@mmerterden/multi-agent-toolkit-mcp 3.11.0 → 3.13.0

package/CHANGELOG.md

@@ -15,6 +15,160 @@ Releases before this file exists are recorded in the git tags and commit history
 
 ---
 
+## Unreleased
+
+---
+
+## 3.13.0 - 2026-09-20
+
+### Added
+
+- **Web family grows from 8 tools to 18.** `web_snapshot` returns an
+  accessibility tree whose `ref` handles `web_click`, `web_type`,
+  `web_get_text` and `web_press_key` accept in place of a CSS selector, so a
+  caller targets what it just read rather than guessing a selector. Refs belong
+  to one snapshot: navigating invalidates the set, and a ref from before is
+  refused by name rather than resolving to whatever now sits at that position.
+  `web_console` and `web_network` report what the page logged and requested
+  since the last navigation. `web_tabs` and `web_storage_state` expose the
+  context. `web_extract` returns readable article text, `web_map` lists
+  same-origin links, `web_crawl` walks them under a page and depth bound that
+  respects robots.txt. `web_select_option` and `web_press_key` close the
+  interaction gaps. `web_goto` gained `timeout_ms`, `viewport`, `locale` and
+  `user_agent`.
+- **Context index (3 tools).** A large result was already written to a file and
+  grepped with `agent_query_output`. It is now also chunked and indexed in
+  SQLite FTS5: `context_search` ranks passages with `bm25()` and answers in
+  roughly 50-100 tokens, `context_get` opens one passage by id, and the file
+  path still holds everything. Grep answers which lines contain a string;
+  ranking answers which part is about the subject. No new dependency -
+  `node:sqlite` ships with Node. `agent_query_output` is untouched; it is in the
+  cross-CLI contract.
+- **Research (2 tools).** `research_search` normalizes Brave or Perplexity
+  results to {title, url, snippet}; `research_ask` returns a cited answer
+  through Sonar. Keys are read from the environment at call time and go straight
+  into a header. A literal key is not an accepted argument, so it cannot land in
+  a transcript, and an unset key is reported by VARIABLE name, never by value.
+- **Media (1 tool).** `media_frames` pulls key frames out of a recording with
+  ffmpeg and drops near-duplicates, so the file `ios_record_video` and
+  `android_record_screen` produce becomes something a model can look at. Three
+  flat seconds yield one frame, not ninety.
+- **Capability gating.** `MCP_TOOLKIT_CAPS` narrows the served surface to named
+  families (`ios`, `android`, `web`, `design`, `code`, `pass`, `agent`,
+  `context`, `research`, `media`). Unset serves all 115. Filtering happens when
+  `tools/list` is answered, so a frontend repo is not handed 71 simulator tools.
+  An unknown name warns on stderr and is ignored rather than emptying or
+  widening the surface.
+
+### Security
+
+- **Extracted page text arrives fenced as data.** `web_extract` and `web_crawl`
+  are the only tools that put somebody else's writing into the caller's context.
+  A page reading "disregard every earlier instruction" used to arrive
+  indistinguishable from the server's own reply. It now arrives between explicit
+  markers naming its source. The fence does not make the text safe; it marks
+  where it begins and ends, which is the part a server can do. The fixture page
+  carries such a sentence and the gate asserts it lands inside.
+- **Outbound hosts are declared and checked.** "stdio-only" used to carry two
+  claims: nothing listens, and nothing calls out. The research family ended the
+  second one. `audit-allowlist.mjs` now asserts them separately - no inbound
+  HTTP transport, and no absolute URL in shipped source beyond the two research
+  endpoints and two reference-only documentation hosts.
+
+### Fixed
+
+- `web_goto` cleared console and network logs AFTER navigating, erasing exactly
+  the load-time messages `web_console` and `web_network` exist to report.
+- `extractReadable` used `require.resolve` in an ES module, so the readability
+  path threw and every extraction silently fell back to plain text.
+- `context_search` returned an id and a line range without saying which file
+  they belonged to, which is not enough to act on.
+
+### Testing
+
+- `scripts/smoke-web.sh` (27 assertions) drives all 18 web tools against a
+  static fixture over `file://`, one call at a time through
+  `scripts/mcp-drive.mjs` - concurrent calls interleave on a shared page and a
+  selector times out because a later navigation moved it. Playwright missing is
+  reported as NOT MEASURED, not passed.
+- `scripts/smoke-context.sh` (17 assertions) exercises context, research and
