@lowdefy/server-dev 0.0.0-experimental-20260807075508 → 0.0.0-experimental-20260814133003

package/client/Page.jsx

@@ -20,7 +20,7 @@ import Client from '@lowdefy/client';
 
 import BuildErrorPage from '../lib/client/BuildErrorPage.jsx';
 import InstallingPluginsPage from '../lib/client/InstallingPluginsPage.jsx';
-import RedirectingPage from '../lib/client/RedirectingPage.jsx';
+import RestartingPage from '../lib/client/RestartingPage.jsx';
 import usePageConfig from '../lib/client/utils/usePageConfig.js';
 
 const Page = ({
@@ -47,22 +47,10 @@ const Page = ({
     }
   }, [pageConfig?._warnings, lowdefy]);
 
-  // Full load to the sign-in page so it can return here after sign-in — an
-  // effect, not a fetcher side effect, so the redirect re-fires if the same
-  // cached result renders again.
-  useEffect(() => {
-    if (pageConfig?.authRedirect) {
-      window.location.assign(pageConfig.authRedirect);
-    }
-  }, [pageConfig?.authRedirect]);
-
   if (!pageConfig) {
     router.replace({ pathname: '/404' });
     return '';
   }
-  if (pageConfig.authRedirect) {
-    return <RedirectingPage redirect={pageConfig.authRedirect} />;
-  }
   if (pageConfig.buildError) {
     return (
       <BuildErrorPage
@@ -75,6 +63,9 @@ const Page = ({
   if (pageConfig.installing) {
     return <InstallingPluginsPage packages={pageConfig.packages} />;
   }
+  if (resetContext.restarting) {
+    return <RestartingPage />;
+  }
 
   // Merge dynamic JS entries fetched after JIT build with the static jsMap
   const mergedJsMap = pageConfig._jsEntries ? { ...jsMap, ...pageConfig._jsEntries } : jsMap;

package/client/Reload.jsx

@@ -25,13 +25,6 @@ import waitForRestartedServer from '../lib/client/utils/waitForRestartedServer.j
 const Reload = ({ children, basePath, lowdefy }) => {
   const [reset, setReset] = useState(false);
   const [restarting, setRestarting] = useState(false);
-  // reset is a one-shot boolean the engine lowers only after a page mounts
-  // (getContext.js) — while a page is suspended it stays true and setReset(true)
-  // bails out of re-rendering. The tick always changes, so every reload event
-  // re-invokes Routing's render prop, which re-reads reloadVersion and mints a
-  // fresh Suspense/SWR key — a suspended tab recovers instead of stranding on
-  // the building screen.
-  const [, setReloadTick] = useState(0);
   const mutateCache = useMutateCache(basePath);
   useEffect(() => {
     const sse = new EventSource(`${basePath}/api/reload`);
@@ -45,7 +38,6 @@ const Reload = ({ children, basePath, lowdefy }) => {
           lowdefy._internal.initialised = false;
         }
         setReset(true);
-        setReloadTick((tick) => tick + 1);
         console.log('Reloaded config.');
       }, 600);
     });

package/client/Routing.jsx

@@ -20,7 +20,6 @@ import Head from '@lowdefy/client/adapters/Head.js';
 import createLinkComponent from '@lowdefy/client/adapters/Link.js';
 
