@runtypelabs/persona 4.27.0 → 4.28.1

package/src/voice/voice.test.ts

@@ -896,7 +896,7 @@ describe('RuntypeVoiceProvider (realtime streaming)', () => {
 
       it('declares client_delegation (never the kebab form) only with a bridge and the switch on', async () => {
         const { ws } = await startDelegatedCall();
-        expect(ws.url).toBe(voiceUrl('wss://api.example.com', 'a1', [...BASE_CAPS, 'client_delegation', 'delegation_update', 'delegation_read_back']));
+        expect(ws.url).toBe(voiceUrl('wss://api.example.com', 'a1', [...BASE_CAPS, 'client_delegation', 'delegation_update', 'delegation_read_back', 'delegation_stream']));
         expect(ws.url).not.toContain('client-delegation');
         await startDelegatedCall({ clientDelegation: false });
         expect(lastWs().url).toBe(voiceUrl('wss://api.example.com', 'a1', BASE_CAPS));
@@ -1268,6 +1268,261 @@ describe('RuntypeVoiceProvider (realtime streaming)', () => {
         expect(sentJson(ws)).toEqual([]);
       });
 
+      describe('with delegation_stream negotiated', () => {
+        const STREAM_CAPS = [...ALL_CAPS, 'delegation_stream', 'delegation_read_back'];
+        const progress = (ws: MockWebSocket, delegationId: string, text = 'chunk') =>
+          ws.triggerMessage(JSON.stringify({ type: 'delegation_progress', delegationId, text }));
+
+        it('sends delegation_delta pieces in order, then the result with streamedChars', async () => {
+          const { ws, calls, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          delegate(ws, 'd1', 'hours?');
+          await flush();
+          expect(typeof calls[0].stream).toBe('function');
+          calls[0].stream!('We open at eight. ');
+          calls[0].stream!('We close at six.');
+          await flush();
+          expect(sentJson(ws)).toEqual([
+            { type: 'delegation_delta', delegationId: 'd1', text: 'We open at eight. ' },
+            { type: 'delegation_delta', delegationId: 'd1', text: 'We close at six.' },
+          ]);
+          pending[0]({ status: 'completed', text: 'We open at eight. We close at six.', streamedChars: 34 });
+          await flush();
+          expect(sentJson(ws).at(-1)).toEqual({
+            type: 'delegation_result',
+            delegationId: 'd1',
+            status: 'completed',
+            text: 'We open at eight. We close at six.',
+            streamedChars: 34,
+          });
+        });
+
+        it('omits streamedChars when nothing streamed, and puts it on a parked turn\'s update', async () => {
+          const { ws, calls, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          delegate(ws, 'd1', 'q');
+          await flush();
+          pending[0]({ status: 'completed', text: 'Answer.', streamedChars: 0 });
+          await flush();
+          expect(sentJson(ws)).toEqual([{ type: 'delegation_result', delegationId: 'd1', status: 'completed', text: 'Answer.' }]);
+
+          delegate(ws, 'd2', 'order');
+          await flush();
+          calls[1].stream!('I can place that order. ');
+          pending[1]({
+            status: 'pending_approval',
+            text: 'I can place that order.\n\nThis action needs approval.',
+            streamedChars: 23,
+            followUp: () => new Promise(() => {}),
+          });
+          await flush();
+          expect(sentJson(ws).slice(1)).toEqual([
+            { type: 'delegation_delta', delegationId: 'd2', text: 'I can place that order. ' },
+            {
+              type: 'delegation_update',
+              delegationId: 'd2',
+              status: 'pending_approval',
+              text: 'I can place that order.\n\nThis action needs approval.',
+              streamedChars: 23,
+            },
+          ]);
+        });
+
+        it('does not stream when delegation_read_back is missing (a multi-utterance read-back could not stay folded)', async () => {
+          const { ws, calls, pending } = await startDelegatedCall({}, { capabilities: [...ALL_CAPS, 'delegation_stream'] });
