@withbuddi/buddi 0.1.0-pre.44 → 0.1.0-pre.46

package/node_modules/marked/man/marked.1

@@ -1,4 +1,4 @@
-.TH "MARKED" "1" "September 2026" "18.0.13"
+.TH "MARKED" "1" "October 2026" "18.0.14"
 .SH "NAME"
 \fBmarked\fR \- a javascript markdown parser
 .SH SYNOPSIS

package/node_modules/marked/package.json

@@ -2,7 +2,7 @@
   "name": "marked",
   "description": "A markdown parser built for speed",
   "author": "Christopher Jeffrey",
-  "version": "18.0.14",
+  "version": "18.1.0",
   "type": "module",
   "main": "./lib/marked.esm.js",
   "module": "./lib/marked.esm.js",

package/node_modules/nanoid/README.md

@@ -10,7 +10,7 @@ A tiny, secure, URL-friendly, unique string ID generator for JavaScript.
 > “An amazing level of senseless perfectionism,
 > which is simply impossible not to respect.”
 
-- **Small.** 118 bytes (minified and brotlied). No dependencies.
+- **Small.** 117 bytes (minified and brotlied). No dependencies.
   [Size Limit] controls the size.
 - **Fast.** 50% faster than native `crypto.randomUUID()`.
 - **Safe.** It uses hardware random generator. Can be used in clusters.
@@ -20,8 +20,8 @@ A tiny, secure, URL-friendly, unique string ID generator for JavaScript.
   to over [20 programming languages](./README.md#other-programming-languages).
 
 ```js
-import { nanoid } from 'nanoid'
-model.id = nanoid() //=> "V1StGXR8_Z5jdHi6B-myT"
+import { nanoid } from "nanoid";
+model.id = nanoid(); //=> "V1StGXR8_Z5jdHi6B-myT"
 ```
 
 ---

package/node_modules/nanoid/index.browser.js

@@ -17,7 +17,7 @@ export let customRandom = (alphabet, defaultSize, getRandom) => {
       let id = ''
       while (true) {
         let bytes = getRandom(size)
-        let j = size
+        let j = (size |= 0)
         while (j--) {
           id += alphabet[bytes[j] & mask]
           if (id.length >= size) return id
@@ -26,11 +26,10 @@ export let customRandom = (alphabet, defaultSize, getRandom) => {
     }
   }
 
-  let step = Math.ceil((1.6 * 256 * defaultSize) / safeByteCutoff)
-
   return (size = defaultSize) => {
     if (!size) return ''
     let id = ''
+    let step = Math.ceil((1.6 * 256 * size) / safeByteCutoff)
     while (true) {
       let bytes = getRandom(step)
       let j = step
@@ -48,8 +47,8 @@ export let customAlphabet = (alphabet, size = 21) =>
   customRandom(alphabet, size | 0, random)
 
 export let nanoid = (size = 21) => {
-  let id = ''
-  let bytes = crypto.getRandomValues(new Uint8Array((size |= 0)))
+  var id = ''
+  var bytes = crypto.getRandomValues(new Uint8Array((size |= 0)))
   while (size--) {
     id += urlAlphabet[bytes[size] & 63]
   }

package/node_modules/nanoid/index.d.ts

@@ -59,9 +59,9 @@ export function customAlphabet<Type extends string>(
  * import { customRandom } from 'nanoid'
  *
  * const nanoid = customRandom('abcdef', 5, size => {
- *   const random = []
+ *   const random = new Uint8Array(size)
  *   for (let i = 0; i < size; i++) {
- *     random.push(randomByte())
+ *     random[i] = randomByte()
  *   }
  *   return random
  * })
@@ -85,7 +85,7 @@ export function customRandom<Type extends string>(
  * URL safe symbols.
  *
  * ```js
- * import { urlAlphabet } from 'nanoid'
+ * import { customAlphabet, urlAlphabet } from 'nanoid'
  * const nanoid = customAlphabet(urlAlphabet, 10)
  * nanoid() //=> "Uakgb_J5m9"
  * ```

package/node_modules/nanoid/index.js

@@ -32,7 +32,7 @@ export function customRandom(alphabet, defaultSize, getRandom) {
       let id = ''
       while (true) {
         let bytes = getRandom(size)
-        let i = size
+        let i = (size |= 0)
         while (i--) {
           id += alphabet[bytes[i] & mask]
           if (id.length >= size) return id
@@ -41,11 +41,10 @@ export function customRandom(alphabet, defaultSize, getRandom) {
     }
   }
 
