lexmount · 254808127 · Aug 18, 2026 · Aug 18, 2026 · Aug 18, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       - run: npm run package:verify
       - name: Verify native source pin
         run: |
-          node --input-type=module -e "import source from './native-source.json' with { type: 'json' }; if (source.commit !== 'f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4' || source.version !== '1.1.12') process.exit(1)"
+          node --input-type=module -e "import source from './native-source.json' with { type: 'json' }; if (source.commit !== '3af544780365309feae97d51b631070e7ca73762' || source.version !== '1.1.13') process.exit(1)"
       - name: Verify Bundle manifest
         run: |
           node --input-type=module -e "import pkg from './package.json' with { type: 'json' }; if (pkg.dsh?.bundle?.patch !== './cordis.patch.yml') process.exit(1)"

diff --git a/README.md b/README.md
@@ -29,7 +29,7 @@ The npm tarball contains no `browser-cli` or `browser-cli.exe` file. End users d
 | macOS Intel | `x86_64-apple-darwin` | Not currently supported; asset missing |
 | Linux x64 | `x86_64-unknown-linux-musl` | Not currently supported; asset missing |
 
-`native-source.json` pins `browser-cli` v1.1.12 at commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`. This pre-release intentionally uses the two assets published by that immutable release. Adding Linux or macOS Intel requires a new browser-cli version and a new npm package version with fresh validation; it will not mutate this release in place.
+`native-source.json` pins `browser-cli` v1.1.13 at commit `3af544780365309feae97d51b631070e7ca73762`. The Windows asset in this release statically links the C runtime. This pre-release intentionally uses the two assets published by that immutable release. Adding Linux or macOS Intel requires a new browser-cli version and a new npm package version with fresh validation; it will not mutate this release in place.
 
 ## Install
 
@@ -175,7 +175,7 @@ npm run check
 npm run package:verify
 ```
 
-On a currently supported host, test a locally built v1.1.12 CLI without changing the package:
+On a currently supported host, test a locally built v1.1.13 CLI without changing the package:
 
 ```bash
 LEXMOUNT_BROWSER_CLI_PATH=/absolute/path/to/browser-cli npm run test:native

diff --git a/docs/implementation-status.md b/docs/implementation-status.md
@@ -1,6 +1,6 @@
 # Implementation status
 
-Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first npm preview and its matching Git tag are published; stable support remains blocked by real Windows/macOS and Lexmount service validation.
+Status updated on 2026-08-18 for the `@lexmount/dsh-browser@0.1.0-rc.3` candidate. Earlier npm previews and their matching Git tags are published; stable support remains blocked by real Windows/macOS and Lexmount service validation.
 
 ## Completed and verified
 
@@ -14,7 +14,7 @@ Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first
 - Screenshot output is stored through the DSH image attachment service; temporary screenshot files are removed. RC.6 PDF/download attachment limitations are documented separately.
 - `npm run check` passes 21 automated tests covering source/target pins, deferred unsupported-platform errors, checksum parsing, executable rejection paths, explicit-path resolution, protocol parsing, redaction, cancellation, forced cleanup, schema/argv mapping, 31-tool registration, and screenshot cleanup.
 - `npm run package:verify` reports a 24-file npm payload and rejects any native executable path. The current unpacked wrapper is about 105 KiB.
-- `npm run native:assets` resolves the official v1.1.12 tag to the pinned commit, downloads the Windows x64 and macOS ARM64 assets from COS, and verifies both SHA-256 digests successfully.
+- `npm run native:assets` resolves the official v1.1.13 tag to the pinned commit, downloads the Windows x64 and macOS ARM64 assets from COS, and verifies both SHA-256 digests successfully. The Windows PE import table has no dynamic Visual C++ runtime dependency.
 - `npm audit --omit=dev` reports zero known vulnerabilities.
 - The release workflow uses tag-only assembly, pins Node 24.15.0 and npm 12.0.2, creates one tarball, verifies it contains no executable, and passes the exact artifact through the npm environment approval gate without rebuilding.
 - The previous bundled Linux binary and all `vendor/` package entries have been removed from the working tree.
@@ -28,11 +28,11 @@ Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first
 ## Native source currently pinned
 
 - repository: `https://github.com/lexmount/browser-cli-rs.git`;
-- version: `1.1.12`;
-- tag commit: `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`;
-- COS base: `https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12`.
+- version: `1.1.13`;
+- tag commit: `3af544780365309feae97d51b631070e7ca73762`;
+- COS base: `https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13`.
 
