haltija 1.12.1 → 1.12.5

package/CHANGELOG.md

@@ -1,5 +1,226 @@
 # Changelog
 
+## 1.12.5
+
+**Installing this delivers 1.12.3 and 1.12.4 as well** — both were tagged but never published, so
+npm went straight from 1.12.2 to here. Their entries below still describe what they contained.
+
+### Embedding on an HTTPS dev server no longer fails silently ([#33](https://github.com/tonioloewald/haltija/issues/33))
+
+An `https://` page cannot load an `http://` script: the browser blocks it as **mixed content** and
+reports nothing that names the cause. You get no widget, `hj where` says `0 tabs`, and the natural
+conclusion is that your own setup is wrong. The reporter worked it out from `--help` and source.
+
+This is not an edge case — the tosijs-ui doc-system dev server is HTTPS by default (`bun run tls`),
+so the default project setup hits it on the first attempt.
+
+A static `src` cannot branch on the page's scheme, so the canonical embed snippet is now a
+three-line loader that picks the matching transport, with the plain tag kept below as the equivalent
+for HTTP pages. Serving an HTTPS page also needs `bunx haltija --server --both` and accepting the
+self-signed cert once at `https://localhost:8701`.
+
+Same root cause as [#32](https://github.com/tonioloewald/haltija/issues/32) from the other end:
+there, a shared HTTP-only server silently denied another project's HTTPS pages; here, an HTTPS page
+silently cannot reach an HTTP server. **Opening both transports by default would remove the class
+rather than documenting it**, which is why that remains the top of the queue rather than something
+more prose can fix.
+
+## 1.12.4
+
+Backlog work done while releases were paused. **Includes everything in 1.12.3**, which was tagged
+but never published — installing 1.12.4 gets both.
+
+### Three bugs found by closing a coverage hole
+
+**Ten of seventeen step actions had no executable coverage in any lane** — including the
+deprecated-alias branch and the `select-text` dispatch that shipped in 1.12.3. Nothing was red; the
+lanes simply never ran those paths, and the failure mode there is a *silent success*. There is now a
+blocking suite that asserts an **observable effect** per action (a checkbox actually checked, a
+keydown that actually arrived), and it found:
+
+- **`hj drag` does nothing to a native `<input type=range>` and reported success.** Measured: a 60px
+  drag leaves a native range at 0 while moving a custom div thumb 0 → 60px. Browsers drive native
+  controls from *trusted* input only; a custom implementation listens for `mousemove` on `document`,
+  which is why MUI sliders, resize handles and reorder lists are unaffected. `/drag` now returns a
+  warning naming the cause and the way round it.
+- **`hj test validate` accepted an `assert` step with no `assertion` object** — the shape our own
+  `CLAUDE.md` documented. Such a step never checks anything: a guard that cannot fail.
+- **`tests/haltija.test.ts` reported 11 passes for work it never did.** With no server it early-returned
+  from each test body, and bun records that as PASSED. Now 0 pass / 11 skip.
+
+### The MCP server has been shipping 43 of 63 endpoints since January
+
+`apps/mcp/build/endpoints.json` — what the committed MCP server imports at runtime — had drifted
+seven months behind. Anyone on the MCP path had no `/map`, `/find`, `/wait`, `/key`, `/call`,
+`/form`, `/fetch`, `/select`, `/recording`, `/test/suite`, or the `/network`, `/video` and `/dialog`
+families. Twenty endpoints.
+
+`docs-drift` could not catch it, and that is the lesson: the gate asserts a build leaves the tree
+clean, and **nothing in the build wrote that file**. A drift gate only covers what the build
+produces. Now it writes it, with a test asserting the runtime copy matches the generated one.
+
+Also fixed: `hj --setup-mcp` pointed at `node_modules/tosijs-dev/…` in two of three lookups, a
+package name that changed long ago. (`apps/mcp` is still not in the npm `files` list — that is a
+packaging decision, deliberately left rather than guessed at.)
+
+### `hj where` says which transports are open — and why one is not ([#32](https://github.com/tonioloewald/haltija/issues/32))
+
+```
+transports: http 8700 ✓   https 8701 ✗ (no certs in <path>)
+```
+
+The channel is shared across projects, so **one project's transport choice is paid for by another**:
+an instance that came up HTTP-only leaves every `https` page with nothing to import, because mixed
+content blocks the fallback. The reporter's doc site had no haltija at all while `hj where` said
+"haltija 1.12.2, 1 tab" and everything looked healthy. A half-open channel and a full one were
+indistinguishable from outside; now the reason is named (`not requested`, `no certs at <path>`, or
