@modootoday/datalab-extension-mcp 1.8.9 → 1.8.10

package/README.en.md

@@ -55,10 +55,10 @@ Avoid sharing a screenshot or the copied setup. If it may have leaked, press **[
 One command finds **every** AI app on your computer and connects them automatically. Nothing to do per app.
 
 1. **Open a terminal** — on Windows type `cmd` in the search box → "Command Prompt"; on Mac press `⌘+Space` and type `Terminal`; on Linux open your terminal app (often `Ctrl+Alt+T`).
-2. **Paste this command and press Enter.** (`@1.8.9` is the pinned version, so the connector never changes behind your back.)
+2. **Paste this command and press Enter.** (`@1.8.10` is the pinned version, so the connector never changes behind your back.)
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.9 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.10 install
    ```
 
    Lines of English scrolling by is normal. This only downloads and runs the connector — it touches nothing else.
@@ -252,7 +252,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 - **When the connection disappears** — run the very command you used at the start once more; it safely re-registers. (Some AI apps clean up their settings file and drop the connection.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.9 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.10 install
   ```
 
 - **`'npx' is not recognized...`** — Node.js isn't installed. The "No Node.js?" one-liner in Step 2 is the simplest fix.
@@ -282,7 +282,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 1. Run this in a terminal (it removes the entries registered in your AI apps).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.9 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.10 uninstall
    ```
 
 2. Turn **MCP 연결** off in the extension settings. The panel is the bridge, so with it off a leftover config line can look nothing up.

package/README.md

@@ -49,10 +49,10 @@ Claude 같은 AI 앱을 데이터랩툴즈에 연결해 주는 작은 무료 프
 명령 한 줄이면 컴퓨터에 있는 AI 앱을 **모두 자동으로** 찾아 연결해 줘요. 앱마다 따로 할 일은 없어요.
 
 1. **터미널을 열어요** — Windows는 검색창에 `cmd` → "명령 프롬프트", Mac은 `⌘+스페이스`로 `터미널`, Linux는 터미널 앱(보통 `Ctrl+Alt+T`)이에요.
-2. **아래 명령을 붙여넣고 Enter를 눌러요.** (`@1.8.9`은 커넥터가 나도 모르게 바뀌지 않도록 고정한 버전이에요.)
+2. **아래 명령을 붙여넣고 Enter를 눌러요.** (`@1.8.10`은 커넥터가 나도 모르게 바뀌지 않도록 고정한 버전이에요.)
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.9 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.10 install
    ```
 
    영어 글자가 여러 줄 올라오는 건 정상이에요. 이 명령은 커넥터를 내려받아 실행할 뿐, 다른 건 건드리지 않아요.
@@ -220,7 +220,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 - **연결이 사라졌을 때** — 처음 실행했던 그 명령을 한 번 더 실행하면 안전하게 다시 등록돼요. (일부 AI 앱이 설정 파일을 정리하며 연결을 지우기도 해요.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.9 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.10 install
   ```
 
 - **`'npx'을(는) 내부 또는 외부 명령...`** — Node.js가 없는 거예요. 위 2단계의 "Node.js가 없다면" 한 줄 설치가 가장 간단해요.
@@ -250,7 +250,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 1. 터미널에서 아래 명령을 실행해요(AI 앱에 등록된 설정을 지워 줘요).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.9 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.10 uninstall
    ```
 
 2. 확장 설정에서 **MCP 연결을 꺼요.** 패널이 브릿지라, 꺼 두면 어딘가 설정 줄이 남아 있어도 AI 앱이 아무것도 조회할 수 없어요.

