@descryy/mcp 0.2.0 → 0.4.0

package/dist/tools/browser-click.js

@@ -0,0 +1,117 @@
+/**
+ * `browser_click` — click an element the agent has seen.
+ *
+ * ## Consent, and why this tool asks for none
+ *
+ * `DEC-380` grants consent once, at
+ * `browser_start_session`, bound to that call's origin. So this tool declares
+ * `class: "action"` — it does change a running application, and pretending
+ * otherwise would be the lie — while its `describeAction` returns `undefined`,
+ * the existing "this particular call has nothing to confirm" path that
+ * `questions` uses when asked to read rather than write.
+ *
+ * The property that makes that safe rather than merely cheap: **a verb cannot
+ * mint consent for itself.** Called against a session with no consent record,
+ * it refuses. There is deliberately no path from a click to a token.
+ *
+ * ## A ref, never a selector
+ *
+ * The element is named by a ref from a snapshot the calling agent actually
+ * saw. A raw selector would let an agent act on an element it never looked
+ * at, and a ref from a superseded snapshot refuses rather than resolving
+ * against whatever now matches — that is the same mistake, arriving later.
+ */
+import { browserAnswer, emptyEvidence, mutationRefusal, observeAndCorrelate, useSession } from "../browser/tool-support.js";
+import { NO_GRAPH_WRITE } from "../browser/graph-write.js";
+import { UnknownElementRefError } from "../browser/driver.js";
+import { requiredString } from "./kit.js";
+const SCHEMA = {
+    type: "object",
+    properties: {
+        sessionId: {
+            type: "string",
+            description: "REQUIRED. The id returned by browser_start_session.",
+        },
+        ref: {
+            type: "string",
+            description: "REQUIRED. An element ref from a browser_snapshot reply. Refs are issued per snapshot and are " +
+                "invalidated by navigation — a stale ref is refused rather than resolved against whatever now " +
+                "matches it, so take a fresh snapshot after the page changes.",
+        },
+        confirmToken: {
+            type: "string",
+            description: "Not normally needed. Consent is granted once, for the whole session, by browser_start_session, " +
+                "so this call performs its action directly. The field is declared because the handshake reads it " +
+                "for every action-class tool.",
+        },
+    },
+    required: ["sessionId", "ref"],
+    additionalProperties: false,
+};
+async function run(args, ctx) {
+    const sessionId = requiredString(args, "sessionId");
+    const ref = requiredString(args, "ref");
+    const found = await useSession(ctx.session.browserSessions(), sessionId);
+    if (!found.ok) {
+        return browserAnswer({
+            ctx,
+            state: found.dead.state,
+            headline: found.dead.headline,
+            notes: found.dead.notes,
+            data: { sessionId, ref, url: "", evidence: found.dead.evidence, graph: NO_GRAPH_WRITE },
+        });
+    }
+    const { entry } = found;
+    // Consent and safetyLevel are independent and both must pass. Consent was
+    // granted at session start; this is the other half.
+    const refused = mutationRefusal(entry);
+    if (refused !== null) {
+        return browserAnswer({
+            ctx,
+            state: "refused",
+            headline: `${entry.profile?.name ?? "This environment"} is read-only.`,
+            notes: [refused],
+            data: { sessionId, ref, url: entry.page.currentUrl(), evidence: emptyEvidence(), graph: NO_GRAPH_WRITE },
+        });
+    }
+    try {
+        ctx.progress(`Clicking`);
+        await entry.page.click(ref);
+    }
+    catch (error) {
+        if (!(error instanceof UnknownElementRefError))
+            throw error;
+        return browserAnswer({
+            ctx,
+            state: "refused",
+            headline: `"${ref}" is not an element in this session's current snapshot.`,
+            notes: [error.message],
+            data: { sessionId, ref, url: entry.page.currentUrl(), evidence: emptyEvidence(), graph: NO_GRAPH_WRITE },
+        });
+    }
+    const observed = await observeAndCorrelate(ctx, entry);
+    return browserAnswer({
+        ctx,
+        headline: `Clicking on ${entry.page.currentUrl()}.`,
+        notes: observed.notes,
+        data: { sessionId, ref, url: entry.page.currentUrl(), evidence: observed.evidence, graph: observed.graph },
+    });
+}
+export const browserClickTool = {
+    name: "browser_click",
+    title: "click an element the agent has seen",
+    description: "Click an element in an open browser session, named by a ref from a browser_snapshot reply. Returns " +
+        "whatever the page produced as a result — console errors and failed requests, raw and untriaged. " +
+        "Refused when the session's environment profile declares safetyLevel \"readOnly\".",
+    class: "action",
+    tier: "evidence",
+    version: "1.0.0",
+    inputSchema: SCHEMA,
+    run,
+    // Undefined, always: the session this runs in was confirmed at
+    // browser_start_session, and a verb that could describe — and therefore
+    // mint — its own consent would be a gate that exists only for callers who
+    // were not going to abuse it.
+    describeAction: () => undefined,
+};
+//# sourceMappingURL=browser-click.js.map

