@frontmcp/plugin-webmcp 1.12.0 → 1.12.1

package/esm/index.mjs

@@ -432,23 +432,32 @@ var LazyWebMcpTools = class {
     const placeholder = {
       fingerprint: fingerprintOf(tool, exposedTo),
       controller: new AbortController(),
-      adopted: false
+      adopted: false,
+      exposedTo: exposedTo ?? []
     };
     this.placeholders.set(tool.name, placeholder);
     try {
       await this.modelContext.registerTool(
-        { ...tool, execute: (input, options) => this.call(tool.name, input, options) },
+        { ...tool, execute: (input, options) => this.call(tool.name, placeholder, input, options) },
         { signal: placeholder.controller.signal, ...exposedTo && { exposedTo } }
       );
     } catch {
       this.release(tool.name, placeholder);
     }
   }
-  async call(name, input, options) {
+  /**
+   * A call an agent made through a listed tool, run by the plugin once the server is loaded, unless the plugin no
+   * longer offers the tool to every origin the listed one was offered to: that call must come again through the
+   * plugin's own registration.
+   */
+  async call(name, placeholder, input, options) {
     await this.load();
-    const execute = this.executors.get(name);
-    if (!execute) throw new Error(`Tool "${name}" not found`);
-    return execute(input, options);
+    const executor = this.executors.get(name);
+    if (!executor) throw new Error(`Tool "${name}" not found`);
+    if (!placeholder.exposedTo.every((origin) => executor.exposedTo.includes(origin))) {
+      throw new Error(`Tool "${name}" is no longer offered to every origin it was listed for: call it again`);
+    }
+    return executor.execute(input, options);
   }
   /** Load the server once; a failed load is tried again on the next call. */
   load() {
@@ -493,12 +502,13 @@ var LazyWebMcpTools = class {
     const { execute, ...descriptor } = tool;
     const placeholder = this.placeholders.get(tool.name);
     const kept = placeholder && !placeholder.adopted && placeholder.fingerprint === fingerprintOf(descriptor, options?.exposedTo) ? placeholder : void 0;
-    this.executors.set(tool.name, execute);
+    const executor = { execute, exposedTo: options?.exposedTo ?? [] };
+    this.executors.set(tool.name, executor);
     options?.signal?.addEventListener(
       "abort",
       () => {
         if (attempt.failed) return;
-        if (this.executors.get(tool.name) === execute) this.executors.delete(tool.name);
+        if (this.executors.get(tool.name) === executor) this.executors.delete(tool.name);
         if (kept) this.release(tool.name, kept);
       },
       { once: true }

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-webmcp",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "WebMCP plugin for FrontMCP - expose an in-browser FrontMCP server's tools to browser agents through document.modelContext",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -60,14 +60,14 @@
     }
   },
   "dependencies": {
-    "@frontmcp/utils": "1.12.0"
+    "@frontmcp/utils": "1.12.1"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.12.0",
-    "@frontmcp/sdk": "1.12.0"
+    "@frontmcp/lazy-zod": "1.12.1",
+    "@frontmcp/sdk": "1.12.1"
   },
   "devDependencies": {
-    "@frontmcp/sdk": "1.12.0",
+    "@frontmcp/sdk": "1.12.1",
     "reflect-metadata": "^0.2.2"
   }
 }