package/dist/{browsers-DRGNGPSI.js → browsers-AGEUPMJA.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_HOST,
   DEFAULT_PORT
-} from "./chunk-GCRJQLTV.js";
+} from "./chunk-DOPJ4OZ4.js";
 import {
   TOKEN_PROMPT_GUIDE,
   TOKEN_PROMPT_QUESTION,
@@ -40,9 +40,9 @@ async function runBrowsers(argv, deps) {
   const send = deps.fetchImpl ?? globalThis.fetch;
   const rest = withoutFlag(argv, "--token");
   const action = rest[0] ?? "list";
-  if (action !== "add" && action !== "list" && action !== "revoke") {
+  if (action !== "add" && action !== "list" && action !== "revoke" && action !== "repair") {
     deps.out(
-      `usage: browsers [add <label>|list|revoke <handle>] [--token <t>]`
+      `usage: browsers [add <label>|list|revoke <handle>|repair] [--token <t>]`
     );
     return 2;
   }
@@ -93,6 +93,13 @@ async function runBrowsers(argv, deps) {
   }
   if (action === "list") {
     const rows = parsed["browsers"] ?? [];
+    const registryStatus = parsed["registryStatus"];
+    if (registryStatus?.state === "degraded") {
+      deps.out(
+        `Registry warning: ${String(registryStatus.error ?? "degraded")}.`
+      );
+      deps.out("Run: datalab-extension-mcp browsers repair");
+    }
     if (rows.length === 0) {
       deps.out("No browsers registered.");
       return 0;
@@ -109,6 +116,13 @@ async function runBrowsers(argv, deps) {
     );
     return parsed["removed"] === true ? 0 : 1;
   }
+  if (action === "repair") {
+    const removed = Array.isArray(parsed["removed"]) ? parsed["removed"].length : 0;
+    deps.out(
+      removed > 0 ? `Repaired ${String(removed)} conflicting browser registration.` : "No conflicting browser registrations found."
+    );
+    return 0;
+  }
   deps.out(`Registered ${String(parsed["handle"])}.`);
   deps.out(`Paste this into the browser's panel \u2014 it is shown only now:`);
   deps.out(String(parsed["token"]));

