tide-commander 1.139.2 → 1.141.0

package/dist/assets/{web-KIxT1AKQ.js → web-B0Nj3gOp.js}

@@ -1 +1 @@
-import{cP as t}from"./main-CpuU-ex-.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{cQ as t}from"./main-CAE1L3Sb.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/assets/{web-f3jpYwOI.js → web-B5mCc_qm.js}

@@ -1 +1 @@
-import{cP as a}from"./main-CpuU-ex-.js";import{ImpactStyle as i,NotificationType as r}from"./index-C9wQ_Bkk.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{cQ as a}from"./main-CAE1L3Sb.js";import{ImpactStyle as i,NotificationType as r}from"./index-YDzuES6L.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/assets/{web-CQHAjGLu.js → web-CaEzTKao.js}

@@ -1 +1 @@
-import{cP as s}from"./main-CpuU-ex-.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{cQ as s}from"./main-CAE1L3Sb.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/index.html

@@ -22,10 +22,10 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-CpuU-ex-.js"></script>
+    <script type="module" crossorigin src="/assets/main-CAE1L3Sb.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
-    <link rel="stylesheet" crossorigin href="/assets/main-d2YCqass.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-BCym1dpG.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/locales/en/config.json

@@ -581,7 +581,15 @@
     "close": "Close",
     "stuckHint": "Taking longer than expected?",
     "reload": "Reload",
-    "recheck": "Recheck"
+    "recheck": "Recheck",
+    "updated": "Updated to v{{version}}",
+    "viewChangelog": "View changelog",
+    "changelogTitle": "What's new in v{{version}}",
+    "changelogTitleAll": "Changelog",
+    "changelogLoading": "Loading changelog…",
+    "changelogError": "Couldn't load the changelog.",
+    "changelogEmpty": "No release notes for this version.",
+    "viewOnGithub": "View on GitHub"
   },
   "shortcuts": {
     "pressKeys": "Press keys...",

package/dist/src/packages/server/data/builtin-skills/browser-control.js

@@ -31,10 +31,12 @@ matter what's focused. \`/console\`, \`/network\` and \`/errors\` are SCOPED to
 - **Multiple agents can drive different tabs at the same time.** Each agent must target its
   own tab by \`tab\`/\`tabId\`; never rely on "the active tab".
 - **Do NOT call \`/api/browser/tab/activate\` just to drive.** Clicks/typing/reads work on a
-  **background, unfocused tab** (the user may be on another screen/monitor) — activating
-  steals their focus and, with multiple agents, makes the tab fight over the foreground.
-  Activate ONLY if the user explicitly asks, or you need a full-viewport screenshot
-  (element-clip screenshots don't need it either).
+  **background, unfocused tab** (the user may be on another screen/monitor) — activate ONLY
+  if the user explicitly asks, or you need a full-viewport screenshot (element-clip
+  screenshots don't need it either). Note: \`/tab/activate\` now makes the tab the active
+  tab of its window WITHOUT stealing the user's OS focus (their current app stays in front) —
+  enough for \`captureVisibleTab\`. Pass \`"focusWindow":true\` to ALSO raise the window to the
+  foreground; that interrupts whatever the user is doing, so use it only when they ask.
 
 ## Reads (always available)
 - \`POST /api/browser/dom\` \`{selector, all?}\` → outerHTML/text/box/styles + **\`field\`** (live \`value\`/\`checked\`/\`selectedText\`/\`disabled\` for input/textarea/select). Read form state from \`field\`, NOT from the value attribute (React often doesn't mirror it) and NOT via \`evaluate\` (its content-script fallback is CSP-blocked). Bulky \`<svg>\` icon markup is stripped to a compact \`<svg data-icon>\` placeholder by default (token saver) — pass \`"keepSvg":true\` to keep it.
@@ -54,7 +56,7 @@ matter what's focused. \`/console\`, \`/network\` and \`/errors\` are SCOPED to
 - \`POST /api/browser/wait\` \`{selector | text | ms}\` · \`/evaluate\` \`{expression}\` → \`{value}\`
 - \`POST /api/browser/drag\` \`{from, to}\` · \`/dialog\` \`{accept?, promptText?}\` · \`/cdp-raw\` \`{method, params?}\`
 - \`POST /api/browser/batch\` \`{tab|tabId, steps:[{cmd, …}]}\` — runs ANY steps in order (mixed click/type/wait/…), stops at first failure unless the step has \`continueOnError\`. Use for non-form multi-step flows; for pure form-filling prefer \`/fill\`.
-- Tabs: \`POST /api/browser/tab/{open,close,activate}\`
+- Tabs: \`POST /api/browser/tab/{open,close,activate}\` — \`tab/open\` opens in the BACKGROUND by default (drive/read it there without interrupting the user); pass \`"active":true\` only to actually switch the user to the new tab. \`tab/activate\` won't steal OS focus unless you pass \`"focusWindow":true\`.
 