package/esm/register.mjs

@@ -59,23 +59,32 @@ var LazyWebMcpTools = class {
     const placeholder = {
       fingerprint: fingerprintOf(tool, exposedTo),
       controller: new AbortController(),
-      adopted: false
+      adopted: false,
+      exposedTo: exposedTo ?? []
     };
     this.placeholders.set(tool.name, placeholder);
     try {
       await this.modelContext.registerTool(
-        { ...tool, execute: (input, options) => this.call(tool.name, input, options) },
+        { ...tool, execute: (input, options) => this.call(tool.name, placeholder, input, options) },
         { signal: placeholder.controller.signal, ...exposedTo && { exposedTo } }
       );
     } catch {
       this.release(tool.name, placeholder);
     }
   }
-  async call(name, input, options) {
+  /**
+   * A call an agent made through a listed tool, run by the plugin once the server is loaded, unless the plugin no
+   * longer offers the tool to every origin the listed one was offered to: that call must come again through the
+   * plugin's own registration.
+   */
+  async call(name, placeholder, input, options) {
     await this.load();
-    const execute = this.executors.get(name);
-    if (!execute) throw new Error(`Tool "${name}" not found`);
-    return execute(input, options);
+    const executor = this.executors.get(name);
+    if (!executor) throw new Error(`Tool "${name}" not found`);
+    if (!placeholder.exposedTo.every((origin) => executor.exposedTo.includes(origin))) {
+      throw new Error(`Tool "${name}" is no longer offered to every origin it was listed for: call it again`);
+    }
+    return executor.execute(input, options);
   }
   /** Load the server once; a failed load is tried again on the next call. */
   load() {
@@ -120,12 +129,13 @@ var LazyWebMcpTools = class {
     const { execute, ...descriptor } = tool;
     const placeholder = this.placeholders.get(tool.name);
     const kept = placeholder && !placeholder.adopted && placeholder.fingerprint === fingerprintOf(descriptor, options?.exposedTo) ? placeholder : void 0;
-    this.executors.set(tool.name, execute);
+    const executor = { execute, exposedTo: options?.exposedTo ?? [] };
+    this.executors.set(tool.name, executor);
     options?.signal?.addEventListener(
       "abort",
       () => {
         if (attempt.failed) return;
-        if (this.executors.get(tool.name) === execute) this.executors.delete(tool.name);
+        if (this.executors.get(tool.name) === executor) this.executors.delete(tool.name);
         if (kept) this.release(tool.name, kept);
       },
       { once: true }

package/index.js

@@ -460,23 +460,32 @@ var LazyWebMcpTools = class {
     const placeholder = {
       fingerprint: fingerprintOf(tool, exposedTo),
       controller: new AbortController(),
-      adopted: false
+      adopted: false,
+      exposedTo: exposedTo ?? []
     };
     this.placeholders.set(tool.name, placeholder);
     try {
       await this.modelContext.registerTool(
-        { ...tool, execute: (input, options) => this.call(tool.name, input, options) },
+        { ...tool, execute: (input, options) => this.call(tool.name, placeholder, input, options) },
         { signal: placeholder.controller.signal, ...exposedTo && { exposedTo } }
       );
     } catch {
       this.release(tool.name, placeholder);
     }
   }
-  async call(name, input, options) {
+  /**
+   * A call an agent made through a listed tool, run by the plugin once the server is loaded, unless the plugin no
+   * longer offers the tool to every origin the listed one was offered to: that call must come again through the
+   * plugin's own registration.
+   */
+  async call(name, placeholder, input, options) {
     await this.load();
-    const execute = this.executors.get(name);
-    if (!execute) throw new Error(`Tool "${name}" not found`);
-    return execute(input, options);
+    const executor = this.executors.get(name);
+    if (!executor) throw new Error(`Tool "${name}" not found`);
+    if (!placeholder.exposedTo.every((origin) => executor.exposedTo.includes(origin))) {
+      throw new Error(`Tool "${name}" is no longer offered to every origin it was listed for: call it again`);
+    }
+    return executor.execute(input, options);
   }
   /** Load the server once; a failed load is tried again on the next call. */
   load() {
@@ -521,12 +530,13 @@ var LazyWebMcpTools = class {
     const { execute, ...descriptor } = tool;
     const placeholder = this.placeholders.get(tool.name);
     const kept = placeholder && !placeholder.adopted && placeholder.fingerprint === fingerprintOf(descriptor, options?.exposedTo) ? placeholder : void 0;
-    this.executors.set(tool.name, execute);
+    const executor = { execute, exposedTo: options?.exposedTo ?? [] };
+    this.executors.set(tool.name, executor);
     options?.signal?.addEventListener(
       "abort",
       () => {
         if (attempt.failed) return;
-        if (this.executors.get(tool.name) === execute) this.executors.delete(tool.name);
+        if (this.executors.get(tool.name) === executor) this.executors.delete(tool.name);
         if (kept) this.release(tool.name, kept);
       },
       { once: true }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-webmcp",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "WebMCP plugin for FrontMCP - expose an in-browser FrontMCP server's tools to browser agents through document.modelContext",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -60,14 +60,14 @@
     }
   },
   "dependencies": {
-    "@frontmcp/utils": "1.12.0"
+    "@frontmcp/utils": "1.12.1"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.12.0",
-    "@frontmcp/sdk": "1.12.0"
+    "@frontmcp/lazy-zod": "1.12.1",
+    "@frontmcp/sdk": "1.12.1"
   },
   "devDependencies": {
-    "@frontmcp/sdk": "1.12.0",
+    "@frontmcp/sdk": "1.12.1",
     "reflect-metadata": "^0.2.2"
   }
 }