package/dist/{chunk-GCRJQLTV.js → chunk-DOPJ4OZ4.js}

@@ -1,4 +1,4 @@
-// ../mcp-server/dist/chunk-TUYW5HMB.js
+// ../mcp-server/dist/chunk-Q4ALBPO7.js
 import { createHash } from "crypto";
 import { createHash as createHash2, randomUUID } from "crypto";
 import { mkdir, readFile, readdir, rm, writeFile } from "fs/promises";
@@ -24,8 +24,8 @@ import { spawn } from "child_process";
 import { closeSync } from "fs";
 import { randomBytes } from "crypto";
 import { readFileSync } from "fs";
-import { rename, writeFile as writeFile2 } from "fs/promises";
-import { join as join3 } from "path";
+import { mkdir as mkdir2, rename, writeFile as writeFile2 } from "fs/promises";
+import { dirname, join as join3 } from "path";
 import { createRequire } from "module";
 import { join as join4 } from "path";
 var __defProp = Object.defineProperty;
@@ -14462,7 +14462,9 @@ var HelloNackReasonSchema = external_exports.enum([
   /** Origin header absent or not our extension. */
   "forbidden_origin",
   /** This browser already has an active event stream. */
-  "session_active"
+  "session_active",
+  /** Root authority cannot open a browser session. */
+  "browser_registration_required"
 ]);
 var BrowserRoutingSchema = external_exports.object({
   targetBrowserId: external_exports.string(),
@@ -14652,6 +14654,14 @@ var REFUSED = {
   message: "Pairing token missing or invalid."
 };
 function resolveCredential(presented, known) {
+  const root = checkToken(presented.token, known.rootToken);
+  if (root.ok) {
+    return {
+      kind: "refused",
+      reason: "browser_registration_required",
+      message: "The root token is management-only. Register this browser with its own token."
+    };
+  }
   const { browserId } = presented;
   if (browserId !== void 0 && browserId.length > 0) {
     const expected = known.claimed.get(browserId);
@@ -14662,8 +14672,7 @@ function resolveCredential(presented, known) {
       return REFUSED;
     }
   }
-  const root = checkToken(presented.token, known.rootToken);
-  return root.ok ? { kind: "root" } : REFUSED;
+  return REFUSED;
 }
 var READ_ONLY_TOOLS = [
   "datalab_browsers",
@@ -15615,10 +15624,6 @@ var PendingRegistry = class {
 function digestToken(token) {
   return createHash("sha256").update(token, "utf8").digest("hex");
 }
-var LEGACY_SESSION_KEY = "legacy";
-function sessionKeyFor(credential) {
-  return credential.kind === "claimed" ? credential.browserId : LEGACY_SESSION_KEY;
-}
 var DEFAULT_RATE_LIMIT = BRIDGE_LIMITS;
 function daemonIdTag() {
   return Math.floor(Math.random() * 16777215).toString(36).padStart(4, "0");
@@ -15676,6 +15681,9 @@ var Bridge = class {
       primary: primary === id
     }));
   }
+  browserRegistryStatus() {
+    return this.#deps.browserRegistryStatus?.() ?? { state: "ready" };
+  }
   /**
    * The only place a registry is born, and it is born already in the map.
    * One living anywhere else would be missed by `sweep` and by `#closeSession`,
@@ -15699,7 +15707,6 @@ var Bridge = class {
       key,
       session,
       tokenHash: auth.tokenHash,
-      authRequired: auth.authRequired,
       routingRequired: auth.routingRequired,
       fileRequestBound: auth.fileRequestBound,
       streamActive: false,
@@ -15751,9 +15758,6 @@ var Bridge = class {
   sessionForKey(key) {
     return this.#sessions.get(key)?.session ?? null;
   }
-  legacySessionKey() {
-    return this.#sessions.has(LEGACY_SESSION_KEY) ? LEGACY_SESSION_KEY : null;
-  }
   /** Is a panel connected and ready to serve tool calls? */
   get connected() {
     return this.#primary() !== null;
@@ -15800,9 +15804,6 @@ var Bridge = class {
     if (!timingSafeEqual(hash2, entry.tokenHash) || this.#deps.wasRevoked(hash2)) {
       return null;
     }
-    if (entry.key === LEGACY_SESSION_KEY) {
-      return this.verifyRootToken(presented) ? "root" : null;
-    }
     const current = this.#deps.claimedBrowsers.get(entry.key);
     return current !== void 0 && timingSafeEqual(hash2, current) ? "claimed_browser" : null;
   }
@@ -15814,33 +15815,6 @@ var Bridge = class {
     }
     return "unknown";
   }
-  authorizeLegacyFileCredential(presented) {
-    if (typeof presented !== "string" || presented.length === 0) {
-      return {
-        ok: false,
-        reason: "file_session_token_missing",
-        credential: "missing"
-      };
-    }
-    const credential = this.#fileCredentialClass(presented);
-    for (const entry of this.#sessions.values()) {
-      const accepted = this.#fileCredential(entry, presented);
-      if (accepted && !entry.fileRequestBound) {
-        return {
-          ok: true,
-          key: entry.key,
-          sessionId: entry.session.sessionId,
-          credential: accepted,
-          requestBound: false
-        };
-      }
-    }
-    return {
-      ok: false,
