viveworker 0.7.0-beta.1 → 0.7.0-beta.3

package/web/hazbase-passkey.js

@@ -0,0 +1,107 @@
+function ensureBrowserSupport() {
+  if (typeof window === 'undefined' || typeof navigator === 'undefined' || !navigator.credentials) {
+    throw new Error('WebAuthn is only available in a browser environment');
+  }
+}
+
+function toBase64url(input) {
+  if (!input) throw new Error('Expected binary data from WebAuthn response');
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+function fromBase64url(input) {
+  const normalized = String(input || '').replace(/-/g, '+').replace(/_/g, '/');
+  const padding = normalized.length % 4 === 0 ? '' : '='.repeat(4 - (normalized.length % 4));
+  const binary = atob(normalized + padding);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+function algorithmFromCode(code) {
+  if (code === -257) return 'RS256';
+  return 'ES256';
+}
+
+export async function createPasskeyRegistrationCredential(challenge) {
+  ensureBrowserSupport();
+  const credential = await navigator.credentials.create({
+    publicKey: {
+      challenge: fromBase64url(challenge.challenge),
+      rp: { id: challenge.rpId, name: challenge.rpName },
+      user: {
+        id: fromBase64url(challenge.userHandle),
+        name: challenge.userName,
+        displayName: challenge.userDisplayName,
+      },
+      pubKeyCredParams: [
+        { type: 'public-key', alg: -7 },
+        { type: 'public-key', alg: -257 },
+      ],
+      timeout: challenge.timeoutMs,
+      authenticatorSelection: {
+        userVerification: 'required',
+        residentKey: 'preferred',
+      },
+      attestation: 'none',
+      excludeCredentials: (challenge.excludeCredentialIds || []).map((credentialId) => ({
+        id: fromBase64url(credentialId),
+        type: 'public-key',
+      })),
+    },
+  });
+
+  if (!(credential instanceof PublicKeyCredential)) {
+    throw new Error('Passkey registration failed');
+  }
+  const response = credential.response;
+  const publicKey = response.getPublicKey?.();
+  const algorithm = response.getPublicKeyAlgorithm?.();
+  const authenticatorData = response.getAuthenticatorData?.();
+  if (!publicKey || algorithm == null || !authenticatorData) {
+    throw new Error('This browser does not expose the WebAuthn attestation details required by hazBase');
+  }
+
+  return {
+    username: challenge.userName,
+    credential: {
+      id: credential.id,
+      publicKey: toBase64url(publicKey),
+      algorithm: algorithmFromCode(algorithm),
+    },
+    authenticatorData: toBase64url(authenticatorData),
+    clientData: toBase64url(response.clientDataJSON),
+    attestationData: toBase64url(response.attestationObject),
+  };
+}
+
+export async function createPasskeyAssertionCredential(challenge) {
+  ensureBrowserSupport();
+  const credential = await navigator.credentials.get({
+    publicKey: {
+      challenge: fromBase64url(challenge.challenge),
+      rpId: challenge.rpId,
+      userVerification: 'required',
+      timeout: challenge.timeoutMs,
+      allowCredentials: (challenge.credentialIds || []).map((credentialId) => ({
+        id: fromBase64url(credentialId),
+        type: 'public-key',
+      })),
+    },
+  });
+
+  if (!(credential instanceof PublicKeyCredential)) {
+    throw new Error('Passkey assertion failed');
+  }
+  const response = credential.response;
+  return {
+    credentialId: credential.id,
+    authenticatorData: toBase64url(response.authenticatorData),
+    clientData: toBase64url(response.clientDataJSON),
+    signature: toBase64url(response.signature),
+    ...(response.userHandle ? { userHandle: toBase64url(response.userHandle) } : {}),
+  };
+}

package/web/i18n.js

@@ -135,6 +135,26 @@ const translations = {
     "detail.planReady": "Plan is ready.",
     "detail.previousMessage": "Previous message",
     "detail.interruptedTask": "Interrupted task",
+    "detail.autoPilotManualEyebrow": "Auto Pilot",
+    "detail.autoPilot.manualTitle": "Why this stayed manual",
+    "detail.autoPilot.writeDisabled": "Low-risk writes is off right now, so file changes still wait for manual approval.",
