@wenathlan/devthink 2.0.134 → 2.0.136

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # DevThink release notes
 
+## 2.0.136
+
+This release is the security closure rung of the ladder: the supply chain pins answer the code scanning findings — every github actions reference across the ten workflow files resolves to its immutable commit sha with the moving tag riding as the trailing comment, every literal docker FROM line in the family container files carries its registry digest (the variable ARG images and the build stage names stay untouched by design), the broken rust toolchain reference of the optional desktop audit heals against the commit of its version branch with the toolchain input the sha ref can no longer carry, the chat session identifiers mint their random suffixes from the webcrypto well of the identity contract instead of the math random the insecure randomness finding flagged, and the harvest walker drops its identity replacement no-op. The release lane itself reruns over the freeze artifacts the 2.0.135 rung re-stamped, because the release trigger only fires on a version bump and the artifacts heal landed without one.
+
+## 2.0.135
+
+This release is the workflow recovery rung of the ladder: the ci battery, the verify gate ladder, the pages deploy, the security scans and the publish lanes all answer green again after the roots healed — the vitest dialect of the zindex guard, the release artifacts regenerated at the current version, the operational reference documents restored from the overbroad purge, the supply chain age gate admitting the fresh security fixes, the override law reaching the pnpm workspaces beside the manifests, the lint debt of the harvest scripts cleared, and the publish install neutralizing the registry redirect the setup leaves in the home npmrc.
+
 ## 2.0.134
 
 This release is the automated maintenance rung of the ladder: the DevThink maintenance workflow applied every non-breaking update available at run time — the npm dependency set, the engine recommendations and the versioned GitHub Actions references — derived the next patch number with plain arithmetic over package.json (2.0.133 plus one rung), stamped it across the whole metadata family, re-froze the apifreeze artifact, recorded the permission baseline and regenerated the release metadata before the pull request below ran the complete verification pipeline. The updates of this rung: - "@opencode-ai/sdk": "^1.19.3",

package/bridge.d.ts

@@ -428,7 +428,7 @@ import type { jsonrpcframe } from "./types.js";
 /** The native bridge protocol major version this build speaks: the handshake reports it, the upgrade path keeps compatibility for exactly one major version, and a host that speaks another major version degrades instead of breaking the run. */
 export declare const nativebridgeprotocolmajor = 1;
 /** The installer version the installer stamps into the install state; the upgrade path compares it so a manifest written by an older installer reports before it overwrites. */
-export declare const nativehostinstallerversion: "2.0.134";
+export declare const nativehostinstallerversion: "2.0.136";
 /** The generated extension id placeholder the host manifest template carries: the installer replaces the token with the extension id of the installed build, so the template never pins an identity the user did not generate. */
 export declare const nativehostidplaceholder = "__generated_extension_id__";
 /** The native messaging directory name of the chromium user profile: the installer writes the host manifest beside it, never into a system directory without the explicit flag. */

package/bridge.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 
 // types.ts

package/bun.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/caps/background.json

@@ -1,6 +1,6 @@
 {
   "surface": "background",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/caps/cli.json

@@ -1,6 +1,6 @@
 {
   "surface": "cli",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "commands",

package/caps/library.json

@@ -1,6 +1,6 @@
 {
   "surface": "library",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "a11ycapture",

package/caps/mcp.json

@@ -1,6 +1,6 @@
 {
   "surface": "mcp",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "browser.a11ytree",

package/caps/pagebridge.json

@@ -1,6 +1,6 @@
 {
   "surface": "pagebridge",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "canvasdata",

package/caps/popup.json

@@ -1,6 +1,6 @@
 {
   "surface": "popup",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "bridge",

package/caps/sidepanel.json

@@ -1,6 +1,6 @@
 {
   "surface": "sidepanel",
-  "release": "2.0.134",
+  "release": "2.0.136",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/checksums.txt

