# Changelog ## 2.0.13 This release applies the dependency updates the open dependabot pull requests carried — the denoland/setup-deno action of the verification pipeline moves 2.0.3 → 2.0.5 and the anchore/sbom-action of the security pipeline moves 0.24.0 → 0.24.2, beside the two reference refreshes the same sweep found current (docker/setup-qemu-action 4.2.0 → 4.3.0 and trufflesecurity/trufflehog 3.97.1 → 3.97.4) — and it lands the automation that keeps those numbers current from now on. The maintenance workflow becomes the automated dependency ladder: it applies every non-breaking update available at run time (the npm dependency set, the engine recommendations and the versioned GitHub Actions references), derives the next rung with plain arithmetic over package.json — the current patch number plus one, never a hardcoded number anywhere — stamps it across the whole metadata family, re-freezes the apifreeze artifact, records the permission baseline, runs the complete verification pipeline on the archive-tagged automation branch, squashes the green result onto main with linear history, deletes the branch (the archive tag preserves it verbatim) and dispatches the release workflow on the new version tag, so every automatic bump publishes exactly the way the manual rungs always did. The dependabot configuration is removed with this rung: the versioned GitHub Actions references are the maintenance workflow's own surface now — the denoland/setup-deno entry joins its allowlist so the gap that kept the two open pull requests alive never opens again — and no dependency update path is left creating parallel branches; the repository keeps exactly one long-lived branch (main, protected) and the archive tags carry every automation branch the ladder ever creates. The version stamps 2.0.13 land across the metadata family with the apifreeze artifact re-frozen and the permission baseline recorded. ## 2.0.12 This release is the seventh rung of the bug-fix ladder, and it closes the marginal ceiling the 2.0.10 and 2.0.11 container legs caught: the full matrix build test of the library modes family legitimately runs past the five second default on a two vcpu runner — the 2.0.10 amd64 leg failed it at five thousand sixteen milliseconds, a sixteen millisecond overrun of a green test (the same test crossed the same ceiling on the 2.0.9 arm64 leg where the emulated scaling already covered it), so the native ceiling itself was the defect, not the test. The two build-heavy tests of the family now pin their own env-scaled ceilings the same way the vitest config scales the global default: the esm core build reads sixty seconds natively and the whole-matrix build reads one hundred twenty seconds, both reading the same `DEVTHINK_TEST_TIMEOUT_MS` the emulated arm64 container leg exports, so a slow runner or an interpreted leg never fails a test that builds every platform target of the matrix and loads each bundle. The 2.0.11 sanitizer closures, the 2.0.10 emulation ceilings and the 2.0.9 browser flow fixes all ride beneath this rung, and the version stamps 2.0.12 land across the metadata family with the apifreeze artifact re-frozen and the permission baseline recorded. ## 2.0.11 This release is the sixth rung of the bug-fix ladder, and it closes the two code scanning alerts the re-analysis of the security page surfaced beside the two the 2.0.7 rung already closed: the accessibility sweep script carried a replacement-expression sanitizer pair CodeQL refuses — the script stripper of `withoutscripts` (a `[\s\S]*?` alternation over unterminated blocks) flagged as a bad tag filter, and the inline tag strip of the button name scan (a `<[^>]*>` global replace) flagged as incomplete multi character sanitization. Both strips now walk plain index arithmetic the same linear way the tabular preface scans of the 2.0.7 rung read their markers: the script stripper finds each `` referrers fallback tag the earlier attestation pushes created — the registry carries no referrers api, so every registry attestation push left the fallback tag behind on the package page; the attest step keeps generating the attestation with the registry mirror off, and a cleanup step walks the package versions and drops exactly the versions tagged only `sha256-…`, dynamically from the registry answer with no digest written in the workflow or in any file, so the package page answers only the version, stable, latest and pre tags the metadata step owns. The version stamps 2.0.7 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the docs with the full verification chain green. ## 2.0.6 This release is the third rung of the bug-fix ladder, and it comes straight from the end-user verification of the published 2.0.5 package: the flat package installed clean, every library surface answered (the esm import of every subpath, the cjs require, the umd global, the cli help, recipes with the package-root gallery index, planlint, the headless replay of the shipped fixture plan, the http transport driving live GET and POST round trips against the host, the library run handle over the recorded page state, and the package-scoped checksums verifying all 141 shipped files with the identity pin matching), the release zip loaded in the browser with all five surfaces rendering, the service worker alive and zero console errors — one command alone failed: `npx devthink manifest` answered six icon errors and exit one from the installed package, because the deep manifest check demanded the icon files of the extension bundle while the flat library package deliberately ships no bundle (the browser bundle rides the release zip channel). The fix mirrors the identity-digest fail-soft the manifest command already carries: the deep manifest check learns whether any extension bundle exists in the running tree — a repository checkout after pnpm build carries dist/extension with the materialized icons and the strict behavior stays exactly as it was (a declared icon missing from a present bundle remains an error), while a tree with no bundle at all (an installed library package, an unbuilt checkout) answers every declared icon through the info note that names where the family actually rides — the release zip channel — instead of six absent-bundle errors, so the structural manifest checks (the key allowlist, the permission sources, the csp hashes, the reviewed resources, the duplicate scan, the capability floor, the icon shape) stand alone the way the identity checks already did. The clitools tests cover both branches: the unbundled context answers the release-zip note with exit zero, the bundled-missing context keeps the error with exit one. The version stamps 2.0.6 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green from the clean state. ## 2.0.5 This release is the second rung of the bug-fix ladder: the 2.0.4 push surfaced a works-on-my-machine defect the clean CI runner caught — the readiness review reads the soak and wcag evidence artifacts (tests/artifacts/soak.json and tests/artifacts/wcag.json) the 2.0.2 final polish added as gates 25 and 26 of the 27, but the artifacts are gitignored build records and no lane of the validate chain ever regenerated them, so the runner answered 25 of 27 gates green with the soak and wcag rows blocked and the go decision no-go, while the development tree still carried the 2.0.2 session leftovers that kept every local run green. The fix closes the generation gap at the chain: the validate:candidate script now runs the soak and the wcag sweeps (tests/soak.mjs and tests/wcag.mjs, both sub-second fake-clock suites) beside the sweep, the pool audit, the matrix and the telemetry-free verification, so every validate run — local or on the GitHub runners — records the fresh evidence the readiness review walks and the go decision answers the chain that just ran, never the state a previous session left on disk. The local proof of this release deletes every recorded artifact and the whole dist tree before running the validate chain from a clean state, so the 27 of 27 go decision rides only what the chain itself regenerates. The version stamps 2.0.5 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green from the clean state. ## 