 Every call returns \`{ok:true, result}\` or \`{ok:false, error}\`. **If you pipe to \`jq\`, use
 the right paths — wrong paths return \`null\`, which is NOT the API failing** (it's your

package/dist/src/packages/server/data/builtin-skills/create-building.js

@@ -47,7 +47,7 @@ ${BT}name${BT}, ${BT}type${BT}, and ${BT}position${BT} are always required. Styl
 ${BT3}typescript
 {
   name: string,                                       // Display name
-  type: 'server'|'link'|'database'|'docker'|'monitor'|'folder'|'boss'|'terminal'|'tests',
+  type: 'server'|'link'|'database'|'docker'|'monitor'|'folder'|'boss'|'terminal'|'tests'|'http',
   position: { x: number, z: number },
   style?: 'server-rack'|'tower'|'dome'|'pyramid'|'desktop'
         | 'filing-cabinet'|'satellite'|'crystal'|'factory'|'command-center',
@@ -58,7 +58,7 @@ ${BT3}typescript
   docker?: { ... },                                   // Docker type — see below
   database?: { connections: [...] },                  // Database type
   terminal?: { ... },                                 // Terminal type
-  folderPath?: string,                                // Folder + tests types — required
+  folderPath?: string,                                // Folder + tests + http types — required
   urls?: [{ label, url }],                            // Link type — required
   commands?: { start, stop, restart, healthCheck, logs },  // Non-PM2 server custom commands
   subordinateBuildingIds?: string[],                  // Boss type
@@ -221,6 +221,11 @@ Requires ${BT}ttyd${BT} installed; ${BT}saveSession: true${BT} also needs ${BT}t
 - ${BT}{"name":"Docs","type":"link","style":"tower","position":{"x":10,"z":0},"urls":[{"label":"Internal Wiki","url":"https://wiki.example.com"}]}${BT}
 - ${BT}{"name":"Host Metrics","type":"monitor","style":"satellite","position":{"x":12,"z":4}}${BT}
 
+### Tests / HTTP requests
+
+- Tests browser (scan + run a folder's test suite): ${BT}{"name":"Core Tests","type":"tests","style":"dome","position":{"x":6,"z":3},"folderPath":"/home/user/projects/core"}${BT}
+- HTTP request tests (IntelliJ-style .http file runner; picks up ${BT}http-client.env.json${BT} / ${BT}http-client.private.env.json${BT} environments in the folder): ${BT}{"name":"Core API Requests","type":"http","style":"satellite","position":{"x":7,"z":3},"folderPath":"/home/user/projects/core/http-requests"}${BT}
+
 ### Boss
 
 Subordinates must already exist — get their IDs from ${BT}GET /api/buildings${BT} first.