+          delegate(ws, 'd1', 'q');
+          await flush();
+          expect(calls[0]).not.toHaveProperty('stream');
+          pending[0]({ status: 'completed', text: 'Answer.', streamedChars: 7 });
+          await flush();
+          expect(sentJson(ws)).toEqual([{ type: 'delegation_result', delegationId: 'd1', status: 'completed', text: 'Answer.' }]);
+        });
+
+        it('a cancellation after progress disarms that delegation\'s fold, not another\'s', async () => {
+          const { ws, calls, transcripts } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          delegate(ws, 'd1', 'q');
+          await flush();
+          calls[0].stream!('It is sunny. ');
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(JSON.stringify({ type: 'delegation_cancelled', delegationId: 'dx', reason: 'deadline' }));
+          ws.triggerMessage(JSON.stringify({ type: 'delegation_cancelled', delegationId: 'd1', reason: 'provider_cancelled' }));
+          ws.triggerMessage(update('assistant', 'Something unrelated.', 'x1')); // read-back never started: renders
+          progress(ws, 'd1'); // cancelled: no frames, and no re-arm
+          ws.triggerMessage(update('assistant', 'Still here.', 'x2'));
+          expect(transcripts.map((t) => t[1])).toEqual(['Something unrelated.', 'Still here.']);
+        });
+
+        it('a refusing warning after progress disarms the fold too', async () => {
+          const { ws, calls, transcripts } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          delegate(ws, 'd1', 'q');
+          await flush();
+          calls[0].stream!('It is sunny. ');
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(JSON.stringify({ type: 'warning', code: 'UNKNOWN_DELEGATION', delegationId: 'd1' }));
+          ws.triggerMessage(update('assistant', 'Something unrelated.', 'x1'));
+          expect(transcripts.map((t) => t[1])).toEqual(['Something unrelated.']);
+        });
+
+        it('streams nothing (and sends no streamedChars) when the server did not grant it', async () => {
+          const { ws, calls, pending } = await startDelegatedCall();
+          delegate(ws, 'd1', 'q');
+          await flush();
+          expect(calls[0]).not.toHaveProperty('stream');
+          pending[0]({ status: 'completed', text: 'Answer.', streamedChars: 7 });
+          await flush();
+          expect(sentJson(ws)).toEqual([{ type: 'delegation_result', delegationId: 'd1', status: 'completed', text: 'Answer.' }]);
+        });
+
+        it('sends deltas after a slow call context, and nothing once the delegation is cancelled', async () => {
+          let resolveContext!: (text: string) => void;
+          const { ws, calls, pending } = await startDelegatedCall(
+            { callContext: () => new Promise<string>((resolve) => (resolveContext = resolve)) },
+            { capabilities: STREAM_CAPS },
+          );
+          delegate(ws, 'd1', 'q');
+          await flush();
+          calls[0].stream!('First piece. ');
+          await flush();
+          expect(sentJson(ws)).toEqual([]);
+          resolveContext('On /docs.');
+          await flush();
+          expect(sentJson(ws).map((f) => f.type)).toEqual(['context', 'delegation_delta']);
+          ws.triggerMessage(JSON.stringify({ type: 'delegation_cancelled', delegationId: 'd1', reason: 'provider_cancelled' }));
+          calls[0].stream!('Second piece.');
+          pending[0]({ status: 'completed', text: 'First piece. Second piece.', streamedChars: 26 });
+          await flush();
+          expect(sentJson(ws).map((f) => f.type)).toEqual(['context', 'delegation_delta']);
+        });
+
+        it('folds the read-back on the first delegation_progress, once per spoken phase', async () => {
+          const { provider, ws, calls, transcripts, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          const statuses: string[] = [];
+          provider.onStatusChange((s) => statuses.push(s));
