machine-bridge-mcp 2.0.0 → 3.0.0-beta.102
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1142 -0
- package/CONTRIBUTING.md +23 -25
- package/GOVERNANCE.md +2 -2
- package/README.md +58 -20
- package/SECURITY.md +161 -120
- package/SUPPORT.md +1 -1
- package/browser-extension/broker-auth.js +83 -0
- package/browser-extension/broker-liveness.js +35 -0
- package/browser-extension/browser-error-boundary.js +96 -0
- package/browser-extension/browser-operations.js +1456 -101
- package/browser-extension/devtools-input.js +195 -34
- package/browser-extension/devtools-observation.js +429 -0
- package/browser-extension/devtools-session.js +48 -0
- package/browser-extension/manifest.json +4 -3
- package/browser-extension/page-automation.js +578 -118
- package/browser-extension/pairing-bootstrap.js +42 -0
- package/browser-extension/pairing.js +28 -12
- package/browser-extension/service-worker.js +126 -106
- package/docs/AGENT_CONTEXT.md +13 -10
- package/docs/ARCHITECTURE.md +159 -67
- package/docs/AUDIT.md +1302 -4
- package/docs/CLIENTS.md +19 -6
- package/docs/COMPUTER_USE.md +297 -0
- package/docs/ENGINEERING.md +72 -13
- package/docs/GETTING_STARTED.md +18 -20
- package/docs/LOCAL_AUTHORIZATION.md +115 -72
- package/docs/LOCAL_AUTOMATION.md +27 -21
- package/docs/LOGGING.md +40 -19
- package/docs/MANAGED_JOBS.md +37 -34
- package/docs/MULTI_ACCOUNT.md +98 -37
- package/docs/OPERATIONS.md +145 -51
- package/docs/OVERVIEW.md +14 -11
- package/docs/POLICY_REFERENCE.md +71 -3
- package/docs/PRIVACY.md +41 -2
- package/docs/PROJECT_STANDARDS.md +29 -6
- package/docs/RELEASING.md +238 -64
- package/docs/TESTING.md +150 -39
- package/docs/THREAT_MODEL.md +164 -67
- package/docs/TOOL_REFERENCE.md +653 -60
- package/docs/UPGRADING.md +78 -18
- package/native/macos/MachineBridgeBackgroundInput.swift +1051 -0
- package/native/macos/MachineBridgeBackgroundInputSmokeFixture.swift +295 -0
- package/native/macos/MachineBridgeTrustBroker.swift +233 -0
- package/package.json +94 -16
- package/scripts/accepted-candidate-tarball.mjs +77 -0
- package/scripts/candidate-runtime-store.mjs +93 -0
- package/scripts/check-plan.mjs +73 -3
- package/scripts/check-runner.mjs +129 -17
- package/scripts/commit-message-check.mjs +5 -2
- package/scripts/consumer-package-security.mjs +293 -0
- package/scripts/coverage-check.mjs +251 -15
- package/scripts/coverage-generation.mjs +41 -0
- package/scripts/coverage-range-merge.mjs +41 -0
- package/scripts/foreground-daemon-recovery.mjs +88 -0
- package/scripts/generate-policy-reference.mjs +28 -5
- package/scripts/generate-tool-reference.mjs +1 -1
- package/scripts/generate-worker-types.mjs +21 -11
- package/scripts/github-backlog.mjs +11 -10
- package/scripts/github-push.mjs +62 -16
- package/scripts/github-release-asset.mjs +58 -0
- package/scripts/github-release.mjs +241 -132
- package/scripts/global-package-installation.mjs +68 -0
- package/scripts/hardened-npm-session.mjs +42 -0
- package/scripts/install-published-prerelease.mjs +198 -0
- package/scripts/local-release-acceptance.mjs +103 -45
- package/scripts/macos-background-input-smoke.mjs +515 -0
- package/scripts/network-retry.mjs +8 -1
- package/scripts/npm-global-prefix.mjs +27 -0
- package/scripts/npm-publication-policy.mjs +17 -0
- package/scripts/official-mcp-conformance.mjs +267 -0
- package/scripts/persistent-activation-process.mjs +101 -0
- package/scripts/prepare-pinned-npm.mjs +12 -69
- package/scripts/prerelease-activation.mjs +160 -0
- package/scripts/privacy-check.mjs +14 -6
- package/scripts/promotion-digest.mjs +128 -0
- package/scripts/publish-npm.mjs +260 -0
- package/scripts/published-release.mjs +132 -0
- package/scripts/release-acceptance.mjs +62 -54
- package/scripts/release-browser-extension-store.mjs +172 -0
- package/scripts/release-candidate-manifest.mjs +52 -0
- package/scripts/release-channel.mjs +106 -0
- package/scripts/release-diagnostic.mjs +41 -0
- package/scripts/release-impact-check.mjs +12 -22
- package/scripts/release-oauth-canary-core.mjs +325 -0
- package/scripts/release-oauth-canary-evidence.mjs +100 -0
- package/scripts/release-oauth-canary.mjs +127 -0
- package/scripts/release-publication-guard.mjs +67 -0
- package/scripts/release-soak.mjs +284 -0
- package/scripts/release-state.mjs +1 -1
- package/scripts/run-checks.mjs +44 -7
- package/scripts/run-worker-dry-run.mjs +21 -0
- package/scripts/sarif-security-gate.mjs +2 -1
- package/scripts/sbom-check.mjs +106 -0
- package/scripts/start-release-candidate.mjs +267 -44
- package/scripts/syntax-check.mjs +36 -14
- package/scripts/verification-generation-guard.mjs +15 -0
- package/scripts/verification-idle-sleep-guard.mjs +37 -0
- package/scripts/verification-state.mjs +108 -0
- package/scripts/wrangler-command-lifecycle.mjs +115 -0
- package/src/local/account-access.mjs +13 -1
- package/src/local/account-admin-response.mjs +92 -0
- package/src/local/account-admin.mjs +52 -19