package/dist/src/packages/server/data/builtin-skills/http-requests.js

@@ -0,0 +1,51 @@
+export const httpRequests = {
+    slug: 'http-requests',
+    name: 'HTTP Request Tests',
+    description: 'Browse and fire IntelliJ-style .http request files via the Tide Commander http-requests API; results render as rich cards in the terminal (method, status, timing, body preview).',
+    allowedTools: ['Bash(curl:*)', 'Bash(jq:*)'],
+    // Not assigned to anyone by default — enable it per agent/class in the Skills panel.
+    assignedAgentClasses: [],
+    content: `# HTTP Request Tests
+
+Run requests from IntelliJ-style \`.http\` / \`.rest\` files through \`/api/http-requests/*\` (never by hand-crafting the HTTP call yourself) so each result is persisted to the building's history and renders as a **rich card** in the user's terminal — method, status pill, timing, size and a body preview instead of raw JSON.
+
+Use this when asked to fire/test HTTP requests from a project's \`.http\` files, smoke-test API endpoints defined there, or report on past request runs. The folder usually comes from an \`http\`-type building — find it with \`GET /api/buildings\` (look for \`"type":"http"\`, use its \`folderPath\`).
+
+All calls use the API Calling Convention scaffolding (host, \`-H "X-Auth-Token: ..."\`). No exclamation marks in commands.
+
+## 1. Scan — list files, requests and environments
+
+\`POST /api/http-requests/scan\`
+\`\`\`json
+{"path":"/abs/path/to/http-folder"}
+\`\`\`
+Returns every parsed file with its requests (0-based \`index\`, \`name\`, \`method\`, \`url\`, \`variables\`) plus \`environments\` (from \`http-client.env.json\` / \`http-client.private.env.json\`) and \`envFiles\`. Pipe through \`jq\` to keep it short, e.g. \`jq '{environments, files: [.files[] | {relFile, requests: [.requests[] | {index, name, method}]}]}'\`.
+
+## 2. Run one request
+
+\`POST /api/http-requests/run\`
+\`\`\`json
+{"agentId":"YOUR_AGENT_ID","path":"/abs/path/to/http-folder","relFile":"payment-order.http","requestIndex":2,"env":"dev"}
+\`\`\`
+- \`agentId\` (IMPORTANT) — your agent ID from the system prompt. With it, a live card appears in the user's terminal under your curl the moment the request fires (spinner → method/status/time/body, with Re-run and copy-curl buttons). Without it, nothing renders.
+- \`requestIndex\` — the request's 0-based \`index\` from the scan.
+- \`env\` (optional but usually required) — environment name for \`{{variable}}\` resolution; omit only when the file has no variables. \`unresolvedVariables\` in the response tells you what was missing.
+
+Synchronous: the response IS the result (\`ok\`, \`status\`, \`timeMs\`, \`sizeBytes\`, \`headers\`, \`body\`, resolved \`request\`, \`runId\`). 60s timeout, 2 MB body cap.
+
+Silence the response with \`-o /dev/null\` if you don't need to inspect it (the card already shows everything to the user), or print it as-is (plain \`curl -s\`, no jq filter) — printed run JSON also renders as a card. To READ a field yourself, fetch \`GET /runs/RUN_ID\` afterwards and jq that.
+
+## 3. Run several / "run all in a file"
+
+Run each request as its OWN curl command (one Bash call per request, agentId included) so every run gets its own live card in the terminal. Avoid shell for-loops — a loop is a single Bash line, so only the last run's card would attach to it. Do not parallelize.
+
+## 4. History
+
+\`GET /api/http-requests/history?folder=/abs/path&limit=20\` — recent executed requests for that folder (newest first). Printing this JSON also renders as a card (compact list of runs). \`GET /api/http-requests/runs/RUN_ID\` returns one stored run with the full request/response detail.
+
+## Rules
+- A non-2xx status or \`"ok":false\` (connection refused, timeout) is a **normal result to report**, not an API error — summarize which requests passed/failed and why.
+- Prefer the building's configured folder; for ad-hoc paths anything under the home directory works.
+- Requests hit real endpoints. Fire GETs freely; for POST/PUT/PATCH/DELETE against non-test systems, confirm with the user first unless they explicitly asked.
+- After a batch, finish with a short written summary (counts + failures); the cards complement it, they don't replace it.`,
+};

package/dist/src/packages/server/data/builtin-skills/index.js

@@ -29,6 +29,7 @@ import { workflowBuilder } from './workflow-builder.js';
 import { backupRestore } from './backup-restore.js';
 import { browserControl } from './browser-control.js';
 import { runTests } from './run-tests.js';
+import { httpRequests } from './http-requests.js';
 /**
  * All built-in skills that ship with Tide Commander
  */
@@ -57,6 +58,7 @@ export const BUILTIN_SKILLS = [
     backupRestore,
     browserControl,
     runTests,
+    httpRequests,
 ];
 /**
  * Get the ID for a built-in skill based on its slug

package/dist/src/packages/server/data/builtin-skills/release-pipeline.js

@@ -62,6 +62,13 @@ git pull --rebase origin $(git branch --show-current)
 \`\`\`
 On conflicts: STOP immediately and report. Do NOT auto-resolve.
 
