browser-broker 0.1.0

package/dist/src/tool/session.js

@@ -0,0 +1,351 @@
+import { toolStdioAdapter } from "./adapter.js";
+import { decodeMessage, encodeMessage, METHODS, negotiateProtocolVersion, NOTIFICATIONS, } from "./protocol.js";
+import { TOOLS_BY_NAME, TOOL_DEFINITIONS } from "./tools.js";
+/**
+ * What this surface calls itself during the handshake.
+ *
+ * The version was a literal `0.0.0` for as long as the package was private
+ * and unversioned: reading a manifest that says "unset" would have reported
+ * that as though it were a release. **That reservation expired when the
+ * package was versioned and published**, which the comment here anticipated
+ * as the one line that would have to agree with it — so it now reads the
+ * manifest for the same reason the command line does, and the two cannot
+ * disagree because there is only one of them.
+ *
+ * Read once at module load rather than per handshake: it cannot change while
+ * the process runs, and a session serves one client.
+ */
+const manifest = await import('../../package.json', { with: { type: 'json' } });
+export const SERVER_INFO = {
+    name: 'browser-broker',
+    version: typeof manifest.default.version === 'string'
+        ? manifest.default.version
+        : '0.0.0',
+};
+/**
+ * What `initialize` returns: the negotiated revision, what this server can
+ * do, and what it is.
+ *
+ * **`capabilities` announces `tools` and nothing else, because there is
+ * nothing else.** This surface serves no resources and no prompts, and
+ * claiming either would make a client offer its user a menu that answers
+ * `method_not_found` when chosen. An empty object is the specification's way
+ * of saying "this capability, with no optional extras" — notably not
+ * `listChanged`, since the twelve tools are fixed at build time and a surface
+ * that promised change notifications would owe notifications it can never
+ * have a reason to send.
+ */
+export function initializeResult(params) {
+    return {
+        protocolVersion: negotiateProtocolVersion(params['protocolVersion']),
+        capabilities: { tools: {} },
+        serverInfo: SERVER_INFO,
+    };
+}
+/** What `tools/list` returns: the twelve, with their descriptions and schemas. */
+export function listTools() {
+    return {
+        tools: TOOL_DEFINITIONS.map((tool) => ({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: {
+                type: 'object',
+                properties: Object.fromEntries(tool.arguments.map((argument) => [
+                    argument.name,
+                    { type: argument.type, description: argument.description },
+                ])),
+                required: tool.arguments
+                    .filter((argument) => argument.required)
+                    .map((argument) => argument.name),
+            },
+        })),
+    };
+}
+/**
+ * Fields never written to the protocol stream, on any message.
+ *
+ * §5.6 states it for the command line — "the lease key is never printed by
+ * any command, including in error output and in the machine-readable mode,
+ * where the field is absent rather than masked". **The same rule holds here,
+ * and holding it on one route only would be exactly the drift the parity
+ * claim exists to prevent.**
+ *
+ * There is one deliberate exception, and it is the reason this list is not
+ * simply reused from the command line: `browser_claim` **has to** return the
+ * key it just issued, or the lease it granted is unreachable. So the rule is
+ * enforced on the way out of every *other* tool, and the grant is the single
+ * named hole.
+ */
+export const NEVER_RETURNED = ['lease_key', 'leaseKey', 'key'];
+/** Strip anything that must never be returned, at every depth. */
+export function withoutSecrets(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => withoutSecrets(entry));
+    }
+    if (value !== null && typeof value === 'object') {
+        const output = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (NEVER_RETURNED.includes(key)) {
+                continue;
+            }
+            output[key] = withoutSecrets(entry);
+        }
+        return output;
+    }
+    return value;
+}
+/**
+ * Render a value as the text a client shows, and carry it structured beside.
+ *
+ * ── Both, not either, and the specification asks for exactly that ───────
+ *
+ * "For backwards compatibility, a tool that returns structured content SHOULD
+ * also return the serialized JSON in a TextContent block." A client too old
+ * to know about `structuredContent` still has something to render, and one
+ * that does know reads the object without parsing the string back.
