lasso-mcp 1.29.0 → 1.29.1

package/README.en.md

@@ -212,7 +212,7 @@ Goes to the Internet Archive (Wayback Machine) to find the last archived copy of
 
 ## Install
 
-**Current version v1.29.0** (changelog in the collapsed block at the end of this section).
+**Current version v1.29.1** (changelog in the collapsed block at the end of this section).
 
 Prerequisites: Node.js ≥ 20 + Claude Code (or any MCP-capable client).
 
@@ -227,8 +227,9 @@ Restart Claude Code → `/mcp` → `lasso ✓ Connected`. **That's the one line
 **Deterministic render browser for other AI tools (render tier)**: if you use rendering tools like media-gen-mcp that demand "same input → same pixels", one line after installing lasso — `npx -y lasso-mcp render-chrome --ensure` — brings up a deterministic headless Chrome on port 9224 (frozen flag snapshot + isolated temp profile) and prints the `wsEndpoint` for the consumer to attach to; **the browser keeps running even if the consumer process is SIGKILLed** (lifecycle owned by lasso), and it is idle-reaped after 10 minutes with its profile cleaned up (tunable via `LASSO_RENDER_IDLE_MS`). Companions: `render-chrome --status` introspection / `--stop` (honors `LASSO_RENDER_PORT`: an explicit valid port stops only that port, unset = all render records, an invalid value exits 1; global teardown remains `chrome-stop --modes render`) / `render-chrome doctor [--clean]` orphan & stale-profile sweep (dry-run by default; honors `LASSO_RENDER_PORT` like `--stop`: an explicit valid port scopes the orphan scan, unset = full scan, an invalid value exits 1; in-use instances with a touch heartbeat within 10 minutes are exempt from orphan judgment). **Multiple parallel acceptance agents on one machine** (whose independent teardown commands would kill each other's instances) need a three-env namespace: `LASSO_RENDER_PORT` + `LASSO_LAUNCHED_CHROMES_PATH` + `LASSO_RENDER_GUARDIAN_PID_PATH` — with all three set, parallel agents are mutually invisible; see the full recipe and teardown discipline in [doc/渲染档-并行验收隔离配方.md](doc/渲染档-并行验收隔离配方.md) (Chinese).
 
 <details>
-<summary>📋 Changelog (v1.8 → v1.29.0 — click to see what each version changed)</summary>
+<summary>📋 Changelog (v1.8 → v1.29.1 — click to see what each version changed)</summary>
 