-The upstream v1.1.12 Action completed successfully and published macOS ARM64 and Windows x64. Those are the only platforms claimed by this npm pre-release. Linux x64 and macOS Intel are deferred to a new native and npm version.
+The upstream v1.1.13 Action completed successfully and published macOS ARM64 and Windows x64. Its Windows build statically links the C runtime. Those are the only platforms claimed by this npm pre-release. Linux x64 and macOS Intel are deferred to a new native and npm version.
 
 ## Not yet complete
 

diff --git a/docs/manual-platform-validation.md b/docs/manual-platform-validation.md
@@ -14,9 +14,9 @@ Run this checklist against the exact npm tarball that will be published. The cur
 
 ## First download and cache
 
-1. Reinstall, run `lexmount_doctor`, and confirm the first tool call downloads exactly the current platform asset from the pinned v1.1.12 COS path.
+1. Reinstall, run `lexmount_doctor`, and confirm the first tool call downloads exactly the current platform asset from the pinned v1.1.13 COS path.
 2. Compare the cached executable hash with its `SHA256SUMS` entry.
-3. Confirm cache metadata records v1.1.12, commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`, platform target, asset name, and digest.
+3. Confirm cache metadata records v1.1.13, commit `3af544780365309feae97d51b631070e7ca73762`, platform target, asset name, and digest.
 4. Disconnect outbound network access, restart DSH, and confirm the verified cache still runs.
 5. Corrupt a disposable copy of the cache, restore network access, and confirm the next call refuses the corrupt file and replaces it from the pinned release.
 6. Cancel a first-use download and confirm no temporary executable is selected or left as the active cache entry.
@@ -58,17 +58,18 @@ Run this checklist against the exact npm tarball that will be published. The cur
 
 ### Windows x64
 
-- Asset: `browser-cli-v1.1.12-x86_64-pc-windows-msvc.exe`.
+- Asset: `browser-cli-v1.1.13-x86_64-pc-windows-msvc.exe`.
+- The PE import table contains no `VCRUNTIME` or `api-ms-win-crt` dependency.
 - SmartScreen/antivirus behavior is documented for the unsigned binary.
 - Cache paths containing spaces and non-ASCII characters work.
-- The CLI reports v1.1.12 and cancellation leaves no `browser-cli.exe` process.
+- The CLI reports v1.1.13 and cancellation leaves no `browser-cli.exe` process.
 
 ### macOS Apple Silicon
 
-- Asset: `browser-cli-v1.1.12-aarch64-apple-darwin`.
+- Asset: `browser-cli-v1.1.13-aarch64-apple-darwin`.
 - `codesign --verify --strict` succeeds.
 - Gatekeeper accepts the notarized executable on a clean machine.
-- The process is native arm64 and reports browser-cli v1.1.12.
+- The process is native arm64 and reports browser-cli v1.1.13.
 
 macOS Intel and Linux are not part of this pre-release validation because the pinned native release has no assets for them.
 

diff --git a/docs/release-access.md b/docs/release-access.md
@@ -4,7 +4,7 @@ Observed on 2026-08-18. These are external publication and account facts, not br
 
 ## Confirmed available
 
-- `browser-cli` v1.1.12 is an official public tag at commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`.
+- `browser-cli` v1.1.13 is an official public tag at commit `3af544780365309feae97d51b631070e7ca73762`.
 - Its GitHub release and COS path publicly expose the two assets claimed by this npm pre-release: Windows x64 and macOS ARM64.
 - `npm run native:assets` downloads both files and verifies their pinned SHA-256 digests.
 - npm account `lexmount` has read-write access to `@lexmount/dsh-browser`.

