@harness-gw/sdk 0.11.0 → 0.12.0

package/README.md

@@ -63,7 +63,7 @@ You need a running harness. Hermes is the primary one; see
    docker run --rm \
      -v "$PWD/config.yaml:/run/harness-gw/config.yaml:ro" \
      -v "$PWD/hermes-token:/run/secrets/hermes-token:ro" \
-     ghcr.io/almogbaku/harness-gw:0.11.0 \
+     ghcr.io/almogbaku/harness-gw:0.12.0 \
      config check --config /run/harness-gw/config.yaml
    ```
 
@@ -73,7 +73,7 @@ You need a running harness. Hermes is the primary one; see
    docker run --rm -p 127.0.0.1:4100:4100 \
      -v "$PWD/config.yaml:/run/harness-gw/config.yaml:ro" \
      -v "$PWD/hermes-token:/run/secrets/hermes-token:ro" \
-     ghcr.io/almogbaku/harness-gw:0.11.0 \
+     ghcr.io/almogbaku/harness-gw:0.12.0 \
      serve --config /run/harness-gw/config.yaml
    ```
 

package/dist/chunks/index.js

@@ -1186,25 +1186,81 @@ var McpAppResourceReadRequestSchema2 = z4.strictObject({
   uri: z4.string().min(1).max(2048)
 });
 var MCP_APP_SANDBOX_PATH2 = "/mcp-app-sandbox.html";
-var LOOPBACK_SOURCES = (scheme) => ["127.0.0.1", "localhost", "*.localhost"].map((host) => `${scheme}://${host}:*`);
-var MCP_APP_SANDBOX_CSP2 = [
-  "default-src 'none'",
-  "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https:",
-  "style-src 'self' 'unsafe-inline' https:",
-  "img-src 'self' data: https:",
-  "font-src 'self' data: https:",
-  ["media-src 'self' data: https:", ...LOOPBACK_SOURCES("http")].join(" "),
-  [
-    "connect-src https: wss:",
-    ...LOOPBACK_SOURCES("http"),
-    ...LOOPBACK_SOURCES("ws")
-  ].join(" "),
-  "worker-src 'self' blob: data:",
-  "frame-src https:",
-  "base-uri https:",
-  "object-src 'none'",
-  "form-action 'none'",
-  "frame-ancestors 'self'"
-].join("; ");
+var POLICY_ORIGIN = new RegExp(`^https?://${HOST}${PORT}$`, "u");
+function isMcpAppPolicyOrigin2(value) {
+  try {
+    return POLICY_ORIGIN.test(value) && new URL(value).origin === value;
+  } catch {
+    return false;
+  }
+}
+function ownHosts({
+  frameAncestors,
+  sandboxOrigin
+}) {
+  const origins = [...frameAncestors, sandboxOrigin];
+  const invalid = origins.find((origin) => !isMcpAppPolicyOrigin2(origin));
+  if (invalid !== undefined)
+    throw new Error(`Not an exact origin a sandbox policy can name: ${invalid}`);
+  if (frameAncestors.includes(sandboxOrigin))
+    throw new Error(`The sandbox origin is one of the host's: ${sandboxOrigin}`);
+  return new Set(origins.map((origin) => new URL(origin).host));
+}
+function namesHost(domain, hosts) {
+  try {
+    return hosts.has(new URL(domain).host);
+  } catch {
+    return false;
+  }
+}
+var CSP_LISTS = McpUiCspSchema2.keyof().options;
+function appliedMcpAppCsp2({
+  csp,
+  ...origins
+}) {
+  const own = ownHosts(origins);
+  const applied = {};
+  for (const list of CSP_LISTS) {
+    const domains = new Set((csp?.[list] ?? []).filter((domain) => isMcpAppCspDomain2(list, domain)).map((domain) => domain.toLowerCase()).filter((domain) => !namesHost(domain, own)));
+    if (domains.size > 0)
+      applied[list] = [...domains];
+  }
+  return Object.keys(applied).length > 0 ? applied : undefined;
+}
+function policyFileLocation(value, origins) {
+  try {
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || !origins.includes(url.origin) || url.pathname.endsWith("/"))
+      return;
+    const path = url.pathname.split("/").map((segment) => encodeURIComponent(decodeURIComponent(segment)).replaceAll("'", "%27")).join("/");
+    return `${url.origin}${path}`;
+  } catch {
+    return;
+  }
+}
+var sources = (base, domains = []) => [...base, ...domains].join(" ") || "'none'";
+function mcpAppSandboxPolicy2({
+  fileLocations = [],
+  ...view
+}) {
+  const applied = appliedMcpAppCsp2(view) ?? {};
+  const files = fileLocations.flatMap((location) => policyFileLocation(location, view.frameAncestors) ?? []);
+  const resource = applied.resourceDomains ?? [];
+  return [
+    "default-src 'none'",
+    `script-src ${sources(["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'"], resource)}`,
+    `style-src ${sources(["'self'", "'unsafe-inline'"], resource)}`,
+    `img-src ${sources(["'self'", "data:"], resource)}`,
+    `font-src ${sources(["'self'", "data:"], resource)}`,
+    `media-src ${sources(["'self'", "data:"], [...resource, ...files])}`,
+    `connect-src ${sources(applied.connectDomains ?? [], files)}`,
+    "worker-src 'self' blob: data:",
+    `frame-src ${sources([], applied.frameDomains)}`,
+    `base-uri ${sources([], applied.baseUriDomains)}`,
+    "object-src 'none'",
+    "form-action 'none'",
+    `frame-ancestors ${sources([], view.frameAncestors)}`
+  ].join("; ");
+}
 