+ *
+ * **The structured half is what keeps the refusal taxonomy machine-readable.**
+ * `outcome`, `code` and `rule` are the fields a caller branches on — retry a
+ * capacity refusal, do not retry a typo — and flattening them into a sentence
+ * would leave every caller matching on English. That taxonomy is the best
+ * thing on this surface and it survives this change intact: the same four
+ * fields, in the same spellings, one level further in.
+ *
+ * Indented rather than dense, because the text block is the half a person
+ * reads.
+ */
+function asContent(value) {
+    return [{ type: 'text', text: JSON.stringify(value, null, 2) }];
+}
+/**
+ * A refusal, shaped for the wire.
+ *
+ * ── Why a refusal is `isError: true` and still a *result* ───────────────
+ *
+ * It stays a JSON-RPC result — that part is unchanged and the reasoning below
+ * it is unchanged. What is new is the flag, and the specification is explicit
+ * about which way it goes: "Any errors that originate from the tool SHOULD be
+ * reported inside the result object, with `isError` set to true, *not* as an
+ * MCP protocol-level error response. Otherwise, the LLM would not be able to
+ * see that an error occurred and self-correct."
+ *
+ * Self-correction is precisely what this service's refusals are for. They
+ * name a rule and say what to do instead — `act.ref_resolves` tells a caller
+ * to read the page again, `claim.browser_known` lists the browsers by name —
+ * and a caller that acts on one recovers in a single attempt. Marking them as
+ * errors is what puts them in front of the model rather than leaving them to
+ * be mistaken for success.
+ *
+ * **`isError` is not a demotion of the taxonomy.** It is one boolean added
+ * beside four fields that all survive; a caller reading `code` and `rule` out
+ * of `structuredContent` gets everything it got before.
+ *
+ * What does *not* become `isError` is a protocol failure — an unknown tool,
+ * an unknown method, a malformed call. The specification puts "errors in
+ * finding the tool" on the protocol side, and this surface already answered
+ * them there with its own name carried alongside the integer. That design is
+ * untouched.
+ */
+function refusalResult(refusal) {
+    const structured = {
+        outcome: 'refused',
+        code: refusal.code,
+        rule: refusal.rule,
+        message: refusal.message,
+        ...(refusal.details === undefined ? {} : { details: withoutSecrets(refusal.details) }),
+    };
+    return {
+        // **The sentence alone, not the serialised object.** A refusal's message
+        // is written to be read — it says what was refused and what to do next —
+        // and wrapping it in JSON braces would bury the one part of this result a
+        // person or a model acts on. The machine-readable half is directly below
+        // it, so nothing is lost by rendering this half plainly.
+        content: [{ type: 'text', text: `refused (${refusal.rule}): ${refusal.message}` }],
+        structuredContent: structured,
+        isError: true,
+    };
+}
+/**
+ * Answer one request.
+ *
+ * Exported so a test can drive a single exchange, and so the conformance
+ * driver can go through the real handler rather than around it.
+ */
+export async function handleRequest(request, options) {
+    if (request.method === METHODS.initialize) {
+        return { id: request.id, result: initializeResult(request.params ?? {}) };
+    }
+    if (request.method === METHODS.listTools) {
+        return { id: request.id, result: listTools() };
+    }
+    if (request.method !== METHODS.callTool) {
+        return {
+            id: request.id,
+            error: {
+                code: 'method_not_found',
+                message: `This surface answers ${METHODS.initialize}, ${METHODS.listTools} and ${METHODS.callTool}. It has no "${request.method}".`,
+            },
+        };
+    }
+    const params = request.params ?? {};
+    const name = params['name'];
+    if (typeof name !== 'string') {
+        return {
+            id: request.id,
+            error: { code: 'malformed_call', message: 'A tool call names the tool it is calling.' },
+        };
+    }
+    const tool = TOOLS_BY_NAME.get(name);
+    if (tool === undefined) {
+        return {
+            id: request.id,
+            error: {
+                code: 'tool_not_found',
+                message: `There is no tool named "${name}". Call ${METHODS.listTools} for the twelve this surface offers.`,
+            },
+        };
+    }
+    const outcome = await toolStdioAdapter.invoke(options.service, tool.operation, {
+        name,
+        arguments: params['arguments'],
+    });
+    if (outcome.outcome === 'accepted') {
+        // A grant has to carry the key it issued or the lease is unreachable;
+        // everything else is stripped. The exception is named rather than
+        // implicit, so widening it is a visible change.
