@ontologic/pillowfort-agent 1.1.2 → 1.1.4

package/docs/agents/index.md

@@ -128,13 +128,13 @@ Anonymous requests to `/mcp` return 401 with OAuth discovery; this is not a manu
 
 ## Local MCP: keep the runtime under your control
 
-The local package is `@ontologic/pillowfort-agent` version `1.1.2`; source and MCP Registry ownership remain under GitHub `slee1996`. It connects directly to production without building or hosting the app. Use patched supported Node. [Release identity](https://about.pillowfort.xyz/agents/release.json) records the source tag and catalog digest; the deployed app exposes the same identity at `/agents-release.json`.
+The local package is `@ontologic/pillowfort-agent` version `1.1.4`; source and MCP Registry ownership remain under GitHub `slee1996`. It connects directly to production without building or hosting the app. Use patched supported Node. [Release identity](https://about.pillowfort.xyz/agents/release.json) records the source tag and catalog digest; the deployed app exposes the same identity at `/agents-release.json`.
 
 ```sh
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent install-browser
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent doctor --url https://pillowfort.xyz
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent discover --url https://pillowfort.xyz
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent mcp --url https://pillowfort.xyz
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent install-browser
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent doctor --url https://pillowfort.xyz
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent discover --url https://pillowfort.xyz
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent mcp --url https://pillowfort.xyz
 ```
 
 Review downloaded code before running it. Browser installation is explicit; `doctor` creates no rooms. Keep the MCP process running while sessions are in use. Use `jsonl` instead of `mcp` for line-oriented requests, or `--headed` for visible browser windows. The local CLI's `--url` selects the app origin, not the hosted MCP URL. If your npm configuration redirects the `@ontologic` scope elsewhere, explicitly select npmjs.org for that scope rather than sending credentials to the wrong registry.
@@ -150,7 +150,7 @@ Local Codex configuration:
 ```toml
 [mcp_servers.pillowfort]
 command = "npm"
-args = ["exec", "--yes", "--package=@ontologic/pillowfort-agent@1.1.2", "--", "pillowfort-agent", "mcp", "--url", "https://pillowfort.xyz"]
+args = ["exec", "--yes", "--package=@ontologic/pillowfort-agent@1.1.4", "--", "pillowfort-agent", "mcp", "--url", "https://pillowfort.xyz"]
 startup_timeout_sec = 120
 tool_timeout_sec = 60
 ```
@@ -160,7 +160,7 @@ Local VS Code uses `type: "stdio"`, `command: "npm"`, and the same argument arra
 A bounded, real two-agent demonstration is available:
 
 ```sh
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent autonomous --url https://pillowfort.xyz
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent autonomous --url https://pillowfort.xyz
 ```
 
 Running it authorizes one room, a private invitation between its isolated host/guest, exact fingerprint approval, two encrypted messages, and room teardown. It prints safe step outcomes, not invitations or transcripts. It does not send invitations to external recipients.

package/docs/agents/security.md

@@ -58,6 +58,24 @@ These versions reject the compromised October 2026 eMudhra/emSign TLS chains,
 including cross-signed chains. Update the runtime binaries as well as OS/browser
 trust stores; never disable certificate verification to work around a failure.
 
+Release 1.1.4 pins Playwright 1.65.0 with Chromium 158.0.8127.18. Upgrade the
+package and explicitly rerun `install-browser`; an older cached browser is not
+patched by updating npm metadata alone. This replaces the browser affected by
+the known-exploited V8 CVEs CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.
+The Node/Bun minimums above also include the Brotli fix for CVE-2026-111497.
+The CLI and direct SDK constructor enforce the same Node release policy before
+browser startup or an app connection. Runtime package managers and unrelated
+scripts are outside that guard: upgrade the actual Node and Bun executables.
+
+The MLS adapter supports only ciphersuite 1
+(X25519/AES-128-GCM/SHA-256/Ed25519). Its pinned providers exclude unused
+Weierstrass-curve backends and their affected `crypto-bigint` dependency
+([RUSTSEC-2026-0387](https://rustsec.org/advisories/RUSTSEC-2026-0387.html)).
+Other ciphersuites, signature schemes, and HPKE configurations fail closed;
+there is no fallback to a different algorithm. The rebuilt WASM retains the
+existing room wire and snapshot formats. Maintained timer dependencies replace
+`instant` and `pin-utils`; neither maintenance notice was a confirmed exploit.
+
 Each room session is an isolated ephemeral browser context with its own device identity and MLS state. Session storage is not a durable account. `session_close`, process EOF, or process termination destroys local contexts and their keys. The transport does not export raw MLS keys or persist browser session state for room continuity. The caller, MCP host, and model provider may separately retain tool calls/results; protect those systems and minimize secret exposure.
 
