@opentabs-dev/browser-extension 0.0.34

package/dist/plugin-storage.js

@@ -0,0 +1,100 @@
+import { PLUGINS_META_KEY } from './constants.js';
+/**
+ * Write-through in-memory cache of plugin metadata.
+ * Populated on first read, kept in sync on every write.
+ * Avoids redundant async chrome.storage.local reads on hot paths
+ * (tabs.onUpdated, tab state checks).
+ */
+let metaCache = null;
+/** Serializes all write operations to prevent concurrent read-modify-write races. */
+let writeMutex = Promise.resolve();
+const serialize = (fn) => {
+    const result = writeMutex.then(fn);
+    writeMutex = result.then(() => { }, () => { });
+    return result;
+};
+/**
+ * Store a batch of plugins in a single chrome.storage.local.set() call.
+ * Builds the full meta index in memory and writes the meta index atomically.
+ */
+const storePluginsBatch = (metas) => serialize(async () => {
+    if (metas.length === 0)
+        return;
+    const index = await getAllPluginMeta();
+    for (const meta of metas) {
+        index[meta.name] = meta;
+    }
+    await chrome.storage.local.set({ [PLUGINS_META_KEY]: index });
+    metaCache = index;
+});
+const removePlugin = (pluginName) => serialize(async () => {
+    const index = await getAllPluginMeta();
+    if (!(pluginName in index))
+        return;
+    const { [pluginName]: _, ...rest } = index;
+    await chrome.storage.local.set({ [PLUGINS_META_KEY]: rest });
+    metaCache = rest;
+});
+/**
+ * Remove multiple plugins in a single batched operation.
+ * Reads the meta index once, removes all named plugins, then writes the
+ * updated index in one call.
+ */
+const removePluginsBatch = (pluginNames) => serialize(async () => {
+    if (pluginNames.length === 0)
+        return;
+    const index = await getAllPluginMeta();
+    const removeSet = new Set(pluginNames);
+    const filtered = {};
+    for (const [name, meta] of Object.entries(index)) {
+        if (!removeSet.has(name)) {
+            filtered[name] = meta;
+        }
+    }
+    await chrome.storage.local.set({ [PLUGINS_META_KEY]: filtered });
+    metaCache = filtered;
+});
+const VALID_TRUST_TIERS = new Set(['official', 'community', 'local']);
+const isValidPluginMeta = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const obj = value;
+    return (typeof obj.name === 'string' &&
+        typeof obj.version === 'string' &&
+        Array.isArray(obj.urlPatterns) &&
+        typeof obj.trustTier === 'string' &&
+        VALID_TRUST_TIERS.has(obj.trustTier) &&
+        Array.isArray(obj.tools));
+};
+const getAllPluginMeta = async () => {
+    if (metaCache !== null) {
+        return { ...metaCache };
+    }
+    const data = await chrome.storage.local.get(PLUGINS_META_KEY);
+    const index = data[PLUGINS_META_KEY];
+    if (!index || typeof index !== 'object') {
+        metaCache = {};
+        return {};
+    }
+    const validated = {};
+    for (const [key, value] of Object.entries(index)) {
+        if (isValidPluginMeta(value)) {
+            validated[key] = value;
+        }
+        else {
+            console.warn(`[opentabs] Skipping corrupted plugin meta entry: ${key}`);
+        }
+    }
+    metaCache = validated;
+    return { ...validated };
+};
+const getPluginMeta = async (pluginName) => {
+    const index = await getAllPluginMeta();
+    return index[pluginName];
+};
+/** Invalidate the in-memory cache, forcing the next read to hit chrome.storage.local. */
+const invalidatePluginCache = () => {
+    metaCache = null;
+};
+export { storePluginsBatch, removePlugin, removePluginsBatch, getAllPluginMeta, getPluginMeta, invalidatePluginCache };
+//# sourceMappingURL=plugin-storage.js.map

