@modootoday/datalab-extension-mcp 1.8.8 → 1.8.9

package/README.en.md

@@ -55,10 +55,10 @@ Avoid sharing a screenshot or the copied setup. If it may have leaked, press **[
 One command finds **every** AI app on your computer and connects them automatically. Nothing to do per app.
 
 1. **Open a terminal** — on Windows type `cmd` in the search box → "Command Prompt"; on Mac press `⌘+Space` and type `Terminal`; on Linux open your terminal app (often `Ctrl+Alt+T`).
-2. **Paste this command and press Enter.** (`@1.8.8` is the pinned version, so the connector never changes behind your back.)
+2. **Paste this command and press Enter.** (`@1.8.9` is the pinned version, so the connector never changes behind your back.)
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.8 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.9 install
    ```
 
    Lines of English scrolling by is normal. This only downloads and runs the connector — it touches nothing else.
@@ -252,7 +252,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 - **When the connection disappears** — run the very command you used at the start once more; it safely re-registers. (Some AI apps clean up their settings file and drop the connection.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.8 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.9 install
   ```
 
 - **`'npx' is not recognized...`** — Node.js isn't installed. The "No Node.js?" one-liner in Step 2 is the simplest fix.
@@ -282,7 +282,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 1. Run this in a terminal (it removes the entries registered in your AI apps).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.8 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.9 uninstall
    ```
 
 2. Turn **MCP 연결** off in the extension settings. The panel is the bridge, so with it off a leftover config line can look nothing up.

package/README.md

@@ -49,10 +49,10 @@ Claude 같은 AI 앱을 데이터랩툴즈에 연결해 주는 작은 무료 프
 명령 한 줄이면 컴퓨터에 있는 AI 앱을 **모두 자동으로** 찾아 연결해 줘요. 앱마다 따로 할 일은 없어요.
 
 1. **터미널을 열어요** — Windows는 검색창에 `cmd` → "명령 프롬프트", Mac은 `⌘+스페이스`로 `터미널`, Linux는 터미널 앱(보통 `Ctrl+Alt+T`)이에요.
-2. **아래 명령을 붙여넣고 Enter를 눌러요.** (`@1.8.8`은 커넥터가 나도 모르게 바뀌지 않도록 고정한 버전이에요.)
+2. **아래 명령을 붙여넣고 Enter를 눌러요.** (`@1.8.9`은 커넥터가 나도 모르게 바뀌지 않도록 고정한 버전이에요.)
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.8 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.9 install
    ```
 
    영어 글자가 여러 줄 올라오는 건 정상이에요. 이 명령은 커넥터를 내려받아 실행할 뿐, 다른 건 건드리지 않아요.
@@ -220,7 +220,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 - **연결이 사라졌을 때** — 처음 실행했던 그 명령을 한 번 더 실행하면 안전하게 다시 등록돼요. (일부 AI 앱이 설정 파일을 정리하며 연결을 지우기도 해요.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.8 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.9 install
   ```
 
 - **`'npx'을(는) 내부 또는 외부 명령...`** — Node.js가 없는 거예요. 위 2단계의 "Node.js가 없다면" 한 줄 설치가 가장 간단해요.
@@ -250,7 +250,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 1. 터미널에서 아래 명령을 실행해요(AI 앱에 등록된 설정을 지워 줘요).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.8 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.9 uninstall
    ```
 
 2. 확장 설정에서 **MCP 연결을 꺼요.** 패널이 브릿지라, 꺼 두면 어딘가 설정 줄이 남아 있어도 AI 앱이 아무것도 조회할 수 없어요.