 The optional CMS context is separate and uses normal authenticated permissions. Room hosting does not require CMS login, CMS storage state, a Pillowfort account, or automated checkout. Do not grant CMS tools or share CMS storage-state files for a room-only task.

package/docs/agents/workflows.md

@@ -9,7 +9,7 @@ An agent may host its own room and invite people or other agents under the calle
 Use local or hosted MCP tools with the same session/input envelope. Authenticate the hosted endpoint as described in the [setup guide](https://about.pillowfort.xyz/agents/index.md). For the local JSON-lines interface, keep this process running:
 
 ```sh
-npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent jsonl --url https://pillowfort.xyz
+npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent jsonl --url https://pillowfort.xyz
 ```
 
 The examples below are JSON-lines requests. In MCP, invoke the value of `tool` with the object in `arguments`; omit the JSON-lines envelope and `id`. Replace capitalized placeholders with values obtained at the stated step. They are not real room IDs or credentials. **Do not pipe all examples blindly:** creation, membership, and delivery are asynchronous, and later steps require fresh observations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ontologic/pillowfort-agent",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Local browser-backed Pillowfort agent SDK, JSON-lines CLI, and stdio MCP server for ephemeral encrypted rooms.",
   "type": "module",
   "license": "MIT",
@@ -30,6 +30,7 @@
   "files": [
     "scripts/agent.mjs",
     "scripts/agent-sdk.mjs",
+    "scripts/agent-runtime.mjs",
     "scripts/agent-browser.mjs",
     "scripts/agent-common.mjs",
     "scripts/agent-tools.mjs",
@@ -43,7 +44,7 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.32.2",
-    "playwright": "1.59.1"
+    "playwright": "1.65.0"
   },
   "publishConfig": {
     "access": "public",

package/scripts/agent-mcp.mjs

@@ -9,9 +9,9 @@ import { AGENT_INSTRUCTIONS, AGENT_RESOURCES, listAgentPrompts, readAgentResourc
 /** Dynamic JSON Schema catalogs require the SDK's lower-level Server API. */
 export function createAgentMcpServer({
   agent, tools = [], instructions = AGENT_INSTRUCTIONS, resources = AGENT_RESOURCES,
-  resourceLoader = readAgentResource, roomTools, includeCMS = true, maxActiveCalls = 64, jsonSchemaValidator, onToolError,
+  resourceLoader = readAgentResource, roomTools, includeCMS = true, maxActiveCalls = 64, jsonSchemaValidator, onToolError, observeToolCall,
 }) {
-  const server = new Server({ name: 'pillowfort', version: '1.1.2' }, {
+  const server = new Server({ name: 'pillowfort', version: '1.1.4' }, {
     capabilities: { tools: {}, resources: {}, prompts: {} },
     instructions,
     jsonSchemaValidator,
@@ -35,17 +35,20 @@ export function createAgentMcpServer({
     }
   });
   server.setRequestHandler(CallToolRequestSchema, async request => {
-    if (activeCalls >= maxActiveCalls) return toolResult(errorResult(new AgentError('BUSY', 'Too many pending tool calls. Wait for existing calls to finish.', true)));
-    activeCalls++;
-    try {
-      let tool;
-      try { tool = (await registry()).get(request.params.name); }
-      catch (error) { return toolResult(errorResult(error)); }
-      if (!tool) throw new McpError(ErrorCode.InvalidParams, 'Unknown tool. Call tools/list to discover available tools.');
-      const result = await tool.invoke(request.params.arguments ?? {});
-      if (result.ok === false) onToolError?.(result.error);
-      return toolResult(result);
-    } finally { activeCalls--; }
+    const invoke = async () => {
+      if (activeCalls >= maxActiveCalls) return errorResult(new AgentError('BUSY', 'Too many pending tool calls. Wait for existing calls to finish.', true));
+      activeCalls++;
+      try {
+        let tool;
+        try { tool = (await registry()).get(request.params.name); }
+        catch (error) { return errorResult(error); }
+        if (!tool) throw new McpError(ErrorCode.InvalidParams, 'Unknown tool. Call tools/list to discover available tools.');
+        const result = await tool.invoke(request.params.arguments ?? {});
+        if (result.ok === false) onToolError?.(result.error);
+        return result;
+      } finally { activeCalls--; }
+    };
+    return toolResult(await (observeToolCall ? observeToolCall(request.params.name, invoke) : invoke()));
   });
   return server;
 }

