@wenathlan/devthink 2.0.133 → 2.0.135

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # DevThink release notes
 
+## 2.0.135
+
+This release is the workflow recovery rung of the ladder: the ci battery, the verify gate ladder, the pages deploy, the security scans and the publish lanes all answer green again after the roots healed — the vitest dialect of the zindex guard, the release artifacts regenerated at the current version, the operational reference documents restored from the overbroad purge, the supply chain age gate admitting the fresh security fixes, the override law reaching the pnpm workspaces beside the manifests, the lint debt of the harvest scripts cleared, and the publish install neutralizing the registry redirect the setup leaves in the home npmrc.
+
+## 2.0.134
+
+This release is the automated maintenance rung of the ladder: the DevThink maintenance workflow applied every non-breaking update available at run time — the npm dependency set, the engine recommendations and the versioned GitHub Actions references — derived the next patch number with plain arithmetic over package.json (2.0.133 plus one rung), stamped it across the whole metadata family, re-froze the apifreeze artifact, recorded the permission baseline and regenerated the release metadata before the pull request below ran the complete verification pipeline. The updates of this rung: - "@opencode-ai/sdk": "^1.19.3",
+- "@opencode-ai/sdk": "^1.19.4",
+- "bun": ">=1.4.3 <2",
+- "bun": ">=1.4.4 <2",
+- "bun-types": "^1.4.3",
+- "bun-types": "^1.4.4",
+- "npm": ">=12.2.0 <13",
+- "npm": ">=12.2.1 <13",
+- "packageManager": "bun@1.4.3"
+- "packageManager": "bun@1.4.4"
+- "pnpm": "^12.14.0",
+- "pnpm": "^12.15.0",
+- bun-version: 1.4.3
+- bun-version: 1.4.4
+- uses: trufflesecurity/trufflehog@v3.99.3
+- uses: trufflesecurity/trufflehog@v3.99.4
+- version: 12.14.0
+- version: 12.15.0. The version stamps 2.0.134 land across the metadata family with the apifreeze artifact re-frozen and the permission baseline recorded, and the ladder keeps no long-lived branch behind: the automation branch of this rung squashes onto main when the verification pipeline answers green — and closes with its branch deleted when it answers red — so the repository keeps exactly one long-lived branch and the archive tag carries the rung either way.
+
 ## 2.0.133
 
 This release is the automated maintenance rung of the ladder: the DevThink maintenance workflow applied every non-breaking update available at run time — the npm dependency set, the engine recommendations and the versioned GitHub Actions references — derived the next patch number with plain arithmetic over package.json (2.0.132 plus one rung), stamped it across the whole metadata family, re-froze the apifreeze artifact, recorded the permission baseline and regenerated the release metadata before the pull request below ran the complete verification pipeline. The updates of this rung: - "@biomejs/biome": "^2.5.15",

package/bridge.d.ts

@@ -428,7 +428,7 @@ import type { jsonrpcframe } from "./types.js";
 /** The native bridge protocol major version this build speaks: the handshake reports it, the upgrade path keeps compatibility for exactly one major version, and a host that speaks another major version degrades instead of breaking the run. */
 export declare const nativebridgeprotocolmajor = 1;
 /** The installer version the installer stamps into the install state; the upgrade path compares it so a manifest written by an older installer reports before it overwrites. */
-export declare const nativehostinstallerversion: "2.0.133";
+export declare const nativehostinstallerversion: "2.0.135";
 /** The generated extension id placeholder the host manifest template carries: the installer replaces the token with the extension id of the installed build, so the template never pins an identity the user did not generate. */
 export declare const nativehostidplaceholder = "__generated_extension_id__";
 /** The native messaging directory name of the chromium user profile: the installer writes the host manifest beside it, never into a system directory without the explicit flag. */

package/bridge.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 
 // types.ts

package/bun.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/caps/background.json

@@ -1,6 +1,6 @@
 {
   "surface": "background",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/caps/cli.json

