended");
     switch (result?.status) {
         case "already-selected":
             logger(formatBrowserThinkingLog(`${result.label ?? capitalizedLevel} (already selected)`));
@@ -53,18 +57,24 @@ export async function ensureThinkingTime(Runtime, level, logger, desiredModel) {
                     : "";
             const message = `Thinking time: ${result.status.replaceAll("-", " ")}${kindHint} (requested ${capitalizedLevel})`;
             if (strictProEffort) {
-                throw new Error(`${message}; refusing to submit without confirmed Pro Extended.`);
+                const target = level === "pro" ? "Pro" : "Pro Extended";
+                throw new Error(`${message}; refusing to submit without confirmed ${target}.`);
             }
-            // Nothing was clicked, so the tab keeps whatever effort it already had —
-            // which is not necessarily ChatGPT's default.
-            logger(formatBrowserThinkingLog(`${message}; keeping the effort already selected in ChatGPT.`));
+            // "selection-unverified" is the one status here that already dispatched a
+            // click, so the effort may or may not have moved. Every other status left
+            // the tab on whatever effort it had — which is not necessarily the default.
+            const outcome = result.status === "selection-unverified"
+                ? "the effort in ChatGPT is unconfirmed"
+                : "keeping the effort already selected in ChatGPT";
+            logger(formatBrowserThinkingLog(`${message}; ${outcome}.`));
             return;
         }
         default: {
             await logDomFailure(Runtime, logger, "thinking-time-unknown");
             logPickerDiagnostic(result, logger);
             if (strictProEffort) {
-                throw new Error(`Thinking time: unknown outcome selecting ${capitalizedLevel}; refusing to submit without confirmed Pro Extended.`);
+                const target = level === "pro" ? "Pro" : "Pro Extended";
+                throw new Error(`Thinking time: unknown outcome selecting ${capitalizedLevel}; refusing to submit without confirmed ${target}.`);
             }
             logger(formatBrowserThinkingLog(`unknown outcome selecting ${capitalizedLevel}; continuing with ChatGPT default.`));
             return;
@@ -74,7 +84,7 @@ export async function ensureThinkingTime(Runtime, level, logger, desiredModel) {
 /**
  * Best-effort selection of a thinking time level in ChatGPT's composer pill menu.
  * Safe by default: if the pill/menu/option isn't present, we continue without throwing.
- * @param level - The thinking time intensity: 'light', 'standard', 'extended', 'extra-high', or 'heavy'
+ * @param level - The thinking time intensity: 'light', 'standard', 'extended', 'extra-high', 'pro', or 'heavy'
  */
 export async function ensureThinkingTimeIfAvailable(Runtime, level, logger, desiredModel) {
     try {
@@ -145,7 +155,12 @@ function buildThinkingTimeExpression(level, desiredModel) {
       'extra-high': ['extra high', 'sehr hoch', '极高'],
       heavy: ['heavy', 'schwer', '重度', '加重'],
     };
-    const targetTokens = LEVEL_TOKENS[TARGET_LEVEL] || [TARGET_LEVEL];
+    // Pro is a tier you can request, but it is also a MODEL name, so it must never
+    // be used to decide whether a control or a menu is an effort owner: a model pill
+    // reading "Pro" would be claimed as the effort pill, and a model menu listing
+    // "Instant"/"Pro" would look like a tier list. Keep it to target matching only.
+    const TARGET_LEVEL_TOKENS = { ...LEVEL_TOKENS, pro: ['pro'] };
+    const targetTokens = TARGET_LEVEL_TOKENS[TARGET_LEVEL] || [TARGET_LEVEL];
 
