@withbuddi/buddi 0.1.0-pre.52 → 0.1.0-pre.54

package/node_modules/marked/man/marked.1

@@ -1,4 +1,4 @@
-.TH "MARKED" "1" "October 2026" "18.0.14"
+.TH "MARKED" "1" "October 2026" "18.1.0"
 .SH "NAME"
 \fBmarked\fR \- a javascript markdown parser
 .SH SYNOPSIS

package/node_modules/marked/package.json

@@ -2,7 +2,7 @@
   "name": "marked",
   "description": "A markdown parser built for speed",
   "author": "Christopher Jeffrey",
-  "version": "18.1.0",
+  "version": "18.1.1",
   "type": "module",
   "main": "./lib/marked.esm.js",
   "module": "./lib/marked.esm.js",

package/node_modules/process-warning/.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0
     with:
       license-check: true
       lint: true

package/node_modules/process-warning/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0

package/node_modules/process-warning/.github/workflows/release.yml

@@ -0,0 +1,24 @@
+name: Release the package
+
+on:
+  workflow_dispatch:
+    inputs:
+      semver:
+        description: 'Release bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      id-token: write # required for npm provenance via OIDC
+      contents: write # required to push the release commit and the tag
+    uses: fastify/workflows/.github/workflows/reusable-release.yml@b1a11bce713bc857e52b2231fec3c89071ad3135
+    with:
+      semver: ${{ inputs.semver }}

package/node_modules/process-warning/README.md

@@ -4,18 +4,18 @@
 [![NPM version](https://img.shields.io/npm/v/process-warning.svg?style=flat)](https://www.npmjs.com/package/process-warning)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
-A small utility for generating consistent [warning objects](https://nodejs.org/api/process.html#event-warning) across your codebase.
+A small utility for generating consistent [warning objects](https://nodejs.org/api/process.html#event-warning) across a codebase.
 It also exposes a utility for emitting those warnings, guaranteeing that they are issued only once (unless configured otherwise).
 
-_This module is used by the [Fastify](https://fastify.dev) framework and it was called `fastify-warning` prior to version 1.0.0._
+_This module is used by the [Fastify](https://fastify.dev) framework, and it was called `fastify-warning` prior to version 1.0.0._
 
-### Install
+## Install
 
 ```
 npm i process-warning
 ```
 
-### Usage
+## Usage
 
 The module exports two builder functions for creating warnings.
 
@@ -34,35 +34,34 @@ const warning = createWarning({
 const emitted = warning('world')
 ```
 
-#### Methods
+### Methods
 
-##### `createWarning({ name, code, message[, unlimited] })`
+#### `createWarning({name, code, message[, unlimited]})`
 
-- `name` (`string`, required) - The error name, you can access it later with
-`error.name`. For consistency, we recommend prefixing module error names
-with `{YourModule}Warning`
-- `code` (`string`, required) - The warning code, you can access it later with
-`error.code`. For consistency, we recommend prefixing plugin error codes with
-`{ThreeLetterModuleName}_`, e.g. `FST_`. NOTE: codes should be all uppercase.
-- `message` (`string`, required) - The warning message. You can also use
-interpolated strings for formatting the message.
+- `name` (`string`, required) - The error name, accessible through
+`error.name`. For consistency, prefix module error names with
+`{ModuleName}Warning`.
+- `code` (`string`, required) - The warning code, accessible through
+`error.code`. For consistency, prefix plugin error codes with
+`{ThreeLetterModuleName}_`, e.g. `FST_`. Note: Codes should be all uppercase.
+- `message` (`string`, required) - The warning message. Interpolated strings
+can also be used to format the message.
 - `options` (`object`, optional) - Optional options with the following
 properties:
   + `unlimited` (`boolean`, optional) - Should the warning be emitted more than
   once? Defaults to `false`.
 
-
-##### `createDeprecation({code, message[, options]})`
+#### `createDeprecation({ code, message[, options] })`
 
 This is a wrapper for `createWarning`. It is equivalent to invoking
-`createWarning` with the `name` parameter set to "DeprecationWarning".
+`createWarning` with the `name` parameter set to `"DeprecationWarning"`.
 
 Deprecation warnings have extended support for the Node.js CLI options:
 `--throw-deprecation`, `--no-deprecation`, and `--trace-deprecation`.
 
-##### `warning([, a [, b [, c]]])`
+#### `warning([, a [, b [, c]]])`
 
-The returned `warning` function can used for emitting warnings.
+The returned `warning` function can be used to emit warnings.
 A warning is guaranteed to be emitted at least once.
 
 - `[, a [, b [, c]]]` (`any`, optional) - Parameters for string interpolation.
@@ -73,14 +72,16 @@ const FST_ERROR_CODE = createWarning({ name: 'MyAppWarning', code: 'FST_ERROR_CO
 FST_ERROR_CODE()
 ```
 