+- **v1.29.1**: release fix — v1.29.0's npm package carried a stale dist (published without rebuilding after the version bump, so `doctor` reported 1.28.0); this version rebuilds before publishing, zero content change. Lesson locked in: after the version triple, always `npm run build` before publish.
 - **v1.29.0**: input-primitive completion + honest-signal batch — the "input guard layer" falsification re-analysis, doc/bugs/11) — the afternoon field report's P0 verdict ("tm.aliyun.com's input guard instantly clears programmatically set values") was **falsified** by a controlled white-box re-analysis: the real mechanism is the **state-integrity semantics of a React 16/17 controlled component** (script writes don't fire onChange → on blur/commit the framework rewrites the DOM back to the committed state — the value survives until blur, it does not vanish in milliseconds; the "six attacks all failed" was an observation-surface error: the submit went through `window.open` into a NEW tab, the original page's URL never changes → `wait url_contains` is structurally blind, while the uid-path fill completed a real search end-to-end that same day). Deliverables: (1) **`type` / `press` input-primitive completion** (the missing third of the click/fill/type triad): `action:"type"` + `selectors:{<uid|ref>:<text>}` — per-key dispatch through the CDP `Input.dispatchKeyEvent` **trusted input pipeline** (marked `isTrusted:true` by the browser, enters the framework input pipeline, React onChange fires normally, survives blur; same tier as Playwright's `page.keyboard.type()`; long texts are also per-key — covering the fault line where fill's uid path flips to an untrusted JS bulk-set path at ≥100 chars); **append semantics** (= Playwright `page.type`; fill replaces); ref-path focus-receipt failure reports `type_focus_failed` (didnt — no guessing); `action:"press"` + `key:"Enter"` (modifiers split + failure-release guaranteed upstream) — implemented as mappings onto the locked upstream `type_text`/`press_key` tools (no direct CDP); submitKey is NOT exposed (submissions go explicitly through a follow-up press/click — a two-step chain is more auditable). (2) **`input_guard_suspected` honest signal** (advisory, eviction-sentinel paradigm): the ref fill/type path embeds three probes (non-native value setter installed / ~250ms in-page readback mismatch / React tracker divergence) — a hit attaches the signal + a hint with three legal exits (switch to the trusted type pipeline / re-extract for the snapshot-uid path / ask the user to type physically); **signal only, NEVER auto-reroutes** (no automatic primitive switch/retry/channel change), probes are pure reads with zero side effects (synthesizing blur for probing is forbidden). (3) **wait-timeout observation-surface teaching**: `wait_timeout` errors gain a window.open new-tab teaching sentence (the original page's URL never changes — this timeout shape now carries its attribution clue) + TROUBLESHOOTING §2.19 (including the `navigate → wait{selector} → fill → press/click` chain recipe; the fill-timing-race hypothesis was falsified with no reproducer — no defensive code written). (4) **no_reload semantics clarification**: the describe gains the "this is NOT a skip-navigation flag" clause (substantially different URLs always navigate; identical URLs never navigate at all — that's url rule 2, unrelated to this flag) + §2.20 four-row behavior matrix + a semantics-pinning spec (description and behavior now pinned together by tests). (5) **governance/13 synthetic-input ethics boundary declaration**: the sanctioned face = standard primitives + honest signals + the trust-ladder doc; **Rejected-by-design** = keystroke-rhythm randomization/human-mimicry delays, `_valueTracker` spoofing, accessor un-hooking, isTrusted forgery, and every wrapper that "makes fill look like human typing" (deceiving site-side mechanisms ≠ input capability; only an explicit, item-by-item user ruling can overturn it). Stance: **the wall is there and we tell you** — only two legal ways through (switch to the trusted primitive, or ask the user to type physically); lasso never decides to attack the wall for you. (6) HighRiskGate gains the `type` branch: RTE-blacklisted elements block type exactly like fill (closing the rename-bypass gap; press has no DOM target and stays evaluate-tier unblocked, documented). (7) Upstream-contract dead list gains `type_text`/`press_key` (P10 pre-gate false-red fix) + explicit description budget-cap re-baselining (fleet 59,850 / HEADLESS 13,900 / L2 2,300→2,450 — §5.1-3 single-topic cap-raise discipline). (8) Local input-guard fixture regression (opt-in `LASSO_TEST_INPUT_GUARD=1`, bound to 127.0.0.1): all three mechanism families check-typed + type/uid paths verified to survive blur.
 - **v1.28.0**: the kill-silent-failure batch after the cgEvent delivery "break" was falsified (driven by the trademark-site slider field report, doc/bugs/10) — white-box verdict: the HID delivery chain is intact (a controlled counter page produced a full `isTrusted:true` sequence); the real culprit is concurrent physical input racing plus a blind judgment method, so the deliverable is not "fix delivery" but "make the failure visible": ① **landing receipts for coordinate mouse actions**: `desktop act` click/move/drag (scroll with x,y likewise) each echo `cursor_after{x,y}` + `landed` (the real cursor is read back after the final post, 0.5pt tolerance) — **not landed → that action gets `ok:false` + `cgevent_no_landing`** (previously "API worked, zero effect" was silent); ② **physical-input racing warning**: dispatch-level `physical_input.attribution` (idle/synthetic/physical) — `physical` = a mouse event later than our own synthetic post was detected (the user is physically operating; just resend — worked never flips on this, signal not policy); ③ **honest TCC probing**: macOS<15 no longer fakes "dimension absent" — the raw IOHID PostEvent probe reports four states (Undefined is a real third state and delivery is proven to work under it; per-process attribution recorded honestly), **gate semantics unchanged** (<15 never rejects on IOHID); ④ **doctor #22 delivery selftest** (opt-in `LASSO_DOCTOR_INPUT_SELFTEST=1`: moves your cursor 7px and restores it — off by default, agents cannot trigger it; cursor read-back judgment, unambiguous); ⑤ **desktop screenshot writes to disk by default** (browse-channel parity: `/tmp/lasso-screenshot-<uuid>.png`, path only — previously a full-screen 860KB base64 blob blew the token budget; `inline_base64:true` restores the old behavior). Ethical red line: synthetic input only gets "detect and report honestly" — no capability to bypass user input monitoring is introduced. Rejected: PostToPid targeting (SOTA counter-evidence: PID-targeted mouse events are silently dropped by AppKit) / in-act pixel diff / in-act auto-retry.
 - **v1.28.0**: bugs/10 browse/docs half — evaluate return-value contract + anti-bot detection-surface docs batch, BUG-10, driven by the trademark-site slider campaign, doc/bugs/10) — (1) 🔴 **corrective behavior change (the silent-wrong-value face)**: `evaluate`'s `options.js` gains two expression routes — previously a **single-line bare expression** (`JSON.stringify({...})`, `document.title`) got wrapped as a statement body, the expression's value swallowed by the statement → **always undefined**; a **parenthesized expression** (`({a:1})`) got passed through as a function expression, upstream evaluating it to an object → **`fn is not a function`** (real-machine report P2: a hidden contract that took two trial-and-error calls to discover). Both shapes are now auto-wrapped as expression bodies and their **VALUE is returned**; the three existing forms (function expression passthrough / IIFE wrapping / statement body) are byte-identical (statement bodies still require an explicit `return`); (2) **errors as teaching**: a statement body returning undefined now echoes `data.js_form:"statement_body"` + `js_form_hint` (one sentence on WHY it is undefined and how to fix it); upstream `is not a function` errors get the same hint appended; (3) the tool description's evaluate section gains a RETURNS contract clause ("THREE forms … All work" was false for expression shapes — that description gap WAS P2); (4) `browse_headless`/`browse_headed` descriptions gain a "**click worked ≠ submission accepted**" NOTE + TROUBLESHOOTING §2.18 (tm.aliyun.com layered interception profile: home layer now open / submission layer silently swallowed on headless, slider captcha on headed — verify submissions with `wait url_contains`/`text` or `extract`, never trust the act receipt). This entry is part 2 (the browse/docs half); the same batch's part 1 (rust/desktop half: cgEvent delivery receipts / doctor self-test / desktop screenshots to disk) is the v1.28.0 entry above.

