shadow-claw 1.26.0 → 1.27.0

package/src/security/custom-element-security.test.ts

@@ -7,6 +7,7 @@ import {
   DEFAULT_IFRAME_SANDBOX_POLICY,
   getAllowedCustomElementHostPatterns,
   getAllowedCustomElements,
+  getApprovedCustomElementScriptDescriptors,
   getApprovedCustomElementScripts,
   getCustomElementPurifyConfig,
   getIframeCsp,
@@ -398,6 +399,12 @@ describe("custom-element-security", () => {
         expect(getApprovedCustomElementScripts()).toEqual([
           "https://kherrick.github.io/block-garden/block-garden-bundle-min.mjs",
         ]);
+        expect(getApprovedCustomElementScriptDescriptors()).toEqual([
+          {
+            src: "https://kherrick.github.io/block-garden/block-garden-bundle-min.mjs",
+            hasInit: false,
+          },
+        ]);
 
         const csp = getIframeCsp("test-nonce");
         expect(csp).toContain("script-src 'nonce-test-nonce'");
@@ -409,5 +416,49 @@ describe("custom-element-security", () => {
         setIframeSandboxPolicy(DEFAULT_IFRAME_SANDBOX_POLICY);
       }
     });
+
+    it("parses object script descriptors with src and hasInit", () => {
+      const siteConfigScript = document.createElement("script");
+      siteConfigScript.id = "shadow-claw-site-config";
+      siteConfigScript.type = "application/json";
+      siteConfigScript.textContent = JSON.stringify({
+        customElements: {
+          allowedDomains: ["kherrick.github.io"],
+          scripts: [
+            { src: ".agents/scripts/main/pwgen-adapter.js", hasInit: true },
+            { src: "https://kherrick.github.io/x-pwgen.js", hasInit: false },
+            "local-element.js",
+          ],
+        },
+      });
+      document.head.appendChild(siteConfigScript);
+
+      try {
+        installCustomElementsRegistryGuard();
+
+        expect(getApprovedCustomElementScripts()).toEqual([
+          ".agents/scripts/main/pwgen-adapter.js",
+          "https://kherrick.github.io/x-pwgen.js",
+          "local-element.js",
+        ]);
+        expect(getApprovedCustomElementScriptDescriptors()).toEqual([
+          {
+            src: ".agents/scripts/main/pwgen-adapter.js",
+            hasInit: true,
+          },
+          {
+            src: "https://kherrick.github.io/x-pwgen.js",
+            hasInit: false,
+          },
+          {
+            src: "local-element.js",
+            hasInit: false,
+          },
+        ]);
+      } finally {
+        uninstallCustomElementsRegistryGuard();
+        siteConfigScript.remove();
+      }
+    });
   });
 });

package/src/security/custom-element-security.ts

@@ -150,10 +150,10 @@ export function isSafeCustomElementSource(urlStr: string): boolean {
 
   try {
     const base =
-      typeof window !== "undefined" &&
-      window.location?.origin &&
-      window.location.origin !== "null"
-        ? window.location.origin
+      typeof globalThis !== "undefined" &&
+      globalThis.location?.origin &&
+      globalThis.location.origin !== "null"
+        ? globalThis.location.origin
         : "http://localhost";
     const url = new URL(trimmed, base);
 
@@ -163,10 +163,10 @@ export function isSafeCustomElementSource(urlStr: string): boolean {
 
     // Same-origin is trusted
     if (
-      typeof window !== "undefined" &&
-      window.location?.origin &&
-      window.location.origin !== "null" &&
-      url.origin === window.location.origin
+      typeof globalThis !== "undefined" &&
+      globalThis.location?.origin &&
+      globalThis.location.origin !== "null" &&
+      url.origin === globalThis.location.origin
     ) {
       return true;
     }
@@ -240,8 +240,8 @@ export function getIframeCsp(nonce: string): string {
     try {
       const parsed = new URL(
         scriptUrl,
-        typeof window !== "undefined" && window.location?.origin
-          ? window.location.origin
+        typeof globalThis !== "undefined" && globalThis.location?.origin
+          ? globalThis.location.origin
           : "http://localhost",
       );
       allowedScriptHosts.add(parsed.origin);
@@ -372,10 +372,15 @@ export function initCustomElementSecurityFromEmbeddedConfig(): void {
   }
 }
 
