@melaya/runner 1.1.16 → 1.1.17

package/dist/assistantHost.py

@@ -272,17 +272,25 @@ def _apply_browser_turn_grant(req) -> bool:
     present (injected by the runner's per-turn bridge registration). These are
     purged at turn end alongside the grant (see _purge_browser_turn_grant)."""
     grant = str((req or {}).get("browser_grant") or "") if isinstance(req, dict) else ""
+    # Front 3: EXTENSION-target proxy turn — no client-side grant; the host's
+    # browser tools call the server bridge (MEL_BROWSER_URL/TOKEN) which holds the
+    # grant and runs the action against the user's real tab.
+    ext_proxy = bool((req or {}).get("browser_ext_proxy")) if isinstance(req, dict) else False
     target_ref = str((req or {}).get("browser_target_ref") or "") if isinstance(req, dict) else ""
-    if grant and _browser_capable():
-        os.environ["MEL_BROWSER_TURN_GRANT"] = grant
+    bridge_url = str((req or {}).get("mel_browser_url") or "") if isinstance(req, dict) else ""
+    bridge_token = str((req or {}).get("mel_browser_token") or "") if isinstance(req, dict) else ""
+    if (grant or ext_proxy) and _browser_capable():
+        if grant:
+            os.environ["MEL_BROWSER_TURN_GRANT"] = grant
+        else:
+            os.environ.pop("MEL_BROWSER_TURN_GRANT", None)  # proxy: grant stays server-side
         if target_ref:
             os.environ["MEL_BROWSER_TURN_TARGET_REF"] = target_ref
         else:
             os.environ.pop("MEL_BROWSER_TURN_TARGET_REF", None)
-        # Per-turn bridge URL + token (assistant path only; pipeline path has
-        # these in the spawn env already). Apply only when present on the frame.
-        bridge_url = str((req or {}).get("mel_browser_url") or "") if isinstance(req, dict) else ""
-        bridge_token = str((req or {}).get("mel_browser_token") or "") if isinstance(req, dict) else ""
+        # Per-turn bridge URL + token (assistant path). For the runner target this
+        # is the runner's local bridge; for the extension proxy it is the server's
+        # /ext-bridge. Apply only when present on the frame.
         if bridge_url:
             os.environ["MEL_BROWSER_URL"] = bridge_url
         if bridge_token:

package/dist/connection.js

@@ -1569,6 +1569,16 @@ export async function connect(opts) {
                 return;
             }
         }
+        else if (payload.browserExtProxy && payload.browserExtProxy.url && payload.browserExtProxy.token) {
+            // Front 3: EXTENSION target. No grant verification / local bridge run — the
+            // host's browser_* tools POST to the server bridge (Bearer proxy token) and
+            // the SERVER runs the action against the extension using the grant it holds.
+            turnBridgeUrl = String(payload.browserExtProxy.url);
+            turnBridgeToken = String(payload.browserExtProxy.token);
+            browserTargetRef = String(payload.browserExtProxy.targetRef || "");
+            if (opts.verbose)
+                console.log(chalk.gray(`  [browser-bridge] ext-proxy turn (session=${payload.sessionId.slice(0, 10)} url=${turnBridgeUrl})`));
+        }
         // Capture for the stdout "done" handler closure below.
         const _turnBridgeRunId = turnBridgeRunId;
         const _turnId = payload.turnId;
@@ -1617,9 +1627,13 @@ export async function connect(opts) {
                 // JWS string so the Python browser toolkit can verify it again
                 // (defence-in-depth) and install MEL_BROWSER_TURN_GRANT in the
                 // host env for THIS turn only. Absent when no grant was provided.
-                ...(verifiedGrantToken ? { browser_grant: verifiedGrantToken, browser_target_ref: browserTargetRef ?? "" } : {}),
+                ...(verifiedGrantToken
+                    ? { browser_grant: verifiedGrantToken, browser_target_ref: browserTargetRef ?? "" }
+                    // Front 3 EXTENSION proxy: no grant, but the host must still apply
+                    // MEL_BROWSER_URL/TOKEN + register the browser toolkit for the turn.
+                    : (turnBridgeUrl ? { browser_ext_proxy: true, browser_target_ref: browserTargetRef ?? "" } : {})),
                 // Bridge URL + token for the host process env (applied per-turn by
-                // _apply_browser_turn_grant alongside the grant token).
+                // _apply_browser_turn_grant, alongside the grant token OR the proxy flag).
                 ...(turnBridgeUrl && turnBridgeToken
                     ? { mel_browser_url: turnBridgeUrl, mel_browser_token: turnBridgeToken }
                     : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.16",
+  "version": "1.1.17",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,