@wenathlan/devthink 2.0.117 → 2.0.127

package/CHANGELOG.md

@@ -1,5 +1,104 @@
 # DevThink release notes
 
+## 2.0.127
+
+**The release lane answers the owner verdict** — the regression every bump since 2.0.118 carried: the version stamp walked the package manifest, the web manifest and the version module, but the release metadata synchronization (`node tests/release.mjs sync`) never ran after the bump, so the whole lockstep family drifted — the generated release notes (`docs/releasenotes.md`), the permission baseline (`tests/permdiff.json`), the maven revision, the nuget version, the gemspec, the java and csharp carriers, the deno imports and the docker build args all kept answering 2.0.118, the gate ladder refused every candidate since v2.0.119 and the releases shipped the source archive alone. The same wave runs the restamp the release pass demands: the sync walks the whole metadata family to the current version and the release notes render the per channel artifact sections again. **The fourteen open security findings close the same day**: the cadria and debonair locks carry the esbuild override (every nested copy collapses to 0.28.2 and the dev server advisories die) and the uuid override (the xcode transitive walks to 11.1.1 and the buffer bounds advisory dies); the trufflehog step of the security workflow pins its commit sha; the npm install of the maintenance ladder pins the literal the engines floor demands; the six read-only checkouts of the release lane stop persisting credentials (the dispatch tag checkout never holds the repo token again); the automation module answers a caught value with its message only (a stack byte never rides the wire payload); the plain text converter of the scrape engine kills an unterminated script opener as the whole sequence; and the storage platform placeholder of the drives panel joins the sibling no-path grammar so the origin sweep stays honest.
+
+| Area | Change |
+| --- | --- |
+| The release lane | The lockstep restamp — `release.mjs sync` and `permdiff.mjs sync` walk the whole metadata family to the current version; the gate ladder answers go again. |
+| The security fourteen | The esbuild and uuid overrides of cadria and debonair, the trufflehog sha pin, the npm literal pin, the six credential-free checkouts, the automation message boundary, the scrape sanitizer guard and the drives panel placeholder. |
+| The release notes | `docs/releasenotes.md` renders the current version with the per channel artifact sections — the deterministic contract the notes test asserts. |
+
+## 2.0.126
+
+**My Files** — the Windows 11 File Explorer of the os — answers the owner verdict (the meus-arquivos law the reference shot of *Este Computador* pinned): the app the desktop never carried now opens from its own icon (the premium manila folder with the rising arrow beside the chat tile, pinned in the start grid and bound in the registry, the catalog label rows and the window catalog with its 1020×680 spawn) as a floating window or the `/files` route carrying the whole explorer grammar — the toolbar with the back/forward/up/refresh cluster, the breadcrumb address bar and the search field; the command bar with the new-drive action, the sort and view menus; the nav pane with quick access (the seven shell folders), This PC with its drives and the opt-in storage platforms; the content area answering **Pastas (7)** over **Dispositivos e unidades (N)** — the folder grid of the shell folders (each tile the drawn two-plane manila folder with its category glyph: the monitor, the sheets, the arrow, the photo, the note, the cube, the filmstrip) and the drive cards with the disk body, the activity light and the blue capacity bar riding the honest free-of line the storage manager answered — and the status bar with the item count and the view toggles. Every figure is real: the capacity reads `navigator.storage.estimate`, the drives read the machine registry, the record counts read the live store summary, every folder holds the honest records of its category (the installed apps with their premium tiles, the docs library modules, the runner binaries, the studio catalog rows) and an empty category answers *empty folder*, never an invented record. The Windows interaction grammar rides the whole surface: single click selects, double click or Enter opens, Alt+Left/Right walks the history stack, Alt+Up answers the parent, Ctrl+F arms the search, Escape clears the selection, the items stagger in at 40 ms steps under the motion-reduce guard, and the details view answers the name/type/meta columns. **The same wave kills the first-visit drive bug at its root**: `harddrives.ts drives()` registered the active drive in localStorage but returned the stale empty list it read before the registration, so every fresh machine answered zero drives until a reload (the exact HD-panel break the owner named) — the saved array is the returned array now, and the settings drives panel inherits the fix through the same root module. The synchronized db folder leaves the tree the same day (the accidental commit of the live sqlite partition broke the workflow gates; the whole `db/` folder stays untracked the way `devthink.sqlite` always has).
+
+| Area | Change |
+| --- | --- |
+| The os desktop | My Files — the Win11 file explorer app with its premium icon, its `/files` route and its floating window; the whole explorer grammar from the toolbar to the status bar. |
+| The file logic | `fileexplorer.ts` — the pure location/breadcrumb/sort/filter/byte-format grammar of the explorer (react-free, root layer). |
+| The drive registry | The first-visit stale-list fix in `drives()` — the saved array is the returned array; the settings drives panel inherits it. |
+| The repository | The synchronized `db/` folder leaves the index and the ignore wall (the runtime partition never rides the tree). |
+
+## 2.0.125
+