+  media through the MCP channel. Research runs with a planted fake key so the
+  failure path is the one under test, and the gate asserts no reply ever carried
+  the value.
+- `tools/context/__tests__/context.test.mjs` (13 tests) covers chunk overlap,
+  re-index skip, stale-passage removal, the path filter, FTS5 syntax in a user
+  query, and snippet windowing.
+- Gates 16 and 17 in `scripts/gates.sh` run both smokes and assert capability
+  gating narrows the surface at serve time.
+
+---
+
+## 3.12.0
+
+The CI matrix had been red for five runs. Every fix below is something the red
+leg was pointing at; three of them are defects a green local run could not see,
+because the thing that broke was the assumption that the host is a Mac.
+
+### Fixed
+
+- **`ios_app_store_audit` answered PASS on an archive it never read.** Plist
+  parsing went entirely through `plutil`, a macOS binary. Off macOS every read
+  returned `null`, all 18 rules saw an empty archive, found nothing, and the
+  verdict came back clean - on a fixture built to be non-compliant. There are
+  now three answers instead of two: `plutil` when it is there, a small XML plist
+  reader when it is not, and an explicit record of what could be read by
+  neither. An audit with a non-empty `unreadablePlists` reports
+  `measurable: false` and an `archive-readable` error, so it can no longer
+  return PASS. An unreadable archive and a compliant one now look different.
+- **Argument rules were unreachable on a host without Xcode.** `handleIOS`
+  refused everything with "Xcode not installed" before any handler ran, so the
+  checks that answer from the arguments alone - `extra_args` shell
+  metacharacters, `project` XOR `workspace`, `mode=diff` without
+  `baseline_graph`, `ios_leaks` with neither `pid` nor `bundle_id`,
+  `ios_testflight_validate` with neither `ipa_path` nor `list_providers` - never
+  ran there, and the tests that prove them could not run either. They are
+  evaluated before the capability gate now, so a malformed call is named as
+  malformed on any host. The `extra_args` character class is additionally
+  declared as `pattern` on the tool schema, where a host can enforce it too.
+- **`build-stack-plugins.mjs`-style "works on the author's machine" in the
+  test harness.** Gate 10 printed a bare exit code when a suite failed, so a red
+  CI leg said which file failed and nothing about why. It now prints the failing
+  assertions, matching both reporter shapes `node:test` uses (TAP when piped,
+  spec on a terminal).
+
+### Changed
+
+- **`validateArgs` enforces the whole schema, not three keywords of it.** It
+  checked `type`, `required` and `enum`; `pattern`, `minimum`, `maximum`,
+  `minLength`, `maxLength`, `minItems`, `maxItems` and `items` were declarable
+  and unenforced. A schema the server does not keep is worse than no schema,
+  because the host shows the caller a contract that is not real. Array `items`
+  are validated element by element, including nested `required` and property
+  types. No existing tool declared any of the newly-enforced keywords, so
+  nothing that used to be accepted is now refused.
+- **`design-check` tests are `node:test` cases.** 1002 lines and 143 assertions
+  ran inside a hand-rolled tally that ended in `process.exit(1)`: the runner saw
+  one opaque suite, coverage could not attribute a line, and a failure named the
+  file rather than the check. Same assertions, now 143 reported cases. The two
+  that need `ripgrep` register as skips with a reason instead of printing a
+  warning nobody reads.
+- **Dependency advisories closed by upgrade, not by allowlist.** `fast-uri`,
+  `hono` and `qs` reach this tree only through `@modelcontextprotocol/sdk`;
+  bounded `overrides` resolve all three. `scripts/audit-allowlist.mjs` now has
+  an empty accepted list, and its stdio-only assertion runs on every invocation
+  rather than only when an advisory happens to be open.
+- **Repo tooling only, nothing in the published package.** A `PostToolUse` hook
+  (`.claude/settings.json` -> `scripts/hooks/stdout-hygiene.sh`) greps the file
+  that was just edited for `console.log` under `index.js` and `tools/`, and
+  fails the edit back to the author when it finds one. stdout is this server's
+  JSON-RPC channel, so a stray log corrupts the protocol stream and the client
+  reports only a closed connection. Gate 5 in `scripts/gates.sh` remains the
+  authority - it decides whether the package ships; the hook only moves the
+  catch from ship-day to edit-second, and gate 5 now also asserts that the hook
+  exists, parses and is wired.
+
+---
+
 ## 3.11.0
 
