@visulima/dev-toolbar 1.0.0-alpha.4 → 1.0.0-alpha.40

package/CHANGELOG.md

@@ -1,3 +1,324 @@
+## @visulima/dev-toolbar [1.0.0-alpha.40](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.39...@visulima/dev-toolbar@1.0.0-alpha.40) (2026-06-21)
+
+## @visulima/dev-toolbar [1.0.0-alpha.39](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.38...@visulima/dev-toolbar@1.0.0-alpha.39) (2026-06-21)
+
+## @visulima/dev-toolbar [1.0.0-alpha.38](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.37...@visulima/dev-toolbar@1.0.0-alpha.38) (2026-06-20)
+
+## @visulima/dev-toolbar [1.0.0-alpha.37](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.36...@visulima/dev-toolbar@1.0.0-alpha.37) (2026-06-20)
+
+### Bug Fixes
+
+* **dev-toolbar:** bump @babel/parser to v8 and fix vite 8 source-map type ([eb8a111](https://github.com/visulima/visulima/commit/eb8a1110eb9a5ae6acedc55d970d10e896a16950))
+
+## @visulima/dev-toolbar [1.0.0-alpha.36](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.35...@visulima/dev-toolbar@1.0.0-alpha.36) (2026-06-19)
+
+## @visulima/dev-toolbar [1.0.0-alpha.35](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.34...@visulima/dev-toolbar@1.0.0-alpha.35) (2026-06-19)
+
+### Bug Fixes
+
+* **dev-toolbar:** resolve import/no-named-as-default eslint error ([#686](https://github.com/visulima/visulima/issues/686)) ([87964f5](https://github.com/visulima/visulima/commit/87964f587e9b13fff0ea8b7ea8f058e847d7c015))
+
+## @visulima/dev-toolbar [1.0.0-alpha.34](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.33...@visulima/dev-toolbar@1.0.0-alpha.34) (2026-06-19)
+
+## @visulima/dev-toolbar [1.0.0-alpha.33](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.32...@visulima/dev-toolbar@1.0.0-alpha.33) (2026-06-13)
+
+### Bug Fixes
+
+* **dev-toolbar:** bound annotation and thread growth ([c07b6f1](https://github.com/visulima/visulima/commit/c07b6f1f7994d4160977bc286acc5b5b7d68d249))
+* **dev-toolbar:** harden readFile rpc and fix dev-toolbar docs/perf ([385f279](https://github.com/visulima/visulima/commit/385f279d911d5f9df9290b33151fb62411bdd5b9))
+
+### Miscellaneous Chores
+
+* apply safe prettier and eslint formatting ([05120af](https://github.com/visulima/visulima/commit/05120af8c898d18c495575680f01134681e29b65))
+* **dev-toolbar:** apply lint-driven style cleanup across src and tests ([b1f004d](https://github.com/visulima/visulima/commit/b1f004d661a6b41184e1dab57d291045e6908f72))
+
+### Tests
+
+* **dev-toolbar:** cover vite-plugin, global API, hook events, helpers ([c402e62](https://github.com/visulima/visulima/commit/c402e625e6db180767dc2336f28faf4c1c45ce7f))
+* fix platform-specific path assertions ([a74080a](https://github.com/visulima/visulima/commit/a74080ab1adc4227af3d7d9c302547167cca7f16))
+
+### Build System
+
+* regenerate bundled-license manifests and types ordering ([af26588](https://github.com/visulima/visulima/commit/af26588d75aaa937fd4862800560bd4070a4878c))
+
+## @visulima/dev-toolbar [1.0.0-alpha.32](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.31...@visulima/dev-toolbar@1.0.0-alpha.32) (2026-06-04)
+
+### Bug Fixes
+
+* **dev-toolbar:** 3 bug fixes ([ff28161](https://github.com/visulima/visulima/commit/ff281617a8346dcfae90db522507b8a7c0c94c61))
+
+### Miscellaneous Chores
+
+* apply eslint + prettier autofixes across packages ([c1bb784](https://github.com/visulima/visulima/commit/c1bb7848a0d93d0dfe2960c77e3cda22239c79a0))
+
+### Tests
+
+* **dev-toolbar:** cover rpc functions/server/client, timeline, hooks, messaging presets and vite matcher ([16f7dd8](https://github.com/visulima/visulima/commit/16f7dd85180082d48016193255b4d251f4d145ea))
+* **dev-toolbar:** cover vite-config rpc function branches ([1c66865](https://github.com/visulima/visulima/commit/1c668656af8b595c1bb7ac37f6249eb3d21feecc))
+
+## @visulima/dev-toolbar [1.0.0-alpha.31](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.30...@visulima/dev-toolbar@1.0.0-alpha.31) (2026-05-27)
+
+### Bug Fixes
+
+* **storage-client:** percent-encode user fields in defaultFingerprint ([7c78a0f](https://github.com/visulima/visulima/commit/7c78a0f9512e2a673b941d80839e9f1e86b7b5d0))
+
+### Documentation
+
+* prettier-format agent instructions ([71b6414](https://github.com/visulima/visulima/commit/71b6414528780ac82c4e0bb25b5f4f11faba5549))
+