package/dist/{browsers-KBFQARNA.js → browsers-DRGNGPSI.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_HOST,
   DEFAULT_PORT
-} from "./chunk-U7AIWUSN.js";
+} from "./chunk-GCRJQLTV.js";
 import {
   TOKEN_PROMPT_GUIDE,
   TOKEN_PROMPT_QUESTION,

package/dist/{chunk-U7AIWUSN.js → chunk-GCRJQLTV.js}

@@ -1,4 +1,4 @@
-// ../mcp-server/dist/chunk-YXH45HHP.js
+// ../mcp-server/dist/chunk-TUYW5HMB.js
 import { createHash } from "crypto";
 import { createHash as createHash2, randomUUID } from "crypto";
 import { mkdir, readFile, readdir, rm, writeFile } from "fs/promises";
@@ -14387,7 +14387,6 @@ function date4(params) {
   return /* @__PURE__ */ _coercedDate(ZodDate, params);
 }
 config(en_default());
-var BRIDGE_PROTOCOL_VERSION = 1;
 var SUPPORTED_PROTOCOL_VERSIONS = [1];
 var MCP_TOOL_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 var BridgeToolDescriptorSchema = external_exports.object({
@@ -15621,7 +15620,6 @@ function sessionKeyFor(credential) {
   return credential.kind === "claimed" ? credential.browserId : LEGACY_SESSION_KEY;
 }
 var DEFAULT_RATE_LIMIT = BRIDGE_LIMITS;
-var STALE_TOKEN_LIMIT = 5;
 function daemonIdTag() {
   return Math.floor(Math.random() * 16777215).toString(36).padStart(4, "0");
 }
@@ -15631,8 +15629,7 @@ var Bridge = class {
   #idTag = daemonIdTag();
   #sessionSeq = 0;
   #defaultKey = null;
-  /** Consecutive handshakes refused for our own token. See `#noteStaleToken`. */
-  #badTokenStreak = 0;
+  #retireSession = null;
   #bucketTokens = 0;
   #bucketRefilledAt = 0;
   // Last catalog the panel reported, kept across disconnects: many hosts cache
@@ -15642,6 +15639,12 @@ var Bridge = class {
   constructor(deps) {
     this.#deps = deps;
   }
+  bindRetireSession(retire) {
+    if (this.#retireSession !== null) {
+      throw new Error("bridge transport retirement is already bound");
+    }
+    this.#retireSession = retire;
+  }
   /**
    * The session a request with no browser named goes to. Map preserves
    * insertion order, so this is the oldest one — while the key space holds a
@@ -15948,36 +15951,6 @@ var Bridge = class {
     }
     return null;
   }
-  /**
-   * The extension is right about the token, and we can be wrong about it.
-   *
-   * This server is detached and outlives the app that started it, and a
-   * replacement only takes over when its version is newer. Once the user
-   * issues a fresh token, stepping aside is gated on the very token that no
-   * longer matches, so the server has to notice on its own. A run of refusals
-   * with nobody connected says exactly that, and exiting costs nothing.
-   */
-  #noteStaleToken(browserId, tokenHash) {
-    if (this.#deps.wasRevoked(tokenHash)) {
-      this.#deps.log?.("refused a revoked registration; not ours to leave for");
-      return;
-    }
-    if (this.#isClaimed(browserId)) {
-      this.#deps.log?.("refused a claimed browser; not ours to step aside for");
-      return;
-    }
-    if (this.#sessions.has(LEGACY_SESSION_KEY)) return;
-    this.#badTokenStreak += 1;
-    if (this.#badTokenStreak < STALE_TOKEN_LIMIT) return;
-    this.#deps.log?.(
-      `refused ${this.#badTokenStreak} handshakes for a stale token; stepping aside`
-    );
-    this.#badTokenStreak = 0;
-    this.#deps.onStaleToken?.();
-  }
-  #isClaimed(browserId) {
-    return browserId !== void 0 && this.#deps.claimedBrowsers.has(browserId);