- package/src/local/agent-context-projection.mjs +26 -7
- package/src/local/agent-context.mjs +88 -49
- package/src/local/agent-skill-discovery.mjs +16 -5
- package/src/local/app-automation-macos-jxa.mjs +350 -0
- package/src/local/app-automation.mjs +873 -163
- package/src/local/application-capability-projection.mjs +24 -0
- package/src/local/authority-context.mjs +106 -0
- package/src/local/autostart-log-maintenance.mjs +36 -0
- package/src/local/browser-bridge-http.mjs +5 -3
- package/src/local/browser-bridge.mjs +109 -31
- package/src/local/browser-broker-auth-http.mjs +67 -0
- package/src/local/browser-broker-auth.mjs +98 -0
- package/src/local/browser-broker-routes.mjs +63 -20
- package/src/local/browser-broker-server.mjs +17 -7
- package/src/local/browser-command.mjs +79 -30
- package/src/local/browser-computer-observation-service.mjs +266 -0
- package/src/local/browser-extension-identity.mjs +50 -0
- package/src/local/browser-extension-path.mjs +22 -0
- package/src/local/browser-extension-protocol.mjs +50 -11
- package/src/local/browser-operation-service.mjs +147 -117
- package/src/local/browser-pairing-grant.mjs +109 -0
- package/src/local/browser-pairing-http.mjs +36 -0
- package/src/local/browser-pairing-launch.mjs +58 -0
- package/src/local/browser-pairing-store.mjs +85 -48
- package/src/local/browser-request-registry.mjs +40 -14
- package/src/local/browser-request-settlement.mjs +78 -0
- package/src/local/browser-resource-input.mjs +74 -0
- package/src/local/browser-trusted-input-health.mjs +63 -0
- package/src/local/call-authority.mjs +21 -0
- package/src/local/call-capacity.mjs +45 -0
- package/src/local/call-registry-drain.mjs +54 -0
- package/src/local/call-registry.mjs +30 -15
- package/src/local/capability-observer.mjs +5 -0
- package/src/local/capability-ranking.mjs +3 -2
- package/src/local/child-process-settlement.mjs +132 -0
- package/src/local/cli-account-admin.mjs +40 -6
- package/src/local/cli-activate.mjs +162 -0
- package/src/local/cli-local-admin.mjs +20 -45
- package/src/local/cli-options.mjs +12 -13
- package/src/local/cli-ready-output.mjs +52 -0
- package/src/local/cli-service.mjs +91 -11
- package/src/local/cli.mjs +232 -150
- package/src/local/computer-use-application-observation.mjs +224 -0
- package/src/local/computer-use-arguments.mjs +270 -0
- package/src/local/computer-use-deadline.mjs +50 -0
- package/src/local/computer-use-dispatch-settlement.mjs +40 -0
- package/src/local/computer-use-expectation.mjs +171 -0
- package/src/local/computer-use-observation.mjs +769 -0
- package/src/local/computer-use-recovery.mjs +82 -0
- package/src/local/computer-use-result-budget.mjs +145 -0
- package/src/local/computer-use-snapshot-store.mjs +67 -0
- package/src/local/computer-use.mjs +2255 -0
- package/src/local/daemon-http-relay-auth.mjs +26 -0
- package/src/local/daemon-http-relay-connection.mjs +298 -0
- package/src/local/daemon-http-relay-request.mjs +64 -0
- package/src/local/daemon-http-relay-sequence.mjs +49 -0
- package/src/local/daemon-process.mjs +40 -7
- package/src/local/delegated-process-sandbox.mjs +148 -0
- package/src/local/device-identity.mjs +156 -49
- package/src/local/device-root-provider.mjs +81 -0
- package/src/local/directory-metadata.mjs +47 -0
- package/src/local/doctor-reporting.mjs +23 -0
- package/src/local/durable-process-spec.mjs +80 -0
- package/src/local/errors.mjs +25 -15
- package/src/local/exclusive-file.mjs +74 -26
- package/src/local/execution-limits.mjs +9 -0
- package/src/local/execution-routing.mjs +276 -0
- package/src/local/execution-surface.mjs +23 -0
- package/src/local/file-mutation-coordinator.mjs +47 -0
- package/src/local/file-snapshot-preservation.mjs +24 -0
- package/src/local/filesystem-identity.mjs +54 -0
- package/src/local/fixed-process-environment.mjs +21 -0
- package/src/local/full-access-test.mjs +31 -13
- package/src/local/git-commit.mjs +69 -0
- package/src/local/git-config-safety.mjs +55 -0
- package/src/local/git-log-parser.mjs +41 -0
- package/src/local/git-metadata-boundary.mjs +77 -0
- package/src/local/git-metadata-tree-safety.mjs +59 -0
- package/src/local/git-operation-state.mjs +19 -0
- package/src/local/git-service.mjs +165 -30
- package/src/local/hardened-npm-download-timeout.mjs +46 -0
- package/src/local/hardened-npm-download.mjs +109 -0
- package/src/local/hardened-npm-extract.mjs +20 -0
- package/src/local/hardened-npm-verification.mjs +104 -0
- package/src/local/hardened-npm.mjs +199 -0
- package/src/local/job-runner.mjs +244 -89
- package/src/local/lifecycle.mjs +6 -0
- package/src/local/log.mjs +19 -45
- package/src/local/macos-background-input.mjs +398 -0
- package/src/local/macos-idle-sleep-assertion.mjs +65 -0
- package/src/local/macos-trust-broker.mjs +404 -0
- package/src/local/managed-job-cancellation.mjs +42 -0
- package/src/local/managed-job-capacity.mjs +16 -0
- package/src/local/managed-job-directory-generation.mjs +60 -0
