@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-browse/src/routes/activity.ts

@@ -1,63 +0,0 @@
-/**
- * Activity feed routes: the SSE session cookie mint, the activity SSE stream
- * and the REST history. None reset the idle timer.
- */
-
-import { json, type RouteEntry } from './table';
-import { subscribe, getActivityAfter, getActivityHistory, getSubscriberCount } from '../activity';
-import { createSseEndpoint } from '../sse-helpers';
-import { mintSseSessionToken, buildSseSetCookie, SSE_COOKIE_NAME } from '../sse-session-cookie';
-
-export const activityRoutes: RouteEntry[] = [
-  // ─── SSE session cookie mint (auth required) ──────────────────
-  //
-  // Issues a short-lived view-only token in an HttpOnly SameSite=Strict
-  // cookie so EventSource calls can authenticate without putting the
-  // root token in a URL. It is not a scoped token and cannot be used
-  // against /command. The extension calls this once at bootstrap with the
-  // root Bearer header, then opens EventSource with `withCredentials: true`
-  // which sends the cookie back automatically.
-  {
-    method: 'POST', path: '/sse-session', auth: 'root-bearer', surfaces: ['local'],
-    handler: () => {
-      const minted = mintSseSessionToken();
-      return json({
-        expiresAt: minted.expiresAt,
-        cookie: SSE_COOKIE_NAME,
-      }, { headers: { 'Set-Cookie': buildSseSetCookie(minted.token) } });
-    },
-  },
-
-  // Activity stream — SSE. Auth: Bearer header OR view-only SSE session
-  // cookie (EventSource can't send Authorization headers). The ?token= query
-  // param is NO LONGER accepted — URLs leak to logs/referer/history.
-  {
-    method: '*', path: '/activity/stream', auth: 'root-or-sse-cookie', surfaces: ['local'],
-    handler: (req, { url }) => {
-      const afterId = parseInt(url.searchParams.get('after') || '0', 10);
-      // Cleanup contract (abort + enqueue-fail + heartbeat-fail, all
-      // idempotent) lives in createSseEndpoint; sanitizeReplacer is applied
-      // to every JSON.stringify inside the helper, so page-content-derived
-      // fields stay surrogate-safe per the CLAUDE.md egress invariant.
-      return createSseEndpoint(req, {
-        initialReplay: (send) => {
-          const { entries, gap, gapFrom, availableFrom } = getActivityAfter(afterId);
-          if (gap) send('gap', { gapFrom, availableFrom });
-          for (const entry of entries) send('activity', entry);
-        },
-        subscribe,
-        liveEventName: 'activity',
-      });
-    },
-  },
-
-  // Activity history — REST
-  {
-    method: '*', path: '/activity/history', auth: 'root-bearer', surfaces: ['local'],
-    handler: (_req, { url }) => {
-      const limit = parseInt(url.searchParams.get('limit') || '50', 10);
-      const { entries, totalAdded } = getActivityHistory(limit);
-      return json({ entries, totalAdded, subscribers: getSubscriberCount() });
-    },
-  },
-];