+The **thinking picker and the honest token meter** land in the composer's microrow (the seventh competitor-grammar rung): the effort control the competitors ship — `think off / medium / high` — rides the row's right side as the same flyout grammar the model chip wears (one flyout at a time, Escape closes first, the outside pointerdown dismisses, the pressed row carries the checkmark), and the choice **persists** across sessions before riding every round as the `x-thinking-level` header (off maps to `none` — the honest straight answer). The thinking tool pill retires from the pill row with its retirement note in the catalog array (cognition is a header lane now, not a prompt patch; the array stays the extension point the future tools join). Beside the chip, the **token meter** answers with the house estimator: `≈ 687 tok` in the quiet mono ink — the capped history window plus the draft in the well, estimated with the per-script chars-per-token approximation, and when the selected model declares its context window the meter grows the honest percent (`≈ 2.3k tok · 1%`). The meter always says estimate: the `≈` mark rides it and the tooltip names the approximation — it never pretends to count.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | The effort picker (off/medium/high, persisted, header-ridden) and the token meter (the house estimate + the declared-window percent) in the microrow; the thinking pill retires. |
+| The chat state | `ChatThinking` + `useChatThinking` join the contract; the CHAT_TOOLS array carries the retirement note and stays the future-tools extension point. |
+
+## 2.0.124
+
+The **model picker** reaches the composer (the sixth competitor-grammar rung): the microrow's quiet `model devthink` chip becomes the catalog door — the chevron rotates, the win11 acrylic flyout rises above the well carrying one row per gateway model with its **declared context window** (`{n}k ctx`, shown honestly — never invented), the pressed row wearing the checkmark in the windows accent. The catalog probes `/v1/models` once per registration (the probe never chats; an outage keeps the meta-model row alone, a disconnect empties the picker), the chosen id **persists** across sessions on the stored-state grammar, and the selection rides every round as the model lane of the request body — the meta-model stays the default so an unconfigured chat never names a model the gateway doesn't know. The topbar identity line follows the selection (`sol glm-5 gateway on`), and the flyout answers the full key grammar: Escape closes it first (the chat Escape stack sits above), the outside pointerdown dismisses it, and the focus returns to the chip.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | The model picker: the /v1/models catalog flyout with declared context windows, the persisted selection riding every round, and the topbar identity following it. |
+| The gateway client | `gatewayModels` — the catalog probe that never throws (an outage answers an empty list, the picker falls back to the meta-model). |
+
+## 2.0.123
+
+The markdown v2 closes with **links, tables and the in-house syntax highlighter** (the fifth competitor-grammar rung). The inline grammar grows the citation lane: markdown links and bare http(s) urls render as safe anchors — the href lane is enforced at the regex (only http and https, never a scheme the floor would execute), every anchor opens with `noopener noreferrer nofollow`, the trailing punctuation of a sentence-ending url stays on the floor as text (the period never rides the href), and the link wears the accent underline that deepens on hover with the keyboard focus ring. **Tables** answer the ledger grammar: the hairline grid with the header row on the softened mono panel, the alignment honors the divider cells (`:---` left, `:---:` center, `---:` right), the numerals ride tabular figures, and a wide table scrolls horizontally inside its own region. The code panes gain the **in-house highlighter**: one ordered master scan per language family (js/ts, python, shell, sql, json — the aliases fold in, the unknown families fall to the generic scan), with the comments in the faded olive, the strings in the warm amber, the numbers in the coral, the keywords in the signal blue of the house accent family and the call-shaped identifiers in the soft cyan-green. It is honest about being a light grammar — no tree, no states — and a token the scan misses is plain text, never an error.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | Safe links (markdown + autolink with the trailing-punctuation law), aligned tables with the horizontal scroll region, and the five-family in-house syntax highlighter on the code panes. |
+| The code panes | The highlight token palette — comments, strings, numbers, keywords and calls — in the quiet flagship tones on the dark pane. |
+
+## 2.0.122
+
+The markdown v2 opens with the **block grammar** (the fourth competitor-grammar rung): the chat floor stops gluing multi-paragraph answers into one paragraph and stops flashing raw markers — the renderer now walks the line grammar over every fence-free segment. **Headings** render on the thread's own ladder (`#` caps at the h3 — the page h1 lives in the topbar, so the floor never grows a second h1), **ordered and nested unordered lists** group their runs with the nesting indents (a marker-type change starts a new list — a dash run never swallows a numbered run), **blockquotes** speak with the accent bar and the softened voice, and **horizontal rules** breathe as the quiet editorial hairline. Paragraphs split on blank lines (the old renderer joined everything into a single p), the fenced-code lane keeps its streaming-honest open-fence handling (tokens land in the code pane mid-stream), and the copy affordance of the code blocks rides unchanged.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | The markdown block grammar: the heading ladder (h3-capped), ordered and nested lists, blockquotes, rules, blank-line paragraphs — no raw asterisks on the floor, ever. |
+| The thread design | The editorial steps for the headings, the accent-bar quote, the mono markers on the lists, the depth rails (the nesting caps at three for readability). |
+
+## 2.0.121
+
+The thread reads like the flagship timelines: **date separators and the streaming clock** land on the chat floor (the third competitor-grammar rung). A turn that opens a new calendar day arrives under the timeline divider — the hairline carrying the locale label chip (mono lowercase, the meta grammar): Today, Yesterday, or the locale weekday with month and day (the year joins when the day is not of the current one — honest dating, never a hardcode). The generation status row answers with the **elapsed clock**: the label reads Thinking before the first token, flips to Responding while the deltas land, and the honest `· Ns` count ticks every half second from the round start — the visitor always knows how long the round has been running, and the row retires when the round commits.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | Day separators between turns of different days (the locale label chip on the hairline) and the elapsed clock on the generation status row (Thinking → Responding · Ns, the half-second tick). |