-  }
   /**
    * Run the handshake.
    *
@@ -16018,7 +15991,9 @@ var Bridge = class {
       { rootToken: this.#deps.token, claimed: this.#deps.claimedBrowsers }
     );
     if (credential.kind === "refused") {
-      this.#noteStaleToken(parsed.data.browserId, tokenHash);
+      this.#deps.log?.(
+        this.#deps.wasRevoked(tokenHash) ? "refused a revoked browser credential" : "refused an unauthorized browser credential"
+      );
       return {
         t: "hello_nack",
         reason: credential.reason,
@@ -16026,7 +16001,6 @@ var Bridge = class {
         message: credential.message
       };
     }
-    if (credential.kind === "root") this.#badTokenStreak = 0;
     const negotiated = negotiateProtocol(parsed.data.protocolVersions);
     if (!negotiated.ok) {
       return {
@@ -16037,13 +16011,9 @@ var Bridge = class {
       };
     }
     const key = sessionKeyFor(credential);
-    if (this.#sessions.get(key)?.streamActive) {
-      return {
-        t: "hello_nack",
-        reason: "session_active",
-        supported: [BRIDGE_PROTOCOL_VERSION],
-        message: "This browser already has an active panel session."
-      };
+    const held = this.#sessions.get(key);
+    if (held?.streamActive) {
+      this.#retireSession?.(key, held.session.sessionId);
     }
     const session = {
       // A counter, not a timestamp: a panel reload produces two handshakes
@@ -17194,6 +17164,13 @@ function createHttpBridge(opts) {
     opts.bridge.disconnect(key);
     if (wasPrimary) scheduleToolsDrop();
   };
+  opts.bridge.bindRetireSession((key, sessionId) => {
+    const stream = streams.get(key);
+    if (!stream || stream.sessionId !== sessionId) return;
+    const wasPrimary = key === opts.bridge.sessionKey;
+    removeStream(key)?.end();
+    if (wasPrimary) scheduleToolsDrop();
+  });
   const server = createServer((req, res) => {
     const url2 = new URL(req.url ?? "/", `http://${host}`);
     const origin = req.headers.origin;
@@ -17235,6 +17212,18 @@ function createHttpBridge(opts) {
       });
       return;
     }
+    if (req.method === "POST" && url2.pathname === "/mcp/authority") {
+      void readJson(req, MAX_BODY_BYTES).then((body) => {
+        const token = body?.token;
+        if (!opts.bridge.verifyRootToken(typeof token === "string" ? token : "")) {
+          json2(res, 403, { error: "authority_mismatch" });
+          return;
+        }
+        res.writeHead(204, { "cache-control": "no-store" });
+        res.end();
+      }).catch(() => json2(res, 400, { error: "bad request" }));
+      return;
+    }
     if (req.method === "POST" && url2.pathname === "/bridge/hello") {
       void readJson(req, MAX_BODY_BYTES).then((body) => {
         const out = opts.bridge.handshake(body, origin);
@@ -18002,13 +17991,6 @@ function runDaemon(env, deps = {}) {
   }
   const bridge = new Bridge({
     send: (frame, key) => http.send(frame, key),
-    // Step aside once our own token looks stale. This process is detached
-    // and survives an app restart, and a replacement only takes over on a newer
-    // version — so nothing outside can unblock the install if we do not.
-    onStaleToken: () => {
-      log("pairing token is stale; exiting so the next call can start fresh");
-      void http.close().finally(() => exit(0));
-    },
     token,
     extensionIds,
     serverVersion: version2,