 import BuildingPage from '../lib/client/BuildingPage.jsx';
-import RestartingPage from '../lib/client/RestartingPage.jsx';
 import FeedbackMount from './feedback/FeedbackMount.jsx';
 import Inspector from './Inspector.jsx';
 import OpenInEditorListener from './openInEditor/OpenInEditorListener.jsx';
@@ -76,36 +75,29 @@ function Routing({ auth, lowdefy, router }) {
       <FeedbackMount basePath={router.basePath} lowdefy={lowdefy} pageId={pageId} />
       <OpenInEditorListener basePath={router.basePath} pageId={pageId} />
       <Reload basePath={router.basePath} lowdefy={lowdefy}>
-        {(resetContext) =>
-          // Rendered here, not in Page — Page sits below the Suspense boundary
-          // and cannot render anything while its config fetch is suspended, so
-          // a restarting server would present as "Building page..." forever.
-          resetContext.restarting ? (
-            <RestartingPage />
-          ) : (
-            <Suspense key={`${pageId}_${getReloadVersion()}`} fallback={<BuildingPage />}>
-              <Page
-                auth={auth}
-                Components={{ Head, Link }}
-                config={{
-                  rootConfig,
-                }}
-                jsMap={staticJsMap}
-                lowdefy={lowdefy}
-                pageId={pageId}
-                resetContext={resetContext}
-                router={router}
-                types={{
-                  actions,
-                  blockMetas,
-                  blocks,
-                  icons,
-                  operators,
-                }}
-              />
-            </Suspense>
-          )
-        }
+        {(resetContext) => (
+          <Suspense key={`${pageId}_${getReloadVersion()}`} fallback={<BuildingPage />}>
+            <Page
+              auth={auth}
+              Components={{ Head, Link }}
+              config={{
+                rootConfig,
+              }}
+              jsMap={staticJsMap}
+              lowdefy={lowdefy}
+              pageId={pageId}
+              resetContext={resetContext}
+              router={router}
+              types={{
+                actions,
+                blockMetas,
+                blocks,
+                icons,
+                operators,
+              }}
+            />
+          </Suspense>
+        )}
       </Reload>
     </>
   );

package/lib/client/auth/Auth.jsx

@@ -14,6 +14,8 @@
   limitations under the License.
 */
 
+/* eslint-disable react/jsx-props-no-spreading */
+
 import React from 'react';
 import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
@@ -23,15 +25,15 @@ import { serializer } from '@lowdefy/helpers';
 // Client code imports the build JSON directly — Vite handles JSON imports;
 // the lib/build/*.js wrappers are server-only (they read from disk).
 // Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for provider lookups in createAuthMethods).
+// must be a real array for single-provider inference in createAuthMethods).
 import rawAuthConfig from '../../../build/auth.json';
 
 const authConfig = serializer.deserialize(rawAuthConfig);
 
-function Auth({ children, user }) {
+function Auth({ children, session }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverUser={user} authConfig={authConfig}>
+      <AuthConfigured serverSession={session} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );

package/lib/client/auth/AuthConfigured.jsx

@@ -14,194 +14,60 @@
   limitations under the License.
 */
 
+/* eslint-disable react/jsx-props-no-spreading */
+
 import React, { useEffect, useRef } from 'react';
-import { createAuthClient } from 'better-auth/react';
 import {
-  adminClient,
-  genericOAuthClient,
-  magicLinkClient,
-  organizationClient,
-  phoneNumberClient,
-  twoFactorClient,
-} from 'better-auth/client/plugins';
-import { passkeyClient } from '@better-auth/passkey/client';
+  authConfigManager,
+  getSession,
+  SessionProvider,
+  signIn,
+  signOut,
+  useSession,
+} from '@hono/auth-js/react';
 
-import { normalizeCaller, serializer } from '@lowdefy/helpers';
+import { serializer } from '@lowdefy/helpers';
 
 import rawLowdefyConfig from '../../../build/config.json';
 
 const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
 
-const authClient = createAuthClient({
-  baseURL: `${window.location.origin}${lowdefyConfig.basePath ?? ''}/api/auth`,
-  plugins: [
-    adminClient(),
-    genericOAuthClient(),
-    magicLinkClient(),
-    organizationClient(),
-    passkeyClient(),
-    phoneNumberClient(),
-    twoFactorClient(),
-  ],
-});
-
-// UpdateSession owns session freshness - suppress BetterAuth's own
-// signal-driven refetch on the calls that would otherwise fire one, so
-// nothing competes with (and aborts) the refetch UpdateSession awaits.
-// Only calls that mutate an existing session are suppressed - calls that
-// can establish one (the sign-ins, and the two-factor, phone-number and
-// passkey verifies) keep their signal: its refetch is what makes the store
-// notice a login when no navigation follows.
-// disableSignal silences all atomListeners for the call, including the
-// organization plugin's org atoms - none are exposed to app config, so a
-// future design exposing one must refresh it through its own action.
-const sessionScoped = (params) => ({
-  ...params,
-  fetchOptions: { ...params?.fetchOptions, disableSignal: true },
-});
+// @hono/auth-js/react configures its fetch paths through a module-level
+// manager instead of SessionProvider props.
+if (lowdefyConfig.basePath) {
+  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
+}
 