+          ws.triggerMessage(update('assistant', 'Let me check.', 'f1'));
+          delegate(ws, 'd1', 'q');
+          await flush();
+          calls[0].stream!('It is sunny. ');
+          await flush();
+          progress(ws, 'd1', 'It is sunny.');
+          ws.triggerMessage(update('assistant', 'Let me check. Okay.', 'f1')); // the filler keeps updating
+          ws.triggerMessage(update('assistant', 'It is sunny.', 'r1')); // read-back: folded
+          progress(ws, 'd1', 'And warm.'); // a later chunk of the same phase
+          ws.triggerMessage(update('assistant', 'It is sunny. And warm.', 'r1'));
+          pending[0]({ status: 'completed', text: 'It is sunny. And warm.', streamedChars: 13 });
+          await flush();
+          completed(ws, 'd1'); // the phase ends: no second fold
+          ws.triggerMessage(update('assistant', 'Anything else?', 'a2'));
+          expect(transcripts.map((t) => t[1])).toEqual(['Let me check.', 'Let me check. Okay.', 'Anything else?']);
+          // Progress keeps the call "processing" until delegation_completed.
+          expect(statuses.filter((s) => s !== 'processing')).toEqual(['listening']);
+        });
+
+        it('folds a single-shot result\'s read-back on progress, and ignores progress for delegations it did not answer', async () => {
+          const { ws, transcripts, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          progress(ws, 'dx');
+          ws.triggerMessage(update('assistant', 'Hello there.', 'g1')); // unrelated: renders
+          delegate(ws, 'd1', 'q');
+          await flush();
+          pending[0]({ status: 'completed', text: 'It is sunny.' });
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(update('assistant', 'It is sunny.', 'r1'));
+          ws.triggerMessage(update('user', 'thanks', 'u2'));
+          ws.triggerMessage(update('assistant', 'You are welcome.', 'a2'));
+          expect(transcripts.map((t) => t[1])).toEqual(['Hello there.', 'thanks', 'You are welcome.']);
+        });
+
+        it('folds again for a later spoken phase (the approval outcome)', async () => {
+          const { ws, transcripts, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          let settle!: (f: VoiceDelegationFollowUp | null) => void;
+          delegate(ws, 'd1', 'order');
+          await flush();
+          pending[0]({ status: 'pending_approval', text: 'Approve it.', followUp: () => new Promise((r) => (settle = r)) });
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(update('assistant', 'Please approve it.', 'r1'));
+          completed(ws, 'd1', false);
+          settle({ status: 'completed', text: 'Order placed.' });
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(update('assistant', 'Your order is placed.', 'r2'));
+          completed(ws, 'd1');
+          ws.triggerMessage(update('assistant', 'Anything else?', 'a3'));
+          expect(transcripts.map((t) => t[1])).toEqual(['Anything else?']);
+        });
+
+        it('folds an untagged read-back after delegation_progress on a tag-negotiated server (the cut-filler continuation)', async () => {
+          const { ws, calls, transcripts, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          const frame = (turnId: string, text: string, final: boolean, delegationId?: string) =>
+            ws.triggerMessage(
+              JSON.stringify({ type: 'transcript_update', role: 'assistant', text, utteranceId: turnId, final, delegationId }),
+            );
+          // GPT-Live's filler A is streaming when the delegation starts.
+          frame('a1', 'Let me check', false);
+          delegate(ws, 'd1', 'hours?');
+          await flush();
+          calls[0].stream!("We're open Monday to Friday from 8 to 6. ");
+          await flush();
+          expect(sentJson(ws).map((f) => f.type)).toEqual(['delegation_delta']);
+          // Core cuts A (its final carries the start of the answer), reports progress...
+          frame('a1', "Let me check on that for you. We're open Monday", true);
