@wenathlan/devthink 2.0.14 → 2.0.15

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # DevThink release notes
 
+## 2.0.15 — the base image CVE closure and the five family lanes the merge left behind
+
+### Changed
+
+| Area | Change |
+| --- | --- |
+| The container runtime base closure | The 2.0.14 publish ghcr gate failed on four HIGH advisories the trivy release scan found inside the npm bundle the node slim base carries (brace-expansion 5.0.7 under CVE-2026-14257 and CVE-2026-69152, ip-address 10.2.0 under CVE-2026-69192, tar 7.5.19 under CVE-2026-73566 — all three in /usr/local/lib/node_modules/npm of the runtime image). No npm release folds the fixes yet — the check against npm 12.0.2 latest still resolves the three frozen versions, so an npm upgrade cannot close them — and the runtime surface never invokes the package manager (the entrypoint is plain node driving container.mjs, the healthcheck rides node fetch, the --check boot probe needs no installer): the bundle leaves the runtime image entirely (the e2ugh 1.2.18 base-image closure doctrine applied to the bundled toolchain), the trivy release gate answers clean, the image drops the unused toolchain weight, and the deletion rides before the smoke boot so the boot that gates the build already answers from the pruned surface it ships. |
+| The strict json gate | The gateway family json gate (the maene and e2ugh lanes carry the same battery) joins the verify ladder: every tracked .json document answers a strict parse with the single JSONC tolerance tsconfig files carry, the manifests answer their structural contract (the mining evidence fixtures under tests/code stay arrays at the top level — they are recorded repository evidence, not configuration), and the web manifest mirrors the root version in lockstep — a broken metadata document never reaches the ladder (115 documents validated on this rung). |
+| The license compliance lane | The gateway family license gate joins the security pipeline: the repository license must exist and be non-empty (GPL-3.0-only, the label the runtime image declares), and the runtime dependency tree the bun lockfile pins answers the permissive OSI allow list plus the two family facts of the merged tree (the devthink package itself answers GPL-3.0-only, elkjs answers EPL-2.0 with the eclipse secondary license exception) — a copyleft or unlicensed transitive dependency never rides the published package. |
+| The LTS typecheck leg | The e2ugh family LTS doctrine joins the runtime compatibility lanes: the typecheck must hold on the active LTS line (node 24.x), not only on the current line the .nvmrc baseline pins — a TypeScript regression that only answers on the current runtime never rides a release. The tsc binary stays the pinned toolchain the lockfile resolves; the LTS lane only swaps the node that drives it. |
+| The pages boot smoke and the html lint | The e2ugh pages battery joins the pages pipeline: the built static bundle must actually serve — a pinned-port boot of the delivered tree (python stdlib http.server on the documented 30000-59999 band), a bounded curl poll, content assertions on the SPA entry and the fallback page, and the trap that guarantees the server child terminates whether the assertions pass or fail — and the delivered pages answer the python stdlib html.parser well-formedness walk (every opened tag closed in order, the VOID set the html spec carries). A bundle whose entry cannot be served never reaches the Pages deploy. |
+| The registry lanes hardening | The two npm registry lanes gain the pair of family doctrines the extension and maene lanes carry: the bounded retry policy (registry pushes answer transient failures — the publish retries inside three attempts with the linear backoff, only a third failure reddens the lane) and the latest dist-tag realignment (npm never moves the latest tag when a release lands below the current latest, so both lanes pin latest to the release version explicitly — the registry pages always answer the version this pipeline published). |
+| The referrers fallback cleanup | The extension release lane doctrine joins the publish ghcr lane: the registry records every pushed manifest as a package version, and the attestation pushes of earlier releases left referrers fallback manifests behind as versions tagged only sha256-... — the lane walks the package versions and drops exactly those, dynamically from the registry answer (no digest is written anywhere), so the package page answers only the version tags the metadata step owns. The walk is idempotent: a page with no referrers-only versions answers nothing and the lane stays green. |
+| The root typescript grouping audit | The root tree answers the family grouping doctrine as it stands: the eighty-seven typescript documents carry the correlated-domain families at the scale the house doctrine demands (the giant domain files hold hundreds of correlated logics each — policy, background, types, memory, page, protocol, server, workflow, cli, request, streaming), and the small files beside them are build contracts, not fragments: the cjs/umd/node/bun/deno entries are the platform targets the 1.1.67/1.1.81 library modes emit as separate bundles, the version stamp is the canonical single source the lockstep battery reads, and consolidating any of them would break the api freeze, the permission baseline and the bridge battery that guard the contracts. No file moves; the audit records the grouping stands. |
+
 ## 2.0.14 — the saddle workflow features answer the container product, the family surface completes
 
