@modelprofile.com/browser-runtime 5.0.0 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/browser-runtime",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "private": false,
   "description": "Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -126,7 +126,7 @@ renewal leaves the original expiry unchanged. Only one authorization callback pe
 may remain unsettled, including after timeout; runtime-wide renewal admission is bounded
 by `maxCapabilities`. Hosts must stop scheduling renewal when their viewer disconnects.
 
-Agent actions are exactly `navigate`, `snapshot`, `screenshot`, `click`, `fill`, and `press`. Human leases additionally expose tab lifecycle, viewport, raw input, frame subscription/acknowledgement and refresh, and exact-resource artifact reads/deletes. JavaScript evaluation is not public.
+Agent actions are exactly `navigate`, `snapshot`, `screenshot`, `click`, `fill`, and `press`. Agents can read or delete screenshots created by their exact lease using `readArtifact()` and `deleteArtifact()`. Human leases additionally expose tab lifecycle, viewport, raw input, frame subscription/acknowledgement and refresh, and exact-resource artifact reads/deletes. JavaScript evaluation is not public.
 
 All participants enter one strict resource FIFO. `maxQueuedOperationsPerLease` defaults to 128 and accepts 1 through 1,024; each participant has that bound, and the resource queue is bounded by its product with `maxCapabilitiesPerResource`. Overflow fails with `QUOTA_EXCEEDED`. Releasing a participant cancels only its queued and active work. Resource termination and shutdown cancel everyone. Started uncertain work must quiesce or the exact incarnation is terminated before operation settlement.
 
@@ -164,7 +164,7 @@ The MCP tool list is exactly `browser_navigate`, `browser_snapshot`, `browser_sc
 
 Each running resource owns one authenticated loopback `BrowserEgressProxy` carrying immutable `projectId` and `browserResourceId`. HTTP, WebSocket Upgrade, and CONNECT share strict public-unicast DNS/IP validation, numeric dialing, bounded lifetimes, and fail-closed policy.
 
-Artifact identity and APIs use `(projectId, browserResourceId, artifactId)`. Keyed project/resource directories prevent caller IDs from entering paths. Admission is serialized across per-resource, per-project, and global count/byte quotas. Reads use no-follow handles and verify size and SHA-256. Agent, Flex, and MCP surfaces receive metadata only.
+Artifact identity and APIs use `(projectId, browserResourceId, artifactId)`. Keyed project/resource directories prevent caller IDs from entering paths. Admission is serialized across per-resource, per-project, and global count/byte quotas. Reads use no-follow handles and verify size and SHA-256. Screenshot actions return metadata. Direct agent leases can read/delete only artifacts created by that exact lease; other agent and human artifacts remain unavailable. Human artifact access remains scoped to the resource. Read completion revalidates the lease and clears bytes if authority ended during IO. The built-in framed/Flex/MCP action adapters continue to return metadata; hosts can return image content after a scoped lease read. The artifact store accepts an optional opaque owner ID on `store()` and an expected owner ID on `read()`/`delete()`; omitting an expected owner retains its trusted parent API.
 
 ## Verification
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/browser-runtime',
-  version: '5.0.0',
+  version: '5.1.0',
   description: 'Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.'
 }

package/ts/classes.artifactstore.ts

@@ -15,6 +15,7 @@ import {
 interface IStoredArtifact {
   metadata: IBrowserArtifactMetadata;
   digest: string;
+  ownerId?: string;
 }
 
