fix: remediate Dependabot security alerts (2026-07-22)

ts/packages/agentServer/client/README.AUTOGEN.md

@@ -3,7 +3,7 @@
 
 <!-- AUTOGEN:DOCS:START -->
 
-<!-- AUTOGEN:DOCS:HASH:sha256=5c99a2d89344c3b0b4474211b3862a2ff4ddc20c529ddd4a18379c5b7ccb6acb -->
+<!-- AUTOGEN:DOCS:HASH:sha256=04fbfb30a474f5ce625eba7bf97ac4448ffa83d1f1f1cd231891ceb5f3609946 -->
 <!-- AUTOGEN:DOCS:SOURCE: ./README.md (hand-written documentation; this file is the AI-generated companion) -->
 
 # @typeagent/agent-server-client — AI-generated documentation
@@ -12,17 +12,17 @@
 
 ## Overview
 
-The `@typeagent/agent-server-client` package is a TypeScript library that provides tools for interacting with a running `agentServer`. It enables clients to manage server connections, handle conversations, and ensure the server's availability. This package is a core component of the TypeAgent ecosystem and is utilized by various clients, including the Shell, CLI, and other integrations.
+The `@typeagent/agent-server-client` package is a TypeScript library designed to facilitate interaction with a running `agentServer`. It provides tools for managing server connections, handling conversations, and ensuring the server's availability. This package is a foundational component of the TypeAgent ecosystem and is used by various clients, including the Shell, CLI, and other integrations.
 
 ## What it does
 
-The `@typeagent/agent-server-client` package offers the following key functionalities:
+The package offers a comprehensive set of features for interacting with the `agentServer`:
 
 - **Server Connection Management**:
 
-  - The `connectAgentServer` function establishes a WebSocket connection to an `agentServer` and returns an `AgentServerConnection` object. This object provides methods for managing conversations and interacting with the server.
-  - The `isServerRunning` function checks if an `agentServer` is already running at a specified WebSocket URL.
-  - The `ensureAgentServer` function ensures that the `agentServer` is running, spawning it if necessary.
+  - `connectAgentServer`: Establishes a WebSocket connection to an `agentServer` and returns an `AgentServerConnection` object. This object provides methods for managing conversations and interacting with the server.
+  - `isServerRunning`: Checks if an `agentServer` is already running at a specified WebSocket URL.
+  - `ensureAgentServer`: Ensures that the `agentServer` is running, spawning it if necessary. This includes options for hidden mode and idle timeout.
 
 - **Conversation Management**:
 
@@ -31,7 +31,7 @@ The `@typeagent/agent-server-client` package offers the following key functional
 
 - **Convenience Wrappers**:
 
-  - The `ensureAndConnectConversation` function combines multiple steps into a single operation, including ensuring the server is running, connecting to it, and joining a conversation.
+  - `ensureAndConnectConversation`: Combines multiple steps into a single operation, including ensuring the server is running, connecting to it, and joining a conversation.
 
 - **Discovery**:
   - The `discovery` module helps external clients locate the dynamically assigned port of an in-process agent, which is useful for browser extensions, IDE plugins, and other external integrations.
@@ -50,11 +50,16 @@ To use this package, follow these steps:
    ```
 
 2. **Set up environment variables**:
+   The following environment variables are required for the package to function correctly:
 
-   - `TYPEAGENT_TUNNEL_TOKEN`: This environment variable is required for certain server interactions. Refer to the hand-written README for instructions on obtaining and setting this value.
+   - `TYPEAGENT_SERVER_PATH`: Specifies the path to the `agentServer`. Ensure this is set to the correct location of the server binary or executable.
+   - `TYPEAGENT_TUNNEL_TOKEN`: Required for certain server interactions. Refer to the hand-written README for instructions on obtaining and setting this value.
+   - `XDG_DATA_HOME`: Used for locating user-specific data files. Ensure this is set to a valid directory path.
 
-3. **Configure your environment**:
-   Ensure that the `TYPEAGENT_TUNNEL_TOKEN` environment variable is set in your shell or `.env` file before running any code that interacts with the `agentServer`.
+   These variables can be set in your shell or a `.env` file.
+
+3. **Verify the environment**:
+   Ensure that the required environment variables are correctly configured before running any code that interacts with the `agentServer`.
 