 ### Changed

package/dist/bridge.d.ts

@@ -428,7 +428,7 @@ import type { jsonrpcframe } from "./types.js";
 /** The native bridge protocol major version this build speaks: the handshake reports it, the upgrade path keeps compatibility for exactly one major version, and a host that speaks another major version degrades instead of breaking the run. */
 export declare const nativebridgeprotocolmajor = 1;
 /** The installer version the installer stamps into the install state; the upgrade path compares it so a manifest written by an older installer reports before it overwrites. */
-export declare const nativehostinstallerversion: "2.0.14";
+export declare const nativehostinstallerversion: "2.0.15";
 /** The generated extension id placeholder the host manifest template carries: the installer replaces the token with the extension id of the installed build, so the template never pins an identity the user did not generate. */
 export declare const nativehostidplaceholder = "__generated_extension_id__";
 /** The native messaging directory name of the chromium user profile: the installer writes the host manifest beside it, never into a system directory without the explicit flag. */

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! devthink 2.0.14 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+/*! devthink 2.0.15 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
 
 // cli.ts
 import { createInterface } from "node:readline/promises";
@@ -569,7 +569,7 @@ function endcall(input) {
 }
 
 // version.ts
-var packageversion = "2.0.14";
+var packageversion = "2.0.15";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 import type { memoryadapter } from "./memory.js";
-export declare const protocolversion: "2.0.14";
+export declare const protocolversion: "2.0.15";
 /** The frozen protocolv2 major of the 1.1.91 api freeze: the wire speaks major two from this release on, version one messages stay accepted through the deprecation window and versions above two refuse until a future major bump — the constant mirrors version.ts so the freeze gate can verify the pair never drifts. */
 export declare const protocolmajorversion: 2;
 /** The protocolv2 pin a library consumer imports to freeze the wire contract of its build: the pinned pair of the exact package version and the frozen protocol major, so a consumer that imports this constant answers which wire line its build declared and refuses every message its pinned build never carried. */

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** Canonical package version synchronized from package.json. */
-export declare const packageversion: "2.0.14";
+export declare const packageversion: "2.0.15";
 /** The frozen protocolv2 major of the 1.1.91 api freeze: the wire speaks major two from this release on, the deprecation window closed at 2.0.0 and every major above two refuses until a future major bump. */
 export declare const protocolmajor: 2;
 /** The lowest protocol major this build accepts: the deprecation window closed at 2.0.0, so the line speaks major two only — a client that declares major one answers the refusal below the floor while version one assets ride the migrateplan command and the migration guide. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/devthink",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/wenathlan/devthink"

package/version.ts

@@ -1,5 +1,5 @@
 /** Canonical package version synchronized from package.json. */
-export const packageversion = "2.0.14" as const;
+export const packageversion = "2.0.15" as const;
 
 /** The frozen protocolv2 major of the 1.1.91 api freeze: the wire speaks major two from this release on, the deprecation window closed at 2.0.0 and every major above two refuses until a future major bump. */
 export const protocolmajor = 2 as const;

