@browserstack/mcp-server 2.2.0-beta.1 → 2.2.0-beta.2

package/dist/tools/ask-browserstack/types.js

@@ -11,4 +11,14 @@
 // describe text in register.ts, and the two a11y handoffs in tool-handoff.ts — which stop
 // pointing here precisely because the call would now be rejected.
 export const PRODUCTS = ["tm", "tra"];
-export const ASK_STATUSES = ["ok", "blocked", "error", "rate_limited"];
+export const ASK_STATUSES = [
+    "ok",
+    "blocked",
+    "error",
+    "rate_limited",
+    // Deferred only: the run reached an ask and is PARKED, not finished. Distinct from
+    // `blocked` (a human said no) and from `error` (nothing is waiting) — this one is the
+    // only status a caller is invited to come back from, and the only one carrying a
+    // `run_id`.
+    "needs_approval",
+];

package/dist/tools/automate-utils/fetch-screenshots.js

@@ -2,6 +2,7 @@ import { assertOkResponse, maybeCompressBase64 } from "../../lib/utils.js";
 import { SessionType } from "../../lib/constants.js";
 import { getBrowserStackAuth } from "../../lib/get-auth.js";
 import { apiClient } from "../../lib/apiClient.js";
+import globalConfig from "../../config.js";
 async function extractScreenshotUrls(sessionId, sessionType, config) {
     const authString = getBrowserStackAuth(config);
     const auth = Buffer.from(authString).toString("base64");
@@ -36,23 +37,24 @@ async function extractScreenshotUrls(sessionId, sessionType, config) {
     }
     return urls;
 }
+async function fetchAndCompress(url) {
+    const response = await apiClient.get({ url, responseType: "arraybuffer" });
+    // Axios returns response.data as a Buffer for binary data
+    const base64 = Buffer.from(response.data).toString("base64");
+    return { url, base64: await maybeCompressBase64(base64) };
+}
 //Converts screenshot URLs to base64 encoded images
 async function convertUrlsToBase64(urls) {
-    const screenshots = await Promise.all(urls.map(async (url) => {
-        const response = await apiClient.get({
-            url,
-            responseType: "arraybuffer",
-        });
-        // Axios returns response.data as a Buffer for binary data
-        const base64 = Buffer.from(response.data).toString("base64");
-        // Compress the base64 image if needed
-        const compressedBase64 = await maybeCompressBase64(base64);
-        return {
-            url,
-            base64: compressedBase64,
-        };
-    }));
-    return screenshots;
+    // Hosted pods are memory-constrained: process one image at a time. Local runs
+    // keep the concurrent path.
+    if (globalConfig.REMOTE_MCP) {
+        const screenshots = [];
+        for (const url of urls) {
+            screenshots.push(await fetchAndCompress(url));
+        }
+        return screenshots;
+    }
+    return Promise.all(urls.map(fetchAndCompress));
 }
 //Fetches and converts screenshot URLs to base64 encoded images
 export async function fetchAutomationScreenshots(sessionId, sessionType = SessionType.Automate, config) {

package/dist/tools/capability-registry/redact.js

@@ -25,13 +25,13 @@ const RULES = [
     },
     {
         name: "email",
-        pattern: /\b[\w.%+-]+@[\w.-]+\.[a-z]{2,}\b/gi,
+        pattern: /\b[\w.%+-]{1,128}@[\w.-]{1,128}\.[a-z]{2,24}\b/gi,
         replacement: "[email]",
     },
     // JWT: three base64url segments.
     {
         name: "jwt",
-        pattern: /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g,
+        pattern: /\beyJ[\w-]{8,1024}\.[\w-]{8,1024}\.[\w-]{8,1024}\b/g,
         replacement: "[token]",
     },
     // A long opaque run — access keys, API keys, session ids. Requires BOTH a digit and a
@@ -41,7 +41,7 @@ const RULES = [
     // wording a product uses is exactly the assumption that fails.
     {
         name: "opaque_token",
-        pattern: /\b(?=[A-Za-z0-9_-]*\d)(?=[A-Za-z0-9_-]*[A-Za-z])[A-Za-z0-9_-]{20,}\b/g,
+        pattern: /\b(?=[A-Za-z0-9_-]{0,256}\d)(?=[A-Za-z0-9_-]{0,256}[A-Za-z])[A-Za-z0-9_-]{20,256}\b/g,
         replacement: "[token]",
     },
     {
@@ -53,7 +53,7 @@ const RULES = [
     // separator or a `+`, so a bare digit run falls to long_number instead.
     {
         name: "phone",
-        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
+        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\b\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
         replacement: "[phone]",
     },
     // Long bare digit runs: account ids, card numbers, unseparated phone numbers.
@@ -81,7 +81,9 @@ export function redact(text) {
     try {
         if (typeof text !== "string")
             return undefined;
-        let out = text.replace(/\s+/g, " ").trim();
+        // Slice before the rules run; a multi-KB digit run makes them backtrack.
+        const SCAN_LIMIT = MAX_LENGTH * 8;
+        let out = text.slice(0, SCAN_LIMIT).replace(/\s+/g, " ").trim();
         if (!out)
             return undefined;
         for (const rule of RULES)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserstack/mcp-server",
-  "version": "2.2.0-beta.1",
+  "version": "2.2.0-beta.2",
   "description": "BrowserStack's Official MCP Server",
   "mcpName": "io.github.browserstack/mcp-server",
   "main": "dist/index.js",