2.0.4 This release is the first rung of the bug-fix ladder the operator protocol demands: the 2.0.3 push exposed one defect in the new flat layout gate itself and no package ever published, so the fix lands here with the version bump. The flat depth check of the release and verify lanes anchored its nesting pattern on `^package/[^/]+/[^/]+/[^/]+` — a pattern that counts the `package/` root prefix every npm tarball carries as if it were a directory level, so it rejected every legitimately flat two-directory path (package/fixtures/recipes/…) and failed the verify and assemble lanes before anything published; the v2.0.3 tag the metadata job cut points at the commit that never released. The fixed gate anchors on three real directory segments behind the tarball root — `^package/([^/]+/){3}` — so a path only fails when it carries a folder inside a folder inside a folder inside the package itself, exactly the organization rule the staging gate enforces over the staged tree; the pattern is verified against a real packed tarball before this release ships (142 entries, zero depth violations, the 49 two-directory data paths all allowed), the release and verify lanes carry the same corrected anchor, and the version stamps 2.0.4 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green. ## 2.0.3 This release is the flat package organization pass the registry consumers demanded: the npm tarball the 2.0.2 build shipped carried the whole dist tree — every file buried under `dist/`, the mv3 extension bundle, the static site, the zips, the vsix and the minified variants riding beside the library surface, paths nested four and five directories deep (dist/extension/fixtures/recipes/…) — so the published package opened messy instead of organized. The 2.0.3 build stages a dedicated flat package tree the release lanes pack: the library surface the exports map resolves lands at the package root — one file per correlated domain, index.js, index.cjs, index.neutral.js, devthink.umd.js, the per module entries (policy, protocol, memory, progress, hardening, dashdone), the platform adapters (node.cjs, bun.js, deno.js), the terminal and service entries (cli, headless, mcp, bridge, companion, nativehost.template.json), the pipeline and comms entries (pack, http, gateway, crossbrowser) — with the declaration files and the declaration maps beside them, the source maps staying behind in the dist build and the release assets so the published package rides lean, and the data groups riding in their own shallow folders (caps, schemas, fixtures — nothing nested past two directories, verified by the staging gate and re-asserted over the packed tarball in the release and verify lanes). The staged package manifest is generated by the build from the repository manifest — the entry paths remap from the dist folder to the package root, the repository machinery (the files allowlist, the scripts, the devDependencies and the packageManager pin) drops out, and every field a registry consumer reads rides verbatim — so the two manifests never drift, the exports map of the published package resolves every entry to a staged file, and the pack step runs `npm pack ./distpackage` on the GitHub build machines exactly the way the release workflow already owns every build. The package-scoped checksums cover exactly the shipped set: one sha256 line per staged file beside the identity pin of the manifest key, so a consumer verifies every file of the installed package against the build that shipped it while the full dist checksums keep covering the minified variants and the release archives as release assets. The cli path candidates join the installed-package layout: the recipes command reads the gallery index at the package root (gallery.json) before the dist copy and the repository source, the recipe loader resolves the package fixtures first, and the identity digest reads the package checksums before the build checksums — so `npx devthink recipes` answers from an installed package without the dist tree. The five package channels open organized the same flat way: the maven jar resources land at the jar root (index.js, index.cjs, devthink.umd.js, checksums.txt, cli.js, headless.js, mcp.js, gateway.js, http.js — no dist folder inside the artifact, the pom drops the targetPath), the vsix carries the library esm bundle at extension/index.js instead of extension/dist/index.js (the extension host and the webview resolve the flat path), the nuget content files keep the consumer-root layout they always had with the same staged sources, the gem stays the single runner shim it is, and the npm and GitHub Packages registries publish the one flat tarball. The release workflow extracts the maven and nuget lanes from the flat tarball (tgzwork/package at the root), the sbom and the artifact manifest lanes import the pack module from the flat extraction, the assemble lane asserts the flat layout over the packed tarball (the package root files, the grouped data, and no path nested past two directories), and the verify lane mirrors the same assertions beside the maven jar greps and the vsix flat entry. The metadata lane loses the stale mavendist path the 2.0.2 push tripped over (the git add list no longer names a directory the reorganization removed), the pnpm baseline of the runtime catalog syncs to the recorded 11.25.0, and the version stamps 2.0.3 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green. ## 2.0.2 This release is the final polish pass the 2.0.0 audits demanded: the closing roadmap verification of the whole chain — six audit dispatches over every release section from 1.1.32 to 2.0.0, the rc.2 fold, the 2.0.0 section and the drift records — found sixteen never-built items concentrated in the ui polish family, the version one sunset user experience, the soak and accessibility sweeps and the store package, and this release implements every one of them at the source. The ui polish lands complete: the keyboard focus order of the review dialog (the focusorderof helper orders the dialog controls — read the step, approve, revise, reject — with the ordered tabindex sequence the rendering applies and the focus target the open moves to), the high contrast theme (the highcontrasttokens family beside the darklight resolution writes the same --theme-* custom properties with mathematically verified ratios — every text class token reaches 4.5:1 against the surface, the accent reaches 3:1 — with the contrastpreference setting the options page persists and the body[data-contrast="high"] marker the surfaces carry), the notification plurals (the pluralize helper renders every count the notification payloads carry in its correct singular and plural form), the dashboard panel resize (the dashboardcolumns split with the panelresizer handle, the pointer drag and the keyboard arrows, the clamped bounds and the persisted panelwidths), the unused-style pruning (the stylesheet lost the rules the surfaces no longer render — the editorpalette library row, the runrow family the run lifecycle view replaced, the memorymark badges the state depth view replaced and the wordbox rules the ocr overlay replaced — and the stylepruning test re-runs the scan so the pruning stays enforced), and the stepstimeline adopts the virtlist windowing the logstream and the datagrid already carry, closing the last 1.1.68 partial. The version one sunset gains the user-facing surfaces the refusal texts always promised: the negotiation banner (a below-floor frame the mcp intake receives marks the once-per-session v1sunset state, the popup renders the banner card with the migration guide reference and the migrateplan command, and the dismissal resets it for the session) and the once-per-user migration prompt (the onInstalled update branch reads the previous version — the runtime report or the stored install marker — and only a 1.x predecessor meets the prompt, which rides the notification path the trigger notifications already use, names the migrateplan command and docs/migrationguide.md, and the persistent migrationpromptdismissed flag a dismissal writes keeps it from ever appearing again). The audit trail gains the release provenance stamps (every progress record, step