 ### Added

package/README.md

@@ -7,7 +7,7 @@
 
 🇹🇷 Türkçe: [README.tr.md](./README.tr.md)
 
-**99 tools** for iOS Simulator, Android Emulator, and headless web control. MCP server that lets your AI coding assistant see, interact with, and audit your mobile apps - plus drive browsers, run an 18-rule App Store compliance audit, and orchestrate multi-step batch flows.
+**115 tools** for iOS Simulator, Android Emulator, and headless web control. MCP server that lets your AI coding assistant see, interact with, and audit your mobile apps - plus drive browsers, run an 18-rule App Store compliance audit, and orchestrate multi-step batch flows.
 
 Distributed on the **public npm registry** - `npx @mmerterden/multi-agent-toolkit-mcp` resolves with no auth, no token, no `~/.npmrc` setup.
 
@@ -15,16 +15,19 @@ Distributed on the **public npm registry** - `npx @mmerterden/multi-agent-toolki
 
 That distinction is worth keeping straight. This line once called five hosts "the multi-agent-pipeline's full-orchestration targets", which stopped being true in pipeline v10.7.0 when the Cursor / Antigravity / Codex / Copilot Chat adapters were deleted. Codex CLI returned as a first-class target in pipeline v13.0.0 on capability - it now has skills, parallel sub-agents, hooks and MCP - and it is on the verified list only because a gate exercises it, not because it is supported elsewhere. Claiming hosts nobody exercises is not free either: 2.20.0 and 2.21.0 shipped an illegal `outputSchema` on the first tool, so Claude Code rejected the whole `tools/list` and served zero of the 78 - in the primary host, for two releases, with every gate in this repo green.
 