-How to use an interpolated string:
+Using an interpolated string:
+
 ```js
 const { createWarning } = require('process-warning')
 const FST_ERROR_CODE = createWarning({ name: 'MyAppWarning', code: 'FST_ERROR_CODE', message: 'Hello %s'})
 FST_ERROR_CODE('world')
 ```
 
-The `warning` object has methods and properties for managing the warning's state. Useful for testing.
+The `warning` object has methods and properties for managing the warning's state. These are useful for testing.
+
 ```js
 const { createWarning } = require('process-warning')
 const FST_ERROR_CODE = createWarning({ name: 'MyAppWarning', code: 'FST_ERROR_CODE', message: 'Hello %s'})
@@ -90,20 +91,21 @@ console.log(FST_ERROR_CODE.emitted) // true
 
 const FST_ERROR_CODE_2 = createWarning('MyAppWarning', 'FST_ERROR_CODE_2', 'Hello %s')
 FST_ERROR_CODE_2.emitted = true
-FST_ERROR_CODE_2('world') // will not be emitted because it is not unlimited
+FST_ERROR_CODE_2('world') // Will not be emitted because it is not unlimited
 ```
 
-How to use an unlimited warning:
+Using an unlimited warning:
+
 ```js
 const { createWarning } = require('process-warning')
 const FST_ERROR_CODE = createWarning({ name: 'MyAppWarning', code: 'FST_ERROR_CODE', message: 'Hello %s', unlimited: true })
-FST_ERROR_CODE('world') // will be emitted
-FST_ERROR_CODE('world') // will be emitted again
+FST_ERROR_CODE('world') // Will be emitted
+FST_ERROR_CODE('world') // Will be emitted again
 ```
 
 #### `spyWarning(warning)`
 
-Spy the created warning function for testing purpose.
+Spy on the created warning function for testing purposes.
 
 ```js
 const { test } = require('node:test')
@@ -113,45 +115,43 @@ const FST_ERROR_CODE = createWarning({ name: 'MyAppWarning', code: 'FST_ERROR_CO
 test('spy warning', t => {
   const spyData = spyWarning(FST_ERROR_CODE)
 
-  // call after spy
+  // Call after spying
   const emitted = FST_ERROR_CODE('world')
   t.assert.strictEqual(emitted, true)
 
-  // restore the warning function
-  // it must be called when you do not need to spy anymore
-  // otherwise, the calls data will accumulates.
+  // Restore the warning function
+  // This must be called when spying is no longer required
+  // Otherwise, the call data will accumulate
   t.after(() => spyData.restore())
 
   t.assert.strictEqual(FST_ERROR_CODE.emitted, true)
-  // calls return the arguments and result.
-  // result indicate whether warning is emitted through process.emitWarning
+  // `calls` contains the arguments and results
+  // `result` indicates whether the warning was emitted through `process.emitWarning`
   console.log(spyData.calls) // [{ arguments: ['world'], result: true }]
   t.assert.deepStrictEqual(spyData.calls[0].arguments, ['world'])
-  t.assert.strictEqual(spyData.calls[0].result,  true)
-  // number of times called the function
+  t.assert.strictEqual(spyData.calls[0].result, true)
+  // Number of times the function was called
   console.log(spyData.callCount()) // 1
-  t.assert.strictEqual(spyData.callCount(),  1)
+  t.assert.strictEqual(spyData.callCount(), 1)
 
-  // reset the spy stat and warning state
+  // Reset the spy statistics and warning state
   spyData.reset()
   t.assert.strictEqual(FST_ERROR_CODE.emitted, false)
   t.assert.deepStrictEqual(spyData.calls, [])
-  t.assert.strictEqual(spyData.callCount(),  0)
+  t.assert.strictEqual(spyData.callCount(), 0)
 })
 ```
 
-#### Suppressing warnings
-
-It is possible to suppress warnings by utilizing one of node's built-in warning suppression mechanisms.
+### Suppressing warnings
 
-Warnings can be suppressed:
+Warnings can be suppressed by using one of Node.js's built-in warning suppression mechanisms:
 
-- by setting the `NODE_NO_WARNINGS` environment variable to `1`
-- by passing the `--no-warnings` flag to the node process
-- by setting '--no-warnings' in the `NODE_OPTIONS` environment variable
+- Setting the `NODE_NO_WARNINGS` environment variable to `1`
+- Passing the `--no-warnings` flag to the Node.js process
+- Setting `--no-warnings` in the `NODE_OPTIONS` environment variable
 
-For more information see [node's documentation](https://nodejs.org/api/cli.html).
+For more information, see the [Node.js documentation](https://nodejs.org/api/cli.html).
 
