haltija 1.13.0-beta.5 → 1.13.0

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 1.13.0 (2026-10-18)
+
+The 1.13 betas, released. Read **Security** and **Upgrading from 1.12** before moving off 1.12.x.
+The beta sections below have the detail and the reasoning; this section is the list. The changes
+made after beta.5 are at the end.
+
+### Security
+
+- **Through 1.12.9, anything on your network could drive your browser.** The server listens on
+  every interface and, without `--token`, answered any machine, `/eval` included. Affected: every
+  release through **1.12.9** (the previous `latest`) and **1.13.0-beta.1 to beta.4**. In 1.13.0 a
+  connection from another machine is refused (403) unless the server has a token (virta #815,
+  GitHub #44; first shipped in beta.5). If you stay on 1.12.x, start the server with `--token
+  <secret>` on any network you don't trust.
+- **Pages on this machine can still call the API, and that is by design.** beta.1 listed this as a
+  known issue with "an origin gate planned before 1.13.0". That gate is not coming: the widget is
+  injected into arbitrary pages, so the REST surface must answer any origin, and an origin check
+  would break exactly the pages haltija exists for. `--token` closes it, as it closes a tunnel or
+  reverse proxy running on this machine (which connects from localhost). The README's Security
+  section says what is and isn't covered.
+
+### Upgrading from 1.12
+
+Each of these changes something that worked before. Before → after:
+
+- **Other machines need a token.** Phones, headsets, other computers, and browsers in a container,
+  VM or WSL2 that reach haltija through a forwarded port: they connected freely, and now get a 403
+  until the server has `--token <secret>` and the client sends it (beta.5).
+- **Both transports by default.** `DEV_CHANNEL_MODE` was `http`; it is `both`, so HTTPS 8701 comes
+  up too. `--http` opts out, and says what that costs other projects (beta.1).
+- **The certificate lives in `~/.haltija/certs`.** It was per-install; an existing one is copied
+  forward, so trust you already granted survives (beta.1).
+- **The desktop app's internal server moved from 8701 to 8710.** `HALTIJA_PORT=8701 hj tree`
+  (inspecting the app's own UI) is now `HALTIJA_PORT=8710 hj tree` (beta.1).
+- **Only the server on 8700 takes HTTPS 8701.** A `--port` / `--name` server's HTTPS is now
+  ephemeral, shown in its banner and `/status`, unless you pass `--https-port` (beta.1).
+- **`server` from `haltija/server` is the HTTP listener**, and `server`, `httpServer` and
+  `httpsServer` are typed `ListeningServer` (`port`, `hostname`, `url`, `stop()`) instead of
+  Bun's server type. Code that used other Bun server methods on them needs a cast (beta.1).
+- **Navigate and refresh wait for the page's widget.** They returned at once; now they block until
+  the widget reconnects, up to `--timeout` (default 10 s). A page that doesn't load the widget
+  itself (a bookmarklet tab) waits that long every time: pass `--no-wait` there. `navigate()` and
+  `refresh()` in `DevChannelClient` / `haltija/test` now return `{ reconnected, warning? }` (beta.2).
+- **The widget writes `window.name` while navigating**, and restores the page's own value after.
+  An app that keeps state in `window.name` can see the marker briefly (beta.2).
+- **`press` acts at the focused element.** In `haltija/test` and `DevChannelClient.press` it was one
+  `keydown` at `body`; now it is the full key sequence at the focused element, like `hj key`
+  (beta.4).
+- **Schematics are drawn by tosijs-floorplan.** Same response fields; the picture looks different
+  (beta.5).
+
+### Fixed after beta.5
+
+From the 1.13.0 release review (`reviews/1.13.0-*.md`):
+
+- **A refused connection from another machine is now logged on the server**, once per address, with
+  the `--token` remedy. A browser cannot read why a WebSocket handshake failed, so a widget in a
+  container or VM retried forever while the server said nothing.