+Verify the changelog packaging contract (fail fast — before doing any build/publish work):
+
+\`\`\`bash
+npm pkg get files | grep -q '"CHANGELOG.md"' || echo "MISSING: CHANGELOG.md not in package.json files"
+\`\`\`
+\`CHANGELOG.md\` MUST be listed in package.json \`files\`. It ships in the npm tarball and is served by the server at \`GET /api/system/changelog\`; the in-app changelog (post-update banner + Settings → About) reads this local packaged file instead of the GitHub API, which 403'd on rate limits (60 req/hour). If the check prints \`MISSING\`: STOP and report — do NOT publish, or the in-app changelog breaks.
+
 ### Phase 2: Quality Gates (3 parallel sub-agents)
 
 Spawn all 3 Agent calls in a single response, each using the curl template above with its command, checking output and exitCode, and instructed not to fix any issues:
@@ -105,7 +112,7 @@ npm version <patch|minor|major> --no-git-tag-version
 git log --oneline $(git describe --tags --abbrev=0 2>/dev/null || echo "HEAD~20")..HEAD
 \`\`\`
 
-Add the new version entry at the top of \`CHANGELOG.md\` (below the header), Keep a Changelog format. Only include sections that have entries; write concise, user-facing descriptions.
+Add the new version entry at the top of \`CHANGELOG.md\` (directly below the \`# Changelog\` header), Keep a Changelog format. Only include sections that have entries; write concise, user-facing descriptions. The changelog is a committed, packaged (package.json \`files\`), server-served artifact — it MUST be updated every release so the bundled file stays current.
 
 \`\`\`markdown
 ## [X.Y.Z] - YYYY-MM-DD
@@ -123,6 +130,8 @@ Add the new version entry at the top of \`CHANGELOG.md\` (below the header), Kee
 - (from \`remove:\` or \`delete:\` commits)
 \`\`\`
 
+CRITICAL — keep the per-version header EXACTLY \`## [X.Y.Z] - YYYY-MM-DD\` (Keep a Changelog): one header per release, newest at the top. The in-app changelog modal extracts a single release by matching the line \`## [X.Y.Z]\`; any other header format breaks the per-version view (the full-changelog view still works). Do NOT drop the \`[\` \`]\` brackets, the version number, or change the \` - YYYY-MM-DD\` suffix.
+
 ### Phase 6: Commit, Tag, Push (run yourself — sequential git ops)
 
 \`\`\`bash

package/dist/src/packages/server/data/index.js

@@ -923,3 +923,68 @@ export function saveTestRun(run) {
         log.error(' Failed to save test run:', err);
     }
 }
+// ============================================================================
+// HTTP Run History (persisted to http-runs/ — one file per run + an index)
+// Mirrors the test-run history above for the "http" (.http requests) building.
+// ============================================================================
+const HTTP_RUNS_DIR = path.join(DATA_DIR, 'http-runs');
+const HTTP_RUNS_INDEX_FILE = path.join(HTTP_RUNS_DIR, 'index.json');
+const MAX_HTTP_RUNS = 300;
+function ensureHttpRunsDir() {
+    if (!fs.existsSync(HTTP_RUNS_DIR)) {
+        fs.mkdirSync(HTTP_RUNS_DIR, { recursive: true });
+        log.log(` Created http runs directory: ${HTTP_RUNS_DIR}`);
+    }
+}
+function getHttpRunFile(runId) {
+    return path.join(HTTP_RUNS_DIR, `${runId}.json`);
+}
+function summarizeHttpRun(run) {
+    const { result: _result, ...summary } = run;
+    return summary;
+}
+/** List recent http runs (newest first); optionally scoped to one folder. */
+export function loadHttpRunSummaries(limit = 50, folder) {
+    ensureHttpRunsDir();
+    const data = safeReadJsonSync(HTTP_RUNS_INDEX_FILE, 'Http runs index');
+    let runs = data?.runs || [];
+    if (folder)
+        runs = runs.filter((r) => r.folder === folder);
+    return limit > 0 ? runs.slice(0, limit) : runs;
+}
+/** Read a single stored http run (full request/response detail) by id. */
+export function loadHttpRun(runId) {
+    return safeReadJsonSync(getHttpRunFile(runId), `Http run ${runId}`);
+}
+/**
+ * Persist an executed request: write its full file, prepend a summary to the
+ * index, cap at MAX_HTTP_RUNS, prune per-run files that fell out.
+ */
+export function saveHttpRun(run) {
+    ensureHttpRunsDir();
+    try {
+        atomicWriteJsonSync(getHttpRunFile(run.runId), run);
+        const existing = loadHttpRunSummaries(0).filter((r) => r.runId !== run.runId);
+        const runs = [summarizeHttpRun(run), ...existing];
+        const kept = runs.slice(0, MAX_HTTP_RUNS);
+        const dropped = runs.slice(MAX_HTTP_RUNS);
+        atomicWriteJsonSync(HTTP_RUNS_INDEX_FILE, {
+            runs: kept,
+            savedAt: Date.now(),
+            version: '1.0.0',
+        });
+        for (const d of dropped) {
+            try {
+                const f = getHttpRunFile(d.runId);
+                if (fs.existsSync(f))
+                    fs.unlinkSync(f);
+            }
+            catch {
+                // best-effort prune
+            }
+        }
+    }
+    catch (err) {
+        log.error(' Failed to save http run:', err);
+    }
+}