+| The thread floor | The status row now rides the whole streaming phase above the live turn (the pre-token Thinking and the in-flight Responding are one continuous status, never two surfaces). |
+
+## 2.0.120
+
+The message action row lands on every turn of the chat flagship (the second competitor-grammar rung of the campaign): **copy, delete, regenerate and edit ride one quiet key group** in the meta line that reveals on hover and focus. The copy key answers with the icon morph — the glyph swaps to the checkmark in the windows accent with a soft accent wash for 1.4s and the sr-only status line speaks the result (the clipboard answer IS the feedback; no toast ever doubles the surface, and a failed copy keeps the glyph armed with the quiet red hint while the retry stays available). The delete key carries the destructive red hover and removes the row through the honest session commit (the toast answers once; a session left empty falls back to the hero). The meta time now wears the **full locale date-time on hover** (the dotted underline whispers the hint), and the checkpoint edit law finally shows its face: a turn born from an edit branch carries the `edited` flag and its honest `· edited` mark — the same italic grammar the stopped partial wears (both marks share the `.dtc-meta__mark` chip).
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | The action row: copy-with-morph, delete-own-turn, regenerate and edit in one hover-revealed key group; the full hover timestamp; the edited badge on checkpoint-branch turns. |
+| The chat state | `ChatTurn.edited` joins the contract (type + validator + the cloneSessionForEdit stamp) — the branch turns finally carry their provenance. |
+
+## 2.0.119
+
+This release opens the 118-to-3.0 campaign (the wave ledger of docs/25.waveplan.md) with the first competitor-grammar rung of the chat flagship: **stop and regenerate**. The round controller now rides the whole streaming path — the composer's signal key swaps to a Stop key while the round runs, the abort lands as the honest ChatStoppedError (never a timeout lie, never an error row), and whatever streamed stays on the floor as a partial answer carrying its `stopped` flag and its italic `· stopped` mark in the meta line. The last assistant turn gains the regenerate affordance (the round arrow on the hover, the same grammar the edit pencil rides): the old answer leaves the floor, the same user turn rounds again, and a stopped partial regenerates the same way — the stop never locks the conversation.
+
+The rung also repairs three layout laws the stop work surfaced on the /chat page: the **app-surface law** (the page is an app surface, not a document — it fills exactly the band above the fixed taskbar and never scrolls the body; the old min-height let the rail's intrinsic content grow the frame past the viewport and land the send key under the taskbar), the **pinned-dock law** (the hero never scrolls itself — the welcome wrap owns the scroll, the composer dock rides the hero floor always visible, with the safe margin-auto centering that never clips the scroll origin) and the **stage-stretch guard** (the hero carries the `.grain` film class whose `position: relative` utility defeated the absolute inset-0 stretch of the stage children — a two-class compound selector keeps the stretch law order-proof). The session panel answers with the **inspector-breathe law**: an open panel on a wide viewport breathes the main right by the panel's band so the pinned dock never sits under the inspector.
+
+The R00170 edit affordance finally wears its intended win11 well grammar (the flat 8px field with the 2px accent underline on focus, the primary save and the quiet cancel) and the meta action keys — the edit pencil and the new regenerate arrow — share one quiet 22px key grammar that rises on hover and focus inside the touch law.
+
+| Area | Change |
+| --- | --- |
+| The chat flagship | Stop and regenerate: the AbortController rides runTurnStream, the ChatStoppedError separates the visitor's stop from the timeout, the partial commits with its stopped flag, and the last assistant turn regenerates through the stripped-history round. |
+| The composer | The signal key swaps to a graphite Stop key while busy (the accent stays the send's — an interrupt never reads as a confirm). |
+| The /chat page laws | The app-surface height, the pinned hero dock, the stage-stretch guard against the grain utility, and the inspector-breathe padding of an open session panel. |
+| The edit affordance | The checkpoint edit field ships its win11 well grammar (six stylesheet classes the component referenced that never existed before this rung) and the meta action keys share the quiet hover grammar. |
+
+## 2.0.118
+
+This release is the automated maintenance rung of the ladder: the DevThink maintenance workflow applied every non-breaking update available at run time — the npm dependency set, the engine recommendations and the versioned GitHub Actions references — derived the next patch number with plain arithmetic over package.json (2.0.117 plus one rung), stamped it across the whole metadata family, re-froze the apifreeze artifact, recorded the permission baseline and regenerated the release metadata before the pull request below ran the complete verification pipeline. The updates of this rung: - "@wenathlan/saddle": "2.1.6",
+- "@wenathlan/saddle": "^2.1.6",
+- "streamdown": "^2.7.0",
+- "streamdown": "^2.7.1",
+- uses: trufflesecurity/trufflehog@v3.99.2
+- uses: trufflesecurity/trufflehog@v3.99.3. The version stamps 2.0.118 land across the metadata family with the apifreeze artifact re-frozen and the permission baseline recorded, and the ladder keeps no long-lived branch behind: the automation branch of this rung squashes onto main when the verification pipeline answers green — and closes with its branch deleted when it answers red — so the repository keeps exactly one long-lived branch and the archive tag carries the rung either way.
+
 ## 2.0.117 — the os answers the windows grammar end to end and the family assets ride the release
 