+    "detail.autoPilot.writeMissingWorkspace": "Auto Pilot could not confirm a current workspace for this file change.",
+    "detail.autoPilot.writeMissingDiff": "The file change did not include a usable diff, so Auto Pilot left it for manual review.",
+    "detail.autoPilot.writeMissingFiles": "The file change did not include any referenced files for Auto Pilot to check.",
+    "detail.autoPilot.writeInvalidFiles": "The referenced files were outside the current workspace or matched a protected path.",
+    "detail.autoPilot.writeDiffTooLarge": "This diff is larger than the current low-risk write limits.",
+    "detail.autoPilot.writeDiffUnreadable": "Auto Pilot could not parse the diff into a safe file-level change.",
+    "detail.autoPilot.writeDangerousDiff": "This diff included create, delete, rename, mode, or binary markers that stay manual.",
+    "detail.autoPilot.writeDiffMismatch": "The diff headers did not line up cleanly with the referenced files, so Auto Pilot left it for manual review.",
+    "detail.autoPilot.writeContentDisabled": "This looks like a Content & copy change, but that lane is currently off.",
+    "detail.autoPilot.writeUiDisabled": "This looks like a UI & tests change, but that lane is currently off.",
+    "detail.autoPilot.writeUiUnsafe": "This UI/test diff added imports or higher-risk APIs, so it stayed manual.",
+    "detail.autoPilot.writeUiTooLarge": "UI & tests only covers small diffs, and this one was larger than that lane allows.",
+    "detail.autoPilot.writeSourceDisabled": "This looks like a Small code patch, but that beta lane is currently off.",
+    "detail.autoPilot.writeSourceUnsafe": "This source diff added a higher-risk API or secret-like token, so it stayed manual.",
+    "detail.autoPilot.writeSourceTooLarge": "Small code patches only covers very small single-file diffs.",
+    "detail.autoPilot.writeSourceContinuity": "Small code patches needs a recent read of the same file in this thread before Auto Pilot will approve it.",
+    "detail.autoPilot.writeNoLaneMatch": "This change did not fit any enabled low-risk write lane in the current workspace.",
     "detail.imageAlt": ({ index }) => `Attached image ${index}`,
     "detail.filesTitle": "Files",
     "detail.diffTitle": "Diff",
@@ -312,6 +332,35 @@ const translations = {
     "settings.awayMode.title": "Sync mode",
     "settings.awayMode.copy": "Let Claude's plan approvals and questions be answered from either your PC browser or any paired device, whichever you reach first.",
     "settings.awayMode.codexNote": "Codex requires no configuration: approvals and prompts can already be handled from either the desktop or any paired device.",
+    "settings.autoPilot.title": "Auto Pilot",
+    "settings.autoPilot.copy": "Choose which safe approvals viveworker can handle for you in the current workspace.",
+    "settings.autoPilot.trustedReadsTitle": "Safe reads",
+    "settings.autoPilot.trustedReadsDescription": "Auto-approve workspace-only reads such as rg, find, git diff, git show, and sed -n.",
+    "settings.autoPilot.trustedWritesTitle": "Low-risk writes",
+    "settings.autoPilot.trustedWritesDescription": "Choose which write lanes Auto Pilot can handle in the current workspace.",
+    "settings.autoPilot.writeLaneContentTitle": "Content & copy",
+    "settings.autoPilot.writeLaneContentDescription": "Docs, markdown, and i18n/copy files.",
+    "settings.autoPilot.writeLaneUiTestsTitle": "UI & tests",
+    "settings.autoPilot.writeLaneUiTestsDescription": "Small CSS, web/component UI changes, and test-only diffs.",
+    "settings.autoPilot.writeLaneSourceTitle": "Small code patches (beta)",
+    "settings.autoPilot.writeLaneSourceDescription": "Single-file source edits with tighter diff and safety rules.",
+    "settings.autoPilot.scopeNote": "Secrets, config, deploy, auth, payments, networked changes, and anything outside the current workspace still require manual approval.",
+    "settings.autoPilot.recentTitle": "Recent auto-approved actions",
+    "settings.autoPilot.recentEmpty": "Nothing has been auto-approved yet. Recent reads and writes will appear here once Auto Pilot starts handling them.",