@@ -1,6 +1,6 @@
 {
   "surface": "cli",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "commands",

package/caps/library.json

@@ -1,6 +1,6 @@
 {
   "surface": "library",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "a11ycapture",

package/caps/mcp.json

@@ -1,6 +1,6 @@
 {
   "surface": "mcp",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "browser.a11ytree",

package/caps/pagebridge.json

@@ -1,6 +1,6 @@
 {
   "surface": "pagebridge",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "canvasdata",

package/caps/popup.json

@@ -1,6 +1,6 @@
 {
   "surface": "popup",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "bridge",

package/caps/sidepanel.json

@@ -1,6 +1,6 @@
 {
   "surface": "sidepanel",
-  "release": "2.0.133",
+  "release": "2.0.135",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/checksums.txt

@@ -1,34 +1,34 @@
-ef5a42e12b35f50c8adaea1e576c78c4bb9e18ee5a562275b65900fb23bce178  CHANGELOG.md
+bfa2686d9495f132651d4fec59dd8b5105cb26553ca1f2cc341c3ab3d8707775  CHANGELOG.md
 9dfe38a3b873d150550355596958cc83eb440c6e8ac2e4038dfc5609fc0f8f82  README.md
-7ac40a3355f4fda3657665d988f54df2f70e1a0472f768cd7baef3854308d860  bridge.d.ts
+2a71b3c696f03b3f4ae9c8907dc2c6cb6dcd15dd82ebde696e4d49c6fc885cdb  bridge.d.ts
 e54c2df84438ff3d256a8ea628b5aa755e6fc8e7d6d754502f7e38142d273cf3  bridge.d.ts.map
-1dd551fd93d904245f9b2120662f67610c3c6468f9b1a3599bf2b32c1b69f567  bridge.js
+17bf2688070ec7d3505508a4f23b1999a50f95b161b69eb6b32a392af87f6191  bridge.js
 9557339c2c57fb58212c3b90e8e5934ddba56066a2537d645e4cb34439fdc2ff  bun.d.ts
 601a75f547bb845b8a81fa59a21d560691561eb17d598acb3fd1f4ac8421e424  bun.d.ts.map
-7e64edcbb314c599e49e928ae6133ac4517ee9f811e3c34f373d84af3bfb97c8  bun.js
-158cd929611396c219d79456b39cf21fc3f7030ba4b65f1160574f499574880e  caps/background.json
-8e942ce0c70674279eee3f297cab1fa8f9e592cd7fbfb382a71291ae52e8995a  caps/cli.json
-44603692988edf6727dbcda3eaea104498b959da3e28f439dddc207f24b26276  caps/library.json
-393649be1932cae19c352e267246ce4e7a8a1c75f46929b7a5dd1f3b2c4a61d1  caps/mcp.json
-b1e053f4714ef7c52eec3b9fb2acffe7ef9346401994b79b5a70875627b09e23  caps/pagebridge.json
-c9e9c0d53d7d81cf83f77944e8d7e4bd4505d2363cc370f8b5b2a7431e86ef95  caps/popup.json
-45d0533f4fe2c4a5c22559cdecf7360ea3e147a7cde79a9a69a9cef11d608c44  caps/sidepanel.json
+bf117e75005822181070aa1763c45307b7922a20ab46b2d0981265ae3a5e89f8  bun.js
+968573fad237b1ea4baa3de59bd5e20f356ea7d7501136958e08c94a5d2b9483  caps/background.json
+70c8dbc8732c7850fcd5e43a14cb65d4c054d7a070645c81ecc6987a69363ccc  caps/cli.json
+7c4d905c065012b6ea5745aa6586826929fd0bed2dd2d2b055e6a29492ecc834  caps/library.json