 ### Added

package/bridge.d.ts

@@ -428,7 +428,7 @@ import type { jsonrpcframe } from "./types.js";
 /** The native bridge protocol major version this build speaks: the handshake reports it, the upgrade path keeps compatibility for exactly one major version, and a host that speaks another major version degrades instead of breaking the run. */
 export declare const nativebridgeprotocolmajor = 1;
 /** The installer version the installer stamps into the install state; the upgrade path compares it so a manifest written by an older installer reports before it overwrites. */
-export declare const nativehostinstallerversion: "2.0.117";
+export declare const nativehostinstallerversion: "2.0.127";
 /** The generated extension id placeholder the host manifest template carries: the installer replaces the token with the extension id of the installed build, so the template never pins an identity the user did not generate. */
 export declare const nativehostidplaceholder = "__generated_extension_id__";
 /** The native messaging directory name of the chromium user profile: the installer writes the host manifest beside it, never into a system directory without the explicit flag. */

package/bridge.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 
 // types.ts

package/bun.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/caps/background.json

@@ -1,6 +1,6 @@
 {
   "surface": "background",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/caps/cli.json

@@ -1,6 +1,6 @@
 {
   "surface": "cli",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "commands",

package/caps/library.json

@@ -1,6 +1,6 @@
 {
   "surface": "library",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "a11ycapture",

package/caps/mcp.json

@@ -1,6 +1,6 @@
 {
   "surface": "mcp",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "browser.a11ytree",

package/caps/pagebridge.json

@@ -1,6 +1,6 @@
 {
   "surface": "pagebridge",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "canvasdata",

package/caps/popup.json

@@ -1,6 +1,6 @@
 {
   "surface": "popup",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "bridge",

package/caps/sidepanel.json

@@ -1,6 +1,6 @@
 {
   "surface": "sidepanel",
-  "release": "2.0.117",
+  "release": "2.0.127",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/checksums.txt