package/dist/tools/browser-click.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-click.js","sourceRoot":"","sources":["../../src/tools/browser-click.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5H,OAAO,EAAE,cAAc,EAA0B,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAyC,MAAM,UAAU,CAAC;AAYjF,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qDAAqD;SACnE;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,+FAA+F;gBAC/F,+FAA+F;gBAC/F,8DAA8D;SACjE;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,iGAAiG;gBACjG,kGAAkG;gBAClG,8BAA8B;SACjC;KACF;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;IAC9B,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,KAAK,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAgB;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,aAAa,CAAmB;YACrC,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExB,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,aAAa,CAAmB;YACrC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,kBAAkB,gBAAgB;YACtE,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACzG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5D,OAAO,aAAa,CAAmB;YACrC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI,GAAG,yDAAyD;YAC1E,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACtB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACzG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEvD,OAAO,aAAa,CAAmB;QACrC,GAAG;QACH,QAAQ,EAAE,eAAe,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG;QACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;KAC3G,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,qGAAqG;QAChH,kGAAkG;QAClG,mFAAmF;IACrF,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,MAAM;IACnB,GAAG;IACH,+DAA+D;IAC/D,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;CAChC,CAAC"}

package/dist/tools/browser-close-session.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `browser_close_session` — tear down and hand back what is left.
+ *
+ * Returns the final flush rather than an acknowledgement. Evidence captured
+ * and then dropped is worse than evidence never captured, because nothing
+ * discloses it — so the last thing a session does is report what it was
+ * holding.
+ *
+ * Closing a session that is already gone is **not an error**. An agent whose
+ * session timed out while it was thinking should get "here is why it went,
+ * and here is what it saw", not a failure it has to handle. That is the whole
+ * reason the registry keeps a record of a reaped session rather than
+ * forgetting the id.
+ */
+import type { BrowserEvidenceReport } from "../browser/evidence.ts";
+import { type ToolDefinition } from "./kit.ts";
+export interface BrowserCloseSessionData {
+    readonly sessionId: string;
+    /** How the session ended — closed here, or already gone and why. */
+    readonly endedBy: "thisCall" | "idleTimeout" | "clientDisconnect" | "crashed" | "alreadyClosed";
+    readonly evidence: BrowserEvidenceReport;
+}
+export declare const browserCloseSessionTool: ToolDefinition;
+//# sourceMappingURL=browser-close-session.d.ts.map

package/dist/tools/browser-close-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-close-session.d.ts","sourceRoot":"","sources":["../../src/tools/browser-close-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAGjF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,kBAAkB,GAAG,SAAS,GAAG,eAAe,CAAC;IAChG,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AA+CD,eAAO,MAAM,uBAAuB,EAAE,cAWrC,CAAC"}