-// The server resolves the caller per request and embeds it in the page
-// config, so the first render never flashes unauthenticated. The BetterAuth
-// client store takes over once its session fetch settles.
-//
-// Roles and merged attributes resolve server-side from the active member row
-// - the base session carries neither. The last server-resolved caller is
-// kept in a ref: while the session user is unchanged it stays authoritative
-// for the fields the session does not carry, and UpdateSession refreshes the
-// ref from /api/user after a change (e.g. SetActiveOrganization).
-//
-// Only the session half is passed through normalizeCaller. BetterAuth's store
-// returns camelCase keys whatever the columns are named, so untransformed it
-// would sit emailVerified beside the resolved caller's email_verified on one
-// object; anything arriving from the server is already snake_case.
-function Session({ children, reloadSuppressedRef, serverUser }) {
-  const { data: session, isPending } = authClient.useSession();
-  const resolvedUserRef = useRef(serverUser);
-  const wasAuthenticated = useRef(Boolean(serverUser));
+function Session({ children }) {
+  const wasAuthenticated = useRef(false);
+  const { data: session, status } = useSession();
+  wasAuthenticated.current = wasAuthenticated.current || status === 'authenticated';
 
   useEffect(() => {
-    if (session) {
-      wasAuthenticated.current = true;
-    }
-    // Reload after sign-out (or session revocation) so the server can apply
-    // the page auth fork - a protected page redirects to the login page.
-    // A logout with a callbackUrl suppresses the reload - its own navigation
-    // would otherwise race this one.
-    if (wasAuthenticated.current && !isPending && !session && !reloadSuppressedRef.current) {
+    if (wasAuthenticated.current && status === 'unauthenticated') {
       window.location.reload();
     }
-  }, [session, isPending]);
+  }, [status]);
 
-  if (isPending) {
-    return children(resolvedUserRef.current, resolvedUserRef);
-  }
-  if (!session?.user) {
-    return children(null, resolvedUserRef);
-  }
-  const resolved = resolvedUserRef.current;
-  if (!resolved) {
-    return children({ roles: [], ...normalizeCaller(session.user) }, resolvedUserRef);
-  }
-  if (resolved.id !== session.user.id) {
-    // The ref has not caught up with a changed session user - a sign-in as a
-    // different person lands between the session refetch and the /api/user
-    // result. Render the last resolved caller whole rather than mixing the new
-    // session user with the previous person's resolved fields, or falling back
-    // to a caller with no roles - blocks re-evaluate operators on render, so a
-    // role-guarded page would act on an empty role list. UpdateSession closes
-    // the window when it lands the new caller; a flow that changes the session
-    // user without chaining it leaves the previous caller rendered until the
-    // next page load.
-    return children(resolved, resolvedUserRef);
+  // If session is passed to SessionProvider from the server-rendered config
+  // we won't have a loading state here, but unauthenticated first loads do.
+  if (status === 'loading') {
+    return '';
   }
-  // _user is one object with one meaning on both sides: the resolved caller is
-  // spread whole, so every field resolveAuthentication emits is readable in app
-  // config without this file naming it. session.user is the floor - the client
-  // store may hold a fresher one than the ref, and the resolved object wins
-  // wherever both carry a key.
-  const user = { ...normalizeCaller(session.user), ...resolved };
-  return children(user, resolvedUserRef);
+  return children(session);
 }
 