stamp, outcome and nav entry carries the release and protocolmajor that produced it, and the replay path replays the stamps), the migration guide gains the faq for candidate upgraders and the rollback path from a candidate install, and the copyscreen clipboard routing of the 1.1.39 files family gains the dedicated vitest it never had (the captureVisibleTab screenshot routes through the ClipboardItem onto the clipboard write, the clip entry records the payload hash, and the refusal path degrades to the destination marker). The two never-built sweeps of the 2.0.0 section land as real gates: the soak run of tests/soak.mjs keeps a long workflow alive across the full retention window without drift — twenty nine dispatched steps over three loop passes against the fixture page in the fake clock mode, the heartbeat stays fresh while a silent twin reaps, the checkpoint resume completes byte-identically, the hash chain verifies and seals the same audit hash on two full runs, the memory items stay bounded inside the retention window with the provenance surviving the purge, and the report lands in tests/artifacts/soak.json with the gate exiting nonzero on any drift. The accessibility sweep of tests/wcag.mjs audits every ui surface against the wcag checklist — alt text on every image, accessible names on the sixty six buttons, labels on the ninety three fields, the computed contrast ratios of the default tokens, the focus visible outlines, the positive tabindex scan, the language stamp and the heading hierarchy — with the success criterion of every check named, and the report lands in tests/artifacts/wcag.json. The store package completes the final polish triad: the icon family ships at every required size (icons.ts carries the six png payloads as base64 so the repository stays text only, the build materializes them into the zip the manifest icons block, the action default icon and the notification icon path resolve, and the build verifies every payload decodes to a real png header with the exact pixel size of its key), the web store listing draft of docs/webstore.md records the descriptions, the permission justification rows of the frozen set, the privacy posture and the screenshot checklist, and the packageextension gate asserts the six icons answer inside the shipped archive. The schemastrict inbound guard closes a latent defect the first full router test exposed: the family grammar check flagged the kind field of every registered family — surface, sessions, configure, execute — as an unknown field, refusing every popup surface command before dispatch, so the validation now reads the payload fields alone with the dispatch kind resolved by the registry lookup. The documentation completes the honest gaps: docs/21.librarymodes.md documents the runtime matrix the 1.1.67 section promised, docs/24.gatewayguide.md becomes the gateway entry point the 1.1.83 section promised, the emulation section joins docs/05 and the emulation row joins docs/01, the packagenaming and nativebridge artifact tables drop the stale wsbridge and companion paths, the releasepipeline mcp coverage line describes the real lanes, and SECURITY.md carries the supported version row of this release with the reporting contact. The version stamps 2.0.2 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec, the readiness review walks the new gates beside the standing twenty four, and the full verification chain runs green. ## 2.0.0 This release is the platform release the chain promised: sixty eight releases after 1.1.31 the library is an agentic browser platform, and 2.0.0 freezes, verifies and ships it with every roadmap feature of the release candidate two section folded in — no separate candidate ships, the polish, the readiness review and the closing stamps land here in one release. The security review first: the three open code scanning alerts of the polynomial regular expression family close at the source — the capture name slug of commands.ts and the identifier fold of evidence.ts trim their leading and trailing dashes through a single linear scan instead of the alternation that answered attacker paced backtracking, and the dataset interpolation of data.ts walks the {{column}} tokens with plain index arithmetic instead of the nested brace expression, so no library input drives a polynomial path anywhere in the grammar. The repository joins the pipeline family configuration: the RubyGems channel the gateway, e2ugh, maene, saddle and devthink repositories carry lands here as the fifth package channel beside npm, maven, nuget and the container image — extension.gemspec at the root builds the Ruby process adapter gem with the runner shim the workflow generates at build time, and the publish rubygems workflow carries the family resolve pattern (the version tag verified against the package metadata, the tag-to-head equality check, the published-release check and the pre-deploy existence check against the registry versions list) with the workflow_run trigger that follows the release workflow to completion. The workflow lint gate joins the family the same way: the actionlint step leaves the verify lane for the dedicated workflowlint workflow that rides the reviewdog action on a version tag, and no workflow file in the repository pins an action by a hard coded commit digest anymore. The hard coded hashes leave the sources entirely, the way the gateway repository already exterminated them: the devops-actions/actionlint commit digest of the verify workflow became the version tag of the workflowlint lane, and the pinned identity key digest of cli.ts became a generated build artifact — the build writes the sha-256 digest of the published manifest identity key beside the bundle checksums in dist/checksums.txt, the manifest command verifies the live key against that recorded digest, and the tests verify the artifact instead of a source constant, so the internal cryptographic digests of the bundles, the packages and the identity are generated by every build and never stay baked inside a source file. The deprecation window the 1.1.91 api freeze opened closes exactly as docs/deprecation.md promised: the protocol floor rises to major two, a client that still declares version one refuses with the migration path named (the migrateplan command and docs/migrationguide.md), a client that declares both majors still negotiates up to two, the deprecatedfields registry empties with both promised removals executed — the uppercase Devthink global of the umd envelope and the protocolversion string of the mcp capability set — and the freeze artifact re-records the emptied registry through the reviewed sync. The migration bridge the 1.1.92 section promised and the window record restated ships with it: the migrateplan command converts a version one devthink plan, an automa workflow, a selenium side file, a ui vision macro or a tabular csv into the reviewed plan grammar, refuses every entry it cannot map with the source entry named, verifies the converted plan through the same frozen grammar and the same lint engine the planlint command runs before anything is written, and the five importer fixtures ride the built fixture set of dist/fixtures/importers for the packages, the readiness gate and the migration guide chapters that now speak in the shipped present tense. The example gallery the 1.1.97 section promised and never shipped lands complete: thirty six recipes across the five categories — eight scraping, nine form, eight testing, six monitoring and five agent recipes — live as pure plan documents in tests/code/recipes with the gallery index carrying the metadata (category, difficulty, description, fixture page, origin, expected duration, capabilities, consent classes, kinds, export formats, schedules and agent topologies), four self contained fixture pages cover the product grid, the checkout wizard, the console noisy dashboard and the infinite feed, the recipes runner of tests/recipes.mjs validates every entry against the frozen plan schema, the policy rule set and the capability set, proves the consent gates hold, dry runs every recipe through the runflow pipeline with a recording consent provider, replays the cli