 ## License
 
-Licensed under [MIT](./LICENSE).
+Licensed under [MIT](./LICENSE).

package/node_modules/process-warning/package.json

@@ -1,6 +1,6 @@
 {
   "name": "process-warning",
-  "version": "5.1.0",
+  "version": "5.1.1",
   "description": "A small utility for creating warnings and emitting them.",
   "main": "index.js",
   "type": "commonjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withbuddi/buddi",
-  "version": "0.1.0-pre.52",
+  "version": "0.1.0-pre.54",
   "type": "module",
   "description": "Your personal agents, on your computer",
   "repository": {
@@ -17,7 +17,7 @@
     "buddi": "packages/install/dist/launcher.js"
   },
   "buddi": {
-    "notes": "### Added\n\n- Secrets in the sign-in flow, in place: an agent on a sign-in form with nothing saved for the site calls `secret.request` and a card in the chat asks for the fields it saw (username, password), with the site as a chip. Save and fill saves them for that site and fills the form at once, one approval for the set; Save only saves and hands you the page; I'll sign in myself hands it over; More options opens a sheet beside the page with a code field and more fields. The agent hears only the names saved and whether the form was filled. The thread says \"Filled username and password on wikipedia.org\", and Keys and secrets links each saved secret back to its conversation. On Telegram the card says to open the dashboard, with Decline. `POST /api/secrets` saves a set for one site in one call; `POST /api/secrets/request/decline`.\n- Capture on the Page tab's window bar: a full-resolution PNG of the page as it is now (password fields masked), whoever holds it, saved to Files under the page's title and the time, with Open in Files. `POST /api/browser/capture`.\n- A page in your Chrome is live on the Canvas: the extension paints the agent's background tab (focus emulated, so a hidden tab paints) two frames a second while the agent works, and Take over is the remote hand there as in buddi's own browser, from your phone or any other device: the picture at the link's quality (sharp, normal, fast), clicks, wheel, keys, paste, copy (never a password field) and the window's back, forward, reload and address. **Bring the tab to the front** is the secondary action in the bar for when you are at the computer (`POST /api/browser/front`), and Capture works there too. Chrome's \"buddi started debugging this browser\" bar shows while a page is open; it goes when the page closes or you close the tab. Frames cross the extension socket as binary messages.\n- One extension, several buddis: the popup lists every buddi this Chrome works for, each with its name (from its handshake: `buddi`, `buddi-dev`), address, colour, state and a switch, plus **Add a buddi** and **Remove** per row. Each buddi has its own socket, pairing code and tab groups, named after it in its colour, and a tab belongs to exactly one of them. An existing pairing becomes the first buddi, switched on. A buddi that answers and turns this browser away (paired with another copy of the extension) says so instead of *did not answer*, and is not retried until you press Try again; a token it no longer takes is dropped for a fresh code; retries back off to 30 seconds and the popup no longer flickers; a buddi from before this release connects and says *older buddi: live view off*. Settings → Browser & apps says *paired with this buddi and 1 other* instead of asking to re-point the extension, and *off in Chrome* for a buddi switched off there.\n\n### Changed\n\n- A `secret.fill` for a site with nothing saved now tells the agent to ask with the sign-in card (`secret.request`) instead of asking you in chat where the password is; a set of secrets saved together asks once for the set the first time an agent fills it there, not once per field.\n- The Canvas no longer takes the screen from a live page. While an agent has a page open in the conversation the Page tab stays in front: results open behind it with a quiet dot that clears when you open them, and only the agent's own `canvas.show` brings something forward (on a phone the sheet behaves as before). Only results with a view open a tab at all (tables, lists, charts, stories, documents, diffs, pictures, audio, previews, terminal output, a structured result with real content); a browser step, a `secret.*` fill or list, a `mission.*` report and `owner.notify` stay in their chat row, which still opens them on the canvas. When you start a new turn, the previous turn's tabs fold into the **N more** menu unless you opened them yourself.\n- The live picture of a page you hold gets sharp on a link that keeps up: after a few seconds of frames going out promptly it grows to the page's own size (up to 1440×900) at JPEG quality 70, and steps back down on lag, waiting longer each time before trying again. The window bar says *sharp* or *fast*.\n\n### Fixed\n\n- Save and fill no longer types a password into the wrong element: fields are filled by their label on the latest page (Wikipedia's login redraws after the first fill and its refs land on the Appearance radios), a ref that names a radio, checkbox or button is refused before anything is entered, and the agent is told to observe once and fill again by label before asking you; afterwards it presses the form's sign-in button itself.