package/dist/plugin-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-storage.js","sourceRoot":"","sources":["../src/plugin-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD;;;;;GAKG;AACH,IAAI,SAAS,GAAsC,IAAI,CAAC;AAExD,qFAAqF;AACrF,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,SAAS,GAAG,CAAI,EAAoB,EAAc,EAAE;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,UAAU,GAAG,MAAM,CAAC,IAAI,CACtB,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAAmB,EAAiB,EAAE,CAC/D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAiB,EAAE,CACzD,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,WAAqB,EAAiB,EAAE,CAClE,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,SAAS,GAAG,QAAQ,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAuB,EAAE;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC9B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;QACpC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CACzB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,IAAyC,EAAE;IACvE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,SAAS,GAAG,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,oDAAoD,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,SAAS,GAAG,SAAS,CAAC;IACtB,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,UAAkB,EAAmC,EAAE;IAClF,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC,CAAC;AAEF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/rate-limiter.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sliding window rate limiter for browser commands.
+ *
+ * Tracks request timestamps per method and rejects requests that exceed the
+ * configured limit within the window. Timestamps older than the window are
+ * lazily pruned on each check to prevent unbounded memory growth.
+ */
+/**
+ * Check whether a request for the given method is allowed under the rate limit.
+ * Returns true if the request is allowed, false if it should be rejected.
+ *
+ * @param now - Optional timestamp override (milliseconds). Defaults to Date.now().
+ *              Exposed for deterministic testing without global Date mocks.
+ */
+export declare const checkRateLimit: (method: string, now?: number) => boolean;
+/** Clear all rate limiter state. Exposed for test isolation. */
+export declare const resetRateLimiter: () => void;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiCH;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,MAAK,MAAmB,KAAG,OAiBzE,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,QAAO,IAEnC,CAAC"}

package/dist/rate-limiter.js

@@ -0,0 +1,53 @@
+/**
+ * Sliding window rate limiter for browser commands.
+ *
+ * Tracks request timestamps per method and rejects requests that exceed the
+ * configured limit within the window. Timestamps older than the window are
+ * lazily pruned on each check to prevent unbounded memory growth.
+ */
+/** Per-method rate limit configuration */
+const METHOD_LIMITS = new Map([
+    // Expensive operations — tight limits
+    ['browser.screenshotTab', { maxRequests: 2, windowMs: 1_000 }],
+    ['browser.enableNetworkCapture', { maxRequests: 2, windowMs: 1_000 }],
+    ['browser.executeScript', { maxRequests: 15, windowMs: 1_000 }],
+    // Tool dispatch — allow bursts of sequential/concurrent tool calls from agents
+    ['tool.dispatch', { maxRequests: 30, windowMs: 1_000 }],
+]);
+/** Default limit for methods without a specific config */
+const DEFAULT_LIMIT = { maxRequests: 20, windowMs: 1_000 };
+/**
+ * Methods exempt from rate limiting. These are control/lifecycle methods that
+ * must always be processed (e.g., sync.full arrives once on connect, and
+ * extension.reload must never be delayed).
+ */
+const EXEMPT_METHODS = new Set(['extension.reload', 'sync.full', 'plugin.update', 'plugin.uninstall']);
+/** Sliding window timestamps per method */
+const methodTimestamps = new Map();
+/**
+ * Check whether a request for the given method is allowed under the rate limit.
+ * Returns true if the request is allowed, false if it should be rejected.
+ *
+ * @param now - Optional timestamp override (milliseconds). Defaults to Date.now().
+ *              Exposed for deterministic testing without global Date mocks.
+ */
+export const checkRateLimit = (method, now = Date.now()) => {
+    if (EXEMPT_METHODS.has(method))
+        return true;
+    const config = METHOD_LIMITS.get(method) ?? DEFAULT_LIMIT;
+    const cutoff = now - config.windowMs;
+    // Get existing timestamps and prune expired entries
+    const timestamps = (methodTimestamps.get(method) ?? []).filter(t => t > cutoff);
+    if (timestamps.length >= config.maxRequests) {
+        methodTimestamps.set(method, timestamps);
+        return false;
+    }
+    timestamps.push(now);
+    methodTimestamps.set(method, timestamps);
+    return true;
+};
+/** Clear all rate limiter state. Exposed for test isolation. */
+export const resetRateLimiter = () => {
+    methodTimestamps.clear();
+};
+//# sourceMappingURL=rate-limiter.js.map