planlint over the built copies and records the outcome of every entry in tests/artifacts/recipes.json — all thirty six entries green, all nineteen checks green, the runner wired into the verify lane so the gallery never drifts from the code. The cli gains the recipes command to list the gallery, validate one entry and dry run it against its fixture, the sidepanel offers the one click import of a packaged recipe into the workflow import review (the chromium archive carries the gallery index and the recipe plans under fixtures/), docs/gallery.md documents the recipe format, the authoring path, the fixture pages and the consent requirements, the site page carries the gallery section, and the reference catalog, the agent certification and the readme link the gallery in. The readiness review the release candidate two section promised joins as the final gate: tests/readiness.mjs walks every release gate against the evidence the candidate lanes recorded — the pool audit with full disposition of all 626 mined items, the api freeze schemas rehashed against the 1.1.91 record, the closed deprecation window, the migrateplan bridge over every importer fixture, the pentest checklist with zero failed entries, the strict content security policies, the clean permission diff, the frozen permission coverage behind the transparency page, the agent certification, the cost certification, the doc check, the recipes runner, the defect sweep, the verification matrix, the telemetry free evidence, the changelog chain from 1.1.31, the migration guide paths, the release notes, the roadmap chain rules, the release pipeline draft-verify-publish controls and the capability manifest release pins — twenty four gates, all green, the go decision recorded in docs/readiness.md with the gate table, the residual risks and the go criteria, the verdict artifact in tests/artifacts/readiness.json, and the gate exits nonzero when any verdict blocks the go. The closing stamps follow the platform release: the version stamps 2.0.0 across package.json, manifest.json, version.ts, pom.xml, extension.csproj and the capmanifests the build derives, the release notes assemble the platform entry, the roadmap marks the chain complete with 2.0.0 as the closing release, the todo document closes the chain work items, the releasegates record the final gate matrix, and the readme states the platform status with the gallery as the fastest way to start. The npm library, the maven artifact, the nuget package, the container image and the rubygems gem publish on the reviewed release lanes with the checksums, the sbom, the attestations and the artifact manifest covering the built set, and the full verification chain runs green on the final tag. ## 1.1.99 This release is the first release candidate the roadmap promised: the defect sweep, the verification matrix and the telemetry free verification join the gate chain, so the candidate ships with full gate evidence instead of single gate runs. The sweep of tests/sweep.mjs collects every failed outcome the audit trails of tests/artifacts recorded since the 1.1.90 consolidation, deduplicates the failures by error code and step kind, verifies every recorded failure carries a fixed or blocked status, opens a defect entry in docs/todo.md for every unfixed failure it finds and replays every reproducible failed step against its fixture — the recorded set is green, so the replay set is empty and the report records the zero. The sweep also scans the sources for real defect classes: todo markers without an owner and a target release, silent catch blocks that swallow errors without surfacing them to the envelope, unbounded loops without a user bound, hardcoded origins and keys, and platform deprecated api usage; every scan records its findings, every finding carries its fix or its written blocker, and the report lands in tests/artifacts/sweep.json with the gate exiting nonzero while any blocker stays open. The verification matrix of tests/matrixverify.mjs enumerates the full candidate surface: every action kind of the frozen catalog against the fake tab provider, every browser surface across the popup, the sidepanel and the dashboard templates, the cli surface in library mode, the mcp surface through the stdio bridge contract, the importers on every fixture format of dist/fixtures, the migration paths from version one plans through the deprecation window, and the eight standing gates (poolaudit of the crx mining pool aside, apifreeze, cspaudit, permdiff, agentcert, costcert, doccheck and the release metadata check) — every cell records its outcome in tests/artifacts/matrixverify.json, the matrix reports its coverage percentage of the candidate, and the gate exits nonzero when any cell fails. The telemetry free verification of tests/telemetryfree.mjs proves the candidate makes no request without consent: it greps the compiled bundle set for every network call site, lists every network capable path with its gate, runs the candidate behind a block all proxy over the startup, a full fixture recipe run and the dashboard render with the fake clock, and records zero outbound requests on the fresh run; the sync and update paths assert opt in only, the crash and error reporting paths assert local only, and the evidence lands in tests/artifacts/telemetryfree.json with the assertions joined to the verify workflow. The release candidate documentation follows: docs/releasecandidate.md describes the candidate process and its gates, docs/perfbudgets.md records the candidate measurements beside the budgets the build already enforces, the notes assembly of tests/release.mjs merges the chain drafts into the full docs/releasenotes.md covering every release from 1.1.31 to the candidate with the phase groups, the migration steps, the frozen protocol guarantees, the certified scenarios, the performance budget results and the security review summary, and docs/releasegates.md, docs/todo.md, docs/poolcoverage.md, docs/referencecatalog.md, the roadmap and the readme record the candidate status. The residual data the 1.1.98 reorganization gathered leaves the tests/code source set: the seven stale capability manifest records duplicate the frozen lists the build derives into dist/caps and the workspace file the single package repository never read, so the source set keeps only the schemas, the fixtures and the research data the build and the generators read. The verify workflow runs the three new gates beside the standing ones, the workflowcheck mirror set and the package scripts carry them, and the full suite passes with the candidate gates green. The workspace restoration follows the first CI run of the candidate: the reorganization deleted the pnpm workspace file under the belief the single package repository never read it, but pnpm still resolves its build approvals there, so the esbuild postinstall approval and the supply chain age exclusion the frozen toolchain pins return as the standard workspace file the repository root carries beside the lockfile. ## 1.1.98 This release restores the clean repository shape the operator directive demands after the manual reorganization that flattened docs/examples into docs, gathered the schema, cap, research and fixture data into tests/code and removed the caps, manifests, patches and .devthink directories from the root: the root now carries only the typescript sources beside the standard metadata files (package.json, tsconfig, manifest.json, pom.xml, extension.csproj, deno.json, pnpm-lock.yaml, the containerfile and the web design), every runtime file that lived as a hand maintained script or a scattered json becomes either a typescript module in the root or a build artifact under dist, and nothing else lives in the repository root. The broken references the reorganization left behind are all repaired: the build reads the schema, fixture and research sources from tests/code, the planlint and workflow dry run gates run over the emitted dist/fixtures set, the packaging descriptors read the fixtures from dist, and the documentation follows the new locations. The companion converts from the root companion.mjs script into the root companion.ts module: the plain node recipe of