@ait-co/devtools 0.1.132 → 0.1.133

package/dist/mcp/cli.js

@@ -2024,7 +2024,7 @@ async function readMcpSdkVersion() {
 * some test environments that skip the build step).
 */
 function readDevtoolsVersion() {
-	return "0.1.132";
+	return "0.1.133";
 }
 /**
 * Derives the next recommended action from a completed diagnostics snapshot.
@@ -2932,6 +2932,110 @@ function buildIndicatorExpression(opts) {
 * Node-only. react-free. CdpConnection only.
 */
 /**
+* `__AIT_PERMS__` key → SDK function name whose `.getPermission()` is probed
+* (devtools#739). This is the exact contract sdk-example#265 consumes — do
+* not rename keys without a coordinated sdk-example update.
+*
+* Each SDK function is reached via `window.__sdk` — the SAME page-global
+* bridge `src/in-app/auto.ts` installs for `call_sdk`/`__sdkCall` (see
+* `src/test-runner/bundle.ts`'s `sdkRedirectPlugin`, which redirects bundled
+* `@apps-in-toss/web-framework` imports to this same object at runtime). The
+* test-runner bundle owns no independent SDK import — `window.__sdk` is a
+* page global regardless of whether a bundle has been injected yet, so this
+* preflight runs standalone via `injectGlobals`'s `Runtime.evaluate`
+* mechanism BEFORE the first bundle, rather than being prepended into
+* `rpc.ts#buildRunTestsExpression`. (Design choice documented in PR #739 —
+* bundle-prepend was the fallback plan if the SDK were only reachable from
+* inside bundle scope, which reality ruled out.)
+*/
+const PERMISSION_PROBE_MAP = {
+	clipboardRead: "getClipboardText",
+	clipboardWrite: "setClipboardText",
+	album: "fetchAlbumPhotos",
+	camera: "openCamera",
+	contacts: "fetchContacts",
+	location: "getCurrentLocation"
+};
+/** Non-fatal bound for the permission preflight `Runtime.evaluate` round-trip. */
+const PERMISSION_PREFLIGHT_TIMEOUT_MS = 1e4;
+/**
+* Builds the `Runtime.evaluate` expression for the permission-state preflight
+* (devtools#739). Evaluated ONCE per relay session, before the first test
+* bundle is injected (see `relay-worker.ts#runTestFilesOverRelay`).
+*
+* For each entry in {@link PERMISSION_PROBE_MAP}, probes
+* `window.__sdk.<fn>.getPermission()` — a NON-blocking query (never
+* `openPermissionDialog`/`requestPermission`, which open native UI) — and
+* assigns the resolved `'allowed'|'denied'|'notDetermined'` status to
+* `globalThis.__AIT_PERMS__[<key>]`. A probe that is absent, throws, or
+* rejects resolves to `'unavailable'` — this expression never throws to its
+* caller, and a single slow/broken permission must not fail the others (each
+* probe is awaited independently, not short-circuited).
+*
+* Tests (sdk-example#265) read `globalThis.__AIT_PERMS__` to branch
+* deterministically per permission state instead of blanket outcome-branching.
+*
+* Returns a JSON-serialised string (the same double-serialisation pattern
+* `rpc.ts#buildRunTestsExpression` uses) rather than relying on CDP
+* `returnByValue` structural fidelity for a plain object across the Chii
+* relay — the Node side re-parses via `JSON.parse`.
+*
+* Pure function — no I/O, no CDP call. Callers pass the returned string to
+* `Runtime.evaluate`.
+*/
+function buildPermissionPreflightExpression() {
+	return `(async () => {  const probe = async (fnName) => {    try {      const fn = globalThis.__sdk && globalThis.__sdk[fnName];      if (!fn || typeof fn.getPermission !== 'function') return 'unavailable';      const status = await fn.getPermission();      if (status === 'allowed' || status === 'denied' || status === 'notDetermined') return status;      return 'unavailable';    } catch (e) {      return 'unavailable';    }  };  const result = {};${Object.entries(PERMISSION_PROBE_MAP).map(([key, fnName]) => `    result[${JSON.stringify(key)}] = await probe(${JSON.stringify(fnName)});`).join("\n")}\n  globalThis.__AIT_PERMS__ = result;  return JSON.stringify(result);})()`;
+}
+/**
+* Runs the permission-state preflight (devtools#739) via `Runtime.evaluate`
+* and returns the collected `__AIT_PERMS__` map, or `undefined` when the
+* preflight itself failed or timed out.
