@wenathlan/extension 1.1.54 → 1.1.56

package/extension/dist/sidepanel.js

@@ -4702,7 +4702,7 @@ function renderagentprotocol(context) {
     badge.className = "sessionbadge";
     badge.dataset.restored = "false";
     badge.textContent = client.paired ? "paired" : "waiting for approval";
-    headline.append(`${client.id} \xB7 ${client.transport}${client.capabilities !== void 0 ? ` \xB7 protocol ${client.capabilities.protocolversion} \xB7 tool floor ${client.capabilities.toolversion} \xB7 ${client.capabilities.tools} tools` : " \xB7 not negotiated yet"}`, badge);
+    headline.append(`${client.id} \xB7 ${client.transport}${client.fingerprint !== void 0 ? ` \xB7 ${client.fingerprint.slice(0, 12)}` : ""}${client.capabilities !== void 0 ? ` \xB7 protocol ${client.capabilities.protocolversion} \xB7 tool floor ${client.toolfloor ?? client.capabilities.toolversion} \xB7 ${client.capabilities.tools} tools` : " \xB7 not negotiated yet"}`, badge);
     row.append(headline);
     const actions = document.createElement("div");
     actions.className = "actions";
@@ -4723,6 +4723,18 @@ function renderagentprotocol(context) {
       status(`Disconnected the client ${client.id}; its record stays for the audit trail.`);
       await refresh();
     }));
+    const clienttokens = mcp.tokens.filter((token) => token.clientid === client.id && token.revokedat === void 0);
+    for (const token of clienttokens) {
+      const tokenline = document.createElement("p");
+      const remaining = Math.max(0, Math.round((token.expiresat - Date.now()) / 1e3));
+      tokenline.textContent = `Session token ${token.id.slice(0, 8)} \xB7 scopes ${token.scopes.join(", ") || "none"} \xB7 expires in ${Math.floor(remaining / 60)}m ${remaining % 60}s${token.revokedat !== void 0 ? " \xB7 revoked" : ""}.`;
+      row.append(tokenline);
+    }
+    actions.append(" ", button("Revoke client", async () => {
+      await request({ kind: "mcprevokeclient", clientid: client.id });
+      status(`Revoked the client ${client.id}; its tokens stopped verifying at once.`);
+      await refresh();
+    }));
     row.append(actions);
     clientsbox.append(row);
   }
@@ -4732,6 +4744,155 @@ function renderagentprotocol(context) {
     clientsbox.append(empty);
   }
   agentprotocolroot.append(clientsbox);
+  const approvalsbox = document.createElement("details");
+  approvalsbox.className = "sessiongroup";
+  approvalsbox.open = true;
+  const approvalssummary = document.createElement("summary");
+  const pendingapprovals = mcp.approvals.filter((request2) => request2.state === "pending");
+  approvalssummary.textContent = `Approval gates (${pendingapprovals.length} pending, ${mcp.approvals.length - pendingapprovals.length} resolved)`;
+  approvalsbox.append(approvalssummary);
+  for (const gate of mcp.approvals.slice(0, 10)) {
+    const card = document.createElement("div");
+    card.className = "sessionrow";
+    const identity = mcp.identities.find((entry) => entry.fingerprint === mcp.clients.find((client) => client.id === gate.clientid)?.fingerprint);
+    const headline = document.createElement("p");
+    const secrets = gate.secretfields ?? [];
+    const shown = {};
+    for (const [name, value] of Object.entries(gate.params)) shown[name] = secrets.includes(name) ? "[redacted]" : value;
+    headline.textContent = `${gate.state === "pending" ? "PENDING" : gate.state.toUpperCase()} \xB7 ${identity?.displayname ?? gate.clientid} calls ${gate.tool} \xB7 ${gate.reason} Arguments: ${JSON.stringify(shown)}${gate.timeoutat !== void 0 ? ` \xB7 refuses by default at ${new Date(gate.timeoutat).toISOString()}` : ""}.`;
+    card.append(headline);
+    if (gate.state === "pending") {