+## @visulima/dev-toolbar [1.0.0-alpha.30](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.29...@visulima/dev-toolbar@1.0.0-alpha.30) (2026-05-27)
+
+## @visulima/dev-toolbar [1.0.0-alpha.29](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.28...@visulima/dev-toolbar@1.0.0-alpha.29) (2026-05-26)
+
+### Miscellaneous Chores
+
+* sorted package.json ([b47c545](https://github.com/visulima/visulima/commit/b47c545591600fdab17d5cd3a3fbc68b61e199da))
+
+## @visulima/dev-toolbar [1.0.0-alpha.28](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.27...@visulima/dev-toolbar@1.0.0-alpha.28) (2026-05-26)
+
+### Bug Fixes
+
+* **security:** address codeql findings across packages ([3366f9c](https://github.com/visulima/visulima/commit/3366f9c07d54bdde5242fbd90780baa4634de179))
+
+### Miscellaneous Chores
+
+* **ci-stability:** green CI across vis, native, lint, tests, attw ([#651](https://github.com/visulima/visulima/issues/651)) ([d4eb684](https://github.com/visulima/visulima/commit/d4eb684b5f75c818c9251048c605a0ed54a268e3))
+* **repo:** apply eslint --fix and prettier --fix across packages ([#650](https://github.com/visulima/visulima/issues/650)) ([2e26a84](https://github.com/visulima/visulima/commit/2e26a84774f218f21345e9a8ecd68236b6542743)), closes [#620](https://github.com/visulima/visulima/issues/620)
+* **repo:** sort package.json keys across all packages ([e1fd9ab](https://github.com/visulima/visulima/commit/e1fd9ab467ef96a98c777da1572ff6a50fcf7e71))
+
+### Tests
+
+* **repo:** add dist runtime + types integration tests ([32ee300](https://github.com/visulima/visulima/commit/32ee300b7184117a0ddf9f9d390f75f8932d5ed9))
+* **repo:** cover bin entry points in dist integration suite ([7479ef1](https://github.com/visulima/visulima/commit/7479ef113cf5ccef25692619082afb1b6a0eecab))
+
+## @visulima/dev-toolbar [1.0.0-alpha.27](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.26...@visulima/dev-toolbar@1.0.0-alpha.27) (2026-05-20)
+
+### Tests
+
+* **dev-toolbar:** rebind localStorage globals for Node 25 ([ee5e1f8](https://github.com/visulima/visulima/commit/ee5e1f8774cce170c95248d9c4d74d91fafe90e7))
+
+## @visulima/dev-toolbar [1.0.0-alpha.26](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.25...@visulima/dev-toolbar@1.0.0-alpha.26) (2026-05-19)
+
+## @visulima/dev-toolbar [1.0.0-alpha.25](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.24...@visulima/dev-toolbar@1.0.0-alpha.25) (2026-05-16)
+
+## @visulima/dev-toolbar [1.0.0-alpha.24](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.23...@visulima/dev-toolbar@1.0.0-alpha.24) (2026-05-14)
+
+### Bug Fixes
+
+* **dev-toolbar:** cast form element to AnnotationElement shape ([618e91e](https://github.com/visulima/visulima/commit/618e91e5535a75f1d2d0132e0f7085987af79b34))
+* **dev-toolbar:** scope JSX inject to enclosing function ([1b7e82a](https://github.com/visulima/visulima/commit/1b7e82af78cd599bd35b58a2f3e232c25b7e5192))
+* **dev-toolbar:** silence unnecessary-type-assertion on form element cast ([86282de](https://github.com/visulima/visulima/commit/86282de06a3581be69210a12f12e307ac6ca99c8))
+
+### Miscellaneous Chores
+
+* **error:** apply prettier and eslint formatting sweep ([25c5eaf](https://github.com/visulima/visulima/commit/25c5eaf4989bddfe860b52aea113b3e229fea84f))
+
+## @visulima/dev-toolbar [1.0.0-alpha.23](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.22...@visulima/dev-toolbar@1.0.0-alpha.23) (2026-05-11)
+
+## @visulima/dev-toolbar [1.0.0-alpha.22](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.21...@visulima/dev-toolbar@1.0.0-alpha.22) (2026-05-11)
+
+## @visulima/dev-toolbar [1.0.0-alpha.21](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.20...@visulima/dev-toolbar@1.0.0-alpha.21) (2026-05-10)
+
+## @visulima/dev-toolbar [1.0.0-alpha.20](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.19...@visulima/dev-toolbar@1.0.0-alpha.20) (2026-05-10)
+
+## @visulima/dev-toolbar [1.0.0-alpha.19](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.18...@visulima/dev-toolbar@1.0.0-alpha.19) (2026-05-07)
+
+## @visulima/dev-toolbar [1.0.0-alpha.18](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.17...@visulima/dev-toolbar@1.0.0-alpha.18) (2026-05-07)
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** bump peer ranges for @modelcontextprotocol/sdk and vite ([b6bbb40](https://github.com/visulima/visulima/commit/b6bbb406766e74f822ffe9956e85acf5feaa1ded))