+    "settings.autoPilot.recentRead": "Read",
+    "settings.autoPilot.recentWrite": "Write",
+    "settings.autoPilot.recentContent": "Content & copy",
+    "settings.autoPilot.recentUiTests": "UI & tests",
+    "settings.autoPilot.recentSource": "Small code patch",
+    "settings.autoPilot.suggestionsTitle": "Suggested next",
+    "settings.autoPilot.suggestionsEmpty": "Keep using viveworker normally. Suggestions will appear here once repeated manual approvals show a clear pattern.",
+    "settings.autoPilot.suggestionEnable": "Enable",
+    "settings.autoPilot.suggestionContentTitle": "Turn on Content & copy",
+    "settings.autoPilot.suggestionContentBody": ({ count }) => `${count} recent manual approvals matched docs, markdown, or i18n/copy edits.`,
+    "settings.autoPilot.suggestionUiTestsTitle": "Turn on UI & tests",
+    "settings.autoPilot.suggestionUiTestsBody": ({ count }) => `${count} recent manual approvals matched small UI or test diffs.`,
+    "settings.autoPilot.suggestionSourceTitle": "Turn on Small code patches (beta)",
+    "settings.autoPilot.suggestionSourceBody": ({ count }) => `${count} recent manual approvals matched small single-file source patches.`,
     "settings.notifications.copy":
       "Keep approvals, plans, questions, and completions within reach even when viveworker is in the background.",
     "settings.notifications.serverDisabled": "Web Push is not enabled on the server yet.",
@@ -374,6 +423,8 @@ const translations = {
     "settings.row.currentDeviceSubscribed": "This device subscribed",
     "settings.row.lastSuccessfulDelivery": "Last successful delivery",
     "settings.row.version": "Version",
+    "settings.updateAvailable.title": "New version available",
+    "settings.updateAvailable.copy": "viveworker v{latest} is available. You are currently using v{current}.",
     "settings.row.currentLanguage": "Current language",
     "settings.row.languageSource": "Language source",
     "settings.row.defaultLanguage": "Setup default",
@@ -461,6 +512,77 @@ const translations = {
     "settings.a2aShare.expired": "Expired",
     "settings.a2aShare.status.unreachable": "Unreachable",
     "settings.a2aShare.error": "Upstream fetch failed: {reason}",
+    "settings.wallet.title": "Wallet",
+    "settings.wallet.subtitle": "Sign-in, passkey, Base addresses",
+    "settings.wallet.copy": "Manage your wallet sign-in, passkey, and Base addresses.",
+    "settings.wallet.unavailable": "Wallet is not configured for this viveworker instance.",
+    "settings.wallet.summary.title": "Current status",
+    "settings.wallet.flow.title": "Recommended order",
+    "settings.wallet.flow.banner.title": "Let's set up your wallet",
+    "settings.wallet.flow.copy": "You need to activate your wallet to exchange task rewards over A2A.",
+    "settings.wallet.sessionExpired.title": "Refresh your wallet session",
+    "settings.wallet.sessionExpired.copy": "Your wallet session expired. Sign in again with a one-time password; your passkey and Base Sepolia address stay linked.",
+    "settings.wallet.ready.title": "Ready to use",
+    "settings.wallet.ready.copy": "Your email sign-in, passkey, and Base Sepolia wallet are all set.",
+    "settings.wallet.ready.payoutIntro": "Agents will use this address for payouts:",
+    "settings.wallet.ready.copyAddress": "Tap to copy address",
+    "settings.wallet.advanced.title": "Account actions",
+    "settings.wallet.stepNumber": ({ count }) => `Step ${count}`,
+    "settings.wallet.status.complete": "Done",
+    "settings.wallet.status.current": "Do next",
+    "settings.wallet.status.pending": "Pending",
+    "settings.wallet.status.locked": "Waiting",
+    "settings.wallet.status.optional": "Optional",
+    "settings.wallet.step.signIn.title": "Sign in with email",
+    "settings.wallet.step.signIn.copy": "Send a one-time password to your email, then enter it here to sign in to your wallet.",
+    "settings.wallet.step.refreshSession.title": "Refresh session",
+    "settings.wallet.step.refreshSession.copy": "Send a new one-time password and sign in again before continuing wallet actions.",