- package/src/local/managed-job-directory.mjs +75 -0
- package/src/local/managed-job-durable-process.mjs +49 -0
- package/src/local/managed-job-lock.mjs +46 -14
- package/src/local/managed-job-plan.mjs +38 -14
- package/src/local/managed-job-projection.mjs +23 -15
- package/src/local/managed-job-retention.mjs +128 -0
- package/src/local/managed-job-runner-claim.mjs +70 -0
- package/src/local/managed-job-runner.mjs +35 -10
- package/src/local/managed-job-storage.mjs +22 -6
- package/src/local/managed-job-terminal-maintenance.mjs +40 -0
- package/src/local/managed-job-terminal.mjs +150 -0
- package/src/local/managed-jobs.mjs +424 -287
- package/src/local/npm-cli.mjs +42 -0
- package/src/local/npm-environment.mjs +37 -0
- package/src/local/operation-authorization.mjs +68 -324
- package/src/local/operation-risk.mjs +51 -4
- package/src/local/owner-state-lock.mjs +118 -0
- package/src/local/package-identity.mjs +9 -0
- package/src/local/patch.mjs +20 -18
- package/src/local/path-inspection.mjs +23 -0
- package/src/local/policy.mjs +19 -0
- package/src/local/private-toolchain-integrity.mjs +54 -0
- package/src/local/process-execution.mjs +87 -75
- package/src/local/process-foreground-timeout.mjs +50 -0
- package/src/local/process-identity.mjs +41 -7
- package/src/local/process-nonreplayable-settlement.mjs +50 -0
- package/src/local/process-result-projection.mjs +22 -0
- package/src/local/process-session-events.mjs +47 -0
- package/src/local/process-session-remote-activity.mjs +10 -0
- package/src/local/process-session-termination.mjs +73 -0
- package/src/local/process-sessions.mjs +144 -112
- package/src/local/process-tracker.mjs +140 -13
- package/src/local/process-tree-ownership-types.d.ts +37 -0
- package/src/local/process-tree-ownership.mjs +57 -0
- package/src/local/process-tree-signal.mjs +34 -0
- package/src/local/process-tree-snapshot.mjs +77 -0
- package/src/local/process-tree-supervisor.mjs +69 -0
- package/src/local/process-tree.mjs +11 -53
- package/src/local/project-metadata.mjs +19 -6
- package/src/local/relay-call-recovery.mjs +58 -38
- package/src/local/relay-connection-classification.mjs +131 -0
- package/src/local/relay-connection-support.mjs +91 -0
- package/src/local/relay-connection.mjs +179 -272
- package/src/local/relay-diagnostics.mjs +91 -0
- package/src/local/relay-heartbeat.mjs +119 -0
- package/src/local/relay-liveness.mjs +109 -0
- package/src/local/relay-peer-diagnostics.mjs +29 -0
- package/src/local/release-runtime-lock.mjs +18 -0
- package/src/local/remote-activity-idle-sleep-guard.mjs +77 -0
- package/src/local/remote-configuration.mjs +48 -0
- package/src/local/resilient-relay-connection.mjs +178 -0
- package/src/local/resource-admission-diagnostics.mjs +52 -0
- package/src/local/resource-admission-policy.mjs +115 -0
- package/src/local/resource-admission.mjs +339 -0
- package/src/local/resource-build-root.mjs +83 -0
- package/src/local/resource-cargo-concurrency.mjs +38 -0
- package/src/local/resource-cmake-concurrency.mjs +42 -0
- package/src/local/resource-command-concurrency.mjs +37 -0
- package/src/local/resource-command-profile.mjs +176 -0
- package/src/local/resource-coordinator-accounting.mjs +21 -0
- package/src/local/resource-cpu-window.mjs +20 -0
- package/src/local/resource-disk-headroom.mjs +13 -0
- package/src/local/resource-elastic-memory.mjs +19 -0
- package/src/local/resource-elastic-request.mjs +36 -0
- package/src/local/resource-foreground-wait.mjs +29 -0
- package/src/local/resource-go-concurrency.mjs +43 -0
- package/src/local/resource-gradle-concurrency.mjs +57 -0
- package/src/local/resource-host-cache.mjs +39 -0
- package/src/local/resource-host-darwin.mjs +54 -0
- package/src/local/resource-host-linux.mjs +35 -0
- package/src/local/resource-host-sample-file.mjs +23 -0
- package/src/local/resource-host-snapshot.mjs +99 -0
- package/src/local/resource-lease-accounting.mjs +119 -0
- package/src/local/resource-light-command.mjs +6 -0
- package/src/local/resource-make-concurrency.mjs +42 -0
- package/src/local/resource-maven-concurrency.mjs +38 -0
- package/src/local/resource-ninja-command-concurrency.mjs +20 -0
- package/src/local/resource-ninja-concurrency.mjs +28 -0
- package/src/local/resource-operations.mjs +26 -10
- package/src/local/resource-pressure.mjs +67 -0
- package/src/local/resource-probe-command.mjs +35 -0
- package/src/local/resource-process-admission.mjs +59 -0
- package/src/local/resource-process-ancestry-cache.mjs +43 -0
- package/src/local/resource-process-ancestry.mjs +32 -0
- package/src/local/resource-process-priority.mjs +15 -0
- package/src/local/resource-project-key.mjs +53 -0
- package/src/local/resource-pytest-concurrency.mjs +33 -0
- package/src/local/resource-release-control-classification.mjs +14 -0
- package/src/local/resource-release-control-executable.mjs +70 -0
- package/src/local/resource-release-control-workspace.mjs +41 -0
- package/src/local/resource-request-contract.mjs +30 -0