     const INITIAL_WAIT_MS = 150;
     const STEP_WAIT_MS = 200;
@@ -372,7 +387,20 @@ function buildThinkingTimeExpression(level, desiredModel) {
       diagnostic: collectPickerDiagnostic(),
     });
     const findOptionInMenu = (menu, modelKindOverride = null) => {
-      const items = Array.from(menu.querySelectorAll(MENU_ITEM_SELECTOR));
+      // Container controls reveal other controls; they are not tiers you can pick.
+      // Two shapes exist and both can collide with a tier label: a submenu opener
+      // ("ModelGPT-5.6 Pro" would satisfy a Pro request) and a disclosure toggle
+      // (German "Erweitert" is literally one of the extended tokens, so the
+      // Advanced toggle would satisfy an extended request and be clicked in place
+      // of the tier). Detect them structurally rather than by label: a real tier row
+      // carries a checked state, while a container carries expansion state.
+      const isContainerControl = (node) =>
+        node?.getAttribute?.('aria-haspopup') === 'menu' ||
+        (node?.getAttribute?.('aria-expanded') !== null &&
+          node?.getAttribute?.('aria-checked') === null);
+      const items = Array.from(menu.querySelectorAll(MENU_ITEM_SELECTOR)).filter(
+        (item) => !isContainerControl(item),
+      );
       const modelKind = modelKindOverride || effectiveTargetModelKind();
       if (modelKind === 'pro') {
         // GPT-5.6's unified Intelligence picker exposes Pro as the highest
@@ -414,7 +442,11 @@ function buildThinkingTimeExpression(level, desiredModel) {
         const itemText = normalize(
           (item.textContent ?? '') + ' ' + (item.getAttribute?.('aria-label') ?? ''),
         );
-        if (modelKind !== 'pro' && hasToken(itemText, 'pro')) {
+        // Pro rows are skipped for non-Pro targets so "High" never resolves to
+        // "Pro". Two things lift this: an explicit TARGET_LEVEL of 'pro', and a
+        // legacy Pro-model menu (modelKind === 'pro'), whose rows are all Pro
+        // variants so excluding them would leave nothing to match.
+        if (TARGET_LEVEL !== 'pro' && modelKind !== 'pro' && hasToken(itemText, 'pro')) {
           continue;
         }
         if (
@@ -644,6 +676,119 @@ function buildThinkingTimeExpression(level, desiredModel) {
       return null;
     };
 