+    "settings.wallet.step.passkey.title": "Register a passkey",
+    "settings.wallet.step.passkey.copy": "Register a passkey on this device. You will use it for wallet issuance and sensitive wallet actions.",
+    "settings.wallet.step.baseSepolia.title": "Issue a Base Sepolia wallet",
+    "settings.wallet.step.baseSepolia.copy": "Create a testing wallet for the current beta flow. This is the main wallet we recommend issuing first.",
+    "settings.wallet.step.base.title": "Issue a Base wallet",
+    "settings.wallet.step.base.copy": "Create a Base mainnet wallet when you are ready for production payouts. This step is optional for now.",
+    "settings.wallet.mainnet.optIn": "Also set up Base mainnet",
+    "settings.wallet.mainnet.optInHint": "Optional — required only for production payouts.",
+    "settings.hazbase.title": "Wallet",
+    "settings.hazbase.status.signedOut": "Signed out",
+    "settings.hazbase.status.signedIn": "Signed in",
+    "settings.hazbase.status.sessionExpired": "Session expired",
+    "settings.hazbase.status.otpAwaitingVerify": "Sent. Check your inbox, then enter the code below.",
+    "settings.hazbase.passkey.ready": "Registered on this device",
+    "settings.hazbase.passkey.missing": "Not registered yet",
+    "settings.hazbase.passkey.localHostRequired": "Open viveworker on its .local hostname to register a passkey.",
+    "settings.hazbase.wallet.missing": "Not issued yet",
+    "settings.hazbase.field.emailLabel": "Email address",
+    "settings.hazbase.field.emailPlaceholder": "you@example.com",
+    "settings.hazbase.field.otpLabel": "One-time password",
+    "settings.hazbase.field.otpPlaceholder": "e.g. 123456",
+    "settings.hazbase.action.requestOtp": "Send one-time password",
+    "settings.hazbase.action.refreshSession": "Refresh session",
+    "settings.hazbase.action.resendOtp": "Resend",
+    "settings.hazbase.action.verifyOtp": "Sign in",
+    "settings.hazbase.action.changeEmail": "Change email",
+    "settings.hazbase.action.registerPasskey": "Register passkey",
+    "settings.hazbase.action.bootstrapBaseSepolia": "Issue Base Sepolia",
+    "settings.hazbase.action.bootstrapBase": "Issue Base",
+    "settings.hazbase.action.signOut": "Sign out of wallet",
+    "settings.hazbase.logout.confirm.title": "Sign out of wallet?",
+    "settings.hazbase.logout.confirm.copy": "You'll need to sign back in with a one-time password to access this wallet again. Your wallet address and passkey stay linked to this account.",
+    "settings.hazbase.logout.confirm.confirmLabel": "Sign out",
+    "settings.hazbase.notice.otpRequested": "One-time password sent.",
+    "settings.hazbase.notice.otpVerified": "Signed in to wallet.",
+    "settings.hazbase.notice.passkeyRegistered": "Passkey registered.",
+    "settings.hazbase.notice.walletBootstrapped": "Wallet issued on chain {chainId}.",
+    "settings.hazbase.notice.signedOut": "Signed out of wallet.",
+    "settings.hazbase.notice.sessionRefreshStarted": "Session refresh started. Send a one-time password to sign in again.",
+    "settings.hazbase.prompt.email": "Wallet email address",
+    "settings.hazbase.prompt.otp": "One-time password",
+    "settings.row.hazbaseStatus": "Wallet",
+    "settings.row.hazbaseEmail": "Wallet email",
+    "settings.row.hazbasePasskey": "Passkey",
+    "settings.row.hazbaseBaseSepolia": "Base Sepolia wallet",
+    "settings.row.hazbaseBase": "Base wallet",
     "settings.row.a2aShareStatus": "Status",
     "settings.row.a2aShareEndpoint": "Endpoint",
     "settings.row.a2aShareUserId": "User ID",
@@ -525,6 +647,13 @@ const translations = {
     "error.choiceInputReadOnly": "Please answer this type of input on the Mac.",
     "error.choiceInputAlreadyHandled": "This choice request was already handled.",
     "error.mkcertRootCaNotFound": "The mkcert root CA file could not be found.",
+    "error.hazbaseAuthRequired": "Sign in to your wallet first.",
+    "error.hazbaseSessionExpired": "Your wallet session expired. Open Wallet settings and sign in again.",