+- **`DevChannelClient` and `haltija/test` send `HALTIJA_TOKEN`.** `hj` and the MCP bridge always
+  did; these two never did, so a test suite could not reach a `--token` server at all, which since
+  beta.5 is the setup for any runner on another machine.
+- **`haltija --token=<secret>` sets a token.** The launcher read only `--token <secret>`, so the `=`
+  form, like a misspelled flag, started a server with no token and no complaint. `--flag=value` now
+  works for every launcher flag that takes a value, an unknown flag is reported, and the banner has
+  an `AUTH:` line saying whether a token is in force.
+- **`/drag`, `hj drag` and the `drag` step move pointer-driven controls.** They sent bare mouse
+  events (some of them `CustomEvent`s with no coordinates), so a slider, resize handle or orbit
+  camera that listens for pointer events didn't move while the drag reported success. They now use
+  the same pointer-and-mouse sequence as `dragFrom`, with `buttons` set while pressed.
+- **MCP setup replaces a stale entry.** Before 1.13 setup wrote `node …/apps/mcp/build/index.js`,
+  which no longer exists. `--check` reported such an entry as configured, and re-running setup said
+  "already configured". Both now call it stale, and setup rewrites it. The help named
+  `npx haltija-mcp-setup`, a package that does not exist; it is `npx -p haltija haltija-mcp-setup`.
+- **The `test:integration` lane runs its tests.** It needed a server it was never given, so every
+  1.13 beta attested "0 pass, 11 skip" as a pass. It now starts its own private headless instance,
+  and a lane that only skipped fails.
+- Docs: the README no longer shows a demo image that doesn't exist, and links the API reference and
+  the browser-test guide (`docs/TEST-IN-BROWSER.md`).
+
 ## 1.13.0-beta.5 (2026-10-18)
 
 ### Changed

package/README.md

@@ -8,9 +8,6 @@
 
 Unlike screenshot-based tools, Haltija works with the actual DOM. Unlike Playwright, it connects to your real browser — already logged in, same cookies, same bug you're looking at.
 
-<!-- TODO: Replace with actual GIF showing: 1) bunx haltija launches app, 2) agent queries tree, 3) agent clicks something, 4) highlight shows result -->
-![Haltija in action](docs/assets/demo.gif)
-
 > *Haltija* (Finnish): a guardian spirit that watches over a place. In this case, your DOM.
 
 ---
@@ -337,7 +334,9 @@ app also exists but isn't required for either.
   8701 by default), but without a token it refuses every connection that doesn't come from this
   machine. To use haltija from another device (a phone, a headset, a second computer), start it
   with `--token <secret>` (or `HALTIJA_TOKEN`) and send the same value as `X-Haltija-Token`,
-  `?token=`, or the widget's `token` option.
+  `?token=`, or the widget's `token` option. A browser in a container, VM or WSL2 that reaches
+  haltija through a forwarded port also counts as another machine. The server's terminal names
+  each refused address once.