+        const value = tool.operation === 'claim' ? outcome.value : withoutSecrets(outcome.value);
+        const structured = { outcome: 'accepted', value };
+        const result = {
+            // The whole outcome is serialised, `outcome` and `value` together,
+            // rather than the value alone. A client showing only the inner object
+            // would leave a caller unable to tell an acceptance from a refusal
+            // without reading `isError`, and the two spellings agreeing is what
+            // makes the text and the structure the same answer.
+            content: asContent(structured),
+            structuredContent: structured,
+        };
+        return { id: request.id, result };
+    }
+    // **A refusal is a successful response carrying a refusal, not a protocol
+    // error.** `SCHEMA.md` §5.6: a refusal is the service working, and the
+    // command line gives it its own exit code rather than the malformed-command
+    // one for exactly this reason. A caller can retry a capacity refusal
+    // intelligently; it cannot retry a typo. Collapsing the two would take that
+    // distinction away from every caller on this route and from nobody on the
+    // other, which is the drift the parity claim exists to catch.
+    //
+    // It is marked `isError` so a model sees it and self-corrects — see
+    // {@link refusalResult}, which is also where the taxonomy is kept intact.
+    return {
+        id: request.id,
+        result: refusalResult({
+            code: outcome.code,
+            rule: outcome.rule,
+            message: outcome.message,
+            ...(outcome.details === undefined ? {} : { details: outcome.details }),
+        }),
+    };
+}
+/**
+ * Serve one session: answer every line until the input ends, then return.
+ *
+ * Returns the number of requests answered, so a caller — or a test — can tell
+ * a session that served nothing from one that served something without
+ * parsing what it wrote.
+ */
+export async function serveSession(lines, options) {
+    let answered = 0;
+    for await (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (line === '') {
+            continue;
+        }
+        const decoded = decodeMessage(line);
+        // **A notification draws no response, and that is the whole handling.**
+        // `notifications/initialized` is the client saying the handshake is
+        // complete; there is nothing to do with it and — the part that matters —
+        // nothing to send back. A strict client that receives a reply to a
+        // message it sent without an identifier is entitled to treat the stream
+        // as broken, so this branch deliberately writes nothing and does not
+        // count toward the answered total, which is what makes "answered
+        // nothing" assertable by a test.
+        if (decoded.kind === 'notification') {
+            const known = Object.values(NOTIFICATIONS).includes(decoded.notification.method);
+            options.streams.log?.(known
+                ? `noted ${decoded.notification.method}`
+                : // An unknown notification is still a notification. Answering it
+                    // with `method_not_found` would be a reply to something that must
+                    // not be replied to, so it is logged and dropped — which is what
+                    // the specification asks of a receiver that does not recognise
+                    // one.
+                    `ignored an unrecognised notification: ${decoded.notification.method}`);
+            continue;
+        }
+        if (decoded.kind === 'malformed') {
+            // `decoded.id === undefined` means the id KEY itself was absent — a
+            // notification-shaped line this surface could not otherwise read —
+            // so there is nobody to answer, and it is reported on the log stream
+            // rather than dropped in silence. `decoded.id === null` is different:
+            // the key was present but unusable (not a number or a string), which
+            // is a request with an id this surface cannot echo back — answered
+            // below with `id: null`, JSON-RPC's own way of saying so, rather than
+            // silently read as the notification it is not.
+            if (decoded.id === undefined) {
+                options.streams.log?.(`ignored a message that could not be answered: ${decoded.why}`);
+                continue;
+            }
+            options.streams.write(encodeMessage({
+                id: decoded.id,
+                error: { code: 'malformed_message', message: decoded.why },
+            }));
+            answered += 1;
+            continue;
+        }
+        const response = await answerOrReportFailure(decoded.request, options);
+        options.streams.write(encodeMessage(response));
+        answered += 1;
+    }
+    return answered;
+}
+/**
+ * Answer a request, turning an unexpected throw into a protocol error.