package/README.md

@@ -221,7 +221,7 @@ macOS 上能控 Finder / Mail / Safari / Notes / 系统设置等任何原生 app
 
 ## 安装
 
-**当前版本 v1.29.0**（更新日志见本节末尾折叠块）。
+**当前版本 v1.29.1**（更新日志见本节末尾折叠块）。
 
 前提：Node.js ≥ 20 + Claude Code（或任何支持 MCP 的客户端）。
 
@@ -236,9 +236,10 @@ claude mcp add lasso -- npx -y lasso-mcp
 **给其它 AI 工具当确定性渲染浏览器（渲染档）**：如果你在用 media-gen-mcp 这类要求「同一输入必须产出同一像素」的渲染工具，装好 lasso 后只需一行 `npx -y lasso-mcp render-chrome --ensure`——它会在 9224 端口拉起一个确定性 headless Chrome（冻结旗标快照 + 独立临时 profile），输出消费方直连用的 `wsEndpoint`；**消费方进程被强杀浏览器也照常存活**（生命周期归属 lasso），空闲 10 分钟自动回收并连带清理 profile（`LASSO_RENDER_IDLE_MS` 可调）。配套：`render-chrome --status` 自省 / `--stop` 收尾（认 `LASSO_RENDER_PORT`：显式设 port 只收该 port，未设=全部 render 记录，非法值 exit 1；全局收口仍可用 `chrome-stop --modes render`）/ `render-chrome doctor [--clean]` 孤儿与陈年 profile 清理（默认只报告；认 `LASSO_RENDER_PORT`，同 `--stop`：显式设 port 只判该 port，未设=全扫，非法值 exit 1；touch 心跳 10 分钟内的在用实例豁免不判孤儿）。**同机多 agent 并行验收**（多个 agent 各自清场会互杀对方实例）需配三 env 契命名空间隔离：`LASSO_RENDER_PORT` + `LASSO_LAUNCHED_CHROMES_PATH` + `LASSO_RENDER_GUARDIAN_PID_PATH`，配齐后并行互不可见，配方与清场纪律见 [doc/渲染档-并行验收隔离配方.md](doc/渲染档-并行验收隔离配方.md)。
 