+
+## @visulima/dev-toolbar [1.0.0-alpha.17](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.16...@visulima/dev-toolbar@1.0.0-alpha.17) (2026-05-06)
+
+## @visulima/dev-toolbar [1.0.0-alpha.16](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.15...@visulima/dev-toolbar@1.0.0-alpha.16) (2026-05-06)
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** apply prettier and eslint quote-style auto-fix ([3bb9b50](https://github.com/visulima/visulima/commit/3bb9b50337d5bbc0e3a1bd372a69ceebad1fb188))
+* **dev-toolbar:** housekeeping cleanup ([d7c5ed5](https://github.com/visulima/visulima/commit/d7c5ed5518069405476212d8a9814af50cf2ef15))
+
+## @visulima/dev-toolbar [1.0.0-alpha.15](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.14...@visulima/dev-toolbar@1.0.0-alpha.15) (2026-05-04)
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** allow zod v4 and align eslint-plugin-zod with catalog ([70733ad](https://github.com/visulima/visulima/commit/70733ad6155c3bc460d2bc0943f88af59b7b6725))
+
+## @visulima/dev-toolbar [1.0.0-alpha.14](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.13...@visulima/dev-toolbar@1.0.0-alpha.14) (2026-04-30)
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** upgrade packem to 2.0.0-alpha.76 ([4a496ed](https://github.com/visulima/visulima/commit/4a496edb863ecd414c34ff043d49ba3171538ccd))
+* re-sort workspace package.json files via vis sort-package-json ([f625696](https://github.com/visulima/visulima/commit/f625696cfac974325774b3243e1a83c3d23acbd7))
+* simplify pnpm-workspace packages list ([7cab221](https://github.com/visulima/visulima/commit/7cab221163632d9b7aa044a6f88c49083103a869))
+
+## @visulima/dev-toolbar [1.0.0-alpha.13](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.12...@visulima/dev-toolbar@1.0.0-alpha.13) (2026-04-22)
+
+### Bug Fixes
+
+* Remove JSR configuration generation script and generated jsr.json files ([#616](https://github.com/visulima/visulima/issues/616)) ([533744b](https://github.com/visulima/visulima/commit/533744b103b74896941db5b727173e617a27a63b))
+
+## @visulima/dev-toolbar [1.0.0-alpha.12](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.11...@visulima/dev-toolbar@1.0.0-alpha.12) (2026-04-21)
+
+### Miscellaneous Chores
+
+* jsr.json update and lock file ([73fce38](https://github.com/visulima/visulima/commit/73fce38c7cb4603f3fffb88609b1b18e2feb4937))
+
+## @visulima/dev-toolbar [1.0.0-alpha.11](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.10...@visulima/dev-toolbar@1.0.0-alpha.11) (2026-04-21)
+
+### Miscellaneous Chores
+
+* update the jsr.json ([864ab7e](https://github.com/visulima/visulima/commit/864ab7e71c4b5ae82f64792d1ae8debfea2c539b))
+
+## @visulima/dev-toolbar [1.0.0-alpha.10](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.9...@visulima/dev-toolbar@1.0.0-alpha.10) (2026-04-21)
+
+### Bug Fixes
+
+* **dev-toolbar:** resolve type errors in annotation overlay and perf monitor ([b201aa6](https://github.com/visulima/visulima/commit/b201aa6605a9fa030ce74f58743e10a042183156))
+* **tui:** inline component and hook barrel exports in ink entry ([1cf8dd2](https://github.com/visulima/visulima/commit/1cf8dd25c91a2001268fb9d964d95df649bf7832))
+
+### Miscellaneous Chores
+
+* **api-platform:** apply pending lint and source updates ([3fb0043](https://github.com/visulima/visulima/commit/3fb0043a4cf35f752ca89a09a077100ae0142da8))
+* bump engines.node to ^22.14.0 || >=24.10.0 ([c3d0931](https://github.com/visulima/visulima/commit/c3d0931d1504e4f21ebf50ea680cfa7ce4ba15ce))
+* **dev-toolbar:** apply formatter and type refinements ([167c654](https://github.com/visulima/visulima/commit/167c654ae2f7c57a4ff7d0c84f5196de4a72c8d7))
+* **dev-toolbar:** apply pending changes ([e16638c](https://github.com/visulima/visulima/commit/e16638c00907a4612fa53f74f141bd3aac9f6ca9))
+* **dev-toolbar:** apply pending lint and source updates ([ece08e1](https://github.com/visulima/visulima/commit/ece08e16c85e927d1eead02eea69f15d5ea1a3dc))
+* **dev-toolbar:** enforce curly braces and apply lint fixes ([1b6797e](https://github.com/visulima/visulima/commit/1b6797ec1844979a7bb3ac3aa094e42a4fe3a68b))
+* fixed jsr.json ([5d85e51](https://github.com/visulima/visulima/commit/5d85e5179de38e284ec433b14d77c71a1619c8d6))
+
+### Code Refactoring
+