-function AuthConfigured({ authConfig, children, serverUser }) {
-  const reloadSuppressedRef = useRef(false);
-  const auth = {
-    authConfig,
-    getSession: ({ disableCookieCache } = {}) =>
-      authClient.getSession(disableCookieCache ? { query: { disableCookieCache: true } } : {}),
-    // Refetches the session through the session atom - the store's only
-    // writer - and resolves only after the store is written. fetchSession
-    // returns undefined and never rejects (failures are written into the
-    // atom), so the atom's own { data, error } is read back and returned,
-    // keeping unwrap working and surfacing a failed refresh to the action.
-    refreshSession: async ({ disableCookieCache } = {}) => {
-      const sessionAtom = authClient.$store.atoms.session;
-      await sessionAtom
-        .get()
-        .refetch(disableCookieCache ? { query: { disableCookieCache: true } } : undefined);
-      const { data, error } = sessionAtom.get();
-      return { data, error };
-    },
-    // The server-resolved caller - roles from the active member row and the
-    // merged attributes bag - for re-syncing after session changes.
-    getResolvedUser: async () => {
-      const response = await fetch(`${lowdefyConfig.basePath ?? ''}/api/user`, {
-        credentials: 'same-origin',
-      });
-      if (!response.ok) {
-        // /api/user itself always answers 200 { user } - user: null when no
-        // caller is admitted, which updateSession branches on. A non-OK
-        // response is a transport failure (gateway error page, 5xx) with no
-        // parsable body.
-        throw new Error(`Failed to fetch the resolved user (HTTP ${response.status}).`);
-      }
-      return response.json();
-    },
-    suppressSignOutReload: () => {
-      reloadSuppressedRef.current = true;
-    },
-    acceptInvitation: (params) => authClient.organization.acceptInvitation(sessionScoped(params)),
-    // addPasskey runs the WebAuthn browser ceremony itself - options fetch,
-    // authenticator prompt, verification.
-    addPasskey: (params) => authClient.passkey.addPasskey(params),
-    changePassword: (params) => authClient.changePassword(sessionScoped(params)),
-    deletePasskey: (params) => authClient.passkey.deletePasskey(params),
-    leaveOrganization: (params) => authClient.organization.leave(sessionScoped(params)),
-    phoneNumberRequestPasswordReset: (params) =>
-      authClient.phoneNumber.requestPasswordReset(params),
-    phoneNumberResetPassword: (params) => authClient.phoneNumber.resetPassword(params),
-    phoneNumberSendOtp: (params) => authClient.phoneNumber.sendOtp(params),
-    phoneNumberVerify: (params) => authClient.phoneNumber.verify(params),
-    requestPasswordReset: (params) => authClient.requestPasswordReset(params),
-    resetPassword: (params) => authClient.resetPassword(params),
-    revokeOtherSessions: () => authClient.revokeOtherSessions(sessionScoped()),
-    sendVerificationEmail: (params) => authClient.sendVerificationEmail(params),
-    setActiveOrganization: (params) => authClient.organization.setActive(sessionScoped(params)),
-    signInEmail: (params) => authClient.signIn.email(params),
-    signInMagicLink: (params) => authClient.signIn.magicLink(params),
-    signInOauth2: (params) => authClient.signIn.oauth2(params),
-    signInPasskey: (params) => authClient.signIn.passkey(params),
-    signInPhoneNumber: (params) => authClient.signIn.phoneNumber(params),
-    signInSocial: (params) => authClient.signIn.social(params),
-    signOut: () => authClient.signOut(),
-    signUpEmail: (params) => authClient.signUp.email(params),
-    twoFactorDisable: (params) => authClient.twoFactor.disable(sessionScoped(params)),
-    twoFactorEnable: (params) => authClient.twoFactor.enable(sessionScoped(params)),
-    twoFactorGenerateBackupCodes: (params) =>
-      authClient.twoFactor.generateBackupCodes(sessionScoped(params)),
-    twoFactorVerifyBackupCode: (params) => authClient.twoFactor.verifyBackupCode(params),
-    twoFactorVerifyTotp: (params) => authClient.twoFactor.verifyTotp(params),
-  };
+function AuthConfigured({ authConfig, children, serverSession }) {
+  const auth = { authConfig, getSession, signIn, signOut };
   return (
-    <Session reloadSuppressedRef={reloadSuppressedRef} serverUser={serverUser}>
-      {(user, resolvedUserRef) => {
-        auth.user = user;
-        auth.updateResolvedUser = (resolved) => {
-          resolvedUserRef.current = resolved;
-        };
-        return children(auth);
-      }}
-    </Session>
+    <SessionProvider session={serverSession}>
+      <Session>
+        {(session) => {
+          auth.session = session;
+          return children(auth);
+        }}
+      </Session>
+    </SessionProvider>
   );
 }
 