@@ -1,34 +1,34 @@
-dda93439c3aa08f883cb88ca9d45b8387533924371c27dcdb63527856e8600af  CHANGELOG.md
+388ffeefe7b8254e3b87a7b3e4e779e830f95d88dffefcc6a38a4c6b95344500  CHANGELOG.md
 9dfe38a3b873d150550355596958cc83eb440c6e8ac2e4038dfc5609fc0f8f82  README.md
-7aa1c7efcbd849c85b0c361097a7f94aba5be4cc4aa28b320244709e8149f5c0  bridge.d.ts
+848e861b8836e1ef4fe8e62c8e33cf9c6c10f5d9e9412fa34a1298d793a2e58e  bridge.d.ts
 e54c2df84438ff3d256a8ea628b5aa755e6fc8e7d6d754502f7e38142d273cf3  bridge.d.ts.map
-93312439556b0ac587b343cca14662a9a008fa750f9cf7b6361a5621a01a5cb0  bridge.js
+6e4054cd950649e81d7b183c0140792860a1512e0babbc7b874c3ce802b4bcb4  bridge.js
 9557339c2c57fb58212c3b90e8e5934ddba56066a2537d645e4cb34439fdc2ff  bun.d.ts
 601a75f547bb845b8a81fa59a21d560691561eb17d598acb3fd1f4ac8421e424  bun.d.ts.map
-5363899c1d7de64ffb363913de59d8589f4a0173e32fe7a8fce666c4c73b4447  bun.js
-daffbb70bb987dc02e8d82ff27a1d354f5c523134d8fbe8d3a7bc2013514ec4e  caps/background.json
-ce08c7fdff1cb949bcead5ed08d44ed882603f0d0f34b54c2df967a3d5751a8f  caps/cli.json
-1a559d2fd8967b84eb568004ebbfc91848a02ab267743ae0cf161a9508f54807  caps/library.json
-5e5e6a9e36e2dc32f251814416699eb14773afa679efae8da411c94a14a4f85a  caps/mcp.json
-ab0526f513119ae4bbaa4716831b374c1bc3cb7913300867144b26ba485f5690  caps/pagebridge.json
-c8ae76cda189a0e1e232fb24beb8044ca1ad3d08d0f723b1c36072ddbd975ad0  caps/popup.json
-9c062feed3f4b79579bf8621e86ccc8499454129df02d8b99af6c2475561c7d0  caps/sidepanel.json
+1fe474379a4922cb3f942399da4f0a1b0d0ff693a0261a1096729ccf4f895236  bun.js
+67d496d4054ec9aff904abf5309b09667c152528832a2cd5def6fb2e2f5f27fc  caps/background.json
+e0baed36ad93f4044548ef8f825f6030051905a0e3f46b5c544b7faa25d0b86e  caps/cli.json
+24b245bf35dcb7861cd483f88a214fd3154aec233c6478db7ad7b13524a12773  caps/library.json
+147199934df21d61c1d5929bf092010985e3b6f7410f8c8df262ec7a669b58db  caps/mcp.json
+d256c30cf50b12c81b2cccb5840956d6706ddb218b2f51ae9b178ee3d4edc947  caps/pagebridge.json
+68b1cfae37cbd205f0ecdfa2a66b932d49a0f42399bf50175fee02638518969b  caps/popup.json
+ba87eac4a8bf5128806f5dff575f059fcfaf8ba3097fad05dcbbcc1faa88ac70  caps/sidepanel.json
 d35d001526d77c8f37371a39146587ea6ad86179167d82862284557adcd70f17  cli.d.ts
 f7bb3e1903702366effe6c081837b1060c26479740a808f11e0a08ea85e849c9  cli.d.ts.map
-f9a134a575cd773ac2fed5bfebbff60006a22dbb38e50218617e4333805a6ff9  cli.js
+5b3d7eb80f9050ecbd2ffa4ca87c88745fb194066a94a77730f83b06455e763a  cli.js