package/dist/tools/browser-close-session.js

@@ -0,0 +1,63 @@
+/**
+ * `browser_close_session` — tear down and hand back what is left.
+ *
+ * Returns the final flush rather than an acknowledgement. Evidence captured
+ * and then dropped is worse than evidence never captured, because nothing
+ * discloses it — so the last thing a session does is report what it was
+ * holding.
+ *
+ * Closing a session that is already gone is **not an error**. An agent whose
+ * session timed out while it was thinking should get "here is why it went,
+ * and here is what it saw", not a failure it has to handle. That is the whole
+ * reason the registry keeps a record of a reaped session rather than
+ * forgetting the id.
+ */
+import { evidenceNotes } from "../browser/evidence.js";
+import { browserAnswer, reportOf } from "../browser/tool-support.js";
+import { requiredString } from "./kit.js";
+const SCHEMA = {
+    type: "object",
+    properties: {
+        sessionId: {
+            type: "string",
+            description: "REQUIRED. The id returned by browser_start_session. Closing a session that has already ended is " +
+                "safe and returns what it observed, so there is no need to check first.",
+        },
+    },
+    required: ["sessionId"],
+    additionalProperties: false,
+};
+async function run(args, ctx) {
+    const sessionId = requiredString(args, "sessionId");
+    const registry = ctx.session.browserSessions();
+    const alreadyReaped = registry.reaped(sessionId);
+    ctx.progress(`Closing browser session ${sessionId}`);
+    const observation = await registry.close(sessionId);
+    const evidence = reportOf(observation);
+    const endedBy = alreadyReaped === undefined ? "thisCall" : alreadyReaped.reason === "closed" ? "alreadyClosed" : alreadyReaped.reason;
+    const notes = [...evidenceNotes(evidence)];
+    if (alreadyReaped !== undefined) {
+        notes.push(`This session had already ended (${endedBy}). Anything it observed before it went is included here ` +
+            "rather than discarded.");
+    }
+    return browserAnswer({
+        ctx,
+        headline: alreadyReaped === undefined
+            ? `Closed browser session ${sessionId}.`
+            : `Browser session ${sessionId} had already ended (${endedBy}).`,
+        notes,
+        data: { sessionId, endedBy, evidence },
+    });
+}
+export const browserCloseSessionTool = {
+    name: "browser_close_session",
+    title: "Close a browser session",
+    description: "Tear down an open browser session and return everything it observed but had not yet reported. Safe to " +
+        "call on a session that has already ended — it tells you how it ended and hands over what it saw.",
+    class: "stateful-read",
+    tier: "evidence",
+    version: "1.0.0",
+    inputSchema: SCHEMA,
+    run,
+};
+//# sourceMappingURL=browser-close-session.js.map

package/dist/tools/browser-close-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-close-session.js","sourceRoot":"","sources":["../../src/tools/browser-close-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAyC,MAAM,UAAU,CAAC;AAUjF,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,kGAAkG;gBAClG,wEAAwE;SAC3E;KACF;IACD,QAAQ,EAAE,CAAC,WAAW,CAAC;IACvB,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,KAAK,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAgB;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IAE/C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,GAAG,CAAC,QAAQ,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,OAAO,GACX,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;IAExH,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,mCAAmC,OAAO,0DAA0D;YAClG,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAA0B;QAC5C,GAAG;QACH,QAAQ,EACN,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,0BAA0B,SAAS,GAAG;YACxC,CAAC,CAAC,mBAAmB,SAAS,uBAAuB,OAAO,IAAI;QACpE,KAAK;QACL,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,wGAAwG;QACxG,kGAAkG;IACpG,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,MAAM;IACnB,GAAG;CACJ,CAAC"}