 - **On this machine, any page you visit can call it.** The widget is injected into arbitrary
   pages, so the REST API answers any origin, `/eval` in your connected tabs included. That is by
   design for a local dev tool, and `--token` closes it too. A tunnel or reverse proxy on this
@@ -411,10 +410,11 @@ hj api                        # Full API reference (markdown)
 hj --help                     # CLI subcommand reference
 ```
 
-- [Full API Reference](./API.md) (auto-generated from schema)
+- [Full API Reference](https://github.com/tonioloewald/haltija/blob/main/API.md) (auto-generated from schema)
 - [Agent Prompt](docs/agent-prompt.md) — Copy-paste prompt for any AI agent
 - [Recipes](docs/recipes.md) — Common workflows
 - [CI Integration](docs/CI-INTEGRATION.md) — E2E testing with Haltija in GitHub Actions
+- [Browser tests from your test runner](docs/TEST-IN-BROWSER.md) — `createBrowserPage` from `haltija/test`: assertions on the host, probes in a real browser
 - [Roadmap](docs/ROADMAP.md)
 
 ---

package/apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "haltija-desktop",
-  "version": "1.13.0-beta.5",
+  "version": "1.13.0",
   "private": true,
   "description": "Haltija Desktop - God Mode Browser for AI Agents",
   "homepage": "https://github.com/tonioloewald/haltija",

package/apps/desktop/resources/component.js

@@ -46,7 +46,7 @@
   });
 
   // src/version.ts
-  var VERSION = "1.13.0-beta.5";
+  var VERSION = "1.13.0";
 
   // src/ws-url.ts
   function httpBaseFromWsUrl(wsUrl2, fallback = "http://localhost:8700") {

package/bin/launcher-args.mjs

@@ -0,0 +1,35 @@
+/**
+ * The launcher's own flags, and `--flag=value` support for the ones that take a value.
+ *
+ * The launcher read flags with `args.indexOf('--token')`, so `--token=secret` and a typo like
+ * `--tokn secret` both started a server with NO token, silently (1.13.0 review). With the #815 gate
+ * that mostly fails closed for other machines, but a tunnel on this machine connects from loopback,
+ * and the README sends tunnel users to `--token`. So: accept the `=` form, and say when a flag is not
+ * one the launcher knows.
+ */
+export const VALUE_FLAGS = [
+  '--port', '--https-port', '--token', '--name', '--port-file',
+  '--headless-url', '--snapshots-dir', '--docs-dir',
+]
+export const BOOLEAN_FLAGS = [
+  '--app', '--server', '--headless', '--ci', '--http', '--https', '--both', '--force', '-f',
+  '--wait-ready', '--private', '--setup-mcp', '--setup-mcp-check', '--setup-mcp-remove',
+  '--help', '-h',
+]
+
+/** `--token=x` becomes `--token x`, for the value flags only. Returns the unknown flags it saw. */
+export function normalizeLauncherArgs(args) {
+  const out = []
+  const unknown = []
+  for (const a of args) {
+    const eq = a.indexOf('=')
+    const flag = a.startsWith('-') && eq > 0 ? a.slice(0, eq) : a
+    if (flag !== a && VALUE_FLAGS.includes(flag)) {
+      out.push(flag, a.slice(eq + 1))
+      continue
+    }
+    if (a.startsWith('-') && !VALUE_FLAGS.includes(a) && !BOOLEAN_FLAGS.includes(a)) unknown.push(a)
+    out.push(a)
+  }
+  return { args: out, unknown }
+}

package/bin/mcp-locate.mjs

@@ -31,3 +31,20 @@ export function mcpServerCommand(serverPath, root = PACKAGE_ROOT) {
   }
   return { command: 'node', args: [serverPath] }
 }
+
+/**
+ * Why an existing `haltija` MCP entry can no longer start, or null when it looks runnable.
+ *
+ * Before 1.13.0 setup wrote `node …/apps/mcp/build/index.js`, a path the package no longer has, and
+ * `--check` reported such an entry as configured while re-running setup said "already configured",
+ * so nothing short of hand-editing the config could fix it. An entry that names a server file which
+ * is not there is stale, whatever else it says; one that runs a command (`npx …`) is left alone.