@@ -1,34 +1,34 @@
-5093bb903529af92cdb35b9313db3e331c4231a6b5b913cdef4256f8f309785d  CHANGELOG.md
+f0b8f4f63db75c8b6b4b98906d79ce383c9f53bf94985244dbd9b7ccf7395c78  CHANGELOG.md
 9dfe38a3b873d150550355596958cc83eb440c6e8ac2e4038dfc5609fc0f8f82  README.md
-05c27e22a939d7ce8fb3fee1b6ca7648e109a4b86291013bfa9bca75b37c9b69  bridge.d.ts
+6e35edf8caa53824e2aab0aec3a5bf5533ec1bdf7b5a00db56138e90a0b97c9a  bridge.d.ts
 e54c2df84438ff3d256a8ea628b5aa755e6fc8e7d6d754502f7e38142d273cf3  bridge.d.ts.map
-6c703104523ef82be81d6f62c98c17a4631f1367da22383561383aa6a5d05b90  bridge.js
+4712ae9e4eea7f7bce75a5c40634122b4096bdbe089a8c472d874ee46257e441  bridge.js
 9557339c2c57fb58212c3b90e8e5934ddba56066a2537d645e4cb34439fdc2ff  bun.d.ts
 601a75f547bb845b8a81fa59a21d560691561eb17d598acb3fd1f4ac8421e424  bun.d.ts.map
-81054c908d172f988dbe18c12a16e52615d2384c5dc7ed11ae5c2ab65e1dab26  bun.js
-7c37feb312ffd4e192d08eba2dfb449b4b0aea3644c2af468ba89b2b18a174dd  caps/background.json
-5f260e229dd9efa1c76fd5bb1c37e20e84923a942056208af36c382ec24b3e7e  caps/cli.json
-2f794daf5c5fc3a7d9e20e17745d7dc44ee4253823d92a994151c358fb221af1  caps/library.json
-3bc537e33b3001621a9ee569af2d8c75cdba82195e1663a275139f47efb644a1  caps/mcp.json
-dcd3bb2afe91cff61b10ea1b05b11992d8b588b1cdc89d80fb7f53689db3a00c  caps/pagebridge.json
-c45fd92ae138e2c8f405e713cdca2ebab5d521996fb90f261e215754faff2828  caps/popup.json
-84b9bf745622a784d85223e8c5df2d0b783b6e84d7a41fcda9aa534ada2b0abd  caps/sidepanel.json
+b5baddab8b0556a602d3d89316206777f947e70e11686bb457f68fe5721aa8c7  bun.js
+b3e950a7f8359677102694f2e36efe9da120e040e273c7ba485c19fb1e3b860b  caps/background.json
+d0f719565329b9cedd1814597867cd142dd407a937fd2f1538d8beccf8ea6ad3  caps/cli.json
+a16b08eb7845366ea8793808097dc3eca4f8adab17c2ef1d9e499b69194690f1  caps/library.json
+865828ed46d1788dcf62951e9f99ec90fb99d6ae29241024ef19b604096329c5  caps/mcp.json
+595e4ff127433f46b889681a5a5956fba16501dd9d574906082d6bbf9e0fa2e9  caps/pagebridge.json
+227c6a3d9c146a0154afccf7c95b8bec905f6eab52a8cf389c8578df46e3e3e0  caps/popup.json
+d3b93f821c967bb96d7c9b5de281f6edf39fafbd37d08906c47a625722bdfe7b  caps/sidepanel.json
 d35d001526d77c8f37371a39146587ea6ad86179167d82862284557adcd70f17  cli.d.ts
 f7bb3e1903702366effe6c081837b1060c26479740a808f11e0a08ea85e849c9  cli.d.ts.map
-5f3efa4977223a8c45860f01e9bae10e4c103d48701f8e49cfd6e08b6de37543  cli.js
+77cb0bd0241dfb01bdaa5756277a8a92f07cfb41695051ad6610f1fd7a06e331  cli.js
 6d47383663f5efa626bfbc31977bc3df7cfb383725b243ce08057c059234e42f  companion.d.ts
 df25256c8176fc547298c2fb5666bcbf0f01bec284a0dc94f66350f6c29a38be  companion.d.ts.map
-e963e0d76c6cb38218a6958e808d3155e5fc045a91e7999e428f463f93e12cf0  companion.js
+e7c587caa1714959ea8b4528dbeaca54eef5869c7bf42c737456cec69c26ea32  companion.js
 85824f4b1603769f1c117b524925f05a42d37f2bcb41e9d4d377e5408615721f  crossbrowser.d.ts
 a7c4cd26ce8402a9ec1d11bd8dab4222d3c73a0e6f84915402c2fd60f8282d95  crossbrowser.d.ts.map
-c33ef1ac99d715c9c7ccfd5b85c91b25b9a2a84b758671d58292617201775ea2  crossbrowser.js
+7970cd307d5b93bb4dedcb108b849e7ff20477f0d2f6e6445270c24e4e58e239  crossbrowser.js
 bc8f0d95430875b0fd8aff5c0744580d3dd07c5a0927aad4f2c54d34b83be016  dashdone.d.ts
 4d7e32ac75985463dd38a5c408e154276c902c1a1a9ba032d610bffc2b89eee5  dashdone.d.ts.map