package/dist/tools/browser-fill.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `browser_fill` — set a field's value directly.
+ *
+ * ## Consent, and why this tool asks for none
+ *
+ * `DEC-380` grants consent once, at
+ * `browser_start_session`, bound to that call's origin. So this tool declares
+ * `class: "action"` — it does change a running application, and pretending
+ * otherwise would be the lie — while its `describeAction` returns `undefined`,
+ * the existing "this particular call has nothing to confirm" path that
+ * `questions` uses when asked to read rather than write.
+ *
+ * The property that makes that safe rather than merely cheap: **a verb cannot
+ * mint consent for itself.** Called against a session with no consent record,
+ * it refuses. There is deliberately no path from a click to a token.
+ *
+ * ## A ref, never a selector
+ *
+ * The element is named by a ref from a snapshot the calling agent actually
+ * saw. A raw selector would let an agent act on an element it never looked
+ * at, and a ref from a superseded snapshot refuses rather than resolving
+ * against whatever now matches — that is the same mistake, arriving later.
+ */
+/**
+ * ## The trap this tool sets, stated where a reader meets it
+ *
+ * `fill` is faster and more reliable than typing, and for most fields it is
+ * the right verb. It also fires **no key events whatsoever** — the value is
+ * set directly. Any behaviour the page attaches to typing simply does not
+ * happen: autocompletes stay closed, per-character validation never runs, a
+ * debounced search never fires. The field ends up holding the right string
+ * and the page never learns it was touched.
+ *
+ * That is a correct tool producing a wrong answer, so the distinction is in
+ * the schema prose and not only here.
+ */
+import type { BrowserEvidenceReport } from "../browser/evidence.ts";
+import { type BrowserGraphWrite } from "../browser/graph-write.ts";
+import { type ToolDefinition } from "./kit.ts";
+export interface BrowserFillData {
+    readonly sessionId: string;
+    readonly ref: string;
+    readonly url: string;
+    readonly evidence: BrowserEvidenceReport;
+    /** Graph nodes this action's own requests reached, and any R4 edges it witnessed. */
+    readonly graph: BrowserGraphWrite;
+}
+export declare const browserFillTool: ToolDefinition;
+//# sourceMappingURL=browser-fill.d.ts.map

package/dist/tools/browser-fill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-fill.d.ts","sourceRoot":"","sources":["../../src/tools/browser-fill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnF,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAGjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AA0FD,eAAO,MAAM,eAAe,EAAE,cAiB7B,CAAC"}