-**10 categories:**
+**13 categories:**
 - **Device Control** (59 tools) - screenshot, tap, swipe, type, navigate, dark mode, locale, orientation, location, permissions, push notifications, real start/stop screen recording
 - **Memory** (2 tools) - `ios_leaks` runs /usr/bin/leaks against a simulator or host process, snapshot or diff against a saved memory graph; `android_meminfo` reads dumpsys meminfo, snapshot or diff. Both report `measurable:false` rather than a clean result when they could not look
 - **Crash Diagnostics** (2 tools) - `ios_list_crashes` reads the host's DiagnosticReports, `android_list_crashes` dumps the adb crash buffer, both tail-bounded
 - **Accessibility Audit** (3 tools) - `ios_accessibility_audit` / `android_accessibility_audit` read the live tree for missing labels, controls a screen reader cannot name, small tap targets, missing identifiers and a reading order that does not follow the visual layout. `ios_accessibility_audit_deep` runs Apple's own XCUIAccessibilityAudit through your XCUITest for the things a tree cannot show: contrast, Dynamic Type, clipped text. All three report `measurable:false` with a reason rather than a clean result when they could not look
 - **Store Compliance** (5 tools) - App Store / Play Store readiness; **18-rule deep `ios_app_store_audit`** cross-references Apple ITMS error codes + App Store Review Guidelines (privacy manifest, required-reason API, Info.plist, code signing, entitlements, embedded SDK, IPv6, debug-tool leak, ...)
-- **Web Automation** (8 tools) - Playwright-powered: goto, click (CSS selectors), type, eval JS, wait for selector, extract text, screenshot. Chromium / WebKit / Firefox engines. **Requires `playwright` peer dependency.**
+- **Web Automation** (18 tools) - Playwright-powered: goto, click, type, press a key, select an option, eval JS, wait for a selector, extract text, screenshot, plus an accessibility snapshot whose `ref` handles the other tools accept in place of a CSS selector, console and network logs captured since the last navigation, tab and storage state, readable article extraction, same-origin link mapping and a bounded crawl. Chromium / WebKit / Firefox engines. **Requires `playwright` peer dependency.**
 - **Design Audit** (6 tools) - mock-mode vs Figma conformance: scenario inventory, mock detection, mock launch, live UI geometry, pixel/geometry/typography compare, and the HTML/PDF report with its coverage gate
 - **Code Intelligence** (8 tools) - compiler-grade answers about Swift and Kotlin source, over the language server each platform already ships: definition, references, hover, document and workspace symbols, diagnostics without a full build, plus `code_index_status` for whether this machine can answer at all. Cross-file answers need a background index, so they report whether it had settled instead of returning an empty list that reads as "unused"
 - **Wallet Passes** (4 tools) - build, sign, validate and inspect Apple Wallet passes. All five styles, offline and deterministic, and a literal passphrase is deliberately not an accepted input: the caller names an environment variable or a keychain entry. The validator grades by consequence, because the interesting failures are the silent ones - one unknown `PKPassengerCapability` value raises nothing and quietly drops an enhanced pass back to the old layout
+- **Context Index** (3 tools) - a large result is not only written to a file, it is chunked and indexed in SQLite FTS5, so `context_search` ranks passages with bm25() and answers in roughly 50-100 tokens which part is about what. `context_get` opens one passage by id; the file path is still there for everything. Grep tells you which lines contain a string; ranking tells you which part is about the subject. No dependency: `node:sqlite` ships with Node
+- **Research** (2 tools) - provider-backed web search normalized to {title, url, snippet}, and a cited answer through Perplexity Sonar. Keys are read from the environment at call time and go straight into a header; a literal key is not an accepted argument, the same contract the Wallet signer uses
+- **Media** (1 tool) - `media_frames` pulls key frames out of a recording with ffmpeg, dropping near-duplicates, so the video `ios_record_video` just produced becomes something a model can actually look at
 - **Autonomous Agent DSL** (2 tools) - `agent_run_steps` executes a batch array of {tool, args, continue_on_error?, wait_ms?} steps in one MCP round trip. Ideal for scripted login flows, form fills, multi-step QA paths. `agent_query_output` searches the full output of an earlier call that was too large to return inline, so a follow-up question does not mean re-running an expensive tool.
 
 ## Quick Start

package/README.tr.md

@@ -7,7 +7,7 @@
 
 🇬🇧 English: [README.md](./README.md)
 
-iOS Simulator, Android Emulator ve headless web kontrolü için **99 araç**. AI kodlama asistanının mobil uygulamalarını görmesini, onlarla etkileşime girmesini ve denetlemesini sağlayan bir MCP sunucusu - ayrıca tarayıcıları sürer, 18-kurallık bir App Store uyumluluk denetimi çalıştırır ve çok-adımlı batch akışlarını orkestre eder.
+iOS Simulator, Android Emulator ve headless web kontrolü için **115 araç**. AI kodlama asistanının mobil uygulamalarını görmesini, onlarla etkileşime girmesini ve denetlemesini sağlayan bir MCP sunucusu - ayrıca tarayıcıları sürer, 18-kurallık bir App Store uyumluluk denetimi çalıştırır ve çok-adımlı batch akışlarını orkestre eder.
 