package/dist/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,0CAA0C;AAC1C,MAAM,aAAa,GAAyC,IAAI,GAAG,CAAC;IAClE,sCAAsC;IACtC,CAAC,uBAAuB,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC,uBAAuB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAE/D,+EAA+E;IAC/E,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,aAAa,GAAoB,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE5E;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEvG,2CAA2C;AAC3C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE,EAAW,EAAE;IAClF,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IAErC,oDAAoD;IACpD,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAEhF,IAAI,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAS,EAAE;IACzC,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC,CAAC"}

package/dist/resource-prompt-dispatch.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Handle resource.read request from MCP server.
+ * Finds matching tabs, checks adapter readiness, executes the resource read,
+ * and returns the result.
+ */
+declare const handleResourceRead: (params: Record<string, unknown>, id: string | number) => Promise<void>;
+/**
+ * Handle prompt.get request from MCP server.
+ * Finds matching tabs, checks adapter readiness, executes the prompt render,
+ * and returns the result.
+ */
+declare const handlePromptGet: (params: Record<string, unknown>, id: string | number) => Promise<void>;
+export { handleResourceRead, handlePromptGet };
+//# sourceMappingURL=resource-prompt-dispatch.d.ts.map

package/dist/resource-prompt-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-prompt-dispatch.d.ts","sourceRoot":"","sources":["../src/resource-prompt-dispatch.ts"],"names":[],"mappings":"AAwLA;;;;GAIG;AACH,QAAA,MAAM,kBAAkB,GAAU,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,MAAM,GAAG,MAAM,KAAG,OAAO,CAAC,IAAI,CAiBpG,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,eAAe,GAAU,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,MAAM,GAAG,MAAM,KAAG,OAAO,CAAC,IAAI,CAgCjG,CAAC;AAEF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,CAAC"}