- package/src/local/resource-script-classification.mjs +44 -0
- package/src/local/resource-shell-analysis.mjs +58 -0
- package/src/local/resource-staging-recovery.mjs +97 -0
- package/src/local/resource-swift-concurrency.mjs +31 -0
- package/src/local/resource-transaction-lock.mjs +189 -0
- package/src/local/resource-wait.mjs +48 -0
- package/src/local/resource-waiters.mjs +139 -0
- package/src/local/resource-xcode-command.mjs +7 -0
- package/src/local/resource-xcode-concurrency.mjs +34 -0
- package/src/local/resource-xcode-non-build.mjs +19 -0
- package/src/local/runtime-activation.mjs +700 -0
- package/src/local/runtime-activity-projection.mjs +48 -0
- package/src/local/runtime-capabilities.mjs +48 -15
- package/src/local/runtime-diagnostic-state.mjs +14 -0
- package/src/local/runtime-diagnostics.mjs +40 -13
- package/src/local/runtime-info-projection.mjs +60 -0
- package/src/local/runtime-info-relay-projection.mjs +21 -0
- package/src/local/runtime-paths.mjs +2 -1
- package/src/local/runtime-process-routing.mjs +33 -0
- package/src/local/runtime-relay-connection-options.mjs +44 -0
- package/src/local/runtime-relay-control.mjs +98 -0
- package/src/local/runtime-relay.mjs +26 -50
- package/src/local/runtime-reporting.mjs +37 -21
- package/src/local/runtime-resource-service.mjs +77 -0
- package/src/local/runtime-tool-handlers.mjs +13 -10
- package/src/local/runtime.mjs +244 -208
- package/src/local/secure-file.mjs +73 -20
- package/src/local/security-audit-dispatch.mjs +35 -0
- package/src/local/security-audit-log.mjs +215 -0
- package/src/local/security-audit-state.mjs +139 -0
- package/src/local/security-audit-storage.mjs +135 -0
- package/src/local/security-audit-warning.mjs +31 -0
- package/src/local/security-audit-worker.mjs +87 -0
- package/src/local/service-convergence.mjs +42 -1
- package/src/local/service-definition.mjs +24 -0
- package/src/local/service-environment.mjs +18 -10
- package/src/local/service-owner.mjs +146 -0
- package/src/local/service-ownership.mjs +17 -0
- package/src/local/service-restart-handoff.mjs +64 -0
- package/src/local/service-restart-scheduler.mjs +49 -0
- package/src/local/service-runtime-convergence.mjs +52 -0
- package/src/local/service-runtime.mjs +105 -0
- package/src/local/service-status.mjs +60 -0
- package/src/local/service.mjs +385 -92
- package/src/local/shell.mjs +39 -19
- package/src/local/ssh-key.mjs +158 -42
- package/src/local/state-inventory.mjs +50 -24
- package/src/local/state-owner-lock-inventory.mjs +23 -0
- package/src/local/state-root-owned-namespaces.mjs +83 -0
- package/src/local/state-root-retirement.mjs +89 -0
- package/src/local/state.mjs +386 -96
- package/src/local/stdio.mjs +96 -66
- package/src/local/support-state-projection.mjs +30 -0
- package/src/local/system-network-route.mjs +76 -0
- package/src/local/systemd-removal.mjs +20 -0
- package/src/local/tool-executor.mjs +85 -20
- package/src/local/tool-result-boundary.mjs +51 -0
- package/src/local/toolchain-operation-lock.mjs +41 -0
- package/src/local/tools.mjs +7 -5
- package/src/local/trusted-executable.mjs +53 -0
- package/src/local/trusted-git-executable.mjs +34 -0
- package/src/local/trusted-github-cli.mjs +24 -0
- package/src/local/windows-service-convergence.mjs +49 -0
- package/src/local/windows-service.mjs +52 -45
- package/src/local/worker-deployment-fingerprint.mjs +102 -0
- package/src/local/worker-deployment.mjs +48 -60
- package/src/local/worker-health.mjs +12 -4
- package/src/local/worker-secret-file.mjs +37 -17
- package/src/local/workspace-file-service.mjs +156 -239
- package/src/local/workspace-file-transaction.mjs +189 -0
- package/src/local/workspace-search.mjs +55 -0
- package/src/local/wrangler-toolchain/package-lock.json +1505 -0
- package/src/local/wrangler-toolchain/package.json +23 -0
- package/src/local/wrangler-toolchain-verification.mjs +135 -0
- package/src/local/wrangler-toolchain.mjs +188 -0
- package/src/shared/access-contract.json +7 -1
- package/src/shared/activation-recovery.mjs +49 -0
- package/src/shared/admin-auth.d.mts +2 -1
- package/src/shared/admin-auth.mjs +3 -3
- package/src/shared/authority-revocation.d.mts +9 -0
- package/src/shared/authority-revocation.mjs +28 -0
- package/src/shared/daemon-auth.d.mts +11 -0
- package/src/shared/daemon-auth.mjs +17 -0
- package/src/shared/device-session-auth.d.mts +20 -0
- package/src/shared/device-session-auth.mjs +51 -0
- package/src/shared/foreground-timeout.d.mts +15 -0
- package/src/shared/foreground-timeout.mjs +70 -0
- package/src/shared/log-redaction.d.mts +9 -0
- package/src/shared/log-redaction.mjs +51 -0
- package/src/shared/mcp-protocol.d.mts +27 -0
- package/src/shared/mcp-protocol.mjs +275 -0
- package/src/shared/project-overview-projection.d.mts +4 -0
- package/src/shared/project-overview-projection.mjs +96 -0
- package/src/shared/relay-contract.json +28 -0
- package/src/shared/result-projection.d.mts +2 -1