 6d47383663f5efa626bfbc31977bc3df7cfb383725b243ce08057c059234e42f  companion.d.ts
 df25256c8176fc547298c2fb5666bcbf0f01bec284a0dc94f66350f6c29a38be  companion.d.ts.map
-af9c1cb0aeed99ae642f07a9de33d2b2109befc16a900c93447257cbb9dbe35b  companion.js
+0350a5ba61b53850807a6dc250ac385c1dd1879116f4692296bfca3530b5d2b1  companion.js
 85824f4b1603769f1c117b524925f05a42d37f2bcb41e9d4d377e5408615721f  crossbrowser.d.ts
 a7c4cd26ce8402a9ec1d11bd8dab4222d3c73a0e6f84915402c2fd60f8282d95  crossbrowser.d.ts.map
-75978befb979bc17896f30c0c0791dc697159b5836abf98561fe26aed42ba852  crossbrowser.js
+7619c509d59c110a3497ebd01eca065348dfacf5943e51ec7550ffdbd92d2700  crossbrowser.js
 bc8f0d95430875b0fd8aff5c0744580d3dd07c5a0927aad4f2c54d34b83be016  dashdone.d.ts
 4d7e32ac75985463dd38a5c408e154276c902c1a1a9ba032d610bffc2b89eee5  dashdone.d.ts.map
-c84ad0434c67a8e02a4b9e45a0c2a2fa28144eb45dc513f09ec261f4312e755a  dashdone.js
+7fed493a3a943cb0fa166dc9f8a279349a288780a2ecd8f76e2eec8235e3782e  dashdone.js
 fea8d906a8c3b0608a9ae4b622c0b88c78d535ed151aa9db29922d817c387495  deno.d.ts
 3b07bf585688565ff818934d7d38f26c0188fcaf44ddbc8727ad3c76999b826c  deno.d.ts.map
-a7908f7454c45ab0171131bb21b1ceb25ffc50a12657b8a57a8828c304e59f61  deno.js
-a1232e26fbccdacd2569be3aa0b4cb9379f08def9a7adfdd28d2ce0ce93eec69  devthink.umd.js
+ff7277aa06e88f4fe87b10790819017d29d2e7fa313e27162a784cbdf5fbae47  deno.js
+7322fb1c4e273ce19bccdbdd40e6ee21953ef632df627b8237262ecaf2730786  devthink.umd.js
 d8b6d1f6446da72d359dae978c5495244257dc70660415f8aaad96dd5075e241  fixtures/bun.ts
 702c21459e5d6d8d0b914a86bb6c3646a0be40e132b2d40cc04f2994cfbd1cf3  fixtures/cjs.js
 6bd268717a28a23405e5200264d47bb68aaf9c0d6d911674eaa22477bf19d003  fixtures/deno.ts
@@ -86,42 +86,42 @@ c93c417dbf3a43736845e653598624ee48e79f69bf93d36e3b19655e0a23b792  fixtures/recip
 6b757866f79c4a16098879f7cfffdb85557b7fb6ca4ec7b1c0cd1d1169c3e3c0  gallery.json
 16f6a0cdd78820a257d0fbb501784ed031dcffcdc4b9841d5279c8273e3776f4  hardening.d.ts
 eb153f3fa619ca8f59dd8abb598f33213a98026392854a32a7c305a73688bc95  hardening.d.ts.map
-6e49a7f60603bb4293daa73186984df3134979834728ebf08af926ff864ce099  hardening.js
+cdb7e0b0a06a89cc42e14c0d2d62e44edd84eb0822a4359cc02b9b35f013312c  hardening.js
 2e560159a8c3b121c91d83545e0dcfa03b79399ed052bc23a425b2d355839362  headless.d.ts
 f6a7bced8d6b26f05ca971e70aaa177b8be9fb5a7e25a17ab5f2235a8f9ed590  headless.d.ts.map
-b5e2ab0b13af5143c0eddfd87e9b38ec74ef5f1521e66876f1e2901f39271409  headless.js