+ *
+ * **A session that died on one bad call would take the caller's whole session
+ * with it**, including a lease it is holding, which the caller then cannot
+ * release. So an unexpected failure is answered and the loop continues. This
+ * is not swallowing: the caller is told, by identifier, that the call failed.
+ */
+async function answerOrReportFailure(request, options) {
+    try {
+        return await handleRequest(request, options);
+    }
+    catch (error) {
+        return {
+            id: request.id,
+            error: {
+                code: 'unexpected_failure',
+                message: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+}
+/** Split a byte stream into lines, for the real standard input. */
+export async function* linesFrom(input) {
+    let buffer = '';
+    for await (const chunk of input) {
+        buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+        let newline = buffer.indexOf('\n');
+        while (newline !== -1) {
+            yield buffer.slice(0, newline);
+            buffer = buffer.slice(newline + 1);
+            newline = buffer.indexOf('\n');
+        }
+    }
+    // A final line with no trailing newline is still a message. Dropping it
+    // would make the surface's behaviour depend on whether the caller's last
+    // write happened to end in a newline, which is not a distinction any caller
+    // knows it is making.
+    if (buffer.trim() !== '') {
+        yield buffer;
+    }
+}

package/dist/src/tool/tools.js

@@ -0,0 +1,310 @@
+import { OPERATION_NAMES } from "../adapter/operations.js";
+import { BROWSER_CHOICE_GUIDANCE } from "../browser/driver.js";
+/** Every tool takes the key except the first and the last (§3.1). */
+const LEASE_KEY = {
+    name: 'lease_key',
+    type: 'string',
+    required: true,
+    description: 'Your lease key, from browser_claim. Every call carrying it extends the lease.',
+};
+/**
+ * The twelve, in §3.1's order.
+ *
+ * The list is data rather than a switch statement for the same reason the
+ * command table is: the conformance driver reads it to translate a neutral
+ * case input into a tool call, so the tool a caller invokes and the tool the
+ * parity suite drives are the same string.
+ */
+export const TOOL_DEFINITIONS = [
+    {
+        name: 'browser_claim',
+        operation: 'claim',
+        description: 'Ask for a lease on one browser tab. You get a tab, or a place in the queue — queued is an ' +
+            'outcome, not a failure; poll browser_status until it turns active. One lease is one tab: ' +
+            'call this again for a second.',
+        arguments: [
+            {
+                name: 'session_id',
+                type: 'string',
+                required: true,
+                description: 'Who you are. Attributed on captures and in the ledger; it is not a limit.',
+            },
+            {
+                name: 'browser',
+                type: 'string',
+                // **Optional** (`DECISIONS.md` §13i): unstated resolves to the first
+                // signed-in browser. The two wrong guesses are not symmetric —
+                // defaulting to clean-room when a sign-in was wanted returns a login
+                // redirect, a wrong page that looks like a right one, while
+                // defaulting to signed-in returns a personalised page, which is the
+                // page most callers were asking for.
+                required: false,
+                // **Row #66 lands here.** The description is the only place a calling
+                // agent reliably reads, and 25 measured sessions hand-seeded tokens
+                // into an isolated browser while the signed-in one sat unused. The
+                // cookie-jar caveat is carried in the same string rather than left to
+                // a refusal — and the default makes that more load-bearing, not less,
+                // because a caller that states nothing never sees a refusal at all.
