Melaya Extension v0.1.66:
- Tightened the panel's network policy (CSP connect-src) to HTTPS/WSS only
- Trimmed host permissions to the minimum required
- Minor security hardening
- HITL Cards per conversation

Melaya Browser Extension 0.1.64
New
- HITL approval cards over a live socket — no polling
- Cards hydrate on panel open and on every reconnect
- Approval card redesigned: neumorphic dome, breathing violet halo, recessed args well
- Per-conversation settings restore on switch: model, provider, autonomy, connectors, tab scope, persona
- Settings and persona now stored server-side, so they follow you across devices and reinstalls

Fixed
-Connector approvals never appeared — every card that wasn't a browser action was filtered out, so a connector write hung indefinitely with nothing to approve
- Approval cards only existed while a turn was streaming; one raised at the end, or before the panel opened, was invisible
- Safe mode let consequential clicks through — create, delete, save, confirm, invite, transfer, revoke and every non-English label now gate
- Enter-to-submit, select_option and coordinate-only clicks bypassed the gate entirely
- Stopping a turn then asking something else resumed the stopped task
- Full-page screenshots left the page rendered shrunk
- Update banner showed permanently, and its dismiss button did nothing
- Update banner wrapped to two rows and could navigate the panel away
- Duplicate and stale tooltips on the header and settings seam
- The upgrade arrow reached the account overview instead of the plan picker