package/dist/tools/browser-fill.js

@@ -0,0 +1,138 @@
+/**
+ * `browser_fill` — set a field's value directly.
+ *
+ * ## Consent, and why this tool asks for none
+ *
+ * `DEC-380` grants consent once, at
+ * `browser_start_session`, bound to that call's origin. So this tool declares
+ * `class: "action"` — it does change a running application, and pretending
+ * otherwise would be the lie — while its `describeAction` returns `undefined`,
+ * the existing "this particular call has nothing to confirm" path that
+ * `questions` uses when asked to read rather than write.
+ *
+ * The property that makes that safe rather than merely cheap: **a verb cannot
+ * mint consent for itself.** Called against a session with no consent record,
+ * it refuses. There is deliberately no path from a click to a token.
+ *
+ * ## A ref, never a selector
+ *
+ * The element is named by a ref from a snapshot the calling agent actually
+ * saw. A raw selector would let an agent act on an element it never looked
+ * at, and a ref from a superseded snapshot refuses rather than resolving
+ * against whatever now matches — that is the same mistake, arriving later.
+ */
+/**
+ * ## The trap this tool sets, stated where a reader meets it
+ *
+ * `fill` is faster and more reliable than typing, and for most fields it is
+ * the right verb. It also fires **no key events whatsoever** — the value is
+ * set directly. Any behaviour the page attaches to typing simply does not
+ * happen: autocompletes stay closed, per-character validation never runs, a
+ * debounced search never fires. The field ends up holding the right string
+ * and the page never learns it was touched.
+ *
+ * That is a correct tool producing a wrong answer, so the distinction is in
+ * the schema prose and not only here.
+ */
+import { browserAnswer, emptyEvidence, mutationRefusal, observeAndCorrelate, useSession } from "../browser/tool-support.js";
+import { NO_GRAPH_WRITE } from "../browser/graph-write.js";
+import { UnknownElementRefError } from "../browser/driver.js";
+import { requiredString } from "./kit.js";
+const SCHEMA = {
+    type: "object",
+    properties: {
+        sessionId: {
+            type: "string",
+            description: "REQUIRED. The id returned by browser_start_session.",
+        },
+        ref: {
+            type: "string",
+            description: "REQUIRED. An element ref from a browser_snapshot reply. Refs are issued per snapshot and are " +
+                "invalidated by navigation — a stale ref is refused rather than resolved against whatever now " +
+                "matches it, so take a fresh snapshot after the page changes.",
+        },
+        text: {
+            type: "string",
+            description: "REQUIRED. The value to put in the field, REPLACING whatever is there. Set directly, so the page " +
+                "sees no keydown, keypress or keyup at all — if the field has an autocomplete, per-character " +
+                "validation or a debounced search, none of it will fire. Use browser_type for those.",
+        },
+        confirmToken: {
+            type: "string",
+            description: "Not normally needed. Consent is granted once, for the whole session, by browser_start_session, " +
+                "so this call performs its action directly. The field is declared because the handshake reads it " +
+                "for every action-class tool.",
+        },
+    },
+    required: ["sessionId", "ref", "text"],
+    additionalProperties: false,
+};
+async function run(args, ctx) {
+    const sessionId = requiredString(args, "sessionId");
+    const ref = requiredString(args, "ref");
+    const text = requiredString(args, "text");
+    const found = await useSession(ctx.session.browserSessions(), sessionId);
+    if (!found.ok) {
+        return browserAnswer({
+            ctx,
+            state: found.dead.state,
+            headline: found.dead.headline,
+            notes: found.dead.notes,
+            data: { sessionId, ref, url: "", evidence: found.dead.evidence, graph: NO_GRAPH_WRITE },
+        });
+    }
+    const { entry } = found;
+    // Consent and safetyLevel are independent and both must pass. Consent was
+    // granted at session start; this is the other half.
+    const refused = mutationRefusal(entry);
+    if (refused !== null) {
+        return browserAnswer({
+            ctx,
+            state: "refused",
+            headline: `${entry.profile?.name ?? "This environment"} is read-only.`,
+            notes: [refused],
+            data: { sessionId, ref, url: entry.page.currentUrl(), evidence: emptyEvidence(), graph: NO_GRAPH_WRITE },
+        });
+    }
+    try {
+        ctx.progress(`Filling`);
+        await entry.page.fill(ref, text);
+    }
+    catch (error) {
+        if (!(error instanceof UnknownElementRefError))
+            throw error;
+        return browserAnswer({
+            ctx,
+            state: "refused",
+            headline: `"${ref}" is not an element in this session's current snapshot.`,
+            notes: [error.message],
+            data: { sessionId, ref, url: entry.page.currentUrl(), evidence: emptyEvidence(), graph: NO_GRAPH_WRITE },
+        });
+    }
+    const observed = await observeAndCorrelate(ctx, entry);
+    return browserAnswer({
+        ctx,
+        headline: `Filling on ${entry.page.currentUrl()}.`,
+        notes: observed.notes,
+        data: { sessionId, ref, url: entry.page.currentUrl(), evidence: observed.evidence, graph: observed.graph },
+    });
+}
+export const browserFillTool = {
+    name: "browser_fill",
+    title: "set a field's value directly",
+    description: "Set a field's value in an open browser session, replacing what is there. Fires no key events at all: " +
+        "the value is set directly, so an autocomplete, per-character validation or debounced search attached " +
+        "to that field will not run. Use browser_type when the page reacts to typing. Refused when the " +
+        "session's environment profile declares safetyLevel \"readOnly\".",
+    class: "action",
+    tier: "evidence",
+    version: "1.0.0",
+    inputSchema: SCHEMA,
+    run,
+    // Undefined, always: the session this runs in was confirmed at
+    // browser_start_session, and a verb that could describe — and therefore
+    // mint — its own consent would be a gate that exists only for callers who
+    // were not going to abuse it.
+    describeAction: () => undefined,
+};
+//# sourceMappingURL=browser-fill.js.map