package/dist/resource-prompt-dispatch.js

@@ -0,0 +1,195 @@
+import { requireStringParam } from './browser-commands/helpers.js';
+import { SCRIPT_TIMEOUT_MS } from './constants.js';
+import { dispatchWithTabFallback, executeWithTimeout, resolvePlugin } from './dispatch-helpers.js';
+import { JSONRPC_INVALID_PARAMS } from './json-rpc-errors.js';
+import { sendToServer } from './messaging.js';
+/**
+ * Execute a resource read on a specific tab. Returns the structured result
+ * from the adapter script, or throws if the tab is inaccessible.
+ */
+const executeResourceReadOnTab = async (tabId, pluginName, resourceUri) => {
+    const scriptPromise = chrome.scripting.executeScript({
+        target: { tabId },
+        world: 'MAIN',
+        func: async (pName, uri) => {
+            const ot = globalThis.__openTabs;
+            const adapter = ot?.adapters?.[pName];
+            if (!adapter || typeof adapter !== 'object') {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" not injected or not ready` };
+            }
+            if (!Object.isFrozen(adapter)) {
+                return {
+                    type: 'error',
+                    code: -32002,
+                    message: `Adapter "${pName}" failed integrity check (not frozen)`,
+                };
+            }
+            if (typeof adapter.isReady !== 'function') {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" has no isReady function` };
+            }
+            let ready;
+            try {
+                ready = await adapter.isReady();
+            }
+            catch {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" isReady() threw an error` };
+            }
+            if (!ready) {
+                return {
+                    type: 'error',
+                    code: -32002,
+                    message: `Plugin "${pName}" is not ready (state: unavailable)`,
+                };
+            }
+            if (!Array.isArray(adapter.resources)) {
+                return { type: 'error', code: -32603, message: `Adapter "${pName}" has no resources array` };
+            }
+            const resource = adapter.resources.find((r) => r.uri === uri);
+            if (!resource || typeof resource.read !== 'function') {
+                return { type: 'error', code: -32603, message: `Resource "${uri}" not found in adapter "${pName}"` };
+            }
+            try {
+                const output = await resource.read(uri);
+                return { type: 'success', output };
+            }
+            catch (err) {
+                const caughtError = err;
+                return {
+                    type: 'error',
+                    code: -32603,
+                    message: caughtError.message ?? 'Resource read failed',
+                };
+            }
+        },
+        args: [pluginName, resourceUri],
+    });
+    return executeWithTimeout(scriptPromise, SCRIPT_TIMEOUT_MS, 'No result from resource read');
+};
+/**
+ * Execute a prompt render on a specific tab. Returns the structured result
+ * from the adapter script, or throws if the tab is inaccessible.
+ */
+const executePromptGetOnTab = async (tabId, pluginName, promptName, promptArgs) => {
+    const scriptPromise = chrome.scripting.executeScript({
+        target: { tabId },
+        world: 'MAIN',
+        func: async (pName, pPromptName, pArgs) => {
+            const ot = globalThis.__openTabs;
+            const adapter = ot?.adapters?.[pName];
+            if (!adapter || typeof adapter !== 'object') {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" not injected or not ready` };
+            }
+            if (!Object.isFrozen(adapter)) {
+                return {
+                    type: 'error',
+                    code: -32002,
+                    message: `Adapter "${pName}" failed integrity check (not frozen)`,
+                };
+            }
+            if (typeof adapter.isReady !== 'function') {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" has no isReady function` };
+            }
+            let ready;
+            try {
+                ready = await adapter.isReady();
+            }
+            catch {
+                return { type: 'error', code: -32002, message: `Adapter "${pName}" isReady() threw an error` };
+            }
+            if (!ready) {
+                return {
+                    type: 'error',
+                    code: -32002,
+                    message: `Plugin "${pName}" is not ready (state: unavailable)`,
+                };
+            }
+            if (!Array.isArray(adapter.prompts)) {
+                return { type: 'error', code: -32603, message: `Adapter "${pName}" has no prompts array` };
+            }
+            const prompt = adapter.prompts.find((p) => p.name === pPromptName);
+            if (!prompt || typeof prompt.render !== 'function') {
+                return {
+                    type: 'error',
+                    code: -32603,
+                    message: `Prompt "${pPromptName}" not found in adapter "${pName}"`,
+                };
+            }
+            try {
+                const output = await prompt.render(pArgs);
+                return { type: 'success', output };
+            }
+            catch (err) {
+                const caughtError = err;
+                return {
+                    type: 'error',
+                    code: -32603,
+                    message: caughtError.message ?? 'Prompt render failed',
+                };
+            }
+        },
+        args: [pluginName, promptName, promptArgs],
+    });
+    return executeWithTimeout(scriptPromise, SCRIPT_TIMEOUT_MS, 'No result from prompt render');
+};
+/**
+ * Handle resource.read request from MCP server.
+ * Finds matching tabs, checks adapter readiness, executes the resource read,
+ * and returns the result.
+ */
+const handleResourceRead = async (params, id) => {
+    const pluginName = requireStringParam(params, 'plugin', id);
+    if (!pluginName)
+        return;
+    const resourceUri = requireStringParam(params, 'uri', id);
+    if (!resourceUri)
+        return;
+    const plugin = await resolvePlugin(pluginName, id);
+    if (!plugin)
+        return;
+    await dispatchWithTabFallback({
+        id,
+        pluginName,
+        plugin,
+        operationName: 'resource read',
+        executeOnTab: tabId => executeResourceReadOnTab(tabId, pluginName, resourceUri),
+    });
+};
+/**
+ * Handle prompt.get request from MCP server.
+ * Finds matching tabs, checks adapter readiness, executes the prompt render,
+ * and returns the result.
+ */
+const handlePromptGet = async (params, id) => {
+    const pluginName = requireStringParam(params, 'plugin', id);
+    if (!pluginName)
+        return;
+    const promptName = requireStringParam(params, 'prompt', id);
+    if (!promptName)
+        return;
+    const rawArgs = params.arguments;
+    if (rawArgs !== undefined && rawArgs !== null && (typeof rawArgs !== 'object' || Array.isArray(rawArgs))) {
+        sendToServer({
+            jsonrpc: '2.0',
+            error: { code: JSONRPC_INVALID_PARAMS, message: 'Invalid "arguments" param (expected object)' },
+            id,
+        });
+        return;
+    }
+    const rawObj = (rawArgs ?? {});
+    const promptArgs = {};
+    for (const [key, val] of Object.entries(rawObj)) {
+        promptArgs[key] = String(val);
+    }
+    const plugin = await resolvePlugin(pluginName, id);
+    if (!plugin)
+        return;
+    await dispatchWithTabFallback({
+        id,
+        pluginName,
+        plugin,
+        operationName: 'prompt get',
+        executeOnTab: tabId => executePromptGetOnTab(tabId, pluginName, promptName, promptArgs),
+    });
+};
+export { handleResourceRead, handlePromptGet };
+//# sourceMappingURL=resource-prompt-dispatch.js.map