 <details>
-<summary>📋 更新日志（v1.8 → v1.29.0，点开看每版改了什么）</summary>
+<summary>📋 更新日志（v1.8 → v1.29.1，点开看每版改了什么）</summary>
 
-- **v1.29.0**（未发布预写 · bug11：输入原语补齐 + 诚实信号批——「输入保护层」证伪重析，doc/bugs/11）——下午实机报告判定的 P0「tm.aliyun.com 输入保护层瞬间清除程序化设值」经白盒受控重析**证伪**：真机理是 React 16/17 受控组件的**状态完整性语义**（脚本写入不触发 onChange → blur/commit 时框架把 DOM 回写为已提交状态——值存活到 blur，非「毫秒级消失」；「六路全败」实为观察面错误：submit 走 `window.open` 开新 tab、原页 URL 永不变 → `wait url_contains` 结构性失明，而 uid 路 fill 当天全链路完成真实搜索）。本批交付物：① **`type` / `press` 输入原语补齐**（click/fill/type 三原语的第三缺）：`action:"type"` + `selectors:{<uid|ref>:<text>}`——逐字派发走 CDP `Input.dispatchKeyEvent` **可信输入管道**（浏览器标记 `isTrusted:true`，进框架输入管道、React onChange 正常触发、blur 后存活；与 Playwright `page.keyboard.type()` 同级；长文本亦逐字——覆盖 fill uid 路 ≥100 字符翻转进 JS 批量设值不可信管道的断层）；**追加语义**（=Playwright `page.type`，fill 才是替换）；ref 路 focus 回执失败显式报 `type_focus_failed`（didnt 档，不猜）；`action:"press"` + `key:"Enter"`（修饰键由上游拆解 + 失败释放保证）——实现为对已锁定上游 `type_text`/`press_key` 的映射（禁 CDP 直连）；不暴露 submitKey（提交显式走后续 press/click，两步链更可审计）。② **`input_guard_suspected` 诚实信号**（advisory，驱逐哨兵同范式）：ref 路填充/键入内嵌三探针（value setter 非原生安装态 / ~250ms 页内读回不一致 / React tracker 分叉）——命中即附信号 + hint 三条合法出路（换 type 可信管道 / 重 extract 走快照 uid 路 / 请用户物理输入）；**只供信号绝不自动改道**（不自动换原语/重试/通道），探测纯读零副作用（禁为探测合成 blur）。③ **wait 超时观察面教学**：`wait_timeout` 错误追加 window.open 新 tab 教学句（原选中页 URL 永不变——该形态超时首次自带归因线索）+ TROUBLESHOOTING §2.19 新 tab 观察面（含 `navigate → wait{selector} → fill → press/click` 链配方；fill 时序竞争假说无 reproducer 证伪登记，不写防御代码）。④ **no_reload 语义澄清**：describe 补「不是跳过导航旗标」句（实质不同 URL 恒导航；同 URL 恒零导航是 url 规则 2、与本键无关）+ §2.20 行为矩阵四行 + 语义钉 spec（描述与行为从此被测试钉死为一体）。⑤ **governance/13 合成输入伦理边界声明**：正面面 = 标准原语 + 诚实信号 + 信任阶梯文档；**Rejected-by-design** = 键入节奏随机化/人类拟态延迟、`_valueTracker` 欺骗、accessor 反劫持、isTrusted 伪造、「让 fill 看起来像人输入」的一切包装（欺骗站点侧机制 ≠ 输入能力；仅用户显式逐条裁决可推翻）。立场：**墙在那里我们告诉你**——穿墙只有两种合法形态（换可信原语 / 请用户物理输入），绝不替用户决定攻墙。⑥ **HighRiskGate 补 `type` 分支**：RTE 黑名单元素上 type 与 fill 同拦（封「换 action 名绕过 identity 通道守卫」口径裂缝；press 无 DOM 目标与 evaluate 同档不拦，注释文档化）。⑦ 上游契约死列表补 `type_text`/`press_key`（P10 前置门假红修复）+ 描述预算帽显式提帽（fleet 59,850 / HEADLESS 13,900 / L2 2,300→2,450——§5.1-3 独立单主题提帽纪律）。⑧ 本地保护层 fixture 回归（opt-in `LASSO_TEST_INPUT_GUARD=1`，绑 127.0.0.1）：三型机制（受控回写/accessor 劫持/异步重置）check 型对号 + type/uid 路 blur 后存活全实证。
+- **v1.29.1**：发版修正——v1.29.0 的 npm 包携带了旧 dist（版本转正后未重 build 即 publish，`doctor` 自报 1.28.0）；本版重 build 后发布，内容零变化。教训固化：版本三处改后必须 `npm run build` 再 publish。