+* replace inline import() types with top-level imports ([4569a4c](https://github.com/visulima/visulima/commit/4569a4ca04723da069f985855dcfab292f7347e1))
+
+### Tests
+
+* **tui, dev-toolbar:** fix expect.assertions counts on looped assertions ([898bc59](https://github.com/visulima/visulima/commit/898bc59ef217f7c8ee2aa7fdf7da3d355c028b13))
+
+## @visulima/dev-toolbar [1.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.8...@visulima/dev-toolbar@1.0.0-alpha.9) (2026-04-15)
+
+### Bug Fixes
+
+* **dev-toolbar:** add missing DOM property types and tighten getOptionValue fallback ([55326d0](https://github.com/visulima/visulima/commit/55326d02b173211608aefa994aa0e5f54705120d))
+* **dev-toolbar:** replace bogus .toBe(true) assertions with proper matchers ([e672ca4](https://github.com/visulima/visulima/commit/e672ca459bf8d3e9141e277755bc35f2b59dac07))
+* **error-debugging:** resolve eslint and type-safety issues ([886dbff](https://github.com/visulima/visulima/commit/886dbffe3f744c9493fcc54e781de3fd21eebf78))
+
+## @visulima/dev-toolbar [1.0.0-alpha.8](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.7...@visulima/dev-toolbar@1.0.0-alpha.8) (2026-04-08)
+
+### Bug Fixes
+
+* **dev-toolbar:** resolve eslint errors ([225128a](https://github.com/visulima/visulima/commit/225128ab192d318b9d997ad793c7c43384e2431e))
+* remove deprecated baseUrl and downlevelIteration from tsconfigs ([a708366](https://github.com/visulima/visulima/commit/a708366b5c3bc73cfde480a712ed397bd921fb93))
+* resolve failing tests across multiple packages ([2b4b6f0](https://github.com/visulima/visulima/commit/2b4b6f04169b60fdc4cf77b293015436a272c0fb))
+
+### Miscellaneous Chores
+
+* added og images ([02d9d1e](https://github.com/visulima/visulima/commit/02d9d1e47be3ce75679ea89e857dc4e4bfe4946b))
+* apply linting and formatting fixes across packages ([5d150a5](https://github.com/visulima/visulima/commit/5d150a578f9ce861c791843c683deeb849b774a9))
+* **dev-toolbar:** add tsconfig.eslint.json for type-aware linting ([d2c864a](https://github.com/visulima/visulima/commit/d2c864a01f9c4805975596c9de8af4a04ac4beaa))
+* **dev-toolbar:** apply auto-fix formatting ([3a80a7d](https://github.com/visulima/visulima/commit/3a80a7daaadcc9705ebb153bfea617e4a5029379))
+* **dev-toolbar:** apply prettier formatting ([a6d5528](https://github.com/visulima/visulima/commit/a6d5528602966810f03eb30c7883b8fd53088d40))
+* **dev-toolbar:** expand braceless if statements to block syntax ([b059279](https://github.com/visulima/visulima/commit/b059279c444036b52c94515d852ec20cd782692e))
+* **dev-toolbar:** expand inline if-return to block syntax ([db834ab](https://github.com/visulima/visulima/commit/db834ab5b42ff3dca9ef90e478c690e8367d4df8))
+* **dev-toolbar:** expand inline if-return to block syntax ([90ffee8](https://github.com/visulima/visulima/commit/90ffee895f5fa746932e6a4e2a3323b621af763f))
+* **dev-toolbar:** migrate .prettierrc.cjs to prettier.config.js ([1cd3cc7](https://github.com/visulima/visulima/commit/1cd3cc72156127384babc0238cfe90b328683cf3))
+* update bundled dependency licenses ([6ace4c6](https://github.com/visulima/visulima/commit/6ace4c69d41fc1fd0a744fbca8ca219ba631b4ab))
+
+## @visulima/dev-toolbar [1.0.0-alpha.7](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.6...@visulima/dev-toolbar@1.0.0-alpha.7) (2026-03-26)
+
+### Features
+
+* **web:** auto-generate packages page from workspace metadata ([623e520](https://github.com/visulima/visulima/commit/623e5207693a7fe720f5f2f179593a3654c880e3))
+
+## @visulima/dev-toolbar [1.0.0-alpha.6](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.5...@visulima/dev-toolbar@1.0.0-alpha.6) (2026-03-26)
+
+### Features
+
+* **dev-toolbar:** add accessibility info capture to inspector ([2b98ee6](https://github.com/visulima/visulima/commit/2b98ee6249759d1d2c42504354ebf3a92db4a6e6))
+* **dev-toolbar:** add custom Select component replacing native <select> ([c9c8685](https://github.com/visulima/visulima/commit/c9c8685ea3a05c28ea89d5f5d852d56bc8cbcad0))
+* **dev-toolbar:** add viewport rulers with draggable guidelines to inspector ([9df079a](https://github.com/visulima/visulima/commit/9df079a83563b1afc617d76df78259082ea98817))
+* **dev-toolbar:** add visual annotation system with MCP agent integration ([be88cfe](https://github.com/visulima/visulima/commit/be88cfe30f3f624075167762e9c9780653dd34e9))
