@sema-agent/connector-browser 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this package are documented here. Released sections are
 frozen: once a version is published its section is never edited again; new text
 goes into the next version's section.
 
+## 0.2.3 (2026-10-31)
+
+### Changed
+
+- Re-pinned to `@sema-agent/connectors` 0.10.0 and `@sema-agent/connectors-contract` 0.2.1: the hosted http face answers every
+  `401` with a `WWW-Authenticate: Bearer` challenge and, for a URL audience, publishes its protected resource metadata
+  (CN-069); the error-code description no longer states an engine failure-kind mapping (CN-068); the idle-release line
+  rounds its seconds (CN-071). Nothing in this package's own code changed.
+
 ## 0.2.2 (2026-10-25)
 
 ### Changed

package/KNOWN-LIMITS.md

@@ -7,7 +7,7 @@ contract, or a long-lived transitional path: those are defects and get a ticket
 | ID | Symptom | Why it is not fixed | Trigger | Upgrade criterion |
 |---|---|---|---|---|
 | KL-01 | A standalone catalog entry names its configuration directory with an absolute `--config-dir`. After the directory is moved, or when the `mcp` domain is exported in a bundle to another machine, the entry still names the old path: the launcher finds no secrets there and reports `unauthorized`, and `mount` (and with it the seed) refuses the stale entry as a conflict until it is removed by hand. | The engine starts stdio connectors with a minimal environment, so the entry must carry the directory (CN-028); an absolute path is machine-local by nature, like the installed connector package the entry also depends on. The seed (CN-009) never overwrites an entry, so it does not repair one. | Moving the configuration directory; importing a bundle that carries connector entries. | The CLI wrapper (CN-012) rewriting entries on import, or an engine that hands its configuration directory to stdio connectors. |
-| KL-02 | The end-to-end gate pins `@sema-agent/server` 7.136.0 word for word in `test/negctl/CN-006.json`: the four helper invocations the server starts outside the egress probe (`ps`, two `git` commands and `/bin/bash`, each with its exact arguments) and the variables `MODEL_ID`, `MODEL_API_KEY` and `APPROVAL_GRANT` it needs for a local run. A server release that changes any of them turns the gate red until a person has reviewed the new invocations or variables and updated the fixture. The per-tool axes gate (CN-013) pins wording the same way in `test/negctl/CN-013.json`: the start of the line with which a local run of `@sema-agent/server` 7.136.0 reports a call it refused for want of a person, and the reason that line gives for each of the two refusals it expects (the engine's wording, `@sema-agent/core` 7.55.0). | The server documents neither its helper processes nor the minimal environment of a local run as a stable contract, nor the wording of a refused call (the engine gives no code per reason); the fixtures record what the pinned releases do, and a reviewed change is what the gates are for. | A new version of the `@sema-agent/server` development dependency. | The server documents these helpers and variables as a stable contract, or publishes a machine-readable minimal environment that the gate can read instead of the fixture; for the refusal wording, a refusal the server reports with a code per reason. |
+| KL-02 | The end-to-end gate pins `@sema-agent/server` 7.142.0 word for word in `test/negctl/CN-006.json`: the four helper invocations the server starts outside the egress probe (`ps`, two `git` commands and `/bin/bash`, each with its exact arguments; the `/bin/bash` one, the engine's project probe, names the task root it was given, which the fixture writes as `$taskRoot` and the gate fills with the run's working directory as given or resolved, shell-quoted the engine's way) and the variables `MODEL_ID`, `MODEL_API_KEY` and `APPROVAL_GRANT` it needs for a local run. A server release that changes any of them turns the gate red until a person has reviewed the new invocations or variables and updated the fixture. The per-tool axes gate (CN-013) pins wording the same way in `test/negctl/CN-013.json`: the start of the line with which a local run of `@sema-agent/server` 7.142.0 reports a call it refused for want of a person, and the reason that line gives for each of the two refusals it expects (the engine's wording, `@sema-agent/core` 7.60.0; unchanged since the fixture was recorded against 7.136.0 / 7.55.0). | The server documents neither its helper processes nor the minimal environment of a local run as a stable contract, nor the wording of a refused call (the engine gives no code per reason); the fixtures record what the pinned releases do, and a reviewed change is what the gates are for. | A new version of the `@sema-agent/server` development dependency. | The server documents these helpers and variables as a stable contract, or publishes a machine-readable minimal environment that the gate can read instead of the fixture; for the refusal wording, a refusal the server reports with a code per reason. |
 | KL-03 | On the hosted http face, `GET /status` answers `503` until a client has opened a session and the connector has answered `initialize`; a health probe on a fresh launcher sees an error although the launcher is fine (the compose healthcheck probes for the `401` instead). | The status lists the tools the caller sees, which only a running connector can tell; a `200` before that would carry an invented empty list, and the contract has no way to say "unknown". | Reading `/status` on a hosted launcher before any session, or after the session ended. | A `connector-status-v1` change that can state the tools as unknown, or a hosted launcher that starts its connector at boot (M2, with the token vault). |
 | KL-04 | A connector that takes none of its waiting input for 10 seconds is ended as "stalled" (`connector.internal` on every pending call; exit 5 on stdio), also when it is merely busy: a client that keeps sending more than the pipe holds while one tool runs synchronously for over 10 seconds loses its pending calls. A reader taking at least about 1 KiB per 10 seconds is not affected. | The launcher cannot tell "stopped reading" from "busy", and without the bound a connector that stops reading leaves the launcher and itself hanging when upstream only closes its pipe (CN-025). | A connector that blocks for more than 10 seconds while more input than the pipe buffer waits for it. | A connector protocol signal for "busy", or a measured need for a longer bound from a real connector (M1). |