+- **v1.29.0**（bug11：输入原语补齐 + 诚实信号批——「输入保护层」证伪重析，doc/bugs/11）——下午实机报告判定的 P0「tm.aliyun.com 输入保护层瞬间清除程序化设值」经白盒受控重析**证伪**：真机理是 React 16/17 受控组件的**状态完整性语义**（脚本写入不触发 onChange → blur/commit 时框架把 DOM 回写为已提交状态——值存活到 blur，非「毫秒级消失」；「六路全败」实为观察面错误：submit 走 `window.open` 开新 tab、原页 URL 永不变 → `wait url_contains` 结构性失明，而 uid 路 fill 当天全链路完成真实搜索）。本批交付物：① **`type` / `press` 输入原语补齐**（click/fill/type 三原语的第三缺）：`action:"type"` + `selectors:{<uid|ref>:<text>}`——逐字派发走 CDP `Input.dispatchKeyEvent` **可信输入管道**（浏览器标记 `isTrusted:true`，进框架输入管道、React onChange 正常触发、blur 后存活；与 Playwright `page.keyboard.type()` 同级；长文本亦逐字——覆盖 fill uid 路 ≥100 字符翻转进 JS 批量设值不可信管道的断层）；**追加语义**（=Playwright `page.type`，fill 才是替换）；ref 路 focus 回执失败显式报 `type_focus_failed`（didnt 档，不猜）；`action:"press"` + `key:"Enter"`（修饰键由上游拆解 + 失败释放保证）——实现为对已锁定上游 `type_text`/`press_key` 的映射（禁 CDP 直连）；不暴露 submitKey（提交显式走后续 press/click，两步链更可审计）。② **`input_guard_suspected` 诚实信号**（advisory，驱逐哨兵同范式）：ref 路填充/键入内嵌三探针（value setter 非原生安装态 / ~250ms 页内读回不一致 / React tracker 分叉）——命中即附信号 + hint 三条合法出路（换 type 可信管道 / 重 extract 走快照 uid 路 / 请用户物理输入）；**只供信号绝不自动改道**（不自动换原语/重试/通道），探测纯读零副作用（禁为探测合成 blur）。③ **wait 超时观察面教学**：`wait_timeout` 错误追加 window.open 新 tab 教学句（原选中页 URL 永不变——该形态超时首次自带归因线索）+ TROUBLESHOOTING §2.19 新 tab 观察面（含 `navigate → wait{selector} → fill → press/click` 链配方；fill 时序竞争假说无 reproducer 证伪登记，不写防御代码）。④ **no_reload 语义澄清**：describe 补「不是跳过导航旗标」句（实质不同 URL 恒导航；同 URL 恒零导航是 url 规则 2、与本键无关）+ §2.20 行为矩阵四行 + 语义钉 spec（描述与行为从此被测试钉死为一体）。⑤ **governance/13 合成输入伦理边界声明**：正面面 = 标准原语 + 诚实信号 + 信任阶梯文档；**Rejected-by-design** = 键入节奏随机化/人类拟态延迟、`_valueTracker` 欺骗、accessor 反劫持、isTrusted 伪造、「让 fill 看起来像人输入」的一切包装（欺骗站点侧机制 ≠ 输入能力；仅用户显式逐条裁决可推翻）。立场：**墙在那里我们告诉你**——穿墙只有两种合法形态（换可信原语 / 请用户物理输入），绝不替用户决定攻墙。⑥ **HighRiskGate 补 `type` 分支**：RTE 黑名单元素上 type 与 fill 同拦（封「换 action 名绕过 identity 通道守卫」口径裂缝；press 无 DOM 目标与 evaluate 同档不拦，注释文档化）。⑦ 上游契约死列表补 `type_text`/`press_key`（P10 前置门假红修复）+ 描述预算帽显式提帽（fleet 59,850 / HEADLESS 13,900 / L2 2,300→2,450——§5.1-3 独立单主题提帽纪律）。⑧ 本地保护层 fixture 回归（opt-in `LASSO_TEST_INPUT_GUARD=1`，绑 127.0.0.1）：三型机制（受控回写/accessor 劫持/异步重置）check 型对号 + type/uid 路 blur 后存活全实证。