+                description: BROWSER_CHOICE_GUIDANCE,
+            },
+            {
+                name: 'purpose',
+                type: 'string',
+                required: true,
+                description: 'What this lease is for, in human words, 3-200 characters. Read by an operator ' +
+                    'deciding whether to revoke it.',
+            },
+            {
+                name: 'storage_seed',
+                type: 'array',
+                required: false,
+                description: 'Up to 16 storage entries written into the origin before the first load. For a token ' +
+                    'obtained from an API rather than a login form. Written as data, never evaluated.',
+            },
+        ],
+    },
+    {
+        name: 'browser_status',
+        operation: 'status',
+        description: 'Where your lease stands — and the call that renews it. There is deliberately no separate ' +
+            'renew tool: every keyed call extends the lease, and this is the one that does nothing ' +
+            'else. Call it to keep a lease alive, and to poll a queued one.',
+        arguments: [LEASE_KEY],
+    },
+    {
+        name: 'browser_release',
+        operation: 'release',
+        description: 'Give back whatever you hold — your tab, or your place in the queue. Do this when you are ' +
+            'done rather than letting the lease lapse: it frees capacity for the next caller ' +
+            'immediately. Releasing twice is fine.',
+        arguments: [LEASE_KEY],
+    },
+    {
+        name: 'browser_tab_replace',
+        operation: 'tab_replace',
+        description: 'Discard this lease’s tab and open a fresh one, keeping the lease and its expiry. ' +
+            'For a tab that has stopped responding — a wedged page cannot be fixed by navigating, ' +
+            'because navigating is a request to that page. For a working tab use browser_navigate, ' +
+            'which is cheaper.',
+        arguments: [LEASE_KEY],
+    },
+    {
+        name: 'browser_navigate',
+        operation: 'navigate',
+        description: 'Point your tab at an address. Returns the final address after redirects, the title, the ' +
+            'status, and a path to the accessibility snapshot taken on arrival — a path, because a ' +
+            'snapshot is thousands of tokens and you usually want one part of it.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'url',
+                type: 'string',
+                required: true,
+                description: 'Ordinary web traffic or a blank page. A local-file address is refused: it would turn ' +
+                    'a browser lease into a read of the machine’s filesystem.',
+            },
+            {
+                name: 'wait_ms',
+                type: 'integer',
+                required: false,
+                description: 'How long to wait for the page, in milliseconds.',
+            },
+        ],
+    },
+    {
+        name: 'browser_act',
+        operation: 'act',
+        description: 'Do one thing to the page: click, type, fill, press, select, hover, check, scroll, resize, ' +
+            'emulate, dialog. Element references come from a snapshot. Returns a fresh snapshot after ' +
+            'every change, because your next reference has to come from the page as it is now.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'action',
+                type: 'string',
+                required: true,
+                description: 'One of the verbs above. An unknown verb is refused with the full list.',
+            },
+            {
+                name: 'target',
+                type: 'string',
+                required: false,
+                description: 'The element reference, from a snapshot, where the action needs one.',
+            },
+            {
+                name: 'value',
+                type: 'string',
+                required: false,
+                description: 'What to type, select, or answer a dialog with.',
+            },
+        ],
+    },
+    {
+        name: 'browser_read',
+        operation: 'read',
+        description: 'Read the page: the accessibility snapshot by default, or the console, network or cookies ' +
+            'on request. Written to disk and returned as a path, so you pay for the part you open ' +
+            'rather than for all of it.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'what',
+                type: 'string',
+                required: false,
+                description: '"snapshot" (default), "console", "network" or "cookies".',
+            },
+        ],
+    },
+    {
+        name: 'browser_evaluate',
+        operation: 'evaluate',
+        description: 'Evaluate an expression in the page and get its value back. For a fact about the page that ' +
+            'the snapshot does not carry.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'expression',
+                type: 'string',
+                required: true,
+                description: 'The expression. Bounded in length; an over-long one is refused.',
+            },
+        ],
+    },
+    {
+        name: 'browser_capture',
+        operation: 'capture',
+        description: 'Take a picture of the page — and, if you name an earlier capture, what changed since it. ' +
+            'Returns paths, never the image itself. A selector and a full page cannot both be asked ' +
+            'for. Never refused for cost.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'selector',
+                type: 'string',
+                required: false,
+                description: 'Capture one element rather than the viewport.',
+            },
+            {
+                name: 'full_page',
+                type: 'boolean',
+                required: false,
+                description: 'Capture the whole scrollable page. Not combinable with a selector.',
+            },
+            {
+                name: 'compare_to',
+                type: 'string',
+                required: false,
+                description: 'An earlier capture to diff against. The diff rides here rather than being its own tool.',
+            },
+            {
+                name: 'reason',
+                type: 'string',
+                required: false,
+                description: 'Free text, recorded, never refused — why this capture needed more than the default tier.',
+            },
+        ],
+    },
+    {
+        name: 'browser_sign_in',
+        operation: 'sign_in',
+        // **Row #67 lands here, and §3.2's sentence is the reason.** The
+        // description is the only place a calling agent reliably reads, and the
+        // measured failure this tool exists to end is one no refusal can reach: a
+        // caller that hits a login wall and never learns it could ask. §1.2
+        // counted 25 sessions hand-seeding tokens into an isolated browser rather
+        // than asking, so the alternative is named explicitly — the way the
+        // refusals do — rather than left to be inferred from the tool existing.
