sweetlink 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,8 +1,27 @@
 # Changelog
 
-## 0.2.1 — Unreleased
+## 0.2.2 — 2026-08-10
 
-- _No changes yet._
+**Highlight:** `sweetlinkd --help` no longer starts the daemon, and this
+release clears seven security advisories — the vulnerable undici 7.28.0 leaves
+the dependency graph entirely.
+
+### Fixes
+
+- **Standalone daemon help fixed**: `sweetlinkd --help` now prints usage and exits instead of starting the daemon.
+- **Example handshake fixed**: the basic web example now converts HTTP daemon origins to browser-compatible WebSocket URLs and permits the configured socket origin plus SweetLink command modules through its content security policy.
+
+### Security and maintenance
+
+- Refresh the dependency graph, clearing seven advisories: vulnerable `undici` 7.28.0 is removed entirely, and playwright-core, puppeteer-core, jsdom 30, ws, and the oxc toolchain move to current releases.
+
+## 0.2.1 — 2026-06-11
+
+- **Click defaults restored**: `sweetlink click` now scrolls targets into view and dispatches bubbling clicks by default again, with explicit `--no-scroll` and `--no-bubbles` opt-outs. Thanks @devYRPauli.
+- **Cookie collection modernized**: Chrome cookie sync now uses `@steipete/sweet-cookie`, preserves the `~/.oracle` inline fallback, and drops the old native SQLite/keytar dependency path.
+- **Smoke route corrected**: the built-in `main` preset now targets `/timeline` and no longer treats the removed `/timeline/home` route as equivalent.
+- **Node 24 baseline**: package metadata, CI, TypeScript builds, linting, and runtime dependencies now target Node.js 24 or newer.
+- **Runtime maintenance**: updated Commander, Puppeteer Core, Playwright Core, WebSocket, Vite, and supporting dependencies.
 
 ## 0.2.0 — 2025-12-26
 

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Peter Steinberger
+Copyright (c) 2026 Peter Steinberger
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -23,7 +23,7 @@ SweetLink is the agent-ready way to "connect your agent to your web app. Like Pl
 
 ## Prerequisites
 
-- Node.js 22+
+- Node.js 24+
 - `pnpm` (managed via Corepack)
 - TLS requirements: `brew install mkcert nss`
 - SweetLink daemon running locally (`pnpm exec sweetlink daemon` or `pnpm exec sweetlinkd`)
@@ -150,11 +150,11 @@ Place the config file in your project root (or any parent directory). With the f
 - `oauthScript` – Absolute or relative path to an OAuth automation script (ESM module). When set, SweetLink loads the module at runtime and calls its `authorize(context)` export to approve third-party consent dialogs.
 
 SweetLink reads the config once at start-up. When you edit `sweetlink.json` rerun the CLI command to pick up the new defaults. Multiple projects on the same machine can keep their own config files; SweetLink stops at the first file it finds while walking up the directory tree, so place project-specific configs as close to the repo root as possible.
-See `apps/sweetlink/docs/config.md` for a full configuration reference (including environment overrides).
+See `docs/config.md` for a full configuration reference (including environment overrides).
 
 ### OAuth automation scripts
 
-Out of the box SweetLink no longer ships opinionated OAuth heuristics. Instead you can point `oauthScript` at a small ESM module that exports an `authorize(context)` function. The helper receives a `SweetLinkOauthAuthorizeContext` with DevTools and Puppeteer helpers, so you can fully control how SweetLink approves third-party consent prompts. A ready-to-use implementation for Twitter/X lives at `apps/sweetlink/examples/oauth/twitter-oauth-automation.ts`; copy it into your project (or tweak it) and set `oauthScript` to that path to re-enable the previous behaviour. If the script is omitted, SweetLink will log that auto-authorization is disabled and leave the prompt untouched.
+Out of the box SweetLink no longer ships opinionated OAuth heuristics. Instead you can point `oauthScript` at a small ESM module that exports an `authorize(context)` function. The helper receives a `SweetLinkOauthAuthorizeContext` with DevTools and Puppeteer helpers, so you can fully control how SweetLink approves third-party consent prompts. A ready-to-use implementation for Twitter/X lives at `examples/oauth/twitter-oauth-automation.ts`; copy it into your project (or tweak it) and set `oauthScript` to that path to re-enable the previous behaviour. If the script is omitted, SweetLink will log that auto-authorization is disabled and leave the prompt untouched.
 
 You can also specify the script through runtime inputs:
 
@@ -204,11 +204,11 @@ export const sweetLinkClient = createSweetLinkClient({
 
 The runtime mirrors everything we ship in production: websocket lifecycle, console buffering, screenshot hooks/renderers, selector discovery, and auto-reconnect with stored-session resume. Tests can import `sweetLinkBrowserTestHelpers` to reuse `createHookRunner`, `stripDataUrlPrefix`, and `commandSelectorSummary` without reaching into private modules.
 
-👉 See [`apps/sweetlink/browser.md`](./browser.md) for a step-by-step integration guide (handshake endpoint, custom storage adapters, DOM events) plus a reference implementation you can copy into other apps.
+👉 See [`browser.md`](./browser.md) for a step-by-step integration guide (handshake endpoint, custom storage adapters, DOM events) plus a reference implementation you can copy into other apps.
 
