What's new

- CLI package provenance now identifies the `krispyhq/krispyai` repository, and npm preserves the Bun executable mapping during publication.

- Operator reply drafts request distinct useful approaches and allow a single supported suggestion instead of multiple paraphrases of the same answer. - Edge: stop-offer outbox requests use the Cloud API's `actionEventId` field, allowing device cleanup events to be acknowledged. - Edge: successful private media reads include CORS headers so guest browsers can load operator-sent attachments. - Widget: sent image and video bubbles no longer collapse to a thin strip when their content is taller than the visible chat log.

- Visitor handoff forms now occupy full-width rows, with Instagram links in an evenly sized responsive group. This prevents mixed-width, misaligned choices in narrow and right-to-left chat panels.

- Pinned new agent worktrees to WT0 0.1.20 and removed the older readiness fallback.

- Edge: **`ALLOWED_ORIGIN` accepts a comma-separated origin list.** The CORS header can only carry one origin, so the list is matched against the request's own `Origin` and echoed back at a single fetch boundary (`finalizeCors`); `Vary: Origin` rides along so a cache never serves one origin's header to another. Single-origin and wildcard (`*`) behavior are unchanged, and the 55 `json()`/`cors()` call sites are untouched. (PR #58.)

- Widget + edge: **paste a screenshot into the chat.** Support is the one conversation where a picture _is_ the message — a broken layout, an error dialog, a line on a statement — and until now the visitor had to describe it in words, which is exactly what they were already failing to do when they reached for the chat. `Ctrl`/`Cmd`+`V` and drag-and-drop both work; the image lands in a tray above the composer with a thumbnail and a remove control, and is sent with the next message.

- Widget: **the composer grows with the message.** The message field was an `<input>`, which can hold exactly one line no matter how long the message is — anyone reporting a real problem typed into a slot that showed them ~40 characters of what they had written. It is now a `<textarea class="in">` that starts at one line and animates its height as the content wraps, up to 5 rows, after which it scrolls (`.in.tall`). Height is animated (`0.18s`), and dropped under `prefers-reduced-motion`. **Enter still sends** and `Shift`/`Ctrl`/`Cmd`+`Enter` opens a new line; `isComposing` is honoured so Enter never sends mid-IME-composition in Japanese/Chinese/Korean input. The composer is `align-items:flex-end` so the send button stays on the last line rather than drifting to the middle of a paragraph. Sending resets the field to one line on the same transition.