+* **dev-toolbar:** redesign annotation popups, add toast notifications, improve docs ([cca080f](https://github.com/visulima/visulima/commit/cca080fc6098a692e681ee5b140f8c5c3a810a2c))
+
+### Bug Fixes
+
+* **api-platform:** use workspace:* for internal [@visulima](https://github.com/visulima) deps ([daa2b0b](https://github.com/visulima/visulima/commit/daa2b0bfb491b42bc83c369fec2dcd7950f082b0))
+* **dev-toolbar:** address code review findings across toolbar components ([449a300](https://github.com/visulima/visulima/commit/449a300226e4ccaee52ad258d5eccf6f77a72343))
+* **dev-toolbar:** align inspector floating badge with main toolbar styling ([8ea1814](https://github.com/visulima/visulima/commit/8ea1814b596126b71231fd124c036f1e450275ef))
+* **dev-toolbar:** audit Select component, add tests, fix pre-existing type error ([c8452d3](https://github.com/visulima/visulima/commit/c8452d3b495e9707579490155e6689c40cff9568))
+* **dev-toolbar:** auto-detect TanStack Start and shield Preact from React Compiler ([6e9fa57](https://github.com/visulima/visulima/commit/6e9fa571ded1ff53d8809cee47fb404897320e9f))
+* **dev-toolbar:** fix coordinate bugs, orphaned elements, and doc inaccuracies ([efa9c54](https://github.com/visulima/visulima/commit/efa9c544c9a8591c6efe6fd4a9995b411c054f54))
+* **dev-toolbar:** open inspector popup at click point and add visible drag handle ([c012aed](https://github.com/visulima/visulima/commit/c012aed47eeabf2047d5a7a7e46cab807de902f3))
+* **dev-toolbar:** prevent querySelector crash on area selection element paths ([ecd64d4](https://github.com/visulima/visulima/commit/ecd64d4b418e74cc582da0cd5efdb9f5e8e95d2b))
+* **dev-toolbar:** resolve all TypeScript, ESLint, and Prettier errors in annotation system ([2fae465](https://github.com/visulima/visulima/commit/2fae4658017d61262293a41bef13348bbfc70e41))
+* **dev-toolbar:** use correct ARIA role in select search tests ([2e1ddfe](https://github.com/visulima/visulima/commit/2e1ddfed1b49697a2d772c5a6b61bf3b6538a43b))
+* **dev-toolbar:** use workspace:* for internal [@visulima](https://github.com/visulima) deps ([26ea008](https://github.com/visulima/visulima/commit/26ea00878218a34f89587fb9a2157cb379e98733))
+* **web:** improve build setup with incremental stats caching and prod install ([fe33e75](https://github.com/visulima/visulima/commit/fe33e75827586779b4b3a0c6d57b39f889ee6207))
+
+### Documentation
+
+* **dev-toolbar:** update examples to use native Vite 8 resolve.tsconfigPaths ([d54d3f7](https://github.com/visulima/visulima/commit/d54d3f71714fc600e4b965e1ab2bdbe0cc442ba6))
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** migrate deps to pnpm catalogs ([a43badc](https://github.com/visulima/visulima/commit/a43badcc8cd19d9c3c9cda4b2d75e272d76d51c8))
+* **dev-toolbar:** update dependencies ([8cac2a2](https://github.com/visulima/visulima/commit/8cac2a2068d902ee8196f8e1f50d658644be7e70))
+* update gen file ([8794258](https://github.com/visulima/visulima/commit/87942584bc22cab96a14094d2ec46ec667179490))
+* visulima website ([#591](https://github.com/visulima/visulima/issues/591)) ([59ab2e2](https://github.com/visulima/visulima/commit/59ab2e2befb03e51cd2088956f83d9b87de6d033))
+
+### Code Refactoring
+
+* **dev-toolbar:** use native Vite 8 tsconfigPaths in cloudflare example ([fb15d1d](https://github.com/visulima/visulima/commit/fb15d1df62040853a36e7926382765e902380d3a))
+* **dev-toolbar:** use native Vite 8 tsconfigPaths in tanstack-start example ([d89aef7](https://github.com/visulima/visulima/commit/d89aef7c2ba4a8443897d3f7cb9ada494d38d2c4))
+* **docs:** migrate Nextra components to fumadocs-ui, remove Nextra stripping ([484878f](https://github.com/visulima/visulima/commit/484878f01879363ef5e9a0282904dc4627d6060c))
+
+## @visulima/dev-toolbar [1.0.0-alpha.5](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.4...@visulima/dev-toolbar@1.0.0-alpha.5) (2026-03-06)
+
+### Features
+
+* **dev-toolbar:** add assets app export and make axe-core an optional peer dependency ([812bc8d](https://github.com/visulima/visulima/commit/812bc8d45ef760862d43f59665e1f86c7d4a5008))
+* **dev-toolbar:** add singleton guard, SEO JSON-LD validation, editor preference, and tests ([7584425](https://github.com/visulima/visulima/commit/758442518f8390b1faa0fd553d7ed1aaa4d9c037))