+          progress(ws, 'd1');
+          // ...and GPT-Live continues in a NEW utterance B that nobody tagged: folded.
+          frame('b1', 'to Friday from 8 to 6.', false);
+          frame('b1', 'to Friday from 8 to 6. Saturday 9 to 4.', true);
+          pending[0]({ status: 'completed', text: "We're open Monday to Friday from 8 to 6.", streamedChars: 40 });
+          await flush();
+          completed(ws, 'd1'); // the tag server's completion arms nothing
+          frame('n1', 'Anything else?', true); // renders
+          // A later read-back tagged with the delegation folds by its tag.
+          ws.triggerMessage(update('user', 'and sundays', 'u2'));
+          frame('c1', 'Closed on Sundays.', true, 'd1');
+          expect(transcripts.map((t) => t[1])).toEqual([
+            'Let me check',
+            "Let me check on that for you. We're open Monday",
+            'Anything else?',
+            'and sundays',
+          ]);
+        });
+
+        it('a user transcript clears a progress-armed fold, and a tag fold consumes it (tag-negotiated server)', async () => {
+          const { ws, calls, transcripts, pending } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          const frame = (turnId: string, text: string, delegationId?: string) =>
+            ws.triggerMessage(
+              JSON.stringify({ type: 'transcript_update', role: 'assistant', text, utteranceId: turnId, final: true, delegationId }),
+            );
+          delegate(ws, 'd1', 'order');
+          await flush();
+          calls[0].stream!('I can do that. ');
+          await flush();
+          progress(ws, 'd1');
+          ws.triggerMessage(update('user', 'wait', 'u1')); // the visitor spoke first: disarmed
+          frame('x1', 'Sure, go ahead.'); // renders
+          progress(ws, 'd1'); // same phase: no re-arm
+          frame('x2', 'Still here.'); // renders
+          // The approval ask ends that phase; the outcome's phase arms again.
+          pending[0]({ status: 'pending_approval', text: 'I can do that.\n\nApprove it.', streamedChars: 14, followUp: () => new Promise(() => {}) });
+          await flush();
+          completed(ws, 'd1', false);
+          progress(ws, 'd1');
+          frame('r2', 'Your order is placed.', 'd1'); // folded by its tag, consuming the armed fold
+          frame('x3', 'Anything else?'); // renders
+          expect(transcripts.map((t) => t[1])).toEqual(['wait', 'Sure, go ahead.', 'Still here.', 'Anything else?']);
+        });
+
+        it('folds a tagged read-back that starts while the answer is still streaming (delegation_read_back)', async () => {
+          const { ws, calls, transcripts } = await startDelegatedCall({}, { capabilities: STREAM_CAPS });
+          delegate(ws, 'd1', 'q');
+          await flush();
+          calls[0].stream!('It is sunny. ');
+          await flush();
+          ws.triggerMessage(
+            JSON.stringify({ type: 'transcript_update', role: 'assistant', text: 'It is sunny.', utteranceId: 'r1', final: false, delegationId: 'd1' }),
+          );
+          expect(transcripts).toEqual([]);
+        });
+      });
+
       describe('approval lifecycle (delegation_update, then one terminal delegation_result)', () => {
         /** A parked result whose follow-up the test settles, recording the options it got. */
         const parked = () => {
@@ -1838,7 +2093,7 @@ describe('RuntypeVoiceProvider prewarm', () => {
       provider.setSessionBridge({ getHistory: () => [], runDelegatedTurn: async () => ({ status: 'completed', text: '' }) });
       provider.prewarm();
       expect(lastWs().url).toBe(
-        voiceUrl('wss://api.example.com', 'agent%2F1', ['attach', ...BASE_CAPS, 'client_delegation', 'delegation_update', 'delegation_read_back']),
+        voiceUrl('wss://api.example.com', 'agent%2F1', ['attach', ...BASE_CAPS, 'client_delegation', 'delegation_update', 'delegation_read_back', 'delegation_stream']),
       );
     });
 