 - **v1.28.0**（未发布预写 · 上半：bugs/10 rust/desktop 半——桌面投递回执批）：cgEvent 投递「断裂」证伪后的**消灭静默失败**批（商标站滑块实机报告驱动，doc/bugs/10）——白盒定谳：HID 投递链完好（受控计数器页产出完整 `isTrusted:true` 序列），真凶是并发物理输入竞争 + 判定法盲区，故交付物不是「修投递」而是让失败可见：① **坐标鼠标动作落地回执**：`desktop act` 的 click/move/drag（带 x,y 的 scroll 同）每个动作回 `cursor_after{x,y}` + `landed`（最终 post 后读回真实光标，容差 0.5pt）——**未落地 → 该动作 `ok:false` + `cgevent_no_landing`**（此前「API worked 实际零效果」是静默的）；② **物理竞争警示**：dispatch 级 `physical_input.attribution`（idle/synthetic/physical）——`physical` = 检测到晚于本进程合成 post 的鼠标事件（用户在物理操作，重发即可；worked 不因此翻转，信号不策略）；③ **TCC 探测诚实化**：macOS<15 不再假报「无此维度」——IOHID PostEvent 原始探测四态直报（Undefined 是真实第三态且该状态下投递实证可用；per-process 归因如实入档），**门控语义零变化**（<15 永不因 IOHID 拒绝）；④ **doctor #22 投递自检**（opt-in `LASSO_DOCTOR_INPUT_SELFTEST=1`：移动你的光标 7px 后复位——默认关，agent 不可触发；光标读回判读，无歧义）；⑤ **desktop screenshot 默认落盘**（对齐 browse 通道：`/tmp/lasso-screenshot-<uuid>.png` 只回路径——此前全屏 860KB base64 直塞爆 token；`inline_base64:true` 恢复旧行为）。伦理红线：合成输入只做「检测与诚实报告」，不引入任何绕过用户输入监控的能力。Rejected：PostToPid 定向（SOTA 反证 PID 定向鼠标被 AppKit 静默丢弃）/ act 内置像素 diff / act 内自动重试。
 - **v1.28.0**（未发布预写 · 下半：bugs/10 browse/docs 半——evaluate 返回值契约 + 反爬检测面文档批，BUG-10，商标站滑块战役驱动，doc/bugs/10）——① 🔴 **修正型行为变更（静默错值面）**：`evaluate` 的 `options.js` 新增两条表达式路由——此前传**单行裸表达式**（`JSON.stringify({...})`、`document.title`）会被包进语句体，表达式值被语句吞掉 → **恒 undefined**；传**括号表达式**（`({a:1})`）会被当函数表达式透传，上游求值为对象 → **报 `fn is not a function`**（实机报告 P2：两次调用试错才暴露的隐藏契约）。现在这两类入参自动包成表达式体箭头，**值直达**；既有三形态（函数表达式透传 / IIFE 包裹 / 语句体）字节级不变（语句体仍须显式 `return`）；② **错误即教学**：语句体 + 返回 undefined 时响应附 `data.js_form:"statement_body"` + `js_form_hint`（一句说清「为什么是 undefined」与怎么改）；上游 `is not a function` 错误文案同款追加；③ 工具描述 evaluate 段补 RETURNS 契约句（「THREE forms … All work」对表达式形态为假——描述缺口即 P2 本体）；④ `browse_headless`/`browse_headed` 描述 NOTE 新增「**click worked ≠ 提交被接受**」标注 + TROUBLESHOOTING 新增 §2.18 tm.aliyun.com 分层拦截面实测（首页层已放行 / 提交层 headless 静默吞、headed 弹滑块——判定提交成败用 `wait url_contains`/`text` 或 `extract`，不能信 act 回执）。本条为下半（browse/docs 半）；同批上半（rust/desktop 半：cgEvent 投递回执 / doctor 自检 / desktop 截图落盘）见上一条 v1.28.0。
 - **v1.27.1**：工具示例体系批（消费方接口自描述完善）——修复「调用者靠试错学用法」：此前 18 个工具只有 1 个含可抄示例，其余全是规则散文（七家消费方报告的试错考古实证）。本批：① **13 个调用示例进工具 description**（agent 经 `tools/list` 端到端可见——内容全部从真实试错事故反推：navigate+screenshot 一步/evaluate current-page/驱逐信号响应/freshProfile/browse_headed consent 等）；② **错误即教学**：`unknown_action` / 无会话等高频错误内嵌正确调用形态（学 Rust "did you mean"）；③ schema 全量 `.describe()` 补齐（action enum 值说明——此前全仓零 field 描述）；④ **防漂移四道闸**：示例逐字锚 / consent 前缀锚 / call-shape⊆schema / 预算帽。纯接口自描述增强零行为变更；盲测 8/8 + 9/9 变异全杀。体系文档见 doc/usage/04。