+* **dev-toolbar:** implement iframe app rendering and custom app registration ([a1585a8](https://github.com/visulima/visulima/commit/a1585a8bd3624ae13b40fa386cd66b62c29ca08f))
+* **dev-toolbar:** keep inspector active after element click and fix UX issues ([8f7e88a](https://github.com/visulima/visulima/commit/8f7e88a874f6412a15bf2adde9ddd95948b07c22))
+* **dev-toolbar:** overhaul vite config app UI with env masking and improved layout ([7cfee9d](https://github.com/visulima/visulima/commit/7cfee9da5957fb9ffbcc940d9948909c4677efb6))
+* **dev-toolbar:** redesign vite config app with tabbed interface ([087df63](https://github.com/visulima/visulima/commit/087df630dc378933e54d1587d40c99f19fca0df0))
+* **dev-toolbar:** remove more overflow app ([cd3f369](https://github.com/visulima/visulima/commit/cd3f369c176c598d2e9a2bcdef194b7d457d343f))
+
+### Bug Fixes
+
+* **dev-toolbar:** move removePopupOutsideHandler declaration before first use ([d734a84](https://github.com/visulima/visulima/commit/d734a847b7f0b4574f081b9b78b2fce3d2b0e698))
+* **dev-toolbar:** resolve all ESLint errors across src files ([165b471](https://github.com/visulima/visulima/commit/165b471c95099bff76ba78d054664e79cfcdcb9a))
+* **dev-toolbar:** resolve ESLint errors in test files and config ([ea7e46c](https://github.com/visulima/visulima/commit/ea7e46c13db73431738a8f75febb847f3e7e530b))
+* **dev-toolbar:** resolve ESLint errors in vite-config app and RPC function ([fedce68](https://github.com/visulima/visulima/commit/fedce686ca59ba5d5b82cd10abfffa8d91a738c1))
+* **dev-toolbar:** split single-line mock factories to satisfy max-statements-per-line ([025b972](https://github.com/visulima/visulima/commit/025b9722b6e854cf1ae53694597e64c63493f730))
+* **dev-toolbar:** update packem to 2.0.0-alpha.54 ([f9779c9](https://github.com/visulima/visulima/commit/f9779c9e8dc7637db3bfef341cb66233469f653f))
+* removed old test ([bfa9e78](https://github.com/visulima/visulima/commit/bfa9e784b2e183ed481d432290070ee554b357ac))
+
+### Performance Improvements
+
+* **dev-toolbar:** replace tailwind-merge with clsx in cn() utility ([6c4740c](https://github.com/visulima/visulima/commit/6c4740c8ce890d955cecbf634dada65fd8a99769))
+
+### Documentation
+
+* **dev-toolbar:** add assets app documentation ([bea25b9](https://github.com/visulima/visulima/commit/bea25b96f7f7dbb2f3952b6c04d38d032569760d))
+* **dev-toolbar:** add iframe app documentation and remove more app references ([03dab85](https://github.com/visulima/visulima/commit/03dab85a92c5ee27b18db018c9dc263a1a3f1ea4))
+* **dev-toolbar:** add vite-overlay integration guide ([8f6f25a](https://github.com/visulima/visulima/commit/8f6f25aae43f0c32380ede56a93915897a4a939f))
+* **dev-toolbar:** update a11y docs to reflect optional axe-core peer dependency ([50396e8](https://github.com/visulima/visulima/commit/50396e8b18c56e716d119a468fa0b1219e789dff))
+* **dev-toolbar:** update built-in app docs for opt-in defaults and add SEO structured data section ([e95050a](https://github.com/visulima/visulima/commit/e95050aa419fe1a85664ccd5c88a3967de70b113))
+
+### Miscellaneous Chores
+
+* **dev-toolbar:** enable a11y in tanstack-start-cloudflare example and fix LICENSE whitespace ([e02cd3e](https://github.com/visulima/visulima/commit/e02cd3edf2426c709d8247cc77f999f56315438e))
+* **dev-toolbar:** update dependencies ([1be313b](https://github.com/visulima/visulima/commit/1be313bf37cd32739ddbb275e1af58dcf029e9a1))
+* **dev-toolbar:** update examples to enable assets and inspector apps ([b3dc74d](https://github.com/visulima/visulima/commit/b3dc74d999acbfe4ee564a141dea47cf5ea2f71a))
+* update dependencies and fix vite-react-rolldown example ([8811909](https://github.com/visulima/visulima/commit/8811909e90877b0041e4b08cdd797d58749464e9))
+* year update ([47f4105](https://github.com/visulima/visulima/commit/47f410596ce7190cfea36a073db32e0cec50bbcd))
+
+### Code Refactoring
+
+* **dev-toolbar:** replace cn wrapper with direct clsx imports ([6ac069b](https://github.com/visulima/visulima/commit/6ac069bf0f2e772f0a5626a47d9034b824a5b23a))
+* **dev-toolbar:** replace cn() wrapper with clsx() directly ([e774b36](https://github.com/visulima/visulima/commit/e774b367f9270dd9e43fcf0b7147a8cd23a1734a))
+
 ## @visulima/dev-toolbar [1.0.0-alpha.4](https://github.com/visulima/visulima/compare/@visulima/dev-toolbar@1.0.0-alpha.3...@visulima/dev-toolbar@1.0.0-alpha.4) (2026-03-04)
 