package/.agent/skills/gstack-browse/src/routes/commands.ts

@@ -1,154 +0,0 @@
-/**
- * Command routes: POST /command (one command; the only non-/connect tunnel
- * route) and POST /batch (N commands in one round trip). Both accept root and
- * scoped tokens and run through the full command security pipeline. Also owns
- * the tunnel command allowlist.
- */
-
-import { type RouteEntry, jsonError } from './table';
-import { canonicalizeCommand } from '../commands';
-import { hasOutArg } from '../read-commands';
-import { emitActivity } from '../activity';
-import { logTunnelDenial } from '../tunnel-denial-log';
-import { sanitizeBody, stripLoneSurrogateEscapes } from '../sanitize';
-
-/**
- * Commands reachable via POST /command over the tunnel surface. A paired
- * remote agent can drive the browser (goto, click, text, etc.) but cannot
- * configure the daemon, bootstrap new sessions, import cookies, or reach
- * extension-inspector state. This allowlist maps to the eng-review decision
- * logged in the CEO plan for sec-wave v1.6.0.0.
- */
-export const TUNNEL_COMMANDS = new Set<string>([
-  // Original 17
-  'goto', 'click', 'text', 'screenshot',
-  'html', 'links', 'forms', 'accessibility',
-  'attrs', 'media', 'data',
-  'scroll', 'press', 'type', 'select', 'wait', 'eval',
-  // Tab + navigation primitives operator docs and CLI hints already promised
-  'newtab', 'tabs', 'back', 'forward', 'reload',
-  // Read/inspect/write operators paired agents need to be useful
-  'snapshot', 'fill', 'url', 'closetab',
-]);
-
-/**
- * Pure gate: returns true iff the command is reachable over the tunnel surface.
- * Canonicalizes the command (so aliases hit the same set) and returns false
- * for null/undefined input.
- *
- * `args` is consulted so an `--out` invocation (e.g. `eval --out <file>`) is
- * NEVER tunnel-dispatchable: `--out` turns an otherwise-readable command into a
- * local-disk WRITE, and the tunnel surface never grants disk-write capability to
- * remote paired agents. Omitting `args` preserves the old command-only behavior.
- */
-export function canDispatchOverTunnel(command: string | undefined | null, args?: string[]): boolean {
-  if (typeof command !== 'string' || command.length === 0) return false;
-  if (Array.isArray(args) && hasOutArg(args)) return false;
-  const cmd = canonicalizeCommand(command);
-  return TUNNEL_COMMANDS.has(cmd);
-}
-
-export const commandRoutes: RouteEntry[] = [
-  // ─── Batch endpoint — N commands, 1 HTTP round-trip ─────────────
-  // Executes commands sequentially through the full security pipeline.
-  // Designed for remote agents where tunnel latency dominates.
-  {
-    method: 'POST', path: '/batch', auth: 'scoped', surfaces: ['local'],
-    handler: async (req, { tokenInfo }, ctx) => {
-      const { browserManager } = ctx;
-      ctx.resetIdleTimer();
-      const body = await req.json();
-      const { commands } = body;
-      if (!Array.isArray(commands) || commands.length === 0) return jsonError(400, '"commands" must be a non-empty array');
-      if (commands.length > 50) return jsonError(400, 'Max 50 commands per batch');
-
-      const startTime = Date.now();
-      emitActivity({
-        type: 'command_start',
-        command: 'batch',
-        args: [`${commands.length} commands`],
-        url: browserManager.getCurrentUrl(),
-        tabs: browserManager.getTabCount(),
-        mode: browserManager.getConnectionMode(),
-        clientId: tokenInfo?.clientId,
