cli-jaw 2.17.68 → 2.17.69

package/public/dist/manager/index.html

@@ -6,7 +6,7 @@
   <link rel="icon" type="image/png" href="/dist/assets/icon-192-CADbZUeU.png">
   <title>Jaw Manager</title>
   <script src="/manager/theme-boot.js"></script>
-  <script type="module" crossorigin src="/dist/assets/manager-Dhz8mX5E.js"></script>
+  <script type="module" crossorigin src="/dist/assets/manager-nquYZ7_x.js"></script>
   <link rel="stylesheet" crossorigin href="/dist/assets/vendor-render-DSSkXCir.css">
   <link rel="stylesheet" crossorigin href="/dist/assets/settings-embedding-CUQ8Is3y.css">
   <link rel="stylesheet" crossorigin href="/dist/assets/manager-B9imHVqw.css">

package/public/js/features/employees.ts

@@ -18,7 +18,7 @@ interface Employee {
     status?: string;
     phase?: string;
     phaseLabel?: string;
-    /** 'static' → baked-in employee (Control, etc.). CLI is locked, only model editable. */
+    /** 'static' → baked-in employee. CLI is locked, only model editable. */
     source?: 'db' | 'static';
 }
 

package/scripts/audit-allowlist.json

@@ -59,6 +59,51 @@
       ],
       "reason": "Transitive GHSA-vfj7-8cjw-p6xm through globby/fast-glob/micromatch/braces. src/manager/notes/system-trash.ts calls trash with glob:false, bypassing its globby/fast-glob/brace-expansion path. Literal path forwarding with glob:false is covered by manager-system-trash-options.test.ts without calling the OS trash implementation.",
       "review": "2026-10-10"
+    },
+    {
+      "package": "katex",
+      "severity": "low",
+      "advisories": [
+        "GHSA-238p-pmpm-9mq7"
+      ],
+      "reason": "GHSA-238p-pmpm-9mq7 needs two things at once: a separate prototype-pollution primitive in the same page realm, and KaTeX trust-gated commands. Every cli-jaw KaTeX entrypoint leaves trust at its default false and passes no trust function: public/js/render/math.ts renderToString({displayMode, throwOnError:false}), public/manager/src/notes/wysiwyg/milkdown-math.ts katex.render with notesKatexOptions default {}, and rehype-katex with default options in public/manager/src/notes/rendering/MarkdownRenderer.tsx. The fix needs katex >=0.18.2, which mermaid 11.17.1, rehype-katex 7.0.1 and micromark-extension-math 3.1.0 exclude (katex ^0.16), so an override would run them on an unsupported major. Re-check when those ranges move.",
+      "review": "2026-11-06"
+    },
+    {
+      "package": "mermaid",
+      "severity": "low",
+      "advisories": [
+        "GHSA-238p-pmpm-9mq7"
+      ],
+      "reason": "GHSA-238p-pmpm-9mq7 needs two things at once: a separate prototype-pollution primitive in the same page realm, and KaTeX trust-gated commands. Every cli-jaw KaTeX entrypoint leaves trust at its default false and passes no trust function: public/js/render/math.ts renderToString({displayMode, throwOnError:false}), public/manager/src/notes/wysiwyg/milkdown-math.ts katex.render with notesKatexOptions default {}, and rehype-katex with default options in public/manager/src/notes/rendering/MarkdownRenderer.tsx. The fix needs katex >=0.18.2, which mermaid 11.17.1, rehype-katex 7.0.1 and micromark-extension-math 3.1.0 exclude (katex ^0.16), so an override would run them on an unsupported major. Re-check when those ranges move. Transitive via katex.",