-      reason: "file_session_token_mismatch",
-      credential
-    };
-  }
   authorizeFileRequest(input) {
     const entry = [...this.#sessions.values()].find(
       (candidate) => candidate.session.sessionId === input.sessionId
@@ -15859,7 +15833,7 @@ var Bridge = class {
         credential: "missing",
         key: entry.key,
         sessionId: entry.session.sessionId,
-        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+        requestId: input.requestId
       };
     }
     const credential = this.#fileCredential(entry, input.token);
@@ -15870,32 +15844,23 @@ var Bridge = class {
         credential: this.#fileCredentialClass(input.token),
         key: entry.key,
         sessionId: entry.session.sessionId,
-        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+        requestId: input.requestId
       };
     }
     if (!entry.fileRequestBound) {
       return {
-        ok: true,
+        ok: false,
+        reason: "file_request_expired",
+        credential,
         key: entry.key,
         sessionId: entry.session.sessionId,
-        ...input.requestId === void 0 ? {} : { requestId: input.requestId },
-        credential,
-        requestBound: false
+        requestId: input.requestId
       };
     }
     const now = (this.#deps.now ?? Date.now)();
     for (const [requestId, permit2] of entry.filePermits) {
       if (permit2.expiresAt <= now) entry.filePermits.delete(requestId);
     }
-    if (input.requestId === void 0) {
-      return {
-        ok: false,
-        reason: "file_request_expired",
-        credential,
-        key: entry.key,
-        sessionId: entry.session.sessionId
-      };
-    }
     const permit = entry.filePermits.get(input.requestId);
     if (!permit) {
       return {
@@ -16001,6 +15966,14 @@ var Bridge = class {
         message: credential.message
       };
     }
+    if (credential.kind !== "claimed") {
+      return {
+        t: "hello_nack",
+        reason: "browser_registration_required",
+        supported: [],
+        message: "The root token is management-only. Register this browser with its own token."
+      };
+    }
     const negotiated = negotiateProtocol(parsed.data.protocolVersions);
     if (!negotiated.ok) {
       return {
@@ -16010,7 +15983,7 @@ var Bridge = class {
         message: negotiated.message
       };
     }
-    const key = sessionKeyFor(credential);
+    const key = credential.browserId;
     const held = this.#sessions.get(key);
     if (held?.streamActive) {
       this.#retireSession?.(key, held.session.sessionId);
@@ -16023,16 +15996,12 @@ var Bridge = class {
       protocolVersion: negotiated.version,
       extensionVersion: parsed.data.extensionVersion
     };
-    const authRequired = parsed.data.capabilities.includes(
-      BRIDGE_AUTH_CAPABILITY
-    );
     const routingRequired = credential.kind === "claimed" && parsed.data.capabilities.includes(BROWSER_ROUTING_CAPABILITY);
     const fileRequestBound = parsed.data.capabilities.includes(
       LOCAL_FILE_REQUEST_CAPABILITY
     );
     this.#installSession(key, session, {
       tokenHash,
-      authRequired,
       routingRequired,
       fileRequestBound
     });
@@ -16044,10 +16013,8 @@ var Bridge = class {
       protocolVersion: negotiated.version,
       serverVersion: this.#deps.serverVersion,
       sessionId: session.sessionId,
-      // Echoed only when it is actually on, so the panel can tell a server that
-      // is holding it to the header from one that predates the gate entirely.
       capabilities: [
-        ...authRequired ? [BRIDGE_AUTH_CAPABILITY] : [],
+        BRIDGE_AUTH_CAPABILITY,
         ...routingRequired ? [BROWSER_ROUTING_CAPABILITY] : [],
         ...fileRequestBound ? [LOCAL_FILE_REQUEST_CAPABILITY] : []
       ]
@@ -16068,15 +16035,13 @@ var Bridge = class {
     return this.#mayAct(entry, presented);
   }
   #mayAct(entry, presented) {
-    if (!entry.authRequired) return true;
     if (typeof presented !== "string" || presented.length === 0) return false;
     return timingSafeEqual(digestToken(presented), entry.tokenHash);
   }
   /**
    * Route a frame from the panel to whoever is waiting for it.
    *
-   * `presented` is the credential the poster carried. A session that asked to
-   * be held to it refuses anything else; one that did not is unaffected.
+   * `presented` is the credential the poster carried.
    */
   receive(raw, presented) {
     const classified = classifyFrame(
@@ -16268,7 +16233,7 @@ var Bridge = class {
     if (browser === void 0) {
       entry = this.#primary();
     } else {
-      const known = this.#deps.claimedBrowsers.has(browser) || browser === LEGACY_SESSION_KEY && this.#sessions.has(browser);
+      const known = this.#deps.claimedBrowsers.has(browser);
       if (!known) {