+    "error.hazbaseEmailRequired": "Enter your email address first.",
+    "error.hazbaseOtpRequired": "Enter the one-time password.",
+    "error.hazbasePasskeyLocalHostRequired": "Open viveworker on its .local hostname to use hazBase passkeys.",
+    "error.hazbaseWalletAccountMissing": "Issue a wallet on this chain first.",
+    "error.unsupportedChain": "That chain is not supported here.",
     "server.fallback.codexTask": "{provider} task",
     "server.title.approval": "Approval",
     "server.title.complete": "Completed",
@@ -540,10 +669,19 @@ const translations = {
     "server.action.detail": "Detail",
     "server.action.select": "Choose",
     "server.action.approve": "Approve",
+    "server.action.payWithWallet": "Pay with wallet",
     "server.action.reject": "Reject",
     "server.action.implement": "Implement",
     "server.message.commandApprovalNeeded": "Command approval needed.",
     "server.message.commandLabel": "Command",
+    "server.message.filesLabel": "Files",
+    "server.message.diffSummaryLabel": "Diff summary:",
+    "server.message.autoPilotTrustedReadApproved": "Auto Pilot approved this trusted read command.",
+    "server.message.autoPilotTrustedReadSummary": "Auto Pilot approved a trusted read command.",
+    "server.message.autoPilotTrustedReadReason": "Auto-approved by viveworker Auto Pilot because it matched the trusted read policy.",
+    "server.message.autoPilotTrustedWriteApproved": "Auto Pilot approved this low-risk file change.",
+    "server.message.autoPilotTrustedWriteSummary": "Auto Pilot approved a low-risk file change.",
+    "server.message.autoPilotTrustedWriteReason": "Auto-approved by viveworker Auto Pilot because it matched the low-risk write policy for the current workspace.",
     "server.message.fileApprovalNeeded": "File changes need approval.",
     "server.message.commandPrefix": ({ command }) => `Command: ${command}`,
     "server.message.pathPrefix": ({ path }) => `Path: ${path}`,
@@ -917,6 +1055,26 @@ const translations = {
     "detail.planReady": "プランの確認が必要です。",
     "detail.previousMessage": "ひとつ前のメッセージ",
     "detail.interruptedTask": "中断されたタスク",
+    "detail.autoPilotManualEyebrow": "Auto Pilot",
+    "detail.autoPilot.manualTitle": "手動承認になった理由",
+    "detail.autoPilot.writeDisabled": "いまは低リスクな書き込みが OFF なので、ファイル変更は手動承認のままです。",
+    "detail.autoPilot.writeMissingWorkspace": "このファイル変更に対して、現在のワークスペースを確認できませんでした。",
+    "detail.autoPilot.writeMissingDiff": "使える diff が含まれていなかったため、Auto Pilot は手動承認へ回しました。",
+    "detail.autoPilot.writeMissingFiles": "Auto Pilot が確認するための対象ファイルが含まれていませんでした。",
+    "detail.autoPilot.writeInvalidFiles": "対象ファイルが現在のワークスペース外か、保護されたパスに当たっていました。",
+    "detail.autoPilot.writeDiffTooLarge": "この diff は、現在の低リスク書き込みの上限を超えています。",
+    "detail.autoPilot.writeDiffUnreadable": "diff を安全なファイル単位の変更として解釈できませんでした。",
+    "detail.autoPilot.writeDangerousDiff": "作成・削除・rename・mode 変更・binary を含むため、手動承認のままです。",
+    "detail.autoPilot.writeDiffMismatch": "diff のファイルヘッダと対象ファイルがきれいに一致しなかったため、手動承認へ回しました。",
+    "detail.autoPilot.writeContentDisabled": "文書・文言に見える変更ですが、そのレーンは現在 OFF です。",
+    "detail.autoPilot.writeUiDisabled": "UI・テストに見える変更ですが、そのレーンは現在 OFF です。",
+    "detail.autoPilot.writeUiUnsafe": "この UI / テスト差分には import や高リスク API の追加が含まれていたため、手動承認のままです。",
+    "detail.autoPilot.writeUiTooLarge": "UI・テストは小さな差分だけが対象で、今回はその範囲を超えています。",
+    "detail.autoPilot.writeSourceDisabled": "小さなコード修正に見える変更ですが、そのベータレーンは現在 OFF です。",
+    "detail.autoPilot.writeSourceUnsafe": "このソース差分には高リスク API または secret に近い追加が含まれていたため、手動承認のままです。",
+    "detail.autoPilot.writeSourceTooLarge": "小さなコード修正は、ごく小さい単一ファイル差分だけが対象です。",
+    "detail.autoPilot.writeSourceContinuity": "小さなコード修正は、このスレッド内で同じファイルを直前に読んでいることが必要です。",
+    "detail.autoPilot.writeNoLaneMatch": "この変更は、現在のワークスペースで有効な低リスク書き込みレーンに当てはまりませんでした。",
     "detail.imageAlt": ({ index }) => `添付画像 ${index}`,
     "detail.filesTitle": "関連ファイル",
     "detail.diffTitle": "差分",
@@ -1091,6 +1249,35 @@ const translations = {
     "settings.awayMode.title": "同期モード",
     "settings.awayMode.copy": "Claude のプラン承認・質問を PC ブラウザとペアリング端末の両方から回答できるようにします。先に回答した方が有効です。",