+26aac9e30b2cd3a67db418a2d24e228d6f29d5a27d58ef22f44c08a12f5dd9d2  caps/mcp.json
+915cac914839ef4e648e3b5dc63a18c2cb2997f2db124c5ad18f2ec76669a258  caps/pagebridge.json
+24929d4ba0817e65f798cb331de75cd509d8a2732b151e0bf407f5350ebe5b4b  caps/popup.json
+1a76961dd93936980f657921b9c248801c8d3eadc17ca8da8e13caa4e17a902a  caps/sidepanel.json
 d35d001526d77c8f37371a39146587ea6ad86179167d82862284557adcd70f17  cli.d.ts
 f7bb3e1903702366effe6c081837b1060c26479740a808f11e0a08ea85e849c9  cli.d.ts.map
-9c61abe55f1b724b204458707b96737bf006fb7782006c9c39564d863a436b36  cli.js
+81de5b8168446676917324ca0e4eb3bd7ff0c51f19537083f5ba148bcb89fe4e  cli.js
 6d47383663f5efa626bfbc31977bc3df7cfb383725b243ce08057c059234e42f  companion.d.ts
 df25256c8176fc547298c2fb5666bcbf0f01bec284a0dc94f66350f6c29a38be  companion.d.ts.map
-d9601a5b7ac0909cd4031b3caa7bcf0c6a765c7ef0e7da1482799b202d44f846  companion.js
+75e4648f56d7563cb7c8dcb1e36d6c860a3fc10ae394b8c0c2d6655e99aa90d2  companion.js
 85824f4b1603769f1c117b524925f05a42d37f2bcb41e9d4d377e5408615721f  crossbrowser.d.ts
 a7c4cd26ce8402a9ec1d11bd8dab4222d3c73a0e6f84915402c2fd60f8282d95  crossbrowser.d.ts.map
-f7f983947860ae9c32a65e96efa974c8a781e420ded8fb4c845cc9d4959e7fee  crossbrowser.js
+504b4653f589c9eb84656cc9c5cd0f2897dc2b9c7c0f6bafb49f7a598b38712a  crossbrowser.js
 bc8f0d95430875b0fd8aff5c0744580d3dd07c5a0927aad4f2c54d34b83be016  dashdone.d.ts
 4d7e32ac75985463dd38a5c408e154276c902c1a1a9ba032d610bffc2b89eee5  dashdone.d.ts.map
-8d87f0f6102370d08f802be57fa0e0e1c2a5dd4e6ff73d2575e7959ac16402fe  dashdone.js
+a76a641edf7c822bb5bd94ba2680412463922a925f88f81668bd246063e9769f  dashdone.js
 fea8d906a8c3b0608a9ae4b622c0b88c78d535ed151aa9db29922d817c387495  deno.d.ts
 3b07bf585688565ff818934d7d38f26c0188fcaf44ddbc8727ad3c76999b826c  deno.d.ts.map
-fdf114b781ab817ad308e0013e9ff9eeda80de21b4188b212d6aeacf4ed4e334  deno.js
-8b53214426e66f32b42c0f7b2ff18249b635ee91221705789117108f206551f5  devthink.umd.js
+0947a36d8add8b5d37a416d46247570ed558f3d96d241259cadd0016049548c2  deno.js
+80be59211d07fd4df809f58dd1959909d358618333a2cbc133f732ae27f1a789  devthink.umd.js
 d8b6d1f6446da72d359dae978c5495244257dc70660415f8aaad96dd5075e241  fixtures/bun.ts
 702c21459e5d6d8d0b914a86bb6c3646a0be40e132b2d40cc04f2994cfbd1cf3  fixtures/cjs.js
 6bd268717a28a23405e5200264d47bb68aaf9c0d6d911674eaa22477bf19d003  fixtures/deno.ts
@@ -86,42 +86,42 @@ c93c417dbf3a43736845e653598624ee48e79f69bf93d36e3b19655e0a23b792  fixtures/recip
 6b757866f79c4a16098879f7cfffdb85557b7fb6ca4ec7b1c0cd1d1169c3e3c0  gallery.json
 16f6a0cdd78820a257d0fbb501784ed031dcffcdc4b9841d5279c8273e3776f4  hardening.d.ts
 eb153f3fa619ca8f59dd8abb598f33213a98026392854a32a7c305a73688bc95  hardening.d.ts.map