+ */
+export function staleMcpEntry(entry) {
+  const args = Array.isArray(entry?.args) ? entry.args : []
+  const script = args.find((a) => typeof a === 'string' && /\.(m?js|ts)$/.test(a))
+  if (!script) return null
+  if (/[\\/]apps[\\/]mcp[\\/]build[\\/]/.test(script)) return `it runs ${script}, the pre-1.13 server location`
+  if (!existsSync(script)) return `it runs ${script}, which does not exist`
+  return null
+}

package/bin/mcp-setup.mjs

@@ -3,18 +3,18 @@
  * haltija-mcp-setup - Configure Claude Code to use Haltija
  *
  * Usage:
- *   npx haltija-mcp-setup          # Create .mcp.json in current directory
- *   npx haltija-mcp-setup --global # Add to user's Claude Code config
- *   npx haltija-mcp-setup --check  # Check if Haltija MCP is configured
- *   npx haltija-mcp-setup --help   # Show help
+ *   npx -p haltija haltija-mcp-setup          # Create .mcp.json in current directory
+ *   npx -p haltija haltija-mcp-setup --global # Add to user's Claude Code config
+ *   npx -p haltija haltija-mcp-setup --check  # Check if Haltija MCP is configured
+ *   npx -p haltija haltija-mcp-setup --help   # Show help
  */
 
 import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'fs'
 import { homedir } from 'os'
 import { join, dirname } from 'path'
 import { fileURLToPath } from 'url'
-import { execSync } from 'child_process'
-import { mcpServerPath, mcpServerCommand } from './mcp-locate.mjs'
+import { execFileSync } from 'child_process'
+import { mcpServerPath, mcpServerCommand, staleMcpEntry } from './mcp-locate.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const args = process.argv.slice(2)
@@ -31,11 +31,11 @@ if (args.includes('--help') || args.includes('-h')) {
 ${bold('haltija-mcp-setup')} - Configure Claude Code to use Haltija
 
 ${bold('Usage:')}
-  npx haltija-mcp-setup          Create .mcp.json in current directory (recommended)
-  npx haltija-mcp-setup --global Add to user's global Claude Code config
-  npx haltija-mcp-setup --check  Check current MCP configuration status
-  npx haltija-mcp-setup --remove Remove Haltija from MCP configuration
-  npx haltija-mcp-setup --help   Show this help
+  npx -p haltija haltija-mcp-setup          Create .mcp.json in current directory (recommended)
+  npx -p haltija haltija-mcp-setup --global Add to user's global Claude Code config
+  npx -p haltija haltija-mcp-setup --check  Check current MCP configuration status
+  npx -p haltija haltija-mcp-setup --remove Remove Haltija from MCP configuration
+  npx -p haltija haltija-mcp-setup --help   Show this help
 
 ${bold('What this does:')}
   Configures Claude Code to connect to the Haltija server, giving Claude
@@ -84,7 +84,11 @@ function checkConfig() {
   if (existsSync(projectMcpPath)) {
     try {
       const config = JSON.parse(readFileSync(projectMcpPath, 'utf8'))
-      if (config.mcpServers?.haltija) {
+      const stale = config.mcpServers?.haltija && staleMcpEntry(config.mcpServers.haltija)
+      if (stale) {
+        console.log(red('✗') + ` Project .mcp.json has a stale Haltija entry: ${stale}`)
+        console.log(dim('  Run setup again to replace it: npx -p haltija haltija-mcp-setup'))
+      } else if (config.mcpServers?.haltija) {
         console.log(green('✓') + ` Project .mcp.json has Haltija configured`)
         console.log(dim(`  Path: ${projectMcpPath}`))
       } else {
@@ -108,9 +112,10 @@ function checkConfig() {
   }
 
   // Check if Haltija server is running
+  const port = process.env.HALTIJA_PORT || '8700'
   try {
-    execSync('curl -s http://localhost:8700/status', { encoding: 'utf8', timeout: 2000 })
-    console.log(green('✓') + ' Haltija server is running on port 8700')
+    execFileSync('curl', ['-sf', `http://localhost:${port}/status`], { encoding: 'utf8', timeout: 2000 })
+    console.log(green('✓') + ` Haltija server is running on port ${port}`)
   } catch {
     console.log(yellow('○') + ' Haltija server not running')
     console.log(dim('  Start with: bunx haltija'))
@@ -145,7 +150,10 @@ function setupProjectConfig() {
   }
 
   // Check if already configured
-  if (config.mcpServers.haltija) {
+  const stale = config.mcpServers.haltija && staleMcpEntry(config.mcpServers.haltija)
+  if (stale) {
+    console.log(yellow('Replacing a stale Haltija entry in .mcp.json:') + ` ${stale}`)
+  } else if (config.mcpServers.haltija) {
     console.log(yellow('Haltija is already configured in .mcp.json'))
     console.log(dim('Use --remove to remove it, or delete .mcp.json manually'))
     process.exit(0)
@@ -178,7 +186,9 @@ function setupGlobalConfig() {
   const addCommand = `claude mcp add --scope user haltija -- ${[command, ...commandArgs].map((a) => JSON.stringify(a)).join(' ')}`
   // Try using claude CLI first
   try {
-    execSync(addCommand, {
+    // An argv, not a shell string: the install path is in the args, and a shell would run any
+    // `$()` or backtick in it.
