@solarisdk/mcp 0.3.4 → 0.4.1

package/dist/browser.js

@@ -156,6 +156,8 @@ export function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
                 captcha: z.boolean().optional(),
                 recording: z.boolean().optional(),
                 profileId: z.string().optional(),
+                /** Defaults to ON. Pass false to never auto-sign-in on this session. */
+                autoLogin: z.boolean().optional(),
             },
             handler: async (a) => {
                 // STEALTH IS THE DEFAULT. Models consistently declined to opt in when it
@@ -203,6 +205,13 @@ export function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
                     body.proxy = a.proxy;
                 if (a.profileId)
                     body.profileId = a.profileId;
+                // Auto-login is ON by default. If the account has connected a password
+                // manager and configured this site, the gateway signs the session in on
+                // its own — the agent never sees or handles the credential. Costs
+                // nothing when nothing is configured: the gateway finds no connection
+                // and the flow is exactly as before.
+                if (a.autoLogin !== false)
+                    body.autoLogin = true;
                 const res = await api(cfg, "POST", "/sessions", body);
                 if (res.status !== 201)
                     await apiError(res, "session create");
@@ -286,7 +295,12 @@ export function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
             },
         },
         solari_browser_login: {
-            description: "Ask a HUMAN to sign in, so you never handle credentials yourself. Two ways to call it:\n" +
+            description: "Get this session signed in. Call it the moment you hit a login form, a 2FA prompt, or "
+                + "anything asking for a password — you must never handle credentials yourself.\n"
+                + "It tries the account's connected password manager FIRST: if one is set up for this "
+                + "site, you are signed in automatically and NO human is involved — the reply says "
+                + 'signedIn:true and you simply carry on. Otherwise it falls back to asking a human.\n'
+                + "Two ways to call it:\n" +
                 "HOT — pass `sessionId` when you are ALREADY on a login wall mid-task. The user gets a " +
                 "live view of the exact page you are on and types into it; you resume on that same page.\n" +
                 "COLD — pass `profileName` when you know a task will need a login and no session is open " +
@@ -350,6 +364,29 @@ export function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
                 }
                 // ── HOT: rescue the live session ─────────────────────────────────
                 const e = need(sessionId);
+                // Try the account's password manager FIRST. If a vault is connected and
+                // this site is configured, the gateway signs in on its own and no human
+                // is involved at all — we never see the credential either way. Only
+                // escalate to a human when that cannot work. Best-effort: any failure
+                // here just falls through to the handoff below, which is the behaviour
+                // that existed before.
+                try {
+                    const auto = await api(cfg, "POST", `/sessions/${encodeURIComponent(sessionId)}/autologin`, {});
+                    if (auto.status === 200) {
+                        const r = (await auto.json());
+                        if (r.outcome === "already_authenticated" || r.outcome === "vault_login") {
+                            return text({
+                                mode: "auto",
+                                signedIn: true,
+                                via: r.outcome === "vault_login" ? "password manager" : "saved session",
+                                next: "You are signed in — carry on. No human was needed.",
+                            });
+                        }
+                    }
+                }
+                catch {
+                    /* fall through to the human handoff */
+                }
                 const res = await api(cfg, "POST", `/sessions/${encodeURIComponent(sessionId)}/handoff`, { reason: a.reason });
                 if (res.status !== 200)
                     await apiError(res, "handoff request");

package/dist/solari-mcp-http.bundle.cjs

@@ -112358,7 +112358,7 @@ var SolariClient = class {
 };
 
 // src/version.ts
-var VERSION = "0.3.4";
+var VERSION = "0.4.1";
 