-c042bae84d64dfac810f53186844ae7bb3e3de1069ed1aa39cb5b9bed9d5c742  hardening.js
+0b482edb0560e6234fc467d163316108abe6bfbebf4e4bff7cd769f7ff1defce  hardening.js
 2e560159a8c3b121c91d83545e0dcfa03b79399ed052bc23a425b2d355839362  headless.d.ts
 f6a7bced8d6b26f05ca971e70aaa177b8be9fb5a7e25a17ab5f2235a8f9ed590  headless.d.ts.map
-417927fabf1e98099d90559bf544c6bb9478630516af4c58b755c780879450ae  headless.js
+f53b7b51508a1bb790050e72aa25ebcb7e134c4f41fa9312deb094fb6a88c602  headless.js
 7aed8c110caffd11caf27d63b993ad71328851905f4faeea2a8e1442eba8e257  http.d.ts
 b1ab1184756d92fb301a71d5a696ed4cd70bb4953f292002f01930c9e4893024  http.d.ts.map
-035b48ac84ffb21f334bd6a6cdd92f8f7d5ba726e25fb879f2fd1fd89569cf25  http.js
-02f7bb72cd8869f5687961951fb79f6fd0162f121cbff436760dc5ae3c10853d  index.cjs
+0a8cf8adaecb45aa62daf2fe61d9bab636538c824344481b6e6e90e738541a9e  http.js
+f251626a420e847315ad46c5523ccd508d754f4efb5dcc732d93b50d72b42804  index.cjs
 31b2f3e15bb0b8cbef623b438f01bb8424909686424a98dd88366412d063d7ed  index.d.ts
 9398106d8b2277fb1c40892eff062a8cc8e605837d01f191fb783517367860fc  index.d.ts.map
-f465e138fb7e00bb6f4a791c2700106961a7f44906dc0f5bcc5f2f9aca0ed1b6  index.js
-70457d70a62b298ae1f8d3bea83a90f13209179a28b18ec6ee64755c9e1078bd  index.neutral.js
-eb589f89a1a54d95d1477e48ce14cfcf3ee0483092204013627f4503024e4b1f  manifest.json
+79128f33c6576c75a784d05cd0b87b55612242795340601c4d3ff9aebc811175  index.js
+1556d5553edd367623ba55a51c7342bd1fc924e4d0bafa8d129f13b42df887b2  index.neutral.js
+5c04421106806af1915e946c4e14e83b090aef75840bc224104ee4701a657a10  manifest.json
 4a4a38d5c2f25f6e33d7fea853a074d4c82dfe5c721506ca4636b1d65c130f10  mcp.d.ts
 dd22f998da99d77485e863c4e7f1f906bb46dc03ee500efe99a5c09a935f4539  mcp.d.ts.map
-637f4d87c4206ce4a47097f3611916f778032ffc513322ec699358416d876baf  mcp.js
+197acecf1bc98720d3edfb2337ce97536b2de2049870bb796dcabe9768c560b2  mcp.js
 ce98408283eccac2d435ac0e0ceb6bb5456e1eb70edb03a03e347a9f82f99c69  memory.d.ts
 9f4c19494bb1b2260a4d15c4c2dce4d2b3f5da96f07b8fbe9037f9b5fe31c8e1  memory.d.ts.map
-11a05bf2fc3e61cbbccdcd28d81a763b9e571f6b8f3390663a73a9a93b40e2b8  memory.js
-99bdceaa23bbb0fdc6195c4777aba753e3c2b9a42a2cf37c1c892fecddc06cf7  nativehost.template.json
-a7ae1aa8db51492908f7b199db0399c8593407849600f0cecff576c2c0f1d945  node.cjs
+2f2192fda059d99e7a2a00001447ed97ae2991d6897421b4ee4fc8b3a39a4095  memory.js
+c85c3ac3c8c7a944c2b627c016e9307e90921c09e62fe8c80f2e33fd663a6419  nativehost.template.json
+dc50bb1878113512645329b6b911432085911698206b23cb6c513596a1f69eed  node.cjs
 705d895c58fe6816958f0fed4bef0a6f79e5fc521ab49d9cf83e0fbcd9d71afe  node.d.ts
 45f4394eca20fc889fe1128059ce20130d26a5ae0d89008a7ca93f0e4d52841b  node.d.ts.map