+      const actions = document.createElement("div");
+      actions.className = "actions";
+      actions.append(button("Approve", async () => {
+        await request({ kind: "mcpapprovaldecision", approvalid: gate.id, approved: true });
+        status(`Approved the ${gate.tool} call of the client ${gate.clientid}; the gate executed the held call.`);
+        await refresh();
+      }));
+      actions.append(" ", button("Refuse", async () => {
+        await request({ kind: "mcpapprovaldecision", approvalid: gate.id, approved: false });
+        status(`Refused the ${gate.tool} call of the client ${gate.clientid}; the pending call never executes.`);
+        await refresh();
+      }));
+      card.append(actions);
+    }
+    approvalsbox.append(card);
+  }
+  if (mcp.approvals.length === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No approval gate yet; every sensitive call a remote client raises lands here with its full arguments before anything executes.";
+    approvalsbox.append(empty);
+  }
+  agentprotocolroot.append(approvalsbox);
+  const remotebox = document.createElement("details");
+  remotebox.className = "sessiongroup";
+  const remotesummary = document.createElement("summary");
+  remotesummary.textContent = `Remote transport (${mcp.remote.channelsopen} live channel${mcp.remote.channelsopen === 1 ? "" : "s"}, ${mcp.remote.channelsdead} closed)`;
+  remotebox.append(remotesummary);
+  const remoteline = document.createElement("p");
+  remoteline.textContent = `Endpoint ${mcp.remote.endpoint} \xB7 tls ${mcp.remote.tls.mode}${mcp.remote.tls.certificaterequired ? " (certificate required)" : ""}${mcp.remote.tls.verified ? " and verified" : " and unverified"} \xB7 ${mcp.remote.paired} of ${mcp.remote.clients} client${mcp.remote.clients === 1 ? "" : "s"} paired \xB7 ${mcp.remote.tokenslive} live token${mcp.remote.tokenslive === 1 ? "" : "s"}.`;
+  remotebox.append(remoteline);
+  for (const channel of mcp.channels.slice(0, 10)) {
+    const line = document.createElement("p");
+    const beatage = Math.max(0, Math.round((Date.now() - channel.lastbeatat) / 1e3));
+    line.textContent = `Stream channel ${channel.id.slice(0, 12)} of ${channel.clientid} \xB7 ${channel.closedat === void 0 ? `heartbeat ${beatage}s ago` : `closed at ${new Date(channel.closedat).toISOString()}`}.`;
+    remotebox.append(line);
+  }
+  for (const shake of mcp.handshakes.slice(0, 5)) {
+    const line = document.createElement("p");
+    line.textContent = `Auth handshake ${shake.method} of ${shake.clientid} \xB7 ${shake.outcome}${shake.outcome === "refused" ? " (consentrefused error, no pairing state leaked)" : ""} \xB7 ${new Date(shake.at).toISOString()}.`;
+    remotebox.append(line);
+  }
+  const pairingline = document.createElement("p");
+  pairingline.textContent = mcp.pairing.length > 0 ? `Pairing code ${mcp.pairing[0]?.code} for ${mcp.pairing[0]?.scopes.join(", ") || "no"} namespaces \xB7 expires at ${new Date(mcp.pairing[0]?.expiresat ?? Date.now()).toISOString()} \xB7 single use.` : "No pairing code pending; issue one while a session is live to pair a remote client.";
+  remotebox.append(pairingline);
+  const pairingactions = document.createElement("div");
+  pairingactions.className = "actions";
+  pairingactions.append(button("Issue pairing code", async () => {
+    await request({ kind: "mcppairing", scopes: ["browser", "workflow", "memory", "system"] });
+    status("Issued one single use pairing code; copy it to the remote client before its window closes.");
+    await refresh();
+  }));
+  pairingactions.append(" ", button("Copy pairing code", async () => {
+    const code = mcp.pairing[0]?.code ?? "";
+    if (code === "") {