+`port N is held`). A `--private` instance reports transports but not the cross-project warning — it
+is isolated by construction and denies nobody.
+
+Opening both transports by default (the other half of that issue) needs a release to exercise and is
+queued rather than rushed.
+
+### Also
+
+- Four stale copies folded in, including a **fourth** hand-maintained step list in `api-schema.ts`
+  that had drifted to 8 of 17 and propagated to `API.md` and the MCP definitions.
+- `CLAUDE.md`'s test-JSON example used the flat `assert` shape the runner ignores.
+
+## 1.12.3
+
+Documentation-drift machinery, a measured rename, and the six blockers a nine-lens review raised
+against all of it. **Known open:** [#26](https://github.com/tonioloewald/haltija/issues/26) (a tab
+becoming permanently undrivable — observed, not reproducible on any version) and
+[#16](https://github.com/tonioloewald/haltija/issues/16) (native tosiAgent bridge, on hold).
+
+**Recorded suites now use `select-text`, which servers before 1.12.3 reject.** If you record on an
+updated machine and run against a pinned older haltija, that step fails with `unknown step action`.
+The paved CI path (`bunx haltija@latest`) is unaffected.
+
+
+### `select` is now `select-text` — and `select` is being freed
+
+Measured, not argued. Shown the bare step vocabulary with no descriptions, **3/3 agents reached for
+`select` to choose an option from a dropdown, and 3/3 read it cold as "choose an `<option>`".
+Nobody read it as text selection** — which is what it does. A name that unanimously means something
+else to competent readers is not a documentation problem.
+
+`select-text` says what it does. **`select` still works** as a deprecated alias, so existing suites
+keep running; steps using it now carry a `warning` naming the replacement, rendered in the test
+report rather than only present in `--json`.
+
+The recorder also stopped emitting two illegal steps it had emitted since long before this release:
+`set` (not a step action at all — recorded suites died with "Unsupported step action: set") and
+`select` for **dropdowns**, which resolved to `select-text` and dispatched a text-selection event at
+the `<select>`, passing while choosing nothing. Both now record an explicit `eval` that works, and a
+test asserts every action the recorder can emit is legal and non-deprecated.
+
+The point of the deprecation is the reuse: once the alias can be dropped, `select` is free to mean
+what everyone already expects — pick an option from a `<select>` — which haltija cannot do at all
+today. A test enforces that the two meanings can never overlap (`no alias may shadow a live
+action`), because a word meaning two things depending on vintage is exactly the silent-wrong-action
+trap the rename exists to remove.
+
+**Correction, and it matters more than the rename.** An earlier draft of these notes acquitted
+`check`, `verify` and `tabs-focus` as "measured and fine". That was wrong: the harness spawned each
+agent **in this repo**, so every "first impression" had our own `CLAUDE.md` — which documents the
+vocabulary under test — in context. Re-run from a neutral directory, `check` is cold-read as
+*"asserts that some condition is true"* by **3/3** (the exact confusion it was cleared of), and
+`verify` slips to 2/3. What survives is narrower and honest: with the full vocabulary in view agents
+still pick `assert` for assertions and `check` for checkboxes, so `check` is safe **in context** and
+misleading **in isolation**. `tabs-focus` holds at 3/3.
+
+The `select` verdict is unaffected — contamination ran in its favour and it still lost 3/3, and the
+clean re-run agrees. The probe now runs each sample in an empty temp directory, and its vocabularies
+are derived from the registries rather than hand-copied (the old copy still listed `select`, stale
+as of the commit it motivated). Harness: `tools/naming-probe.mjs`, run with bun.
+
+## 1.12.2
+
+Two fixes, both from an agent driving real apps. Each is a case where haltija reported success — or
+green health — while quietly producing something you couldn't trust, which is the same thread the
+1.12.x line has been pulling on throughout.
+
+**[#26](https://github.com/tonioloewald/haltija/issues/26) remains open and is NOT a 1.12.0
+regression.** The reporter's own control run settled it: the known-bad version survived the original
+failing surface through seven hard navigations plus an HMR rebuild. A tab becoming permanently
+undrivable was really observed, so the issue stays open as a standing record — but neither of us can
+currently reproduce it on any version, and nothing here claims to fix it.
+
+
+### `--private` instances get their own Electron profile — [#31](https://github.com/tonioloewald/haltija/issues/31)
+
+Private mode isolated ports, the registry, retirement and teardown — but **not the Electron