package/dist/resource-prompt-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-prompt-dispatch.js","sourceRoot":"","sources":["../src/resource-prompt-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C;;;GAGG;AACH,MAAM,wBAAwB,GAAG,KAAK,EACpC,KAAa,EACb,UAAkB,EAClB,WAAmB,EACM,EAAE;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE;QACjB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE;YACzC,MAAM,EAAE,GAAI,UAAsC,CAAC,UAatC,CAAC;YACd,MAAM,OAAO,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,6BAA6B,EAAE,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,YAAY,KAAK,uCAAuC;iBAClE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,2BAA2B,EAAE,CAAC;YACzG,CAAC;YAED,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,4BAA4B,EAAE,CAAC;YAC1G,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,WAAW,KAAK,qCAAqC;iBAC/D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,0BAA0B,EAAE,CAAC;YACxG,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACrD,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,GAAG,2BAA2B,KAAK,GAAG,EAAE,CAAC;YAChH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,WAAW,GAAG,GAA2B,CAAC;gBAChD,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,sBAAsB;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KAChC,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;AAC9F,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAAG,KAAK,EACjC,KAAa,EACb,UAAkB,EAClB,UAAkB,EAClB,UAAkC,EACT,EAAE;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE;QACjB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,KAA6B,EAAE,EAAE;YAChF,MAAM,EAAE,GAAI,UAAsC,CAAC,UAatC,CAAC;YACd,MAAM,OAAO,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,6BAA6B,EAAE,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,YAAY,KAAK,uCAAuC;iBAClE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,2BAA2B,EAAE,CAAC;YACzG,CAAC;YAED,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,4BAA4B,EAAE,CAAC;YAC1G,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,WAAW,KAAK,qCAAqC;iBAC/D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,wBAAwB,EAAE,CAAC;YACtG,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnD,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,WAAW,WAAW,2BAA2B,KAAK,GAAG;iBACnE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,WAAW,GAAG,GAA2B,CAAC;gBAChD,OAAO;oBACL,IAAI,EAAE,OAAgB;oBACtB,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,sBAAsB;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;AAC9F,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAA+B,EAAE,EAAmB,EAAiB,EAAE;IACvG,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,uBAAuB,CAAC;QAC5B,EAAE;QACF,UAAU;QACV,MAAM;QACN,aAAa,EAAE,eAAe;QAC9B,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC;KAChF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,eAAe,GAAG,KAAK,EAAE,MAA+B,EAAE,EAAmB,EAAiB,EAAE;IACpG,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzG,YAAY,CAAC;YACX,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,6CAA6C,EAAE;YAC/F,EAAE;SACH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,uBAAuB,CAAC;QAC5B,EAAE;QACF,UAAU;QACV,MAAM;QACN,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;KACxF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,CAAC"}