 ## Key Files
 
@@ -111,6 +116,7 @@ By following these steps, you can effectively extend the capabilities of the `@t
 Workspace:
 
 - [@typeagent/agent-rpc](../../../packages/agentRpc/README.md)
+- [@typeagent/agent-sdk](../../../packages/agentSdk/README.md)
 - [@typeagent/agent-server-protocol](../../../packages/agentServer/protocol/README.md)
 - [@typeagent/dispatcher-rpc](../../../packages/dispatcher/rpc/README.md)
 - [websocket-channel-server](../../../packages/utils/webSocketChannelServer/README.md)
@@ -119,6 +125,7 @@ External: `debug`, `isomorphic-ws`
 
 ### Used by
 
+- [@typeagent/browser-extension](../../../packages/agents/browserExtension/README.md)
 - [@typeagent/copilot-plugin](../../../packages/copilot-plugin/README.md)
 - [agent-cli](../../../packages/cli/README.md)
 - [agent-coda](../../../packages/coda/README.md)
@@ -128,8 +135,7 @@ External: `debug`, `isomorphic-ws`
 - [coder-wrapper](../../../packages/coderWrapper/README.md)
 - [command-executor-mcp](../../../packages/commandExecutor/README.md)
 - [remote-client-example](../../../examples/remoteClient/README.md)
-- [studio-service](../../../packages/studio-service/README.md)
-- _…and 5 more workspace consumers._
+- _…and 6 more workspace consumers._
 
 ### Files of interest
 
@@ -144,12 +150,14 @@ External: `debug`, `isomorphic-ws`
 
 ### Environment variables
 
-_1 environment variable referenced from `./src/` (set in `ts/.env` or your shell). See the `## Setup` section above for guidance on obtaining each value._
+_3 environment variables referenced from `./src/` (set in `ts/.env` or your shell). See the `## Setup` section above for guidance on obtaining each value._
 
+- `TYPEAGENT_SERVER_PATH`
 - `TYPEAGENT_TUNNEL_TOKEN`
+- `XDG_DATA_HOME`
 
 ---
 
-_Auto-generated against commit `b1b5bcafdde8ba2387d669eec198eb70e8fa5986` on `2026-07-17T23:52:55.795Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter @typeagent/agent-server-client docs:verify-links` to spot-check._
+_Auto-generated against commit `6bea19a9ee02598644b1ac3ab67c705dcc495832` on `2026-07-22T11:19:17.632Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter @typeagent/agent-server-client docs:verify-links` to spot-check._
 
 <!-- AUTOGEN:DOCS:END -->

ts/packages/agentServer/client/package.json

@@ -48,6 +48,6 @@
     "rimraf": "^6.0.1",
     "typescript": "~5.4.5",
     "websocket-channel-server": "workspace:*",
-    "ws": "^8.21.0"
+    "ws": "^8.21.1"
   }
 }

ts/packages/agentServer/server/README.AUTOGEN.md

@@ -3,7 +3,7 @@
 
 <!-- AUTOGEN:DOCS:START -->
 
-<!-- AUTOGEN:DOCS:HASH:sha256=dcdaaf81ac5b3038b25930f38dfdf7062ab6282ae8873115aa860e5563ec1988 -->
+<!-- AUTOGEN:DOCS:HASH:sha256=b0edd0cf02b0ff295e1d62494c69fd8c65e83047650c402ac565f0538824eb5e -->
 <!-- AUTOGEN:DOCS:SOURCE: ./README.md (hand-written documentation; this file is the AI-generated companion) -->
 
 # agent-server — AI-generated documentation
@@ -12,7 +12,7 @@
 
 ## Overview
 
-The `agent-server` package is a TypeScript library that implements a long-running WebSocket server for hosting TypeAgent dispatchers. It acts as a central hub for managing client connections, orchestrating conversations, and facilitating communication between clients and agents. The server supports multiple clients and conversations simultaneously, with features like conversation persistence, idle timeouts, and ephemeral conversation cleanup.
+The `agent-server` package is a TypeScript library that implements a long-running WebSocket server for hosting TypeAgent dispatchers. It serves as the central hub for managing client connections, orchestrating conversations, and facilitating communication between clients and agents. The server supports multiple clients and conversations simultaneously, with features like conversation persistence, idle timeouts, and ephemeral conversation cleanup.
 