- package/src/shared/result-projection.mjs +13 -2
- package/src/shared/server-metadata.json +15 -9
- package/src/shared/tool-argument-validation.d.mts +17 -0
- package/src/shared/tool-argument-validation.mjs +325 -0
- package/src/shared/tool-call-capacity.d.mts +41 -0
- package/src/shared/tool-call-capacity.mjs +59 -0
- package/src/shared/tool-catalog.json +626 -57
- package/src/worker/access.ts +12 -0
- package/src/worker/account-admin.ts +55 -33
- package/src/worker/authority-revocations.ts +174 -0
- package/src/worker/authority.ts +52 -6
- package/src/worker/daemon-auth.ts +49 -68
- package/src/worker/daemon-channel.ts +36 -0
- package/src/worker/daemon-http-auth.ts +63 -0
- package/src/worker/daemon-http-channel.ts +120 -0
- package/src/worker/daemon-http-controller.ts +163 -0
- package/src/worker/daemon-http-protocol.ts +62 -0
- package/src/worker/daemon-http-registry.ts +82 -0
- package/src/worker/daemon-last-observation.ts +30 -0
- package/src/worker/daemon-liveness.ts +8 -6
- package/src/worker/daemon-ready-dispatch.ts +17 -0
- package/src/worker/daemon-ready-messages.ts +73 -0
- package/src/worker/daemon-ready-waiters.ts +79 -0
- package/src/worker/daemon-recovery-budget.ts +13 -0
- package/src/worker/daemon-registry.ts +58 -0
- package/src/worker/daemon-relay-diagnostics.ts +127 -0
- package/src/worker/daemon-socket-attachment.ts +55 -0
- package/src/worker/daemon-sockets.ts +72 -62
- package/src/worker/daemon-status.ts +38 -0
- package/src/worker/device-session-verifier.ts +129 -0
- package/src/worker/dpop.ts +157 -0
- package/src/worker/durable-process-timeout.ts +29 -0
- package/src/worker/errors.ts +57 -0
- package/src/worker/http.ts +112 -26
- package/src/worker/index.ts +446 -440
- package/src/worker/mcp-access.ts +57 -0
- package/src/worker/mcp-controller.ts +188 -0
- package/src/worker/mcp-http-accept.ts +11 -0
- package/src/worker/mcp-http-contract.ts +322 -0
- package/src/worker/mcp-initialization-compat.ts +141 -0
- package/src/worker/mcp-jsonrpc.ts +11 -29
- package/src/worker/mcp-removed-protocol.ts +17 -0
- package/src/worker/mcp-response-proxy.ts +135 -0
- package/src/worker/mcp-response-stream.ts +65 -0
- package/src/worker/mcp-stale-schema-compat.ts +57 -0
- package/src/worker/mcp-stream-proxy-contract.ts +48 -0
- package/src/worker/mcp-tool-call-input.ts +23 -0
- package/src/worker/nonce-store.ts +33 -35
- package/src/worker/oauth-authorization-page.ts +21 -1
- package/src/worker/oauth-client-admin.ts +52 -0
- package/src/worker/oauth-client-contract.ts +38 -0
- package/src/worker/oauth-controller.ts +107 -47
- package/src/worker/oauth-field-contract.ts +31 -0
- package/src/worker/oauth-record-contract.ts +7 -0
- package/src/worker/oauth-refresh-authority.ts +27 -0
- package/src/worker/oauth-refresh-exchange.ts +162 -0
- package/src/worker/oauth-refresh-families.ts +130 -27
- package/src/worker/oauth-refresh-persistence.ts +116 -0
- package/src/worker/oauth-state.ts +33 -18
- package/src/worker/oauth-store-validation.ts +131 -0
- package/src/worker/oauth-token-derivation.ts +33 -0
- package/src/worker/oauth-token-issuance.ts +119 -0
- package/src/worker/oauth-tokens.ts +56 -190
- package/src/worker/observability.ts +38 -5
- package/src/worker/pending-admission.ts +15 -0
- package/src/worker/pending-call-capacity.ts +108 -0
- package/src/worker/pending-call-contract.ts +42 -5
- package/src/worker/pending-call-deadlines.ts +75 -0
- package/src/worker/pending-calls.ts +131 -125
- package/src/worker/runtime-alarm-storage.ts +37 -0
- package/src/worker/runtime-alarm.ts +136 -0
- package/src/worker/server-info-activity.ts +36 -0
- package/src/worker/server-info-tool-delivery.ts +15 -0
- package/src/worker/server-info.ts +168 -0
- package/src/worker/tool-catalog.ts +47 -1
- package/src/worker/tool-timeout.ts +75 -14
- package/src/worker/websocket-protocol.ts +26 -2
- package/src/worker/worker-edge-guard.ts +90 -0
- package/src/worker/worker-edge-log.ts +65 -0
- package/src/worker/worker-entry.ts +52 -0
- package/src/worker/worker-mcp-config.ts +23 -0
- package/src/worker/worker-metadata.ts +48 -0
- package/src/worker/worker-rate-limit-key.ts +30 -0
- package/src/worker/worker-runtime-config.ts +20 -0
- package/src/worker/worker-static-routes.ts +54 -0
- package/src/worker/worker-task-lifetime.ts +18 -0
- package/tsconfig.local.json +17 -1
- package/wrangler.jsonc +13 -0
- package/src/local/cli-approval.mjs +0 -117
- package/src/local/operation-state-lock.mjs +0 -92
- package/src/worker/mcp-session.ts +0 -72
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
export function buildRetryGuidance({
|
|
2
|
+
dispatchStatus,
|
|
3
|
+
effectStatus,
|
|
4
|
+
expectationRequested,
|
|
5
|
+
postObservation,
|
|
6
|
+
continuation,
|
|
7
|
+
}) {
|
|
8
|
+
const postSnapshotId = postObservation?.snapshot_id || null;
|
|
9
|
+
const mappedPostTargetRef = continuation?.surface === "application"
|
|
10
|
+
&& continuation?.target_identity_continues === true