+      status("No pending pairing code to copy.", true);
+      return;
+    }
+    await navigator.clipboard.writeText(code).then(() => status(`Copied the pairing code ${code} to the clipboard.`)).catch(() => status(`Pairing code: ${code} (the clipboard permission was refused).`, true));
+  }));
+  remotebox.append(pairingactions);
+  const tlsheadline = document.createElement("p");
+  tlsheadline.textContent = "Tls certificate options of the remote transport: the mode and the reviewed sha-256 fingerprint stay user choices with no hardcoded certificate.";
+  remotebox.append(tlsheadline);
+  const tlsactions = document.createElement("div");
+  tlsactions.className = "actions";
+  const endpointinput = document.createElement("input");
+  endpointinput.placeholder = "remote endpoint url";
+  endpointinput.value = mcp.config.remoteaccess?.endpoint ?? "";
+  const tlsmodeinput = document.createElement("input");
+  tlsmodeinput.placeholder = "tls mode: off, on or required";
+  tlsmodeinput.value = mcp.config.remoteaccess?.tls.mode ?? "off";
+  const certinput = document.createElement("input");
+  certinput.placeholder = "certificate sha-256 fingerprint";
+  certinput.value = mcp.config.httpstream?.tls.certificatefingerprint ?? "";
+  const maxclientsinput = document.createElement("input");
+  maxclientsinput.placeholder = "max clients (empty: unbounded)";
+  maxclientsinput.value = mcp.config.remoteaccess?.maxclients !== void 0 ? String(mcp.config.remoteaccess.maxclients) : "";
+  const timeoutinput = document.createElement("input");
+  timeoutinput.placeholder = "approval window ms";
+  timeoutinput.value = mcp.config.remoteaccess?.approvaltimeout !== void 0 ? String(mcp.config.remoteaccess.approvaltimeout.windowms) : "";
+  tlsactions.append(endpointinput, " ", tlsmodeinput, " ", certinput, " ", maxclientsinput, " ", timeoutinput, " ", button("Save remote config", async () => {
+    await request({ kind: "mcpremoteconfig", endpoint: endpointinput.value, tlsmode: tlsmodeinput.value, ...certinput.value.trim() !== "" ? { certificatefingerprint: certinput.value } : {}, ...maxclientsinput.value.trim() !== "" ? { maxclients: Number(maxclientsinput.value) } : {}, ...timeoutinput.value.trim() !== "" ? { approvaltimeoutms: Number(timeoutinput.value) } : {}, reviewed: true });
+    status(`Saved the remote transport config for ${endpointinput.value} with the ${tlsmodeinput.value} tls mode.`);
+    await refresh();
+  }));
+  remotebox.append(tlsactions);
+  agentprotocolroot.append(remotebox);
+  const allowlistbox = document.createElement("details");
+  allowlistbox.className = "sessiongroup";
+  const allowlistsummary = document.createElement("summary");
+  allowlistsummary.textContent = `Client allowlist (${mcp.allowlist.length} entr${mcp.allowlist.length === 1 ? "y" : "ies"})`;
+  allowlistbox.append(allowlistsummary);
+  for (const entry of mcp.allowlist) {
+    const line = document.createElement("p");
+    line.textContent = `${entry.displayname} \xB7 ${entry.fingerprint.slice(0, 12)} \xB7 namespaces ${entry.namespaces.join(", ") || "none"} \xB7 granted ${new Date(entry.grantedat).toISOString()} \xB7 ${entry.history.length} grant change${entry.history.length === 1 ? "" : "s"}.`;
+    allowlistbox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button(`Rescope to browser+memory`, async () => {
+      await request({ kind: "mcpallowlist", fingerprint: entry.fingerprint, displayname: entry.displayname, namespaces: ["browser", "memory"] });
+      status(`Rescoped the allowlist entry ${entry.displayname} to the browser and memory namespaces.`);
+      await refresh();
+    }));
+    actions.append(" ", button("Refuse entry", async () => {
