@super-one/cli 0.57.5-alpha → 0.58.0-alpha

package/MANIFEST.json

@@ -1,7 +1,7 @@
 {
   "name": "@super-one/cli",
-  "version": "0.57.5-alpha",
+  "version": "0.58.0-alpha",
   "kind": "npm",
   "minNodeMajor": 20,
-  "builtAt": "2026-08-26T08:31:28.203Z"
+  "builtAt": "2026-08-27T12:23:20.692Z"
 }

package/lib/cli.mjs

@@ -1759,6 +1759,55 @@ If the tool returns an error containing "user_locked", the user has manually nam
           "additionalProperties": false
         }
       },
+      {
+        "name": "browser_tools_list",
+        "description": "List WebMCP tools registered by the current secure page. Use this to discover page-provided actions and their input schemas, then call browser_tools_call with a returned name.",
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "tab": {
+              "description": "Browser view id. Omit to target the focused browser view (errors if multiple are open).",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      {
+        "name": "browser_tools_call",
+        "description": "Call one WebMCP tool registered by the current secure page. Use browser_tools_list first to get the tool name and input schema. The page is untrusted and the user may need to approve the call.",
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "tab": {
+              "description": "Browser view id. Omit to target the focused browser view (errors if multiple are open).",
+              "type": "string"
+            },
+            "description": {
+              "description": "A short, human-friendly explanation of what this page tool call accomplishes, phrased for the end user watching (e.g. 'Add the shirt to the cart', 'Submit the quote request'). Shown in the UI next to the tool name. Write it in the conversation's language.",
+              "type": "string"
+            },
+            "name": {
+              "type": "string",
+              "description": "Tool name from browser_tools_list."
+            },
+            "input": {
+              "default": {},
+              "description": "Arguments; validated against the page-declared inputSchema at dispatch time.",
+              "type": "object",
+              "propertyNames": {
+                "type": "string"
+              },
+              "additionalProperties": {}
+            }
+          },
+          "required": [
+            "name",
+            "input"
+          ],
+          "additionalProperties": false
+        }
+      },
       {
         "name": "browser_snapshot",
         "description": "Inspect the current browser page. Pick which data sections to return via `include`: 'meta' (url/title/loading), 'elements' (flat list of top interactive elements + CSS selectors + total count), 'tree' (hierarchical accessibility tree of landmarks/headings/interactive nodes \u2014 use when you need page STRUCTURE and nesting, not just a flat list), 'text' (truncated visible text), 'console' (recent console entries, filterable). Default include is ['meta','elements','console'] (lean, warning+error console only). Fetch just logs with include:['console'] \u2014 that skips the DOM scan entirely. Call this first to orient. The result is TOON, not JSON: arrays render as a header row `name[N]{col,col}:` followed by one indented CSV-style row per item.",
@@ -3911,7 +3960,8 @@ var init_host_action_browser_catalog = __esm({
       "browser_list_downloads",
       "browser_network_body",
       "browser_network_wait",
-      "browser_action_list"
+      "browser_action_list",
+      "browser_tools_list"
     ]);
     BROWSER_ACT_PREFIX = "browser_";
     COMPUTER_PREFIX = "computer_";
@@ -22427,7 +22477,10 @@ function isStaticHostOwnedSuperoneToolQualified(qualifiedName) {
   const bare = qualifiedName.slice(MCP_SUPERONE_TOOL_PREFIX.length);
   return isStaticHostOwnedSuperoneBareName(bare);
 }
-var MCP_SUPERONE_TOOL_PREFIX, BROWSER_PRIMITIVE_TOOL_NAMES, BROWSER_ACTION_TOOL_NAMES, BROWSER_LEGACY_TOOL_NAMES, BROWSER_COMPACT_TOOL_NAMES, BROWSER_TOOL_NAMES, DEVICE_AGENT_TOOL_NAMES, BUILT_IN_SUPERONE_TOOL_NAMES, MOBILE_SHARE_FILE_TOOL_NAME, MINIAPP_LIST_BARE_NAME, MINIAPP_CALL_BARE_NAME, STATIC_HOST_OWNED_SUPERONE_QUALIFIED_TOOL_NAMES;
+function isNeverAutoAllowSuperoneBareName(bare) {
+  return NEVER_AUTO_ALLOW_SUPERONE_BARE_NAMES.includes(bare);
+}
+var MCP_SUPERONE_TOOL_PREFIX, BROWSER_PRIMITIVE_TOOL_NAMES, BROWSER_ACTION_TOOL_NAMES, BROWSER_LEGACY_TOOL_NAMES, BROWSER_COMPACT_TOOL_NAMES, BROWSER_TOOL_NAMES, DEVICE_AGENT_TOOL_NAMES, BUILT_IN_SUPERONE_TOOL_NAMES, MOBILE_SHARE_FILE_TOOL_NAME, MINIAPP_LIST_BARE_NAME, MINIAPP_CALL_BARE_NAME, NEVER_AUTO_ALLOW_SUPERONE_BARE_NAMES, STATIC_HOST_OWNED_SUPERONE_QUALIFIED_TOOL_NAMES;
 var init_superone_host_owned_tools = __esm({
   "../../packages/shared/src/superone-host-owned-tools.ts"() {
     "use strict";
@@ -22460,7 +22513,9 @@ var init_superone_host_owned_tools = __esm({
       "browser_list_downloads",
       "browser_emulate",
       "browser_mock",
-      "browser_perf_measure"
+      "browser_perf_measure",
+      "browser_tools_list",
+      "browser_tools_call"
     ];
     BROWSER_ACTION_TOOL_NAMES = [
       "browser_action_list",
@@ -22480,7 +22535,9 @@ var init_superone_host_owned_tools = __esm({
       "browser_evaluate",
       "browser_network",
       "browser_perf",
-      "browser_action"
+      "browser_action",
+      "browser_tools_list",
+      "browser_tools_call"
     ];
     BROWSER_TOOL_NAMES = [
       ...BROWSER_LEGACY_TOOL_NAMES,
@@ -22532,12 +22589,13 @@ var init_superone_host_owned_tools = __esm({
     MOBILE_SHARE_FILE_TOOL_NAME = "mobile_share_file";
     MINIAPP_LIST_BARE_NAME = "miniapp_list";
     MINIAPP_CALL_BARE_NAME = "miniapp_call";
+    NEVER_AUTO_ALLOW_SUPERONE_BARE_NAMES = ["browser_tools_call"];
     STATIC_HOST_OWNED_SUPERONE_QUALIFIED_TOOL_NAMES = [
       ...BUILT_IN_SUPERONE_TOOL_NAMES,
       MOBILE_SHARE_FILE_TOOL_NAME,
       MINIAPP_LIST_BARE_NAME,
       MINIAPP_CALL_BARE_NAME
-    ].map((bare) => `${MCP_SUPERONE_TOOL_PREFIX}${bare}`);
+    ].filter((bare) => !isNeverAutoAllowSuperoneBareName(bare)).map((bare) => `${MCP_SUPERONE_TOOL_PREFIX}${bare}`);
   }
 });
 