     "settings.awayMode.codexNote": "Codex は設定不要です。承認や質問は PC とペアリング端末のどちらからでも操作できます。",
+    "settings.autoPilot.title": "承認の自動化",
+    "settings.autoPilot.copy": "現在のワークスペース内で、viveworker に任せる安全な承認の範囲を選べます。",
+    "settings.autoPilot.trustedReadsTitle": "安全な読み取り",
+    "settings.autoPilot.trustedReadsDescription": "rg、find、git diff、git show、sed -n など、ワークスペース内の読み取りを自動承認します。",
+    "settings.autoPilot.trustedWritesTitle": "低リスクな書き込み",
+    "settings.autoPilot.trustedWritesDescription": "現在のワークスペース内で、自動承認する書き込みレーンを選べます。",
+    "settings.autoPilot.writeLaneContentTitle": "文書・文言",
+    "settings.autoPilot.writeLaneContentDescription": "README、Markdown、i18n などの文書や文言の更新。",
+    "settings.autoPilot.writeLaneUiTestsTitle": "UI・テスト",
+    "settings.autoPilot.writeLaneUiTestsDescription": "小さな CSS、web/components の UI 変更、テスト差分。",
+    "settings.autoPilot.writeLaneSourceTitle": "小さなコード修正（ベータ）",
+    "settings.autoPilot.writeLaneSourceDescription": "既存ソースへの小さな単一ファイル修正。より厳しい条件で判定します。",
+    "settings.autoPilot.scopeNote": "秘密情報、設定・デプロイ、認証・決済、ネットワークを伴う変更、ワークスペース外へのアクセスは引き続き手動承認になります。",
+    "settings.autoPilot.recentTitle": "最近の自動承認",
+    "settings.autoPilot.recentEmpty": "まだ自動承認はありません。承認の自動化が動くと、最近の読み取りや書き込みがここに表示されます。",
+    "settings.autoPilot.recentRead": "読み取り",
+    "settings.autoPilot.recentWrite": "書き込み",
+    "settings.autoPilot.recentContent": "文書・文言",
+    "settings.autoPilot.recentUiTests": "UI・テスト",
+    "settings.autoPilot.recentSource": "小さなコード修正",
+    "settings.autoPilot.suggestionsTitle": "おすすめ",
+    "settings.autoPilot.suggestionsEmpty": "普段どおり使っていれば大丈夫です。手動承認が繰り返されると、ここにおすすめが表示されます。",
+    "settings.autoPilot.suggestionEnable": "有効化",
+    "settings.autoPilot.suggestionContentTitle": "文書・文言を有効化",
+    "settings.autoPilot.suggestionContentBody": ({ count }) => `最近の手動承認 ${count} 件が、文書・Markdown・i18n の更新に一致しています。`,
+    "settings.autoPilot.suggestionUiTestsTitle": "UI・テストを有効化",
+    "settings.autoPilot.suggestionUiTestsBody": ({ count }) => `最近の手動承認 ${count} 件が、小さな UI 変更やテスト差分に一致しています。`,
+    "settings.autoPilot.suggestionSourceTitle": "小さなコード修正（ベータ）を有効化",
+    "settings.autoPilot.suggestionSourceBody": ({ count }) => `最近の手動承認 ${count} 件が、小さな単一ファイルのソース修正に一致しています。`,
     "settings.notifications.copy":
       "viveworker がバックグラウンドでも、承認、プラン、質問、完了を確認しやすくします。",
     "settings.notifications.serverDisabled": "サーバー側で Web Push がまだ有効化されていません。",
@@ -1153,6 +1340,8 @@ const translations = {
     "settings.row.currentDeviceSubscribed": "この端末の購読状態",
     "settings.row.lastSuccessfulDelivery": "最後の通知成功時刻",
     "settings.row.version": "バージョン",
+    "settings.updateAvailable.title": "新しいバージョンがあります",
+    "settings.updateAvailable.copy": "viveworker v{latest} が利用できます。現在は v{current} です。",
     "settings.row.currentLanguage": "現在の言語",
     "settings.row.languageSource": "言語ソース",
     "settings.row.defaultLanguage": "setup 時の既定値",
@@ -1240,6 +1429,77 @@ const translations = {
     "settings.a2aShare.expired": "期限切れ",
     "settings.a2aShare.status.unreachable": "到達不可",
     "settings.a2aShare.error": "上流への問い合わせに失敗しました: {reason}",
+    "settings.wallet.title": "Wallet",
+    "settings.wallet.subtitle": "サインイン / Passkey / Base アドレス",
+    "settings.wallet.copy": "ウォレットへのサインイン、Passkey、Base 系アドレスの管理を行います。",
+    "settings.wallet.unavailable": "この viveworker では Wallet が設定されていません。",
+    "settings.wallet.summary.title": "現在の状態",
+    "settings.wallet.flow.title": "おすすめの順番",
+    "settings.wallet.flow.banner.title": "まずは、セットアップしましょう",
+    "settings.wallet.flow.copy": "A2A でタスクの報酬をやりとりするには、ウォレットを有効化する必要があります。",
+    "settings.wallet.sessionExpired.title": "ウォレットセッションを更新しましょう",
+    "settings.wallet.sessionExpired.copy": "ウォレットのセッションが切れています。ワンタイムパスワードで再サインインすれば、Passkey と Base Sepolia アドレスはそのまま使えます。",
+    "settings.wallet.ready.title": "利用準備ができました",
+    "settings.wallet.ready.copy": "メールサインイン、Passkey、Base Sepolia ウォレットの準備ができています。",
+    "settings.wallet.ready.payoutIntro": "エージェントは下記アドレスを利用します:",
+    "settings.wallet.ready.copyAddress": "タップでアドレスをコピー",
+    "settings.wallet.advanced.title": "アカウント操作",
+    "settings.wallet.stepNumber": ({ count }) => `STEP ${count}`,
+    "settings.wallet.status.complete": "完了",