-export { SESSION_CATALOG_MAX_WINDOW2, RuntimeAuthStateSchema2, OperationCapabilitySchema2, RuntimeInfoSchema2, AgentAvatarSchema2, AgentCatalogEntrySchema2, AgentCatalogResponseSchema2, AgentUpdateFields2, writesAgentField2, AgentUpdateRequestSchema2, AgentUpdateResponseSchema2, SessionStatusSchema2, SessionPlatformSchema2, SessionSchema2, newestSessionFirst2, SessionCatalogResponseSchema2, StopReason2, ToolKind2, ToolLocationSchema2, DiffOperation2, DiffChangeSchema2, ToolDiffSchema2, SessionMessageErrorStatusSchema2, SessionMessageSchema2, SessionPlanActivityMessageSchema2, SessionCompactionActivityMessageSchema2, SessionChildActivityMessageSchema2, SessionActivityMessageSchema2, SessionHistoryResponseSchema2, SessionCreateRequestSchema2, SessionCreateResponseSchema2, SessionPatchRequestSchema2, TurnStopResponseSchema2, TurnSteerRequestSchema2, TurnSteerResponseSchema2, SlashCommandSchema2, MAX_SLASH_COMMANDS2, INTERACTION_PROTOCOL2, SessionWorkspaceCapabilitiesResponseSchema2, GuestRuntimeCapabilitiesResponseSchema2, SessionModelsResponseSchema2, SessionModelUpdateRequestSchema2, SessionModelUpdateResponseSchema2, SessionContextResponseSchema2, ArtifactDescriptorSchema2, SessionTodosResponseSchema2, SessionActivityResponseSchema2, SessionAttachmentStageRequestSchema2, SessionAttachmentStageResponseSchema2, SessionAudioResponseSchema2, SessionTranscriptionRequestSchema2, SessionTranscriptionResponseSchema2, SessionSpeechRequestSchema2, ErrorResponseSchema2, ACP_PROTOCOL_VERSION2, HGW_API_PREFIX2, HGW_ACP_PATH2, HGW_ACP_AGENTS_PATH2, hgwAcpAgentPath2, HGW_META_KEY2, HGW_EXTENSION_VERSION2, HGW_AUTH_METHOD_INVITE2, HGW_ATTACHMENT_URI_SCHEME2, HGW_ARTIFACT_URI_SCHEME2, HGW_METHODS2, HGW_PERMISSION_KIND_SESSION2, HGW_PLAN_ID2, HGW_JSONRPC_ERRORS2, HGW_MAX_FRAME_BYTES2, IdentifierSchema2, HgwExtensionsSchema2, HgwClientCapabilitiesMetaSchema2, HgwInitializeMetaSchema2, HgwLoginMetaSchema2, HgwSessionNewMetaSchema2, HgwSessionListMetaSchema2, HgwSessionSearchMetaSchema2, HgwSessionSearchResponseSchema2, HgwSessionInfoMetaSchema2, HgwSessionResumeMetaSchema2, HGW_REPLAY_POSITION2, HgwReplayPositionSchema2, HGW_REPLAY_BEFORE2, HgwReplayBeforeSchema2, HgwHistoryCursorSchema2, HgwHistoryPageResponseMetaSchema2, HgwHistoryPageTagSchema2, HgwSessionResumeResponseMetaSchema2, HgwPromptMetaSchema2, HgwSessionUpdateRequestSchema2, HgwSessionPartRequestSchema2, HgwSteerRequestSchema2, HgwSteerResponseSchema2, HgwFocusRequestSchema2, HgwAgentsListResponseSchema2, HgwAgentUpdateRequestSchema2, HgwAgentUpdateResponseSchema2, HgwTurnMetaSchema2, HgwNoticeMetaSchema2, HgwMessageMetaSchema2, HgwCostSchema2, HgwChildSessionMetaSchema2, HgwStateMetaSchema2, HgwChunkMetaSchema2, HgwToolCallMetaSchema2, HgwPlanMetaSchema2, HgwUsageMetaSchema2, HgwAvailableCommandsMetaSchema2, HgwPermissionMetaSchema2, HgwQuestionOptionSchema2, HgwQuestionSchema2, HgwElicitationMetaSchema2, HgwArtifactDescriptorSchema2, formatArtifactUri2, parseArtifactUri2, HgwComposerPrefillNotificationSchema2, HgwErrorNotificationSchema2, HGW_REQUEST_TEXT_MAX2, HgwActivityNotificationSchema2, PushCategorySchema2, categoryOf2, PushLocaleSchema2, PRESENCE_IDLE_MS2, PRESENCE_HEARTBEAT_MS2, PRESENCE_GRACE_MS2, PRESENCE_CLOSED_GRACE_MS2, COALESCE_WINDOW_MS2, PUSH_TEXT_LIMITS2, PushMessageSchema2, PushCategoriesSchema2, PushSubscriptionJsonSchema2, PushInfoSchema2, PushRegistrationSchema2, PushUnregistrationSchema2, CallToolResultSchema2, ReadResourceResultSchema2, McpUiCspSchema2, isMcpAppCspDomain2, McpUiPermissionsSchema2, McpAppFilesSchema2, McpAppViewSchema2, viewerFileResult2, McpAppToolCallRequestSchema2, McpAppResourceReadRequestSchema2, MCP_APP_SANDBOX_PATH2, MCP_APP_SANDBOX_CSP2 };
+export { SESSION_CATALOG_MAX_WINDOW2, RuntimeAuthStateSchema2, OperationCapabilitySchema2, RuntimeInfoSchema2, AgentAvatarSchema2, AgentCatalogEntrySchema2, AgentCatalogResponseSchema2, AgentUpdateFields2, writesAgentField2, AgentUpdateRequestSchema2, AgentUpdateResponseSchema2, SessionStatusSchema2, SessionPlatformSchema2, SessionSchema2, newestSessionFirst2, SessionCatalogResponseSchema2, StopReason2, ToolKind2, ToolLocationSchema2, DiffOperation2, DiffChangeSchema2, ToolDiffSchema2, SessionMessageErrorStatusSchema2, SessionMessageSchema2, SessionPlanActivityMessageSchema2, SessionCompactionActivityMessageSchema2, SessionChildActivityMessageSchema2, SessionActivityMessageSchema2, SessionHistoryResponseSchema2, SessionCreateRequestSchema2, SessionCreateResponseSchema2, SessionPatchRequestSchema2, TurnStopResponseSchema2, TurnSteerRequestSchema2, TurnSteerResponseSchema2, SlashCommandSchema2, MAX_SLASH_COMMANDS2, INTERACTION_PROTOCOL2, SessionWorkspaceCapabilitiesResponseSchema2, GuestRuntimeCapabilitiesResponseSchema2, SessionModelsResponseSchema2, SessionModelUpdateRequestSchema2, SessionModelUpdateResponseSchema2, SessionContextResponseSchema2, ArtifactDescriptorSchema2, SessionTodosResponseSchema2, SessionActivityResponseSchema2, SessionAttachmentStageRequestSchema2, SessionAttachmentStageResponseSchema2, SessionAudioResponseSchema2, SessionTranscriptionRequestSchema2, SessionTranscriptionResponseSchema2, SessionSpeechRequestSchema2, ErrorResponseSchema2, ACP_PROTOCOL_VERSION2, HGW_API_PREFIX2, HGW_ACP_PATH2, HGW_ACP_AGENTS_PATH2, hgwAcpAgentPath2, HGW_META_KEY2, HGW_EXTENSION_VERSION2, HGW_AUTH_METHOD_INVITE2, HGW_ATTACHMENT_URI_SCHEME2, HGW_ARTIFACT_URI_SCHEME2, HGW_METHODS2, HGW_PERMISSION_KIND_SESSION2, HGW_PLAN_ID2, HGW_JSONRPC_ERRORS2, HGW_MAX_FRAME_BYTES2, IdentifierSchema2, HgwExtensionsSchema2, HgwClientCapabilitiesMetaSchema2, HgwInitializeMetaSchema2, HgwLoginMetaSchema2, HgwSessionNewMetaSchema2, HgwSessionListMetaSchema2, HgwSessionSearchMetaSchema2, HgwSessionSearchResponseSchema2, HgwSessionInfoMetaSchema2, HgwSessionResumeMetaSchema2, HGW_REPLAY_POSITION2, HgwReplayPositionSchema2, HGW_REPLAY_BEFORE2, HgwReplayBeforeSchema2, HgwHistoryCursorSchema2, HgwHistoryPageResponseMetaSchema2, HgwHistoryPageTagSchema2, HgwSessionResumeResponseMetaSchema2, HgwPromptMetaSchema2, HgwSessionUpdateRequestSchema2, HgwSessionPartRequestSchema2, HgwSteerRequestSchema2, HgwSteerResponseSchema2, HgwFocusRequestSchema2, HgwAgentsListResponseSchema2, HgwAgentUpdateRequestSchema2, HgwAgentUpdateResponseSchema2, HgwTurnMetaSchema2, HgwNoticeMetaSchema2, HgwMessageMetaSchema2, HgwCostSchema2, HgwChildSessionMetaSchema2, HgwStateMetaSchema2, HgwChunkMetaSchema2, HgwToolCallMetaSchema2, HgwPlanMetaSchema2, HgwUsageMetaSchema2, HgwAvailableCommandsMetaSchema2, HgwPermissionMetaSchema2, HgwQuestionOptionSchema2, HgwQuestionSchema2, HgwElicitationMetaSchema2, HgwArtifactDescriptorSchema2, formatArtifactUri2, parseArtifactUri2, HgwComposerPrefillNotificationSchema2, HgwErrorNotificationSchema2, HGW_REQUEST_TEXT_MAX2, HgwActivityNotificationSchema2, PushCategorySchema2, categoryOf2, PushLocaleSchema2, PRESENCE_IDLE_MS2, PRESENCE_HEARTBEAT_MS2, PRESENCE_GRACE_MS2, PRESENCE_CLOSED_GRACE_MS2, COALESCE_WINDOW_MS2, PUSH_TEXT_LIMITS2, PushMessageSchema2, PushCategoriesSchema2, PushSubscriptionJsonSchema2, PushInfoSchema2, PushRegistrationSchema2, PushUnregistrationSchema2, CallToolResultSchema2, ReadResourceResultSchema2, McpUiCspSchema2, isMcpAppCspDomain2, McpUiPermissionsSchema2, McpAppFilesSchema2, McpAppViewSchema2, viewerFileResult2, McpAppToolCallRequestSchema2, McpAppResourceReadRequestSchema2, MCP_APP_SANDBOX_PATH2, isMcpAppPolicyOrigin2, appliedMcpAppCsp2, mcpAppSandboxPolicy2 };