-      });
-
-      const results: Array<{ index: number; status: number; result: string; command: string; tabId?: number }> = [];
-      for (let i = 0; i < commands.length; i++) {
-        const cmd = commands[i];
-        if (!cmd || typeof cmd.command !== 'string') {
-          results.push({ index: i, status: 400, result: JSON.stringify({ error: 'Missing "command" field' }), command: '' });
-          continue;
-        }
-        // Reject nested batches
-        if (cmd.command === 'batch') {
-          results.push({ index: i, status: 400, result: JSON.stringify({ error: 'Nested batch commands are not allowed' }), command: 'batch' });
-          continue;
-        }
-        const cr = await ctx.commands.handleInternal(
-          { command: cmd.command, args: cmd.args, tabId: cmd.tabId },
-          tokenInfo,
-          { skipRateCheck: true, skipActivity: true },
-        );
-        // Sanitize lone surrogates per-result (#1440 — /batch bypasses the
-        // handleCommand chokepoint, so it needs its own sanitization).
-        const safeResult = typeof cr.result === 'string' ? sanitizeBody(cr.result, !!cr.json) : cr.result;
-        results.push({
-          index: i,
-          status: cr.status,
-          result: safeResult,
-          command: cmd.command,
-          tabId: cmd.tabId,
-        });
-      }
-
-      const duration = Date.now() - startTime;
-      emitActivity({
-        type: 'command_end',
-        command: 'batch',
-        args: [`${commands.length} commands`],
-        url: browserManager.getCurrentUrl(),
-        duration,
-        status: 'ok',
-        result: `${results.filter(r => r.status === 200).length}/${commands.length} succeeded`,
-        tabs: browserManager.getTabCount(),
-        mode: browserManager.getConnectionMode(),
-        clientId: tokenInfo?.clientId,
-      });
-
-      // Sanitize the JSON envelope a second time (defense in depth) — catches
-      // any \uXXXX escape sequences for lone surrogates that survived the
-      // per-result pass.
-      const batchBody = stripLoneSurrogateEscapes(JSON.stringify({
-        results,
-        duration,
-        total: commands.length,
-        succeeded: results.filter(r => r.status === 200).length,
-        failed: results.filter(r => r.status !== 200).length,
-      }));
-      return new Response(batchBody, {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      });
-    },
-  },
-
-  // ─── Command endpoint ───────────────────────────────────────────
-  {
-    method: 'POST', path: '/command', auth: 'scoped', surfaces: ['local', 'tunnel'],
-    handler: async (req, { url, surface, tokenInfo }, ctx) => {
-      ctx.resetIdleTimer();
-      const body = await req.json() as any;
-      // Tunnel surface: only commands in TUNNEL_COMMANDS are allowed.
-      // Paired remote agents drive the browser but cannot configure the
-      // daemon, launch new browsers, import cookies, or rotate tokens.
-      if (surface === 'tunnel' && !canDispatchOverTunnel(body?.command, body?.args)) {
-        logTunnelDenial(req, url, `disallowed_command:${body?.command}`);
-        return jsonError(403, `Command '${body?.command}' is not allowed over the tunnel surface`, {
-          hint: `Tunnel commands: ${[...TUNNEL_COMMANDS].sort().join(', ')}. Note: --out (disk write) is never allowed over the tunnel.`,
-        });
-      }
-      return ctx.commands.handle(body, tokenInfo);
-    },
-  },
-];