+    execFileSync('claude', ['mcp', 'add', '--scope', 'user', 'haltija', '--', command, ...commandArgs], {
       encoding: 'utf8',
       stdio: 'inherit'
     })

package/bin/server-list.mjs

@@ -1,6 +1,11 @@
 /** ⚠️  AUTO-GENERATED FROM src/server-list.ts — DO NOT EDIT. Run: bun run build */
+// src/ports.ts
+var DEFAULT_HTTP_PORT = 8700;
+var DEFAULT_HTTPS_PORT = 8701;
+var PUBLIC_PORTS = [DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT];
+
 // src/server-list.ts
-function collectCandidates(instances, resolvedPort, defaults = [8700, 8701]) {
+function collectCandidates(instances, resolvedPort, defaults = [...PUBLIC_PORTS]) {
   const byPort = new Map;
   for (const e of instances) {
     byPort.set(String(e.port), { port: String(e.port), name: e.name, cwd: e.cwd ?? null });

package/bin/tosijs-dev.mjs

@@ -18,7 +18,7 @@ import { homedir, platform, tmpdir } from 'os'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import { stalePrivateEntries, pidIsAlive } from './private-state.mjs'
-import { mcpServerPath, mcpServerCommand } from './mcp-locate.mjs'
+import { mcpServerPath, mcpServerCommand, staleMcpEntry } from './mcp-locate.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const serverPath = join(__dirname, '../dist/server.js')
@@ -171,7 +171,11 @@ function checkMcpConfig() {
     if (existsSync(configPath)) {
       try {
         const config = JSON.parse(readFileSync(configPath, 'utf8'))
-        if (config.mcpServers?.haltija) {
+        const stale = config.mcpServers?.haltija && staleMcpEntry(config.mcpServers.haltija)
+        if (stale) {
+          console.log(red('✗') + ` Haltija's Claude Desktop entry is stale: ${stale}`)
+          console.log(dim(`  Run: haltija --setup-mcp (it replaces the entry)`))
+        } else if (config.mcpServers?.haltija) {
           console.log(green('✓') + ' Haltija is configured in Claude Desktop')
           console.log(dim(`  Command: ${config.mcpServers.haltija.command} ${config.mcpServers.haltija.args?.join(' ') || ''}`))
         } else {
@@ -248,7 +252,10 @@ function setupMcp() {
   }
   
   // Check if already configured
-  if (config.mcpServers.haltija) {
+  const stale = config.mcpServers.haltija && staleMcpEntry(config.mcpServers.haltija)
+  if (stale) {
+    console.log(yellow('Replacing a stale Haltija entry:') + ` ${stale}`)
+  } else if (config.mcpServers.haltija) {
     console.log(green('✓') + ' Haltija is already configured in Claude Desktop')
     console.log(dim(`  Config: ${configPath}`))
     console.log('')
@@ -310,6 +317,7 @@ function removeMcp() {
 // ============================================
 
 import { isSubcommand, runSubcommand } from './cli-subcommand.mjs'
+import { normalizeLauncherArgs } from './launcher-args.mjs'
 
 // Check if first positional arg is a subcommand (not a flag, not a port number)
 const firstNonFlag = args.find(a => !a.startsWith('-'))
@@ -349,6 +357,16 @@ if (args.includes('--setup-mcp-remove')) {
   process.exit(0)
 }
 
+// Launcher mode from here on (subcommands took their own flags above). `--flag=value` is split
+// in place, so every `args.indexOf('--flag')` below sees it; an unknown flag is said out loud.