tests/build.mjs now compiles the companion source with esbuild, stamps the package version over the source build marker and writes the runnable dist/companion.js beside its minified pair, the host manifest template the companion ships embeds in the module as the nativehosttemplatejson export and the build stamps it into dist/nativehost.template.json, and the entry guard keeps the module importable without side effects while the native host still launches it as the process entry — the repository root carries a typescript file instead of a hand maintained mjs script, and the npm tarball ships the compiled artifact instead of the source file. The container runner follows the same consolidation: the containerfile interns the self hosting runner source as one heredoc the runtime stage writes into the image, so every container concern lives inside the single container file and no container.mjs script exists in the root; the builder stage drops the pnpm-workspace reference the single package repository never needed and runs the headless smoke over the dist/fixtures the build emits. The frozen contract data becomes build artifacts: the seven capability manifests under caps/ were generated sync files that cluttered the root, so the build now derives dist/caps/.json from the frozen lists the compiled library exports and the cli manifest check reads them beside the compiled cli; the ten protocol schemas live as the tests/code sources the build copies verbatim into dist/schemas, the frozen message catalog of protocol.ts names them by their dist relative labels (schemas/.schema.json), and the freeze gate and the freeze artifact follow the emitted set with the same hashes the sources pin. The example set follows the same shape: the plans, the workflows, the page state fixture and the consumption mode examples copy from tests/code into dist/fixtures for the packages and the gates, the umd example page the build rewrites into dist/umd-example.html, the deno smoke task runs the tests/code example, and the research catalogs the doc generators read stay in tests/code as the recorded source data. The npm files list shrinks to dist, manifest.json, web, README.md and LICENSE because every shipped data file now rides the dist artifact set the checksums and the artifact manifest cover; the packaging steps, the verify and release workflows, the npmgate allowlist, the workflowcheck mirror set, the container tests and the documentation all read the new locations; the freeze artifact and the permission baseline record their versioned state at tests/apifreeze.json and tests/permdiff.json beside the gates that verify them; the gitignore drops the stale exception lines the moved artifacts carried; and the build repairs the corrupted minified umd sourcemap line the 1.1.93 family introduced (sourcesContent recorded an undefined identifier instead of the minified body). The orphaned files the reorganization gathered leave the tree: the two stale planlint baseline records the runtime cache wrote, the wouter patch no manifest references, and the two doc generator scripts no script or workflow calls. ## 1.1.97 This release completes the written surface the certification chain proved: the doccheck gate keeps the documentation consistent with the code from here to the release candidates — the kind documentation covers every action kind of the immutable three hundred thirty five kind vocabulary exactly, each entry stating its family, its consent class, its capability requirement, its target grammar, its policy test and its schema anchor beside a plan fragment that validates against the frozen plan schema; the flow documentation draws the twelve execution flows of the platform in the shared mermaid style with their module links, from the session lifecycle and the consent gate to the multi agent coordination and the release pipeline itself; and the reference documentation mirrors the code it documents — the fourteen cli commands, the twenty three frozen protocol messages, the five wire error codes beside the six terminal exit codes, the one hundred eighty one audit event kinds, the configuration keys with their types and defaults, the ten frozen storage schemas, the seven capability manifests, the thirty five mcp tools with their per tool versions, the ten trigger kinds and the three consent classes. The gate refuses any drift: a kind the catalog serves that documents nowhere fails the release, a reference table that disagrees with the tool catalog or the message catalog fails the release, a doc link that resolves nowhere fails the release, a code block that states no language fails the release, a released version the changelog misses fails the release, and a surface the capability manifests serve that the readme never mentions fails the release. The first run surfaced and closed eleven language-less code blocks of the certification docs, two configuration keys the configuration document never stated and the pagebridge surface the readme never named. The kind documentation and the reference documentation generate from the compiled module surface so the counts match the code exactly, the documentation requirements join the contribution guide, and the migration guide and the freeze document cross link the new pages. ## 1.1.96 This release certifies the multi agent coordination layer the roadmap 1.1.95 section promised — the security review of 1.1.94 cleared the single agent surface, so the certification now covers the coordination layer end to end. The agentcert gate of tests/agentcert.mjs drives thirty coordination scenario entries against the real compiled modules with the fake tabs of every browser kind and the fake clock mode keeping every run deterministic: the leader worker topology across five fake agents with the planner executor separation, the critic review loop that closes on the reviewed output, the verifier confirmation before completion, the message passing between every agent pair, the shared task queue handing out every task exactly once, the work stealing under its lane lock protocol, the blackboard merging concurrent writes, the tab handoff keeping the session state on every browser kind, the shared resource lock blocking double writes, the conflict detection on simultaneous edits, the merge of parallel results with provenance, the vote and consensus flow with its quorum, the kill switch stopping every agent at once, the pause of one agent leaving the others running, the sub agent depth limits, the escalation gate reaching the human from any agent, the review request flow, the interleaved run replay for audit, the comparison of competing outputs, the prioritized task lanes, the resource arbitration under contention, the worker scale decision by site load, the per agent budget limits stopping the right agent, the per agent permission scopes gating the right kinds, the aggregate report merging every contribution, the interleaved timeline ordering, the lessons learned store deduplication, and the pool item coverage of 469 through 502 mapped onto real exported functions — with every scenario outcome recorded deterministically in tests/artifacts/agentcert.json and the gate exiting nonzero on any failure. The costcert gate of tests/costcert.mjs proves the shared accounting reconciles: it replays recorded runs and recomputes every cost line, verifies the token accounting per agent matches the step logs, that the shared cost accounting sums the agent totals, that the budget alerts fire at the configured thresholds, that the refunds on cancelled steps match the provider rules (the provider bills only the chunks that left the wire, so a cancelled step refunds the completion tokens that never streamed), that the model routing costs land on the right agent, that the exported cost report reconciles to the total, and that no cost event is missing from the audit trail — with the reconciliation report written to tests/artifacts/costcert.json and the gate exiting nonzero on any accounting mismatch. The certification entry gate runs agentcert and costcert together through the new validate:agents chain that joins the validate chain after validate:security, the verify workflow runs both gates beside