|
|
11
|
+
&& typeof continuation?.mapped_post_target_ref === "string"
|
|
12
|
+
&& continuation.mapped_post_target_ref
|
|
13
|
+
? continuation.mapped_post_target_ref
|
|
14
|
+
: "";
|
|
15
|
+
const base = {
|
|
16
|
+
same_action_retry_allowed: false,
|
|
17
|
+
post_snapshot_id: postSnapshotId,
|
|
18
|
+
...(mappedPostTargetRef ? {
|
|
19
|
+
mapped_post_target_ref: mappedPostTargetRef,
|
|
20
|
+
mapped_ref_for_replanning_only: true,
|
|
21
|
+
} : {}),
|
|
22
|
+
};
|
|
23
|
+
|
|
24
|
+
if (effectStatus === "confirmed") {
|
|
25
|
+
return {
|
|
26
|
+
...base,
|
|
27
|
+
disposition: "do_not_retry",
|
|
28
|
+
reason: "effect_confirmed",
|
|
29
|
+
next_step: nextObservationStep(postObservation, continuation),
|
|
30
|
+
message: "The requested effect was confirmed. Do not replay the same action.",
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
if (dispatchStatus === "completed" && expectationRequested !== true) {
|
|
35
|
+
return {
|
|
36
|
+
...base,
|
|
37
|
+
disposition: "do_not_retry",
|
|
38
|
+
reason: "dispatch_completed_without_effect_contract",
|
|
39
|
+
next_step: nextObservationStep(postObservation, continuation),
|
|
40
|
+
message: "Dispatch completed without an explicit effect contract. Do not replay the same action automatically; continue from observed state.",
|
|
41
|
+
};
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
if (!postObservation) {
|
|
45
|
+
return {
|
|
46
|
+
...base,
|
|
47
|
+
disposition: "reobserve_before_retry",
|
|
48
|
+
reason: dispatchStatus === "unknown" ? "dispatch_unknown_and_post_state_unavailable" : "post_state_unavailable",
|
|
49
|
+
next_step: "computer_observe",
|
|
50
|
+
message: "Post-state is unavailable. Re-observe before deciding whether any retry is appropriate.",
|
|
51
|
+
};
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
if (continuation?.reobserve_recommended === true) {
|
|
55
|
+
return {
|
|
56
|
+
...base,
|
|
57
|
+
disposition: "reobserve_before_retry",
|
|
58
|
+
reason: continuation.reason || "post_state_requires_fresh_observation",
|
|
59
|
+
next_step: "computer_observe",
|
|
60
|
+
message: "The post-state cannot be safely continued from the previous ref namespace. Re-observe before deciding whether any retry is appropriate.",
|
|
61
|
+
};
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
return {
|
|
65
|
+
...base,
|
|
66
|
+
disposition: "use_post_snapshot",
|
|
67
|
+
reason: dispatchStatus === "unknown"
|
|
68
|
+
? "dispatch_unknown_inspect_post_state_before_any_retry"
|
|
69
|
+
: effectStatus === "not_observed"
|
|
70
|
+
? "requested_effect_not_observed_use_post_state_to_replan"
|
|
71
|
+
: "effect_unconfirmed_use_post_state_before_any_retry",
|
|
72
|
+
next_step: "continue_from_post_snapshot",
|
|
73
|
+
message: dispatchStatus === "unknown"
|
|
74
|
+
? "Dispatch outcome is ambiguous. Inspect and continue from the post snapshot; do not replay the same action automatically."
|
|
75
|
+
: "The requested effect was not confirmed. Use the post snapshot to replan before considering any retry.",
|
|
76
|
+
};
|
|
77
|
+
}
|
|
78
|
+
|
|
79
|
+
function nextObservationStep(postObservation, continuation) {
|
|
80
|
+
if (!postObservation || continuation?.reobserve_recommended === true) return "computer_observe";
|
|
81
|
+
return "continue_from_post_snapshot";
|
|
82
|
+
}
|
|
@@ -0,0 +1,145 @@
|
|
|
1
|
+
import { buildContinuation, observationDiff, projectPostObservation } from "./computer-use-observation.mjs";
|
|
2
|
+
import { buildRetryGuidance } from "./computer-use-recovery.mjs";
|
|
3
|
+
import { normalizeToolResult } from "./tool-result-boundary.mjs";
|
|
4
|
+
|
|
5
|
+
const WORST_CASE_SNAPSHOT_ID = `cu_${"A".repeat(80)}`;
|
|
6
|
+
export const RESULT_BUDGET_OMISSION_REASON = "tool_result_budget";
|
|
7
|
+
|
|
8
|
+
export function observationResult(observation, imageContent) {
|
|
9
|
+
if (!imageContent.length) return observation;
|
|
10
|
+
return {
|
|
11
|
+
$mcp: {
|
|
12
|
+
content: [{ type: "text", text: JSON.stringify(observation) }, ...imageContent],
|
|
13
|
+
structuredContent: observation,
|
|
14
|
+
},
|
|
15
|
+
};
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
export function assertObservationResultFits(observation, imageContent) {
|
|
19
|
+
const projected = { ...observation, snapshot_id: WORST_CASE_SNAPSHOT_ID };
|
|
20
|
+
normalizeToolResult(observationResult(projected, imageContent));
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
export function isResultLimitExceeded(error) {
|
|
24
|
+
return error?.code === "limit_exceeded";
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
export function omitBrowserScreenshotForResultBudget(observation) {
|
|
28
|
+
if (!observation?.capture || !observation?.capabilities) return;
|
|
29
|
+
observation.capture.screenshot = false;
|
|
30
|
+
observation.capture.screenshot_source = "none";
|
|
31
|
+
observation.capture.screenshot_sha256 = "";