\n- A login wall in buddi's browser now raises the sign-in card (the fields in the card, Save and fill, with Use my Chrome beside it when that route exists) instead of the old card whose \"Save a login for next time\" sent you to Settings; a code page's card opens the sign-in card in place. A tool call the turn never ran because it stopped on a card first reads \"not run\" instead of failed.\n- Give it back starts a turn only when an agent was waiting on the page (its card was answered with Take over, the take-over interrupted it, or it tried to act while you held the page). A page taken from an idle conversation is given back with the \"Gave the page back\" stamp and no model call.\n- Take over and Give it back no longer flash or take the page back by themselves: the Page tab ignores a status still in flight for a page it just gave back or stopped, keeps its buttons asleep until the status after the action has arrived, and keeps showing the last picture the hand drew instead of an empty frame.\n- Scrolling a page you hold no longer shakes: the wheel goes to the host once per animation frame with its deltas summed, frames are drawn in the order they came (an older one finishing its decode late is dropped), a frame that only scrolls back against your gesture waits until the gesture ends, and the dashboard no longer scrolls under the picture.\n- Cmd/Ctrl+C and Cmd/Ctrl+V work on a page you hold. Copy puts the host page's selection (or the focused field's, never a password field's) on your own clipboard instead of the headless browser's; paste fires again on macOS Chrome, where the shortcut's keydown was being cancelled before the browser could paste.\n- A question can always be answered from the chat: it now stands above any approval waiting there instead of behind it, and an approval decided elsewhere, expired, or an owner secret's use that went through (`secret.fill`) leaves the dock instead of hiding the question and the composer behind a card that drew nothing."
+    "notes": "### Added\n\n- Windows (for testing, not public yet): `npm install -g @withbuddi/buddi` then `buddi` runs on Windows 10/11 x64, and on Windows on Arm with the x64 build of Node. The embedded Postgres runs there (initdb, start and a clean `pg_ctl` stop; a missing Visual C++ runtime is named with its download link), secrets live in the file vault, and the service is a Task Scheduler task of your own (no administrator), started at once and at every sign-in with no console window. The supervisor answers on a named pipe instead of a Unix socket; `buddi` and `buddi dashboard` open the link in your default browser; `buddi service logs` follows the logs with PowerShell; `buddi uninstall` removes the task and stops the supervisor and its database cleanly; `buddi upgrade` recognises npm's global tree on Windows. Not there yet on Windows: remote access through a Cloudflare tunnel, MCP programs run on this computer, skill bundle scripts, and Codex sign-ins handed to a plugin's native program (the image plugin). npm must sit beside node (Node's installer or zip, nvm-windows; Volta and Scoop shims are named, not used).\n- Windows setup (for testing, not public yet): `buddi-<version>-windows-x64-setup.exe`, one download that installs buddi for you with no administrator, no Node and no terminal, on Windows 10/11 x64 and Windows on Arm. It carries the Node buddi.app pins with npm beside it, the npm release with its embedded Postgres, and the Visual C++ runtime Postgres needs, copied beside the Postgres binaries (no redistributable to install). It lays buddi out as the Linux install does (`%LOCALAPPDATA%\\buddi\\node` and `releases\\current`, a junction), puts `buddi` on your PATH for Command Prompt and PowerShell (a `buddi.cmd`), adds buddi to the Start menu (it opens the dashboard with no console window), starts buddi and its sign-in task and opens the welcome page. Running a newer setup upgrades the same folder with a backup first, and puts everything back (files, links, command, state, the buddi that ran before) if anything fails or the new version does not start; an npm install serving the same data moves over, and the npm copy is removed only when no other buddi on the computer runs it. Run as administrator, the setup says to run it normally (Postgres refuses administrator rights). Updates from the dashboard and `buddi upgrade` go into `releases\\` as on Linux. Removing buddi in Settings → Apps runs `buddi uninstall` (one last backup with its passphrase kept in `buddi-backups`, then the task, the data and the secrets), and `buddi uninstall` removes the Apps entry too. The release workflow builds, smoke-installs and attaches the setup and the zip it is made from, with their sha256; unsigned for now.