@wenathlan/extension 1.1.54 → 1.1.55

package/extension/dist/sidepanel.js

@@ -4702,7 +4702,7 @@ function renderagentprotocol(context) {
     badge.className = "sessionbadge";
     badge.dataset.restored = "false";
     badge.textContent = client.paired ? "paired" : "waiting for approval";
-    headline.append(`${client.id} \xB7 ${client.transport}${client.capabilities !== void 0 ? ` \xB7 protocol ${client.capabilities.protocolversion} \xB7 tool floor ${client.capabilities.toolversion} \xB7 ${client.capabilities.tools} tools` : " \xB7 not negotiated yet"}`, badge);
+    headline.append(`${client.id} \xB7 ${client.transport}${client.fingerprint !== void 0 ? ` \xB7 ${client.fingerprint.slice(0, 12)}` : ""}${client.capabilities !== void 0 ? ` \xB7 protocol ${client.capabilities.protocolversion} \xB7 tool floor ${client.toolfloor ?? client.capabilities.toolversion} \xB7 ${client.capabilities.tools} tools` : " \xB7 not negotiated yet"}`, badge);
     row.append(headline);
     const actions = document.createElement("div");
     actions.className = "actions";
@@ -4723,6 +4723,18 @@ function renderagentprotocol(context) {
       status(`Disconnected the client ${client.id}; its record stays for the audit trail.`);
       await refresh();
     }));
+    const clienttokens = mcp.tokens.filter((token) => token.clientid === client.id && token.revokedat === void 0);
+    for (const token of clienttokens) {
+      const tokenline = document.createElement("p");
+      const remaining = Math.max(0, Math.round((token.expiresat - Date.now()) / 1e3));
+      tokenline.textContent = `Session token ${token.id.slice(0, 8)} \xB7 scopes ${token.scopes.join(", ") || "none"} \xB7 expires in ${Math.floor(remaining / 60)}m ${remaining % 60}s${token.revokedat !== void 0 ? " \xB7 revoked" : ""}.`;
+      row.append(tokenline);
+    }
+    actions.append(" ", button("Revoke client", async () => {
+      await request({ kind: "mcprevokeclient", clientid: client.id });
+      status(`Revoked the client ${client.id}; its tokens stopped verifying at once.`);
+      await refresh();
+    }));
     row.append(actions);
     clientsbox.append(row);
   }
@@ -4732,6 +4744,155 @@ function renderagentprotocol(context) {
     clientsbox.append(empty);
   }
   agentprotocolroot.append(clientsbox);
+  const approvalsbox = document.createElement("details");
+  approvalsbox.className = "sessiongroup";
+  approvalsbox.open = true;
+  const approvalssummary = document.createElement("summary");
+  const pendingapprovals = mcp.approvals.filter((request2) => request2.state === "pending");
+  approvalssummary.textContent = `Approval gates (${pendingapprovals.length} pending, ${mcp.approvals.length - pendingapprovals.length} resolved)`;
+  approvalsbox.append(approvalssummary);
+  for (const gate of mcp.approvals.slice(0, 10)) {
+    const card = document.createElement("div");
+    card.className = "sessionrow";
+    const identity = mcp.identities.find((entry) => entry.fingerprint === mcp.clients.find((client) => client.id === gate.clientid)?.fingerprint);
+    const headline = document.createElement("p");
+    const secrets = gate.secretfields ?? [];
+    const shown = {};
+    for (const [name, value] of Object.entries(gate.params)) shown[name] = secrets.includes(name) ? "[redacted]" : value;
+    headline.textContent = `${gate.state === "pending" ? "PENDING" : gate.state.toUpperCase()} \xB7 ${identity?.displayname ?? gate.clientid} calls ${gate.tool} \xB7 ${gate.reason} Arguments: ${JSON.stringify(shown)}${gate.timeoutat !== void 0 ? ` \xB7 refuses by default at ${new Date(gate.timeoutat).toISOString()}` : ""}.`;
+    card.append(headline);
+    if (gate.state === "pending") {
+      const actions = document.createElement("div");
+      actions.className = "actions";
+      actions.append(button("Approve", async () => {
+        await request({ kind: "mcpapprovaldecision", approvalid: gate.id, approved: true });
+        status(`Approved the ${gate.tool} call of the client ${gate.clientid}; the gate executed the held call.`);
+        await refresh();
+      }));
+      actions.append(" ", button("Refuse", async () => {
+        await request({ kind: "mcpapprovaldecision", approvalid: gate.id, approved: false });
+        status(`Refused the ${gate.tool} call of the client ${gate.clientid}; the pending call never executes.`);
+        await refresh();
+      }));
+      card.append(actions);
+    }
+    approvalsbox.append(card);
+  }