|
|
32
|
+
observation.capture.screenshot_fallback_reason = "browser screenshot omitted because the MCP result budget would be exceeded";
|
|
33
|
+
observation.capture.screenshot_omitted_reason = RESULT_BUDGET_OMISSION_REASON;
|
|
34
|
+
observation.capabilities.cdp_surface_screenshot = false;
|
|
35
|
+
observation.capabilities.snapshot_bound_visual_points = false;
|
|
36
|
+
}
|
|
37
|
+
|
|
38
|
+
export function omitApplicationScreenshotForResultBudget(observation) {
|
|
39
|
+
if (!observation?.capture || !observation?.capabilities) return;
|
|
40
|
+
observation.capture.screenshot = false;
|
|
41
|
+
observation.capture.screenshot_source = "none";
|
|
42
|
+
observation.capture.screenshot_sha256 = "";
|
|
43
|
+
observation.capture.screenshot_error = "application screenshot omitted because the MCP result budget would be exceeded";
|
|
44
|
+
observation.capture.screenshot_omitted_reason = RESULT_BUDGET_OMISSION_REASON;
|
|
45
|
+
observation.capture.coherence = "window_screenshot_then_accessibility_image_omitted_for_result_budget";
|
|
46
|
+
observation.capabilities.snapshot_bound_visual_points = false;
|
|
47
|
+
observation.capabilities.snapshot_bound_semantic_points = false;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
function actionResult(result, imageContent) {
|
|
51
|
+
if (!imageContent.length) return result;
|
|
52
|
+
return {
|
|
53
|
+
$mcp: {
|
|
54
|
+
content: [{ type: "text", text: JSON.stringify(result) }, ...imageContent],
|
|
55
|
+
structuredContent: result,
|
|
56
|
+
},
|
|
57
|
+
};
|
|
58
|
+
}
|
|
59
|
+
|
|
60
|
+
export function fitActionResultToBudget({
|
|
61
|
+
result, imageContent, beforeObservation, beforePrivateState, postCapture, target,
|
|
62
|
+
effectStatus, expectationRequested, postObservationDetail,
|
|
63
|
+
}) {
|
|
64
|
+
try {
|
|
65
|
+
const value = actionResult(result, imageContent);
|
|
66
|
+
normalizeToolResult(value);
|
|
67
|
+
return value;
|
|
68
|
+
} catch (error) {
|
|
69
|
+
if (!isResultLimitExceeded(error)) throw error;
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
let candidate = result;
|
|
73
|
+
if (postCapture && imageContent.length) {
|
|
74
|
+
if (postCapture.observation?.surface === "browser") omitBrowserScreenshotForResultBudget(postCapture.observation);
|
|
75
|
+
else if (postCapture.observation?.surface === "application") omitApplicationScreenshotForResultBudget(postCapture.observation);
|
|
76
|
+
postCapture.imageContent = [];
|
|
77
|
+
const observedDiff = observationDiff(beforeObservation, postCapture.observation, beforePrivateState, postCapture.privateState);
|
|
78
|
+
const continuation = buildContinuation(
|
|
79
|
+
beforeObservation, postCapture.observation, target, observedDiff, beforePrivateState, postCapture.privateState,
|
|
80
|
+
);
|
|
81
|
+
const retryGuidance = buildRetryGuidance({
|
|
82
|
+
dispatchStatus: result.dispatch_status, effectStatus, expectationRequested,
|
|
83
|
+
postObservation: postCapture.observation, continuation,
|
|
84
|
+
});
|
|
85
|
+
candidate = {
|
|
86
|
+
...result,
|
|
87
|
+
observed_diff: observedDiff,
|
|
88
|
+
post_observation: projectPostObservation(postCapture.observation, postObservationDetail),
|
|
89
|
+
continuation,
|
|
90
|
+
retry_guidance: retryGuidance,
|
|
91
|
+
recovery: retryGuidance.message,
|
|
92
|
+
post_screenshot_included: false,
|
|
93
|
+
post_screenshot_omitted_reason: RESULT_BUDGET_OMISSION_REASON,
|
|
94
|
+
result_budget_compacted: true,
|
|
95
|
+
};
|
|
96
|
+
try {
|
|
97
|
+
normalizeToolResult(candidate);
|
|
98
|
+
return candidate;
|
|
99
|
+
} catch (error) {
|
|
100
|
+
if (!isResultLimitExceeded(error)) throw error;
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
|
|
104
|
+
const compact = compactActionSettlement(candidate);
|
|
105
|
+
normalizeToolResult(compact);
|
|
106
|
+
return compact;
|
|
107
|
+
}
|
|
108
|
+
|
|
109
|
+
function compactActionSettlement(result) {
|
|
110
|
+
const verification = result?.verification && typeof result.verification === "object" && !Array.isArray(result.verification)
|
|
111
|
+
? { requested: result.verification.requested === true, matched: result.verification.matched === true, reason: boundedText(result.verification.reason, 200) }
|
|
112
|
+
: null;
|
|
113
|
+
const postSnapshotId = typeof result?.post_snapshot_id === "string" ? result.post_snapshot_id : null;
|
|
114
|
+
const retryGuidance = result?.retry_guidance && typeof result.retry_guidance === "object" && !Array.isArray(result.retry_guidance)
|
|
115
|
+
? {
|
|
116
|
+
same_action_retry_allowed: false,
|
|
117
|
+
disposition: boundedText(result.retry_guidance.disposition, 80),
|
|
118
|
+
reason: boundedText(result.retry_guidance.reason, 200),
|
|
119
|
+
next_step: boundedText(result.retry_guidance.next_step, 80),
|
|
120
|
+
post_snapshot_id: postSnapshotId,
|
|
121
|
+
message: boundedText(result.retry_guidance.message, 500),