 // node_modules/puppeteer-core/lib/esm/puppeteer/index.js
 init_index_browser();
@@ -113781,7 +113781,9 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
         /** Defaults to ON (following the pool). Pass false to opt out. */
         captcha: external_exports.boolean().optional(),
         recording: external_exports.boolean().optional(),
-        profileId: external_exports.string().optional()
+        profileId: external_exports.string().optional(),
+        /** Defaults to ON. Pass false to never auto-sign-in on this session. */
+        autoLogin: external_exports.boolean().optional()
       },
       handler: async (a2) => {
         const stealth = a2.mode !== void 0 ? a2.mode === "stealth" : a2.stealth ?? true;
@@ -113800,6 +113802,7 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
         if (a2.recording) body.recording = true;
         if (a2.proxy) body.proxy = a2.proxy;
         if (a2.profileId) body.profileId = a2.profileId;
+        if (a2.autoLogin !== false) body.autoLogin = true;
         const res = await api2(cfg, "POST", "/sessions", body);
         if (res.status !== 201) await apiError(res, "session create");
         const s = await res.json();
@@ -113863,7 +113866,7 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
       }
     },
     solari_browser_login: {
-      description: "Ask a HUMAN to sign in, so you never handle credentials yourself. Two ways to call it:\nHOT \u2014 pass `sessionId` when you are ALREADY on a login wall mid-task. The user gets a live view of the exact page you are on and types into it; you resume on that same page.\nCOLD \u2014 pass `profileName` when you know a task will need a login and no session is open yet. The user signs in once in a profile editor, and every later solari_browser_create({profileId}) starts already authenticated. Prefer this when you can: nobody has to be watching mid-run. The profile is created if it does not exist.\nPass exactly one of the two. Either way, SHOW THE RETURNED URL TO THE USER, then call solari_browser_await_login.\nIn the HOT case your access to that session is REVOKED while the handoff is open \u2014 deliberately, so you cannot observe what they type \u2014 and the link expires in 5 minutes. Cold links last longer and revoke nothing, because there is no session yet.\n`reason` is required and is shown to the user \u2014 say plainly which site is asking and what for, because they are being asked to type a password on your say-so.",
+      description: "Get this session signed in. Call it the moment you hit a login form, a 2FA prompt, or anything asking for a password \u2014 you must never handle credentials yourself.\nIt tries the account's connected password manager FIRST: if one is set up for this site, you are signed in automatically and NO human is involved \u2014 the reply says signedIn:true and you simply carry on. Otherwise it falls back to asking a human.\nTwo ways to call it:\nHOT \u2014 pass `sessionId` when you are ALREADY on a login wall mid-task. The user gets a live view of the exact page you are on and types into it; you resume on that same page.\nCOLD \u2014 pass `profileName` when you know a task will need a login and no session is open yet. The user signs in once in a profile editor, and every later solari_browser_create({profileId}) starts already authenticated. Prefer this when you can: nobody has to be watching mid-run. The profile is created if it does not exist.\nPass exactly one of the two. Either way, SHOW THE RETURNED URL TO THE USER, then call solari_browser_await_login.\nIn the HOT case your access to that session is REVOKED while the handoff is open \u2014 deliberately, so you cannot observe what they type \u2014 and the link expires in 5 minutes. Cold links last longer and revoke nothing, because there is no session yet.\n`reason` is required and is shown to the user \u2014 say plainly which site is asking and what for, because they are being asked to type a password on your say-so.",
       inputSchema: {
         sessionId: external_exports.string().optional(),
         profileName: external_exports.string().optional(),
@@ -113910,6 +113913,26 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
           });
         }
         const e = need(sessionId);
+        try {
+          const auto = await api2(
+            cfg,
+            "POST",
+            `/sessions/${encodeURIComponent(sessionId)}/autologin`,
+            {}
+          );
+          if (auto.status === 200) {
+            const r = await auto.json();
+            if (r.outcome === "already_authenticated" || r.outcome === "vault_login") {
+              return text({
+                mode: "auto",
+                signedIn: true,
+                via: r.outcome === "vault_login" ? "password manager" : "saved session",
+                next: "You are signed in \u2014 carry on. No human was needed."
+              });
+            }
+          }
+        } catch {
+        }
         const res = await api2(
           cfg,
           "POST",

package/dist/solari-mcp.bundle.cjs

@@ -111027,7 +111027,7 @@ var SolariClient = class {
 };
 
 // src/version.ts
-var VERSION = "0.3.4";
+var VERSION = "0.4.1";
 