the security gates, the workflowcheck permitted set gains them, and the certification artifacts join the release evidence bundle. The dashdone completion lands the multi agent dashboard: the dashboardpage gains the multi agent overview panel with the topology status, the per agent status cards with live progress, the shared queue view with its lane filter, the message flow view between agents, the conflict and arbitration log panel, the cost per agent panel fed by the costcert totals, the escalation inbox with its human answer controls, the kill switch and the per agent pause controls, the timeline scrubber over the interleaved events, the aggregate report download, the read only rendering for observers without the run role, and the empty states that guide the first multi agent run — all served through the new multiagent view the background shapes from the live swarm state through the dashdone family module, and the agent registry snapshot exports the certified topology inventory of the six certified scenario families of docs/agentscenarios.md: the leader worker scrape, the planner executor critic, the parallel form fill, the monitoring swarm, the competing extraction, and the escalation and review scenarios, each with its topology diagram, its cost characteristics, its fake tab provider setup reference and its consent model. The documentation surface completes the certification: docs/agentcert.md documents the suite and every scenario with its verified pool item, docs/agentscenarios.md describes the six certified topologies with the pool mapping of items 469 through 502, docs/dashdone.md documents the dashboard panels, docs/costcert.md explains the accounting verification method, docs/releasegates.md requires green agentcert and costcert runs, the roadmap progress line marks the multi agent certification complete, docs/todo.md records the certification results, the README notes the certified multi agent topologies, docs/05.agentalgorithms.md links the certified scenarios, docs/07.featureflowmatrix.md gains the coordination verification rows, docs/perfbudgets.md gains the coordination suite runtime budget, docs/configuration.md documents the fake clock mode for deterministic runs, and docs/referencecatalog.md records the certification artifact inventory. The test suite covers the certification chain: tests/agentcert.test.ts verifies the artifact covers every scenario (running the gate itself when a built tree carries no fresh artifact, so the bun and deno lanes that build before vitest verify it without gate ordering), tests/costcert.test.ts verifies the reconciliation invariants the same way, the protocol tests cover the coordination messages against the frozen schemas, the policy tests cover the per agent scope gates, the chromium smoke executes one coordination scenario end to end inside the live browser against the shipped bundles, and the full vitest suite passes with the certification chain green. ## 1.1.95 This release hardens the security surface for the release candidates: the pentest checklist of docs/pentest.md now runs end to end through tests/pentest.mjs — twenty one automated entries that exercise the real modules, from the consent gate blocking a sensitive kind on a fresh profile, the origin check refusing cross origin messages, the connectallow list dropping unknown external senders and the schemastrict rejection of malformed envelopes, through the escape hatch halting every native call, the kill switch stopping all agents at once, the revoked consent aborting the in flight step, the ratelimit buckets throttling command floods and the http bind refusing remote addresses by its documented localhost default, to the pairing handshake refusing unpaired clients, session tokens expiring on their timer, the secretvault never leaking into the audit trail, the loghash chain detecting tampering, the sandbox frame isolating untrusted renders, the quarantine holding downloads until a clean scan verdict, the cookie jar staying isolated per run, the phishguard warning before login flows on lookalike origins, the payment and delete gates refusing every non human resolution, and the purge and export passes removing and returning every stored record — with every executed entry and its outcome recorded deterministically in tests/artifacts/pentest.json and the gate exiting nonzero on any failure. The content security audit lands with the strict policies: tests/cspaudit.mjs extracts every content security policy from the root manifest and both browser overlays, verifies no injected code path uses eval or remote code, that the pagebridge script stays the only injected file, that the sidepanel and popup load no remote resources, that every script, style and connect source stays local or consented, that the dashboard renders untrusted extracts inside the sandbox frame the manifest declares, and that no frozen policy carries a wildcard source; the root manifest gains the strict extension pages policy `script-src 'self'; object-src 'self'; frame-ancestors 'self'` the release candidates carry, the extension pages refuse framing by remote origins, and the inline event handlers stay absent from every extension page. The permission diff gate proves the permission set never grew silently: tests/permdiff.mjs extracts the permission set of the manifest, compares it against the previous release artifact resolved from the git tag or the release commit, reports every added, removed and reordered permission, requires the written justification table of docs/01.extensionpermissions.md for every addition, blocks on any unjustified permission and writes tests/artifacts/permdiff.json — this release gains no permission, the diff reads clean, and the audit trail records the permission set hash of the release beside the permdiff history the transparency export carries for incident reviews. The transparency page reaches completion: it lists every granted origin with its grant date, every permission with its consuming surface from the capability manifest coverage, every stored data kind with its location and its purge and export links, the active consent sessions with their expiry, and the audit trail integrity check result of the loghash chain — all rendered entirely offline with no external request. The hardening pass closes the remaining gaps: input masking covers every field the logs gained since the audit, the redaction pass covers the transparency page exports, the virus scanning hook gains the local signature check option, the quarantine exposes its contents only through the review flow, the escape hatch shows its visible confirmation banner, review mode pauses on new domains with an explanatory card, the safe defaults apply to every newly encountered site, the minimization pass trims extracts before storage, the purge action removes every trace of a run, the export action returns all stored data in one archive, the encrypted sync path gains its key rotation entry point, the mcp transport refuses plaintext remote connections, and the local stdio bridge verifies the client signature when the platform allows it. The security review closes the release: docs/securityreview.md summarizes the pentest execution with every finding, its fix and its verification, records the cspaudit results per surface, the permdiff history since the 1.1.31 baseline and the residual risks with their owners; docs/pentest.md documents the checklist and its rerun instructions, docs/cspaudit.md explains the policy set and the audit rules, docs/transparency.md documents the page contents, docs/01.extensionpermissions.md gains the permdiff justification table, docs/releasegates.md requires green pentest, cspaudit and permdiff runs, SECURITY.md links the review, docs/securitytriage.md gains the release candidate triage flow, and the go decision checklist gains the security review entry. The gates join the tooling: the verify workflow runs the three security gates beside the api freeze, the package validate chain grows the validate security chain, the chromium smoke executes the pentest checklist end to end, the runtime policy accepts the transparency page surface, the extension validation verifies the transparency