-fae43ac3cfe72e9e0a32e8e9846b9cfe120cf88c0ee57a57a27da721075ba3c7  dashdone.js
+c11cf280249b20c0219b132e1707e20917ced40b0f119fee86a51d86797dbab3  dashdone.js
 fea8d906a8c3b0608a9ae4b622c0b88c78d535ed151aa9db29922d817c387495  deno.d.ts
 3b07bf585688565ff818934d7d38f26c0188fcaf44ddbc8727ad3c76999b826c  deno.d.ts.map
-37148a730190b9f0d7923e4fa9674bbeee6bc857458b6c79629f820117db8371  deno.js
-273d188541c0253cd3c8d88a3051a5b27d64bd75ad32c49238930d69ea67fa6c  devthink.umd.js
+db492a4d123241c1786dea172d1950d18a049d2f094b3fa8beda2f1fb2048563  deno.js
+c300e8a460127703a861ab6c2a1b3221470723e64ed36d5c5caef036ad4a1a44  devthink.umd.js
 d8b6d1f6446da72d359dae978c5495244257dc70660415f8aaad96dd5075e241  fixtures/bun.ts
 702c21459e5d6d8d0b914a86bb6c3646a0be40e132b2d40cc04f2994cfbd1cf3  fixtures/cjs.js
 6bd268717a28a23405e5200264d47bb68aaf9c0d6d911674eaa22477bf19d003  fixtures/deno.ts
@@ -86,42 +86,42 @@ c93c417dbf3a43736845e653598624ee48e79f69bf93d36e3b19655e0a23b792  fixtures/recip
 6b757866f79c4a16098879f7cfffdb85557b7fb6ca4ec7b1c0cd1d1169c3e3c0  gallery.json
 16f6a0cdd78820a257d0fbb501784ed031dcffcdc4b9841d5279c8273e3776f4  hardening.d.ts
 eb153f3fa619ca8f59dd8abb598f33213a98026392854a32a7c305a73688bc95  hardening.d.ts.map
-f78abba2187c8a0bb89c10f22e3b01827c9572011613f236abb70ade03fdb51a  hardening.js
+8175166ee25da78dbae8ce264bcd9c3fab66d98f302e99e00b468dce4af258f9  hardening.js
 2e560159a8c3b121c91d83545e0dcfa03b79399ed052bc23a425b2d355839362  headless.d.ts
 f6a7bced8d6b26f05ca971e70aaa177b8be9fb5a7e25a17ab5f2235a8f9ed590  headless.d.ts.map
-34bcb09334776e7e9ac84dda202fc8f50d47382bebf270fa8d13bc49db4d1401  headless.js
+c15eb3e16889262c0e785b9f40a116f16cf64d4199882d3626e29b62e59a3f19  headless.js
 7aed8c110caffd11caf27d63b993ad71328851905f4faeea2a8e1442eba8e257  http.d.ts
 b1ab1184756d92fb301a71d5a696ed4cd70bb4953f292002f01930c9e4893024  http.d.ts.map
-ae01b1d3025166afe5ad0d4e8572f6f5b83600c84308787a50e285232b145b91  http.js
-33ec0029257fcb8adbd46a7b4aaa221c1906f6b07ef374a84e9cfed823c1680f  index.cjs
+766df450aea9ba7c868188d832956dff37def837fb68ec71c0d7e93b8c239e23  http.js
+1a22cedce251e93bb8b0dd0e92aa78c5afb0e05d674cf632bd42b9b499f05654  index.cjs
 31b2f3e15bb0b8cbef623b438f01bb8424909686424a98dd88366412d063d7ed  index.d.ts
 9398106d8b2277fb1c40892eff062a8cc8e605837d01f191fb783517367860fc  index.d.ts.map
-ca9be54eb8aba874be70d5a00485d2fe198417798f0daabc6bbc8a8e8b7b9878  index.js
-8d3549a67a8eb083d04082fd7f1165f1c4aa989720ae9ee942c96eebefff14a7  index.neutral.js
-26f51a6c4d129000d7523ee2caf072f41a64a29ce6fdaeb94493a87e8f1b1298  manifest.json
+d58bc08c48ce544c2ea12119618c0b2f237739ad9c592b0edfa99f4946e99367  index.js
+66166698694120e6cfc33486b61b456468ae2474807c4a0cd6ec7e7a404649b5  index.neutral.js
+3f2781f1185dd773245412d88cc1f770b75053ddbf52c6676cdaa7b3c42923a0  manifest.json
 4a4a38d5c2f25f6e33d7fea853a074d4c82dfe5c721506ca4636b1d65c130f10  mcp.d.ts
 dd22f998da99d77485e863c4e7f1f906bb46dc03ee500efe99a5c09a935f4539  mcp.d.ts.map
-b76e62f8f54f96ef28932b216dc96573915d9ff780f1032ae975ecd6fe74ce9e  mcp.js
+c693665b00a00788c7a8cc18e3a2dd8d13a314dc01325c821ac6077bad855e7d  mcp.js
 ce98408283eccac2d435ac0e0ceb6bb5456e1eb70edb03a03e347a9f82f99c69  memory.d.ts
 9f4c19494bb1b2260a4d15c4c2dce4d2b3f5da96f07b8fbe9037f9b5fe31c8e1  memory.d.ts.map