-  let step = Math.ceil((1.6 * 256 * defaultSize) / safeByteCutoff)
-
   return (size = defaultSize) => {
     if (!size) return ''
     let id = ''
+    let step = Math.ceil((1.6 * 256 * size) / safeByteCutoff)
     while (true) {
       let bytes = getRandom(step)
       let i = step

package/node_modules/nanoid/nanoid.js

@@ -1 +1 @@
-let a="useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";export let nanoid=(e=21)=>{let t="",r=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=a[63&r[e]];return t};
+let a="57X6y3wQZNzYjJB2L_10pxbackgroundhimselfUTF-8DEMOGRAPHICSVqvt4KW9";export let nanoid=(r=21)=>{for(var e="",t=crypto.getRandomValues(new Uint8Array(r|=0));r--;)e+=a[63&t[r]];return e};

package/node_modules/nanoid/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nanoid",
-  "version": "6.0.1",
-  "description": "A tiny (118 bytes), secure URL-friendly unique string ID generator",
+  "version": "6.0.2",
+  "description": "A tiny (117 bytes), secure URL-friendly unique string ID generator",
   "keywords": [
     "id",
     "random",

package/node_modules/nanoid/url-alphabet/index.js

@@ -1,2 +1,2 @@
 export let urlAlphabet =
-  'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict'
+  '57X6y3wQZNzYjJB2L_10pxbackgroundhimselfUTF-8DEMOGRAPHICSVqvt4KW9'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withbuddi/buddi",
-  "version": "0.1.0-pre.44",
+  "version": "0.1.0-pre.46",
   "type": "module",
   "description": "Your personal agents, on your computer",
   "repository": {
@@ -17,7 +17,7 @@
     "buddi": "packages/install/dist/launcher.js"
   },
   "buddi": {
-    "notes": "- Cloudflare Access, \"Set it up for me\": buddi now runs Cloudflare's connector itself, as part of its own service, so the last step is \"Starting the connector…\" then \"Connected\" — no `sudo` command to copy. If cloudflared isn't installed, buddi downloads Cloudflare's official release and checks it against Cloudflare's published checksum before running it (or install it with `brew install cloudflared`). If an earlier setup left Cloudflare's system service on this computer, the step says so, explains why two connectors would fight, and gives the one line that removes it — or choose \"Use the system daemon instead\". Remove what buddi made stops the connector and deletes the copy of cloudflared buddi downloaded.\n- The lock screen has two new pictures: Peoria autumn waterfront and Golden streak. Settings → Lock screen → Background now shows Colours and Pictures as two rows, with the chosen picture's credit underneath. Phones get a picture's portrait version when it has one. Your own picture can have a second, portrait version for phones too.\n- Your front desk can now fill in everything Settings → Profile has, from what you tell it: your full name, pronouns, 12- or 24-hour time, how dates read, and places like Home and Work (it looks up the address, tells you which town it matched, and keeps that town's timezone), as well as your name, timezone, language, birthday and a few lines about you. It only records what you said, refuses what the Profile page refuses, and every agent uses it from its next message. When a task needs something missing (a letter needs your full name, \"how long to work?\" needs Work) it asks once, in one question; otherwise at most one \"knowing you\" question a week, never twice about the same thing, and \"don't ask\" is remembered. Agent Father sees what is missing too, and when you ask it or the front desk to become yours, it answers plainly: it can't change itself in place, but it can make a copy that's yours, same name and handle. From Claude Code, `buddi.profile_update` makes the same change as an approval card.\n- Releases are tagged by CI after the gate passes: `pnpm release pre.N` pushes a release commit to main, and the release workflow tags it and publishes once the full gate is green. A red gate is fixed with a normal push on top; nothing is tagged until then (docs/release.md).\n- One buddi mark everywhere: the Blob is the icon in your Dock, your browser tab, the extension and the site. At the smallest sizes it gets bigger eyes and a bigger coral tip so it still reads as Buddi; the extension's new icon arrives with its next store update.\n- Plugins now learn which of your model accounts can listen and speak: an OpenAI key and Gemini can, a ChatGPT subscription and Claude can't, and Ollama or another compatible server is \"try it and see\". Settings → Speech uses this to offer only accounts that work, with the reason beside the ones that don't. (Host API 1.30.)\n### Added\n\n- Mail: opening a conversation now reads it. Each message shows who wrote it (their initial, name and address), when, and who else got it under \"to …\"; the body looks the way it was sent, with earlier quoted messages folded behind \"··· earlier message\" and attachments you can open in Files (or fetch first). Pictures from the web stay hidden until you press Show images, which buddi remembers for that sender; tracking pixels never load. Above the thread, Mail Triage says what it made of the latest message and what it changed, with Undo; \"Needs a reply\" has a Done button; and the reply written for you shows as a message with Send and Edit. Older messages fold to one line until you open them, and the old summary (subject, state, people, count) is under Details at the bottom. The list shows the sender's name, a line of the latest message, unread conversations in bold and Mail Triage's label as a chip; ↑ and ↓ move through it and Enter opens one. New mail keeps its formatting from now on; mail that arrived before shows its text."