package/dist/protocol/mcp-apps.d.ts

@@ -199,13 +199,57 @@ export declare const McpAppResourceReadRequestSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type McpAppResourceReadRequest = z.infer<typeof McpAppResourceReadRequestSchema>;
 /**
- * The MCP App sandbox gateway: a static page, served beside the workspace on
- * every listener, that holds only the relay creating the App's own frame. It
- * is a real document rather than `srcdoc` so it carries this policy instead of
- * inheriting the embedding page's, which on the guest surface forbids inline
- * scripts. The App frame inherits it too, so it is the widest any view may
- * reach — every source `buildMcpAppCsp` can grant — and the view's own policy,
- * injected into its document, narrows it to what it declared.
+ * The MCP App sandbox page: a static page that holds only the relay creating
+ * the App's own frame. A host serves it from a sandbox origin of its own,
+ * apart from its pages' origins as the spec requires, and frames it with
+ * `allow-scripts allow-same-origin`, so the view runs on that origin with
+ * storage of its own. The page is a real document rather than `srcdoc` so it
+ * carries the view's own policy, `mcpAppSandboxPolicy`, as its header; the
+ * view's `srcdoc` frame inherits it.
  */
 export declare const MCP_APP_SANDBOX_PATH = "/mcp-app-sandbox.html";
-export declare const MCP_APP_SANDBOX_CSP: string;
+/** What one view's sandbox policy is built from. */
+export type McpAppSandboxPolicyInput = {
+    /**
+     * The exact origins of the host's own pages, the only ones that may frame
+     * the sandbox page.
+     */
+    frameAncestors: readonly string[];
+    /** The exact origin the sandbox page is served from. */
+    sandboxOrigin: string;
+    /** The view's declared `_meta.ui.csp`. */
+    csp?: McpUiCsp | undefined;
+    /** The call's absolute file addresses; no pass is written. */
+    fileLocations?: readonly string[] | undefined;
+};
+/**
+ * Whether a sandbox policy can name `value` as a framing page or as the
+ * sandbox: an `http(s)` origin exactly as `URL` writes it, whose host is a name
+ * or an IPv4 address. `mcpAppSandboxPolicy` throws for any other, so a host
+ * checks its settings with this once, before it serves a view.
+ */
+export declare function isMcpAppPolicyOrigin(value: string): boolean;
+/**
+ * The domains a view's sandbox policy applies, per `_meta.ui.csp` list, as a
+ * host reports them in `hostCapabilities.sandbox.csp`: those
+ * `isMcpAppCspDomain` admits, lowercased and once each, without any that names
+ * the host and port of a framing page or of the sandbox itself, whatever its
+ * scheme. `undefined` when it applies none. Throws as `mcpAppSandboxPolicy`
+ * does for the origins.
+ */
+export declare function appliedMcpAppCsp({ csp, ...origins }: Omit<McpAppSandboxPolicyInput, "fileLocations">): McpUiCsp | undefined;
+/**
+ * One view's sandbox policy, sent as the sandbox page's header: the MCP Apps
+ * default policy (spec 2026-01-26), widened only by the domains
+ * `appliedMcpAppCsp` keeps and by the call's own file locations, each by its
+ * exact path, to read and to play; never allowing plugins or form posts, and
+ * framed only by `frameAncestors`. Views may compile WebAssembly, as a
+ * document renderer's decoders do.
+ *
+ * Anyone can ask for a sandbox page with any query, so every value is checked
+ * before it is written: an ancestor or a sandbox origin that is no exact
+ * origin (`isMcpAppPolicyOrigin`) throws, as does a sandbox origin among the
+ * ancestors, and a domain or a file location its rule refuses is dropped. A
+ * file location is kept only on a framing page's origin.
+ */
+export declare function mcpAppSandboxPolicy({ fileLocations, ...view }: McpAppSandboxPolicyInput): string;

package/dist/protocol/sdk.js

@@ -144,7 +144,9 @@ import {
   McpAppToolCallRequestSchema2,
   McpAppResourceReadRequestSchema2,
   MCP_APP_SANDBOX_PATH2,
-  MCP_APP_SANDBOX_CSP2
+  isMcpAppPolicyOrigin2,
+  appliedMcpAppCsp2,
+  mcpAppSandboxPolicy2
 } from "../chunks/index.js";
 // protocol/audio.ts
 var RECORDING_MIME_TYPES = [
@@ -278,7 +280,6 @@ export {
   MAX_SPEECH_BYTES,
   MAX_SPEECH_TEXT_BYTES,
   MAX_TRANSCRIPT_BYTES,
-  MCP_APP_SANDBOX_CSP2 as MCP_APP_SANDBOX_CSP,
   MCP_APP_SANDBOX_PATH2 as MCP_APP_SANDBOX_PATH,
   McpAppFilesSchema2 as McpAppFilesSchema,
   McpAppResourceReadRequestSchema2 as McpAppResourceReadRequestSchema,
@@ -342,10 +343,13 @@ export {
   TurnSteerRequestSchema2 as TurnSteerRequestSchema,
   TurnSteerResponseSchema2 as TurnSteerResponseSchema,
   TurnStopResponseSchema2 as TurnStopResponseSchema,
+  appliedMcpAppCsp2 as appliedMcpAppCsp,
   categoryOf2 as categoryOf,
   formatArtifactUri2 as formatArtifactUri,
   hgwAcpAgentPath2 as hgwAcpAgentPath,
   isMcpAppCspDomain2 as isMcpAppCspDomain,
+  isMcpAppPolicyOrigin2 as isMcpAppPolicyOrigin,
+  mcpAppSandboxPolicy2 as mcpAppSandboxPolicy,
   newestSessionFirst2 as newestSessionFirst,
   parseArtifactUri2 as parseArtifactUri,
   parseRecordingMime,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-gw/sdk",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "A gateway that puts Hermes, OpenClaw, and OpenCode behind one ACP WebSocket, and the browser client and protocol SDK for it.",
   "license": "Apache-2.0",
   "type": "module",