 5ec83bc409bed888ae13ab55d1f329ac630a3cf2f0db0e2414c28324329c055b  pack.d.ts
 619d43a5239d770c3382af3dd57e2588dd067ded81ca8c106d404e6709324a63  pack.d.ts.map
-1a8a00a6b97180454bbae5931af017e777a56d516cc7e4783408f97b5dcb17a4  pack.js
-c1832bca66709c6058db30d8b0ba128e29fe2d54fd5b91f5f6ebf66099e8d27b  package.json
+b236f7592fc0fa0f6da8d375d9c0ee559374c7f3eb4975e4833547ba9a45e329  pack.js
+a518ac414460398d520016bf628b14a94346527339c2ba1933b67e212046b5de  package.json
 e3a2ed944a0bc1ef4943ee250a57e428ce49d781d30de6072571e0bc5d8c0259  policy.d.ts
 8f4fabc57c883e12ac7c7ab280749dc7c2d402c4fce401bef235c5e451b6975a  policy.d.ts.map
-2b757dedef8547a1781fd8ab685aa05e21ddb6bb03d114939bf5c612c5317c43  policy.js
+d570e991122d72f763cdcd3e77927a9ce23daf6ee3a505d00f4fa8d683495b3d  policy.js
 ea621ab35e610fbe8acb8e91f21ed2c74a6b20bba537c5982f31458d6878b90b  progress.d.ts
 33383e690d77faf6f5959846839603079e7f90e1e3dd17cbcc9a4e3fcf1c5641  progress.d.ts.map
-cb3565a4cd857b7ccade1b9b66d79b59589b55518d36109237fa39ee6c630747  progress.js
+be094b321a6c6fd849085da233485f6aaedfb93379d0667032e6673f702074cb  progress.js
 d2e54016f0cad51928752882d780066ccf2267d383deb2407ea7b2f97dfd26e7  protocol.d.ts
 487f8fc63061cb26cbda7f122409d9952810ba3a76b19d147c98d151d4f45d64  protocol.d.ts.map
-539bec9161ec8fa36fdfe6f159bc1652bc2c30dbd3399f7f0a9e88cd04e4b6e5  protocol.js
+88384bfb21ed50957bbb840fc752b27a62c15661bcc4224f968f26c88bb188ca  protocol.js
 456c4a26fd65c728f2dcb9e615ec6e4d446d7e4228bfa3f70ce2b17ee3d6a2c2  schemas/audit.schema.json
 ea272aa6bf4df585ae1ca8ca63e36d7ec713c46187f37ed86ff3620a0e8509b2  schemas/capability.schema.json
 6e9d2291dc54f7d01463e5f70c8f0793d952a63f4096d61ee4dbc4bfd6f6b0a0  schemas/envelope.schema.json
@@ -134,8 +134,8 @@ d0e0365a7641c0127338c14a5318c4591dc598b7d2a36b7b2944219921d1ce4e  schemas/sessio
 5bb7d16534b52ca3a7171178065fb7b283947accd1b616ce89e330eb7a91b82e  schemas/tool.schema.json
 3154e5535045f39fa876a2d0df15ff55421ff1fde1abf41aceccf05f0ad699c7  server.d.ts
 4ffc290d618a91b173b1343d8ae15f0d18fdd4a31b30f4727c0002ec4006ffb0  server.d.ts.map
-7b0e5fc3855427dd6534f7d56c4a697bf9fa4d3315f0617d1bdbe64179278f99  server.js
-7710e17c7ffc43bf8b287726725c7a65f2d16fc79e70c3977b17d59e15f5c44d  umd-example.html
+af00233b87c15ac3f40f2409dc97d1fa1f5d4316d336dbdbd31fe22f1256509c  server.js
+5c177ad9e8d6b32e79f4991a79b2243f0abb381d6a8f7b9578492105cc2b417f  umd-example.html
 16f66af22e038e4f9328420a0ed0ee34145ca79c938940e8c2e6d232e25a7c09  umd.d.ts
 ac25f7481155ac9321c5a657e7c4a53570bee8b3f63fe3527045260523a494c8  umd.d.ts.map
 58e21373cec5ade3e6698da5b36ecc2bf7e7e2f755c6fb5e3a6605b535b93985  manifest.json key