@@ -24801,6 +24859,7 @@ function createNodeSessionEventMapper(ctx) {
         const toolName = asString2(payload.toolName) ?? "tool";
         const requestKind = asString2(payload.requestKind);
         const sessionAgentsConfirm = payload.sessionAgentsConfirm && typeof payload.sessionAgentsConfirm === "object" ? payload.sessionAgentsConfirm : void 0;
+        const webmcpTrustConfirm = payload.webmcpTrustConfirm && typeof payload.webmcpTrustConfirm === "object" ? payload.webmcpTrustConfirm : void 0;
         const request = {
           requestId: interactionId,
           toolName,
@@ -24812,7 +24871,8 @@ function createNodeSessionEventMapper(ctx) {
           } : {},
           ...asString2(payload.serverName) ? { serverName: asString2(payload.serverName) } : {},
           ...asString2(payload.message) ? { message: asString2(payload.message) } : {},
-          ...sessionAgentsConfirm ? { sessionAgentsConfirm } : {}
+          ...sessionAgentsConfirm ? { sessionAgentsConfirm } : {},
+          ...webmcpTrustConfirm ? { webmcpTrustConfirm } : {}
         };
         push({ type: "permission_request", request });
         break;
@@ -70861,8 +70921,8 @@ import { fileURLToPath } from "node:url";
 function resolveCliReleaseVersion() {
   const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
   if (fromEnv) return fromEnv;
-  if ("0.57.5-alpha".trim()) {
-    return "0.57.5-alpha".trim();
+  if ("0.58.0-alpha".trim()) {
+    return "0.58.0-alpha".trim();
   }
   const fromDist = readDistManifestVersion();
   if (fromDist) return fromDist;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-one/cli",
-  "version": "0.57.5-alpha",
+  "version": "0.58.0-alpha",
   "description": "SuperOne headless node CLI — remote execution environment (RPC, workspaces, sessions).",
   "type": "module",
   "license": "BUSL-1.1",