         return {
           ok: false,
@@ -16857,14 +16822,22 @@ async function handleMcpRequest(bridge, body, accept, stage) {
       delete args["browser"];
     }
     if (params.name === BROWSERS_TOOL) {
+      const registryStatus = bridge.browserRegistryStatus();
+      const { state: registryState, ...registryDetail } = registryStatus;
+      const payload = {
+        browsers: bridge.connectedBrowsers(),
+        registryStatus: registryState,
+        ...registryState === "ready" ? {} : registryDetail
+      };
       return frameMcpResponse(
         rpcResult(id, {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ browsers: bridge.connectedBrowsers() })
+              text: JSON.stringify(payload)
             }
-          ]
+          ],
+          ...registryState === "disabled" ? { isError: true } : {}
         }),
         accept
       );
@@ -17240,7 +17213,11 @@ function createHttpBridge(opts) {
     }
     if (req.method === "GET" && url2.pathname === "/bridge/events") {
       const claimed = url2.searchParams.get("session");
-      const key = claimed === null ? opts.bridge.legacySessionKey() : opts.bridge.keyForSession(claimed);
+      if (claimed === null || claimed.length === 0) {
+        json2(res, 400, { error: "session_required" });
+        return;
+      }
+      const key = claimed === null ? null : opts.bridge.keyForSession(claimed);
       if (key === null) {
         opts.log?.("refused a stream for an unknown session");
         res.writeHead(200, { "content-type": "text/event-stream" });
@@ -17267,13 +17244,8 @@ function createHttpBridge(opts) {
         // by nature.
         "x-accel-buffering": "no"
       });
-      const sessionId = claimed ?? opts.bridge.sessionForKey(key)?.sessionId ?? "";
-      if (!sessionId) {
-        res.end();
-        return;
-      }
       try {
-        installStream(key, sessionId, res);
+        installStream(key, claimed, res);
       } catch {
         res.end();
         return;
@@ -17314,7 +17286,11 @@ function createHttpBridge(opts) {
         }
         const action = b?.["action"];
         if (action === "list") {
-          json2(res, 200, { ok: true, browsers: await registry2.list() });
+          json2(res, 200, {
+            ok: true,
+            browsers: await registry2.list(),
+            registryStatus: registry2.status()
+          });
           return;
         }
         if (action === "add") {
@@ -17330,6 +17306,10 @@ function createHttpBridge(opts) {
           });
           return;
         }
+        if (action === "repair") {
+          json2(res, 200, { ok: true, ...await registry2.repair() });
+          return;
+        }
         json2(res, 400, { error: "unknown action" });
       }).catch((err) => {
         const why = err instanceof Error ? err.message : String(err);
@@ -17347,20 +17327,20 @@ function createHttpBridge(opts) {
         const hasRequestId = b !== null && Object.hasOwn(b, "requestId");
         const invalidSessionId = hasSessionId && (typeof b?.sessionId !== "string" || b.sessionId.length === 0);
         const invalidRequestId = hasRequestId && (typeof b?.requestId !== "string" || b.requestId.length === 0);
-        if (invalidSessionId || invalidRequestId) {
+        if (!hasSessionId || !hasRequestId || invalidSessionId || invalidRequestId) {
           json2(res, 403, {
             error: "unauthorized",
             message: "\uC0AC\uC9C4 \uC694\uCCAD\uC758 \uC5F0\uACB0 \uC815\uBCF4\uB97C \uD655\uC778\uD558\uC9C0 \uBABB\uD588\uC5B4\uC694."
           });
           return;
         }
-        const auth = hasSessionId ? opts.bridge.authorizeFileRequest({
+        const auth = opts.bridge.authorizeFileRequest({
           sessionId: b.sessionId,
-          ...hasRequestId ? { requestId: b.requestId } : {},
+          requestId: b.requestId,
           token,
           path,
           ...typeof b?.tool === "string" ? { tool: b.tool } : {}
-        }) : opts.bridge.authorizeLegacyFileCredential(token);
+        });
         if (!auth.ok) {
           opts.log?.(
             `file request refused: reason=${auth.reason} credential=${auth.credential} tokenPresent=${String(token.length > 0)} sessionMatch=${String(auth.key !== void 0)} open=not-entered`
@@ -17383,7 +17363,7 @@ function createHttpBridge(opts) {
           return;
         }
         opts.log?.(
-          `file request authorised: browser=${correlationValue(auth.key, 8)} session=${correlationValue(auth.sessionId, 32)} request=${auth.requestId ? correlationValue(auth.requestId, 96) : "legacy"} credential=${auth.credential} registryMatch=${String(auth.credential === "claimed_browser")} open=entered`
