@broberg/lens-daemon 0.1.20 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/lens-daemon",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "The Lens module of the cardmem daemon (flows, critic, coverage, capture sessions, the /lens/* routes and the cardmem-lens MCP) as a package. The daemon mounts createLensRouter(deps) + createLensMcpRouter(deps). Bun runtime.",
   "type": "module",
   "license": "MIT",

package/src/flow.ts

@@ -404,7 +404,13 @@ export interface FlowResult {
   downloads?: FlowDownload[];
   /** F009.125 — the extension this run loaded: its id (read at load time), the
    *  build path the caller named, and whether host access was SIMULATED on a copy. */
-  extension?: { id: string; path: string; host_access: 'as-built' | 'simulated'; note?: string } | null;
+  extension?: {
+    id: string; path: string; host_access: 'as-built' | 'simulated'; note?: string;
+    /** F009.129 — the chrome.storage.local KEYS seeded before step 0 (names only, never
+     *  values), and which one Lens minted itself. A failed mint never gets here — it
+     *  ends the run before step 0 naming url + status. */
+    storage_local?: { keys: string[]; minted: string | null };
+  } | null;
   name: string;
   status: 'pass' | 'fail' | 'error';
   steps: FlowStepResult[];
@@ -3157,6 +3163,7 @@ export async function runFlow(flow: Flow, env: AuthEnv, opts: RunFlowOptions = {
             path: flow.extension.path,
             host_access: prepared.simulated ? 'simulated' : 'as-built',
             ...(prepared.simulated ? { note: SIMULATED_ACCESS_NOTE } : {}),
+            ...(Object.keys(seed).length ? { storage_local: { keys: Object.keys(seed), minted: mint?.key ?? null } } : {}),
           };
         }
         // F074.36 — measure the credential BEFORE driving, so a run that cannot

package/src/mcp.ts

@@ -369,7 +369,7 @@ export const TOOLS = [
                 path: { type: 'string' },
                 grant_host_access: { type: 'boolean' },
                 storage_local: { type: 'object', description: 'F009.126 — {key: JSON value} for chrome.storage.local, set before step 0.' },
-                storage_local_mint: { type: 'object', description: 'F009.129 — {key, url, method?, secretPath | secretEnv, body?}: the DAEMON calls the mint url (Bearer secret; secretPath relative to local_path, sandboxed) and writes the JSON answer to chrome.storage.local[key] before step 0, so a real token never passes through you. Wins over storage_local on the same key. Value and secret never appear in the report.' },
+                storage_local_mint: { type: 'object', description: 'F009.129 — {key, url, method?, secretPath | secretEnv, body?}: the DAEMON calls the mint url (Bearer secret; secretPath relative to local_path, sandboxed) and writes the JSON answer to chrome.storage.local[key] before step 0, so a real token never passes through you. Wins over storage_local on the same key. Value and secret never appear in the report; it carries extension.storage_local {keys, minted} — key NAMES only — so you can see the login was seeded. Steps after openPopup still run on the page under test: add in:"popup" to drive the popup.' },
               },
             },
             steps: {