+export interface CustomElementScriptDescriptor {
+  src: string;
+  hasInit: boolean;
+}
+
 /**
- * Retrieve approved custom element script URLs from the embedded site config.
+ * Retrieve approved custom element script descriptors from the embedded site config.
  */
-export function getApprovedCustomElementScripts(): string[] {
+export function getApprovedCustomElementScriptDescriptors(): CustomElementScriptDescriptor[] {
   if (typeof document === "undefined") {
     return [];
   }
@@ -395,10 +400,16 @@ export function getApprovedCustomElementScripts(): string[] {
 
     if (Array.isArray(scripts)) {
       return scripts
-        .map((s: any) => (typeof s === "string" ? s : s?.src))
+        .map((s: any) => {
+          const src = typeof s === "string" ? s : s?.src;
+          const hasInit =
+            typeof s === "object" && s !== null ? Boolean(s.hasInit) : false;
+          return { src, hasInit };
+        })
         .filter(
-          (s): s is string =>
-            typeof s === "string" && isSafeCustomElementSource(s),
+          (entry): entry is CustomElementScriptDescriptor =>
+            typeof entry.src === "string" &&
+            isSafeCustomElementSource(entry.src),
         );
     }
   } catch {}
@@ -406,6 +417,13 @@ export function getApprovedCustomElementScripts(): string[] {
   return [];
 }
 
+/**
+ * Retrieve approved custom element script URLs from the embedded site config.
+ */
+export function getApprovedCustomElementScripts(): string[] {
+  return getApprovedCustomElementScriptDescriptors().map((d) => d.src);
+}
+
 /**
  * Load allowed custom elements and host patterns from IndexedDB.
  */

package/src/server/control-plane-types.ts

@@ -117,6 +117,7 @@ export interface ClientInfo {
 
 export type ClientToServerType =
   | "client:register"
+  | "client:unregister"
   | "client:heartbeat"
   | "command:result"
   | "backup:ready";

package/src/server/control-plane.test.ts

@@ -224,6 +224,75 @@ describe("control-plane", () => {
 
       ws.close();
     });
+
+    it("removes client when WebSocket closes or sends client:unregister", async () => {
+      const ws = new WebSocket(
+        `ws://127.0.0.1:${port}/ws/control?token=${token}`,
+      );
+      await new Promise<void>((resolve) => ws.on("open", () => resolve()));
+
+      ws.send(
+        JSON.stringify({
+          id: "reg-unreg",
+          type: "client:register",
+          payload: {
+            clientId: "test-client-unreg",
+            deviceLabel: "Test Device",
+            capabilities: ["opfs"],
+            version: "1.0.0",
+          },
+        }),
+      );
+
+      // Wait for registration
+      await new Promise((resolve) => ws.once("message", resolve));
+
+      // 1. Should be listed as connected
+      let clients = controlPlane.getConnectedClients();
+      expect(clients.some((c) => c.clientId === "test-client-unreg")).toBe(
+        true,
+      );
+
+      const resConnected = await makeHttpRequest({
+        port,
+        path: "/api/control/clients",
+        headers: { "x-control-token": token },
+      });
+      expect(
+        resConnected.data.clients.some(
+          (c: any) => c.clientId === "test-client-unreg",
+        ),
+      ).toBe(true);
+
+      // 2. Send client:unregister
+      ws.send(
+        JSON.stringify({
+          id: "unreg-msg",
+          type: "client:unregister",
+          payload: { clientId: "test-client-unreg" },
+        }),
+      );
+      await new Promise((resolve) => setTimeout(resolve, 30));
+
+      // 3. Should no longer be listed in getConnectedClients or /api/control/clients
+      clients = controlPlane.getConnectedClients();
+      expect(clients.some((c) => c.clientId === "test-client-unreg")).toBe(
+        false,
+      );
+
+      const resAfterUnreg = await makeHttpRequest({
+        port,
+        path: "/api/control/clients",
+        headers: { "x-control-token": token },
+      });
+      expect(
+        resAfterUnreg.data.clients.some(
+          (c: any) => c.clientId === "test-client-unreg",
+        ),
+      ).toBe(false);
+
+      ws.close();
+    });
   });
 