page bundle, and the full vitest suite passes with the security chain green. ## 1.1.94 This release folds every browser manifest into the one root manifest.json the operator directive names: the firefox overlay, the safari overlay and the vs code packaging overlay lived as three separate files under manifests/ beside the chromium source manifest — four hand maintained files each duplicating the release version the root manifest already carries. The single manifest design moves the firefox and the safari adaptation data under the `browsers` key of the root manifest and the vs code packaging data under the `vsix` key, the manifests/ directory leaves the tree, and no overlay declares a version of its own because the root manifest's version stays the single source the release synchronization stamps — a version drift between the overlays and the package is structurally impossible from this release on. The firefoxprep adapter strips the two metadata keys from every derived browser manifest before it ships, the shipped chromium extension copy of the manifest drops the browsers and vsix keys the other targets own, and the build, the verify workflow, the release workflow, the containerfile, the npm file list and the publishing pipeline tests all read the overlays from the one root manifest — one manifest speaks every webextension dialect and no correlated manifest file lives beside another. ## 1.1.93 This release closes the first bug the real consumer simulation of the test campaign exposed: a user installing the npm package and running the documented `devthink manifest` command inside the installed package hit a missing file crash, because the manifest deep checks of 1.1.91 began reading the seven capability manifest files under caps/ while the npm file allowlist never shipped them — the package carried manifest.json, manifests, web, dist and the docs, but the freeze contract the manifest command verifies needs the pinned capmanifests beside them. The npm files list now ships the caps directory with its seven surface manifests, the tarball size budget absorbs the few kilobytes, and the consumer simulation — the pack, the fresh /tmp project, the install, the esm import, the commonjs require, the cli describe and the cli manifest inside the installed package — runs end to end against the shipped artifact exactly the way a library user works. ## 1.1.92 This release is the first stabilization wave of the test campaign the operator directed before the roadmap continues: the suite grows by seven hundred torture tests across fifteen new files in tests/ — torture-run, torture-plan, torture-session, torture-swarm, torture-agent, torture-memory, torture-workflow, torture-tools, torture-llm, torture-http, torture-export, torture-environments, torture-commands, torture-data and the replay-verified extensions of the existing sandboxframe coverage — taking the full vitest suite from one thousand seven hundred and thirty to two thousand four hundred and thirty one tests. The campaign torture-tests every family with adversarial markup reassembly payloads, csv and markdown formula injection, prototype pollution keys, lookalike origins, homograph hosts, boundary values at every budget, window and quorum edge, malformed envelopes, forged tokens, replayed nonces, star-storm patterns that would backtrack catastrophically, unicode and control character payloads, million byte inputs and state machine abuse of terminal transitions. Six library bugs the torture tests exposed close in this release. The sandbox render result acceptance documented that a replayed nonce refuses while the implementation carried no replay tracking at all: the sandboxrender type gains its answeredat marker, acceptrenderresult returns the updated renders with the accepted render closed, and a second message through the same nonce never passes again while tests/sandboxframe.test.ts threads the closed render through its refusal coverage. The fetch redirect handling leaked the request body onto the downgraded GET hop of a 301, 302 or 303: the hop now rebuilds its init without the body whenever the method went bodiless, so a secret POST payload never rides a redirect the contract downgraded. The json rpc posted frame intake accepted an empty batch array as a valid empty message set: an empty batch now refuses with the parse error the json rpc spec demands. The client ceiling enforcement never refused under a non finite configured maximum because two is never greater than NaN: a nonsensical ceiling now fails closed. The prefetch warming misplaced a duplicate granted url into the refused list — a duplicate warms once and stays allowed. The workflow editor template expansion accepted malformed nested parameters without validation: expandtemplate validates every parameter through the nested param normalizer and refuses the malformed ones loudly, matching the import side that always refused them. The earlier hardening the campaign verified along the way lands in the same wave: the tab pattern matcher walks adversarial star storms through one linear token table with a dynamic programming pass instead of a compiled regular expression, the dataset interpolation only answers the row's own string values so inherited properties never leak object internals into a step payload, the plan origin profile tolerates the blank origin of a hostile plan file, the agent budget spend refuses negative and non finite amounts, the swarm consensus vote refuses a blank agent id, the tool idempotency lookup scopes its search by client so one client's key never replays another client's record, the sealed run state open guards against a null payload, and the heartbeat, budget pressure and timeout decisions survive non finite telemetry values. ## 1.1.91 This release freezes the external contracts before the release candidates: the audit of 1.1.90 proved the feature surface complete, so nothing new enters the library here — only versioned contracts, manifests and guarantees. protocolv2 pins the message schemas: the frozen message catalog of protocol.ts declares every message type with its family, its schema file, its envelope class and its carrier, ten schema files under docs/schemas (session, proposal, plan, observation, envelope, capability, audit, memory, progress and tool) freeze the wire shapes with the protocolv2 id and a frozen semantic version of their own, every message field carries a documented type with a plain language description, the response envelope covers the success, error and cancel outcomes with the stable error code table — parse, method, params, internal and consentrefused with the retry semantics of every code — the stdio and http framing rules join the written contract, the observation payload keeps its schemaversion field forward compatible with a reserved fields map for future additions, the plan schema documents the review surface without hard caps, the tool catalog entries carry per tool versions from this release on, and the action kind identifiers become immutable constants in types.ts with the option grammar of every kind frozen inside the plan schema. The capability manifests describe every surface: caps/background.json, caps/pagebridge.json, caps/sidepanel.json, caps/popup.json, caps/cli.json, caps/library.json and caps/mcp.json each list the message types, the kinds and the permissions their surface speaks, pinned to the release version and the frozen protocol major, with the permission coverage map that ties every manifest permission to its consuming capability and the per tool versions of the mcp surface. the background serves the capmanifest of its surface on request through the new capmanifest message that also answers the highest shared protocol version of the negotiation, the cli prints the manifest of every surface through the new describe command, and the capmanifest comparison flags the capability drift between releases — every added or removed message, kind, permission and tool version answers as one named drift entry the drift gate refuses. the protocol major negotiation answers version two as the default for new clients, accepts version one messages with the deprecation notice of the window, and