+      await request({ kind: "mcpallowlist", fingerprint: entry.fingerprint, remove: true });
+      status(`Refused the allowlist entry ${entry.displayname}; its fingerprint stops passing the check.`);
+      await refresh();
+    }));
+    allowlistbox.append(actions);
+  }
+  const allowactions = document.createElement("div");
+  allowactions.className = "actions";
+  const fingerprintinput = document.createElement("input");
+  fingerprintinput.placeholder = "client fingerprint";
+  const displayinput = document.createElement("input");
+  displayinput.placeholder = "display name";
+  const scopesinput = document.createElement("input");
+  scopesinput.placeholder = "namespaces: browser,workflow,memory,system";
+  allowactions.append(fingerprintinput, " ", displayinput, " ", scopesinput, " ", button("Allow client", async () => {
+    const namespaces = scopesinput.value.split(",").map((scope) => scope.trim()).filter((scope) => scope !== "");
+    await request({ kind: "mcpallowlist", fingerprint: fingerprintinput.value, ...displayinput.value.trim() !== "" ? { displayname: displayinput.value } : {}, namespaces });
+    status(`Allowed the client ${displayinput.value || fingerprintinput.value} the ${namespaces.join(", ") || "no"} namespaces.`);
+    await refresh();
+  }));
+  allowlistbox.append(allowactions);
+  if (mcp.allowlist.length === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No allowlist entry yet; a remote client pairs through the one time code or the user allows a known fingerprint with its namespace scopes.";
+    allowlistbox.append(empty);
+  }
+  agentprotocolroot.append(allowlistbox);
   const catalogbox = document.createElement("details");
   catalogbox.className = "sessiongroup";
   const catalogsummary = document.createElement("summary");
@@ -4752,25 +4913,254 @@ function renderagentprotocol(context) {
     domain.append(domainsummary);
     for (const tool of tools) {
       const line = document.createElement("p");
-      line.textContent = `${tool.name} v${tool.version} \xB7 ${tool.risk} \xB7 ${tool.description.split(".")[0] ?? tool.description}${tool.consentmeta !== void 0 ? ` \xB7 review: ${tool.consentmeta}` : ""}`;
+      line.textContent = `${tool.name} v${tool.version} \xB7 ${tool.risk} \xB7 ${tool.description.split(".")[0] ?? tool.description}${tool.consentmeta !== void 0 ? ` \xB7 ${tool.consentmeta.riskclass} \xB7 approval gate ${tool.consentmeta.approvalrequired ? "required" : "off"} \xB7 ${tool.consentmeta.originscope} scope \xB7 review: ${tool.consentmeta.review}` : ""}`;
       domain.append(line);
     }
     catalogbox.append(domain);
   }
   agentprotocolroot.append(catalogbox);
+  const runtimebox = document.createElement("details");
+  runtimebox.className = "sessiongroup";
+  const runtimesummary = document.createElement("summary");
+  runtimesummary.textContent = `Call runtime (${mcp.inflight?.length ?? 0} in flight, ${mcp.dryruntoggle === true ? "dry run armed" : "dry run off"}, ${mcp.mocks?.length ?? 0} mock${(mcp.mocks?.length ?? 0) === 1 ? "" : "s"})`;
+  runtimebox.append(runtimesummary);
+  for (const call of mcp.inflight ?? []) {
+    const line = document.createElement("p");
+    line.textContent = `In flight ${call.tool} of ${call.clientid} \xB7 call ${call.callid.slice(0, 12)} \xB7 ${call.chunks} chunk${call.chunks === 1 ? "" : "s"} \xB7 open ${Math.max(0, Math.round((Date.now() - call.startedat) / 1e3))}s${call.dryrun === true ? " \xB7 dry run" : ""}.`;
+    runtimebox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button("Cancel call", async () => {
+      await request({ kind: "mcpcancelcall", callid: call.callid });
+      status(`Cancelled the in flight ${call.tool} call; the partial result stays preserved.`);