+{
+  const { args: normalized, unknown } = normalizeLauncherArgs(args)
+  args.splice(0, args.length, ...normalized)
+  for (const flag of unknown) {
+    console.error(yellow(`[haltija] unknown option ${flag} is ignored (see haltija --help)`))
+  }
+}
+
 // Set up environment from args
 const env = { ...process.env }
 

package/bin/version.mjs

@@ -3,4 +3,4 @@
  * ⚠️  To change the version, update package.json and run: bun run build
  */
 
-export const HJ_VERSION = '1.13.0-beta.5'
+export const HJ_VERSION = '1.13.0'

package/dist/api-schema.d.ts

@@ -297,8 +297,8 @@ export declare const recordingStart: EndpointDef<{
 export declare const recordingStop: EndpointDef<{}>;
 export declare const recordingGenerate: EndpointDef<{
     url?: string | undefined;
-    events?: any[] | undefined;
     minDelay?: number | undefined;
+    events?: any[] | undefined;
     name?: string | undefined;
     since?: number | undefined;
     description?: string | undefined;
@@ -654,8 +654,8 @@ export declare const endpoints: {
     readonly recordingStop: EndpointDef<{}>;
     readonly recordingGenerate: EndpointDef<{
         url?: string | undefined;
-        events?: any[] | undefined;
         minDelay?: number | undefined;
+        events?: any[] | undefined;
         name?: string | undefined;
         since?: number | undefined;
         description?: string | undefined;
@@ -931,8 +931,8 @@ export declare const ALL_ENDPOINTS: (EndpointDef<{
     name?: string | undefined;
 }> | EndpointDef<{}> | EndpointDef<{
     url?: string | undefined;
-    events?: any[] | undefined;
     minDelay?: number | undefined;
+    events?: any[] | undefined;
     name?: string | undefined;
     since?: number | undefined;
     description?: string | undefined;

package/dist/client-auth.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `fetch`, plus `X-Haltija-Token` when `HALTIJA_TOKEN` is set: what `DevChannelClient` and
+ * `haltija/test` send every request with.
+ *
+ * `hj` and the MCP bridge have always sent the token; these two never did, so a test suite could
+ * not reach a server started with `--token` at all. Since 1.13.0 a caller on another machine (or in
+ * a container reaching the host through a forwarded port) needs that token (#815), so the gap went
+ * from rare to the documented setup (1.13.0 review). Imported as `fetch` so no call site changes,
+ * and a header the caller set explicitly wins.