 **Public npm registry** üzerinden dağıtılır - `npx @mmerterden/multi-agent-toolkit-mcp`, auth'suz, token'sız, `~/.npmrc` ayarı gerekmeden çözülür.
 
@@ -15,16 +15,19 @@ iOS Simulator, Android Emulator ve headless web kontrolü için **99 araç**. AI
 
 Bu ayrımı net tutmakta fayda var. Bu satır bir zamanlar beş host'u "multi-agent-pipeline'ın tam-orkestrasyon hedefleri" olarak adlandırıyordu, bu da pipeline v10.7.0'da Cursor / Antigravity / Codex / Copilot Chat adaptörleri silindiğinde doğru olmaktan çıktı. Codex CLI, pipeline v13.0.0'da yetenek üzerinden birinci-sınıf bir hedef olarak geri döndü - artık skill'leri, paralel sub-agent'ları, hook'ları ve MCP'si var - ve doğrulanmış listede sadece bir kapı onu çalıştırdığı için yer alıyor, başka bir yerde desteklendiği için değil. Kimsenin çalıştırmadığı host'ları iddia etmek de bedavaya gelmiyor: 2.20.0 ve 2.21.0, ilk araçta yasa dışı bir `outputSchema` gönderdi, bu yüzden Claude Code tüm `tools/list`'i reddetti ve 78'in sıfırını sundu - birincil host'ta, iki release boyunca, bu repo'daki her kapı yeşilken.
 