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // cli.ts
 import { createInterface } from "node:readline/promises";
@@ -569,7 +569,7 @@ function endcall(input) {
 }
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/companion.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
+/*! devthink 2.0.135 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
 
 // companion.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -16,7 +16,7 @@ var nativehosttemplatejson = `{
   "devthinkBanner": "devthink __devthink_version__ native host manifest template \u2014 GPL-3.0-only \u2014 the chromium host manifest of the optional companion process"
 }
 `;
-var companionbuild = "2.0.133";
+var companionbuild = "2.0.135";
 var companionprotocol = 1;
 var companionsurfaces = ["osdialog", "notification"];
 var maxnativemessage = 1024 * 1024;

package/crossbrowser.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // crossbrowser.ts
 var browserpolyfillflags = [

package/dashdone.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // dashdone.ts
 function dashboardviewerof(input) {

package/deno.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/devthink.umd.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 (function (root, factory) {
   if (typeof define === "function" && define.amd) { define([], factory); }
   else if (typeof module === "object" && module.exports) { module.exports = factory(); }
@@ -2365,7 +2365,7 @@ __export(umd_exports, {
 module.exports = __toCommonJS(umd_exports);
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/hardening.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // security.ts
 var maskmarker = "[redacted]";

package/headless.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 
 // runtime.ts

package/http.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 
 // types.ts

package/index.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2356,7 +2356,7 @@ __export(cjs_exports, {
 module.exports = __toCommonJS(cjs_exports);
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.neutral.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpkinds = [
@@ -2010,7 +2010,7 @@ function sessionbundleof(input) {
 }
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnOEjO8Z0PDgQyfvawGcaO2j+o0GLCFTLNj7TkYC/Avo9l2NenMRq7gp90Nfd7E9MViv/OMcCKSYZ5unv12QPRtv31C+a5UQWDFAOP/cH5mwMd6hsayElrSoW8ta+FwFqmr9dIFkn7cQEU3YhZr4Gcbs+ycUHOxVgDA4NBKB0rQ6e9VW5LvTw0isRYUrqM+M72vKxHk9zUIYYn/LGPvottKBYi2GLr0PHSeC2UE+Shmq7vcFIXj6hDjvD4kLJ5sKoUllEcZ1TPuBcnHUQ9ndKA5iktXDQOIJCUJmi7a0YJ2PGg7fvpYfT9k0ai/qZ+pIoRfoOEwE01bPoDn7NjeYnNQIDAQAB",
   "name": "DevThink",
-  "version": "2.0.133",
+  "version": "2.0.135",
   "description": "A consent-first bridge for reviewed browser-agent tasks.",
   "icons": {
     "16": "icons/16.png",

package/mcp.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/memory.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 function expireprofilerecords(input) {

package/nativehost.template.json

@@ -6,5 +6,5 @@
   "allowed_origins": [
     "chrome-extension://__generated_extension_id__/"
   ],
-  "devthinkBanner": "devthink 2.0.133 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
+  "devthinkBanner": "devthink 2.0.135 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
 }

package/node.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2357,7 +2357,7 @@ __export(node_exports, {
 module.exports = __toCommonJS(node_exports);
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/pack.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // pack.ts
 function artifactchannels() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/devthink",
-  "version": "2.0.133",
+  "version": "2.0.135",
   "description": "DevThink is the merged AI development workbench: the provider-owned gateway engine, the DevThink browser extension (the agent surface), the Antigravity engine and the workbench CLI — one product, one binary, one metadata.",
   "type": "module",
   "license": "GPL-3.0-only",
@@ -32,14 +32,15 @@
     "@wenathlan/saddle": "^2.1.6",
     "hono": "^4.13.13",
     "ink": "^7.1.1",
+    "motion": "^12.43.0",
     "react": "^19.3.1",
     "react-devtools-core": "^8.0.0",
     "z-ai-web-dev-sdk": "^0.0.18"
   },
   "engines": {
-    "bun": ">=1.4.3 <2",
+    "bun": ">=1.4.4 <2",
     "node": ">=26.12.1 <27",
-    "npm": ">=12.2.0 <13",
+    "npm": ">=12.2.1 <13",
     "deno": ">=2.0.0 <3"
   },
   "sideEffects": false,

package/policy.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -350,7 +350,7 @@ function sessionrecordvalid(value) {
 }
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/progress.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 
 // progress.ts

package/protocol.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -1255,7 +1255,7 @@ function cronvalue(value, min, max, names) {
 }
 
