@browserstack/mcp-server 2.2.0-beta.1 → 2.2.0

package/dist/tools/ask-browserstack/types.js

@@ -11,4 +11,14 @@
 // describe text in register.ts, and the two a11y handoffs in tool-handoff.ts — which stop
 // pointing here precisely because the call would now be rejected.
 export const PRODUCTS = ["tm", "tra"];
-export const ASK_STATUSES = ["ok", "blocked", "error", "rate_limited"];
+export const ASK_STATUSES = [
+    "ok",
+    "blocked",
+    "error",
+    "rate_limited",
+    // Deferred only: the run reached an ask and is PARKED, not finished. Distinct from
+    // `blocked` (a human said no) and from `error` (nothing is waiting) — this one is the
+    // only status a caller is invited to come back from, and the only one carrying a
+    // `run_id`.
+    "needs_approval",
+];

package/dist/tools/automate-utils/fetch-screenshots.js

@@ -2,6 +2,7 @@ import { assertOkResponse, maybeCompressBase64 } from "../../lib/utils.js";
 import { SessionType } from "../../lib/constants.js";
 import { getBrowserStackAuth } from "../../lib/get-auth.js";
 import { apiClient } from "../../lib/apiClient.js";
+import globalConfig from "../../config.js";
 async function extractScreenshotUrls(sessionId, sessionType, config) {
     const authString = getBrowserStackAuth(config);
     const auth = Buffer.from(authString).toString("base64");
@@ -36,23 +37,24 @@ async function extractScreenshotUrls(sessionId, sessionType, config) {
     }
     return urls;
 }
+async function fetchAndCompress(url) {
+    const response = await apiClient.get({ url, responseType: "arraybuffer" });
+    // Axios returns response.data as a Buffer for binary data
+    const base64 = Buffer.from(response.data).toString("base64");
+    return { url, base64: await maybeCompressBase64(base64) };
+}
 //Converts screenshot URLs to base64 encoded images
 async function convertUrlsToBase64(urls) {
-    const screenshots = await Promise.all(urls.map(async (url) => {
-        const response = await apiClient.get({
-            url,
-            responseType: "arraybuffer",
-        });
-        // Axios returns response.data as a Buffer for binary data
-        const base64 = Buffer.from(response.data).toString("base64");
-        // Compress the base64 image if needed
-        const compressedBase64 = await maybeCompressBase64(base64);
-        return {
-            url,
-            base64: compressedBase64,
-        };
-    }));
-    return screenshots;
+    // Hosted pods are memory-constrained: process one image at a time. Local runs
+    // keep the concurrent path.
+    if (globalConfig.REMOTE_MCP) {
+        const screenshots = [];
+        for (const url of urls) {
+            screenshots.push(await fetchAndCompress(url));
+        }
+        return screenshots;
+    }
+    return Promise.all(urls.map(fetchAndCompress));
 }
 //Fetches and converts screenshot URLs to base64 encoded images
 export async function fetchAutomationScreenshots(sessionId, sessionType = SessionType.Automate, config) {