package/src/webmcp-bridge.test.ts

@@ -8,13 +8,13 @@ import type {
 
 // ---------------------------------------------------------------------------
 // Mock the strict @mcp-b/webmcp-polyfill. The bridge dynamically imports it and
-// calls `initializeWebMCPPolyfill()` (idempotent install of document.modelContext).
+// calls `initializeWebMCPPolyfill()` for the v5 automatic fallback.
 // We stub the install as a no-op and provide `document.modelContext` ourselves,
 // modeling the strict producer-preview surface the bridge consumes:
 //   - getTools(): async; inputSchema in either generation (see
 //     `registry.schemaShape`); annotations only when the tool declared them
-//   - executeTool(info, argsJson, { signal }): async; validates+runs execute(),
-//     returns JSON.stringify(rawResult) or null; honors the abort signal.
+//   - executeTool(info, input, { signal }): async; runs execute(),
+//     returns JSON.stringify(rawResult); honors the abort signal.
 // ---------------------------------------------------------------------------
 
 const polyfillMock = { initThrows: false };
@@ -39,7 +39,7 @@ import {
 } from "./webmcp-bridge";
 import type { ClientToolDefinition } from "./types";
 
-type MockClient = { requestUserInteraction: (cb: () => unknown) => Promise<unknown> };
+type MockClient = { signal: AbortSignal };
 
 type MockTool = {
   name: string;
@@ -85,22 +85,22 @@ const makeModelContext = () => ({
                 : JSON.stringify(t.inputSchema),
           }),
       title: t.title ?? "",
+      window,
+      origin: location.origin,
       ...(t.annotations === undefined ? {} : { annotations: t.annotations }),
     }));
   },
   async executeTool(
     info: { name: string },
-    inputArgsJson: string,
+    input: object,
     options?: { signal?: AbortSignal },
   ): Promise<string | null> {
     if (options?.signal?.aborted) throw new Error("Tool execution was cancelled");
     const tool = registry.tools.find((t) => t.name === info.name);
     if (!tool) throw new Error(`Tool not found: ${info.name}`);
-    const args = inputArgsJson ? JSON.parse(inputArgsJson) : {};
-    // The polyfill owns this client; `requestUserInteraction` is a pass-through.
-    const client: MockClient = {
-      requestUserInteraction: async (cb) => cb(),
-    };
+    if (!input || typeof input !== "object") throw new TypeError("inputObject must be an object");
+    const args = input as Record<string, unknown>;
+    const client: MockClient = { signal: options?.signal ?? new AbortController().signal };
     const execPromise = Promise.resolve(tool.execute(args, client));
     const raced = options?.signal
       ? Promise.race<unknown>([
@@ -118,7 +118,9 @@ const makeModelContext = () => ({
         ])
       : execPromise;
     const raw = await raced;
-    return raw === undefined ? null : JSON.stringify(raw);
+    const json = JSON.stringify(raw);
+    if (json === undefined) throw new Error("Tool execution failed");
+    return json;
   },
 });
 
@@ -137,6 +139,7 @@ beforeEach(() => {
   polyfillMock.initThrows = false;
   registry.tools = [];
   registry.schemaShape = "object";
+  vi.stubGlobal("window", {});
   // location is read by snapshotForDispatch; document.modelContext is the
   // consumer surface. Both are absent in the Node test environment.
   vi.stubGlobal("location", { origin: "https://example.test" });
@@ -183,7 +186,7 @@ describe("WebMcpBridge.snapshotForDispatch", () => {
     expect(bridge.isOperational()).toBe(false);
   });
 
-  it("returns empty when initializeWebMCPPolyfill() throws", async () => {
+  it("returns empty when the fallback initializer throws", async () => {
     // No pre-existing modelContext: otherwise install() short-circuits
     // before importing the polyfill and the throwing init never runs.
     vi.stubGlobal("document", {});
@@ -331,7 +334,7 @@ describe("setWebMcpPolyfillLoader", () => {
     vi.stubGlobal("document", doc);
     registry.tools = [fakeTool({ name: "search" })];
     const loader = vi.fn(async () => ({
-      initializeWebMCPPolyfill: () => {
+      installWebMCP: () => {
         doc.modelContext = makeModelContext();
       },
     }));
@@ -457,7 +460,7 @@ describe("WebMcpBridge.executeToolCall", () => {
   it("warns once and degrades cleanly when document.modelContext is present but incompatible", async () => {
     // A different / older WebMCP polyfill (or divergent native draft) squats
     // document.modelContext without the strict getTools()/executeTool() surface.
-    // @mcp-b's initializeWebMCPPolyfill correctly declines to overwrite it, so
+    // @mcp-b's installWebMCP correctly declines to overwrite it, so
     // Persona must (a) report non-operational, (b) surface an actionable error
     // distinct from "not available", and (c) warn exactly once.
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => undefined);
@@ -531,32 +534,31 @@ describe("WebMcpBridge.executeToolCall", () => {
     expect(r).toEqual(shaped);
   });
 
-  it("normalizes an undefined return into an empty text block", async () => {
+  it("returns an error for a non-serializable undefined result", async () => {
     registry.tools = [fakeTool({ name: "act", execute: () => undefined })];
     const bridge = new WebMcpBridge({ enabled: true, onConfirm: allowAll });
     const r = await bridge.executeToolCall("webmcp:act", {});
-    expect(r).toEqual({ content: [{ type: "text", text: "" }] });
+    expect(r.isError).toBe(true);
   });
 