 // version.ts
-var packageversion = "2.0.133";
+var packageversion = "2.0.135";
 var protocolmajor = 2;
 
 // types.ts

package/server.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.133 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.135 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -7795,11 +7795,11 @@ import { createHash, randomInt as randomInt4, timingSafeEqual } from "node:crypt
 import { existsSync as existsSync4, readFileSync as readFileSync3, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 
 // ids.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
 var alphabet = "0123456789abcdefghjkmnpqrstvwxyz";
 var tokenLength = 10;
 function compactToken() {
-  const bytes = randomBytes2(tokenLength);
+  const bytes = new Uint8Array(tokenLength);
+  globalThis.crypto.getRandomValues(bytes);
   return Array.from(bytes, (value) => alphabet[value & 31]).join("");
 }
 function createCompactId(prefix) {
@@ -11160,7 +11160,83 @@ var SEED = Object.freeze({
   "plans.tier.enterprise.line3": "every capability badge unlocked",
   "plans.tier.free.headline": "free",
   "plans.tier.pro.headline": "pro",
-  "plans.tier.enterprise.headline": "enterprise"
+  "plans.tier.enterprise.headline": "enterprise",
+  "auth.oauth.headline": "Continue with DevThink",
+  "auth.oauth.google": "continue with devthink \xB7 google",
+  "auth.oauth.github": "continue with devthink \xB7 github",
+  "auth.oauth.gitlab": "continue with devthink \xB7 gitlab",
+  "auth.oauth.unconfigured": "The provider ids land with the gateway configuration.",
+  "auth.oauth.failed": "The sign-in round trip could not start on this machine.",
+  "callback.title": "The sign-in callback",
+  "callback.received": "devthink received the {provider} sign in",
+  "callback.received.note": "The code waits for the token exchange \u2014 the exchange lands with the gateway wave, no account is signed in yet.",
+  "callback.error": "The provider refused the sign in",
+  "callback.error.note": "The provider answered with an error \u2014 the sign-in round trip did not complete.",
+  "callback.unknown": "Unknown origin",
+  "callback.unknown.note": "The callback carries no state marker this page minted \u2014 the round trip did not start here.",
+  "callback.back.auth": "back to the sign-in page",
+  "callback.back.panel": "to the panel",
+  "settings.search.placeholder": "Find a setting",
+  "settings.nav.personalization": "Personalization",
+  "settings.nav.accounts": "Accounts",
+  "settings.nav.gateway": "Gateway & Pairing",
+  "settings.nav.drives": "Drives",
+  "settings.nav.automation": "Automation & MCP",
+  "settings.nav.about": "About",
+  "settings.account.sub.local": "local browser",
+  "settings.account.sub.paired": "paired gateway",
+  "settings.personal.background": "Background",
+  "settings.personal.background.desc": "The wallpaper the desktop and the lock screen paint.",
+  "settings.wall.trident": "Trident dawn",
+  "settings.wall.bloom": "Bloom",
+  "settings.wall.meadow": "Meadow",
+  "settings.wall.tide": "Tide",
+  "settings.wall.dusk": "Dusk",
+  "settings.wall.sand": "Linen",
+  "settings.personal.colors": "Colors",
+  "settings.personal.colors.desc": "The mode and the accent the shell wears.",
+  "settings.personal.mode": "Mode",
+  "settings.personal.mode.light": "Light",
+  "settings.personal.mode.dark": "Dark",
+  "settings.personal.accent": "Accent color",
+  "settings.accent.blue": "Signal blue",
+  "settings.accent.cyan": "Cyan",
+  "settings.accent.teal": "Teal",
+  "settings.accent.fern": "Fern",
+  "settings.accent.moss": "Moss",
+  "settings.accent.amber": "Amber",
+  "settings.accent.rose": "Rosewood",
+  "settings.accent.slate": "Slate",
+  "settings.personal.navbar": "Navbar position",
+  "settings.personal.navbar.desc": "Where the taskbar docks on the screen.",
+  "settings.navbar.floating": "Floating",
+  "settings.navbar.left": "Left edge",