+      await refresh();
+    }));
+    runtimebox.append(actions);
+  }
+  if ((mcp.inflight?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No in flight tool call; a cancellation frame aborts a running call and preserves its partial result.";
+    runtimebox.append(empty);
+  }
+  const runtimeactions = document.createElement("div");
+  runtimeactions.className = "actions";
+  runtimeactions.append(button(mcp.dryruntoggle === true ? "Disarm dry run" : "Dry run next call", async () => {
+    await request({ kind: "mcpdryrun", enabled: mcp.dryruntoggle !== true });
+    status(mcp.dryruntoggle === true ? "Disarmed the tool dry run; the next call executes behind the gates." : "Armed the tool dry run of the next call: it evaluates arguments and consent with no side effects.");
+    await refresh();
+  }));
+  const mockinput = document.createElement("input");
+  mockinput.placeholder = "tool name to mock (test context)";
+  runtimeactions.append(" ", mockinput, " ", button("Add mock", async () => {
+    if (mockinput.value.trim() === "") {
+      status("The tool mock needs the namespaced tool name.", true);
+      return;
+    }
+    await request({ kind: "mcpmock", tool: mockinput.value.trim() });
+    status(`Registered the ${mockinput.value.trim()} tool mock of a test context; it never touches the browser.`);
+    await refresh();
+  }));
+  runtimebox.append(runtimeactions);
+  for (const mock of mcp.mocks ?? []) {
+    const line = document.createElement("p");
+    line.textContent = `Tool mock ${mock.tool} \xB7 test context \xB7 created ${new Date(mock.createdat).toISOString()}.`;
+    runtimebox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button("Remove mock", async () => {
+      await request({ kind: "mcpmock", tool: mock.tool, remove: true });
+      status(`Removed the ${mock.tool} tool mock; the tool returns to the real gates.`);
+      await refresh();
+    }));
+    runtimebox.append(actions);
+  }
+  agentprotocolroot.append(runtimebox);
+  const limitsbox = document.createElement("details");
+  limitsbox.className = "sessiongroup";
+  const limitssummary = document.createElement("summary");
+  limitssummary.textContent = `Rate limits (${mcp.limits?.length ?? 0} client${(mcp.limits?.length ?? 0) === 1 ? "" : "s"} limited)`;
+  limitsbox.append(limitssummary);
+  for (const limit of mcp.limits ?? []) {
+    const line = document.createElement("p");
+    const used = limit.budget !== void 0 ? Math.min(100, Math.round(limit.used / limit.budget * 100)) : 0;
+    const bar = limit.budget !== void 0 ? " " + "\u2588".repeat(Math.round(used / 10)) + "\xB7".repeat(10 - Math.round(used / 10)) : "";
+    line.textContent = `${limit.clientid} \xB7 ${limit.used}${limit.budget !== void 0 ? ` of ${limit.budget}` : " of unbounded"} call${limit.used === 1 ? "" : "s"} in the ${limit.windowms}ms window${bar} \xB7 resets in ${Math.max(0, Math.round((limit.windowstartedat + limit.windowms - Date.now()) / 1e3))}s.`;
+    limitsbox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button("Remove limit", async () => {
+      await request({ kind: "mcpratelimit", clientid: limit.clientid, remove: true });
+      status(`Removed the rate limit of the client ${limit.clientid}; the client stays unbounded because no silent default applies.`);
+      await refresh();
+    }));
+    limitsbox.append(actions);
+  }
+  const limtactions = document.createElement("div");
+  limtactions.className = "actions";
+  const limitclientinput = document.createElement("input");
+  limitclientinput.placeholder = "client id";
+  const limitwindowinput = document.createElement("input");
+  limitwindowinput.placeholder = "window ms";
+  const limitbudgetinput = document.createElement("input");