 | KL-05 | A connector directory whose `.auth.lock` was left behind (a process killed while holding it, a power loss during `auth`) stops every launch of that connector: the launcher waits 5 seconds, exits 2 and names the lock; `auth` and `status` wait and refuse the same way, until someone removes the lock file by hand. | The lock is never guessed stale (a live holder could be slow), the same rule as the mount lock; a liveness check by pid would be wrong across machines and containers. | A crash or kill while a write or a launch snapshot holds the lock. | A lock that carries a lease the holder renews, or an operator command that removes a lock after checking its holder. |
@@ -36,4 +36,5 @@ contract, or a long-lived transitional path: those are defects and get a ticket
 | KL-30 | There is no media connector, and the media service's external contract list (its HTTP and console faces, and the refusal shape of its MCP tool face: an `isError: true` result whose text starts with `<code>: <text>`) is not consumed by anything in this repository. | The media connector is M4 work behind the hosted container (M2); until it is designed there is nothing to pin, and a ticket that only waits is not a debt. | Any media use case. | The M4 media connector design, which reads the service's list and takes its refusal shape into the contract review. |
 | KL-31 | A connector that changes its tool list at runtime is not re-read by the engine: the launcher forwards `notifications/tools/list_changed`, but the engine does not consume it, so a tool declared after the handshake is refused until the session is reconnected. | The consumer side is the engine's, and the engine has closed its ticket as a known limit; there is nothing in this repository to pin until the engine reads the notification. | A connector whose tool list changes while a session is open. | The engine consuming `tools/list_changed`; this repository then adds the positive control (the pointer ticket CN-018 is closed into this entry). |
 | KL-32 | After a person adds `toolAxes` (or any other member) to a connector's standalone entry in `config.d/mcp.json`, `mount` of that connector refuses with a conflict (exit 1) and leaves the entry as written, and a seed that has not yet recorded the connector reports it as `conflict` (exit 1). `list` no longer shows the connector as mounted (the entry is no longer exactly what `mount` would write) and `unmount` refuses to remove it (`unexpected_shape`, never deleting what it did not write): recovering the standalone catalog's own reading of the connector means removing the extended entry from `config.d/mcp.json` by hand. | `mount` compares the whole entry and never overwrites one; telling the deployment's members from its own would need a list of the catalog's members, which are the settings schema's (this repository defines no catalog types). | Running `mount`, `list` or `unmount`, or a first seed, after editing the entry by hand. | The CLI wrapper (CN-012) editing entries through `mount`, or a reader of the entry's deployment members exported by the settings schema. |
-| KL-33 | One entry anywhere in `config.d/mcp.json`'s `servers` that is nested too deep to compare (deeper than the shape comparison follows) makes `mount` and `unmount` of every connector in that configuration directory refuse with `unexpected_shape`, and `listMounted` refuse the whole call, not only the one entry: the post-write verification compares the whole list, so one unreadable entry means no write can be verified. | Answering for the other entries while one cannot be read would report a list shorter than the truth, or write a file whose verification is partial; refusing the whole call keeps the file and the lock exactly as they were. The limit on width (an entry with very many members) and the cost of `listMounted` on a very long list are not measured and not pinned. | A hand-edited `config.d/mcp.json` with a deeply nested entry (a seed or `mount` never writes one). | A reader of the catalog that reports per-entry problems instead of refusing the whole file (a settings-schema export of the entry shape would make that reading one source). |
+| KL-33 | One entry anywhere in `config.d/mcp.json`'s `servers` that is nested too deep to compare (deeper than the shape comparison follows) makes every `mount` and `unmount` in that configuration directory that has to write refuse with `unexpected_shape` (an idempotent call, whose entry is already there or already absent, answers before that comparison and is not affected), and `listMounted` refuse the whole call, not only the one entry: the post-write verification compares the whole list, so one unreadable entry means no write can be verified. | Answering for the other entries while one cannot be read would report a list shorter than the truth, or write a file whose verification is partial; refusing the whole call keeps the file and the lock exactly as they were. The limit on width (an entry with very many members) and the cost of `listMounted` on a very long list are not measured and not pinned. | A hand-edited `config.d/mcp.json` with a deeply nested entry (a seed or `mount` never writes one). | A reader of the catalog that reports per-entry problems instead of refusing the whole file (a settings-schema export of the entry shape would make that reading one source). |
+| KL-34 | The assertion-header pin gate holds the credential reference kinds of `docs/DESIGN/credential-ref-alignment.md` to the engine's `CREDENTIAL_REF_KINDS` at the level of the kind name only: a kind whose members the engine changes keeps the gate green. | The engine exports the kind names as one closed set and the members of each kind only as types, which a gate cannot read from the installed package without a compiler; the header name, the one value the launcher itself sends, is pinned exactly. | An engine release that keeps a kind's name and changes its members. | The engine exports each kind's member names as a value (then the gate holds the table's `<kind>.<member>` cells to it), or the alignment table stops naming members. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/connector-browser",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Browser connector: runs the pinned Playwright MCP server and a pinned Chrome for Testing behind the sema-connector launcher, in an isolated, headless session whose login state is a secret handle.",
   "license": "Apache-2.0",
   "type": "module",
@@ -23,8 +23,8 @@
     "build": "tsc -p tsconfig.json"
   },
   "dependencies": {
-    "@sema-agent/connectors": "0.9.0",
-    "@sema-agent/connectors-contract": "0.2.0"
+    "@sema-agent/connectors": "0.10.0",
+    "@sema-agent/connectors-contract": "0.2.1"
   },
   "engines": {
     "node": ">=22"