[GenoDevelop]

Updates genodevelop/refined-chat to v0.5.0 and moves it out of Themes.

Pin. artifact.commit and repository.commit move from 52b907fe4ba1b4a1975e02ddb3b92d9f0b6479e0 (v0.4.0) to 088d860fecb5154ba5973816f528a6781028d7f9 (tag v0.5.0). Release notes: https://github.com/GenoDevelop/paseo-refined-chat/releases/tag/v0.5.0. 0.5.0 adds a file preview side panel, links between files and headings, and path handling on tool cards. It also fixes a gap in 0.4.0: the daemon's image and edit-line lookups did not refuse network paths (\\host\share), which on Windows contacts that host. Every call that takes a path from a reply now refuses them. Installing the tag with paseo plugin add git:GenoDevelop/paseo-refined-chat --ref v0.5.0 gives a running plugin.

Categories. [extras,utils,themes] becomes [extras,utils,workspaces]. Refined Chat is not a theme: it restyles chat replies and tool cards and adds a workspace panel. I ticked Themes by mistake in the first submission, and it is why the plugin appears under the Themes tab on paseo.cafe.

I left the date fields for the reviewer, as the README says the bot writes them. This is one PR because both changes edit the same record.

🤖 Generated with Claude Code

[paseo-bot]

Refined Chat 0.5.0 is approved, merged and published, @GenoDevelop. I kept your requested Workspaces category and reviewed pin, updated the review timestamp, and retained your overview, description and interface image. Nothing is required from you.

For the next release, add the file-preview panel, its 1 MB text limit and the outside-project setting to your shipped OVERVIEW.md, so readers understand the new capability and file access before installing. See the listing-page guidance.

Review data

• Policy: main REVIEW.md, blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head: 536b7fa201b17d62777efe7075fa3457a6f71654.
• Artifact: https://github.com/GenoDevelop/paseo-refined-chat.git, root directory, commit/tag v0.5.0 at 088d860fecb5154ba5973816f528a6781028d7f9, tree 7ad964af293554d89b683a548d3a5f313cbe0608. Independently fetched and compared with the previous pin 52b907fe4ba1b4a1975e02ddb3b92d9f0b6479e0. Archive paths and file types checked before extraction; no submodules or hooks used. Original accepted submission #1645, this PR and repository ownership identify the same human account (API ID 209021332). MIT fork/font attribution is retained.
• Inspected the complete changed runtime, both entries and their affected RPC callers, Markdown parsing/link/image handling, preview panel/navigation, preferences, clipboard/font changes, manifest/package/lock, README, overview and image. Local imports resolve. No translations are supplied.
• Preparation remains npm ci --omit=dev --ignore-scripts; no invoked plugin script. Package and lock root declarations agree. All 43 production dependency entries, sources and SHA-512 pins are unchanged from the previous reviewed artifact, whose dependency archives were integrity-verified in the original review. Origins remain registry.npmjs.org; no production install-script flags. This bump does not re-audit every unchanged dependency implementation.
• Clicking a file path opens the preview panel (client/live-renderers.tsx:420, client/file-preview.tsx:175); file.read (index.server.ts:500) resolves symlinks, checks project containment unless the user enables outside-project reads, rejects non-files, checks 1 MB size and rejects a NUL in the first 8 KB. Contents return to the connected client for rendering/highlighting. These checks do not claim isolation against concurrent filesystem changes. Images retain their separate 3 MB path and are not subject to the text-preview project restriction.
• Network-path checks precede direct file lookups in reveal, kind, text/image read and edit-location handlers. This is a direct-path check, not a guarantee about network-backed symlink targets. Local image preview and completed-edit lookup retain purposeful file access; no new unrelated secret collection, file write/delete or installer was found. Remote Markdown images remain click-to-load unless the user enables automatic loading; loading contacts the supplied destination. External links remain user initiated with HTTP/HTTPS/mailto schemes.
• File-manager reveal uses platform subprocess argument arrays, without a shell string. Syntax highlighting uses installed local libraries. Preferences remain local client storage; Copy uses the host clipboard on click. No separate telemetry or remote-code execution path was found in the inspected changes.
• Registry edits: author pin/category changes retained; reviewer updated only reviewedAt. The shipped English overview/description and existing PNG interface image remain adequate; no redundant registry fallback added. Overview advice above is optional.
• Publish run completed successfully; the served registry and listing page were checked with the new pin and Workspaces category.
• Trusted main scripts are unchanged in the PR. Online changed-record validation: 439 well-formed records, one matched pinned artifact, zero skipped. All 189 registry tests passed. Plugin/dependency code was never installed, built, imported or run. No live UI, Windows/network-share, native rendering or file-manager QA was performed. Dependency and decoder internals were not exhaustively inspected.