package/web/design.html

@@ -378,7 +378,7 @@ button.secondary { background: transparent; color: var(--ink); }
 </script>
 </template>
 <template data-surface="popup">
-<main><header><p class="eyebrow">DEVTHINK 2.0.14</p><h1>Browser bridge</h1><p>Consent is required before page access or action.</p></header><label for="endpoint">Optional agent endpoint</label><input id="endpoint" type="url" inputmode="url" placeholder="https://agent.example/proposal" autocomplete="off"><button id="connect">Approve endpoint origin</button><div class="actions"><button id="session">Start active tab session</button><button id="pause" class="secondary">Pause session</button><button id="openpanel" class="secondary">Review plans</button><button id="stop" class="danger">Stop</button><button id="killswitch" class="danger">Killswitch</button></div>
+<main><header><p class="eyebrow">DEVTHINK 2.0.15</p><h1>Browser bridge</h1><p>Consent is required before page access or action.</p></header><label for="endpoint">Optional agent endpoint</label><input id="endpoint" type="url" inputmode="url" placeholder="https://agent.example/proposal" autocomplete="off"><button id="connect">Approve endpoint origin</button><div class="actions"><button id="session">Start active tab session</button><button id="pause" class="secondary">Pause session</button><button id="openpanel" class="secondary">Review plans</button><button id="stop" class="danger">Stop</button><button id="killswitch" class="danger">Killswitch</button></div>
 <section id="onboardingcard" class="panel" hidden></section>
 <section><h2>Task</h2><label for="taskinput">Describe a browser task in plain language</label><textarea id="taskinput" rows="3" placeholder="For example: collect the pricing table of this page into a dataset."></textarea><div class="actions"><button id="tasksubmit">Propose plan</button><span id="proposalstatus" class="muted">idle</span></div><div class="actions"><button id="runquick" class="secondary">Run</button><button id="cancelquick" class="secondary">Cancel run</button><button id="opendashboard" class="secondary">Open dashboard</button><button id="openoptions" class="secondary">Open options</button></div></section>
 <section><h2>Recent runs</h2><div id="recenttray" class="panel" role="list" aria-label="Recent runs"></div></section><section><h2>Closed tabs</h2><div id="closedtabs" class="panel" role="list" aria-label="Recently closed tabs"></div></section><section><h2>Quick actions</h2><div id="quickactions" class="panel" role="list" aria-label="Quick actions of the active tab"></div></section><section><h2>Command palette</h2><div class="actions"><input id="paletteinput" placeholder="Search commands (ctrl+.)" aria-label="Command palette search"><button id="paletteopen" class="secondary">Palette</button></div><div id="palettematches" class="panel"></div></section><p id="capabilities" role="status" class="muted">Optional capabilities: loading.</p><p id="livelogic" role="status" class="muted">Held keys: none · Open dialogs answered: none.</p><p id="navstate" role="status" class="muted">Navigation: unknown.</p><p id="windowlayout" role="status" class="muted">Window layout: unknown.</p><p id="captchastate" role="status" class="muted">Captcha handoff: none.</p><p id="datasetstate" role="status" class="muted">Datasets: none collected yet.</p><p id="downloadstate" role="status" class="muted">Downloads: none.</p><p id="clipboardstate" role="status" class="muted">Clipboard consent: none waiting.</p><p id="capturestate" role="status" class="muted">Captures: none.</p><p id="mediastate" role="status" class="muted">Media: none.</p><p id="callstate" role="status" class="muted">Outbound calls: none.</p><p id="netstate" role="status" class="muted">Observed requests: none.</p><p id="rulestate" role="status" class="muted">Traffic rules: none active.</p><p id="debugstate" role="status" class="muted">Timeline: no errors captured.</p><p id="emulationstate" role="status" class="muted">Emulation: no active layer.</p><p id="sessionstate" role="status" class="muted">Sessions: none saved yet.</p><p id="workflowstate" role="status" class="muted">Workflows: none running.</p><p id="triggerstate" role="status" class="muted">Triggers: none armed.</p><p id="mcpstate" role="status" class="muted">Mcp server: stopped.</p><p id="modelstate" role="status" class="muted">Models: none connected.</p><p id="swarmstate" role="status" class="muted">Swarm: no agents.</p><p id="environmentstate" role="status" class="muted">Environments: no run state.</p><p id="perfstate" role="status" class="muted">Performance: no run measured.</p><p id="heartbeatstate" role="status" class="muted">Heartbeat: no run heartbeats yet.</p><p id="encryptstate" role="status" class="muted">Encryption: encryptrest off.</p><p id="fleetstate" role="status" class="muted">Fleet: no agents.</p><p id="workstate" role="status" class="muted">Workers: none.</p><p id="pipelinestate" role="status" class="muted">Pipelines: none.</p><p id="visionstate" role="status" class="muted">Vision: none.</p>

package/web/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnOEjO8Z0PDgQyfvawGcaO2j+o0GLCFTLNj7TkYC/Avo9l2NenMRq7gp90Nfd7E9MViv/OMcCKSYZ5unv12QPRtv31C+a5UQWDFAOP/cH5mwMd6hsayElrSoW8ta+FwFqmr9dIFkn7cQEU3YhZr4Gcbs+ycUHOxVgDA4NBKB0rQ6e9VW5LvTw0isRYUrqM+M72vKxHk9zUIYYn/LGPvottKBYi2GLr0PHSeC2UE+Shmq7vcFIXj6hDjvD4kLJ5sKoUllEcZ1TPuBcnHUQ9ndKA5iktXDQOIJCUJmi7a0YJ2PGg7fvpYfT9k0ai/qZ+pIoRfoOEwE01bPoDn7NjeYnNQIDAQAB",
   "name": "Devthink",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "description": "A consent-first bridge for reviewed browser-agent tasks.",
   "icons": {
     "16": "icons/16.png",