refuses every major above two until a future major bump with the supported range inside the refusal; schema validation runs on every incoming message before dispatch — strict mode for version two rejects unknown fields while version one tolerates them through the deprecation window — and library consumers pin the protocol version through the explicit pinnedprotocolversion import. The deprecation policy defines what stability means until 2.0.0: the deprecation window opens at 1.1.91 and closes at 2.0.0, every deprecated field — the uppercase devthink global shim of the umd surface and the full package version string of the version one mcp capability exchange — carries its sunset release in docs/deprecation.md and logs exactly one warning per session inside the window, and the stability rules promise additive changes only inside protocolv2 with breaking changes demanding a new major protocol version by written rule. the new tests/apifreeze.mjs gate verifies the freeze on every release: it enumerates the frozen message catalog, verifies the envelope carriers, the protocol version constants, the tool catalog coverage, the observation schema forward compatibility, the response envelope outcomes, the cli, mcp, sidepanel, popup, pagebridge and library surfaces against the code they freeze, the permission coverage of the manifest, and hashes every frozen schema and contract list into tests/artifacts/apifreeze.json — exiting nonzero when a frozen hash changes without a version bump, reporting the surface size per message family and joining the validate chain and the verify workflow as a required check. the docs land beside the code: docs/apifreeze.md, docs/deprecation.md with its sunset list and the migration tooling pointer to 1.1.92, docs/stability.md with the compatibility promise from 1.1.91 to 2.0.0, docs/capmanifest.md with the manifest format and versioning, docs/poolcoverage.md with the protocol versioning items recorded as implemented, the protocol reference with every message and its schema link, the permission evidence with the capmanifest surface map, the architecture document with the frozen message boundaries, and the readme, the configuration, the reference catalog, the release gates and the roadmap updates. the full vitest suite passes with every frozen contract validated and the chromium smoke exercises the version negotiation end to end. ## 1.1.90 This release merges every correlated logic of the root into one module per category: the operator directive names the run family as the example — run history, run budget, run state, run resume, run replay, run parallel, the background run queue, the run timeline and the run resilience lifecycle all intern into run.ts — and the same consolidation applies to every file of the root, because the analysis of the whole tree found ninety four modules whose logics belong to twenty five categories that each carry between zero and one hundred correlated logics, so the repository now speaks one module per category instead of one module per half of a category. The merged families follow the correlation map: flowlibrary, flowrun and the syncbridge intern into flow.ts; planlint and planreview intern into plan.ts; sessions and sessioninterface intern into session.ts; orchestration, taskqueue and the blackboard intern into swarm.ts; netwatch, socketbus and netcontrol intern into net.ts; servercontract, socketrelay, chatbridge, wsbridge and nativehost intern into bridge.ts; confirmgates and approvalgate intern into gates.ts; originpolicy, inboundguard, maskinputs, immutablelog, phishguard, secretvault and transparency intern into security.ts; jsonrpc, resourceexpose and promptexpose intern into serve.ts; media, vision and redactshots intern into capture.ts beside the capture base; surfaces, statusviews, pickerviews, tourviews, evidenceviews, datagrid, virtlist, siteprefs, quickactions and attentionfeed intern into views.ts; emulation and sandboxframe intern into environments.ts beside the environments base; platformadapter, runtimeadapters and platformtargets intern into runtime.ts; perfrecords, snapshotdelta, dombatch, stepmeter, resourceaware, batchscheduling and lazyload intern into perf.ts; browserpolyfills, firefoxprep, xpipack and safariskeleton intern into crossbrowser.ts; controlflow, trigger and workfloweditor intern into workflow.ts beside the engine base (the merge resolves the workflow and controlflow import cycle); modelroute and promptlibrary intern into llm.ts beside the llm base; toolcatalog and toolcalls intern into tools.ts; datacommand, pipelines and streamparse intern into data.ts; tabscommand, filescommand and navigation intern into commands.ts; exporttools, minimization and portability intern into export.ts; forensics and outputcompare intern into evidence.ts; artifactmanifest, sbom, vsixpack, mavenpack, nugetpack and containerpack intern into pack.ts; and cdpbus and profilers intern into debug.ts. Every family file organizes its sections hierarchically from the base and most important logic to the derived ones, with the standard jsdoc family header and one merged from marker per section, and every export of every source survives with the same name and semantics except the two collisions the merge resolved: the pipeline grid preview renames to pipelinegridpreview inside data.ts so the dataset grid preview keeps the gridpreview name, and the tool call retry hint renames to callretryhintof inside tools.ts so the session retry hint keeps the retryhintof name. The dist bundles, the exports map and the release chain follow the families: the wsbridge and nativehost bundles merge into the one bridge bundle, the browserpolyfills, firefoxprep, xpipack and safariskeleton bundles merge into the one crossbrowser bundle, the vsixpack, mavenpack, nugetpack, containerpack, sbom and artifactmanifest bundles merge into the one pack bundle, and the runtime family carries the platform matrix build; the exports map replaces the wsbridge, sbom and artifactmanifest entries with the bridge, crossbrowser and pack entries, the declaration emit covers every family module, the npmgate, the nativesmoke, the containerfile, the verify workflow and the release workflow speak the family bundle names, and the publishing pipeline tests assert the family set. The four maven packages the single distribution already replaced — extension mcp, extension headless, extension cli and extension library — retire from the github packages registry through the dispatched package cleanup workflow, so io.github.wenathlan.extension stays the only maven coordinate. The index and the neutral entry collapse their star export lists from the ninety four module lines to the twenty five family lines, the explicit type reexports keep the public surface stable (the loopstep type stays the types module export the surface always carried), and the full test suite of one thousand seven hundred and seven tests passes over the merged tree with the imports repointed at the family modules. ## 1.1.89 This release clears every open code scanning finding of the 1.1.88 tree: the sanitizer of the sandbox frame rewrites as one linear character scan, and the two polynomial regular expressions leave the vsix marketplace check and the css selector tokenizer. The stripscripts rewrite closes the five incomplete multi character sanitization findings: the replace chain over the whole markup (script elements, script tags, event handler attributes and script url schemes removed through global regular expressions inside a convergence loop) reads as incomplete sanitization to static analysis, because a pass over a reassembled payload like `ipt>` leaves a usable fragment behind from the analyzer view. The new scanner rebuilds the markup instead of removing fragments from it: a well formed tag keeps its name and its safe attributes with the script url schemes stripped from the values through plain index finds, every `on` event handler attribute drops, a script element drops with its whole content through the closing tag, a malformed tag whose body carries another open angle drops entirely, and no regular expression ever runs over the untrusted text — the output provably carries no `