+ */
+export declare function authedFetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;

package/dist/client.js

@@ -1,4 +1,15 @@
 // @bun
+// src/client-auth.ts
+function authedFetch(input, init = {}) {
+  const token = typeof process !== "undefined" ? process.env.HALTIJA_TOKEN : undefined;
+  if (!token)
+    return fetch(input, init);
+  const headers = new Headers(init.headers);
+  if (!headers.has("X-Haltija-Token"))
+    headers.set("X-Haltija-Token", token);
+  return fetch(input, { ...init, headers });
+}
+
 // src/client.ts
 class DevChannelClient {
   baseUrl;
@@ -6,11 +17,11 @@ class DevChannelClient {
     this.baseUrl = serverUrl;
   }
   async status() {
-    const res = await fetch(`${this.baseUrl}/status`);
+    const res = await authedFetch(`${this.baseUrl}/status`);
     return res.json();
   }
   async send(channel, action, payload) {
-    const res = await fetch(`${this.baseUrl}/send`, {
+    const res = await authedFetch(`${this.baseUrl}/send`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ channel, action, payload })
@@ -18,7 +29,7 @@ class DevChannelClient {
     return res.json();
   }
   async request(channel, action, payload, timeout = 5000) {
-    const res = await fetch(`${this.baseUrl}/request`, {
+    const res = await authedFetch(`${this.baseUrl}/request`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ channel, action, payload, timeout })
@@ -26,7 +37,7 @@ class DevChannelClient {
     return res.json();
   }
   async query(selector) {
-    const res = await fetch(`${this.baseUrl}/query`, {
+    const res = await authedFetch(`${this.baseUrl}/query`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ selector, all: false })
@@ -35,7 +46,7 @@ class DevChannelClient {
     return response.success ? response.data : null;
   }
   async queryAll(selector) {
-    const res = await fetch(`${this.baseUrl}/query`, {
+    const res = await authedFetch(`${this.baseUrl}/query`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ selector, all: true })
@@ -44,7 +55,7 @@ class DevChannelClient {
     return response.success ? response.data : [];
   }
   async getConsole(since = 0) {
-    const res = await fetch(`${this.baseUrl}/console?since=${since}`);
+    const res = await authedFetch(`${this.baseUrl}/console?since=${since}`);
     const response = await res.json();
     return response.success ? response.data : [];
   }
@@ -52,7 +63,7 @@ class DevChannelClient {
     await this.request("console", "clear", {});
   }
   async eval(code) {
-    const res = await fetch(`${this.baseUrl}/eval`, {
+    const res = await authedFetch(`${this.baseUrl}/eval`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ code })
@@ -64,7 +75,7 @@ class DevChannelClient {
     return response.data;
   }
   async click(selector, options) {
-    const res = await fetch(`${this.baseUrl}/click`, {
+    const res = await authedFetch(`${this.baseUrl}/click`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ selector, options })
@@ -75,7 +86,7 @@ class DevChannelClient {
     }
   }
   async type(selector, text) {
-    const res = await fetch(`${this.baseUrl}/type`, {
+    const res = await authedFetch(`${this.baseUrl}/type`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ selector, text })
@@ -98,7 +109,7 @@ class DevChannelClient {
     await this.dispatch({ selector, event: "blur" });
   }
   async press(key, modifiers) {
-    const res = await fetch(`${this.baseUrl}/key`, {
+    const res = await authedFetch(`${this.baseUrl}/key`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -126,7 +137,7 @@ class DevChannelClient {
     return outcome;
   }
   async refresh(hard = true) {
-    const res = await fetch(`${this.baseUrl}/refresh`, {
+    const res = await authedFetch(`${this.baseUrl}/refresh`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ soft: !hard })
@@ -138,7 +149,7 @@ class DevChannelClient {
     return this.navigationOutcome(response);
   }
   async navigate(url) {
-    const res = await fetch(`${this.baseUrl}/navigate`, {
+    const res = await authedFetch(`${this.baseUrl}/navigate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ url })
@@ -150,7 +161,7 @@ class DevChannelClient {
     return this.navigationOutcome(response);
   }
   async getLocation() {
-    const res = await fetch(`${this.baseUrl}/location`);