 ## What it does
 
@@ -169,6 +169,6 @@ _8 environment variables referenced from `./src/` (set in `ts/.env` or your shel
 
 ---
 
-_Auto-generated against commit `d9ee555d43867e97462e8fa147f7ef73b8da05ec` on `2026-07-19T20:27:13.071Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter agent-server docs:verify-links` to spot-check._
+_Auto-generated against commit `6bea19a9ee02598644b1ac3ab67c705dcc495832` on `2026-07-22T11:19:17.632Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter agent-server docs:verify-links` to spot-check._
 
 <!-- AUTOGEN:DOCS:END -->

ts/packages/agentServer/server/package.json

@@ -55,7 +55,7 @@
     "dispatcher-node-providers": "workspace:*",
     "dotenv": "^16.3.1",
     "websocket-channel-server": "workspace:*",
-    "ws": "^8.21.0"
+    "ws": "^8.21.1"
   },
   "devDependencies": {
     "@jest/globals": "^29.7.0",

ts/packages/agents/browser/README.AUTOGEN.md

@@ -3,7 +3,7 @@
 
 <!-- AUTOGEN:DOCS:START -->
 
-<!-- AUTOGEN:DOCS:HASH:sha256=cdde40bd7812a7315b84d1a8217623e31504146cd8e2831dc52f1cee3b2fdcc5 -->
+<!-- AUTOGEN:DOCS:HASH:sha256=6a4d71a1c1615e3e46ffa890b4f5709cb10d4bdebf113480e2f93c8375f3e4a8 -->
 <!-- AUTOGEN:DOCS:SOURCE: ./README.md (hand-written documentation; this file is the AI-generated companion) -->
 
 # browser-typeagent — AI-generated documentation
@@ -16,7 +16,7 @@ The `browser-typeagent` package is a TypeAgent application agent designed for br
 
 ## What it does
 
-The `browser-typeagent` package provides a comprehensive set of browser automation capabilities, enabling users to interact with web pages and manage browser sessions programmatically. Key functionalities include:
+The `browser-typeagent` package provides a wide range of browser automation capabilities, enabling users to interact with web pages and manage browser sessions programmatically. Key functionalities include:
 
 - **Web Navigation**: Actions such as `openWebPage`, `goBack`, `goForward`, and `reloadPage` allow users to navigate between web pages and control browser tabs.
 - **User Interaction**: Users can interact with web content using actions like `clickOn`, `followLinkByText`, `scrollDown`, and `scrollUp`.
@@ -87,8 +87,8 @@ The `browser-typeagent` package is organized into several key files, each respon
   - [src/agent/browserSchema.agr](./src/agent/browserSchema.agr): Contains the action grammar for the browser agent.
 
 - **Extension Components**:
-  - [src/extension/contentScript/index.ts](./src/extension/contentScript/index.ts): Entry point for the browser extension's content script.
-  - [src/extension/serviceWorker/index.ts](./src/extension/serviceWorker/index.ts): Manages the service worker for the browser extension.
+  - src/extension/contentScript/index.ts: Entry point for the browser extension's content script.
+  - src/extension/serviceWorker/index.ts: Manages the service worker for the browser extension.
 
 ## How to extend
 
@@ -123,11 +123,7 @@ By following these steps, you can enhance the `browser-typeagent` package to sup
 
 - `./agent/manifest` → [./src/agent/manifest.json](./src/agent/manifest.json)
 - `./agent/handlers` → [./dist/agent/browserActionHandler.mjs](./dist/agent/browserActionHandler.mjs)
-- `./agent/types` → [./dist/common/browserControl.mjs](./dist/common/browserControl.mjs)
 - `./agent/indexing` → [./dist/agent/indexing/browserIndexingService.js](./dist/agent/indexing/browserIndexingService.js)
-- `./contentScriptRpc/types` → [./dist/common/contentScriptRpc/types.mjs](./dist/common/contentScriptRpc/types.mjs)
-- `./contentScriptRpc/client` → [./dist/common/contentScriptRpc/client.mjs](./dist/common/contentScriptRpc/client.mjs)
-- `./htmlReducer` → [./dist/common/crossContextHtmlReducer.js](./dist/common/crossContextHtmlReducer.js)
 
 ### Dependencies
 
@@ -142,6 +138,7 @@ Workspace:
 - [@typeagent/agent-server-client](../../../packages/agentServer/client/README.md)
 - [@typeagent/agent-server-protocol](../../../packages/agentServer/protocol/README.md)
 - [@typeagent/aiclient](../../../packages/aiclient/README.md)
+- [@typeagent/browser-control-rpc](../../../packages/agents/browserControlRpc/README.md)
 - [@typeagent/common-utils](../../../packages/utils/commonUtils/README.md)
 - [@typeagent/config](../../../packages/config/README.md)
 - [@typeagent/dispatcher-rpc](../../../packages/dispatcher/rpc/README.md)
@@ -158,15 +155,14 @@ Workspace:
 - [website-memory](../../../packages/memory/website/README.md)
 - [websocket-channel-server](../../../packages/utils/webSocketChannelServer/README.md)
 