-**10 kategori:**
+**13 kategori:**
 - **Device Control** (59 araç) - screenshot, tap, swipe, type, navigate, dark mode, locale, orientation, location, permissions, push notifications, gerçek start/stop ekran kaydı
 - **Memory** (2 araç) - `ios_leaks`, bir simülatör ya da host süreci üzerinde /usr/bin/leaks çalıştırır; anlık görüntü alır ya da kayıtlı bir memory graph ile karşılaştırır. `android_meminfo`, dumpsys meminfo okur, aynı şekilde anlık görüntü ya da fark. İkisi de bakamadıklarında temiz bir sonuç değil `measurable:false` döner
 - **Crash Diagnostics** (2 araç) - `ios_list_crashes` host'un DiagnosticReports dizinini okur, `android_list_crashes` adb crash buffer'ını döker, ikisi de tail-sınırlı
 - **Accessibility Audit** (3 araç) - `ios_accessibility_audit` / `android_accessibility_audit` canlı ağacı okur: eksik label, ekran okuyucunun adlandıramadığı kontrol, küçük tap target, eksik identifier ve görsel düzeni izlemeyen okuma sırası. `ios_accessibility_audit_deep` ise ağacın gösteremeyeceği şeyler için Apple'ın kendi XCUIAccessibilityAudit'ini XCUITest'iniz üzerinden çalıştırır: kontrast, Dynamic Type, kırpılmış metin. Üçü de bakamadıklarında temiz bir sonuç değil, gerekçesiyle `measurable:false` döner
 - **Store Compliance** (5 araç) - App Store / Play Store hazırlığı; **18-kurallık derin `ios_app_store_audit`**, Apple ITMS hata kodları + App Store Review Guidelines'a çapraz referans verir (privacy manifest, required-reason API, Info.plist, code signing, entitlements, gömülü SDK, IPv6, debug-tool sızıntısı, ...)
-- **Web Automation** (8 araç) - Playwright-destekli: goto, click (CSS selector'lar), type, JS eval, selector bekleme, metin çıkarma, screenshot. Chromium / WebKit / Firefox motorları. **`playwright` peer dependency'si gerektirir.**
+- **Web Automation** (18 araç) - Playwright-destekli: goto, click, type, tuş basma, seçenek seçme, JS eval, selector bekleme, metin çıkarma, screenshot; ayrıca diğer araçların CSS selector yerine kabul ettiği `ref` tutamaklarını üreten erişilebilirlik snapshot'ı, son navigasyondan beri toplanan console ve network kayıtları, sekme ve storage durumu, okunabilir makale çıkarımı, aynı-origin link haritası ve sınırlı bir crawl. Chromium / WebKit / Firefox motorları. **`playwright` peer dependency'si gerektirir.**
 - **Design Audit** (6 araç) - mock-mode vs Figma uygunluğu: scenario envanteri, mock tespiti, mock launch, canlı UI geometrisi, piksel/geometri/tipografi karşılaştırması, ve coverage kapısıyla birlikte HTML/PDF rapor
 - **Code Intelligence** (8 araç) - Swift ve Kotlin kaynağı hakkında derleyici seviyesinde cevaplar, her platformun zaten getirdiği dil sunucusu üzerinden: tanım, referanslar, hover, dosya ve proje geneli semboller, tam build olmadan tanılamalar, ve bu makinenin soruyu cevaplayıp cevaplayamayacağını söyleyen `code_index_status`. Çapraz dosya cevapları arka plan index'ine bağlı olduğu için, "kullanılmıyor" diye okunan boş bir liste yerine index'in oturup oturmadığını raporlar
 - **Wallet Passes** (4 araç) - Apple Wallet pass'i üret, imzala, doğrula ve incele. Beş stilin hepsi, çevrimdışı ve deterministik; düz metin parola bilerek kabul edilen bir girdi değil: çağıran taraf bir ortam değişkeninin adını ya da bir keychain kaydını verir. Doğrulayıcı bulguları sonucuna göre derecelendirir, çünkü asıl önemli hatalar sessiz olanlar - tanınmayan tek bir `PKPassengerCapability` değeri hiçbir uyarı üretmez ve gelişmiş pass'i sessizce eski düzene düşürür
+- **Context Index** (3 araç) - büyük bir sonuç yalnızca dosyaya yazılmaz, parçalanıp SQLite FTS5'e indekslenir; `context_search` bm25() ile sıralar ve hangi parçanın neyle ilgili olduğunu yaklaşık 50-100 token'da söyler. `context_get` tek bir parçayı id ile açar, dosya yolu ise her şey için orada durur. Grep hangi satırların bir dizgiyi içerdiğini söyler; sıralama hangi parçanın o konuyla ilgili olduğunu. Bağımlılık yok: `node:sqlite` Node ile geliyor
+- **Research** (2 araç) - sağlayıcı destekli web araması, {title, url, snippet} şemasına normalize edilmiş; ve Perplexity Sonar üzerinden atıflı cevap. Anahtarlar çağrı anında ortamdan okunup doğrudan bir başlığa gider; düz metin anahtar kabul edilen bir argüman değil - Wallet imzalayıcısının kullandığı sözleşmenin aynısı
+- **Media** (1 araç) - `media_frames`, bir kaydın anahtar karelerini ffmpeg ile çıkarır ve birbirine benzeyenleri eler; böylece `ios_record_video`'nun ürettiği video bir modelin gerçekten bakabileceği bir şeye dönüşür
 - **Autonomous Agent DSL** (2 araç) - `agent_run_steps`, tek bir MCP round trip'inde {tool, args, continue_on_error?, wait_ms?} adımlarından oluşan bir batch dizisini çalıştırır. Scriptlenmiş login akışları, form doldurma, çok-adımlı QA yolları için ideal. `agent_query_output`, satır içi dönemeyecek kadar büyük olan önceki bir çağrının tam çıktısını arar; böylece bir takip sorusu pahalı aracı yeniden koşturmak anlamına gelmez.
 
 ## Hızlı Başlangıç