+profile**, so every instance ran with the same `--user-data-dir`. Chromium's single-instance locking
+means the second one to launch can't take the profile lock and falls back to caches it cannot
+persist, losing the HTTP cache and the V8 code cache. A large app bundle is then fully re-parsed on
+every navigation: **roughly 10x slower page boots**.
+
+The damage isn't the slowness, it's that it **lies in the one workflow private mode exists for**.
+Comparing two versions side by side, the failure followed **launch order, not version** — 22.1s vs
+2.04s, the same version passing or failing depending only on which started first, and each fine
+alone. The reporter nearly wrote up a version regression that did not exist. Every health signal
+read green throughout, including `hj doctor` and a measured 120fps rAF cadence, because nothing was
+broken — it was just slow.
+
+Each private instance now gets `<tmpdir>/haltija-private-<pid>` as its `userData` and `sessionData`,
+set before `app.whenReady()` and before anything reads `preferences.json`.
+
+Two related leaks closed at the same time, both cases of "private" having meant *private ports*
+rather than *touches nothing of yours*:
+
+- **A private run no longer writes `~/.haltija/last-quit`.** That marker tells `hj`'s auto-launch the
+  user deliberately quit, so an automated run ending was suppressing auto-launch for the interactive
+  app a developer was using.
+- **Stale private scratch is swept** at the start of the next private run — profiles and the
+  port-files the launcher writes (175 had accumulated on one machine). Swept at startup rather than
+  on exit because Chromium flushes its caches *after* `will-quit`, so deleting the profile there
+  just gets it recreated. The sweep keys on whether the owning pid is still alive and **never
+  touches a live peer** — `EPERM` from `kill(pid, 0)` counts as alive, since the process exists and
+  merely belongs to someone else. That decision is a tested function (`src/private-state.ts`), not a
+  loop in the launcher, because deleting a running instance's profile would be far worse than the
+  litter it tidies.
+
+### The test-suite runner gains `drag`, and a `wait` can no longer pass without waiting — [#30](https://github.com/tonioloewald/haltija/issues/30)
+
+**`drag` is now a step action.** `hj drag` and `POST /drag` had shipped for releases; the runner's
+dispatcher simply had no case, so a perfectly reasonable suite failed with `Unsupported step action:
+drag`. Sliders, resize handles and drag-reorder lists are exactly the interactions you cannot cover
+another way — a synthetic keydown on a slider thumb is not a faithful substitute.
+
+The routine now lives in `src/drag.ts` and both `/drag` and the runner call it. Dragging is not one
+message to the widget (scroll into view → measure → mouseenter/over/move → mousedown → N
+interpolated mousemoves → mouseup), and a second copy in the runner's switch would have been the
+fifth instance this cycle of one idea with two implementations.
+
+**A `wait` step with nothing to wait for was reported as PASSING.** `{"action": "wait",
+"forElement": "tbody tr", "timeout": 10000}` fell out of the runner's chain to `break`, and since a
+step passes by default it looked green — so a guard that had never waited for anything let every
+assertion after it race the page. Two fixes: `forElement` is now accepted as an alias of `selector`
+(the name `/wait` uses, and the name **our own SKILL.md example used**, which means the documented
+example never waited), and a `wait` carrying none of `duration`/`ms`/`selector`/`forElement`/
+`forWindow`/`url` is now an **error**.
+
+This is the same defect as the CLI's `hj wait --hidden`, fixed in 1.12.0 — that fix landed in the
+CLI and never reached the runner.
+
+**`hj test validate` now rejects illegal steps before the suite runs**, with a "did you mean":
+
+```
+step 0: unknown step action "drg" — did you mean "drag"?. Legal actions: navigate, click, …
+step 1: wait step has nothing to wait for — give it `duration` (ms), `selector` (or `forElement`) …
+```
+
+Validation previously checked only that selectors resolved, so `{"action": "drag"}` validated clean
+and then died in CI.
+
+**And the list is published and enforced.** There was nowhere to look up the legal actions: `hj api`
+documents the HTTP endpoints, which reads as though the same verbs work as steps. The canonical list
+is now `TEST_STEP_ACTIONS` in `src/test-actions.ts`, printed in `SKILL.md`, `CLAUDE.md` and
+`docs/CI-INTEGRATION.md` — and a test asserts it matches the runner's `switch (step.action)` in
+**both** directions. Writing that guard immediately found `screenshot` documented in `SKILL.md` as a
+step action when the runner has never had one.
+
 ## 1.12.1
 