+    // ---------- Unified Intelligence picker: Advanced -> Effort submenu ----------
+    // A newer ChatGPT layout replaces the flat effort rows with a "power" slider
+    // (simple view) plus an "Advanced" view holding two submenu openers: Model and
+    // Effort. The tier rows only exist inside the Effort submenu, so the flat scan
+    // of the top-level menu finds nothing and we must expand and descend.
+    const ADVANCED_VIEW_SELECTOR = '[data-testid="composer-model-picker-slider-advanced-view"]';
+    const SUBMENU_OPENER_SELECTOR = '[role="menuitem"][aria-haspopup="menu"]';
+    const nodeLabel = (node) =>
+      normalize((node?.getAttribute?.('aria-label') ?? '') + ' ' + (node?.textContent ?? ''));
+    // Row labels in this menu concatenate without separators ("EffortHigh"), so
+    // token matching cannot be used here — substring is deliberate, as in
+    // countEffortLevels above.
+    const ADVANCED_WORDS = ['advanced', 'erweitert', '高级', 'avanzado', 'avancado', 'avance'];
+    const EFFORT_WORDS = [
+      'effort', 'aufwand', '强度', '努力',
+      'esfuerzo', 'esforco', 'sforzo', 'inspanning', 'wysilek',
+    ];
+    const containsAny = (label, words) => words.some((word) => label.includes(word));
+    const findAdvancedToggle = (menu) => {
+      for (const item of (menu || document).querySelectorAll('[role="menuitem"]')) {
+        if (!isVisible(item)) continue;
+        if (containsAny(nodeLabel(item), ADVANCED_WORDS)) return item;
+      }
+      return null;
+    };
+    // Verify the shape rather than trusting the selector: a tier row must never be
+    // mistaken for the opener, or hovering it would silently change the effort.
+    const isSubmenuOpener = (node) =>
+      node?.getAttribute?.('aria-haspopup') === 'menu' &&
+      (node?.getAttribute?.('role') ?? '') === 'menuitem';
+    // The Effort opener's label is the word "Effort" plus the tier it currently sits
+    // on ("EffortHigh"). Positive identification only: the sibling Model opener has
+    // the identical shape and can read "ModelGPT-5.6 Pro", so guessing from tier
+    // words would pick it and then click model rows as if they were efforts. An
+    // unrecognised language yields no opener, and the caller fails instead of
+    // gambling on the wrong control.
+    const findEffortSubmenuOpener = (menu) => {
+      const scope = menu?.querySelector?.(ADVANCED_VIEW_SELECTOR) || menu || document;
+      for (const item of scope.querySelectorAll(SUBMENU_OPENER_SELECTOR)) {
+        if (!isVisible(item) || !isSubmenuOpener(item)) continue;
+        if (containsAny(nodeLabel(item), EFFORT_WORDS)) return item;
+      }
+      return null;
+    };
+    // countEffortLevels reads aggregate menu text, where one "Extra High" row scores
+    // twice (once as "high", once as "extra high"). Count distinct levels across
+    // distinct rows instead, so ">= 2" really means two selectable tiers.
+    const countDistinctTierRows = (menu) => {
+      if (!menu) return 0;
+      const matched = new Set();
+      for (const row of menu.querySelectorAll(MENU_ITEM_SELECTOR)) {
+        if (isSubmenuOpener(row)) continue;
+        const text = nodeLabel(row);
+        for (const [level, tokens] of Object.entries(LEVEL_TOKENS)) {
+          if (matchesTokens(text, tokens)) matched.add(level);
+        }
+      }
+      return matched.size;
+    };
+    const resolveSubmenuFor = (opener, parentMenu) => {
+      const id = opener?.getAttribute?.('aria-controls');
+      if (id) {
+        const node = document.getElementById?.(id);
+        if (isVisible(node) && countDistinctTierRows(node) >= 2) return node;
+      }
+      let best = null;
+      for (const menu of document.querySelectorAll(MENU_CONTAINER_SELECTOR)) {
+        if (menu === parentMenu || menu.contains?.(opener) || !isVisible(menu)) continue;
+        const hits = countDistinctTierRows(menu);
+        if (hits >= 2 && (!best || hits > best.hits)) best = { menu, hits };
+      }
+      return best?.menu ?? null;
+    };
+    const selectEffortFromAdvancedSubmenu = async (parentMenu, modelKindOverride = null) => {
+      if (!parentMenu) return null;
+      // React can mount the advanced view well after the click under load, so poll
+      // for the opener to the same deadline the submenu gets instead of assuming it
+      // rendered within one STEP_WAIT_MS. Re-expand if the toggle collapses again.
+      let opener = null;
+      const openerDeadline = performance.now() + MAX_WAIT_MS;
+      while (!opener && performance.now() < openerDeadline) {
+        const toggle = findAdvancedToggle(parentMenu);
+        if (toggle && toggle.getAttribute?.('aria-expanded') === 'false') {
+          dispatchClickSequence(toggle);
+          await sleep(STEP_WAIT_MS);
+        }
+        opener = findEffortSubmenuOpener(parentMenu);
+        if (opener) break;
+        await sleep(100);
+      }
+      if (!opener) return null;
+      dispatchHoverSequence(opener);
+      if (opener.getAttribute?.('aria-expanded') !== 'true') {
+        dispatchClickSequence(opener);
+      }
+      const deadline = performance.now() + MAX_WAIT_MS;
+      while (performance.now() < deadline) {
+        const submenu = resolveSubmenuFor(opener, parentMenu);
+        if (submenu) {
+          return selectAndVerify(
+            opener,
+            () => {
+              const current = resolveSubmenuFor(opener, parentMenu);
+              return current ? findOptionInMenu(current, modelKindOverride) : null;
+            },
+            modelKindOverride,
+          );
+        }
+        await sleep(100);
+      }
+      return null;
+    };
+
     // Current ChatGPT exposes a standalone Pro or Thinking composer pill whose
     // controlled menu contains the effort levels. Prefer this ownership boundary
     // before probing older model-picker layouts.
@@ -740,9 +885,26 @@ function buildThinkingTimeExpression(level, desiredModel) {
     }
     if (composerEffortPill) {
       if (attemptedModelButton && attemptedModelButton !== composerEffortPill) closeOpenMenus();
+      // In the unified Intelligence picker the composer pill shows the current
+      // EFFORT ("Pro", "High"), not the model. Reading a Pro *model* out of it would
+      // lift the Pro-row exclusion in findOptionInMenu and let a lower-tier request
+      // settle on Pro. Only a pill naming a tier and nothing else qualifies: legacy
+      // pills read "Pro Extended" (model + effort) and must keep naming their model,
+      // or a Pro Extended user asking for extended would be moved down to High.
+      const pillLabel = normalize(
+        (composerEffortPill.getAttribute?.('aria-label') ?? '') +
+          ' ' +
+          (composerEffortPill.textContent ?? ''),
+      );
+      const pillIsBareEffortTier = Object.values(TARGET_LEVEL_TOKENS).some((tokens) =>
+        tokens.some((token) => normalize(token) === pillLabel),
+      );
+      const pillNamesEffortNotModel =
+        TARGET_IS_GPT56_MODEL ||
+        (pillIsBareEffortTier && Boolean(document.querySelector(INTELLIGENCE_MENU_SELECTOR)));
       const composerModelKind =
         TARGET_MODEL_KIND ||
-        (TARGET_IS_GPT56_MODEL ? 'versioned' : modelKindFromNode(composerEffortPill));
+        (pillNamesEffortNotModel ? 'versioned' : modelKindFromNode(composerEffortPill));
       if (composerEffortPill.getAttribute?.('aria-expanded') !== 'true') {
         dispatchClickSequence(composerEffortPill);
         await sleep(INITIAL_WAIT_MS);
@@ -755,6 +917,14 @@ function buildThinkingTimeExpression(level, desiredModel) {
           if (proEffortResult) {
             return proEffortResult;
           }
+          // Flat rows win when present; only descend into Advanced -> Effort when
+          // this menu has no matching tier of its own (the slider layout).
+          if (!findOptionInMenu(menu, composerModelKind)) {
+            const advancedResult = await selectEffortFromAdvancedSubmenu(menu, composerModelKind);
+            if (advancedResult) {
+              return advancedResult;
+            }
+          }
           return selectAndVerify(
             composerEffortPill,
             () => {