package/scripts/agent-runtime.mjs

@@ -0,0 +1,14 @@
+import { AgentError } from './agent-common.mjs';
+
+/** Enforce the patched Node release policy before local browser use. */
+export function checkRuntime() {
+  const [major, minor, patch] = process.versions.node.split('.').map(Number);
+  const supported = (major === 22 && (minor > 23 || (minor === 23 && patch >= 4)))
+    || (major === 24 && (minor > 22 || (minor === 22 && patch >= 1)))
+    || (major === 26 && (minor > 12 || (minor === 12 && patch >= 1)))
+    || major > 26;
+  if (!supported) {
+    throw new AgentError('UNSUPPORTED_RUNTIME', 'Pillowfort agent requires patched Node 22.23.4+, 24.22.1+, or 26.12.1+ on a supported release line. Upgrade Node before installing Chromium or connecting to an app.');
+  }
+  return { node: process.version, minimum: '^22.23.4 || ^24.22.1 || >=26.12.1', platform: process.platform, arch: process.arch };
+}

package/scripts/agent-sdk.mjs

@@ -1,6 +1,7 @@
 import { chromium } from 'playwright';
 import { PillowfortBrowserAgent } from './agent-browser.mjs';
 import { AgentError } from './agent-common.mjs';
+import { checkRuntime } from './agent-runtime.mjs';
 
 export { AgentError, errorResult, boundedJSON, validateBaseURL, MAX_INPUT_BYTES, MAX_OUTPUT_BYTES, MAX_WAIT_MS } from './agent-common.mjs';
 
@@ -8,6 +9,7 @@ export { AgentError, errorResult, boundedJSON, validateBaseURL, MAX_INPUT_BYTES,
 export class PillowfortAgent extends PillowfortBrowserAgent {
   /** @param {Omit<import('./agent-browser.mjs').BrowserAgentOptions, 'launchBrowser'> & {headed?: boolean}} options */
   constructor({ headed = false, ...options } = {}) {
+    checkRuntime();
     super({
       ...options,
       launchBrowser: async ({ timeout }) => {

package/scripts/agent.mjs

@@ -5,6 +5,7 @@ import { realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { PillowfortAgent, AgentError, errorResult, boundedJSON, MAX_INPUT_BYTES, MAX_OUTPUT_BYTES } from './agent-sdk.mjs';
+import { checkRuntime } from './agent-runtime.mjs';
 import { createAgentToolRegistry } from './agent-tools.mjs';
 import { runAgentMcp } from './agent-mcp.mjs';
 
@@ -12,7 +13,7 @@ const HELP = `Pillowfort agent CLI — real ephemeral encrypted browser sessions
 
 This local CLI requires Node 22.23.4+, 24.22.1+, or 26.12.1+ on a supported release line, and Chromium. Hosted MCP and native WebMCP are separate connection choices: https://about.pillowfort.xyz/agents
 Version-pinned npm package:
-  npm exec --yes --package=@ontologic/pillowfort-agent@1.1.2 -- pillowfort-agent --help
+  npm exec --yes --package=@ontologic/pillowfort-agent@1.1.4 -- pillowfort-agent --help
 
 Commands with the installed executable:
   pillowfort-agent install-browser
@@ -166,18 +167,6 @@ function diagnostic(error) {
   process.stderr.write(`${failure.code}: ${failure.message}\n`);
 }
 
-function checkRuntime() {
-  const [major, minor, patch] = process.versions.node.split('.').map(Number);
-  const supported = (major === 22 && (minor > 23 || (minor === 23 && patch >= 4)))
-    || (major === 24 && (minor > 22 || (minor === 22 && patch >= 1)))
-    || (major === 26 && (minor > 12 || (minor === 12 && patch >= 1)))
-    || major > 26;
-  if (!supported) {
-    throw new AgentError('UNSUPPORTED_RUNTIME', 'Pillowfort agent requires patched Node 22.23.4+, 24.22.1+, or 26.12.1+ on a supported release line. Upgrade Node before installing Chromium or connecting to an app.');
-  }
-  return { node: process.version, minimum: '^22.23.4 || ^24.22.1 || >=26.12.1', platform: process.platform, arch: process.arch };
-}
-
 function playwrightInstallation() {
   const require = createRequire(import.meta.url);
   return {