package/dist/src/packages/server/routes/browser.js

@@ -139,7 +139,10 @@ router.post('/cdp-raw', (req, res) => relay(res, 'cdp_raw', { ...target(req), me
 // ── tabs (open / close / activate) ──
 router.post('/tab/open', (req, res) => relay(res, 'tab_open', { url: req.body?.url, active: req.body?.active }));
 router.post('/tab/close', (req, res) => relay(res, 'tab_close', target(req)));
-router.post('/tab/activate', (req, res) => relay(res, 'tab_activate', target(req)));
+// Activating a tab makes it the ACTIVE tab of its window (so full-viewport screenshots
+// work) WITHOUT stealing the user's OS focus. Pass focusWindow:true to also raise the
+// window to the foreground (interrupts whatever the user is doing) — opt-in only.
+router.post('/tab/activate', (req, res) => relay(res, 'tab_activate', { ...target(req), focusWindow: req.body?.focusWindow }));
 // ── fallback: drive a SEPARATE Chrome via puppeteer-core over the debug port ──
 // For a throwaway --user-data-dir profile or Chrome for Testing (not your live
 // session). Requires Chrome launched with --remote-debugging-port. See cdp-service.ts.

package/dist/src/packages/server/routes/http-requests.js

@@ -0,0 +1,148 @@
+/**
+ * HTTP Request Tests Routes (IntelliJ-style .http files)
+ *
+ * REST API for the "http" building: scan a folder for .http files and fire
+ * individual requests. Runs are synchronous — a single HTTP request resolves
+ * quickly (60s server-side timeout), so no runId/WebSocket plumbing is needed.
+ */
+import { Router } from 'express';
+import { httpRequestsService } from '../services/index.js';
+import { createLogger, generateId } from '../utils/index.js';
+import { saveHttpRun, loadHttpRun, loadHttpRunSummaries } from '../data/index.js';
+const log = createLogger('HttpRequestsRoute');
+const router = Router();
+// Store for broadcasting via WebSocket (wired from the websocket handler).
+let broadcastFn = null;
+export function setBroadcast(fn) {
+    broadcastFn = fn;
+}
+function broadcast(message) {
+    broadcastFn?.(message);
+}
+/**
+ * POST /api/http-requests/scan - Parse every .http/.rest file under a folder.
+ * Body: { path: string }
+ */
+router.post('/scan', (req, res) => {
+    const { path: targetPath } = req.body;
+    if (!targetPath) {
+        res.status(400).json({ error: 'Missing required field: path' });
+        return;
+    }
+    if (!httpRequestsService.isSafeFolder(targetPath)) {
+        res.status(400).json({ error: 'Refusing to scan folders outside your home directory.' });
+        return;
+    }
+    res.json(httpRequestsService.scanFolder(targetPath));
+});
+/**
+ * POST /api/http-requests/run - Execute one request from a .http file.
+ * Body: { path, relFile, requestIndex, env? } — responds with HttpRunResult
+ * once the request completes (or fails / times out).
+ */
+router.post('/run', async (req, res) => {
+    const { path: targetPath, relFile, requestIndex, env, agentId } = req.body;
+    if (!targetPath || !relFile || typeof requestIndex !== 'number') {
+        res.status(400).json({ error: 'Missing required fields: path, relFile, requestIndex' });
+        return;
+    }
+    if (!httpRequestsService.isSafeFolder(targetPath)) {
+        res.status(400).json({ error: 'Refusing to run requests outside your home directory.' });
+        return;
+    }
+    const startAgentId = typeof agentId === 'string' && agentId ? agentId : undefined;
+    const runId = generateId();
+    try {
+        // Announce the run when an agent fired it, so its terminal shows a live