package/dist/tools/browser-fill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-fill.js","sourceRoot":"","sources":["../../src/tools/browser-fill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5H,OAAO,EAAE,cAAc,EAA0B,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAyC,MAAM,UAAU,CAAC;AAYjF,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qDAAqD;SACnE;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,+FAA+F;gBAC/F,+FAA+F;gBAC/F,8DAA8D;SACjE;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,kGAAkG;gBAClG,8FAA8F;gBAC9F,qFAAqF;SACxF;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,iGAAiG;gBACjG,kGAAkG;gBAClG,8BAA8B;SACjC;KACF;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;IACtC,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,KAAK,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAgB;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,aAAa,CAAkB;YACpC,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExB,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,aAAa,CAAkB;YACpC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,kBAAkB,gBAAgB;YACtE,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACzG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5D,OAAO,aAAa,CAAkB;YACpC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI,GAAG,yDAAyD;YAC1E,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACtB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACzG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEvD,OAAO,aAAa,CAAkB;QACpC,GAAG;QACH,QAAQ,EAAE,cAAc,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG;QAClD,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;KAC3G,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,uGAAuG;QAClH,uGAAuG;QACvG,gGAAgG;QAChG,kEAAkE;IACpE,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,MAAM;IACnB,GAAG;IACH,+DAA+D;IAC/D,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;CAChC,CAAC"}

package/dist/tools/browser-navigate.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `browser_navigate` — move an open session to another page.
+ *
+ * ## The one rule that is not obvious
+ *
+ * Navigation is where a session-scoped consent could quietly become a
+ * general-purpose browser. The grant names an origin; this tool is the only
+ * thing that can leave it, so this is where the bound is enforced. A
+ * cross-origin navigate **refuses** — it does not ask again, because a second
+ * prompt at this point is exactly the reflexive confirmation the consent
+ * ruling rejected.
+ *
+ * ## Class
+ *
+ * `stateful-read`. It changes what a later call sees, so it is not a pure
+ * read; but the fact a developer approves — *drive a browser against this
+ * application* — was stated and confirmed at `browser_start_session`, and
+ * re-gating each hop would make the session grant meaningless.
+ */
+import { type ToolDefinition } from "./kit.ts";
+import type { BrowserPageData } from "./browser-snapshot.ts";
+/**
+ * Deliberately the same shape `browser_snapshot` returns.
+ *
+ * A navigate answers the question a snapshot answers — *what is on the page
+ * now* — so returning a different shape would make a caller write two readers
+ * for one fact. It is an alias rather than a re-declaration so the two cannot
+ * drift.
+ */
+export type BrowserNavigateData = BrowserPageData;
+export declare const browserNavigateTool: ToolDefinition;
+//# sourceMappingURL=browser-navigate.d.ts.map

package/dist/tools/browser-navigate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-navigate.d.ts","sourceRoot":"","sources":["../../src/tools/browser-navigate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAEjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AA8ElD,eAAO,MAAM,mBAAmB,EAAE,cAYjC,CAAC"}