+        description: 'Hit a login wall? Ask the person to sign in, on the tab you already have. Do NOT abandon ' +
+            'the task and do NOT fabricate a session by seeding tokens or cookies — ask. Your lease and ' +
+            'your tab survive the wait: keep calling browser_status while the person signs in, then ' +
+            'call browser_sign_in_done when they say they are finished. The result carries a sentence ' +
+            'to relay to them. If nobody answers, the request lapses and the browser serves others ' +
+            'again — you keep your tab either way.',
+        arguments: [
+            LEASE_KEY,
+            {
+                name: 'what',
+                type: 'string',
+                required: true,
+                description: 'What they are signing into, 3-200 characters, relayed to them verbatim. Name the site ' +
+                    'or account — "the account dashboard" — not the step you are on.',
+            },
+            {
+                name: 'request_seconds',
+                type: 'integer',
+                required: false,
+                description: 'Ask for a shorter wait than the default. Capped, never extended; the wait you actually ' +
+                    'got comes back on the response.',
+            },
+        ],
+    },
+    {
+        name: 'browser_sign_in_done',
+        operation: 'sign_in_done',
+        description: 'The person says they have signed in. Gives the browser back to other callers and keeps ' +
+            'your lease and your tab exactly as they were, so carry straight on. Only the lease that ' +
+            'asked can call this.',
+        arguments: [LEASE_KEY],
+    },
+    {
+        name: 'browser_feedback',
+        operation: 'feedback',
+        description: 'Tell this service that something helped or got in the way. No lease needed — if your ' +
+            'claim was just refused, you are exactly who this is for. Rate 1 (it stalled my work) to ' +
+            '5 (it made my work faster); 3 is neutral. The lease, your last operation and the refusal ' +
+            'you hit are captured for you: say what you were trying to achieve and what you expected. ' +
+            'Written locally, never transmitted.',
+        arguments: [
+            {
+                name: 'rating',
+                type: 'integer',
+                required: true,
+                description: '1 it stalled the work · 2 substantial friction · 3 neutral · 4 it helped, with a ' +
+                    'rough edge · 5 it made the work faster. The axis is help versus hinder, not liking.',
+            },
+            {
+                name: 'category',
+                type: 'string',
+                required: true,
+                description: 'refusal-unclear · no-path · worked-around · surprised-me · worked-well. One of those five.',
+            },
+            {
+                name: 'note',
+                type: 'string',
+                required: true,
+                description: '20-2000 characters: what you were trying to achieve, what you expected, and what you ' +
+                    'did instead. Do not type the lease id, the operation or the rule — those are captured.',
+            },
+            {
+                name: 'session_id',
+                type: 'string',
+                required: false,
+                description: 'Your identity, when there is no lease to read one from.',
+            },
+            {
+                name: 'lease_key',
+                type: 'string',
+                required: false,
+                description: 'When you hold one. It only attaches the row to a lease; it authorises nothing.',
+            },
+        ],
+    },
+];
+/**
+ * The tools, by name.
+ *
+ * Built once rather than searched linearly per call, and exported so the
+ * surface and its tests look a tool up the same way.
+ */
+export const TOOLS_BY_NAME = new Map(TOOL_DEFINITIONS.map((tool) => [tool.name, tool]));
+/** Every operation this surface offers, read from the tool table. */
+export const TOOL_OPERATIONS = TOOL_DEFINITIONS.map((tool) => tool.operation);
+/**
+ * Operations the surface offers, named so a test can compare by name.
+ *
+ * `MILESTONES.md` records a hollow test that "iterated a list rather than
+ * naming its entries, so deleting an entry stayed green". A test comparing
+ * this against {@link OPERATION_NAMES} by name catches a deletion; one
+ * comparing lengths does not.
+ */
+export const OPERATIONS_WITH_TOOLS = OPERATION_NAMES.filter((operation) => TOOL_DEFINITIONS.some((tool) => tool.operation === operation));