+  limitbudgetinput.placeholder = "call budget (empty: unbounded)";
+  limtactions.append(limitclientinput, " ", limitwindowinput, " ", limitbudgetinput, " ", button("Limit client", async () => {
+    if (limitclientinput.value.trim() === "") {
+      status("The rate limit needs the client id.", true);
+      return;
+    }
+    await request({ kind: "mcpratelimit", clientid: limitclientinput.value.trim(), windowms: Number(limitwindowinput.value) || 6e4, ...limitbudgetinput.value.trim() !== "" ? { budget: Number(limitbudgetinput.value) } : {} });
+    status(`Limited the client ${limitclientinput.value.trim()} inside its window; the budget stays the user choice.`);
+    await refresh();
+  }));
+  limitsbox.append(limtactions);
+  if ((mcp.limits?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No rate limit configured; an absent limit keeps the client unbounded because no silent default ever applies.";
+    limitsbox.append(empty);
+  }
+  agentprotocolroot.append(limitsbox);
+  const streambox = document.createElement("details");
+  streambox.className = "sessiongroup";
+  const streamsummary = document.createElement("summary");
+  streamsummary.textContent = `Streaming and progress (${mcp.chunks?.length ?? 0} chunk${(mcp.chunks?.length ?? 0) === 1 ? "" : "s"}, ${mcp.progressnotices?.length ?? 0} notice${(mcp.progressnotices?.length ?? 0) === 1 ? "" : "s"})`;
+  streambox.append(streamsummary);
+  for (const notice of (mcp.progressnotices ?? []).slice(0, 5)) {
+    const line = document.createElement("p");
+    line.textContent = `Progress ${notice.percent !== void 0 ? `${notice.percent}%` : ""} of the call ${notice.callid.slice(0, 12)} \xB7 ${notice.message}${notice.cancellable ? " \xB7 cancellable" : ""} \xB7 ${new Date(notice.at).toISOString()}.`;
+    streambox.append(line);
+  }
+  for (const chunk of (mcp.chunks ?? []).slice(0, 10)) {
+    const line = document.createElement("p");
+    line.textContent = `Chunk ${chunk.seq}${chunk.done ? " (done)" : ""} of the call ${chunk.callid.slice(0, 12)} \xB7 ${chunk.content.slice(0, 60)}${chunk.content.length > 60 ? "\u2026" : ""}`;
+    streambox.append(line);
+  }
+  if ((mcp.chunks?.length ?? 0) === 0 && (mcp.progressnotices?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No streamed result yet; a streaming call delivers its content in ordered chunks with progress notices in between.";
+    streambox.append(empty);
+  }
+  agentprotocolroot.append(streambox);
+  const samplingbox = document.createElement("details");
+  samplingbox.className = "sessiongroup";
+  const samplingsummary = document.createElement("summary");
+  samplingsummary.textContent = `Sampling callbacks (${mcp.sampling?.length ?? 0})`;
+  samplingbox.append(samplingsummary);
+  for (const callback of mcp.sampling ?? []) {
+    const line = document.createElement("p");
+    line.textContent = `${callback.state} \xB7 client ${callback.clientid} \xB7 requested ${new Date(callback.requestedat).toISOString()}${callback.answeredat !== void 0 ? ` \xB7 answered ${new Date(callback.answeredat).toISOString()}` : ""}${callback.pagecontent !== void 0 ? " \xB7 page content granted" : " \xB7 page content stripped"}.`;
+    samplingbox.append(line);
+    const payload = document.createElement("p");
+    payload.textContent = `Prompt: ${callback.prompt}${callback.system !== void 0 ? ` System: ${callback.system}` : ""}${callback.answer !== void 0 ? ` Answer: ${callback.answer}` : ""}`;
+    samplingbox.append(payload);
+    if (callback.state === "pending") {
+      const actions = document.createElement("div");
+      actions.className = "actions";
+      const answerinput = document.createElement("input");