package/register.js

@@ -87,23 +87,32 @@ var LazyWebMcpTools = class {
     const placeholder = {
       fingerprint: fingerprintOf(tool, exposedTo),
       controller: new AbortController(),
-      adopted: false
+      adopted: false,
+      exposedTo: exposedTo ?? []
     };
     this.placeholders.set(tool.name, placeholder);
     try {
       await this.modelContext.registerTool(
-        { ...tool, execute: (input, options) => this.call(tool.name, input, options) },
+        { ...tool, execute: (input, options) => this.call(tool.name, placeholder, input, options) },
         { signal: placeholder.controller.signal, ...exposedTo && { exposedTo } }
       );
     } catch {
       this.release(tool.name, placeholder);
     }
   }
-  async call(name, input, options) {
+  /**
+   * A call an agent made through a listed tool, run by the plugin once the server is loaded, unless the plugin no
+   * longer offers the tool to every origin the listed one was offered to: that call must come again through the
+   * plugin's own registration.
+   */
+  async call(name, placeholder, input, options) {
     await this.load();
-    const execute = this.executors.get(name);
-    if (!execute) throw new Error(`Tool "${name}" not found`);
-    return execute(input, options);
+    const executor = this.executors.get(name);
+    if (!executor) throw new Error(`Tool "${name}" not found`);
+    if (!placeholder.exposedTo.every((origin) => executor.exposedTo.includes(origin))) {
+      throw new Error(`Tool "${name}" is no longer offered to every origin it was listed for: call it again`);
+    }
+    return executor.execute(input, options);
   }
   /** Load the server once; a failed load is tried again on the next call. */
   load() {
@@ -148,12 +157,13 @@ var LazyWebMcpTools = class {
     const { execute, ...descriptor } = tool;
     const placeholder = this.placeholders.get(tool.name);
     const kept = placeholder && !placeholder.adopted && placeholder.fingerprint === fingerprintOf(descriptor, options?.exposedTo) ? placeholder : void 0;
-    this.executors.set(tool.name, execute);
+    const executor = { execute, exposedTo: options?.exposedTo ?? [] };
+    this.executors.set(tool.name, executor);
     options?.signal?.addEventListener(
       "abort",
       () => {
         if (attempt.failed) return;
-        if (this.executors.get(tool.name) === execute) this.executors.delete(tool.name);
+        if (this.executors.get(tool.name) === executor) this.executors.delete(tool.name);
         if (kept) this.release(tool.name, kept);
       },
       { once: true }

package/webmcp.lazy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webmcp.lazy.d.ts","sourceRoot":"","sources":["../src/webmcp.lazy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,YAAY,EAEZ,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AAExB,mFAAmF;AACnF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpG,0CAA0C;AAC1C,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAyCD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,mBAAmB,CAAC;IAAE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,GAC9D,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAmBjC;AAmID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAGf"}
+{"version":3,"file":"webmcp.lazy.d.ts","sourceRoot":"","sources":["../src/webmcp.lazy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,YAAY,EAEZ,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AAExB,mFAAmF;AACnF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpG,0CAA0C;AAC1C,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAyCD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,mBAAmB,CAAC;IAAE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,GAC9D,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAmBjC;AA0JD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAGf"}