+*
+* NON-FATAL by design: any failure (CDP exception, timeout, page-side throw)
+* is caught here, logged as ONE stderr line, and swallowed — the whole test
+* run must proceed even when the preflight cannot complete (e.g. `window.__sdk`
+* not yet installed, or a page navigation mid-attach). Callers that want the
+* result for report provenance (`RelayRunReport.preflight`) get `undefined`
+* in that case, which downstream code treats the same as "not run".
+*
+* SECRET-HANDLING: no relay/wss/secret values are read or logged; only
+* permission-state strings cross this boundary.
+*
+* @param conn      - The live CDP connection (relay-attached page).
+* @param timeoutMs - Round-trip bound. Defaults to {@link PERMISSION_PREFLIGHT_TIMEOUT_MS}.
+*/
+async function runPermissionPreflight(conn, timeoutMs = PERMISSION_PREFLIGHT_TIMEOUT_MS) {
+	const TIMEOUT_SENTINEL = Symbol("permission-preflight-timeout");
+	const timeoutPromise = new Promise((resolve) => setTimeout(() => resolve(TIMEOUT_SENTINEL), timeoutMs));
+	try {
+		const evalPromise = conn.send("Runtime.evaluate", {
+			expression: buildPermissionPreflightExpression(),
+			returnByValue: true,
+			awaitPromise: true
+		});
+		const raceResult = await Promise.race([evalPromise.then((v) => ({
+			tag: "eval",
+			v
+		})), timeoutPromise.then(() => ({ tag: "timeout" }))]);
+		if (raceResult.tag === "timeout") {
+			process.stderr.write(`test-runner: permission preflight timed out after ${timeoutMs}ms — proceeding with __AIT_PERMS__ unset\n`);
+			return;
+		}
+		if (raceResult.v.exceptionDetails) {
+			process.stderr.write("test-runner: permission preflight threw — proceeding with __AIT_PERMS__ unset\n");
+			return;
+		}
+		const rawValue = raceResult.v.result.value;
+		if (typeof rawValue !== "string") return void 0;
+		const parsed = JSON.parse(rawValue);
+		if (typeof parsed !== "object" || parsed === null) return void 0;
+		return parsed;
+	} catch (e) {
+		process.stderr.write(`test-runner: permission preflight failed (${e instanceof Error ? e.message : String(e)}) — proceeding with __AIT_PERMS__ unset\n`);
+		return;
+	}
+}
+/**
 * Injects each key of `globals` into `globalThis` in the page via a single
 * `Runtime.evaluate` call. Must be called BEFORE the first `bundleTestFile`
 * inject — the cell is session-global and applies to all subsequent files.
@@ -4178,6 +4282,8 @@ async function runTestFilesOverRelay(connection, files, opts) {
 	const manualFiles = opts?.manualFiles;
 	const manualTotal = manualFiles?.size ?? 0;
 	let manualIndex = 0;
+	let preflightPermissions;
+	if (files.length > 0) preflightPermissions = await runPermissionPreflight(connection);
 	try {
 		for (const file of files) {
 			if (pendingReconnectCheck) {
@@ -4280,7 +4386,8 @@ async function runTestFilesOverRelay(connection, files, opts) {
 		duration: Date.now() - wallStart,
 		files: fileResults,
 		totals,
-		captures
+		captures,
+		...preflightPermissions ? { preflight: { permissions: preflightPermissions } } : {}
 	};
 }
 /**
@@ -7012,7 +7119,7 @@ function createDebugServer(deps) {
 	};
 	const server = new Server({
 		name: "ait-debug",
-		version: "0.1.132"
+		version: "0.1.133"
 	}, { capabilities: { tools: { listChanged: true } } });
 	server.setRequestHandler(ListToolsRequestSchema, () => {
 		const conn = router.active;
@@ -8996,7 +9103,7 @@ function createDevServer(deps = {}) {
 	const aitSource = deps.aitSource ?? new HttpAitSource({ stateEndpoint });
 	const server = new Server({
 		name: "ait-devtools",
-		version: "0.1.132"
+		version: "0.1.133"
 	}, { capabilities: { tools: {} } });
 	server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: DEV_TOOL_DEFINITIONS.map((tool) => ({ ...tool })) }));
 	server.setRequestHandler(CallToolRequestSchema, async (request) => {