+193d671c5404f3e506009f466ba3020a48f6b55a45c235fcae477b7a12615572  headless.js
 7aed8c110caffd11caf27d63b993ad71328851905f4faeea2a8e1442eba8e257  http.d.ts
 b1ab1184756d92fb301a71d5a696ed4cd70bb4953f292002f01930c9e4893024  http.d.ts.map
-825fb2dceac1f795dad0d4781f961d23870b2d7de10b25e8f68b98f7b61d11e3  http.js
-ada7ce1dd10889ff1fdb19cd02440d0f90e1fbd4ee790c6763b06d32d88a2094  index.cjs
+fd7e48c0c9e2c6b0c5e3646bce3964cfb1628e202a9f9670f3b5b35c31937fe8  http.js
+56435aeae78163c8d75332f2a547b2f142418d639e3da199683b946a862cb513  index.cjs
 31b2f3e15bb0b8cbef623b438f01bb8424909686424a98dd88366412d063d7ed  index.d.ts
 9398106d8b2277fb1c40892eff062a8cc8e605837d01f191fb783517367860fc  index.d.ts.map
-100323ed80d3c8a687573ea53be9ed914faf1a8bce1e8502b1722d82b334639f  index.js
-0717652af01c03a1717dfdd29a6894c29ffe976d1beb26189b7e48ddfac2cf5f  index.neutral.js
-438fcbaf9d1002bac5549d7f567e26452541dcf99186ae31e5ff0e5f8c03ac68  manifest.json
+b891c4e0eac0b03e0254b165bf16536cd94169bf22ce3eb02be3678e4f99ea81  index.js
+1b86ae872823e10d5d9daa8be96a4100f2bada8c4b85c6fa3df23e232be9d40a  index.neutral.js
+9cfaa7c1681bf67b1dc3681d4ad8d2068264744a64521b77c6261ab431fa1700  manifest.json
 4a4a38d5c2f25f6e33d7fea853a074d4c82dfe5c721506ca4636b1d65c130f10  mcp.d.ts
 dd22f998da99d77485e863c4e7f1f906bb46dc03ee500efe99a5c09a935f4539  mcp.d.ts.map
-0d06e6ee91924cc642d2dbe155c3c44e54fa2568ea4d05a2f6700051c91fef67  mcp.js
+395b7813621e15143a7057692ddc4f41a361ae61d810cfa2808218cf969dfa9a  mcp.js
 ce98408283eccac2d435ac0e0ceb6bb5456e1eb70edb03a03e347a9f82f99c69  memory.d.ts
 9f4c19494bb1b2260a4d15c4c2dce4d2b3f5da96f07b8fbe9037f9b5fe31c8e1  memory.d.ts.map
-3f101b219fb4760c57c412ca9c16fb6e32c63e48958268b5d5c6645c15e40e77  memory.js
-bef8ecf81119803b687b4a60208db7ff99318a1634bf179555f7c708341c59dd  nativehost.template.json
-57003c700bdb9faea8525fd6ed760d3421db4dd590b21814c38738919bf2fbd4  node.cjs
+54bcc8ef3972f929ef69118303a783f46e8eafc64501471fb92038cb6e4676f9  memory.js
+4e4a0cbe52b5f14636debe7ea63078ec605c668a3c88ba6362351bc54114ba3f  nativehost.template.json
+76ed5c9e829515abb07e61cab670392f7e2d6391cad1f754f4c1560412d3847e  node.cjs
 705d895c58fe6816958f0fed4bef0a6f79e5fc521ab49d9cf83e0fbcd9d71afe  node.d.ts
 45f4394eca20fc889fe1128059ce20130d26a5ae0d89008a7ca93f0e4d52841b  node.d.ts.map
 5ec83bc409bed888ae13ab55d1f329ac630a3cf2f0db0e2414c28324329c055b  pack.d.ts
 619d43a5239d770c3382af3dd57e2588dd067ded81ca8c106d404e6709324a63  pack.d.ts.map