 A patch of fixes reported by an agent driving a real React + web-components admin app against

package/apps/desktop/artifacts.js

@@ -40,12 +40,12 @@ var __export = (target, all) => {
 // src/artifacts.ts
 var exports_artifacts = {};
 __export(exports_artifacts, {
-  saveDataUrl: () => saveDataUrl,
-  pruneKind: () => pruneKind,
-  pruneArtifacts: () => pruneArtifacts,
-  parseDataUrl: () => parseDataUrl,
+  RETENTION: () => RETENTION,
   artifactDir: () => artifactDir,
-  RETENTION: () => RETENTION
+  parseDataUrl: () => parseDataUrl,
+  pruneArtifacts: () => pruneArtifacts,
+  pruneKind: () => pruneKind,
+  saveDataUrl: () => saveDataUrl
 });
 module.exports = __toCommonJS(exports_artifacts);
 var import_promises = require("fs/promises");

package/apps/desktop/isolation.js

@@ -40,12 +40,12 @@ var __export = (target, all) => {
 // src/desktop-isolation.ts
 var exports_desktop_isolation = {};
 __export(exports_desktop_isolation, {
-  resolveServerUrl: () => resolveServerUrl,
-  resolvePublicUrl: () => resolvePublicUrl,
-  resolveInternalPort: () => resolveInternalPort,
-  isPrivateInstance: () => isPrivateInstance,
+  SHARED_INTERNAL_PORT: () => SHARED_INTERNAL_PORT,
   SHARED_PUBLIC_URL: () => SHARED_PUBLIC_URL,
-  SHARED_INTERNAL_PORT: () => SHARED_INTERNAL_PORT
+  isPrivateInstance: () => isPrivateInstance,
+  resolveInternalPort: () => resolveInternalPort,
+  resolvePublicUrl: () => resolvePublicUrl,
+  resolveServerUrl: () => resolveServerUrl
 });
 module.exports = __toCommonJS(exports_desktop_isolation);
 var SHARED_PUBLIC_URL = "http://localhost:8700";

package/apps/desktop/main.js

@@ -44,6 +44,44 @@ const IS_PRIVATE = process.env.HALTIJA_PRIVATE === '1'
 // consumer (e.g. a dev-server test lane) can drive this instance.
 const CALLER_PORT_FILE = IS_PRIVATE ? (process.env.HALTIJA_PORT_FILE || null) : null
 