+        // inline card immediately (spinner → result), like test runs.
+        if (startAgentId) {
+            const item = httpRequestsService.peekRequest(targetPath, relFile, requestIndex);
+            broadcast({
+                type: 'http_run_started',
+                payload: {
+                    runId,
+                    agentId: startAgentId,
+                    folder: targetPath,
+                    relFile,
+                    requestIndex,
+                    requestName: item?.name || `${relFile}#${requestIndex}`,
+                    method: item?.method || 'GET',
+                    url: item?.url || '',
+                    env,
+                },
+            });
+        }
+        const result = await httpRequestsService.executeRequest(targetPath, relFile, requestIndex, env);
+        log.log(`${result.request.method} ${result.request.url} → ` +
+            (result.ok ? `${result.status} in ${result.timeMs}ms` : `error: ${result.error}`));
+        // Persist to history (best-effort — the response never waits on failures
+        // beyond the synchronous write).
+        const stored = {
+            runId,
+            folder: targetPath,
+            relFile,
+            requestIndex,
+            requestName: result.requestName || `${result.request.method} ${result.request.url}`,
+            method: result.request.method,
+            url: result.request.url,
+            env,
+            ok: result.ok,
+            status: result.status,
+            timeMs: result.timeMs,
+            sizeBytes: result.sizeBytes,
+            error: result.error,
+            finishedAt: Date.now(),
+            result,
+        };
+        saveHttpRun(stored);
+        if (startAgentId) {
+            broadcast({
+                type: 'http_run_completed',
+                payload: { runId, agentId: startAgentId, result },
+            });
+        }
+        res.json({ ...result, runId });
+    }
+    catch (err) {
+        // Close the inline card on hard failures too (parse error, missing file).
+        if (startAgentId) {
+            broadcast({
+                type: 'http_run_completed',
+                payload: {
+                    runId,
+                    agentId: startAgentId,
+                    result: {
+                        ok: false,
+                        request: { method: 'GET', url: '', headers: [] },
+                        timeMs: 0,
+                        error: err?.message || 'Failed to run request',
+                    },
+                },
+            });
+        }
+        res.status(400).json({ error: err?.message || 'Failed to run request' });
+    }
+});
+/**
+ * GET /api/http-requests/history - Recent executed requests (newest first).
+ * Query: ?folder=<abs path> scopes to one building's folder; ?limit=N (default
+ * 50, max 200). Summaries only — fetch /runs/:runId for the full detail.
+ */
+router.get('/history', (req, res) => {
+    const raw = parseInt(req.query.limit, 10);
+    const limit = Number.isFinite(raw) && raw > 0 ? Math.min(raw, 200) : 50;
+    const folder = typeof req.query.folder === 'string' && req.query.folder ? req.query.folder : undefined;
+    res.json({ runs: loadHttpRunSummaries(limit, folder) });
+});
+/**
+ * GET /api/http-requests/runs/:runId - Full stored run (request + response).
+ */
+router.get('/runs/:runId', (req, res) => {
+    const run = loadHttpRun(req.params.runId);
+    if (!run) {
+        res.status(404).json({ error: 'Run not found' });
+        return;
+    }
+    res.json(run);
+});
+export default router;