package/dist/{chunk-DR3Q6KT2.js → chunk-WBMZLPXC.js}

@@ -4,7 +4,7 @@ import {
   mediaToolDescriptors,
   spawnDaemon,
   tryConnect
-} from "./chunk-U7AIWUSN.js";
+} from "./chunk-GCRJQLTV.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";
@@ -15586,6 +15586,21 @@ async function defaultShutdown(base, token) {
     return false;
   }
 }
+async function defaultCheckAuthority(base, token) {
+  try {
+    const res = await globalThis.fetch(
+      `${base}/mcp/authority`,
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token })
+      }
+    );
+    return res.status === 204;
+  } catch {
+    return false;
+  }
+}
 async function ensureDaemonRunning(deps = {}) {
   const host = deps.host ?? DEFAULT_HOST;
   const port = deps.port ?? DEFAULT_PORT;
@@ -15601,6 +15616,7 @@ async function ensureDaemonRunning(deps = {}) {
   const token = deps.token ?? process.env["DATALAB_MCP_TOKEN"];
   const readVersion = deps.readVersion ?? defaultReadVersion;
   const shutdown = deps.shutdown ?? defaultShutdown;
+  const checkAuthority = deps.checkAuthority ?? defaultCheckAuthority;
   const spawnAndWait = async () => {
     spawn(daemonEntry, ["serve"]);
     for (let i = 0; i < attempts; i += 1) {
@@ -15623,14 +15639,26 @@ async function ensureDaemonRunning(deps = {}) {
   fast.destroy();
   if (!selfVersion || !token) return;
   const running = await readVersion(base);
-  if (!running || !isOlderVersion(running, selfVersion)) return;
+  if (!running) {
+    throw new Error(
+      `port ${String(port)} is occupied by something other than the DataLab connector`
+    );
+  }
+  if (!isOlderVersion(running, selfVersion)) {
+    if (await checkAuthority(base, token)) return;
+    throw new Error(
+      `connector authority conflict on port ${String(port)}; every MCP host on this machine must use the same DataLab workbench token`
+    );
+  }
   log(`updating the connector: replacing ${running} with ${selfVersion}`);
   const accepted = await shutdown(base, token);
   if (!accepted) {
     log(
       "the running connector is too old to update automatically; restart it (or wait for it to idle out) to pick up the new version"
     );
-    return;
+    throw new Error(
+      `connector authority conflict on port ${String(port)}; the running connector did not accept this workbench token`
+    );
   }
   for (let i = 0; i < attempts; i += 1) {
     const socket = await connect(host, port, PROBE_TIMEOUT_MS);

package/dist/cli.js

@@ -2,10 +2,10 @@
 import {
   dispatchCli,
   runAdapter
-} from "./chunk-DR3Q6KT2.js";
+} from "./chunk-WBMZLPXC.js";
 import {
   runDaemon
-} from "./chunk-U7AIWUSN.js";
+} from "./chunk-GCRJQLTV.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
@@ -62,7 +62,7 @@ async function main() {
     // Loaded lazily, like the installer: the adapter path is what an MCP host
     // spawns and must not pay for a command only an operator types.
     browsers: async (argv) => {
-      const { runBrowsers } = await import("./browsers-KBFQARNA.js");
+      const { runBrowsers } = await import("./browsers-DRGNGPSI.js");
       const { createNodeIo } = await import("./dist-JICXADYR.js");
       const io = createNodeIo();
       const code = await runBrowsers(argv, {

package/dist/index.d.ts

@@ -62,6 +62,8 @@ interface EnsureRunningDeps {
     readVersion?: (base: string) => Promise<string | null>;
     /** Injected in tests; defaults to `POST /mcp/shutdown`. */
     shutdown?: (base: string, token: string) => Promise<boolean>;
+    /** Injected in tests; defaults to the authenticated authority probe. */
+    checkAuthority?: (base: string, token: string) => Promise<boolean>;
 }
 /**
  * Ensure a daemon is up before the adapter starts proxying. A daemon already

package/dist/index.js

@@ -3,8 +3,8 @@ import {
   dispatchCli,
   ensureDaemonRunning,
   runAdapter
-} from "./chunk-DR3Q6KT2.js";
-import "./chunk-U7AIWUSN.js";
+} from "./chunk-WBMZLPXC.js";
+import "./chunk-GCRJQLTV.js";
 import "./chunk-MLKGABMK.js";
 export {
   createAdapterServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/datalab-extension-mcp",
-  "version": "1.8.8",
+  "version": "1.8.9",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",