+// A PRIVATE INSTANCE GETS ITS OWN ELECTRON PROFILE.
+//
+// Private mode isolated the ports, the registry, retirement and teardown — but not the profile, so
+// every instance ran with the same `--user-data-dir`. Chromium single-instance locking means the
+// second one to launch cannot take the profile lock and falls back to caches it cannot persist,
+// losing the HTTP cache and the V8 code cache. A large app bundle is then fully re-parsed on every
+// navigation: measured at roughly 10x slower page boots (issue #31).
+//
+// The damage is not just slowness, it is a LIE in the one workflow private mode exists for. Running
+// two versions side by side, the failure followed LAUNCH ORDER rather than version — 22.1s vs 2.04s,
+// and the same version passed or failed depending only on which started first. The reporter nearly
+// wrote up a version regression that did not exist. Every health signal read green throughout,
+// including `hj doctor` and a 120fps rAF cadence, because nothing was broken; it was just slow.
+//
+// Keyed on pid, not port: the private ports are ephemeral and not known yet at this point, and pid
+// is unique across concurrent runs by construction. Set BEFORE `app.whenReady()` and before
+// anything reads `app.getPath('userData')` (preferences.json does), or the isolation is partial —
+// which is how this bug existed at all.
+let PRIVATE_USER_DATA = null
+if (IS_PRIVATE) {
+  PRIVATE_USER_DATA = path.join(os.tmpdir(), `haltija-private-${process.pid}`)
+  try {
+    fs.mkdirSync(PRIVATE_USER_DATA, { recursive: true })
+    app.setPath('userData', PRIVATE_USER_DATA)
+    // Also keep the disk cache with it, so nothing is left in the shared profile.
+    app.setPath('sessionData', PRIVATE_USER_DATA)
+  } catch (err) {
+    // Falling back to the shared profile is slow and pollutes it, but it still WORKS — so say so
+    // loudly rather than refusing to start a run over a temp-directory failure.
+    console.error(
+      `[Haltija Desktop] Could not create a private profile at ${PRIVATE_USER_DATA}: ${err.message}. ` +
+        `Falling back to the shared profile — concurrent private instances will be slow and are ` +
+        `NOT safe to compare against each other (see issue #31).`,
+    )
+    PRIVATE_USER_DATA = null
+  }
+}
+
 // Haltija server config
 let HALTIJA_PORT = IS_PRIVATE ? 0 : parseInt(process.env.HALTIJA_PORT || '8700')
 let HALTIJA_SERVER = `http://localhost:${HALTIJA_PORT}`
@@ -1694,11 +1732,24 @@ if (!gotTheLock) {
     }
     // Drop a marker so hj's auto-launch knows the user explicitly quit.
     // Cleared next time the user manually starts Haltija.
-    try {
-      const dir = path.join(os.homedir(), '.haltija')
-      fs.mkdirSync(dir, { recursive: true })
-      fs.writeFileSync(path.join(dir, 'last-quit'), String(Date.now()))
-    } catch {}
+    //
+    // NOT in private mode: `~/.haltija/last-quit` is SHARED state, and an automated run ending is
+    // not the user quitting anything. Writing it suppressed auto-launch for the interactive app the
+    // developer is actually using — the same class as the profile sharing above (#31), where
+    // "private" turned out to mean "private ports" rather than "touches nothing of yours".
+    if (!IS_PRIVATE) {
+      try {
+        const dir = path.join(os.homedir(), '.haltija')
+        fs.mkdirSync(dir, { recursive: true })
+        fs.writeFileSync(path.join(dir, 'last-quit'), String(Date.now()))
+      } catch {}
+    }
+
+    // NOTE: the private profile is deliberately NOT deleted here. Chromium flushes its caches
+    // AFTER 'will-quit', so removing the directory at this point just gets it recreated — measured:
+    // both dirs survived a clean shutdown. Stale profiles are swept at the START of the next
+    // private run instead (see sweepStalePrivateState in bin/tosijs-dev.mjs), keyed on whether the
+    // owning pid is still alive, which is immune to shutdown ordering.
   })
 