-  it("runs a tool's client.requestUserInteraction callback without a second confirm", async () => {
+  it("passes an invocation signal with a single confirmation", async () => {
     const confirmSpy = vi.fn(async () => true);
     registry.tools = [
       fakeTool({
         name: "sensitive",
         execute: async (_args, client) => {
-          const ack = await client.requestUserInteraction(async () => "ok!");
-          return { ack };
+          return { aborted: client.signal.aborted };
         },
       }),
     ];
     const bridge = new WebMcpBridge({ enabled: true, onConfirm: confirmSpy });
     const r = await bridge.executeToolCall("webmcp:sensitive", {});
-    // Only the single outer gate fires: the polyfill owns the in-tool callback.
+    // Only the single outer gate fires; the callback receives a cancellation signal.
     expect(confirmSpy).toHaveBeenCalledTimes(1);
     expect(r.isError).toBeUndefined();
     expect(r.content[0]).toEqual({
       type: "text",
-      text: JSON.stringify({ ack: "ok!" }),
+      text: JSON.stringify({ aborted: false }),
     });
   });
 
@@ -745,3 +747,67 @@ describe("computeClientToolsFingerprint: diff-only / send-once", () => {
     expect(fp.length).toBeLessThanOrEqual(128);
   });
 });
+
+describe("v6 local-document boundary", () => {
+  it("installs via the current lazy-module export", async () => {
+    const context = makeModelContext();
+    registry.tools = [fakeTool({ name: "local" })];
+    vi.stubGlobal("document", {});
+    setWebMcpPolyfillLoader(async () => ({
+      installWebMCP: () => { vi.stubGlobal("document", { modelContext: context }); },
+    }));
+    const snapshot = await new WebMcpBridge({ enabled: true }).snapshotForDispatch();
+    expect(snapshot.map(tool => tool.name)).toEqual(["local"]);
+  });
+
+  it("excludes other frames from snapshots and same-name execution", async () => {
+    const localWindow = {};
+    vi.stubGlobal("window", localWindow);
+    const local = { name: "shared", description: "Local", title: "Local title", origin: location.origin, window: localWindow };
+    const remote = { ...local, description: "Remote", title: "Remote title", window: {} };
+    vi.stubGlobal("document", { modelContext: {
+      getTools: async () => [remote, local, { ...remote, name: "remote_only" }],
+      executeTool: async (info: unknown) => JSON.stringify(info === local ? "local" : "remote"),
+    } });
+    const consumer = new WebMcpBridge({ enabled: true, onConfirm: allowAll });
+    const snapshot = await consumer.snapshotForDispatch();
+    expect(snapshot.map(tool => tool.name)).toEqual(["shared"]);
+    expect(getWebMcpToolDisplayTitle("shared")).toBe("Local title");
+    expect(await consumer.executeToolCall("webmcp:shared", {})).toEqual({ content: [{ type: "text", text: "local" }] });
+    expect((await consumer.executeToolCall("webmcp:remote_only", {})).isError).toBe(true);
+  });
+});
+
+describe("polyfill initializer compatibility", () => {
+  it("accepts the legacy initializer used by the automatic fallback", async () => {
+    vi.stubGlobal("document", {});
+    const initializeWebMCPPolyfill = vi.fn(() => {
+      vi.stubGlobal("document", { modelContext: makeModelContext() });
+    });
+    setWebMcpPolyfillLoader(async () => ({ initializeWebMCPPolyfill }));
+    const bridge = new WebMcpBridge({ enabled: true });
+    await bridge.snapshotForDispatch();
+    expect(initializeWebMCPPolyfill).toHaveBeenCalledTimes(1);
+    expect(bridge.isOperational()).toBe(true);
+  });
+});
+
+describe("native preview argument conversion", () => {
+  it("supports DOMString coercion without relying on polyfill metadata", async () => {
+    const nativeExecute = vi.fn(async (_tool: unknown, input: unknown) => {
+      // WebIDL converts an object to DOMString before the native JSON parser.
+      return JSON.stringify({ received: JSON.parse(String(input)) });
+    });
+    vi.stubGlobal("document", {
+      modelContext: {
+        getTools: async () => [{ name: "native", description: "Native preview tool" }],
+        executeTool: nativeExecute,
+      },
+    });
+    const consumer = new WebMcpBridge({ enabled: true, onConfirm: allowAll });
+    expect(await consumer.executeToolCall("webmcp:native", { count: 2 })).toEqual({
+      content: [{ type: "text", text: '{"received":{"count":2}}' }],
+    });
+    expect(nativeExecute).toHaveBeenCalledTimes(1);
+  });
+});