+  if (mcp.approvals.length === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No approval gate yet; every sensitive call a remote client raises lands here with its full arguments before anything executes.";
+    approvalsbox.append(empty);
+  }
+  agentprotocolroot.append(approvalsbox);
+  const remotebox = document.createElement("details");
+  remotebox.className = "sessiongroup";
+  const remotesummary = document.createElement("summary");
+  remotesummary.textContent = `Remote transport (${mcp.remote.channelsopen} live channel${mcp.remote.channelsopen === 1 ? "" : "s"}, ${mcp.remote.channelsdead} closed)`;
+  remotebox.append(remotesummary);
+  const remoteline = document.createElement("p");
+  remoteline.textContent = `Endpoint ${mcp.remote.endpoint} \xB7 tls ${mcp.remote.tls.mode}${mcp.remote.tls.certificaterequired ? " (certificate required)" : ""}${mcp.remote.tls.verified ? " and verified" : " and unverified"} \xB7 ${mcp.remote.paired} of ${mcp.remote.clients} client${mcp.remote.clients === 1 ? "" : "s"} paired \xB7 ${mcp.remote.tokenslive} live token${mcp.remote.tokenslive === 1 ? "" : "s"}.`;
+  remotebox.append(remoteline);
+  for (const channel of mcp.channels.slice(0, 10)) {
+    const line = document.createElement("p");
+    const beatage = Math.max(0, Math.round((Date.now() - channel.lastbeatat) / 1e3));
+    line.textContent = `Stream channel ${channel.id.slice(0, 12)} of ${channel.clientid} \xB7 ${channel.closedat === void 0 ? `heartbeat ${beatage}s ago` : `closed at ${new Date(channel.closedat).toISOString()}`}.`;
+    remotebox.append(line);
+  }
+  for (const shake of mcp.handshakes.slice(0, 5)) {
+    const line = document.createElement("p");
+    line.textContent = `Auth handshake ${shake.method} of ${shake.clientid} \xB7 ${shake.outcome}${shake.outcome === "refused" ? " (consentrefused error, no pairing state leaked)" : ""} \xB7 ${new Date(shake.at).toISOString()}.`;
+    remotebox.append(line);
+  }
+  const pairingline = document.createElement("p");
+  pairingline.textContent = mcp.pairing.length > 0 ? `Pairing code ${mcp.pairing[0]?.code} for ${mcp.pairing[0]?.scopes.join(", ") || "no"} namespaces \xB7 expires at ${new Date(mcp.pairing[0]?.expiresat ?? Date.now()).toISOString()} \xB7 single use.` : "No pairing code pending; issue one while a session is live to pair a remote client.";
+  remotebox.append(pairingline);
+  const pairingactions = document.createElement("div");
+  pairingactions.className = "actions";
+  pairingactions.append(button("Issue pairing code", async () => {
+    await request({ kind: "mcppairing", scopes: ["browser", "workflow", "memory", "system"] });
+    status("Issued one single use pairing code; copy it to the remote client before its window closes.");
+    await refresh();
+  }));
+  pairingactions.append(" ", button("Copy pairing code", async () => {
+    const code = mcp.pairing[0]?.code ?? "";
+    if (code === "") {
+      status("No pending pairing code to copy.", true);
+      return;
+    }
+    await navigator.clipboard.writeText(code).then(() => status(`Copied the pairing code ${code} to the clipboard.`)).catch(() => status(`Pairing code: ${code} (the clipboard permission was refused).`, true));
+  }));
+  remotebox.append(pairingactions);
+  const tlsheadline = document.createElement("p");
+  tlsheadline.textContent = "Tls certificate options of the remote transport: the mode and the reviewed sha-256 fingerprint stay user choices with no hardcoded certificate.";
+  remotebox.append(tlsheadline);
+  const tlsactions = document.createElement("div");
+  tlsactions.className = "actions";
+  const endpointinput = document.createElement("input");
+  endpointinput.placeholder = "remote endpoint url";
+  endpointinput.value = mcp.config.remoteaccess?.endpoint ?? "";
+  const tlsmodeinput = document.createElement("input");
+  tlsmodeinput.placeholder = "tls mode: off, on or required";
+  tlsmodeinput.value = mcp.config.remoteaccess?.tls.mode ?? "off";
+  const certinput = document.createElement("input");
+  certinput.placeholder = "certificate sha-256 fingerprint";
+  certinput.value = mcp.config.httpstream?.tls.certificatefingerprint ?? "";
+  const maxclientsinput = document.createElement("input");
+  maxclientsinput.placeholder = "max clients (empty: unbounded)";
+  maxclientsinput.value = mcp.config.remoteaccess?.maxclients !== void 0 ? String(mcp.config.remoteaccess.maxclients) : "";
+  const timeoutinput = document.createElement("input");
+  timeoutinput.placeholder = "approval window ms";
+  timeoutinput.value = mcp.config.remoteaccess?.approvaltimeout !== void 0 ? String(mcp.config.remoteaccess.approvaltimeout.windowms) : "";