   // Handle certificate errors (for self-signed certs in dev)

package/apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "haltija-desktop",
-  "version": "1.12.1",
+  "version": "1.12.5",
   "private": true,
   "description": "Haltija Desktop - God Mode Browser for AI Agents",
   "homepage": "https://github.com/tonioloewald/haltija",

package/apps/desktop/renderer/isolation.js

@@ -26,10 +26,10 @@ function resolveServerUrl(inputs) {
   return injected || persisted || SHARED_PUBLIC_URL;
 }
 export {
-  resolveServerUrl,
-  resolvePublicUrl,
-  resolveInternalPort,
-  isPrivateInstance,
+  SHARED_INTERNAL_PORT,
   SHARED_PUBLIC_URL,
-  SHARED_INTERNAL_PORT
+  isPrivateInstance,
+  resolveInternalPort,
+  resolvePublicUrl,
+  resolveServerUrl
 };

package/apps/desktop/resources/component.js

@@ -40,13 +40,13 @@
   // src/component.ts
   var exports_component = {};
   __export(exports_component, {
-    inject: () => inject,
+    DevChannel: () => DevChannel,
     VERSION: () => VERSION2,
-    DevChannel: () => DevChannel
+    inject: () => inject
   });
 
   // src/version.ts
-  var VERSION = "1.12.1";
+  var VERSION = "1.12.5";
 
   // src/text-selector.ts
   var TEXT_PSEUDO_RE = /:(?:text-is|has-text|text)\(/;
@@ -4095,25 +4095,21 @@
             let inputDesc = "";
             if (isCleared) {
               inputDesc = `Clear ${inputLabel}`;
-            } else if (inputType === "range") {
-              inputAction = "set";
-              inputDesc = `Set ${inputLabel} to ${inputValue}`;
-            } else if (inputType === "select-one" || inputType === "select-multiple") {
-              inputAction = "select";
-              inputDesc = `Select "${inputValue}" in ${inputLabel}`;
+            } else if (inputType === "range" || inputType === "select-one" || inputType === "select-multiple" || inputType === "date" || inputType === "time" || inputType === "color") {
+              inputAction = "eval";
+              inputDesc = `Set ${inputLabel} to "${inputValue}"`;
             } else if (inputType === "checkbox" || inputType === "radio") {
               inputAction = "check";
               inputDesc = `Check ${inputLabel}`;
-            } else if (inputType === "date" || inputType === "time" || inputType === "color") {
-              inputAction = "set";
-              inputDesc = `Set ${inputLabel} to ${inputValue}`;
             } else {
               inputDesc = `Type "${inputValue}" in ${inputLabel}`;
             }
             steps.push(withFallback({
               action: inputAction,
               selector,
-              ...inputAction === "type" || inputAction === "set" ? { text: inputValue } : { value: inputValue },
+              ...inputAction === "eval" ? {
+                code: `const el = document.querySelector(${JSON.stringify(selector)});` + ` el.value = ${JSON.stringify(inputValue)};` + ` el.dispatchEvent(new Event('input', { bubbles: true }));` + ` el.dispatchEvent(new Event('change', { bubbles: true }));`
+              } : inputAction === "type" ? { text: inputValue } : { value: inputValue },
               description: inputDesc,
               ...delay && delay > 50 ? { delay } : {}
             }, event.target));
@@ -4146,7 +4142,7 @@
           case "interaction:select":
             const selectedText = this.cleanDescription(event.payload?.text || "", 50);
             steps.push({
-              action: "select",
+              action: "select-text",
               selector,
               text: event.payload?.text || "",
               description: `Select text "${selectedText}"`,

package/bin/cli-commands.mjs

@@ -120,9 +120,9 @@ function cliNameForEndpoint(path) {
   return isKnownCommand(name) ? name : null;
 }
 export {
-  isKnownCommand,
-  cliNameForEndpoint,
-  ROUTED_COMMANDS,
+  LOCAL_COMMANDS,
   LOCAL_COMMAND_HELP,
-  LOCAL_COMMANDS
+  ROUTED_COMMANDS,
+  cliNameForEndpoint,
+  isKnownCommand
 };