 ## Example App
 
-Looking for a minimal integration? Launch the demo web app under `apps/sweetlink/examples/basic-web`:
+Looking for a minimal integration? Launch the demo web app under `examples/basic-web`:
 
 ```bash
 cd examples/basic-web
@@ -239,7 +239,7 @@ pnpm test
 
 ## License
 
-SweetLink (CLI, daemon, and shared packages) is licensed under the MIT License. See `apps/sweetlink/LICENSE` for the full text.
+SweetLink (CLI, daemon, and shared packages) is licensed under the MIT License. See `LICENSE` for the full text.
 
 ## TLS Onboarding
 

package/dist/daemon/src/cli.d.ts

@@ -0,0 +1,3 @@
+export declare function isDaemonHelpRequest(args: readonly string[]): boolean;
+export declare function formatDaemonHelp(): string;
+//# sourceMappingURL=cli.d.ts.map

package/dist/daemon/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../daemon/src/cli.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEpE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CASzC"}

package/dist/daemon/src/cli.js

@@ -0,0 +1,14 @@
+export function isDaemonHelpRequest(args) {
+    return args.includes("--help") || args.includes("-h");
+}
+export function formatDaemonHelp() {
+    return [
+        "Usage: sweetlinkd [options]",
+        "",
+        "Launch the SweetLink daemon process",
+        "",
+        "Options:",
+        "  -h, --help  display help for command",
+    ].join("\n");
+}
+//# sourceMappingURL=cli.js.map

package/dist/daemon/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../daemon/src/cli.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,6BAA6B;QAC7B,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,UAAU;QACV,wCAAwC;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/daemon/src/codename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codename.d.ts","sourceRoot":"","sources":["../../../daemon/src/codename.ts"],"names":[],"mappings":"AAGA,UAAU,eAAe;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1C;AA0BD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CA0BzG"}
+{"version":3,"file":"codename.d.ts","sourceRoot":"","sources":["../../../daemon/src/codename.ts"],"names":[],"mappings":"AAGA,UAAU,eAAe;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1C;AA0BD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC1B,OAAO,GAAE,eAAoB,GAC5B,MAAM,CA0BR"}

package/dist/daemon/src/codename.js

@@ -1,22 +1,22 @@
-import { randomInt } from 'node:crypto';
-import { generateSlug } from 'random-word-slugs';
+import { randomInt } from "node:crypto";
+import { generateSlug } from "random-word-slugs";
 const MAX_ATTEMPTS = 12;
 const ensureNonEmptyString = (value, label) => {
-    if (typeof value !== 'string' || value.trim().length === 0) {
+    if (typeof value !== "string" || value.trim().length === 0) {
         throw new TypeError(`${label} must return a non-empty string`);
     }
     return value;
 };
 const defaultSlugFactory = () => {
     const slug = generateSlug(2, {
-        partsOfSpeech: ['adjective', 'noun'],
-        format: 'kebab',
+        partsOfSpeech: ["adjective", "noun"],
+        format: "kebab",
     });
-    return ensureNonEmptyString(slug, 'slugFactory');
+    return ensureNonEmptyString(slug, "slugFactory");
 };
 const defaultSaltFactory = () => randomInt(36 ** 2)
     .toString(36)
-    .padStart(2, '0');
+    .padStart(2, "0");
 const defaultTimestampFactory = () => Date.now();
 export function generateSessionCodename(existing, options = {}) {
     const used = new Set(existing);
@@ -24,18 +24,18 @@ export function generateSessionCodename(existing, options = {}) {
     const saltFactory = options.saltFactory ?? defaultSaltFactory;
     const timestampFactory = options.timestampFactory ?? defaultTimestampFactory;
     for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
-        const candidate = ensureNonEmptyString(slugFactory(), 'slugFactory');
+        const candidate = ensureNonEmptyString(slugFactory(), "slugFactory");
         if (!used.has(candidate)) {
             return candidate;
         }
     }
-    const withSalt = `${ensureNonEmptyString(slugFactory(), 'slugFactory')}-${ensureNonEmptyString(saltFactory(), 'saltFactory')}`;
+    const withSalt = `${ensureNonEmptyString(slugFactory(), "slugFactory")}-${ensureNonEmptyString(saltFactory(), "saltFactory")}`;
     if (!used.has(withSalt)) {
         return withSalt;
     }
     const timestamp = timestampFactory();
-    if (typeof timestamp !== 'number' || Number.isNaN(timestamp)) {
-        throw new TypeError('timestampFactory must return a numeric timestamp');
+    if (typeof timestamp !== "number" || Number.isNaN(timestamp)) {
+        throw new TypeError("timestampFactory must return a numeric timestamp");
     }
     return `${withSalt}-${Math.abs(timestamp).toString(36).slice(-2)}`;
 }

package/dist/daemon/src/codename.js.map

@@ -1 +1 @@
-{"version":3,"file":"codename.js","sourceRoot":"","sources":["../../../daemon/src/codename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQjD,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAE,KAAa,EAAU,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAW,EAAE;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE;QAC3B,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;QACpC,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAC9B,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;KACf,QAAQ,CAAC,EAAE,CAAC;KACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEtB,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAEjD,MAAM,UAAU,uBAAuB,CAAC,QAA0B,EAAE,UAA2B,EAAE;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;IAE7E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,oBAAoB,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,IAAI,oBAAoB,CAC5F,WAAW,EAAE,EACb,aAAa,CACd,EAAE,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"codename.js","sourceRoot":"","sources":["../../../daemon/src/codename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQjD,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAE,KAAa,EAAU,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAW,EAAE;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE;QAC3B,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;QACpC,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAC9B,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;KACf,QAAQ,CAAC,EAAE,CAAC;KACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEtB,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAEjD,MAAM,UAAU,uBAAuB,CACrC,QAA0B,EAC1B,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;IAE7E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,oBAAoB,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,IAAI,oBAAoB,CAC5F,WAAW,EAAE,EACb,aAAa,CACd,EAAE,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC"}

package/dist/daemon/src/index.d.ts

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import 'dotenv/config';
+import "dotenv/config";
 //# sourceMappingURL=index.d.ts.map