package/dist/src/cli/browserConfig.js

@@ -19,7 +19,7 @@ const BROWSER_MODEL_LABELS = [
     // Most specific first (e.g., "gpt-5.2-thinking" before "gpt-5.2")
     ["gpt-5.6-sol", "GPT-5.6 Sol"],
     ["gpt-5.6", "GPT-5.6 Sol"],
-    ["gpt-5.5-pro", "Pro"],
+    ["gpt-5.5-pro", "GPT-5.5"],
     ["gpt-5.5-instant", "GPT-5.5 Instant"],
     ["gpt-5.5", "Thinking 5.5"],
     ["gpt-5.4-pro", "Pro"],
@@ -85,8 +85,11 @@ export async function buildBrowserConfig(options) {
     const normalizedOverride = desiredModelOverride?.toLowerCase() ?? "";
     const baseModel = options.model.toLowerCase();
     const isChatGptModel = baseModel.startsWith("gpt-") && !baseModel.includes("codex");
+    const normalizedBrowserModel = normalizeChatGptModelForBrowser(options.model);
     const shouldUseOverride = !isChatGptModel && normalizedOverride.length > 0 && normalizedOverride !== baseModel;
     const modelStrategy = normalizeBrowserModelStrategy(options.browserModelStrategy) ?? DEFAULT_MODEL_STRATEGY;
+    const thinkingTime = normalizeThinkingTimeLevel(options.browserThinkingTime) ??
+        (modelStrategy === "select" && normalizedBrowserModel === "gpt-5.5-pro" ? "pro" : undefined);
     assertBrowserModelAvailable(options.model, modelStrategy);
     const cookieNames = parseCookieNames(options.browserCookieNames ?? process.env.ORACLE_BROWSER_COOKIE_NAMES);
     let inline = await resolveInlineCookies({
@@ -175,7 +178,7 @@ export async function buildBrowserConfig(options) {
         allowCookieErrors: options.browserAllowCookieErrors ?? true,
         remoteChrome,
         browserTabRef: options.browserTab ?? undefined,
-        thinkingTime: normalizeThinkingTimeLevel(options.browserThinkingTime) ?? undefined,
+        thinkingTime,
         researchMode: options.browserResearch === "deep" ? "deep" : "off",
         archiveConversations: options.browserArchive,
     };