|
|
122
|
+
}
|
|
123
|
+
: null;
|
|
124
|
+
return {
|
|
125
|
+
surface: result.surface, action: result.action, snapshot_id: result.snapshot_id,
|
|
126
|
+
dispatch_status: result.dispatch_status, effect_status: result.effect_status, verification,
|
|
127
|
+
post_snapshot_id: postSnapshotId, post_observation_detail: result.post_observation_detail,
|
|
128
|
+
post_screenshot_policy: result.post_screenshot_policy, post_screenshot_included: false,
|
|
129
|
+
...(result.post_screenshot_omitted_reason === RESULT_BUDGET_OMISSION_REASON ? { post_screenshot_omitted_reason: RESULT_BUDGET_OMISSION_REASON } : {}), post_observation: null,
|
|
130
|
+
continuation: result.continuation && typeof result.continuation === "object" && !Array.isArray(result.continuation)
|
|
131
|
+
? result.continuation
|
|
132
|
+
: postSnapshotId
|
|
133
|
+
? { available: true, snapshot_id: postSnapshotId, reobserve_recommended: true, reason: "post_observation_omitted_from_result_budget" }
|
|
134
|
+
: { available: false, snapshot_id: null, reobserve_recommended: true, reason: "post_observation_unavailable" },
|
|
135
|
+
retry_guidance: retryGuidance,
|
|
136
|
+
...(result.dispatch_error ? { dispatch_error: boundedText(result.dispatch_error, 1000) } : {}),
|
|
137
|
+
...(result.post_observation_error ? { post_observation_error: boundedText(result.post_observation_error, 1000) } : {}),
|
|
138
|
+
recovery: retryGuidance?.message || "Use the returned post snapshot when available; otherwise observe again before any retry.",
|
|
139
|
+
result_budget_compacted: true,
|
|
140
|
+
};
|
|
141
|
+
}
|
|
142
|
+
|
|
143
|
+
function boundedText(value, maximum) {
|
|
144
|
+
return typeof value === "string" ? value.slice(0, maximum) : "";
|
|
145
|
+
}
|
|
@@ -0,0 +1,67 @@
|
|
|
1
|
+
// @ts-check
|
|
2
|
+
import { performance } from "node:perf_hooks";
|
|
3
|
+
import { BridgeError } from "./errors.mjs";
|
|
4
|
+
const SNAPSHOT_TTL_MS = 10 * 60 * 1000;
|
|
5
|
+
const MAX_SNAPSHOTS = 64;
|
|
6
|
+
/** @typedef {{ createdAt: number, observation: Record<string, any>, privateState: any }} SnapshotItem */
|
|
7
|
+
export class ComputerUseSnapshotStore {
|
|
8
|
+
/** @param {{ now?: () => number, createId: () => string }} options */
|
|
9
|
+
constructor({ now = () => performance.now(), createId }) {
|
|
10
|
+
if (typeof createId !== "function") throw new TypeError("computer snapshot store requires an id factory");
|
|
11
|
+
this.now = now;
|
|
12
|
+
this.createId = createId;
|
|
13
|
+
/** @type {Map<string, SnapshotItem>} */
|
|
14
|
+
this.items = new Map();
|
|
15
|
+
/** @type {number | null} */
|
|
16
|
+
this.lastNow = null;
|
|
17
|
+
}
|
|
18
|
+
/** @param {Record<string, any>} observation @param {any} [privateState] */
|
|
19
|
+
add(observation, privateState = null) {
|
|
20
|
+
this.prune();
|
|
21
|
+
while (this.items.size >= MAX_SNAPSHOTS) {
|
|
22
|
+
const oldest = this.items.keys().next().value;
|
|
23
|
+
if (oldest === undefined) break;
|
|
24
|
+
this.items.delete(oldest);
|
|
25
|
+
}
|
|
26
|
+
let id = this.createId();
|
|
27
|
+
while (this.items.has(id)) id = this.createId();
|
|
28
|
+
this.items.set(id, { createdAt: this.readNow(), observation, privateState });
|
|
29
|
+
return id;
|
|
30
|
+
}
|
|
31
|
+
/** @param {string} id */
|
|
32
|
+
get(id) {
|
|
33
|
+
this.prune();
|
|
34
|
+
const item = this.items.get(id);
|
|
35
|
+
if (!item) throw missingSnapshot("computer snapshot is missing or expired; observe again before acting");
|
|
36
|
+
this.items.delete(id);
|
|
37
|
+
this.items.set(id, item);
|
|
38
|
+
return item;
|
|
39
|
+
}
|
|
40
|
+
/** @param {string} id @param {SnapshotItem} expected */
|
|
41
|
+
claim(id, expected) {
|
|
42
|
+
this.prune();
|
|
43
|
+
const item = this.items.get(id);
|
|
44
|
+
if (!item || item !== expected) throw missingSnapshot("computer snapshot is missing, expired, or already consumed; observe again before acting");
|
|
45
|
+
this.items.delete(id);
|
|
46
|
+
return item;
|
|
47
|
+
}
|
|
48
|
+
/** @param {string} id */
|
|
49
|
+
discard(id) {
|
|
50
|
+
if (id) this.items.delete(id);
|
|
51
|
+
}
|
|
52
|
+
prune() {
|
|
53
|
+
const cutoff = this.readNow() - SNAPSHOT_TTL_MS;
|
|
54
|
+
for (const [id, item] of this.items) if (item.createdAt < cutoff) this.items.delete(id);
|
|
55
|
+
}
|
|
56
|
+
/** @returns {number} */
|
|
57
|
+
readNow() {
|
|
58
|
+
const value = Number(this.now());
|
|
59
|
+
if (!Number.isFinite(value)) throw new TypeError("computer snapshot monotonic clock returned a non-finite value");
|
|
60
|
+
if (this.lastNow === null || value > this.lastNow) this.lastNow = value;
|
|
61
|
+
return /** @type {number} */ (this.lastNow);
|
|
62
|
+
}
|
|
63
|
+
}
|
|
64
|
+
/** @param {string} message */
|
|
65
|
+
function missingSnapshot(message) {
|
|
66
|
+
return new BridgeError("conflict", message, { details: { reason: "snapshot_missing_or_expired" } });
|
|
67
|
+
}
|