package/.agent/skills/gstack-browse/src/routes/core.ts

@@ -1,123 +0,0 @@
-/**
- * Daemon routes outside the named areas: the cookie-picker sub-router, the
- * welcome page, the pinned-origin token bootstrap, liveness, refs and the
- * memory diagnostic.
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { resolveStateRoot } from '../../../lib/state-root';
-import { json, type RouteEntry } from './table';
-import { handleCookiePickerRoute } from '../cookie-picker-routes';
-import { sanitizeReplacer } from '../sanitize';
-
-function resolveWelcomePath(): string | null {
-  // Gate GSTACK_SLUG on a strict regex BEFORE interpolating it into the
-  // filesystem path. Without this, a slug like "../../etc/passwd" would
-  // resolve to ~/.gstack/projects/../../etc/passwd/... — path traversal.
-  const rawSlug = process.env.GSTACK_SLUG || 'unknown';
-  const slug = /^[a-z0-9_-]+$/.test(rawSlug) ? rawSlug : 'unknown';
-  const homeDir = process.env.HOME || process.env.USERPROFILE || '/tmp';
-  const projectWelcome = path.join(resolveStateRoot(), 'projects', slug, 'designs', 'welcome-page-20260331', 'finalized.html');
-  if (fs.existsSync(projectWelcome)) return projectWelcome;
-  // Fallback: built-in welcome page from gstack install. Reject SKILL_ROOT
-  // values containing '..' for the same defense-in-depth reason.
-  const rawSkillRoot = process.env.GSTACK_SKILL_ROOT || `${homeDir}/.claude/skills/gstack`;
-  if (rawSkillRoot.includes('..')) return null;
-  const builtinWelcome = `${rawSkillRoot}/browse/src/welcome.html`;
-  if (fs.existsSync(builtinWelcome)) return builtinWelcome;
-  return null;
-}
-
-export const coreRoutes: RouteEntry[] = [
-  // Cookie picker sub-router — HTML page unauthenticated, data/action routes require auth
-  {
-    method: '*', path: '/cookie-picker', prefix: true, auth: 'handler', surfaces: ['local'],
-    handlerAuth: 'sub-router in cookie-picker-routes.ts: OPTIONS preflight open; GET /cookie-picker needs a one-time code or picker session cookie (403 text); every other /cookie-picker/* needs the root bearer or a picker session (401 Unauthorized)',
-    handler: (req, { url }, ctx) => handleCookiePickerRoute(url, req, ctx.browserManager, ctx.bootstrapRootToken),
-  },
-
-  // Welcome page — served when GStack Browser launches in headed mode
-  {
-    method: '*', path: '/welcome', auth: 'none', surfaces: ['local'],
-    handler: () => {
-      const welcomePath = resolveWelcomePath();
-      if (welcomePath) {
-        try {
-          const html = fs.readFileSync(welcomePath, 'utf-8');
-          return new Response(html, { headers: { 'Content-Type': 'text/html; charset=utf-8' } });
-        } catch (err: any) {
-          console.error('[browse] Failed to read welcome page:', welcomePath, err.message);
-        }
-      }
-      // No welcome page found — serve a simple fallback (avoid ERR_UNSAFE_REDIRECT on Windows)
-      return new Response(
-        `<!DOCTYPE html><html><head><title>GStack Browser</title>
-          <style>body{background:#111;color:#fff;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;}
-          .msg{text-align:center;opacity:.7;}.gold{color:#f5a623;font-size:2em;margin-bottom:12px;}</style></head>
-          <body><div class="msg"><div class="gold">◈</div><p>GStack Browser ready.</p><p style="font-size:.85em">Waiting for commands from Claude Code.</p></div></body></html>`,
-        { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } }
-      );
-    },
-  },
-
-  // ─── POST /extension-token — pinned-origin token bootstrap ──────
-  //
-  // The ONLY endpoint that hands out AUTH_TOKEN. The token is released only
-  // to the one extension identity we ship: the Origin header must be exactly
-  // `chrome-extension://<GSTACK_EXTENSION_ID>` and the Host must be loopback
-  // (the extension-origin gate). Chrome sets Origin on cross-origin POSTs
-  // from extension contexts and web pages cannot forge a chrome-extension://
-  // Origin. Local listener only: NEVER added to TUNNEL_PATHS.
-  {
-    method: 'POST', path: '/extension-token', auth: 'extension-origin', surfaces: ['local'],
-    handler: (_req, _r, ctx) => json({ token: ctx.bootstrapRootToken }),
-  },
-
-  // Health check — no auth required, does NOT reset idle timer. NEVER carries
-  // a token in any mode: token bootstrap is POST /extension-token and shell
-  // auth is POST /pty-session. Liveness/status only.
-  {
-    method: '*', path: '/health', auth: 'none', surfaces: ['local'],
-    handler: async (_req, _r, ctx) => {
-      const { browserManager } = ctx;
-      const healthy = await browserManager.isHealthy();
-      return json({
-        status: healthy ? 'healthy' : 'unhealthy',
-        mode: browserManager.getConnectionMode(),
-        uptime: Math.floor((Date.now() - ctx.startTime) / 1000),
-        tabs: browserManager.getTabCount(),
-        // No `security` field (#2557): the live defenses report through
-        // their own call sites, not through /health.
-        // Terminal-agent discovery. ONLY a port number — never a token.
-        // Tokens flow via the /pty-session HttpOnly cookie path.
-        terminalPort: ctx.terminal.readPort(),
-      });
-    },
-  },
-
-  // Refs endpoint — does NOT reset idle timer
-  {
-    method: '*', path: '/refs', auth: 'root-bearer', surfaces: ['local'],
-    handler: (_req, _r, { browserManager }) => json({
-      refs: browserManager.getRefMap(),
-      url: browserManager.getCurrentUrl(),
-      mode: browserManager.getConnectionMode(),
-    }),
-  },
-
-  // GET /memory — diagnostic snapshot, does NOT reset idle. Root-bearer: it
-  // sat behind the if-chain's blanket root-bearer check, so the SSE cookie
-  // its handler also accepted never reached it.
-  {
-    method: 'GET', path: '/memory', auth: 'root-bearer', surfaces: ['local'],
-    handler: async (_req, _r, ctx) => {
-      const { buildMemorySnapshotJson } = await import('../memory-command');
-      const snapshot = await buildMemorySnapshotJson(ctx.browserManager);
-      // sanitizeReplacer is required at every JSON egress that ships
-      // page-content-derived strings — tab.url and tab.title come from page
-      // content.
-      return json(snapshot, { replacer: sanitizeReplacer });
-    },
-  },
-];