package/src/webmcp-bridge.ts

@@ -14,26 +14,19 @@
  * enforcement live on the Runtype API; this bridge mirrors those checks
  * client-side as a usability convenience, not a security boundary.
  *
- * About `@mcp-b/webmcp-polyfill`: it polyfills the *strict standard surface*
- * only (`registerTool` / `getTools` / `executeTool` on `document.modelContext`),
- * with no MCP-B-only extensions. The spec standardizes the *producer* side;
- * Persona is an in-page *consumer*, so it reads the registry via the
- * producer-facing preview API:
- *   - `getTools()`: async; returns `{ name, description, inputSchema }` where
- *     `inputSchema` is a JSON *string*. Annotations are not exposed here.
- *   - `executeTool(toolInfo, inputArgsJson, { signal })`: async; validates args
- *     against the tool's schema, runs `execute()`, and returns the raw result as
- *     a JSON *string* (or `null` for `undefined`). Honors `signal` for abort.
+ * Supports v5's JSON-string input and v6's object input with a single call:
+ * the runtime passes a JSON object that also string-coerces to JSON text.
+ * Never infer the execution contract from metadata or retry a failed call.
+ * Only tools owned by this document are exposed: the wire addresses tools by
+ * name, not by frame. Callbacks must validate their own input.
  *
- * The polyfill auto-installs `document.modelContext` at module-evaluation time,
- * so it is imported *dynamically* and only when `config.webmcp.enabled === true`
- *: a static import would install the global for every widget consumer,
- * including those that never opted into WebMCP.
+ * The automatic fallback stays on v5 to preserve its browser requirements and
+ * result semantics. Host pages may install v5 or v6 themselves; Persona does
+ * not replace an existing context. v5's initializeWebMCPPolyfill() and v6's
+ * installWebMCP() are both accepted by custom loaders.
  *
- * Confirm model: every `webmcp:*` call goes through one confirm gate before
- * `execute()` runs, regardless of `annotations.readOnlyHint`. (The polyfill owns
- * the spec's `client.requestUserInteraction` callback internally; Persona cannot
- * inject a nested confirm there, so the single outer gate is the whole story.)
+ * Every call passes one confirm gate before execution, regardless of
+ * annotations.readOnlyHint. v6 callbacks also receive an invocation signal.
  */
 
 import type { ClientToolDefinition } from "./types";
@@ -59,18 +52,20 @@ export interface ModelContextToolInfo {
    * object. `@mcp-b/webmcp-polyfill` made the switch in v5, and Chrome ships it
    * from 154.0.8013 (cross-document tools first) -- but Chrome 149-153, most of
    * the Origin Trial population, and 154's same-document tools still emit the
-   * string. Both are live in the field, so we accept both.
+   * string. Both input execution contracts are supported independently of
+   * schema representation.
    *
    * Absent when the tool registered no schema: v5 omits the member, where v4
    * always emitted a `{"type":"object"}` string.
    */
   inputSchema?: object | string;
+  /** Owning frame and origin, when supplied by the registry. Never sent on the wire. */
+  window?: Window;
+  origin?: string;
   /**
    * Display title declared on the tool (`ToolDescriptor.title` in the WebMCP
    * spec). The polyfill returns `""` when the tool didn't declare one. Note:
-   * `annotations` (incl. the legacy `annotations.title`) are NOT exposed on
-   * this strict consumer surface: top-level `title` is the only display-name
-   * channel available to us.
+   * top-level `title` is the display-name channel, not `annotations.title`.
    */
   title?: string;
   /**
@@ -89,7 +84,7 @@ export interface ModelContextCoreLike {
   getTools(): Promise<ModelContextToolInfo[]>;
   executeTool(
     tool: ModelContextToolInfo,
-    inputArgsJson: string,
+    input: object | string,
     options?: { signal?: AbortSignal },
   ): Promise<string | null>;
 }
@@ -132,9 +127,9 @@ export const getWebMcpToolDisplayTitle = (
 ): string | undefined => webMcpToolDisplayTitles.get(stripWebMcpPrefix(toolName));
 
 /** The slice of `@mcp-b/webmcp-polyfill` the bridge consumes on install. */
-export type WebMcpPolyfillModule = {
-  initializeWebMCPPolyfill: () => void;
-};
+export type WebMcpPolyfillModule =
+  | { initializeWebMCPPolyfill: () => void }
+  | { installWebMCP: () => void };
 
 /**
  * Override how the polyfill module is obtained. By default the bridge does