v1.6.0

1.6.0 (2026-09-29)

Features

• cli: distinct exit codes (0 pass, 1 issues, 2 tool error) and a recipes epilog in --help (8ffd0a7)
• cli: machine-clean --json, a zoom-track command, and an agent quickstart (427c4a0)
• dashboard: grade the standalone-document and agent-readable contract (f19c265)
• design: add measurable UI design specifications (232a14f)
• design: author and capture precise UI specs without Figma (a2d989c)
• engine: implement IBRSession.mock() via the CDP Fetch domain (4193eee)
• evidence: record external computer-use receipts (3a95a07)
• extract: opt-in content elements and <head> metadata (1588960)
• mcp: add a session idle sweep, implemented always and disabled by default (69a5028)
• native: compact numbered refs, file-out payloads and AX-diff after ref actions (e791697)
• native: model-agnostic computer-use verb for simulators (native:cu) (8d5dd45)
• native: record-and-replay with self-healing steps (native:replay) (e8b38ab)
• release: detect a release that was cut but never reached npm (4390303)
• scan: report clipped and spilled text in web scan (be7715b)
• session: add session:select for native <select> elements (9dedd92)
• zoom-track: carry text and resolved colours, and rank targets by importance (c71cdd4)
• zoom-track: headings as targets, ranked by level; scan --content on the CLI (97cb2ea)
• zoom-track: reach the whole page via scrollY, and accept real event times (0e24a32)

Bug Fixes

• address independent-audit findings on the trust fixes (b7fbf60)
• browser: reap abandoned IBR Chrome sessions (2672ec4)
• calm-precision: stop false positives on compliant pages in grouping, status, cognitive-load, chrome and collision checks (e843a1f)
• ci: run the publish gate unit-only, matching ci.yml's ubuntu contract (b15964f)
• ci: same unit-only gate on the GitHub Packages publish, plus a guard (5311d7c)
• cli: make the documented first run actually run (ac6263a)
• codex: use CLI and ignore hidden choices (3a95330)
• dist: make the shipped CLI and MCP server runnable without node_modules (ea7d148)
• engine: atomic shared-profile lock for concurrent launches; correct node-id kind for element geometry (c05d0c8)
• engine: bound every connect and spawn path, and say what it waited on (1eba66e)
• engine: keep find() from dropping an element that re-rendered between AX reads (f8edd39)
• evidence: bound external evidence ingestion (1a55da3)
• evidence: enforce receipt provenance (97c572a)
• evidence: harden receipt privacy invariants (f5f74bd)
• evidence: preserve local receipt validity (0423315)
• extract: credit document/body click delegation only when the handler source names the control (f0ccd64)
• extract: credit natively-activated buttons in NO_HANDLER and fake-interactive (250700e)
• extract: detect addEventListener handlers before flagging controls (e4104b0)
• extract: judge delegation selectivity per selector-list part; trust jQuery registrations (7930d3d)
• interactivity: detect handlers set as properties, not just attributes (b404e14)
• mcp: close sessions at shutdown, and reuse the warm pool for screenshots (de842d3)
• native: detect same-count AX reorders in action validators (030d394)
• native: emit each AX element once and only walk from a real AXWindow (1f3b278)
• native: exclude AppKit-owned chrome from macOS scan findings (0afcdb5)
• native: open the Accessibility prompt whenever it is explicitly requested (50fbf96)
• native: reach sheet/dialog content and placeholder-only fields when driving macOS apps (9f660a1)
• native: rebuild the cached extractor when any Swift source changes (96318f6)
• native: refuse foreground keystrokes unless the target app has focus (fba2470)
• native: report simulator AX as unavailable when only host chrome comes back (d088626)
• native: restrict modal-window preference to focused/main dialogs (23cc4ac)
• native: route native-hid simulator preference to headless idb instead of a not-implemented stub (dfcd0df)
• native: show the macOS Accessibility prompt at most once per user (770057d)
• native: stable refs, refuse ambiguous targets, unique-match healing (bbc8d1c)
• obsidian: stop reporting clipped descendants as layout collisions (814a046)
• obsidian: stop the test suite grading itself on what is installed (d06d1c7)
• release: unblock validate:release, and test the dormancy we actually ship (f457f64)
• router: point /ibr router and preserved commands at surviving surfaces (d4f1c84)
• rules: stop fake-interactive from flagging natively interactive elements (5d3580a)
• rules: stop grading disabled controls, which WCAG exempts (6c482a8)
• scan: an unreachable URL is a tool error, not a PASS on Chrome's error page (7983d36)
• semantic: read rendered text, not innerText, when detecting error state (cce62e5)
• sensors: match focus rules against real elements (d888526)
• session: stop leaving stale manifests, and say plainly when the CLI blocks (a4306a4)
• summary: stop counting unparseable-colour contrast rows as passes (847d78f)
• types: read sibling sources via __dirname, not import.meta (TS1470) (9cb21de)
• web-ui: derive the muted text colour instead of picking one (ce77e27)
• zoom-track: drop off-screen targets instead of aiming outside the frame (e85d540)

Performance Improvements

• session: batch the per-start hard-wall scan; document the blocking start (04b86a4)

Continuous Integration

• release: small patch releases by default; test the real tag baseline (8c7ed17)