package/.agent/skills/gstack-browse/src/routes/files.ts

@@ -1,47 +0,0 @@
-/**
- * GET /file — serve a downloaded file from the temp roots so remote agents
- * can retrieve screenshots, PDFs and media. Accepts root and scoped tokens.
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { jsonError, type RouteEntry } from './table';
-import { validateTempPath } from '../path-security';
-
-const MIME_MAP: Record<string, string> = {
-  '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
-  '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml',
-  '.avif': 'image/avif',
-  '.mp4': 'video/mp4', '.webm': 'video/webm', '.mov': 'video/quicktime',
-  '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.ogg': 'audio/ogg',
-  '.pdf': 'application/pdf', '.json': 'application/json',
-  '.html': 'text/html', '.txt': 'text/plain', '.mhtml': 'message/rfc822',
-};
-
-export const fileRoutes: RouteEntry[] = [
-  {
-    method: 'GET', path: '/file', auth: 'scoped', surfaces: ['local'],
-    handler: (_req, { url }, ctx) => {
-      const filePath = url.searchParams.get('path');
-      if (!filePath) return jsonError(400, 'Missing "path" query parameter');
-      try {
-        validateTempPath(filePath);
-      } catch (err: any) {
-        return jsonError(403, err.message);
-      }
-      if (!fs.existsSync(filePath)) return jsonError(404, 'File not found');
-      const stat = fs.statSync(filePath);
-      if (stat.size > 200 * 1024 * 1024) return jsonError(413, 'File too large (max 200MB)');
-      const contentType = MIME_MAP[path.extname(filePath).toLowerCase()] || 'application/octet-stream';
-      ctx.resetIdleTimer();
-      return new Response(Bun.file(filePath), {
-        headers: {
-          'Content-Type': contentType,
-          'Content-Length': String(stat.size),
-          'Content-Disposition': `inline; filename="${path.basename(filePath)}"`,
-          'Cache-Control': 'no-cache',
-        },
-      });
-    },
-  },
-];

package/.agent/skills/gstack-browse/src/routes/index.ts

@@ -1,27 +0,0 @@
-/**
- * The browse daemon's route table, in dispatch order. See ./table.ts for the
- * entry shape, auth kinds and the unmatched fallthrough.
- */
-
-import type { RouteEntry } from './table';
-import { pairingRoutes } from './pairing';
-import { coreRoutes } from './core';
-import { ptyRoutes } from './pty';
-import { tokenRoutes } from './tokens';
-import { tunnelRoutes } from './tunnel';
-import { activityRoutes } from './activity';
-import { commandRoutes } from './commands';
-import { fileRoutes } from './files';
-import { inspectorRoutes } from './inspector';
-
-export const ROUTES: readonly RouteEntry[] = [
-  ...pairingRoutes,
-  ...coreRoutes,
-  ...ptyRoutes,
-  ...tokenRoutes,
-  ...tunnelRoutes,
-  ...activityRoutes,
-  ...commandRoutes,
-  ...fileRoutes,
-  ...inspectorRoutes,
-];