package/dist/src/packages/server/routes/index.js

@@ -11,6 +11,7 @@ import agentPromptRouter from './agent-prompt.js';
 import notificationsRouter, { setBroadcast as setNotificationBroadcast } from './notifications.js';
 import execRouter, { setBroadcast as setExecBroadcast } from './exec.js';
 import testsRouter, { setBroadcast as setTestsBroadcast } from './tests.js';
+import httpRequestsRouter, { setBroadcast as setHttpRequestsBroadcast } from './http-requests.js';
 import focusAgentRouter, { setBroadcast as setFocusAgentBroadcast } from './focus-agent.js';
 import customModelsRouter from './custom-models.js';
 import configRouter from './config.js';
@@ -44,6 +45,7 @@ router.use('/folders', foldersRouter);
 router.use('/notify', notificationsRouter);
 router.use('/exec', execRouter);
 router.use('/tests', testsRouter);
+router.use('/http-requests', httpRequestsRouter);
 router.use('/focus-agent', focusAgentRouter);
 router.use('/custom-models', customModelsRouter);
 router.use('/tts', ttsRouter);
@@ -83,5 +85,5 @@ router.use('/', permissionsRouter);
 // Agent prompt routes — root-level: /api/agent-prompt and /api/agent-prompt/:id/respond
 router.use('/', agentPromptRouter);
 // Export the broadcast setters for WebSocket handler to use
-export { setNotificationBroadcast, setExecBroadcast, setTestsBroadcast, setFocusAgentBroadcast, setAgentsBroadcast, setTriggerBroadcast, setBuildingsBroadcast, setSkillsBroadcast };
+export { setNotificationBroadcast, setExecBroadcast, setTestsBroadcast, setHttpRequestsBroadcast, setFocusAgentBroadcast, setAgentsBroadcast, setTriggerBroadcast, setBuildingsBroadcast, setSkillsBroadcast };
 export default router;

package/dist/src/packages/server/routes/system.js

@@ -3,6 +3,8 @@
  * Endpoints for inspecting / updating the running Tide Commander install.
  */
 import { Router } from 'express';
+import * as fs from 'fs';
+import * as path from 'path';
 import { createLogger } from '../utils/logger.js';
 import { fetchLatestNpmVersion, getVersionRelation } from '../../shared/version.js';
 import { getInstallInfo, isAutoUpdateSupported, runNpmGlobalUpdate, schedulePostUpdateRestart, } from '../services/self-update-service.js';
@@ -45,6 +47,34 @@ router.get('/install-info', async (_req, res) => {
         res.status(500).json({ error: message });
     }
 });
+/**
+ * GET /api/system/changelog
+ *
+ * Serves the bundled CHANGELOG.md (Keep a Changelog markdown) so the UI can
+ * render release notes locally — no GitHub API, no rate limits, works offline
+ * and always matches the installed version.
+ */
+router.get('/changelog', (_req, res) => {
+    try {
+        const installRoot = getInstallInfo().installRoot;
+        if (!installRoot) {
+            res.status(404).json({ error: 'Could not locate install root.' });
+            return;
+        }
+        const changelogPath = path.join(installRoot, 'CHANGELOG.md');
+        if (!fs.existsSync(changelogPath)) {
+            res.status(404).json({ error: 'CHANGELOG.md not found.' });
+            return;
+        }
+        const content = fs.readFileSync(changelogPath, 'utf8');
+        res.type('text/markdown').send(content);
+    }
+    catch (err) {
+        const message = err.message;
+        log.error(`Failed to read changelog: ${message}`);
+        res.status(500).json({ error: message });
+    }
+});
 /**
  * POST /api/system/self-update
  *

package/dist/src/packages/server/services/building-service.js

@@ -1088,7 +1088,7 @@ export async function handleBuildingSync(newBuildings, _broadcast) {
 // Validation & CRUD (Phase 1 - REST API support)
 // ============================================================================
 const VALID_TYPES = new Set([
-    'server', 'link', 'database', 'docker', 'monitor', 'folder', 'boss', 'terminal', 'tests',
+    'server', 'link', 'database', 'docker', 'monitor', 'folder', 'boss', 'terminal', 'tests', 'http',
 ]);
 const VALID_STYLES = new Set([
     'server-rack', 'tower', 'dome', 'pyramid', 'desktop',
@@ -1113,6 +1113,7 @@ const DEFAULT_STYLE_BY_TYPE = {
     boss: 'command-center',
     terminal: 'desktop',
     tests: 'dome',
+    http: 'satellite',
 };
 function generateBuildingId(name) {
     const slug = name
@@ -1203,6 +1204,9 @@ export function validateBuilding(input) {
     if (input.type === 'tests' && !input.folderPath) {
         errors.push('folderPath is required for tests buildings (the folder whose tests it browses)');
     }
+    if (input.type === 'http' && !input.folderPath) {
+        errors.push('folderPath is required for http buildings (the folder containing the .http request files)');
+    }
     if (input.type === 'link' && (!input.urls || input.urls.length === 0)) {
         errors.push('urls is required (non-empty array) for link buildings');
     }