diff --git a/native-source.json b/native-source.json
@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
   "name": "browser-cli",
-  "version": "1.1.12",
+  "version": "1.1.13",
   "repository": "https://github.com/lexmount/browser-cli-rs.git",
-  "commit": "f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4",
+  "commit": "3af544780365309feae97d51b631070e7ca73762",
   "download": {
-    "baseUrl": "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12",
+    "baseUrl": "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13",
     "checksums": "SHA256SUMS"
   },
   "targets": {

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lexmount/dsh-browser",
-  "version": "0.1.0-rc.2",
+  "version": "0.1.0-rc.3",
   "description": "Lexmount cloud browser tools for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",

diff --git a/src/binary.ts b/src/binary.ts
@@ -21,12 +21,12 @@ import { HarnessError } from "@deepseek-ai/dsh-llm";
 import { isJsonRecord, type JsonValue } from "./json.js";
 import { redactText } from "./redact.js";
 
-export const EXPECTED_CLI_VERSION = "1.1.12";
-export const EXPECTED_CLI_COMMIT = "f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4";
+export const EXPECTED_CLI_VERSION = "1.1.13";
+export const EXPECTED_CLI_COMMIT = "3af544780365309feae97d51b631070e7ca73762";
 export const EXPECTED_CLI_REPOSITORY =
   "https://github.com/lexmount/browser-cli-rs.git";
 export const EXPECTED_DOWNLOAD_BASE_URL =
-  "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12";
+  "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13";
 
 const CHECKSUM_ASSET = "SHA256SUMS";
 const MAX_CHECKSUM_BYTES = 1024 * 1024;
@@ -36,22 +36,22 @@ const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 const PLATFORM_TARGETS = {
   "win32-x64": {
-    asset: "browser-cli-v1.1.12-x86_64-pc-windows-msvc.exe",
+    asset: "browser-cli-v1.1.13-x86_64-pc-windows-msvc.exe",
     executable: "browser-cli.exe",
     target: "x86_64-pc-windows-msvc",
   },
   "darwin-arm64": {
-    asset: "browser-cli-v1.1.12-aarch64-apple-darwin",
+    asset: "browser-cli-v1.1.13-aarch64-apple-darwin",
     executable: "browser-cli",
     target: "aarch64-apple-darwin",
   },
   "darwin-x64": {
-    asset: "browser-cli-v1.1.12-x86_64-apple-darwin",
+    asset: "browser-cli-v1.1.13-x86_64-apple-darwin",
     executable: "browser-cli",
     target: "x86_64-apple-darwin",
   },
   "linux-x64": {
-    asset: "browser-cli-v1.1.12-x86_64-unknown-linux-musl",
+    asset: "browser-cli-v1.1.13-x86_64-unknown-linux-musl",
     executable: "browser-cli",
     target: "x86_64-unknown-linux-musl",
   },

diff --git a/test/binary.test.mjs b/test/binary.test.mjs
@@ -80,7 +80,7 @@ test("selects only the two currently published platform keys", () => {
 });
 
 test("reads the exact asset checksum from a sha256sum manifest", () => {
-  const asset = "browser-cli-v1.1.12-x86_64-unknown-linux-musl";
+  const asset = "browser-cli-v1.1.13-x86_64-unknown-linux-musl";
   const digest = "a".repeat(64);
   assert.equal(
     checksumForAsset(`${"b".repeat(64)}  other\n${digest} *${asset}\n`, asset),

diff --git a/test/native-cli.test.mjs b/test/native-cli.test.mjs
@@ -25,7 +25,7 @@ test("downloads, resolves, and executes the native browser CLI", async () => {
   const signal = new AbortController().signal;
   try {
     const version = await runner.run(["version"], signal);
-    assert.equal(version.version, "1.1.12");
+    assert.equal(version.version, "1.1.13");
 
     const status = await runner.run(["auth", "status"], signal);
     assert.equal(typeof status.valid, "boolean");