+    "notes": "### Added\n\n- Plugin pages can hide just the figures: a page query may name the values that are sensitive (a balance, a total) instead of hiding everything that reads it. The page then shows its whole layout with those values as •••• and one \"Show amounts\" button in its head, which reveals the page (and the next one) until you switch to another app or tab, or five minutes pass. Showing or hiding amounts never empties a form you are typing in, and a field still showing •••• cannot be saved, in a form, a row's sheet or an editor alike. Over MCP, `buddi.page_query` returns those values as \"(hidden)\" unless asked with `includeSensitive`. (Host API 1.31.)\n\n### Changed\n\n- Canvas tabs in long conversations: a tab is now known by the tool and what it was about (a file, an account, a page, a site), titled \"Staged import · savings.csv\" instead of by the tool alone. Two files with the same name in different folders get a tab each. A repeat call on the same subject updates that tab and keeps the earlier results one step back inside it. The strip holds three tabs, most recently looked at first; the rest are a scrollable timeline (Now / Earlier this turn / Earlier) with Close others and Close all. A staged result past its expiry closes itself and a failure with nothing to show moves into the timeline; their chat rows still open them. Closed tabs and the order are kept per conversation by buddi, not in the browser.\n\n### Fixed\n\n- Agents can download files in the browser. A CFO on a bank site could not get a transactions CSV: buddi's own browser cancelled every download. Now a file an agent's click downloads goes into your Files (\"Downloaded from bank.example\", credited to the agent), and the agent gets its id to hand to the plugin that imports it. At most 50 MB a file and 500 MB per agent (a bigger one is refused and the agent says why), never executable; Files keeps the only copy. Settings → Browser & apps → Downloads shows any file that could not be filed and is waiting (cleared after 30 days), with Clear. In your Chrome, press Allow downloads in the buddi extension's popup once: then downloads an agent's click starts are picked up too, and the ones you start yourself are never touched.\n- Agents' downloads are held to tighter rules. In buddi's own browser a download is stopped the moment it passes 50 MB or runs past five minutes, and when the run is cancelled, instead of first downloading all of it; Chromium's copy is deleted once the file was filed or refused. In your Chrome, a download is read only from Chrome's download folder (`~/Downloads`, or the browser setting `downloadsFolder`), never through a linked folder, a dot-folder or buddi's own data, and the file checked is the file read. A site an agent visited earlier no longer makes your own download from it look like the agent's: each agent action counts only its own sites, for its own 15 seconds.\n- Settings → Browser & apps → Downloads lists each file waiting there (name, agent, day) with File it, which puts it in your Files; Clear asks first and says these copies are not in Files.\n- Reading a long file no longer overflows the reply: `artifacts.text` returns at most 16 KB and says how much there was (\"16 KB of 35 KB; use artifacts.describe or the plugin's import tool\"), and agents are told that a statement or CSV goes to the owning plugin's import tool, not into their answer.\n\n- The chat sends files on their own: drop three statements, press Enter, and they go with no words needed. An empty box with nothing attached still sends nothing.\n- The chat takes files while the agent is working. They used to be refused (\"Send files once the agent has answered.\"); now they queue with the words, the agent picks them up at its next step, or they open the next turn when the answer is already being written. A file can also be sent on its own mid-run. The box says where it goes in a full sentence under itself, and the bubble reads \"Queued with 1 file\".\n- Plugin pages update when the plugin's own tools write: after the CFO records balances in chat, an open Money page shows them within a second instead of still saying \"Start with one account\"; a form you are filling in keeps what you typed. It works for every plugin, whether the agent ran in chat, on Telegram or in a mission."
   },
   "files": [
     "packages",