-034f8da89c6e39104654ba06a917c9fb8769dcf861385e7b182eeeac02e99ab3  memory.js
-45b7ed0f9448fdbe14c0843e5777c566e951b69638c1957b097bb8fc5faf5951  nativehost.template.json
-74bba5516a0be2b766a079f6721922ae1c7df29bb269e8257d8e36f618277e92  node.cjs
+7d56fb5533335faaa94f181bcdd02a0c079cc2594179c281c0f42dd222c794e6  memory.js
+36cdd003beca0d39f44e7c33bbb9a9ecf0a3051d16245e5b4c25b168c7e7f80f  nativehost.template.json
+cb21ca0ddff31f047706607542d9d9ae614022a35f2d9f4cdeb10bfb142cbbc8  node.cjs
 705d895c58fe6816958f0fed4bef0a6f79e5fc521ab49d9cf83e0fbcd9d71afe  node.d.ts
 45f4394eca20fc889fe1128059ce20130d26a5ae0d89008a7ca93f0e4d52841b  node.d.ts.map
 5ec83bc409bed888ae13ab55d1f329ac630a3cf2f0db0e2414c28324329c055b  pack.d.ts
 619d43a5239d770c3382af3dd57e2588dd067ded81ca8c106d404e6709324a63  pack.d.ts.map
-07ac708d161deedc423a59a2d894139109b01605408f4c14ec530f27dccf16ee  pack.js
-4b46de4cdeb7e5f6233288b9f7349f29e8742dddf375fef48da12a3c6069f54c  package.json
+7ed282a8b719f513f5a00d2bd380b5e6bc8a70ff888206daa4c4e8646cbec130  pack.js
+336ed26178325c4036f1ef25901876877fe82c3a5538fee1d93a4e71bf4a563c  package.json
 e3a2ed944a0bc1ef4943ee250a57e428ce49d781d30de6072571e0bc5d8c0259  policy.d.ts
 8f4fabc57c883e12ac7c7ab280749dc7c2d402c4fce401bef235c5e451b6975a  policy.d.ts.map
-7c2052571ae22208f786f9f7ed0e1dba1100eddbcca8fe845cbef11ba3ea7cb7  policy.js
+a009037fd2839226edf5ceea3135370499227ecbaeefc92a7a169f2e8590a441  policy.js
 ea621ab35e610fbe8acb8e91f21ed2c74a6b20bba537c5982f31458d6878b90b  progress.d.ts
 33383e690d77faf6f5959846839603079e7f90e1e3dd17cbcc9a4e3fcf1c5641  progress.d.ts.map
-e837fe298f8dbbc85a007dfaa7f0f8b7ec56bd717c66fe86833bfa2e6f4f7e45  progress.js
+34c83c9a1dd38a3bd8ca77c1124635cabaca4be8d8409574dcba34fcb9a4416c  progress.js
 d2e54016f0cad51928752882d780066ccf2267d383deb2407ea7b2f97dfd26e7  protocol.d.ts
 487f8fc63061cb26cbda7f122409d9952810ba3a76b19d147c98d151d4f45d64  protocol.d.ts.map
-8cc2b05487d560b1e00553eb7eaafb959c39e29e93c6421118e7ae14471f7539  protocol.js
+794a0cd4692d1d782c068a38ca5b856e43689b115a95a463e77adc8c72937608  protocol.js
 456c4a26fd65c728f2dcb9e615ec6e4d446d7e4228bfa3f70ce2b17ee3d6a2c2  schemas/audit.schema.json
 ea272aa6bf4df585ae1ca8ca63e36d7ec713c46187f37ed86ff3620a0e8509b2  schemas/capability.schema.json
 6e9d2291dc54f7d01463e5f70c8f0793d952a63f4096d61ee4dbc4bfd6f6b0a0  schemas/envelope.schema.json
@@ -134,8 +134,8 @@ d0e0365a7641c0127338c14a5318c4591dc598b7d2a36b7b2944219921d1ce4e  schemas/sessio
 5bb7d16534b52ca3a7171178065fb7b283947accd1b616ce89e330eb7a91b82e  schemas/tool.schema.json
 57dfca40f53706c5c5070ea49068c828ae7cfceab04e1e095b9b466821a9110c  server.d.ts
 56308408b75e105d12eedd447c01d2cba7e9c85202e25f0eae6ec80bba8f2300  server.d.ts.map
-35ad81a1a3a7b0175485c1698b5dfec1b6f240223afbbbc6a0e82b6f3b36f0b8  server.js
-1211c3db8a16f5d102eadc48586f5638b87608db196e5aa9fccfe70c0e391ed3  umd-example.html
+0c4f3bb8ad4e4f555f874cc8a85e86b3ce23f0f6191d78b8029074cd98d37c6f  server.js
+96f5c76e0f028ab147146dbb4f5b3e2d2ad713b45d40c72151304a548ba4287e  umd-example.html
 16f66af22e038e4f9328420a0ed0ee34145ca79c938940e8c2e6d232e25a7c09  umd.d.ts
 ac25f7481155ac9321c5a657e7c4a53570bee8b3f63fe3527045260523a494c8  umd.d.ts.map
 58e21373cec5ade3e6698da5b36ecc2bf7e7e2f755c6fb5e3a6605b535b93985  manifest.json key