+    "settings.wallet.status.current": "次に実行",
+    "settings.wallet.status.pending": "保留",
+    "settings.wallet.status.locked": "前の step 待ち",
+    "settings.wallet.status.optional": "任意",
+    "settings.wallet.step.signIn.title": "メールでサインイン",
+    "settings.wallet.step.signIn.copy": "メールにワンタイムパスワードを送り、届いた値を入力してウォレットにサインインします。",
+    "settings.wallet.step.refreshSession.title": "セッションを更新",
+    "settings.wallet.step.refreshSession.copy": "ウォレット操作を続ける前に、新しいワンタイムパスワードで再サインインします。",
+    "settings.wallet.step.passkey.title": "Passkey を登録",
+    "settings.wallet.step.passkey.copy": "この端末に Passkey を登録します。ウォレット発行や重要な操作で使います。",
+    "settings.wallet.step.baseSepolia.title": "Base Sepolia ウォレットを発行",
+    "settings.wallet.step.baseSepolia.copy": "現在の beta フローで使うテスト用ウォレットを発行します。まずはこれを用意するのがおすすめです。",
+    "settings.wallet.step.base.title": "Base ウォレットを発行",
+    "settings.wallet.step.base.copy": "本番の payout が必要になったら Base mainnet ウォレットを発行します。現時点では任意です。",
+    "settings.wallet.mainnet.optIn": "Base mainnet も設定する",
+    "settings.wallet.mainnet.optInHint": "任意 — 本番 payout が必要な場合だけ。",
+    "settings.hazbase.title": "ウォレット",
+    "settings.hazbase.status.signedOut": "未サインイン",
+    "settings.hazbase.status.signedIn": "サインイン済み",
+    "settings.hazbase.status.sessionExpired": "セッション切れ",
+    "settings.hazbase.status.otpAwaitingVerify": "送信しました。メールを確認して、下のフィールドに入力してください。",
+    "settings.hazbase.passkey.ready": "この端末で登録済み",
+    "settings.hazbase.passkey.missing": "まだ登録されていません",
+    "settings.hazbase.passkey.localHostRequired": ".local ホスト名で viveworker を開くと Passkey を登録できます。",
+    "settings.hazbase.wallet.missing": "未発行",
+    "settings.hazbase.field.emailLabel": "メールアドレス",
+    "settings.hazbase.field.emailPlaceholder": "you@example.com",
+    "settings.hazbase.field.otpLabel": "ワンタイムパスワード",
+    "settings.hazbase.field.otpPlaceholder": "例: 123456",
+    "settings.hazbase.action.requestOtp": "ワンタイムパスワードを送信",
+    "settings.hazbase.action.refreshSession": "セッションを更新",
+    "settings.hazbase.action.resendOtp": "再送信",
+    "settings.hazbase.action.verifyOtp": "サインイン",
+    "settings.hazbase.action.changeEmail": "メールアドレスを変更",
+    "settings.hazbase.action.registerPasskey": "Passkey登録",
+    "settings.hazbase.action.bootstrapBaseSepolia": "Base Sepolia発行",
+    "settings.hazbase.action.bootstrapBase": "Base発行",
+    "settings.hazbase.action.signOut": "ウォレットからログアウト",
+    "settings.hazbase.logout.confirm.title": "ウォレットからログアウトしますか?",
+    "settings.hazbase.logout.confirm.copy": "再度アクセスするには、ワンタイムパスワードでのサインインが必要になります。ウォレットアドレスと passkey は同じアカウントに紐付いたまま残ります。",
+    "settings.hazbase.logout.confirm.confirmLabel": "ログアウトする",
+    "settings.hazbase.notice.otpRequested": "ワンタイムパスワードを送信しました。",
+    "settings.hazbase.notice.otpVerified": "ウォレットにサインインしました。",
+    "settings.hazbase.notice.passkeyRegistered": "Passkeyを登録しました。",
+    "settings.hazbase.notice.walletBootstrapped": "chain {chainId} にウォレットを発行しました。",
+    "settings.hazbase.notice.signedOut": "ウォレットからログアウトしました。",
+    "settings.hazbase.notice.sessionRefreshStarted": "セッション更新を開始しました。ワンタイムパスワードを送信して再サインインしてください。",
+    "settings.hazbase.prompt.email": "ウォレットのメールアドレス",
+    "settings.hazbase.prompt.otp": "ワンタイムパスワード",
+    "settings.row.hazbaseStatus": "ウォレット",
+    "settings.row.hazbaseEmail": "ウォレットのメール",
+    "settings.row.hazbasePasskey": "Passkey",
+    "settings.row.hazbaseBaseSepolia": "Base Sepoliaウォレット",
+    "settings.row.hazbaseBase": "Baseウォレット",
     "settings.row.a2aShareStatus": "ステータス",
     "settings.row.a2aShareEndpoint": "エンドポイント",
     "settings.row.a2aShareUserId": "ユーザー ID",
@@ -1304,6 +1564,13 @@ const translations = {
     "error.choiceInputReadOnly": "この種類の入力は Mac で回答してください。",
     "error.choiceInputAlreadyHandled": "この選択入力はすでに処理済みです。",
     "error.mkcertRootCaNotFound": "mkcert の root CA ファイルが見つかりません。",
+    "error.hazbaseAuthRequired": "先にウォレットへサインインしてください。",
+    "error.hazbaseSessionExpired": "ウォレットのセッションが切れています。Wallet 設定を開いて再サインインしてください。",
+    "error.hazbaseEmailRequired": "先にメールアドレスを入力してください。",
+    "error.hazbaseOtpRequired": "ワンタイムパスワードを入力してください。",
