@kaoruisaac/pedelec 0.1.15 → 0.1.16

package/README.md

@@ -143,6 +143,8 @@ const assets = await session.listAssets();
 
 The first time an origin calls `createSession()` or `resumeSession()`, the extension asks the user to approve that origin in the popup. After approval, the same origin can create sessions directly.
 
+Sessions created through the SDK are bound to the creating origin. The same origin may resume them after reload, in another tab, or from another SDK instance; a different scheme, host, subdomain, or port cannot use the ID. A `sessionId` is an identifier, not a cross-origin bearer credential, and applications cannot supply or override its owner origin.
+
 You can query the current origin's approval status first to decide whether to show UI such as "Connect Pedelec":
 
 ```ts
@@ -151,7 +153,11 @@ const status = await pedelec.getApprovalStatus();
 console.log(status.installed, status.approved, status.origin);
 ```
 
-For a complete Extension, approval, and Desktop readiness probe, use `checkAvailability()`. It never creates/resumes a session or opens approval. When approved it validates Desktop by calling `getSettings()`, which may invoke the existing Native Host auto-launch fallback.
+`getApprovalStatus()` includes `appConnected`, a non-sensitive Core `ping` result. It does not require approval or open the approval popup, but it may use the Native Host's existing Desktop auto-launch fallback. `appConnected` does not mean the origin is approved or a provider is ready.
+
+`getSettings()` and `listProviders()` require origin approval and may open the approval popup. Settings expose only defaults (never provider credentials); providers expose only `name`, `code`, `available`, and `error`. Use `getApprovalStatus().appConnected` rather than `listProviders()` as a connection probe.
+
+For a complete Extension, approval, and Desktop readiness probe, use `checkAvailability()`. It never creates/resumes a session or opens approval. Its status ping may attempt Desktop launch even for an unapproved origin.
 
 ```ts
 const availability = await pedelec.checkAvailability();

package/dist/index.d.ts

@@ -97,7 +97,6 @@ export type CreateSessionInput<TTools extends readonly ToolDefinition[] = readon
 export type ProviderInfo = {
     name: string;
     code: ProviderCode;
-    path: string | null;
     available: boolean;
     error: string | null;
 };
@@ -109,6 +108,7 @@ export type ApprovalStatus = {
     installed: boolean;
     approved: boolean;
     origin: string | null;
+    appConnected: boolean;
 };
 export type PedelecAvailability = {
     available: boolean;

package/dist/index.js

@@ -147,15 +147,10 @@ export class Pedelec {
         return this.registerSession(result.sessionId, resolvedInput.provider, resolvedInput.model, resolvedInput.inlineToolHandlers);
     }
     async listProviders() {
-        const result = await this.request("list_providers");
-        if (!Array.isArray(result)) {
-            throw makeError("SDK_PROTOCOL_ERROR", "list_providers response was not an array");
-        }
-        return result;
+        return normalizeProviderInfoList(await this.request("list_providers"));
     }
     async getSettings() {
-        const result = await this.request("get_settings");
-        return result;
+        return normalizePedelecSettings(await this.request("get_settings"));
     }
     async getApprovalStatus() {
         if (this.disconnectedError) {
@@ -163,13 +158,11 @@ export class Pedelec {
                 installed: false,
                 approved: false,
                 origin: getCurrentOrigin(this.pageWindow),
+                appConnected: false,
             };
         }
         try {
             const result = await this.request("get_approval_status");
-            if (!isApprovalStatus(result)) {
-                throw makeError("SDK_PROTOCOL_ERROR", "get_approval_status response had invalid shape");
-            }
             return result;
         }
         catch (err) {
@@ -179,6 +172,7 @@ export class Pedelec {
                     installed: false,
                     approved: false,
                     origin: getCurrentOrigin(this.pageWindow),
+                    appConnected: false,
                 };
             }
             throw error;
@@ -287,7 +281,7 @@ export class Pedelec {
                 available: false,
                 extension: { available: true },
                 approval: { approved: false, origin: approval.origin },
-                desktop: { available: false, launchAttempted: false },
+                desktop: { available: approval.appConnected, launchAttempted: true },
             };
         }
         try {
@@ -894,13 +888,38 @@ function isSessionEvent(message) {
         message.type === "error" ||
         message.type === "ended");
 }
-function isApprovalStatus(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const status = value;
-    return (typeof status.installed === "boolean" &&
-        typeof status.approved === "boolean" &&
-        (status.origin === null || typeof status.origin === "string"));
+function isProviderCode(value) {
+    return value === "codex" || value === "antigravity" || value === "opencode" ||
+        value === "cursor" || value === "claude" || value === "ollama";
+}
+function isPlainObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function normalizePedelecSettings(value) {
+    if (!isPlainObject(value) || (value.defaultProvider !== null && !isProviderCode(value.defaultProvider)) ||
+        !isPlainObject(value.defaultModels)) {
+        throw makeError("SDK_PROTOCOL_ERROR", "get_settings response had invalid shape");
+    }
+    const defaultModels = {};
+    for (const [code, model] of Object.entries(value.defaultModels)) {
+        if (!isProviderCode(code) || typeof model !== "string") {
+            throw makeError("SDK_PROTOCOL_ERROR", "get_settings response had invalid shape");
+        }
+        defaultModels[code] = model;
+    }
+    return { defaultProvider: value.defaultProvider, defaultModels };
+}
+function normalizeProviderInfoList(value) {
+    if (!Array.isArray(value))
+        throw makeError("SDK_PROTOCOL_ERROR", "list_providers response was not an array");
+    return value.map((item) => {
+        if (!isPlainObject(item) || typeof item.name !== "string" || item.name.length === 0 ||
+            !isProviderCode(item.code) || typeof item.available !== "boolean" ||
+            (item.error !== null && typeof item.error !== "string")) {
+            throw makeError("SDK_PROTOCOL_ERROR", "list_providers response had invalid provider data");
+        }
+        return { name: item.name, code: item.code, available: item.available, error: item.error };
+    });
 }
 function makeError(code, message, details) {
     return details === undefined ? { code, message } : { code, message, details };

package/dist/index.type-test.js

@@ -103,11 +103,24 @@ async function availabilityHasPublicType() {
     void availability;
     void promise;
 }
+function publicSecurityTypesAreRestricted() {
+    const status = {
+        installed: true,
+        approved: true,
+        origin: "https://app.example.test",
+        appConnected: true,
+    };
+    const provider = {};
+    // @ts-expect-error SDK provider metadata must not expose executable paths
+    provider.path;
+    return status;
+}
 void typedOnToolNameFromCreateSession;
 void resumedSessionFallsBackToString;
 void noSkillsFallsBackToString;
 void listAssetsHasPublicTypes;
 void availabilityHasPublicType;
+void publicSecurityTypesAreRestricted;
 const baseContext = {
     sessionId: "thread_1",
     provider: "codex",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaoruisaac/pedelec",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",