package/dist/doctor/doctor.d.ts

@@ -2,7 +2,7 @@ import { type RustBridgeLike } from "../desktop/desktop-doctor-checks.js";
 import { classifyPortOccupier } from "./chrome-status.js";
 import { type StealthProfileName } from "../browse/stealth-profiles.js";
 import type { McpClient } from "../subprocess/McpClient.js";
-export declare const LASSO_VERSION = "1.28.0";
+export declare const LASSO_VERSION = "1.29.1";
 export interface DoctorCheck {
     name: string;
     status: "pass" | "fail" | "warn";

package/dist/doctor/doctor.js

@@ -150,7 +150,7 @@ import { probeCreepjs } from "./creepjs-probe.js";
 import { defaultHeadlessProfileForHost } from "../browse/stealth-profiles.js";
 const execFileP = promisify(execFile);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-export const LASSO_VERSION = "1.28.0";
+export const LASSO_VERSION = "1.29.1";
 // ============================================================
 // runDoctor
 // ============================================================

package/dist/index.js

@@ -226,7 +226,7 @@ const fsReadFile = fsPromises.readFile;
  *   INV-76（v1.7 INV-1..75 零回归）→ 1.8.0
  * 与 package.json version + doctor.ts LASSO_VERSION 三处对齐（grep 验；INV-63 守）。
  */
-const LASSO_SERVER_VERSION = "1.28.0";
+const LASSO_SERVER_VERSION = "1.29.1";
 /**
  * cloud 浏览器双重解锁判定（parse5 §3.4 + INV-25）。
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lasso-mcp",
-  "version": "1.29.0",
+  "version": "1.29.1",
   "description": "Claude Code 的全交互对外抓手 MCP —— 搜/抓/登录态抓/控桌面，四通道+多引擎 fallback+AES cookie+markdown 抽取。All-in-one interaction MCP for Claude Code.",
   "type": "module",
   "main": "dist/index.js",

package/src/doctor/doctor.ts

@@ -174,7 +174,7 @@ const execFileP = promisify(execFile);
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-export const LASSO_VERSION = "1.29.0";
+export const LASSO_VERSION = "1.29.1";
 
 // ============================================================
 // 类型

package/src/index.ts

@@ -250,7 +250,7 @@ const fsReadFile = fsPromises.readFile;
  *   INV-76（v1.7 INV-1..75 零回归）→ 1.8.0
  * 与 package.json version + doctor.ts LASSO_VERSION 三处对齐（grep 验；INV-63 守）。
  */
-const LASSO_SERVER_VERSION = "1.29.0";
+const LASSO_SERVER_VERSION = "1.29.1";
 
 /**
  * cloud 浏览器双重解锁判定（parse5 §3.4 + INV-25）。