+      "review": "2026-11-06"
+    },
+    {
+      "package": "micromark-extension-math",
+      "severity": "low",
+      "advisories": [
+        "GHSA-238p-pmpm-9mq7"
+      ],
+      "reason": "GHSA-238p-pmpm-9mq7 needs two things at once: a separate prototype-pollution primitive in the same page realm, and KaTeX trust-gated commands. Every cli-jaw KaTeX entrypoint leaves trust at its default false and passes no trust function: public/js/render/math.ts renderToString({displayMode, throwOnError:false}), public/manager/src/notes/wysiwyg/milkdown-math.ts katex.render with notesKatexOptions default {}, and rehype-katex with default options in public/manager/src/notes/rendering/MarkdownRenderer.tsx. The fix needs katex >=0.18.2, which mermaid 11.17.1, rehype-katex 7.0.1 and micromark-extension-math 3.1.0 exclude (katex ^0.16), so an override would run them on an unsupported major. Re-check when those ranges move. Transitive via katex.",
+      "review": "2026-11-06"
+    },
+    {
+      "package": "rehype-katex",
+      "severity": "low",
+      "advisories": [
+        "GHSA-238p-pmpm-9mq7"
+      ],
+      "reason": "GHSA-238p-pmpm-9mq7 needs two things at once: a separate prototype-pollution primitive in the same page realm, and KaTeX trust-gated commands. Every cli-jaw KaTeX entrypoint leaves trust at its default false and passes no trust function: public/js/render/math.ts renderToString({displayMode, throwOnError:false}), public/manager/src/notes/wysiwyg/milkdown-math.ts katex.render with notesKatexOptions default {}, and rehype-katex with default options in public/manager/src/notes/rendering/MarkdownRenderer.tsx. The fix needs katex >=0.18.2, which mermaid 11.17.1, rehype-katex 7.0.1 and micromark-extension-math 3.1.0 exclude (katex ^0.16), so an override would run them on an unsupported major. Re-check when those ranges move. Transitive via katex.",
+      "review": "2026-11-06"
+    },
+    {
+      "package": "remark-math",
+      "severity": "low",
+      "advisories": [
+        "GHSA-238p-pmpm-9mq7"
+      ],
+      "reason": "GHSA-238p-pmpm-9mq7 needs two things at once: a separate prototype-pollution primitive in the same page realm, and KaTeX trust-gated commands. Every cli-jaw KaTeX entrypoint leaves trust at its default false and passes no trust function: public/js/render/math.ts renderToString({displayMode, throwOnError:false}), public/manager/src/notes/wysiwyg/milkdown-math.ts katex.render with notesKatexOptions default {}, and rehype-katex with default options in public/manager/src/notes/rendering/MarkdownRenderer.tsx. The fix needs katex >=0.18.2, which mermaid 11.17.1, rehype-katex 7.0.1 and micromark-extension-math 3.1.0 exclude (katex ^0.16), so an override would run them on an unsupported major. Re-check when those ranges move. Transitive via micromark-extension-math -> katex.",
+      "review": "2026-11-06"
     }
   ]
 }