-5cfb067ae642d06889c30509d657e5defddf9dfd9da0f284de8ec7d7954990c4  pack.js
-523eb69b6a45637d2ca731b452cb9837089d82040e2490e4397a86c257206741  package.json
+ec5fd9f582a20dd33d43624b99bae6bbc56aa979a5d64b0fd07207bf18496009  pack.js
+deeaf897bbb19bf9da273b72f99984a8535c01ee7f371f6bfbc78cb66330abec  package.json
 e3a2ed944a0bc1ef4943ee250a57e428ce49d781d30de6072571e0bc5d8c0259  policy.d.ts
 8f4fabc57c883e12ac7c7ab280749dc7c2d402c4fce401bef235c5e451b6975a  policy.d.ts.map
-a9ecbb985b367bbf105c13c4f9b2f1a249a44104ada61694079bd57d0ae5b110  policy.js
+93b4a79b25df39d1a1391204cd89f917c6a82a8e42281e1540eaf7a88a462685  policy.js
 ea621ab35e610fbe8acb8e91f21ed2c74a6b20bba537c5982f31458d6878b90b  progress.d.ts
 33383e690d77faf6f5959846839603079e7f90e1e3dd17cbcc9a4e3fcf1c5641  progress.d.ts.map
-bd124c7deb6d093238c3ed4a3753adaee00f3933301a63ec302c6f4a8d514e71  progress.js
+12a8439482c4009d41563730377384780963dcc0df56053a239a3a3001b126cc  progress.js
 d2e54016f0cad51928752882d780066ccf2267d383deb2407ea7b2f97dfd26e7  protocol.d.ts
 487f8fc63061cb26cbda7f122409d9952810ba3a76b19d147c98d151d4f45d64  protocol.d.ts.map
-0cef8be8a34b77c45ea91083af52dc376accd7cd41d9f3f85da344a3d68127a9  protocol.js
+c28cb38ac1a1253650ad1f20edb8bc231d990b1b705f200483c6c0a64ed1ec51  protocol.js
 456c4a26fd65c728f2dcb9e615ec6e4d446d7e4228bfa3f70ce2b17ee3d6a2c2  schemas/audit.schema.json
 ea272aa6bf4df585ae1ca8ca63e36d7ec713c46187f37ed86ff3620a0e8509b2  schemas/capability.schema.json
 6e9d2291dc54f7d01463e5f70c8f0793d952a63f4096d61ee4dbc4bfd6f6b0a0  schemas/envelope.schema.json
@@ -134,8 +134,8 @@ d0e0365a7641c0127338c14a5318c4591dc598b7d2a36b7b2944219921d1ce4e  schemas/sessio
 5bb7d16534b52ca3a7171178065fb7b283947accd1b616ce89e330eb7a91b82e  schemas/tool.schema.json
 3154e5535045f39fa876a2d0df15ff55421ff1fde1abf41aceccf05f0ad699c7  server.d.ts
 4ffc290d618a91b173b1343d8ae15f0d18fdd4a31b30f4727c0002ec4006ffb0  server.d.ts.map
-ca8051920f4d40d2a7f77ba6cfc0e60e1c2c9c516959bbb1ca6ec75067a85383  server.js
-4d19a8b785eec08d46c6aa51c42ae50f49e7538a61058c9dde1b5bac15ddaa49  umd-example.html
+b82213a833d401d8ddce93b0dfdc47606d7ca2d08959ea721c1b4981f909860b  server.js
+7bbbf41af3e3a281345206839980d04cdc7d3dc0714ed7c7a82eab25914f9de5  umd-example.html
 16f66af22e038e4f9328420a0ed0ee34145ca79c938940e8c2e6d232e25a7c09  umd.d.ts
 ac25f7481155ac9321c5a657e7c4a53570bee8b3f63fe3527045260523a494c8  umd.d.ts.map
 58e21373cec5ade3e6698da5b36ecc2bf7e7e2f755c6fb5e3a6605b535b93985  manifest.json key