package/dist/src/cli/options.js

@@ -133,7 +133,7 @@ export function parseThinkingTimeOption(value) {
     if (normalized) {
         return normalized;
     }
-    throw new InvalidArgumentError('Thinking time must be one of "light", "standard", "extended", "extra-high", "heavy", or a ChatGPT UI alias like "instant", "medium", "high", or "xhigh".');
+    throw new InvalidArgumentError('Thinking time must be one of "light", "standard", "extended", "extra-high", "pro", "heavy", or a ChatGPT UI alias like "instant", "medium", "high", or "xhigh".');
 }
 export function normalizeModelOption(value) {
     return (value ?? "").trim();

package/dist/src/oracle/thinkingTime.js

@@ -3,6 +3,10 @@ export const THINKING_TIME_LEVELS = [
     "standard",
     "extended",
     "extra-high",
+    // ChatGPT's unified Intelligence picker exposes Pro as the top effort tier of
+    // the active model rather than a separate model row, so it is a level here.
+    // Kept distinct from "heavy": requesting Pro must be deliberate.
+    "pro",
     "heavy",
 ];
 export const THINKING_TIME_ALIASES = [
@@ -38,6 +42,8 @@ export function normalizeThinkingTimeLevel(value) {
         case "extrahigh":
         case "xhigh":
             return "extra-high";
+        case "pro":
+            return "pro";
         case "heavy":
             return "heavy";
         default:

package/dist/src/sessionManager.js

@@ -23,11 +23,86 @@ const DEFAULT_SLUG = "session";
 const MAX_SLUG_WORDS = 5;
 const MIN_CUSTOM_SLUG_WORDS = 3;
 const MAX_SLUG_WORD_LENGTH = 10;
+// Session artifacts (prompt, attached file contents, model responses) are sensitive.
+// Keep them owner-only, matching the meta.json / bridge-config posture (0o600/0o700).
+const SESSION_DIR_MODE = 0o700;
+const SESSION_FILE_MODE = 0o600;
+const sessionStorageHardening = new Map();
 async function ensureDir(dirPath) {
-    await fs.mkdir(dirPath, { recursive: true });
+    await fs.mkdir(dirPath, { recursive: true, mode: SESSION_DIR_MODE });
+}
+function isMissingPathError(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function chmodIfPresent(targetPath, mode) {
+    try {
+        await fs.chmod(targetPath, mode);
+        return true;
+    }
+    catch (error) {
+        if (isMissingPathError(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+async function hardenSessionStorageEntry(targetPath) {
+    let stats;
+    try {
+        stats = await fs.lstat(targetPath);
+    }
+    catch (error) {
+        if (isMissingPathError(error)) {
+            return;
+        }
+        throw error;
+    }
+    if (stats.isSymbolicLink()) {
+        return;
+    }
+    if (stats.isDirectory()) {
+        if (!(await chmodIfPresent(targetPath, SESSION_DIR_MODE))) {
+            return;
+        }
+        let entries;
+        try {
+            entries = await fs.readdir(targetPath);
+        }
+        catch (error) {
+            if (isMissingPathError(error)) {
+                return;
+            }
+            throw error;
+        }
+        for (const entry of entries) {
+            await hardenSessionStorageEntry(path.join(targetPath, entry));
+        }
+        return;
+    }
+    if (stats.isFile()) {
+        await chmodIfPresent(targetPath, SESSION_FILE_MODE);
+    }
 }
 export async function ensureSessionStorage() {
-    await ensureDir(getSessionsDir());
+    const sessionsDir = getSessionsDir();
+    await ensureDir(sessionsDir);
+    if (process.platform === "win32") {
+        return;
+    }
+    const stats = await fs.lstat(sessionsDir);
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        return;
+    }
+    const identity = `${sessionsDir}:${stats.dev}:${stats.ino}`;
+    let hardening = sessionStorageHardening.get(identity);
+    if (!hardening) {
+        hardening = hardenSessionStorageEntry(sessionsDir).catch((error) => {
+            sessionStorageHardening.delete(identity);
+            throw error;
+        });
+        sessionStorageHardening.set(identity, hardening);
+    }
+    await hardening;
 }
 function slugify(text, maxWords = MAX_SLUG_WORDS) {
     const normalized = text?.toLowerCase() ?? "";
@@ -110,7 +185,7 @@ async function reserveUniqueSessionDir(baseSlug) {
     for (;;) {
         const dir = sessionDir(candidate);
         try {
-            await fs.mkdir(dir, { recursive: false });
+            await fs.mkdir(dir, { recursive: false, mode: SESSION_DIR_MODE });
             return candidate;
         }
         catch (error) {
@@ -171,7 +246,10 @@ export async function updateModelRunMetadata(sessionId, model, updates) {
         ...updates,
         model,
     });
-    await fs.writeFile(modelJsonPath(sessionId, model), JSON.stringify(next, null, 2), "utf8");
+    await fs.writeFile(modelJsonPath(sessionId, model), JSON.stringify(next, null, 2), {
+        encoding: "utf8",
+        mode: SESSION_FILE_MODE,
+    });
     return next;
 }
 export async function readModelRunMetadata(sessionId, model) {
@@ -261,10 +339,13 @@ export async function initializeSession(options, cwd, notifications, baseSlugOve
             status: "pending",
             log: { path: path.relative(sessionDir(sessionId), logFilePath) },
         };
-        await fs.writeFile(jsonPath, JSON.stringify(modelRecord, null, 2), "utf8");
-        await fs.writeFile(logFilePath, "", "utf8");
+        await fs.writeFile(jsonPath, JSON.stringify(modelRecord, null, 2), {
+            encoding: "utf8",
+            mode: SESSION_FILE_MODE,
+        });
+        await fs.writeFile(logFilePath, "", { encoding: "utf8", mode: SESSION_FILE_MODE });
     }));
-    await fs.writeFile(logPath(sessionId), "", "utf8");
+    await fs.writeFile(logPath(sessionId), "", { encoding: "utf8", mode: SESSION_FILE_MODE });
     return metadata;
 }
 export async function readSessionMetadata(sessionId) {
@@ -350,9 +431,9 @@ async function attachModelRuns(meta, sessionId) {
 export function createSessionLogWriter(sessionId, model) {
     const targetPath = model ? modelLogPath(sessionId, model) : logPath(sessionId);
     if (model) {
-        mkdirSync(modelsDir(sessionId), { recursive: true });
+        mkdirSync(modelsDir(sessionId), { recursive: true, mode: SESSION_DIR_MODE });
     }
-    const stream = createWriteStream(targetPath, { flags: "a" });
+    const stream = createWriteStream(targetPath, { flags: "a", mode: SESSION_FILE_MODE });
     const logLine = (line = "") => {
         stream.write(`${line}\n`);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steipete/oracle",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "CLI wrapper around OpenAI Responses API with GPT-5.6 Sol, GPT-5.6, GPT-5.5 Pro, GPT-5.5, GPT-5.4, GPT-5.2, GPT-5.1, and GPT-5.1 Codex high reasoning modes.",
   "keywords": [],
   "homepage": "https://askoracle.sh",
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@anthropic-ai/tokenizer": "^0.0.4",
-    "@google/genai": "^2.15.0",
+    "@google/genai": "^2.16.0",
     "@google/generative-ai": "^0.24.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@steipete/sweet-cookie": "^0.4.1",
@@ -77,24 +77,24 @@
     "openai": "^7.4.0",
     "osc-progress": "^0.3.2",
     "qs": "^6.15.3",
-    "shiki": "^4.4.2",
+    "shiki": "^4.4.3",
     "toasted-notifier": "^10.1.0",
-    "tokentally": "^0.1.3",
+    "tokentally": "^0.1.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@anthropic-ai/tokenizer": "^0.0.4",
     "@types/chrome-remote-interface": "^0.34.0",
     "@types/inquirer": "^9.0.10",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "@vitest/coverage-v8": "4.1.10",
-    "devtools-protocol": "0.0.1673900",
+    "devtools-protocol": "0.0.1676105",
     "es-toolkit": "^1.50.0",
-    "esbuild": "^0.28.1",
-    "oxfmt": "0.62.0",
-    "oxlint": "^1.77.0",
+    "esbuild": "^0.28.2",
+    "oxfmt": "0.63.0",
+    "oxlint": "^1.78.0",
     "puppeteer-core": "^25.5.0",
-    "tsx": "^4.23.7",
+    "tsx": "^4.23.12",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },

package/dist/vendor/oracle-notifier/OracleNotifier.app/Contents/Info.plist

@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleIdentifier</key>
-  <string>com.steipete.oracle.notifier</string>
-  <key>CFBundleName</key>
-  <string>OracleNotifier</string>
-  <key>CFBundleDisplayName</key>
-  <string>Oracle Notifier</string>
-  <key>CFBundleExecutable</key>
-  <string>OracleNotifier</string>
-  <key>CFBundleIconFile</key>
-  <string>OracleIcon</string>
-  <key>CFBundlePackageType</key>
-  <string>APPL</string>
-  <key>LSMinimumSystemVersion</key>
-  <string>13.0</string>
-</dict>
-</plist>

package/dist/vendor/oracle-notifier/OracleNotifier.app/Contents/_CodeSignature/CodeResources

@@ -1,128 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>files</key>
-	<dict>
-		<key>Resources/OracleIcon.icns</key>
-		<data>
-		edUHAMetayIv3xtc3Vb92VXRLfM=
-		</data>
-	</dict>
-	<key>files2</key>
-	<dict>
-		<key>Resources/OracleIcon.icns</key>
-		<dict>
-			<key>hash2</key>
-			<data>
-			AVPJK/6w6IOsDLmZTW4hL+Za+/4wHMxZiIp0t6m3NRA=
-			</data>
-		</dict>
-	</dict>
-	<key>rules</key>
-	<dict>
-		<key>^Resources/</key>
-		<true/>
-		<key>^Resources/.*\.lproj/</key>
-		<dict>
-			<key>optional</key>
-			<true/>
-			<key>weight</key>
-			<real>1000</real>
-		</dict>
-		<key>^Resources/.*\.lproj/locversion.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>1100</real>
-		</dict>
-		<key>^Resources/Base\.lproj/</key>
-		<dict>
-			<key>weight</key>
-			<real>1010</real>
-		</dict>
-		<key>^version.plist$</key>
-		<true/>
-	</dict>
-	<key>rules2</key>
-	<dict>
-		<key>.*\.dSYM($|/)</key>
-		<dict>
-			<key>weight</key>
-			<real>11</real>
-		</dict>
-		<key>^(.*/)?\.DS_Store$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>2000</real>
-		</dict>
-		<key>^(Frameworks|SharedFrameworks|PlugIns|Plug-ins|XPCServices|Helpers|MacOS|Library/(Automator|Spotlight|LoginItems))/</key>
-		<dict>
-			<key>nested</key>
-			<true/>
-			<key>weight</key>
-			<real>10</real>
-		</dict>
-		<key>^.*</key>
-		<true/>
-		<key>^Info\.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^PkgInfo$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^Resources/</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^Resources/.*\.lproj/</key>
-		<dict>
-			<key>optional</key>
-			<true/>
-			<key>weight</key>
-			<real>1000</real>
-		</dict>
-		<key>^Resources/.*\.lproj/locversion.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>1100</real>
-		</dict>
-		<key>^Resources/Base\.lproj/</key>
-		<dict>
-			<key>weight</key>
-			<real>1010</real>
-		</dict>
-		<key>^[^/]+$</key>
-		<dict>
-			<key>nested</key>
-			<true/>
-			<key>weight</key>
-			<real>10</real>
-		</dict>
-		<key>^embedded\.provisionprofile$</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^version\.plist$</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-	</dict>
-</dict>
-</plist>