package/lib/client/auth/AuthNotConfigured.js

@@ -13,6 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+/* eslint-disable react/jsx-props-no-spreading */
 
 function authNotConfigured() {
   throw new Error('Auth not configured.');
@@ -21,30 +22,9 @@ function authNotConfigured() {
 function AuthNotConfigured({ authConfig, children }) {
   const auth = {
     authConfig,
-    user: null,
-    acceptInvitation: authNotConfigured,
-    addPasskey: authNotConfigured,
-    changePassword: authNotConfigured,
-    deletePasskey: authNotConfigured,
-    getResolvedUser: authNotConfigured,
     getSession: authNotConfigured,
-    leaveOrganization: authNotConfigured,
-    requestPasswordReset: authNotConfigured,
-    resetPassword: authNotConfigured,
-    revokeOtherSessions: authNotConfigured,
-    sendVerificationEmail: authNotConfigured,
-    setActiveOrganization: authNotConfigured,
-    signInEmail: authNotConfigured,
-    signInMagicLink: authNotConfigured,
-    signInOauth2: authNotConfigured,
-    signInSocial: authNotConfigured,
+    signIn: authNotConfigured,
     signOut: authNotConfigured,
-    signUpEmail: authNotConfigured,
-    twoFactorDisable: authNotConfigured,
-    twoFactorEnable: authNotConfigured,
-    twoFactorGenerateBackupCodes: authNotConfigured,
-    twoFactorVerifyBackupCode: authNotConfigured,
-    twoFactorVerifyTotp: authNotConfigured,
   };
 
   return children(auth);

package/lib/client/utils/usePageConfig.js

@@ -29,9 +29,7 @@ function parseJsModule(text) {
 
 async function fetchJsEntries(basePath) {
   try {
-    const res = await fetch(`${basePath}/api/js/client`, {
-      signal: AbortSignal.timeout(10_000),
-    });
+    const res = await fetch(`${basePath}/api/js/client`);
     if (!res.ok) return {};
     return parseJsModule(await res.text());
   } catch {
@@ -41,9 +39,7 @@ async function fetchJsEntries(basePath) {
 
 async function fetchDynamicIcons(basePath) {
   try {
-    const res = await fetch(`${basePath}/api/icons/dynamic`, {
-      signal: AbortSignal.timeout(10_000),
-    });
+    const res = await fetch(`${basePath}/api/icons/dynamic`);
     if (!res.ok) return {};
     return parseJsModule(await res.text());
   } catch {
@@ -52,41 +48,12 @@ async function fetchDynamicIcons(basePath) {
 }
 
 async function fetchPageConfig(url) {
-  const basePath = url.replace(/\/api\/page\/.*$/, '');
-  // A stalled request (server restart mid-request, exhausted sockets) must
-  // become a visible error, never an eternal Suspense fallback — the reload
-  // recovery path cannot fire while the page tree is suspended.
-  let res;
-  try {
-    res = await fetch(url, {
-      headers: { 'Content-Type': 'application/json' },
-      signal: AbortSignal.timeout(30_000),
-    });
-  } catch (error) {
-    if (error.name === 'TimeoutError' || error.name === 'AbortError') {
-      throw new Error(
-        `Page config request "${url}" timed out - the dev server may be restarting. Reload the page.`
-      );
-    }
-    throw error;
-  }
+  const res = await fetch(url, {
+    headers: { 'Content-Type': 'application/json' },
+  });
   if (res.status === 404) {
     return null;
   }
-  if (res.status === 401 || res.status === 403) {
-    // 401: logged-out navigation to a protected page. 403: authorised but second
-    // factor not yet enrolled. Page renders a redirect screen and full-loads to
-    // the destination so it can return here afterwards. Returning a settled value
-    // (never a parked promise) keeps the SWR key healthy: if the navigation is
-    // dropped, the tab still recovers on the next reload event or via the manual
-    // link on the redirect screen.
-    const { redirect } = await res.json();
-    const authRedirect = redirect ?? `${basePath}/404`;
-    console.warn(
-      `Lowdefy dev: "${url}" returned ${res.status} - redirecting to "${authRedirect}".`
-    );
-    return { authRedirect };
-  }
   const data = await res.json();
   if (data?.buildError) {
     return data;
@@ -100,6 +67,8 @@ async function fetchPageConfig(url) {
 