+      answerinput.placeholder = "client answer for the local test";
+      actions.append(answerinput, " ", button("Record answer", async () => {
+        await request({ kind: "mcpsampling", respond: true, samplingid: callback.id, ...answerinput.value.trim() !== "" ? { answer: answerinput.value.trim() } : { refused: true } });
+        status(`Closed the sampling round trip ${callback.id.slice(0, 12)}.`);
+        await refresh();
+      }));
+      samplingbox.append(actions);
+    }
+  }
+  if ((mcp.sampling?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No sampling callback yet; a callback asks a paired client model for a completion and the page content rides it only behind the user grant.";
+    samplingbox.append(empty);
+  }
+  const samplingactions = document.createElement("div");
+  samplingactions.className = "actions";
+  const samplingclientinput = document.createElement("input");
+  samplingclientinput.placeholder = "client id";
+  const samplingpromptinput = document.createElement("input");
+  samplingpromptinput.placeholder = "prompt for the client model";
+  const samplingpageinput = document.createElement("input");
+  samplingpageinput.placeholder = "page content (empty: none)";
+  samplingactions.append(samplingclientinput, " ", samplingpromptinput, " ", samplingpageinput, " ", button("Ask client model", async () => {
+    if (samplingclientinput.value.trim() === "" || samplingpromptinput.value.trim() === "") {
+      status("The sampling callback needs the client id and the prompt.", true);
+      return;
+    }
+    await request({ kind: "mcpsampling", clientid: samplingclientinput.value.trim(), prompt: samplingpromptinput.value.trim(), ...samplingpageinput.value.trim() !== "" ? { pagecontent: samplingpageinput.value.trim(), pagegrant: true } : {} });
+    status(`Sent one sampling callback to the client ${samplingclientinput.value.trim()}; the exact payload rides this view.`);
+    await refresh();
+  }));
+  samplingbox.append(samplingactions);
+  agentprotocolroot.append(samplingbox);
+  const subsbox = document.createElement("details");
+  subsbox.className = "sessiongroup";
+  const subssummary = document.createElement("summary");
+  subssummary.textContent = `Subscriptions (${mcp.subscriptions?.length ?? 0} event, ${mcp.watches?.length ?? 0} resource)`;
+  subsbox.append(subssummary);
+  for (const subscription of mcp.subscriptions ?? []) {
+    const line = document.createElement("p");
+    line.textContent = `Client ${subscription.clientid} \xB7 kinds ${subscription.kinds.join(", ")}${subscription.origin !== void 0 ? ` \xB7 origin ${subscription.origin}` : ""}${subscription.tool !== void 0 ? ` \xB7 tool ${subscription.tool}` : ""} \xB7 subscribed ${new Date(subscription.createdat).toISOString()}${subscription.lastdeliveredat !== void 0 ? ` \xB7 last delivery ${new Date(subscription.lastdeliveredat).toISOString()}` : ""}.`;
+    subsbox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button("Unsubscribe", async () => {
+      await request({ kind: "mcpsubscribe", clientid: subscription.clientid, subscriptionid: subscription.id, unsubscribe: true });
+      status(`Cancelled the event subscription of the client ${subscription.clientid}.`);
+      await refresh();
+    }));
+    subsbox.append(actions);
+  }
+  for (const watch of mcp.watches ?? []) {
+    const line = document.createElement("p");
+    line.textContent = `Client ${watch.clientid} watches the ${watch.resource} resource \xB7 since ${new Date(watch.createdat).toISOString()}${watch.lastdeliveredat !== void 0 ? ` \xB7 last delta ${new Date(watch.lastdeliveredat).toISOString()}` : ""}.`;
+    subsbox.append(line);
+    const actions = document.createElement("div");