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // cli.ts
 import { createInterface } from "node:readline/promises";
@@ -569,7 +569,7 @@ function endcall(input) {
 }
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/companion.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
+/*! devthink 2.0.136 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
 
 // companion.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -16,7 +16,7 @@ var nativehosttemplatejson = `{
   "devthinkBanner": "devthink __devthink_version__ native host manifest template \u2014 GPL-3.0-only \u2014 the chromium host manifest of the optional companion process"
 }
 `;
-var companionbuild = "2.0.134";
+var companionbuild = "2.0.136";
 var companionprotocol = 1;
 var companionsurfaces = ["osdialog", "notification"];
 var maxnativemessage = 1024 * 1024;

package/crossbrowser.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // crossbrowser.ts
 var browserpolyfillflags = [

package/dashdone.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // dashdone.ts
 function dashboardviewerof(input) {

package/deno.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/devthink.umd.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 (function (root, factory) {
   if (typeof define === "function" && define.amd) { define([], factory); }
   else if (typeof module === "object" && module.exports) { module.exports = factory(); }
@@ -2365,7 +2365,7 @@ __export(umd_exports, {
 module.exports = __toCommonJS(umd_exports);
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/hardening.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // security.ts
 var maskmarker = "[redacted]";

package/headless.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 
 // runtime.ts

package/http.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 
 // types.ts

package/index.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2356,7 +2356,7 @@ __export(cjs_exports, {
 module.exports = __toCommonJS(cjs_exports);
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.neutral.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpkinds = [
@@ -2010,7 +2010,7 @@ function sessionbundleof(input) {
 }
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnOEjO8Z0PDgQyfvawGcaO2j+o0GLCFTLNj7TkYC/Avo9l2NenMRq7gp90Nfd7E9MViv/OMcCKSYZ5unv12QPRtv31C+a5UQWDFAOP/cH5mwMd6hsayElrSoW8ta+FwFqmr9dIFkn7cQEU3YhZr4Gcbs+ycUHOxVgDA4NBKB0rQ6e9VW5LvTw0isRYUrqM+M72vKxHk9zUIYYn/LGPvottKBYi2GLr0PHSeC2UE+Shmq7vcFIXj6hDjvD4kLJ5sKoUllEcZ1TPuBcnHUQ9ndKA5iktXDQOIJCUJmi7a0YJ2PGg7fvpYfT9k0ai/qZ+pIoRfoOEwE01bPoDn7NjeYnNQIDAQAB",
   "name": "DevThink",
-  "version": "2.0.134",
+  "version": "2.0.136",
   "description": "A consent-first bridge for reviewed browser-agent tasks.",
   "icons": {
     "16": "icons/16.png",

package/mcp.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/memory.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 function expireprofilerecords(input) {

package/nativehost.template.json

@@ -6,5 +6,5 @@
   "allowed_origins": [
     "chrome-extension://__generated_extension_id__/"
   ],
-  "devthinkBanner": "devthink 2.0.134 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
+  "devthinkBanner": "devthink 2.0.136 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
 }

package/node.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2357,7 +2357,7 @@ __export(node_exports, {
 module.exports = __toCommonJS(node_exports);
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/pack.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // pack.ts
 function artifactchannels() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/devthink",
-  "version": "2.0.134",
+  "version": "2.0.136",
   "description": "DevThink is the merged AI development workbench: the provider-owned gateway engine, the DevThink browser extension (the agent surface), the Antigravity engine and the workbench CLI — one product, one binary, one metadata.",
   "type": "module",
   "license": "GPL-3.0-only",
@@ -32,6 +32,7 @@
     "@wenathlan/saddle": "^2.1.6",
     "hono": "^4.13.13",
     "ink": "^7.1.1",
+    "motion": "^12.43.0",
     "react": "^19.3.1",
     "react-devtools-core": "^8.0.0",
     "z-ai-web-dev-sdk": "^0.0.18"

package/policy.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -350,7 +350,7 @@ function sessionrecordvalid(value) {
 }
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/progress.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 
 // progress.ts

package/protocol.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -1255,7 +1255,7 @@ function cronvalue(value, min, max, names) {
 }
 