package/dist/sanitize-error.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Sanitize error messages before returning them to external clients.
+ * Strips absolute file paths, URLs, localhost references, and IP addresses
+ * to prevent leaking internal system details. Truncates to 500 characters.
+ */
+declare const sanitizeErrorMessage: (message: string) => string;
+export { sanitizeErrorMessage };
+//# sourceMappingURL=sanitize-error.d.ts.map

package/dist/sanitize-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-error.d.ts","sourceRoot":"","sources":["../src/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,QAAA,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MAkB/C,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/sanitize-error.js

@@ -0,0 +1,25 @@
+/**
+ * Sanitize error messages before returning them to external clients.
+ * Strips absolute file paths, URLs, localhost references, and IP addresses
+ * to prevent leaking internal system details. Truncates to 500 characters.
+ */
+const MAX_LENGTH = 500;
+const sanitizeErrorMessage = (message) => {
+    let sanitized = message
+        // Windows absolute paths: C:\path\to\file or C:/path/to/file
+        .replace(/[a-z]:[/\\][^\s,;)}\]]+/gi, '[PATH]')
+        // Unix absolute paths: /path/to/file (at least 2 segments to avoid false positives like "/")
+        .replace(/\/[a-z0-9._-]+(?:\/[a-z0-9._-]+)+/gi, '[PATH]')
+        // Full URLs with protocol
+        .replace(/https?:\/\/[^\s,;)}\]]+/gi, '[URL]')
+        // localhost with port
+        .replace(/localhost:\d+/gi, '[LOCALHOST]')
+        // IPv4 addresses
+        .replace(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g, '[IP]');
+    if (sanitized.length > MAX_LENGTH) {
+        sanitized = sanitized.slice(0, MAX_LENGTH - 3) + '...';
+    }
+    return sanitized;
+};
+export { sanitizeErrorMessage };
+//# sourceMappingURL=sanitize-error.js.map

package/dist/sanitize-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-error.js","sourceRoot":"","sources":["../src/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAU,EAAE;IACvD,IAAI,SAAS,GAAG,OAAO;QACrB,6DAA6D;SAC5D,OAAO,CAAC,2BAA2B,EAAE,QAAQ,CAAC;QAC/C,6FAA6F;SAC5F,OAAO,CAAC,qCAAqC,EAAE,QAAQ,CAAC;QACzD,0BAA0B;SACzB,OAAO,CAAC,2BAA2B,EAAE,OAAO,CAAC;QAC9C,sBAAsB;SACrB,OAAO,CAAC,iBAAiB,EAAE,aAAa,CAAC;QAC1C,iBAAiB;SAChB,OAAO,CAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;IAE1D,IAAI,SAAS,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAClC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/sanitize-svg.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SVG sanitizer for plugin icons rendered via dangerouslySetInnerHTML.
+ *
+ * Uses an element/attribute allowlist approach — only known-safe SVG elements
+ * and attributes are preserved. Everything else is stripped. This prevents XSS
+ * vectors including <script>, <foreignObject>, event handler attributes,
+ * javascript: URIs, and CSS-based attacks.
+ *
+ * Runs in the side panel context (browser DOM available) and is also testable
+ * in Bun's test runner (no DOM dependency — pure string processing).
+ */
+/**
+ * Sanitize an SVG string by stripping all elements and attributes not on the allowlist.
+ *
+ * Returns the sanitized SVG string safe for use with dangerouslySetInnerHTML.
+ * Returns an empty string for non-string or empty input.
+ */
+declare const sanitizeSvg: (svg: string) => string;
+export { sanitizeSvg };
+//# sourceMappingURL=sanitize-svg.d.ts.map

package/dist/sanitize-svg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-svg.d.ts","sourceRoot":"","sources":["../src/sanitize-svg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiPH;;;;;GAKG;AACH,QAAA,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MA2ElC,CAAC;AAEF,OAAO,EAAE,WAAW,EAAE,CAAC"}