 interface IResourceArtifacts {
@@ -164,11 +165,14 @@ export class BrowserArtifactStore {
     browserResourceIdArg: string,
     mimeTypeArg: string,
     data: Uint8Array,
+    ownerIdArg?: string,
   ): Promise<IBrowserArtifactMetadata> {
     this.requireStarted();
     const projectId = this.validateProjectId(projectIdArg);
     const browserResourceId = this.validateResourceId(browserResourceIdArg);
     const mimeType = validateBoundedString(mimeTypeArg, 'mimeType', 1, 128);
+    const ownerId = ownerIdArg === undefined ? undefined
+      : validateBoundedString(ownerIdArg, 'ownerId', 1, 128);
     if (!(data instanceof Uint8Array)) {
       throw new BrowserRuntimeError('INVALID_INPUT', 'data must be Uint8Array');
     }
@@ -212,6 +216,7 @@ export class BrowserArtifactStore {
       const stored: IStoredArtifact = {
         metadata,
         digest: plugins.crypto.createHash('sha256').update(bytes).digest('hex'),
+        ...(ownerId === undefined ? {} : { ownerId }),
       };
       const resourceDirectory = this.resourcePath(project, resource);
       const finalPath = plugins.path.join(resourceDirectory, artifactId);
@@ -252,6 +257,7 @@ export class BrowserArtifactStore {
     projectIdArg: string,
     browserResourceIdArg: string,
     artifactIdArg: string,
+    expectedOwnerIdArg?: string,
   ): Promise<Uint8Array> {
     this.requireStarted();
     const projectId = this.validateProjectId(projectIdArg);
@@ -261,6 +267,7 @@ export class BrowserArtifactStore {
     let handle: plugins.fsPromises.FileHandle | undefined;
     try {
       const resolved = this.resolveArtifact(projectId, browserResourceId, artifactId);
+      this.assertArtifactOwner(resolved.stored, expectedOwnerIdArg);
       if (resolved.stored.metadata.expiresAt <= this.now()) {
         await this.deleteArtifact(projectId, browserResourceId, resolved);
         throw new BrowserRuntimeError('INVALID_INPUT', 'artifact is unavailable');
@@ -300,6 +307,7 @@ export class BrowserArtifactStore {
     projectIdArg: string,
     browserResourceIdArg: string,
     artifactIdArg: string,
+    expectedOwnerIdArg?: string,
   ): Promise<void> {
     this.requireStarted();
     const projectId = this.validateProjectId(projectIdArg);
@@ -307,16 +315,26 @@ export class BrowserArtifactStore {
     const artifactId = this.validateArtifactId(artifactIdArg);
     const release = await this.mutex.acquire();
     try {
+      const resolved = this.resolveArtifact(projectId, browserResourceId, artifactId);
+      this.assertArtifactOwner(resolved.stored, expectedOwnerIdArg);
       await this.deleteArtifact(
         projectId,
         browserResourceId,
-        this.resolveArtifact(projectId, browserResourceId, artifactId),
+        resolved,
       );
     } finally {
       release();
     }
   }
 
+  private assertArtifactOwner(storedArg: IStoredArtifact, expectedOwnerIdArg?: string): void {
+    if (expectedOwnerIdArg === undefined) return;
+    const expectedOwnerId = validateBoundedString(expectedOwnerIdArg, 'ownerId', 1, 128);
+    if (storedArg.ownerId !== expectedOwnerId) {
+      throw new BrowserRuntimeError('INVALID_INPUT', 'artifact is unavailable');
+    }
+  }
+
   public async purgeExpired(resource?: IBrowserResourceKey): Promise<number> {
     this.requireStarted();
     const validated = resource === undefined ? undefined : {

package/ts/classes.runtime.ts

@@ -1649,23 +1649,30 @@ export class BrowserRuntime {
     lease: ILeaseRecord,
     artifactId: string,
   ): Promise<Uint8Array> {
-    this.requireHuman(lease);
     this.requireValidLease(lease);
-    return this.requireArtifactStore().read(
+    const bytes = await this.requireArtifactStore().read(
       lease.capability.projectId,
       lease.capability.browserResourceId,
       artifactId,
+      lease.role === 'agent' ? lease.leaseId : undefined,
     );
+    try {
+      this.requireValidLease(lease);
+      return bytes;
+    } catch (errorArg) {
+      bytes.fill(0);
+      throw errorArg;
+    }
   }
 
   /** @internal */
   public async deleteLeaseArtifact(lease: ILeaseRecord, artifactId: string): Promise<void> {
-    this.requireHuman(lease);
     this.requireValidLease(lease);
     await this.requireArtifactStore().delete(
       lease.capability.projectId,
       lease.capability.browserResourceId,
       artifactId,
+      lease.role === 'agent' ? lease.leaseId : undefined,
     );
   }
 
@@ -2564,6 +2571,7 @@ export class BrowserRuntime {
           lease.capability.browserResourceId,
           snapshot.mimeType,
           snapshot.data,
+          lease.leaseId,
         );
         return { action: 'screenshot', artifact } satisfies IBrowserScreenshotResult;
       } finally {