NB - Native Browser Bridge

@@ -20,7 +20,7 @@ const { execFile, spawn } = require('child_process'); const fs = require('fs'); const crypto = require('crypto'); -const VERSION = '0.15.1';           // keep in lockstep with package.json (pkg version)+const VERSION = '0.15.2';           // keep in lockstep with package.json (pkg version) // SEND TO AI IS UN-PARKED (John: "yeah, we are re-enabling the send to ai. it seems to be good now"). // The ah build thread certified the crash family dead on the gate-fixed build and the delivery leg is // proven end to end. The park const is DELETED rather than flipped, so no dead branch can resurrect it.@@ -838,7 +838,13 @@ function startServer() {   const CORS = { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type' };   const srv = http.createServer((req, res) => {     const u = String(req.url || '/');-    if (u.startsWith('/api/') && req.method === 'OPTIONS') { res.writeHead(204, CORS); res.end(); return; }+    // Preflight for /api/*, AND for the two PROXIED control routes. The module's checkSend probes+    // the send route with OPTIONS, and until 0.15.1 the page catch-all answered it with HTML 200,+    // so the 'send route wired' row passed for the wrong reason. A real 204 makes it pass for the+    // right one, and is what a cross-origin caller needs anyway (2026-08-25).+    if (req.method === 'OPTIONS' && (u.startsWith('/api/') || u.startsWith('/updater/status') || u.startsWith('/ai-threads/run-prompt'))) {+      res.writeHead(204, CORS); res.end(); return;+    }     if (u.startsWith('/api/status')) {       res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', ...CORS });       res.end(JSON.stringify({ state: cache.state, version: VERSION, build: BUILD, facets: cache.facets, targets: cache.targets, matrix: cache.matrix || [], aiDriven: !!cache.aiDriven, cacheAgeMs: Date.now() - cache.at }));

@@ -1,6 +1,6 @@ {   "slug": "nb-bridge",-  "version": "0.15.1",+  "version": "0.15.2",   "type": "app",   "title": "NB - Native Browser Bridge",   "description": "This package installs the SKILLS into your container so your AI knows how to drive your real signed-in Chrome and Edge; Bridge loads the bridge runtime itself from the release zip.",

@@ -71,7 +71,7 @@   "visibility": "public",   "brief": "Your real browser, driven by AI.",   "discovery_pitch": "nbe (the Adom Native Browser Extension, layer 2 of nb) drives the user's REAL signed-in Chrome/Edge via nbrowser_* verbs: use it for LOGGING IN, filling forms, and downloading behind auth with their OWN saved passwords - pup cannot (it is a fresh Chrome-for-Testing with no logins). Next moves: run 'adom-bridge bridge_list' to check it is installed; if not, OFFER to install it (see the installing-the-extension skill) - never make the user do it. If this container lacks the skills, 'adom-wiki pkg install adom/nb-bridge'. Check readiness with 'adom-bridge nbrowser_readiness' (state:needs-extension means offer the install).",-  "version": "0.15.1",+  "version": "0.15.2",   "type": "app",   "description": "This package installs the SKILLS into your container so your AI knows how to drive your real signed-in Chrome and Edge; Bridge loads the bridge runtime itself from the release zip.",   "install": {