package/dist/tools/browser-navigate.js

@@ -0,0 +1,103 @@
+/**
+ * `browser_navigate` — move an open session to another page.
+ *
+ * ## The one rule that is not obvious
+ *
+ * Navigation is where a session-scoped consent could quietly become a
+ * general-purpose browser. The grant names an origin; this tool is the only
+ * thing that can leave it, so this is where the bound is enforced. A
+ * cross-origin navigate **refuses** — it does not ask again, because a second
+ * prompt at this point is exactly the reflexive confirmation the consent
+ * ruling rejected.
+ *
+ * ## Class
+ *
+ * `stateful-read`. It changes what a later call sees, so it is not a pure
+ * read; but the fact a developer approves — *drive a browser against this
+ * application* — was stated and confirmed at `browser_start_session`, and
+ * re-gating each hop would make the session grant meaningless.
+ */
+import { browserAnswer, emptyEvidence, observeAndCorrelate, useSession, withinConsent } from "../browser/tool-support.js";
+import { NO_GRAPH_WRITE } from "../browser/graph-write.js";
+import { requiredString } from "./kit.js";
+const SCHEMA = {
+    type: "object",
+    properties: {
+        sessionId: {
+            type: "string",
+            description: "REQUIRED. The id returned by browser_start_session. Sessions belong to this connection and do not survive a reconnect.",
+        },
+        url: {
+            type: "string",
+            description: "REQUIRED. Where to navigate. Must be on the same origin the session was started against — a URL " +
+                "on any other origin is refused rather than confirmed again, because consent was granted for one " +
+                "application, not for the browser generally.",
+        },
+    },
+    required: ["sessionId", "url"],
+    additionalProperties: false,
+};
+function blank(url, evidence) {
+    return { sessionId: "", url, title: "", elements: [], totalElements: 0, evidence, graph: NO_GRAPH_WRITE };
+}
+async function run(args, ctx) {
+    const sessionId = requiredString(args, "sessionId");
+    const url = requiredString(args, "url");
+    const found = await useSession(ctx.session.browserSessions(), sessionId);
+    if (!found.ok) {
+        return browserAnswer({
+            ctx,
+            state: found.dead.state,
+            headline: found.dead.headline,
+            notes: found.dead.notes,
+            data: blank(url, found.dead.evidence),
+        });
+    }
+    const { entry } = found;
+    if (!withinConsent(entry, url)) {
+        return browserAnswer({
+            ctx,
+            state: "refused",
+            headline: `${url} is outside this session's consented origin.`,
+            notes: [
+                `This session was started against ${entry.consentedOrigin} and consent is bound to that origin. ` +
+                    `Navigating to ${url} would take the browser somewhere the developer did not approve, so it is ` +
+                    "refused rather than confirmed again — asking a second time here is how a gate becomes a habit. " +
+                    "Start a new session if you genuinely mean to drive that origin.",
+            ],
+            data: blank(url, emptyEvidence()),
+        });
+    }
+    ctx.progress(`Navigating to ${url}`);
+    await entry.page.navigate(url);
+    const snapshot = await entry.page.snapshot();
+    const observed = await observeAndCorrelate(ctx, entry);
+    const evidence = observed.evidence;
+    return browserAnswer({
+        ctx,
+        headline: `${snapshot.url} — ${snapshot.title || "untitled"} (${snapshot.totalElements} elements).`,
+        notes: observed.notes,
+        data: {
+            sessionId: entry.sessionId,
+            url: snapshot.url,
+            title: snapshot.title,
+            elements: snapshot.elements,
+            totalElements: snapshot.totalElements,
+            evidence,
+            graph: observed.graph,
+        },
+    });
+}
+export const browserNavigateTool = {
+    name: "browser_navigate",
+    title: "Navigate an open browser session",
+    description: "Move an open browser session to another page on the same application, and return what is there plus " +
+        "anything the page produced on the way — console errors and failed requests, raw and untriaged. " +
+        "Refuses to leave the origin the session was started against.",
+    class: "stateful-read",
+    tier: "evidence",
+    version: "1.0.0",
+    inputSchema: SCHEMA,
+    run,
+};
+//# sourceMappingURL=browser-navigate.js.map