\n- Windows desktop app (for testing, not public yet): the Windows setup now carries buddi's window, the same app as on Linux on WebView2. The Start menu's buddi opens it on the dashboard instead of the browser; its tray icon (left click: the window; right click: the menu) has Check for Updates, the previous version, Restart, Stop/Start, Lock, Start at Login (a Run entry of its own, on at first start, changed and removed only when it is the one it wrote), About and Uninstall; the microphone is granted to the dashboard's own address only, notifications are Windows toasts, sign-in pages open in your default browser, and nothing it starts opens a console window. It talks to buddi's supervisor on its named pipe and believes only answers carrying that start's secret. A newer setup quits and restarts it; uninstalling removes it with its data. On Windows 10 without WebView2, the setup installs it.\n\n### Fixed\n\n- Reinstalling after removing buddi with \"Keep my data for a reinstall\" works: the Windows setup and the Linux install.sh used to refuse that data (no buddi left to back it up first) unless told to skip the backup. They now recognise data an uninstall kept (it leaves `kept-for-reinstall.json`; older ones are recognised by their shape), say plainly that no new backup is taken and where the last one is, leave the data folder as it is, and start buddi on it, on the dashboard with everything as it was. A data folder nothing kept still asks for the backup to be skipped explicitly. buddi.app on a Mac already started on kept data. On Windows the removal with \"Keep my data\" now finishes too: the setup's uninstaller used to stop at the kept data (program files missing), leaving buddi in Apps & Features and the desktop app on \"Removing buddi…\"; the app now ends on a page that says where the data and its last backup are kept.\n- On Windows, removing buddi no longer flashes a console window (\"ping -n 6 127.0.0.1\"): the copy of node the removal ran from is now really cleaned up (it stayed in TEMP), by a small script under wscript that tries every half second for up to a minute, with no window at all.\n- `buddi` (and the desktop app) no longer tries to restart a supervisor that is still starting: right after sign-in, while the service brought up its database and migrations, a `buddi` command found the lock held but no answer yet, took it for a dead service and failed with \"The running service could not be stopped to restart it\" (seen on Windows as an 18-second \"buddi needs attention\" in the desktop app after a restart). It now waits for that supervisor to answer, up to ninety seconds, and if it never does says so instead of starting another. The supervisor's lock also records the system's id for the boot it was taken in (`supervisor.boot` beside it; Windows' BootId, Linux's boot_id, macOS's boot session), so a lock left by a computer that restarted is stale at once even when Windows has given its pid to another program; a clock change never makes a live lock look stale.\n- In the desktop app (Linux, Windows): Settings → System no longer suggests installing the dashboard as an app from Edge; removing buddi lists the desktop app among what goes on Windows (and says how to remove the package on Linux); the app stops reconnecting once the removal is confirmed, says \"Removing buddi…\", then, once buddi is gone, keeps a last page with where the backup and its passphrase are until you close it, and never sets buddi up again under a removal started from a terminal. A silent uninstall from the setup's uninstaller writes what the removal said (where the backup is, its passphrase) into buddi-backups. On Windows its tray icon is the full-colour Blob, sharp at every display scale, grey while buddi starts or is stopped and with an amber dot when it needs attention; on Linux the glyph follows KDE's colour scheme as it changes.\n- On Windows, agents run commands on this computer (`host.exec`) in Windows PowerShell 5.1, with the same approvals as on macOS and Linux, no console window, and the command's whole process tree ended on a timeout, a stop or the output cap (and with the command, through a job object); before, the approval card was raised and the run then failed. Skill bundle scripts say they do not run on Windows yet and agents there are no longer told they can run them; `system.info` names Windows 11 by its build (\"Windows 11 Pro 24H2 (build 26100)\", not 10.0.26100) and says which shell host commands use. `artifacts.write` says plainly that Files is buddi's own storage, not the computer's desktop, and that the owner downloads Word or PDF there, so agents stop offering to convert with pandoc.\n- buddi names the browser you actually use instead of always saying Chrome: \"your Edge\" on Edge (also Brave, Opera, Vivaldi, Arc; \"your browser\" when it cannot tell), on Settings → Browser & apps, the chat's Use my … chip, the browser cards and notes, Missions and the Canvas. The extension tells buddi which browser it runs in when it connects (with the next Chrome Web Store update; an older extension or buddi simply leaves it out), and on Edge the store button reads \"Get the buddi extension (Chrome Web Store, works in Edge)\".\n\n…"
   },
   "files": [
     "packages",