package/bin/cli-subcommand.mjs

@@ -1065,6 +1065,40 @@ function exitOnTestFailure(json, subcommand) {
   }
 }
 
+/**
+ * One endpoint's section out of API.md, or the whole document when no name is given.
+ *
+ * Matches the `### \`METHOD /path\`` headings the generator emits, on the path's last segment, so
+ * `hj api screenshot` and `hj api map` both work. An unknown name returns the full document with a
+ * note on stderr rather than nothing — a lookup that silently prints emptiness is worse than one
+ * that over-delivers, and the caller has already paid for the fetch.
+ */
+export function filterApiSection(markdown, args) {
+  const wanted = (args || []).find((a) => !a.startsWith('-'))
+  if (!wanted) return markdown
+  const lines = markdown.split('\n')
+  const needle = wanted.replace(/^\/+/, '').toLowerCase()
+  let start = -1
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^### `[A-Z]+ (\/\S*)`/.exec(lines[i])
+    if (!m) continue
+    const seg = m[1].replace(/^\//, '').toLowerCase()
+    if (seg === needle || seg.split('/').pop() === needle) { start = i; break }
+  }
+  if (start === -1) {
+    process.stderr.write(
+      dim(`[hj] no API section named "${wanted}" — printing the full reference. ` +
+        `Section headings look like \`### \`POST /screenshot\`\`.`) + '\n',
+    )
+    return markdown
+  }
+  let end = lines.length
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^#{2,3} /.test(lines[i])) { end = i; break }
+  }
+  return lines.slice(start, end).join('\n').trimEnd()
+}
+
 export async function runSubcommand(subcommand, subArgs, port = '8700', options = {}) {
   const baseUrl = `http://localhost:${port}`
   const jsonOutput = subArgs.includes('--json')
@@ -1184,7 +1218,7 @@ export async function runSubcommand(subcommand, subArgs, port = '8700', options
     if (isGet) {
       const url = new URL(path, baseUrl)
       url.searchParams.set('window', targetWindowId)
-      return doRequest(url.toString(), 'GET', undefined, { subcommand, jsonOutput })
+      return doRequest(url.toString(), 'GET', undefined, { subcommand, jsonOutput, args: filteredArgs })
     } else {
       if (!body) body = {}
       body.window = targetWindowId
@@ -1192,11 +1226,11 @@ export async function runSubcommand(subcommand, subArgs, port = '8700', options
   }
 
   const url = `${baseUrl}${path}`
-  return doRequest(url, isGet ? 'GET' : 'POST', body, { subcommand, jsonOutput })
+  return doRequest(url, isGet ? 'GET' : 'POST', body, { subcommand, jsonOutput, args: filteredArgs })
 }
 
 async function doRequest(url, method, body, context = {}) {
-  const { subcommand, jsonOutput } = context
+  const { subcommand, jsonOutput, args: cmdArgs } = context
   try {
     const headers = {}
     if (process.env.HALTIJA_TOKEN) headers['X-Haltija-Token'] = process.env.HALTIJA_TOKEN
@@ -1369,7 +1403,14 @@ async function doRequest(url, method, body, context = {}) {
       }
     } else {
       const text = await resp.text()
-      console.log(text)
+      // `hj api <endpoint>` is a LOOKUP, not a dump.
+      //
+      // SKILL.md defers detail to `hj api screenshot` / `hj api map` to keep the always-loaded
+      // prompt small. That only pays off if the pointer works: positionals were dropped for GET
+      // subcommands, so every form returned the whole 64KB file — ~3KB saved from the prompt and
+      // ~16k tokens spent the first time anyone followed the advice. Filtering client-side needs no
+      // server change and no new endpoint.
+      console.log(subcommand === 'api' ? filterApiSection(text, cmdArgs) : text)
     }
 
     // Show hint for this command (if available and successful).

package/bin/format-test.mjs

@@ -46,6 +46,14 @@ export function formatTestResult(result) {
 
       lines.push(`  ${step.index + 1} ${[stepStatus, desc, dur, err].filter(Boolean).join(' ')}`)
 