 // node_modules/puppeteer-core/lib/esm/puppeteer/index.js
 init_index_browser();
@@ -112450,7 +112450,9 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
         /** Defaults to ON (following the pool). Pass false to opt out. */
         captcha: external_exports.boolean().optional(),
         recording: external_exports.boolean().optional(),
-        profileId: external_exports.string().optional()
+        profileId: external_exports.string().optional(),
+        /** Defaults to ON. Pass false to never auto-sign-in on this session. */
+        autoLogin: external_exports.boolean().optional()
       },
       handler: async (a2) => {
         const stealth = a2.mode !== void 0 ? a2.mode === "stealth" : a2.stealth ?? true;
@@ -112469,6 +112471,7 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
         if (a2.recording) body.recording = true;
         if (a2.proxy) body.proxy = a2.proxy;
         if (a2.profileId) body.profileId = a2.profileId;
+        if (a2.autoLogin !== false) body.autoLogin = true;
         const res = await api2(cfg, "POST", "/sessions", body);
         if (res.status !== 201) await apiError(res, "session create");
         const s = await res.json();
@@ -112532,7 +112535,7 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
       }
     },
     solari_browser_login: {
-      description: "Ask a HUMAN to sign in, so you never handle credentials yourself. Two ways to call it:\nHOT \u2014 pass `sessionId` when you are ALREADY on a login wall mid-task. The user gets a live view of the exact page you are on and types into it; you resume on that same page.\nCOLD \u2014 pass `profileName` when you know a task will need a login and no session is open yet. The user signs in once in a profile editor, and every later solari_browser_create({profileId}) starts already authenticated. Prefer this when you can: nobody has to be watching mid-run. The profile is created if it does not exist.\nPass exactly one of the two. Either way, SHOW THE RETURNED URL TO THE USER, then call solari_browser_await_login.\nIn the HOT case your access to that session is REVOKED while the handoff is open \u2014 deliberately, so you cannot observe what they type \u2014 and the link expires in 5 minutes. Cold links last longer and revoke nothing, because there is no session yet.\n`reason` is required and is shown to the user \u2014 say plainly which site is asking and what for, because they are being asked to type a password on your say-so.",
+      description: "Get this session signed in. Call it the moment you hit a login form, a 2FA prompt, or anything asking for a password \u2014 you must never handle credentials yourself.\nIt tries the account's connected password manager FIRST: if one is set up for this site, you are signed in automatically and NO human is involved \u2014 the reply says signedIn:true and you simply carry on. Otherwise it falls back to asking a human.\nTwo ways to call it:\nHOT \u2014 pass `sessionId` when you are ALREADY on a login wall mid-task. The user gets a live view of the exact page you are on and types into it; you resume on that same page.\nCOLD \u2014 pass `profileName` when you know a task will need a login and no session is open yet. The user signs in once in a profile editor, and every later solari_browser_create({profileId}) starts already authenticated. Prefer this when you can: nobody has to be watching mid-run. The profile is created if it does not exist.\nPass exactly one of the two. Either way, SHOW THE RETURNED URL TO THE USER, then call solari_browser_await_login.\nIn the HOT case your access to that session is REVOKED while the handoff is open \u2014 deliberately, so you cannot observe what they type \u2014 and the link expires in 5 minutes. Cold links last longer and revoke nothing, because there is no session yet.\n`reason` is required and is shown to the user \u2014 say plainly which site is asking and what for, because they are being asked to type a password on your say-so.",
       inputSchema: {
         sessionId: external_exports.string().optional(),
         profileName: external_exports.string().optional(),
@@ -112579,6 +112582,26 @@ function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
           });
         }
         const e = need(sessionId);
+        try {
+          const auto = await api2(
+            cfg,
+            "POST",
+            `/sessions/${encodeURIComponent(sessionId)}/autologin`,
+            {}
+          );
+          if (auto.status === 200) {
+            const r = await auto.json();
+            if (r.outcome === "already_authenticated" || r.outcome === "vault_login") {
+              return text({
+                mode: "auto",
+                signedIn: true,
+                via: r.outcome === "vault_login" ? "password manager" : "saved session",
+                next: "You are signed in \u2014 carry on. No human was needed."
+              });
+            }
+          }
+        } catch {
+        }
         const res = await api2(
           cfg,
           "POST",

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.3.4";
+export declare const VERSION = "0.4.1";

package/dist/version.js

@@ -8,4 +8,4 @@
 // `test/version.test.mjs` FAILS the build if it ever drifts from package.json.
 //
 // KEEP IN SYNC WITH sdk/mcp/package.json "version".
-export const VERSION = "0.3.4";
+export const VERSION = "0.4.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solarisdk/mcp",
-  "version": "0.3.4",
+  "version": "0.4.1",
   "description": "Model Context Protocol server for the Solari cloud browser, sandboxes + desktops \u2014 drive them from Claude Desktop/Cowork, Claude Code, Cursor, etc.",
   "type": "module",
   "bin": {