+          `file request authorised: browser=${correlationValue(auth.key, 8)} session=${correlationValue(auth.sessionId, 32)} request=${correlationValue(auth.requestId, 96)} credential=${auth.credential} registryMatch=${String(auth.credential === "claimed_browser")} open=entered`
         );
         let source = null;
         let owner = null;
@@ -17842,6 +17822,7 @@ async function writeLedger(path, claims) {
 var writing = /* @__PURE__ */ new Map();
 async function writeOnce(path, claims) {
   const tmp = `${path}.${process.pid}.tmp`;
+  await mkdir2(dirname(path), { recursive: true, mode: 448 });
   await writeFile2(tmp, `${JSON.stringify(claims, null, 2)}
 `, {
     mode: 384
@@ -17873,17 +17854,24 @@ function matches(claim, handle) {
 function createBrowserRegistry(opts) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const revoked = /* @__PURE__ */ new Set();
-  const current = () => {
+  const readCurrent = () => {
     const read = readLedger(opts.path);
     if (read.state === "unreadable") {
       throw new Error(`browser registry is unreadable: ${read.reason}`);
     }
     const rows = read.state === "ok" ? [...read.rows] : [];
-    if (opts.forbiddenTokenHash && ledgerOverlapsToken(rows, opts.forbiddenTokenHash)) {
-      throw new Error("browser registry overlaps the root authority");
-    }
-    return rows;
+    if (!opts.forbiddenTokenHash) return { rows, quarantined: [] };
+    const quarantined = rows.filter(
+      (row) => timingSafeEqual(row.tokenHash, opts.forbiddenTokenHash)
+    );
+    return {
+      rows: rows.filter(
+        (row) => !timingSafeEqual(row.tokenHash, opts.forbiddenTokenHash)
+      ),
+      quarantined
+    };
   };
+  const current = () => readCurrent().rows;
   return {
     async add(label) {
       const token = mintToken();
@@ -17940,6 +17928,33 @@ function createBrowserRegistry(opts) {
       }
       return true;
     },
+    async repair() {
+      const view = readCurrent();
+      if (view.quarantined.length === 0) return { removed: [] };
+      await writeLedger(opts.path, view.rows);
+      return { removed: view.quarantined.map(handleOf) };
+    },
+    status() {
+      const read = readLedger(opts.path);
+      if (read.state === "unreadable") {
+        return {
+          state: "disabled",
+          error: "browser_registry_unreadable",
+          detail: read.reason
+        };
+      }
+      if (read.state === "ok" && opts.forbiddenTokenHash && ledgerOverlapsToken(read.rows, opts.forbiddenTokenHash)) {
+        return {
+          state: "degraded",
+          error: "browser_registry_root_authority_overlap",
+          quarantinedHandles: read.rows.filter(
+            (row) => timingSafeEqual(row.tokenHash, opts.forbiddenTokenHash)
+          ).map(handleOf),
+          recovery: "browsers repair"
+        };
+      }
+      return { state: "ready" };
+    },
     wasRevoked(tokenHash) {
       return revoked.has(tokenHash);
     }
@@ -17972,12 +17987,12 @@ function runDaemon(env, deps = {}) {
   const browserLabels = /* @__PURE__ */ new Map();
   const ledger = readLedger(ledgerPath(deps.home));
   const rootTokenHash = digestToken(token);
-  const ledgerAuthorityValid = ledger.state !== "ok" || !ledgerOverlapsToken(ledger.rows, rootTokenHash);
-  if (ledger.state === "ok" && ledgerAuthorityValid) {
-    for (const [id, hash2] of claimedDigestsFrom(ledger.rows)) {
+  const safeLedgerRows = ledger.state === "ok" ? ledger.rows.filter((row) => row.tokenHash !== rootTokenHash) : [];
+  if (ledger.state === "ok") {
+    for (const [id, hash2] of claimedDigestsFrom(safeLedgerRows)) {
       claimedBrowsers.set(id, hash2);
     }
-    for (const row of ledger.rows) {
+    for (const row of safeLedgerRows) {
       if (row.browserId !== null) browserLabels.set(row.browserId, row.label);
     }
   }
@@ -17986,8 +18001,10 @@ function runDaemon(env, deps = {}) {
       `browser registry is unreadable (${ledger.reason}); registering is off`
     );
   }
-  if (!ledgerAuthorityValid) {
-    log("browser registry overlaps the root authority; registering is off");
+  if (ledger.state === "ok" && ledgerOverlapsToken(ledger.rows, rootTokenHash)) {
+    log(
+      "browser registry overlaps the root authority; conflicting rows are quarantined"
+    );
   }
   const bridge = new Bridge({
     send: (frame, key) => http.send(frame, key),
@@ -17995,10 +18012,10 @@ function runDaemon(env, deps = {}) {
     extensionIds,
     serverVersion: version2,
     rateLimit: deps.rateLimit,
-    // Empty until a browser is registered, and nothing issues registrations
-    // yet — so every panel still shares the one slot it always had.
+    // Empty until a browser is registered.
     claimedBrowsers,
     browserLabels,
+    browserRegistryStatus: () => registry2.status(),
     claimBrowser: (browserId, tokenHash) => {
       const took = registry2.claim(browserId, tokenHash);
       if (took) {