 ### Bug Fixes

package/LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 visulima
+Copyright (c) 2026 visulima
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -24,16 +24,123 @@ SOFTWARE.
 
 # Licenses of bundled dependencies
 The published @visulima/dev-toolbar artifact additionally contains code with the following licenses:
-ISC
+ISC, MIT
 
 # Bundled dependencies:
+## @babel/helper-string-parser
+License: MIT
+By: The Babel Team
+Repository: https://github.com/babel/babel.git
+
+> MIT License
+>
+> Copyright (c) 2014-present Sebastian McKenzie and other contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining
+> a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to
+> permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be
+> included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+> EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+> NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+> LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+> OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+> WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
+## @babel/helper-validator-identifier
+License: MIT
+By: The Babel Team
+Repository: https://github.com/babel/babel.git
+
+> MIT License
+>
+> Copyright (c) 2014-present Sebastian McKenzie and other contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining
+> a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to
+> permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be
+> included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+> EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+> NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+> LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+> OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+> WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
+## @babel/types
+License: MIT
+By: The Babel Team
+Repository: https://github.com/babel/babel.git
+
+> MIT License
+>
+> Copyright (c) 2014-present Sebastian McKenzie and other contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining
+> a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to
+> permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be
+> included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+> EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+> NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+> LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+> OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+> WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
+## clsx
+License: MIT
+By: Luke Edwards
+Repository: lukeed/clsx
+
+> MIT License
+>
+> Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
 ## lucide-static
 License: ISC
 Repository: https://github.com/lucide-icons/lucide.git
 
 > ISC License
 >
-> Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2026 as part of Feather (MIT). All other copyright (c) for Lucide are held by Lucide Contributors 2026.
+> Copyright (c) 2026 Lucide Icons and Contributors
 >
 > Permission to use, copy, modify, and/or distribute this software for any
 > purpose with or without fee is hereby granted, provided that the above
@@ -49,9 +156,13 @@ Repository: https://github.com/lucide-icons/lucide.git
 >
 > ---
 >
-> The MIT License (MIT) (for portions derived from Feather)
+> The following Lucide icons are derived from the Feather project:
+>
+> airplay, alert-circle, alert-octagon, alert-triangle, aperture, arrow-down-circle, arrow-down-left, arrow-down-right, arrow-down, arrow-left-circle, arrow-left, arrow-right-circle, arrow-right, arrow-up-circle, arrow-up-left, arrow-up-right, arrow-up, at-sign, calendar, cast, check, chevron-down, chevron-left, chevron-right, chevron-up, chevrons-down, chevrons-left, chevrons-right, chevrons-up, circle, clipboard, clock, code, columns, command, compass, corner-down-left, corner-down-right, corner-left-down, corner-left-up, corner-right-down, corner-right-up, corner-up-left, corner-up-right, crosshair, database, divide-circle, divide-square, dollar-sign, download, external-link, feather, frown, hash, headphones, help-circle, info, italic, key, layout, life-buoy, link-2, link, loader, lock, log-in, log-out, maximize, meh, minimize, minimize-2, minus-circle, minus-square, minus, monitor, moon, more-horizontal, more-vertical, move, music, navigation-2, navigation, octagon, pause-circle, percent, plus-circle, plus-square, plus, power, radio, rss, search, server, share, shopping-bag, sidebar, smartphone, smile, square, table-2, tablet, target, terminal, trash-2, trash, triangle, tv, type, upload, x-circle, x-octagon, x-square, x, zoom-in, zoom-out
+>
+> The MIT License (MIT) (for the icons listed above)
 >
-> Copyright (c) 2013-2026 Cole Bemis
+> Copyright (c) 2013-present Cole Bemis
 >
 > Permission is hereby granted, free of charge, to any person obtaining a copy
 > of this software and associated documentation files (the "Software"), to deal
@@ -74,4 +185,25 @@ Repository: https://github.com/lucide-icons/lucide.git
 <!-- /DEPENDENCIES -->
 
 <!-- TYPE_DEPENDENCIES -->
+
+# Licenses of bundled types
+The published @visulima/dev-toolbar artifact additionally contains code with the following licenses:
+MIT
+
+# Bundled types:
+## clsx
+License: MIT
+By: Luke Edwards
+Repository: lukeed/clsx
+
+> MIT License
+>
+> Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 <!-- /TYPE_DEPENDENCIES -->

package/README.md

@@ -1,4 +1,14 @@
-<!-- START_PACKAGE_OG_IMAGE_PLACEHOLDER --><!-- END_PACKAGE_OG_IMAGE_PLACEHOLDER -->
+<!-- START_PACKAGE_OG_IMAGE_PLACEHOLDER -->
+
+<a href="https://www.anolilab.com/open-source" align="center">
+
+  <img src="__assets__/package-og.svg" alt="dev-toolbar" />
+
+</a>
+
+<h3 align="center">Devtools is a set of tools for building advanced devtools for your application</h3>
+
+<!-- END_PACKAGE_OG_IMAGE_PLACEHOLDER -->
 