package/dist/tools/capability-registry/bind.js

@@ -230,15 +230,6 @@ function coerceType(value, param, label = param.name) {
         if (expected === "integer" && !Number.isInteger(parsed)) {
             throw new InvocationError(`'${label}' must be a whole number, not ${JSON.stringify(raw)}`);
         }
-        // Past 2^53 `Number` rounds: TRA's 17-digit unique-error cluster ids came back as a
-        // neighbouring id, so the call silently targeted the wrong cluster. Keep the caller's
-        // exact digits instead — path and query serialise a string identically, and a JSON body
-        // carrying a digit string still binds to a Long on the server.
-        if (expected === "integer" &&
-            !Number.isSafeInteger(parsed) &&
-            /^-?\d+$/.test(raw)) {
-            return raw;
-        }
         return parsed;
     }
     if (expected === "boolean") {
@@ -289,12 +280,6 @@ function place(root, pointer, value) {
     }
     cursor[segments[segments.length - 1]] = value;
 }
-const MAP_KEY = /^[A-Za-z0-9][\w.-]*$/;
-function keyedParam(group, params) {
-    if (group !== "body")
-        return undefined;
-    return params.find((param) => /^\{\w+\}$/.test(param.name));
-}
 const GROUPS = [
     { group: "path_params", declared: "path_params" },
     { group: "query", declared: "query" },
@@ -313,10 +298,9 @@ export function bind(capability, args) {
         }
         const params = capability[declared] || [];
         const byName = new Map(params.map((param) => [param.name, param]));
-        const keyed = keyedParam(group, params);
         // Unknown arguments are an error rather than being dropped: silently ignoring a
         // misspelled filter would return a larger result set that looks like a correct answer.
-        const unknown = Object.keys(supplied).filter((name) => !byName.has(name) && !keyed);
+        const unknown = Object.keys(supplied).filter((name) => !byName.has(name));
         if (unknown.length > 0) {
             // A CALLER WHO SENT THE WRAPPER WE BUILD DESERVES TO BE TOLD SO.
             //
@@ -347,10 +331,7 @@ export function bind(capability, args) {
                     : ""));
         }
         for (const [name, raw] of Object.entries(supplied)) {
-            const param = byName.get(name) ?? keyed;
-            if (param === keyed && !MAP_KEY.test(name)) {
-                throw new InvocationError(`'${name}' is not a usable ${keyed.name} key: use the id exactly as a read returned it`);
-            }
+            const param = byName.get(name);
             const value = coerce(raw, param);
             if (group === "path_params") {
                 // Encode with nothing exempt: a `/` inside a path value would otherwise rewrite the
@@ -358,10 +339,7 @@ export function bind(capability, args) {
                 path = path.replaceAll(`{${name}}`, encodeURIComponent(pathSegment(value, name)));
             }
             else if (group === "body") {
-                const pointer = param.json_path || `/${param.name}`;
-                place(body, param === keyed && !byName.has(name)
-                    ? pointer.replace(keyed.name, name)
-                    : pointer, value);
+                place(body, param.json_path || `/${name}`, value);
             }
             else {
                 query[name] = value;
@@ -376,14 +354,9 @@ export function bind(capability, args) {
         if (group === "query")
             continue;
         const supplied = args[group] || {};
-        const params = capability[declared] || [];
-        const keyed = keyedParam(group, params);
-        const declaredNames = new Set(params.map((param) => param.name));
-        for (const param of params) {
-            const present = param.name in supplied ||
-                (param === keyed &&
-                    Object.keys(supplied).some((name) => !declaredNames.has(name)));
-            if (param.required && !present)
+        for (const param of capability[declared] ||
+            []) {
+            if (param.required && !(param.name in supplied))
                 missing.push(param.name);
         }
     }
@@ -394,14 +367,5 @@ export function bind(capability, args) {
     if (leftover) {
         throw new InvocationError(`path placeholder(s) not supplied: ${leftover.join(", ")}`);
     }
-    // An explicitly supplied empty body is still a body. Dropping it sent no request body at
-    // all, and a route with a required @RequestBody (TRA close_build, whose guidance says to
-    // send `{}`) answered 400 "Invalid request payload". GET/HEAD never carry one.
-    const sentEmptyBody = args.body !== undefined &&
-        !["GET", "HEAD"].includes(capability.method.toUpperCase());
-    return {
-        path,
-        query,
-        body: Object.keys(body).length > 0 || sentEmptyBody ? body : undefined,
-    };
+    return { path, query, body: Object.keys(body).length > 0 ? body : undefined };
 }

package/dist/tools/capability-registry/discovery.js

@@ -79,9 +79,7 @@ export async function discoverBaseUrl(product, source, credentials, transport) {
             `set probe_path in its index`);
     }
     // The same scheme the invocation will use, so a host that answers here answers there.
-    // Minted ONCE for the whole probe, not per candidate: the token is the caller's identity
-    // and does not vary by which region answers.
-    const headers = await authHeaders(credentials, source.auth, product);
+    const headers = authHeaders(credentials, source.auth);
     const failures = [];
     for (const candidate of candidates) {
         const response = await transport("GET", `${candidate}${path}`, headers, {});

package/dist/tools/capability-registry/egress.d.ts

@@ -16,10 +16,11 @@
  * Api-Token regardless, and the mismatch surfaced as a 401 that reads like the user's
  * credentials are wrong.
  */
-import { TokenTransport } from "../../lib/central-oauth.js";
 import { AuthScheme } from "./types.js";
-export type { Credentials } from "../../lib/central-oauth.js";
-import type { Credentials } from "../../lib/central-oauth.js";
+export interface Credentials {
+    username: string;
+    accessKey: string;
+}
 export interface HttpResponse {
     status: number;
     body: unknown;
@@ -38,14 +39,6 @@ export declare const DEFAULT_AUTH: AuthScheme;
  * the common case, not a hypothetical.
  */
 export declare function renderTemplate(template: string, credentials: Credentials): string;
-/**
- * The headers for one outbound call.
- *
- * ASYNC BECAUSE ONE SCHEME NEEDS A ROUND TRIP. `apiKey` and `http` are pure string work, but
- * `oauth2` exchanges the caller's credentials for a JWT before anything can be sent, and
- * there was nowhere to put that while this was synchronous. Both call sites were already
- * inside async functions, so the cost is two `await`s.
- */
-export declare function authHeaders(credentials: Credentials, auth?: AuthScheme, product?: string, tokenTransport?: TokenTransport): Promise<Record<string, string>>;
+export declare function authHeaders(credentials: Credentials, auth?: AuthScheme): Record<string, string>;
 /** A fetch-based transport. Redirects are NOT followed. */
 export declare function fetchTransport(timeoutMs?: number): Transport;