package/dist/{chunk-WBMZLPXC.js → chunk-YB7L4SZC.js}

@@ -4,7 +4,7 @@ import {
   mediaToolDescriptors,
   spawnDaemon,
   tryConnect
-} from "./chunk-GCRJQLTV.js";
+} from "./chunk-DOPJ4OZ4.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";
@@ -14601,7 +14601,9 @@ var HelloNackReasonSchema = external_exports.enum([
   /** Origin header absent or not our extension. */
   "forbidden_origin",
   /** This browser already has an active event stream. */
-  "session_active"
+  "session_active",
+  /** Root authority cannot open a browser session. */
+  "browser_registration_required"
 ]);
 var BrowserRoutingSchema = external_exports.object({
   targetBrowserId: external_exports.string(),

package/dist/cli.js

@@ -2,10 +2,10 @@
 import {
   dispatchCli,
   runAdapter
-} from "./chunk-WBMZLPXC.js";
+} from "./chunk-YB7L4SZC.js";
 import {
   runDaemon
-} from "./chunk-GCRJQLTV.js";
+} from "./chunk-DOPJ4OZ4.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
@@ -62,7 +62,7 @@ async function main() {
     // Loaded lazily, like the installer: the adapter path is what an MCP host
     // spawns and must not pay for a command only an operator types.
     browsers: async (argv) => {
-      const { runBrowsers } = await import("./browsers-DRGNGPSI.js");
+      const { runBrowsers } = await import("./browsers-AGEUPMJA.js");
       const { createNodeIo } = await import("./dist-JICXADYR.js");
       const io = createNodeIo();
       const code = await runBrowsers(argv, {
@@ -109,7 +109,7 @@ async function main() {
     unknown: (sub) => {
       log(`unknown command "${sub}".`);
       log(`usage: ${NAME} [install|uninstall|serve|browsers|skills]`);
-      log(`  browsers [add <label>|list|revoke <handle>] [--token <t>]`);
+      log(`  browsers [add <label>|list|revoke <handle>|repair] [--token <t>]`);
       log(`  skills [list|status|attach <slug>|detach <slug>]`);
       log(`run with no command to serve an MCP host over stdio.`);
       process.exit(2);

package/dist/index.js

@@ -3,8 +3,8 @@ import {
   dispatchCli,
   ensureDaemonRunning,
   runAdapter
-} from "./chunk-WBMZLPXC.js";
-import "./chunk-GCRJQLTV.js";
+} from "./chunk-YB7L4SZC.js";
+import "./chunk-DOPJ4OZ4.js";
 import "./chunk-MLKGABMK.js";
 export {
   createAdapterServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/datalab-extension-mcp",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",