+    const res = await authedFetch(`${this.baseUrl}/location`);
     const response = await res.json();
     if (!response.success) {
       throw new Error(response.error || "Get location failed");
@@ -158,7 +169,7 @@ class DevChannelClient {
     return response.data;
   }
   async startRecording(name) {
-    const res = await fetch(`${this.baseUrl}/recording/start`, {
+    const res = await authedFetch(`${this.baseUrl}/recording/start`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ name })
@@ -170,7 +181,7 @@ class DevChannelClient {
     return response.data.sessionId;
   }
   async stopRecording() {
-    const res = await fetch(`${this.baseUrl}/recording/stop`, {
+    const res = await authedFetch(`${this.baseUrl}/recording/stop`, {
       method: "POST"
     });
     const response = await res.json();
@@ -186,7 +197,7 @@ class DevChannelClient {
     }
   }
   async publishBuild(event) {
-    await fetch(`${this.baseUrl}/build`, {
+    await authedFetch(`${this.baseUrl}/build`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(event)
@@ -206,7 +217,7 @@ class DevChannelClient {
     }
   }
   async watchMutations(options) {
-    const res = await fetch(`${this.baseUrl}/mutations/watch`, {
+    const res = await authedFetch(`${this.baseUrl}/mutations/watch`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(options || {})
@@ -217,7 +228,7 @@ class DevChannelClient {
     }
   }
   async unwatchMutations() {
-    const res = await fetch(`${this.baseUrl}/mutations/unwatch`, {
+    const res = await authedFetch(`${this.baseUrl}/mutations/unwatch`, {
       method: "POST"
     });
     const response = await res.json();
@@ -226,7 +237,7 @@ class DevChannelClient {
     }
   }
   async getMutationStatus() {
-    const res = await fetch(`${this.baseUrl}/mutations/status`);
+    const res = await authedFetch(`${this.baseUrl}/mutations/status`);
     const response = await res.json();
     if (!response.success) {
       throw new Error(response.error || "Get mutation status failed");
@@ -234,7 +245,7 @@ class DevChannelClient {
     return response.data;
   }
   async getMessages(since = 0) {
-    const res = await fetch(`${this.baseUrl}/messages?since=${since}`);
+    const res = await authedFetch(`${this.baseUrl}/messages?since=${since}`);
     return res.json();
   }
   async getInteractiveElements() {
@@ -306,7 +317,7 @@ class DevChannelClient {
     };
   }
   async validateTest(test) {
-    const res = await fetch(`${this.baseUrl}/test/validate`, {
+    const res = await authedFetch(`${this.baseUrl}/test/validate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(test)
@@ -314,7 +325,7 @@ class DevChannelClient {
     return res.json();
   }
   async runTest(test, options) {
-    const res = await fetch(`${this.baseUrl}/test/run`, {
+    const res = await authedFetch(`${this.baseUrl}/test/run`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ test, ...options })
@@ -330,7 +341,7 @@ class DevChannelClient {
     };
   }
   async runTestSuite(tests, options) {
-    const res = await fetch(`${this.baseUrl}/test/suite`, {
+    const res = await authedFetch(`${this.baseUrl}/test/suite`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ tests, ...options })
@@ -339,7 +350,7 @@ class DevChannelClient {
   }
   async loadTest(source) {
     if (source.startsWith("http://") || source.startsWith("https://")) {
-      const res = await fetch(source);
+      const res = await authedFetch(source);
       return res.json();
     }
     return JSON.parse(source);

package/dist/component.d.ts

@@ -20,7 +20,7 @@
  * - Option+Tab toggles visibility (but active state always shows briefly)
  * - Localhost only by default
  */
-export declare const VERSION = "1.13.0-beta.5";
+export declare const VERSION = "1.13.0";
 export declare class DevChannel extends HTMLElement {
     static get tagName(): string;
     static elementCreator(): () => DevChannel;

package/dist/component.esm.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "1.13.0-beta.5";
+var VERSION = "1.13.0";
 
 // src/ws-url.ts
 function httpBaseFromWsUrl(wsUrl2, fallback = "http://localhost:8700") {

package/dist/component.js

@@ -46,7 +46,7 @@
   });
 
   // src/version.ts
-  var VERSION = "1.13.0-beta.5";
+  var VERSION = "1.13.0";
 
   // src/ws-url.ts
   function httpBaseFromWsUrl(wsUrl2, fallback = "http://localhost:8700") {