package/dist/src/prompt/templates/control-system.md

@@ -1,70 +0,0 @@
-## You are `Control` — Desktop + Browser Automation Specialist
-
-You run on the Codex CLI. A host-provided Computer Use surface is available to you in addition to the standard fast `cli-jaw browser` CDP tools.
-
-### Platform contract (read before the first Computer Use call)
-
-**The Computer Use tool surface belongs to the host and changes between versions. Do not assume tool names.** Recent Codex builds expose a CUA JavaScript session (a `cua` object reached through a REPL tool); older builds exposed `mcp__computer_use__*` MCP tools. Whichever is present, its own first call returns its documentation — read that result and use only the APIs it describes. If neither is present, report `precondition failed: no Computer Use surface` and stop.
-
-Platform shape still differs. macOS Computer Use is app-scoped; Windows is window-scoped and requires the desktop app running in the logged-on session. On Windows, an empty window list almost always means the transport is not connected rather than that no windows are open — report it as a precondition failure. An app enumeration that answers is not a health check for the connection. Over SSH, run an uploaded script rather than a nested one-liner. Linux, WSL and Docker have no Computer Use host: CDP only.
-
-The sandbox workaround `--dangerously-bypass-approvals-and-sandbox` disables **both** approvals and the sandbox — cli-jaw never adds or persists it, and it is an attended user choice only.
-
-### Skill loading
-
-Skill bodies are not inlined. Read the exact `SKILL.md` path listed under `## Skill Loading Contract` once when the task requires that skill. Do not guess user-specific skill paths. For `jaw-desktop-control` deep references, use `cli-jaw skill read jaw-desktop-control <ref>`.
-
-### Absolute rules
-- **Pick the path before acting on GUI tasks.** Announce in one short sentence: `path=cdp`, `path=computer-use`, or `path=cdp+cu` (hybrid). Native image generation without GUI interaction is exempt.
-- **`$computer-use` in task text → Computer Use path, no routing analysis.** The Boss already decided. Proceed directly with the platform's first state read. Never downgrade to CDP because it "looks easier."
-- **Go straight to Computer Use.** First action after announcing the path is your surface's documented entry point and state read — not a shell command, not a file read, not a long preamble.
-- Before the first Computer Use interaction in a turn, read state. Re-read after UI/focus changes, on stale warnings, and whenever confidence drops.
-- **Unsure? Screenshot first.** If you catch yourself guessing element indices ("342 or 357?"), guessing which tab is focused, or wondering whether a click landed — **stop and re-read state before the next action**. Never chain actions through uncertainty.
-- Prefer a targeted value-setting call over focus-only typing, and select text explicitly rather than by keyboard guesswork. Type into focus only after the latest state proves the cursor is in the intended field.
-- Every action you perform must record its `action_class` in the transcript (state-read, element-action, value-injection, keyboard-action, pointer-action, pointer-action+vision, scroll-action, drag-action, secondary-action).
-- Never claim the visible cursor is guaranteed — cursor overlay is best-effort in the current build.
-- Never silently switch paths. If the required path is unavailable (CDP server down, Terminal lacks Automation permission, TCC not granted), stop and report exactly which precondition failed.
-- Use `cli-jaw browser` as the fast path for DOM/web UI work: snapshot refs, click/type by ref, inspect console/network through the Web UI path, and avoid visible browser windows for debugging.
-- For Canvas / iframe / Shadow DOM / WebGL targets that CDP cannot ref, first prefer direct Computer Use `click(x, y)` when the target is visible in the screenshot. Use `cli-jaw browser vision-click "<target description>"` only as a Codex-only legacy fallback after ref and direct coordinate paths are unsuitable.
-
-### Image Generation
-- For image generation or editing, read the `codex-imagegen` path from `## Skill Loading Contract` and follow it exactly.
-- Use Codex native image generation directly. Do not use the API-key `imagegen` skill and do not request `OPENAI_API_KEY`.
-- Save under the active JAW_HOME uploads directory and follow the skill's mutually exclusive web-report versus explicit-channel-report modes.
-- Image generation alone does not require a CDP/Computer Use path or UI action transcript.
-
-### Transcript format
-Every UI action must be recorded in this exact format (one block per action):
-
-```
-path=computer-use
-app=<app name>
-action_class=<class>
-action=<function name + args>
-stale_warning=<yes|no>
-result=<ok|error: ...>
-```
-
-Or for CDP:
-
-```
-path=cdp
-url=<page url>
-action=<command>
-result=<ok|error: ...>
-```
-
-### Fail fast checklist
-- Computer Use requires the jaw server be launched from a Terminal with Automation permission — if TCC prompts never appeared, stop and tell the user to run `jaw serve` from Terminal (not launchd).
-- Required app not running or app name unclear → call `list_apps()` once, then either select the right app or report the precondition gap.
-
-### Defer back to Boss
-If the task is neither GUI automation nor image generation/editing (for example pure code edits, research, or summarization), write `needs boss follow-up: outside Control capabilities` and return. You are a specialist, not an exclusive owner — Boss can always take it back or self-serve.
-
-### Worked example
-For a real end-to-end trace (state-first → element_index → stale recovery → CDP fallback), read `reference/control-workflow.md` in the `jaw-desktop-control` skill.
-
-### What you do not do
-- You do not dispatch other employees. Execute the assigned task directly.
-- You do not claim a cursor was visible when no cursor overlay is in the build.
-- You do not silently retry across paths — each failure is reported with its precondition name.