chore: release package(s)

apps/client/desktop/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @internal/desktop-client
 
+## 1.5.1
+
+### Patch Changes
+
+- Updated dependencies [[`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c)]:
+  - @internal/node@3.1.1
+
 ## 1.5.0
 
 ### Minor Changes

apps/client/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@internal/desktop-client",
   "description": "Subshell Client: a Tauri shell that registers this machine as a subshell node and manages its node daemon",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "license": "Apache-2.0",
   "type": "module",
   "private": true,

apps/docs/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @internal/docs
 
+## 0.11.3
+
+### Patch Changes
+
+- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.
+
+  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families.
+
+  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.
+
+  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.
+
+  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.
+
 ## 0.11.2
 
 ### Patch Changes

apps/docs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@internal/docs",
   "description": "Public documentation site for Subshell — Fumadocs, statically exported",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "license": "Apache-2.0",
   "type": "module",
   "private": true,

apps/node/agent/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @internal/node
 
+## 3.1.1
+
+### Patch Changes
+
+- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.
+
+  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families.
+
+  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.
+
+  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.
+
+  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.
+
 ## 3.0.1
 
 ### Patch Changes

apps/node/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@internal/node",
   "description": "subshell — node daemon: enrolls with the control plane and executes signed commands",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "license": "Apache-2.0",
   "type": "module",
   "private": true,

apps/server/api/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @internal/server
 
+## 3.0.4
+
+### Patch Changes
+
+- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.
+
+  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families.
+
+  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.
+
+  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.
+
+  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.
+
+- [#468](https://github.com/subshell-ai/subshell/pull/468) [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9) Thanks [@theogravity](https://github.com/theogravity)! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities.
+
 ## 3.0.3
 
 ### Patch Changes

apps/server/api/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@internal/server",
   "description": "",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "license": "AGPL-3.0-only",
   "type": "module",
   "private": true,

apps/server/desktop/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @internal/desktop-server
 
+## 1.7.1
+
+### Patch Changes
+
+- [#468](https://github.com/subshell-ai/subshell/pull/468) [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9) Thanks [@theogravity](https://github.com/theogravity)! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities.
+- Updated dependencies [[`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c), [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9)]:
+  - @internal/server@3.0.4
+
 ## 1.7.0
 
 ### Minor Changes

apps/server/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@internal/desktop-server",
   "description": "Subshell Server — a Tauri shell that installs, runs and manages a local subshell-server",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "private": true,