   // Fetch jsMap and dynamic icons after page build completes
   // (JIT build may have added new entries).
+  // Extract basePath from the URL to construct the endpoints.
+  const basePath = url.replace(/\/api\/page\/.*$/, '');
   const [jsEntries, dynamicIcons] = await Promise.all([
     fetchJsEntries(basePath),
     fetchDynamicIcons(basePath),

package/lib/docs/checkpointStore.js

@@ -16,7 +16,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import { isReserved, serializer, setKey, type } from '@lowdefy/helpers';
+import { serializer, type } from '@lowdefy/helpers';
 
 import { getConfigDirectory } from './checkpointPaths.js';
 
@@ -90,13 +90,7 @@ function readEntries({ dir, subdir }) {
     .filter((fileName) => fileName.endsWith('.json'))
     .forEach((fileName) => {
       const id = fileName.slice(0, -'.json'.length);
-      // A checkpoint directory is on-disk state a developer can edit by hand.
-      // A reserved file name can't round-trip through the entries map, so skip
-      // it rather than fail the whole checkpoint load.
-      if (isReserved(id)) {
-        return;
-      }
-      setKey(entries, id, readJsonFile(path.join(entriesDir, fileName), null));
+      entries[id] = readJsonFile(path.join(entriesDir, fileName), null);
     });
   return entries;
 }

package/lib/docs/createDocsMcpServer.js

@@ -53,8 +53,6 @@ Feedback loop: after EVERY config edit, call lowdefy_build_status — the dev se
 
 Live state: lowdefy_inspect_state reads the ACTUAL state, request results, and event log of a running page — when the developer has the page open in their browser it reads THEIR live tab (ask them to interact, then inspect), otherwise it runs the page headless. lowdefy_eval_operator evaluates any operator expression against that live state — use it to debug _state/_request bindings. lowdefy_run_request executes a request with a test payload to verify data shape (read-only unless the app opts into writes).
 
-Role-gated pages: the headless renderer signs in as a roleless user, so a page or request gated on a role renders empty or refused. Pass user to lowdefy_screenshot_page, lowdefy_inspect_state, lowdefy_eval_operator or lowdefy_load_state to act as a specific caller — e.g. user {"roles":["admin"]} — and vary it per call to compare what different roles see.
-
 Safety: lowdefy_checkpoint snapshots the config files before risky multi-file changes; lowdefy_revert_checkpoint restores them.
 
 Visual feedback: developers can press Cmd/Ctrl+/ in the running app to point at elements, draw, and copy annotated feedback to their clipboard, then paste it to you. Pasted annotation blocks start with "Feedback:" and carry the blockId, the resolved config file:line, drawn shapes, and usually an "Annotated screenshot:" file path — READ that image to see exactly what the developer drew. Treat them as precise UI feedback and use lowdefy_inspect_state for the page's live state.
@@ -70,17 +68,6 @@ function notFoundResult(message) {
   return { content: [{ type: 'text', text: message }], isError: true };
 }
 