-External: `@anthropic-ai/claude-agent-sdk`, `@modelcontextprotocol/sdk`, `@mozilla/readability`, `@popperjs/core`, `bootstrap`, `chalk`, `cheerio`, `cytoscape`, `cytoscape-dagre`, `dagre`, `debug`, `dompurify`, `express`, `express-rate-limit`, `graphology`, `graphology-communities-louvain`, `graphology-layout`, `graphology-layout-forceatlas2`, `graphology-layout-noverlap`, `graphology-types`
+External: `@anthropic-ai/claude-agent-sdk`, `@modelcontextprotocol/sdk`, `chalk`, `cheerio`, `debug`, `dompurify`, `express`, `express-rate-limit`, `graphology`, `graphology-communities-louvain`, `graphology-layout`, `graphology-layout-forceatlas2`, `graphology-layout-noverlap`, `graphology-types`, `html-to-text`, `jsdom`, `jsonpath`, `pdfjs-dist`, `puppeteer`, `puppeteer-extra`
 
-_…and 18 more not shown._
+_…and 10 more not shown._
 
 ### Used by
 
 - [agent-shell](../../../packages/shell/README.md)
 - [default-agent-provider](../../../packages/defaultAgentProvider/README.md)
-- utility-typeagent
 
 ### Files of interest
 
@@ -175,12 +171,12 @@ _…and 18 more not shown._
 - [./src/agent/browserSchema.agr](./src/agent/browserSchema.agr)
 - [./src/agent/indexing/index.mts](./src/agent/indexing/index.mts)
 - [./src/agent/webFlows/index.mts](./src/agent/webFlows/index.mts)
-- [./src/extension/contentScript/continuationHandler.ts](./src/extension/contentScript/continuationHandler.ts)
-- [./src/extension/contentScript/index.ts](./src/extension/contentScript/index.ts)
-- [./src/extension/contentScript/recording/index.ts](./src/extension/contentScript/recording/index.ts)
-- [./src/extension/serviceWorker/index.ts](./src/extension/serviceWorker/index.ts)
-- [./src/extension/webagent/crossword/crosswordSchema.agr](./src/extension/webagent/crossword/crosswordSchema.agr)
-- _…and 294 more under `./src/`._
+- [./src/puppeteer/index.mts](./src/puppeteer/index.mts)
+- [./src/agent/agentServiceHandlers.mts](./src/agent/agentServiceHandlers.mts)
+- [./src/agent/agentWebSocketServer.mts](./src/agent/agentWebSocketServer.mts)
+- [./src/agent/browserActionHandler.mts](./src/agent/browserActionHandler.mts)
+- [./src/agent/browserActions.mts](./src/agent/browserActions.mts)
+- _…and 161 more under `./src/`._
 
 ### Environment variables
 
@@ -191,6 +187,6 @@ _2 environment variables referenced from `./src/` (set in `ts/.env` or your shel
 
 ---
 
-_Auto-generated against commit `d9ee555d43867e97462e8fa147f7ef73b8da05ec` on `2026-07-19T20:27:13.071Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter browser-typeagent docs:verify-links` to spot-check._
+_Auto-generated against commit `6bea19a9ee02598644b1ac3ab67c705dcc495832` on `2026-07-22T11:19:17.632Z` by `docs-generate.yml`. Links validated at that commit; the working tree may have drifted by up to 24h. Re-run `pnpm --filter browser-typeagent docs:verify-links` to spot-check._
 
 <!-- AUTOGEN:DOCS:END -->

ts/packages/agents/browser/package.json

@@ -64,7 +64,7 @@
     "cheerio": "^1.1.0",
     "conversation-memory": "workspace:*",
     "debug": "^4.4.0",
-    "dompurify": "^3.4.11",
+    "dompurify": "^3.4.12",
     "express": "^4.22.0",
     "express-rate-limit": "^7.5.0",
     "graphology": "^0.25.4",
@@ -92,7 +92,7 @@
     "typescript": "~5.4.5",
     "website-memory": "workspace:*",
     "websocket-channel-server": "workspace:*",
-    "ws": "^8.21.0",
+    "ws": "^8.21.1",
     "xss": "^1.0.15",
     "yaml": "^2.8.3",
     "zod": "^4.1.13"