 // version.ts
-var packageversion = "2.0.134";
+var packageversion = "2.0.136";
 var protocolmajor = 2;
 
 // types.ts

package/server.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.134 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.136 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -7795,11 +7795,11 @@ import { createHash, randomInt as randomInt4, timingSafeEqual } from "node:crypt
 import { existsSync as existsSync4, readFileSync as readFileSync3, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 
 // ids.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
 var alphabet = "0123456789abcdefghjkmnpqrstvwxyz";
 var tokenLength = 10;
 function compactToken() {
-  const bytes = randomBytes2(tokenLength);
+  const bytes = new Uint8Array(tokenLength);
+  globalThis.crypto.getRandomValues(bytes);
   return Array.from(bytes, (value) => alphabet[value & 31]).join("");
 }
 function createCompactId(prefix) {
@@ -11175,7 +11175,68 @@ var SEED = Object.freeze({
   "callback.unknown": "Unknown origin",
   "callback.unknown.note": "The callback carries no state marker this page minted \u2014 the round trip did not start here.",
   "callback.back.auth": "back to the sign-in page",
-  "callback.back.panel": "to the panel"
+  "callback.back.panel": "to the panel",
+  "settings.search.placeholder": "Find a setting",
+  "settings.nav.personalization": "Personalization",
+  "settings.nav.accounts": "Accounts",
+  "settings.nav.gateway": "Gateway & Pairing",
+  "settings.nav.drives": "Drives",
+  "settings.nav.automation": "Automation & MCP",
+  "settings.nav.about": "About",
+  "settings.account.sub.local": "local browser",
+  "settings.account.sub.paired": "paired gateway",
+  "settings.personal.background": "Background",
+  "settings.personal.background.desc": "The wallpaper the desktop and the lock screen paint.",
+  "settings.wall.trident": "Trident dawn",
+  "settings.wall.bloom": "Bloom",
+  "settings.wall.meadow": "Meadow",
+  "settings.wall.tide": "Tide",
+  "settings.wall.dusk": "Dusk",
+  "settings.wall.sand": "Linen",
+  "settings.personal.colors": "Colors",
+  "settings.personal.colors.desc": "The mode and the accent the shell wears.",
+  "settings.personal.mode": "Mode",
+  "settings.personal.mode.light": "Light",
+  "settings.personal.mode.dark": "Dark",
+  "settings.personal.accent": "Accent color",
+  "settings.accent.blue": "Signal blue",
+  "settings.accent.cyan": "Cyan",
+  "settings.accent.teal": "Teal",
+  "settings.accent.fern": "Fern",
+  "settings.accent.moss": "Moss",
+  "settings.accent.amber": "Amber",
+  "settings.accent.rose": "Rosewood",
+  "settings.accent.slate": "Slate",
+  "settings.personal.navbar": "Navbar position",
+  "settings.personal.navbar.desc": "Where the taskbar docks on the screen.",
+  "settings.navbar.floating": "Floating",
+  "settings.navbar.left": "Left edge",
+  "settings.navbar.right": "Right edge",
+  "settings.personal.components": "Component options",
+  "settings.personal.components.desc": "The shell behaviors this machine plays.",
+  "settings.toggle.alttab": "Alt-tab entrance",
+  "settings.toggle.alttab.desc": "The task switcher animates in when it opens.",
+  "settings.toggle.tips": "Taskbar tooltips",
+  "settings.toggle.tips.desc": "The app name surfaces above a taskbar icon.",
+  "settings.rail.title": "Desktop rail",
+  "settings.rail.always": "Always",