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // cli.ts
 import { createInterface } from "node:readline/promises";
@@ -569,7 +569,7 @@ function endcall(input) {
 }
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/companion.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
+/*! devthink 2.0.127 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
 
 // companion.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -16,7 +16,7 @@ var nativehosttemplatejson = `{
   "devthinkBanner": "devthink __devthink_version__ native host manifest template \u2014 GPL-3.0-only \u2014 the chromium host manifest of the optional companion process"
 }
 `;
-var companionbuild = "2.0.117";
+var companionbuild = "2.0.127";
 var companionprotocol = 1;
 var companionsurfaces = ["osdialog", "notification"];
 var maxnativemessage = 1024 * 1024;

package/crossbrowser.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // crossbrowser.ts
 var browserpolyfillflags = [

package/dashdone.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // dashdone.ts
 function dashboardviewerof(input) {

package/deno.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/devthink.umd.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 (function (root, factory) {
   if (typeof define === "function" && define.amd) { define([], factory); }
   else if (typeof module === "object" && module.exports) { module.exports = factory(); }
@@ -2365,7 +2365,7 @@ __export(umd_exports, {
 module.exports = __toCommonJS(umd_exports);
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/hardening.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // security.ts
 var maskmarker = "[redacted]";

package/headless.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 
 // runtime.ts

package/http.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 
 // types.ts

package/index.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2356,7 +2356,7 @@ __export(cjs_exports, {
 module.exports = __toCommonJS(cjs_exports);
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.neutral.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpkinds = [
@@ -2010,7 +2010,7 @@ function sessionbundleof(input) {
 }
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnOEjO8Z0PDgQyfvawGcaO2j+o0GLCFTLNj7TkYC/Avo9l2NenMRq7gp90Nfd7E9MViv/OMcCKSYZ5unv12QPRtv31C+a5UQWDFAOP/cH5mwMd6hsayElrSoW8ta+FwFqmr9dIFkn7cQEU3YhZr4Gcbs+ycUHOxVgDA4NBKB0rQ6e9VW5LvTw0isRYUrqM+M72vKxHk9zUIYYn/LGPvottKBYi2GLr0PHSeC2UE+Shmq7vcFIXj6hDjvD4kLJ5sKoUllEcZ1TPuBcnHUQ9ndKA5iktXDQOIJCUJmi7a0YJ2PGg7fvpYfT9k0ai/qZ+pIoRfoOEwE01bPoDn7NjeYnNQIDAQAB",
   "name": "DevThink",
-  "version": "2.0.117",
+  "version": "2.0.127",
   "description": "A consent-first bridge for reviewed browser-agent tasks.",
   "icons": {
     "16": "icons/16.png",

package/mcp.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/memory.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 function expireprofilerecords(input) {

package/nativehost.template.json

@@ -6,5 +6,5 @@
   "allowed_origins": [
     "chrome-extension://__generated_extension_id__/"
   ],
-  "devthinkBanner": "devthink 2.0.117 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
+  "devthinkBanner": "devthink 2.0.127 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
 }

package/node.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2357,7 +2357,7 @@ __export(node_exports, {
 module.exports = __toCommonJS(node_exports);
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/pack.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // pack.ts
 function artifactchannels() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/devthink",
-  "version": "2.0.117",
+  "version": "2.0.127",
   "description": "DevThink is the merged AI development workbench: the provider-owned gateway engine, the DevThink browser extension (the agent surface), the Antigravity engine and the workbench CLI — one product, one binary, one metadata.",
   "type": "module",
   "license": "GPL-3.0-only",
@@ -29,6 +29,7 @@
     "@libsql/client": "^0.18.0",
     "@prisma/adapter-libsql": "^7.10.1",
     "@prisma/client": "^7.10.1",
+    "@wenathlan/saddle": "^2.1.6",
     "hono": "^4.13.13",
     "ink": "^7.1.1",
     "react": "^19.3.1",

package/policy.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -350,7 +350,7 @@ function sessionrecordvalid(value) {
 }
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/progress.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 
 // progress.ts

package/protocol.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -1255,7 +1255,7 @@ function cronvalue(value, min, max, names) {
 }
 
 // version.ts
-var packageversion = "2.0.117";
+var packageversion = "2.0.127";
 var protocolmajor = 2;
 
 // types.ts

package/server.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.117 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.127 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

package/umd-example.html

@@ -1,4 +1,4 @@
-<!-- devthink 2.0.117 umd example page — GPL-3.0-only -->
+<!-- devthink 2.0.127 umd example page — GPL-3.0-only -->
 <!doctype html>
 <html lang="en">
 <head>