+      // A step can PASS and still have something to say — currently a deprecated action spelling.
+      // Every loop here filtered on failure, so the notice reached nobody: a suite using an old
+      // name ran clean and its author found out when the alias was deleted. The whole point of
+      // deprecating rather than breaking is that the warning arrives while there is time to act.
+      if (step.warning) {
+        lines.push(`      ! ${step.warning}`)
+      }
+
       // Failure context detail
       if (!step.passed && step.context) {
         const detail = formatFailureContext(step.context)

package/bin/hj.mjs

@@ -196,6 +196,33 @@ async function runWhere(port, portSource, jsonOutput) {
     )
     return
   }
+  // TRANSPORTS, present and absent (issue #32). The channel is shared, so an instance that came up
+  // HTTP-only silently denies HTTPS pages in OTHER projects — and nothing said so. A half-open
+  // channel used to look identical to a full one from here.
+  const t = serverInfo.transports
+  if (t) {
+    const parts = []
+    if (t.http) parts.push(t.http.listening ? green(`http ${t.http.port} ✓`) : dim(`http ${t.http.port} ✗`))
+    if (t.https) {
+      // No port when there is nothing listening and none was assigned — `https 0` is noise.
+      const label = t.https.port ? `https ${t.https.port}` : 'https'
+      parts.push(
+        t.https.listening
+          ? green(`${label} ✓`)
+          : `${yellow(`${label} ✗`)} ${dim(`(${t.https.reason})`)}`,
+      )
+    }
+    console.log(`${bold('transports:')} ${parts.join('   ')}`)
+    // Only for a SHARED channel. A private instance denies nobody else — saying otherwise would be
+    // the alarming answer rather than the true one.
+    if (t.https && !t.https.listening && !serverInfo.isPrivate) {
+      console.log(
+        dim('  an HTTPS page cannot import an HTTP channel (mixed content), so any page served over ' +
+          'https has no haltija here — including pages belonging to other projects sharing this channel.'),
+      )
+    }
+  }
+
   const desc = [
     `haltija ${serverInfo.serverVersion}`,
     instanceName ? `name=${instanceName}` : null,

package/bin/mcp-setup.mjs

@@ -62,7 +62,7 @@ function findMcpServerPath() {
   try {
     const result = spawnSync('npm', ['root', '-g'], { encoding: 'utf8' })
     if (result.status === 0) {
-      const globalPath = join(result.stdout.trim(), 'tosijs-dev/apps/mcp/build/index.js')
+      const globalPath = join(result.stdout.trim(), 'haltija/apps/mcp/build/index.js')
       if (existsSync(globalPath)) {
         return globalPath
       }
@@ -70,7 +70,7 @@ function findMcpServerPath() {
   } catch {}
 
   // Check node_modules in current directory
-  const nodeModulesPath = join(process.cwd(), 'node_modules/tosijs-dev/apps/mcp/build/index.js')
+  const nodeModulesPath = join(process.cwd(), 'node_modules/haltija/apps/mcp/build/index.js')
   if (existsSync(nodeModulesPath)) {
     return nodeModulesPath
   }

package/bin/private-state.mjs

@@ -0,0 +1,29 @@
+/** ⚠️  AUTO-GENERATED FROM src/private-state.ts — DO NOT EDIT. Run: bun run build */
+// src/private-state.ts
+function stalePrivateEntries(names, deps) {
+  const out = [];
+  for (const name of names) {
+    const m = /^haltija-private-(\d+)(\.json)?$/.exec(name);
+    if (!m)
+      continue;
+    const pid = parseInt(m[1], 10);
+    if (!pid || pid === deps.selfPid)
+      continue;
+    if (deps.isAlive(pid))
+      continue;
+    out.push(name);
+  }
+  return out;
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+export {
+  pidIsAlive,
+  stalePrivateEntries
+};

package/bin/project-origins.mjs

@@ -86,8 +86,8 @@ function routeByDeclaredOrigin(declared, tabs, focusedWindowId) {
   };
 }
 export {
-  routeByDeclaredOrigin,
-  normalizeOrigin,
+  ORIGINS_FILE,
   findProjectOrigins,
-  ORIGINS_FILE
+  normalizeOrigin,
+  routeByDeclaredOrigin
 };

package/bin/semver.mjs

@@ -64,8 +64,8 @@ function differsBeyondPatch(a, b) {
   return pa.major !== pb.major || pa.minor !== pb.minor;
 }
 export {
-  parseVersion,
-  isOlderThan,
+  compareVersions,
   differsBeyondPatch,
-  compareVersions
+  isOlderThan,
+  parseVersion
 };