+    actions.className = "actions";
+    actions.append(button("Unwatch", async () => {
+      await request({ kind: "mcpresource", clientid: watch.clientid, watchid: watch.id, unwatch: true });
+      status(`Cancelled the ${watch.resource} resource watcher of the client ${watch.clientid}.`);
+      await refresh();
+    }));
+    subsbox.append(actions);
+  }
+  if ((mcp.subscriptions?.length ?? 0) === 0 && (mcp.watches?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No subscription yet; a paired client subscribes its event kinds and watches page state resources through the frame intake.";
+    subsbox.append(empty);
+  }
+  agentprotocolroot.append(subsbox);
+  const batchbox = document.createElement("details");
+  batchbox.className = "sessiongroup";
+  const batchsummary = document.createElement("summary");
+  batchsummary.textContent = `Batch calls (${mcp.batches?.length ?? 0})`;
+  batchbox.append(batchsummary);
+  for (const batch of mcp.batches ?? []) {
+    const line = document.createElement("p");
+    const done = batch.outcomes.length;
+    line.textContent = `${batch.state} \xB7 client ${batch.clientid} \xB7 ${done} of ${batch.calls.length} member${batch.calls.length === 1 ? "" : "s"} done \xB7 stop on error ${batch.stoponerror ? "on" : "off"} \xB7 created ${new Date(batch.createdat).toISOString()}.`;
+    batchbox.append(line);
+    for (const outcome of batch.outcomes.slice(0, 10)) {
+      const item = document.createElement("p");
+      item.textContent = `  ${outcome.ok ? "ran" : "failed"} \xB7 ${outcome.tool} (${outcome.callid}).`;
+      batchbox.append(item);
+    }
+  }
+  if ((mcp.batches?.length ?? 0) === 0) {
+    const empty = document.createElement("p");
+    empty.textContent = "No batch call yet; an ordered batch runs its members behind the gates and stops at the first error when the flag requests it.";
+    batchbox.append(empty);
+  }
+  agentprotocolroot.append(batchbox);
   const callsbox = document.createElement("details");
   callsbox.className = "sessiongroup";
   const callssummary = document.createElement("summary");
-  callssummary.textContent = `Recent tool calls (${mcp.calls.length})`;
+  callssummary.textContent = `Audited tool calls (${(mcp.calllog ?? mcp.calls).length} shown, every call logged)`;
   callsbox.append(callssummary);
-  for (const call of mcp.calls.slice(0, 25)) {
+  for (const call of (mcp.calllog ?? mcp.calls).slice(0, 25)) {
     const line = document.createElement("p");
-    line.textContent = `${new Date(call.at).toISOString()} \xB7 ${call.clientid} \xB7 ${call.tool} \xB7 ${call.origin} \xB7 ${call.ok ? "ran behind the gates" : `refused${call.code !== void 0 ? ` (${call.code})` : ""}`}`;
+    line.textContent = `${new Date(call.at).toISOString()} \xB7 ${call.clientid} \xB7 ${call.tool} \xB7 ${call.origin} \xB7 ${call.ok ? "ran behind the gates" : `refused${call.code !== void 0 ? ` (${call.code})` : ""}`}${call.dryrun === true ? " \xB7 dry run" : ""}${call.mocked === true ? " \xB7 mocked" : ""}${call.batchid !== void 0 ? " \xB7 batch member" : ""}${call.idempotencykey !== void 0 ? ` \xB7 key ${call.idempotencykey.slice(0, 10)}` : ""}${call.replayed === true ? " \xB7 idempotent replay" : ""}`;
     callsbox.append(line);
   }
-  if (mcp.calls.length === 0) {
+  if ((mcp.calllog ?? mcp.calls).length === 0) {
     const empty = document.createElement("p");
-    empty.textContent = "No tool call yet; every call records the client, tool and outcome without payloads.";
+    empty.textContent = "No tool call yet; every call records the client, tool, outcome and idempotency key without payloads.";
     callsbox.append(empty);
   }
   agentprotocolroot.append(callsbox);