+    "error.hazbasePasskeyLocalHostRequired": ".local ホスト名で viveworker を開くと hazBase Passkey を使えます。",
+    "error.hazbaseWalletAccountMissing": "先にこのチェーンのウォレットを発行してください。",
+    "error.unsupportedChain": "このチェーンはここではサポートされていません。",
     "server.fallback.codexTask": "{provider} task",
     "server.title.approval": "要承認",
     "server.title.complete": "完了",
@@ -1319,10 +1586,19 @@ const translations = {
     "server.action.detail": "詳細",
     "server.action.select": "選ぶ",
     "server.action.approve": "承認",
+    "server.action.payWithWallet": "ウォレットで支払う",
     "server.action.reject": "拒否",
     "server.action.implement": "実装する",
     "server.message.commandApprovalNeeded": "コマンド実行の承認が必要です。",
     "server.message.commandLabel": "コマンド",
+    "server.message.filesLabel": "Files",
+    "server.message.diffSummaryLabel": "差分サマリ:",
+    "server.message.autoPilotTrustedReadApproved": "Auto Pilot がこの Trusted Read コマンドを自動承認しました。",
+    "server.message.autoPilotTrustedReadSummary": "Auto Pilot が Trusted Read コマンドを自動承認しました。",
+    "server.message.autoPilotTrustedReadReason": "viveworker Auto Pilot が Trusted Read ポリシーに一致したため自動承認しました。",
+    "server.message.autoPilotTrustedWriteApproved": "承認の自動化がこの低リスクなファイル変更を自動承認しました。",
+    "server.message.autoPilotTrustedWriteSummary": "承認の自動化が低リスクなファイル変更を自動承認しました。",
+    "server.message.autoPilotTrustedWriteReason": "viveworker が現在のワークスペース向け低リスク書き込みポリシーに一致したため自動承認しました。",
     "server.message.fileApprovalNeeded": "ファイル変更の承認が必要です。",
     "server.message.commandPrefix": ({ command }) => `Command: ${command}`,
     "server.message.pathPrefix": ({ path }) => `Path: ${path}`,

package/web/sw.js

@@ -1,4 +1,4 @@
-const CACHE_NAME = "viveworker-v25";
+const CACHE_NAME = "viveworker-v56";
 const NOTIFICATION_INTENT_CACHE = "viveworker-notification-intent-v1";
 const NOTIFICATION_INTENT_PATH = "/__viveworker_notification_intent__";
 const APP_ASSETS = ["/app.css", "/app.js", "/i18n.js"];
@@ -44,12 +44,12 @@ self.addEventListener("fetch", (event) => {
   }
 
   if (APP_ROUTES.has(url.pathname)) {
-    event.respondWith(networkFirst(event.request, "/app"));
+    event.respondWith(staleWhileRevalidate(event, "/app"));
     return;
   }
 
   if (CACHED_PATHS.has(url.pathname)) {
-    event.respondWith(networkFirst(event.request, url.pathname));
+    event.respondWith(staleWhileRevalidate(event, url.pathname));
   }
 });
 
@@ -182,19 +182,37 @@ async function notifyClients(type) {
   }
 }
 
-async function networkFirst(request, cacheKey) {
+// Cache-first with background revalidation. Flips the previous networkFirst
+// strategy: instead of blocking first paint on a fresh fetch of the ~450KB
+// app shell (HTML + app.js + app.css + i18n.js) every launch, we serve the
+// cached copy immediately and refresh it in the background for the next
+// visit. Updates still land quickly because the SW itself is served fresh
+// from the bridge (`/sw.js` is excluded from this handler above), and a new
+// SW's `install` event pre-populates the cache with the latest assets
+// before `activate`/`clients.claim()` triggers a reload in page script.
+async function staleWhileRevalidate(event, cacheKey) {
   const cache = await caches.open(CACHE_NAME);
-  try {
-    const response = await fetch(request, { cache: "no-store" });
-    if (response && response.ok) {
-      await cache.put(cacheKey, response.clone());
-    }
+  const cached = await cache.match(cacheKey);
+
+  const networkPromise = fetch(event.request, { cache: "no-store" })
+    .then(async (response) => {
+      if (response && response.ok) {
+        await cache.put(cacheKey, response.clone());
+      }
+      return response;
+    })
+    .catch(() => null);
+
+  if (cached) {
+    // Keep the SW alive long enough to persist the background refresh even
+    // if the page navigates away right after first paint.
+    event.waitUntil(networkPromise);
+    return cached;
+  }
+
+  const response = await networkPromise;
+  if (response) {
     return response;
-  } catch {
-    const cached = await cache.match(cacheKey);
-    if (cached) {
-      return cached;
-    }
-    return Response.error();
   }
+  return Response.error();
 }