-// Shared by every tool that renders a page headless, so one call can act as an
-// admin and the next as a plain member — each headless call gets its own browser
-// context, so they never share an identity.
-const userSchema = z
-  .object({})
-  .passthrough()
-  .optional()
-  .describe(
-    'Act as this caller instead of the default roleless headless user, e.g. {"roles":["user-admin"]} to render a role-gated page. Merged over the default, so include email/profile/attributes fields too if the page reads them — no auth engine runs for an injected caller, so nothing derives them. Headless only: it is never applied to a page the developer opens in their own browser, so combining it with source "tab" or load_state mode "registry-only" is an error rather than a silently dropped role.'
-  );
-
 function createDocsMcpServer({ origin, honoContext } = {}) {
   const server = new McpServer(
     { name: 'lowdefy-docs', version: '1.0.0' },
@@ -112,11 +99,10 @@ function createDocsMcpServer({ origin, honoContext } = {}) {
           .enum(['tab', 'headless'])
           .optional()
           .describe('Force a source. Default: live tab if connected, else headless.'),
-        user: userSchema,
       },
     },
-    async ({ pageId, source, user }) => {
-      const result = await inspectState({ origin, pageId, source, user });
+    async ({ pageId, source }) => {
+      const result = await inspectState({ origin, pageId, source });
       if (result.error) {
         return notFoundResult(result.error);
       }
@@ -135,11 +121,10 @@ function createDocsMcpServer({ origin, honoContext } = {}) {
           .any()
           .describe('The operator expression — any JSON value, e.g. {"_state": "key"}.'),
         source: z.enum(['tab', 'headless']).optional(),
-        user: userSchema,
       },
     },
-    async ({ pageId, expression, source, user }) => {
-      const result = await evalOperator({ origin, pageId, expression, source, user });
+    async ({ pageId, expression, source }) => {
+      const result = await evalOperator({ origin, pageId, expression, source });
       if (result.error) {
         return notFoundResult(result.error);
       }
@@ -202,11 +187,10 @@ function createDocsMcpServer({ origin, honoContext } = {}) {
       inputSchema: {
         name: z.string().describe('The checkpoint name.'),
         mode: z.enum(['headless', 'registry-only']).optional(),
-        user: userSchema,
       },
     },
-    async ({ name, mode, user }) => {
-      const result = await loadState({ origin, name, mode, user });
+    async ({ name, mode }) => {
+      const result = await loadState({ origin, name, mode });
       if (result.error) {
         return notFoundResult(result.error);
       }
@@ -335,26 +319,17 @@ function createDocsMcpServer({ origin, honoContext } = {}) {
           })
           .optional()
           .describe(
-            "Crop to a viewport-relative region — pass an annotation's geometry from feedback."
+            'Crop to a viewport-relative region — pass an annotation\'s geometry from feedback.'
           ),
         scrollX: z.number().optional().describe('Scroll offset the clip was recorded at.'),
         scrollY: z.number().optional().describe('Scroll offset the clip was recorded at.'),
-        user: userSchema,
       },
     },
-    async ({ pageId, fullPage, clip, scrollX, scrollY, user }) => {
+    async ({ pageId, fullPage, clip, scrollX, scrollY }) => {
       if (!origin) {
         return notFoundResult('Screenshot unavailable: server origin unknown for this transport.');
       }
-      const result = await screenshotPage({
-        origin,
-        pageId,
-        fullPage,
-        clip,
-        scrollX,
-        scrollY,
-        user,
-      });
+      const result = await screenshotPage({ origin, pageId, fullPage, clip, scrollX, scrollY });
       if (result.error) {
         return notFoundResult(result.error);
       }

package/lib/docs/createDocsMcpServer.test.mjs

@@ -77,24 +77,6 @@ test('MCP tools/list returns all lowdefy tools', async () => {
   await client.close();
 });
 
-test('MCP tools that render a page headless advertise an optional user parameter', async () => {
-  const client = await connectClient();
-  const { tools } = await client.listTools();
-
-  [
-    'lowdefy_screenshot_page',
-    'lowdefy_inspect_state',
-    'lowdefy_eval_operator',
-    'lowdefy_load_state',
-  ].forEach((name) => {
-    const tool = tools.find((candidate) => candidate.name === name);
-    expect(tool.inputSchema.properties.user).toBeDefined();
-    expect(tool.inputSchema.required ?? []).not.toContain('user');
-  });
-
-  await client.close();
-});
-
 test('MCP tools/call lowdefy_get_schema returns a block schema', async () => {
   const client = await connectClient();
   const result = await client.callTool({