+  tlsactions.append(endpointinput, " ", tlsmodeinput, " ", certinput, " ", maxclientsinput, " ", timeoutinput, " ", button("Save remote config", async () => {
+    await request({ kind: "mcpremoteconfig", endpoint: endpointinput.value, tlsmode: tlsmodeinput.value, ...certinput.value.trim() !== "" ? { certificatefingerprint: certinput.value } : {}, ...maxclientsinput.value.trim() !== "" ? { maxclients: Number(maxclientsinput.value) } : {}, ...timeoutinput.value.trim() !== "" ? { approvaltimeoutms: Number(timeoutinput.value) } : {}, reviewed: true });
+    status(`Saved the remote transport config for ${endpointinput.value} with the ${tlsmodeinput.value} tls mode.`);
+    await refresh();
+  }));
+  remotebox.append(tlsactions);
+  agentprotocolroot.append(remotebox);
+  const allowlistbox = document.createElement("details");
+  allowlistbox.className = "sessiongroup";
+  const allowlistsummary = document.createElement("summary");
+  allowlistsummary.textContent = `Client allowlist (${mcp.allowlist.length} entr${mcp.allowlist.length === 1 ? "y" : "ies"})`;
+  allowlistbox.append(allowlistsummary);
+  for (const entry of mcp.allowlist) {
+    const line = document.createElement("p");
+    line.textContent = `${entry.displayname} \xB7 ${entry.fingerprint.slice(0, 12)} \xB7 namespaces ${entry.namespaces.join(", ") || "none"} \xB7 granted ${new Date(entry.grantedat).toISOString()} \xB7 ${entry.history.length} grant change${entry.history.length === 1 ? "" : "s"}.`;
+    allowlistbox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button(`Rescope to browser+memory`, async () => {
+      await request({ kind: "mcpallowlist", fingerprint: entry.fingerprint, displayname: entry.displayname, namespaces: ["browser", "memory"] });
+      status(`Rescoped the allowlist entry ${entry.displayname} to the browser and memory namespaces.`);
+      await refresh();
+    }));
+    actions.append(" ", button("Refuse entry", async () => {
+      await request({ kind: "mcpallowlist", fingerprint: entry.fingerprint, remove: true });
+      status(`Refused the allowlist entry ${entry.displayname}; its fingerprint stops passing the check.`);
+      await refresh();
+    }));
+    allowlistbox.append(actions);
+  }
+  const allowactions = document.createElement("div");
+  allowactions.className = "actions";
+  const fingerprintinput = document.createElement("input");
+  fingerprintinput.placeholder = "client fingerprint";
+  const displayinput = document.createElement("input");
+  displayinput.placeholder = "display name";
+  const scopesinput = document.createElement("input");
+  scopesinput.placeholder = "namespaces: browser,workflow,memory,system";
+  allowactions.append(fingerprintinput, " ", displayinput, " ", scopesinput, " ", button("Allow client", async () => {
+    const namespaces = scopesinput.value.split(",").map((scope) => scope.trim()).filter((scope) => scope !== "");
+    await request({ kind: "mcpallowlist", fingerprint: fingerprintinput.value, ...displayinput.value.trim() !== "" ? { displayname: displayinput.value } : {}, namespaces });
+    status(`Allowed the client ${displayinput.value || fingerprintinput.value} the ${namespaces.join(", ") || "no"} namespaces.`);
+    await refresh();
+  }));
+  allowlistbox.append(allowactions);
+  if (mcp.allowlist.length === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No allowlist entry yet; a remote client pairs through the one time code or the user allows a known fingerprint with its namespace scopes.";
+    allowlistbox.append(empty);
+  }
+  agentprotocolroot.append(allowlistbox);
   const catalogbox = document.createElement("details");
   catalogbox.className = "sessiongroup";
   const catalogsummary = document.createElement("summary");
@@ -4752,7 +4913,7 @@ function renderagentprotocol(context) {
     domain.append(domainsummary);
     for (const tool of tools) {
       const line = document.createElement("p");
-      line.textContent = `${tool.name} v${tool.version} \xB7 ${tool.risk} \xB7 ${tool.description.split(".")[0] ?? tool.description}${tool.consentmeta !== void 0 ? ` \xB7 review: ${tool.consentmeta}` : ""}`;
+      line.textContent = `${tool.name} v${tool.version} \xB7 ${tool.risk} \xB7 ${tool.description.split(".")[0] ?? tool.description}${tool.consentmeta !== void 0 ? ` \xB7 ${tool.consentmeta.riskclass} \xB7 approval gate ${tool.consentmeta.approvalrequired ? "required" : "off"} \xB7 ${tool.consentmeta.originscope} scope \xB7 review: ${tool.consentmeta.review}` : ""}`;
       domain.append(line);
     }
     catalogbox.append(domain);