+  "settings.rail.auto": "Auto",
+  "settings.rail.off": "Off",
+  "settings.zoom.label": "Interface zoom",
+  "settings.language.title": "Language",
+  "settings.language.display": "Display language",
+  "settings.accounts.identity": "Public identity",
+  "settings.accounts.identity.id": "Public id",
+  "settings.accounts.identity.save": "Save public id",
+  "settings.accounts.access": "Browser access",
+  "settings.accounts.access.desc": "Revoking removes the paired browser sessions of this machine.",
+  "settings.accounts.access.revoke": "Revoke browser access",
+  "settings.gateway.sync": "Sync state",
+  "settings.gateway.sync.pairhint": "Pair with devthink pair create to sync the cli gateway.",
+  "settings.gateway.boundary": "Credential boundary",
+  "settings.gateway.boundary.desc": "Provider credentials stay with the cli, never in this browser.",
+  "settings.about.database": "Local database",
+  "settings.about.database.paired": "Gateway database"
 });
 function copyseed() {
   return SEED;
@@ -15087,7 +15148,7 @@ __export(request_exports, {
   validateToolNamesDetailed: () => validateToolNamesDetailed
 });
 import * as os7 from "node:os";
-import { randomBytes as randomBytes5, randomInt as randomInt6 } from "node:crypto";
+import { randomBytes as randomBytes4, randomInt as randomInt6 } from "node:crypto";
 var osPlatform2 = os7.platform;
 var MODELS_2026_SET = new Set(FETCH_AVAILABLE_MODELS_2026);
 var TOOL_NAME_MAX_LENGTH = 64;
@@ -17016,12 +17077,12 @@ function generateDeterministicId(seed) {
   return fnv1a32Hex(seed);
 }
 function generateSessionId(seed, offsetEnabled) {
-  const base = seed ?? `${Date.now()}-${randomBytes5(4).toString("hex")}`;
+  const base = seed ?? `${Date.now()}-${randomBytes4(4).toString("hex")}`;
   const offset = offsetEnabled ? randomInt6(0, 1001) : 0;
   return fnv1a32Hex(`${base}-${offset}-session`);
 }
 function generateUserPromptId(seed, offsetEnabled) {
-  const base = seed ?? `${Date.now()}-${randomBytes5(4).toString("hex")}`;
+  const base = seed ?? `${Date.now()}-${randomBytes4(4).toString("hex")}`;
   const offset = offsetEnabled ? randomInt6(0, 1001) : 0;
   return fnv1a32Hex(`${base}-${offset}-user-prompt-${offsetEnabled ? offset : 0}`);
 }
@@ -19443,7 +19504,7 @@ import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:
 import * as fsp4 from "node:fs/promises";
 import { join as join10, resolve as resolve7, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { randomInt as randomInt8, randomBytes as randomBytes9 } from "node:crypto";
+import { randomInt as randomInt8, randomBytes as randomBytes8 } from "node:crypto";
 
 // project.ts
 var project_exports = {};
@@ -23020,7 +23081,7 @@ function buildOpencodeAuthMethods(fallbackProvider) {
       authorize: async () => {
         const inst = getPlugin();
         const identity = resolveOAuthIdentity(inst?.options?.oauth_identity ?? "auto");
-        const state = randomBytes9(32).toString("base64url");
+        const state = randomBytes8(32).toString("base64url");
         const pkce = identity.usesPKCE ? generatePKCE?.() ?? null : null;
         const srv = await createOAuthServerAsync({
           callbackPath: "/oauth2callback",

package/umd-example.html

@@ -1,4 +1,4 @@
-<!-- devthink 2.0.134 umd example page — GPL-3.0-only -->
+<!-- devthink 2.0.136 umd example page — GPL-3.0-only -->
 <!doctype html>
 <html lang="en">
 <head>