+  "settings.navbar.right": "Right edge",
+  "settings.personal.components": "Component options",
+  "settings.personal.components.desc": "The shell behaviors this machine plays.",
+  "settings.toggle.alttab": "Alt-tab entrance",
+  "settings.toggle.alttab.desc": "The task switcher animates in when it opens.",
+  "settings.toggle.tips": "Taskbar tooltips",
+  "settings.toggle.tips.desc": "The app name surfaces above a taskbar icon.",
+  "settings.rail.title": "Desktop rail",
+  "settings.rail.always": "Always",
+  "settings.rail.auto": "Auto",
+  "settings.rail.off": "Off",
+  "settings.zoom.label": "Interface zoom",
+  "settings.language.title": "Language",
+  "settings.language.display": "Display language",
+  "settings.accounts.identity": "Public identity",
+  "settings.accounts.identity.id": "Public id",
+  "settings.accounts.identity.save": "Save public id",
+  "settings.accounts.access": "Browser access",
+  "settings.accounts.access.desc": "Revoking removes the paired browser sessions of this machine.",
+  "settings.accounts.access.revoke": "Revoke browser access",
+  "settings.gateway.sync": "Sync state",
+  "settings.gateway.sync.pairhint": "Pair with devthink pair create to sync the cli gateway.",
+  "settings.gateway.boundary": "Credential boundary",
+  "settings.gateway.boundary.desc": "Provider credentials stay with the cli, never in this browser.",
+  "settings.about.database": "Local database",
+  "settings.about.database.paired": "Gateway database"
 });
 function copyseed() {
   return SEED;
@@ -15072,7 +15148,7 @@ __export(request_exports, {
   validateToolNamesDetailed: () => validateToolNamesDetailed
 });
 import * as os7 from "node:os";
-import { randomBytes as randomBytes5, randomInt as randomInt6 } from "node:crypto";
+import { randomBytes as randomBytes4, randomInt as randomInt6 } from "node:crypto";
 var osPlatform2 = os7.platform;
 var MODELS_2026_SET = new Set(FETCH_AVAILABLE_MODELS_2026);
 var TOOL_NAME_MAX_LENGTH = 64;
@@ -17001,12 +17077,12 @@ function generateDeterministicId(seed) {
   return fnv1a32Hex(seed);
 }
 function generateSessionId(seed, offsetEnabled) {
-  const base = seed ?? `${Date.now()}-${randomBytes5(4).toString("hex")}`;
+  const base = seed ?? `${Date.now()}-${randomBytes4(4).toString("hex")}`;
   const offset = offsetEnabled ? randomInt6(0, 1001) : 0;
   return fnv1a32Hex(`${base}-${offset}-session`);
 }
 function generateUserPromptId(seed, offsetEnabled) {
-  const base = seed ?? `${Date.now()}-${randomBytes5(4).toString("hex")}`;
+  const base = seed ?? `${Date.now()}-${randomBytes4(4).toString("hex")}`;
   const offset = offsetEnabled ? randomInt6(0, 1001) : 0;
   return fnv1a32Hex(`${base}-${offset}-user-prompt-${offsetEnabled ? offset : 0}`);
 }
@@ -19428,7 +19504,7 @@ import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:
 import * as fsp4 from "node:fs/promises";
 import { join as join10, resolve as resolve7, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { randomInt as randomInt8, randomBytes as randomBytes9 } from "node:crypto";
+import { randomInt as randomInt8, randomBytes as randomBytes8 } from "node:crypto";
 
 // project.ts
 var project_exports = {};
@@ -23005,7 +23081,7 @@ function buildOpencodeAuthMethods(fallbackProvider) {
       authorize: async () => {
         const inst = getPlugin();
         const identity = resolveOAuthIdentity(inst?.options?.oauth_identity ?? "auto");
-        const state = randomBytes9(32).toString("base64url");
+        const state = randomBytes8(32).toString("base64url");
         const pkce = identity.usesPKCE ? generatePKCE?.() ?? null : null;
         const srv = await createOAuthServerAsync({
           callbackPath: "/oauth2callback",

package/umd-example.html

@@ -1,4 +1,4 @@
-<!-- devthink 2.0.133 umd example page — GPL-3.0-only -->
+<!-- devthink 2.0.135 umd example page — GPL-3.0-only -->
 <!doctype html>
 <html lang="en">
 <head>