package/.agent/skills/gstack-browse/src/routes/inspector.ts

@@ -1,132 +0,0 @@
-/**
- * CSS inspector routes and the in-memory inspector state they share: pick,
- * read, apply, reset, history and the inspector SSE stream.
- *
- * GET /inspector/events is root-bearer: it sat behind the if-chain's blanket
- * root-bearer check, so the SSE cookie its handler also accepted never reached
- * it. The declaration keeps that behavior.
- */
-
-import { json, jsonError, type RouteEntry } from './table';
-import { inspectElement, modifyStyle, resetModifications, getModificationHistory, type InspectorResult } from '../cdp-inspector';
-import { createSseEndpoint } from '../sse-helpers';
-
-let inspectorData: InspectorResult | null = null;
-let inspectorTimestamp = 0;
-
-type InspectorSubscriber = (event: any) => void;
-const inspectorSubscribers = new Set<InspectorSubscriber>();
-
-/** Diagnostic accessor used by the $B memory snapshot. */
-export function getInspectorSubscriberCount(): number {
-  return inspectorSubscribers.size;
-}
-
-/** Drops every inspector SSE subscriber (daemon shutdown). */
-export function clearInspectorSubscribers(): void {
-  inspectorSubscribers.clear();
-}
-
-function emitInspectorEvent(event: any): void {
-  for (const notify of inspectorSubscribers) {
-    queueMicrotask(() => {
-      try { notify(event); } catch (err: any) {
-        console.error('[browse] Inspector event subscriber threw:', err.message);
-      }
-    });
-  }
-}
-
-export const inspectorRoutes: RouteEntry[] = [
-  // POST /inspector/pick — receive element pick from extension, run CDP inspection
-  {
-    method: 'POST', path: '/inspector/pick', auth: 'root-bearer', surfaces: ['local'],
-    handler: async (req, _r, ctx) => {
-      const body = await req.json();
-      const { selector, activeTabUrl } = body;
-      if (!selector) return jsonError(400, 'Missing selector');
-      try {
-        const page = ctx.browserManager.getPage();
-        const result = await inspectElement(page, selector);
-        inspectorData = result;
-        inspectorTimestamp = Date.now();
-        // Also store on browserManager for CLI access
-        (ctx.browserManager as any)._inspectorData = result;
-        (ctx.browserManager as any)._inspectorTimestamp = inspectorTimestamp;
-        emitInspectorEvent({ type: 'pick', selector, timestamp: inspectorTimestamp });
-        return json(result);
-      } catch (err: any) {
-        return jsonError(500, err.message);
-      }
-    },
-  },
-
-  // GET /inspector — return latest inspector data
-  {
-    method: 'GET', path: '/inspector', auth: 'root-bearer', surfaces: ['local'],
-    handler: () => {
-      if (!inspectorData) return json({ data: null });
-      const stale = inspectorTimestamp > 0 && (Date.now() - inspectorTimestamp > 60000);
-      return json({ data: inspectorData, timestamp: inspectorTimestamp, stale });
-    },
-  },
-
-  // POST /inspector/apply — apply a CSS modification
-  {
-    method: 'POST', path: '/inspector/apply', auth: 'root-bearer', surfaces: ['local'],
-    handler: async (req, _r, ctx) => {
-      const body = await req.json();
-      const { selector, property, value } = body;
-      if (!selector || !property || value === undefined) return jsonError(400, 'Missing selector, property, or value');
-      try {
-        const page = ctx.browserManager.getPage();
-        const mod = await modifyStyle(page, selector, property, value);
-        emitInspectorEvent({ type: 'apply', modification: mod, timestamp: Date.now() });
-        return json(mod);
-      } catch (err: any) {
-        return jsonError(500, err.message);
-      }
-    },
-  },
-
-  // POST /inspector/reset — clear all modifications
-  {
-    method: 'POST', path: '/inspector/reset', auth: 'root-bearer', surfaces: ['local'],
-    handler: async (_req, _r, ctx) => {
-      try {
-        const page = ctx.browserManager.getPage();
-        await resetModifications(page);
-        emitInspectorEvent({ type: 'reset', timestamp: Date.now() });
-        return json({ ok: true });
-      } catch (err: any) {
-        return jsonError(500, err.message);
-      }
-    },
-  },
-
-  // GET /inspector/history — return modification list
-  {
-    method: 'GET', path: '/inspector/history', auth: 'root-bearer', surfaces: ['local'],
-    handler: () => json({ history: getModificationHistory() }),
-  },
-
-  // GET /inspector/events — SSE for inspector state changes
-  {
-    method: 'GET', path: '/inspector/events', auth: 'root-bearer', surfaces: ['local'],
-    handler: (req) => {
-      // Cleanup contract (abort + enqueue-fail + heartbeat-fail, idempotent)
-      // lives in createSseEndpoint; sanitizeReplacer is applied to every
-      // JSON.stringify inside the helper.
-      return createSseEndpoint(req, {
-        initialReplay: inspectorData
-          ? (send) => send('state', { data: inspectorData, timestamp: inspectorTimestamp })
-          : undefined,
-        subscribe: (notify) => {
-          inspectorSubscribers.add(notify);
-          return () => inspectorSubscribers.delete(notify);
-        },
-        liveEventName: 'inspector',
-      });
-    },
-  },
-];