package/dist/tools/capability-registry/egress.js

@@ -16,9 +16,7 @@
  * Api-Token regardless, and the mismatch surfaced as a 401 that reads like the user's
  * credentials are wrong.
  */
-import { fetchTokenTransport, } from "../../lib/central-oauth.js";
 import { InvocationError } from "./index-loader.js";
-import { bearerToken } from "./oauth.js";
 /** What this server can put into a credential template. Nothing else is fillable. */
 const PLACEHOLDERS = ["username", "access_key"];
 /** The historical default, and what an index without an `auth` block still gets. */
@@ -50,15 +48,7 @@ export function renderTemplate(template, credentials) {
         .replaceAll("{username}", credentials.username)
         .replaceAll("{access_key}", credentials.accessKey);
 }
-/**
- * The headers for one outbound call.
- *
- * ASYNC BECAUSE ONE SCHEME NEEDS A ROUND TRIP. `apiKey` and `http` are pure string work, but
- * `oauth2` exchanges the caller's credentials for a JWT before anything can be sent, and
- * there was nowhere to put that while this was synchronous. Both call sites were already
- * inside async functions, so the cost is two `await`s.
- */
-export async function authHeaders(credentials, auth = DEFAULT_AUTH, product = "this product", tokenTransport = fetchTokenTransport()) {
+export function authHeaders(credentials, auth = DEFAULT_AUTH) {
     if (!credentials?.username || !credentials?.accessKey) {
         // Refusing here beats sending unauthenticated and surfacing the product's 401, which
         // reads like the user's problem when it is our missing configuration.
@@ -69,19 +59,6 @@ export async function authHeaders(credentials, auth = DEFAULT_AUTH, product = "t
         "request-source": "ai-chatbot",
         "Content-Type": "application/json",
     };
-    if (auth.type === "oauth2") {
-        // Refused rather than ignored, which is the same call `in: cookie` and `in: query` get
-        // below: a field that looks like it selects behaviour and does not is how someone
-        // spends an afternoon on a 401 they were never going to be able to explain.
-        const stray = ["in", "name", "template"].filter((field) => auth[field] !== undefined);
-        if (stray.length > 0) {
-            throw new InvocationError(`oauth2 auth does not take ${stray.join(", ")}: a bearer token's presentation is ` +
-                `fixed at 'Authorization: Bearer' (RFC 6750). Remove ${stray.length > 1 ? "them" : "it"}, ` +
-                `or use apiKey if this product really does read a different header.`);
-        }
-        const token = await bearerToken(product, auth, credentials, tokenTransport);
-        return { Authorization: `Bearer ${token}`, ...common };
-    }
     const value = renderTemplate(auth.template || DEFAULT_AUTH.template, credentials);
     if (auth.type === "apiKey") {
         // Header only. `cookie` needs a session this server does not have, and `query` would

package/dist/tools/capability-registry/redact.js

@@ -25,13 +25,13 @@ const RULES = [
     },
     {
         name: "email",
-        pattern: /\b[\w.%+-]+@[\w.-]+\.[a-z]{2,}\b/gi,
+        pattern: /\b[\w.%+-]{1,128}@[\w.-]{1,128}\.[a-z]{2,24}\b/gi,
         replacement: "[email]",
     },
     // JWT: three base64url segments.
     {
         name: "jwt",
-        pattern: /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g,
+        pattern: /\beyJ[\w-]{8,1024}\.[\w-]{8,1024}\.[\w-]{8,1024}\b/g,
         replacement: "[token]",
     },
     // A long opaque run — access keys, API keys, session ids. Requires BOTH a digit and a
@@ -41,7 +41,7 @@ const RULES = [
     // wording a product uses is exactly the assumption that fails.
     {
         name: "opaque_token",
-        pattern: /\b(?=[A-Za-z0-9_-]*\d)(?=[A-Za-z0-9_-]*[A-Za-z])[A-Za-z0-9_-]{20,}\b/g,
+        pattern: /\b(?=[A-Za-z0-9_-]{0,256}\d)(?=[A-Za-z0-9_-]{0,256}[A-Za-z])[A-Za-z0-9_-]{20,256}\b/g,
         replacement: "[token]",
     },
     {
@@ -53,7 +53,7 @@ const RULES = [
     // separator or a `+`, so a bare digit run falls to long_number instead.
     {
         name: "phone",
-        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
+        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\b\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
         replacement: "[phone]",
     },
     // Long bare digit runs: account ids, card numbers, unseparated phone numbers.
@@ -81,7 +81,9 @@ export function redact(text) {
     try {
         if (typeof text !== "string")
             return undefined;
-        let out = text.replace(/\s+/g, " ").trim();
+        // Slice before the rules run; a multi-KB digit run makes them backtrack.
+        const SCAN_LIMIT = MAX_LENGTH * 8;
+        let out = text.slice(0, SCAN_LIMIT).replace(/\s+/g, " ").trim();
         if (!out)
             return undefined;
         for (const rule of RULES)