package/dist/tools/browser-navigate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-navigate.js","sourceRoot":"","sources":["../../src/tools/browser-navigate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAyC,MAAM,UAAU,CAAC;AAcjF,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,wHAAwH;SACtI;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,kGAAkG;gBAClG,kGAAkG;gBAClG,6CAA6C;SAChD;KACF;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;IAC9B,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,SAAS,KAAK,CAAC,GAAW,EAAE,QAA+B;IACzD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC5G,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAgB;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,aAAa,CAAsB;YACxC,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAsB;YACxC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG,GAAG,8CAA8C;YAC9D,KAAK,EAAE;gBACL,oCAAoC,KAAK,CAAC,eAAe,wCAAwC;oBAC/F,iBAAiB,GAAG,4EAA4E;oBAChG,iGAAiG;oBACjG,iEAAiE;aACpE;YACD,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEnC,OAAO,aAAa,CAAsB;QACxC,GAAG;QACH,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,UAAU,KAAK,QAAQ,CAAC,aAAa,aAAa;QACnG,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAmB;IACjD,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EACT,sGAAsG;QACtG,iGAAiG;QACjG,8DAA8D;IAChE,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,MAAM;IACnB,GAAG;CACJ,CAAC"}

package/dist/tools/browser-run-scenario.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `browser_run_scenario` — replay a saved scenario in one batch call.
+ *
+ * ## One reply, not N
+ *
+ * The point of this tool over "call browser_click six times" is that a
+ * scenario is a *check*, and a check has one outcome. Six replies make the
+ * calling agent reassemble a verdict from fragments and give it six chances to
+ * stop early with a partial picture; one reply carries the whole run — every
+ * step, every assertion, and one aggregated evidence summary drained a step at
+ * a time.
+ *
+ * ## Class
+ *
+ * `action`, on the same test as `browser_click`: it changes a running
+ * application, and declaring it anything softer would be the lie. Like the
+ * verbs, it mints nothing — consent was granted once at
+ * `browser_start_session` and bound to that origin, and a scenario cannot
+ * widen it: a stored `navigate` step that would leave the consented origin
+ * stops the replay rather than following the file.
+ *
+ * ## What it will not do
+ *
+ * Report a verdict about the application beyond what the scenario's own author
+ * wrote down. `DEC-381` keeps classification
+ * in the desktop pipeline, so a console error observed during a replay is
+ * reported and is not blocking — while a console error the author *asserted*
+ * would not happen is a failed assertion and is. Same evidence, different
+ * status, and the difference is entirely whether a person claimed something
+ * about it.
+ */
+import { type BrowserGraphWrite } from "../browser/graph-write.ts";
+import { type ScenarioAssertionResult, type ScenarioCounts, type ScenarioStepResult } from "../browser/scenario-runner.ts";
+import type { BrowserEvidenceReport } from "../browser/evidence.ts";
+import { type ToolDefinition } from "./kit.ts";
+export interface BrowserRunScenarioData {
+    readonly sessionId: string;
+    readonly scenario: string;
+    /** `passed` · `failed` · `unresolved` · `unverified` — never `passed` for a scenario that asserted nothing. */
+    readonly outcome: "passed" | "failed" | "unresolved" | "unverified" | "notRun";
+    /** Three counts that are never summed, plus how many assertions held. */
+    readonly counts: ScenarioCounts;
+    /** Failed assertions alone. An unresolvable step is not a defect claim, so it does not join this. */
+    readonly blockingTotal: number;
+    /** 0 clean · 1 blocking findings · 2 the check could not run. `descry check`'s existing vocabulary. */
+    readonly exitCode: 0 | 1 | 2;
+    readonly steps: readonly ScenarioStepResult[];
+    readonly assertions: readonly ScenarioAssertionResult[];
+    /** One summary for the whole batch, drained a step at a time. */
+    readonly evidence: BrowserEvidenceReport;
+    readonly graph: BrowserGraphWrite;
+}
+export declare const browserRunScenarioTool: ToolDefinition;
+//# sourceMappingURL=browser-run-scenario.d.ts.map

package/dist/tools/browser-run-scenario.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-run-scenario.d.ts","sourceRoot":"","sources":["../../src/tools/browser-run-scenario.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAA2B,KAAK,uBAAuB,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEpJ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAGjF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC/E,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACxD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AA2LD,eAAO,MAAM,sBAAsB,EAAE,cAoBpC,CAAC"}