 <br />
 
@@ -73,32 +83,45 @@ Start your dev server and press **`Alt`+`Shift`+`D`** to open the toolbar.
 | **Tailwind**      | Browse all resolved Tailwind CSS design tokens and their values               |
 | **Settings**      | Theme, toolbar behaviour, panel sizing, and custom keyboard shortcuts         |
 
-All apps are enabled by default. Disable individual apps via plugin options:
+Most apps are **disabled by default** to keep the toolbar minimal. Out of the box
+only **Settings** and **Vite Config** are shown (and **Annotations**, which is
+auto-enabled whenever the inspector is). Opt into the apps you want:
 
 ```ts
 devToolbar({
     apps: {
-        performance: false,
-        seo: false,
+        inspector: true,
+        a11y: true,
+        seo: true,
     },
 });
 ```
 
+> Enabling `inspector` also auto-enables `annotations` (the inspector's badge
+> links to the annotations panel). Set `annotations: false` to suppress it.
+
 ## Plugin Options
 
 ```ts
 devToolbar({
-    // Built-in apps (all true by default)
+    // Master switch — `false` returns an empty plugin array, disabling the whole
+    // toolbar without removing it from vite.config.ts (handy for CI/preview).
+    enabled: true,
+
+    // Built-in apps. Only `settings` and `viteConfig` default to true; everything
+    // else defaults to false. Set an app to true to enable it.
     apps: {
-        a11y: true,
-        moduleGraph: true,
-        performance: true,
-        seo: true,
-        settings: true,
-        timeline: true,
-        viteConfig: true,
-        inspector: true,
-        tailwind: true,
+        a11y: false,
+        annotations: false, // auto-enabled when `inspector` is true
+        assets: false,
+        inspector: false,
+        moduleGraph: false,
+        performance: false,
+        seo: false,
+        settings: true, // enabled by default
+        tailwind: false,
+        timeline: false,
+        viteConfig: true, // enabled by default
     },
 
     // Register custom apps
@@ -108,9 +131,10 @@ devToolbar({
     placement: "bottom-center", // "bottom-left" | "bottom-center" | "bottom-right"
     position: "bottom", // "bottom" | "top" | "left" | "right"
 
-    // Panel defaults (users can override via Settings app)
-    height: 60, // % of viewport height
-    width: 80, // % of viewport width
+    // Panel defaults (users can override via Settings app).
+    // height/width are clamped to the 20–95 range.
+    height: 60, // % of viewport height (20–95)
+    width: 80, // % of viewport width (20–95)
     minimizePanelInactive: 5000, // ms; -1 = never auto-hide
     closeOnOutsideClick: true,
 
@@ -126,6 +150,11 @@ devToolbar({
     // Force a specific editor for "Open in editor" (auto-detected if omitted)
     editor: "webstorm",
 
+    // `readFile` RPC policy. Restricted to a curated extension allowlist by
+    // default. Set to `false` to remove it entirely (recommended with `vite --host`),
+    // or override the allowed extensions.
+    readFile: { extensions: ["ts", "tsx", "js", "jsx", "css", "json", "md"] },
+
     // JSX source injection for click-to-source in the inspector
     injectSource: {
         enabled: true, // set false to opt out
@@ -198,7 +227,35 @@ devToolbar({
 const routes = await helpers.rpc.getRoutes();
 ```
 
-Built-in RPC functions: `getViteConfig()`, `getModuleGraph()`, `openInEditor(file, line, col)`.
+Built-in RPC functions:
+
+| Function                          | Returns                                          |
+| --------------------------------- | ------------------------------------------------ |
+| `getViteConfig()`                 | Fully resolved Vite config (serializable subset) |
+| `getModuleGraph()`                | Vite's live module dependency graph              |
+| `getStaticAssets()`               | Files under `publicDir` (capped at 5000)         |
+| `getTailwindConfig()`             | Resolved Tailwind theme tokens                   |
+| `openInEditor(file, line?, col?)` | Opens the file in the configured editor          |
+| `readFile(path)`                  | Text file under the project root (allowlisted)   |
+| `getAnnotations()`                | All saved annotations                            |
+| `createAnnotation(data)`          | Creates an annotation                            |
+| `updateAnnotation(id, data)`      | Updates an annotation                            |
+| `deleteAnnotation(id)`            | Deletes an annotation + its screenshot           |
+| `saveScreenshot(id, dataUrl)`     | Stores a screenshot, returns its relative path   |
+| `getScreenshot(id)`               | Returns a screenshot as a base64 data URL        |
+
+## Security
+
+The dev toolbar runs only during `vite dev` and is stripped from production builds
+(`removeDevtoolsOnBuild`, default `true`). Still, be aware of the RPC surface:
+
+- **`readFile` returns project files to any connected WebSocket client.** It is
+  confined to the project root and a curated extension allowlist (no `.env`,
+  lockfiles, or key material by default), but if you run the dev server with
+  `vite --host` (e.g. for mobile testing) **any device on your LAN can call it**.
+  Disable it (`readFile: false`) or narrow `readFile.extensions` in that scenario.
+- Screenshot/annotation writes are path-traversal hardened and symlink escapes are
+  rejected; `openInEditor` confines paths to the project root and never shells out.
 
 ## Global API