   describe("Command execution", () => {

package/src/server/control-plane.ts

@@ -15,6 +15,7 @@ import { ulid } from "../utils/ulid.js";
 import {
   registerClient,
   updateClientHeartbeat,
+  unregisterClient,
   getAllClients,
   pruneStaleClients,
   getOrCreateControlToken,
@@ -60,6 +61,8 @@ export interface ControlPlane {
   ) => Promise<CommandResultPayload[]>;
   isClientConnected: (clientId: string) => boolean;
   getConnectedClients: () => ClientInfo[];
+  getActiveClientId?: () => string;
+  setActiveClientId?: (id: string) => void;
   getToken: () => string;
   close: () => void;
 }
@@ -296,6 +299,22 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
         updateClientHeartbeat(hb.clientId);
         log(`Heartbeat from client: ${hb.clientId}`);
       }
+    } else if (type === "client:unregister") {
+      const unreg = payload as { clientId?: string };
+      const unregId =
+        (unreg?.clientId &&
+          typeof unreg.clientId === "string" &&
+          unreg.clientId.trim()) ||
+        (ws ? socketToClientId.get(ws) : undefined);
+      if (unregId) {
+        unregisterClient(unregId);
+        if (ws) {
+          activeSockets.delete(unregId);
+          socketToClientId.delete(ws);
+        }
+        sseClientsByClientId.delete(unregId);
+        log(`Client explicitly unregistered: ${unregId}`);
+      }
     } else if (type === "command:result") {
       const res = payload as CommandResultPayload;
       if (res?.commandId && pendingCommands.has(res.commandId)) {
@@ -327,6 +346,9 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
         activeSockets.delete(clientId);
         socketToClientId.delete(ws);
         log(`Client disconnected: ${clientId}`);
+        if (!isClientConnected(clientId)) {
+          unregisterClient(clientId);
+        }
       }
     });
 
@@ -381,12 +403,13 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
       });
     });
 
-    // List all registered clients
+    // List connected clients (or all registered clients if ?all=true)
     app.get(
       "/api/control/clients",
       adminAuthMiddleware,
-      (_req: Request, res: Response) => {
-        const clients = getAllClients();
+      (req: Request, res: Response) => {
+        const showAll = req.query.all === "true" || req.query.all === "1";
+        const clients = showAll ? getAllClients() : getConnectedClients();
         res.json({ clients });
       },
     );
@@ -468,6 +491,9 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
           if (clientId && sseClientsByClientId.get(clientId) === res) {
             sseClientsByClientId.delete(clientId);
             log(`SSE client disconnected: ${clientId}`);
+            if (!isClientConnected(clientId)) {
+              unregisterClient(clientId);
+            }
           }
         });
       },
@@ -574,11 +600,25 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
     return false;
   }
 
+  let activeClientId: string = "";
+
   function getConnectedClients(): ClientInfo[] {
     const all = getAllClients();
     return all.filter((c) => isClientConnected(c.clientId));
   }
 
+  function getActiveClientId(): string {
+    if (activeClientId && isClientConnected(activeClientId)) {
+      return activeClientId;
+    }
+    const connected = getConnectedClients();
+    return connected.length > 0 ? connected[0].clientId : "";
+  }
+
+  function setActiveClientId(id: string): void {
+    activeClientId = id;
+  }
+
   function close(): void {
     clearInterval(prunerInterval);
     httpServer.removeListener("upgrade", upgradeHandler);
@@ -615,6 +655,8 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
     broadcastCommand,
     isClientConnected,
     getConnectedClients,
+    getActiveClientId,
+    setActiveClientId,
     getToken: () => token,
     close,
   };

package/src/server/mcp/tools/built-in-tools.ts

@@ -105,6 +105,22 @@ export const SHADOWCLAW_BUILTIN_TOOLS: McpTool[] = [
       },
     },
   },
+  {
+    name: "shadowclaw_set_active_client",
+    description:
+      "Set the active default connected client used when no clientId is explicitly provided in tool calls.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        clientId: {
+          type: "string",
+          description:
+            "Target client ID (or index '0', '1', prefix, or device label) to make active.",
+        },
+      },
+      required: ["clientId"],
+    },
+  },
   {
     name: "shadowclaw_server_status",
     description:
@@ -120,10 +136,6 @@ export function resolveTargetClientId(
   controlPlane: any,
   requestedId?: unknown,
 ): string {
-  if (typeof requestedId === "string" && requestedId.trim()) {
-    return requestedId.trim();
-  }
-
   try {
     const clients =
       typeof controlPlane.getConnectedClients === "function"
@@ -133,11 +145,43 @@ export function resolveTargetClientId(
           : [];
 
     if (Array.isArray(clients) && clients.length > 0) {
+      if (typeof requestedId === "string" && requestedId.trim()) {
+        const trimmed = requestedId.trim();
+        const exact = clients.find(
+          (c: any) => (c.clientId || c.id) === trimmed,
+        );
+        if (exact) return exact.clientId || exact.id;
+
+        const idx = parseInt(trimmed, 10);
+        if (!isNaN(idx) && idx >= 0 && idx < clients.length) {
+          return clients[idx].clientId || clients[idx].id;
+        }
+
+        const prefix = clients.find(
+          (c: any) =>
+            (c.clientId || c.id || "").startsWith(trimmed) ||
+            (c.clientId || "").replace(/^client-/, "").startsWith(trimmed),
+        );
+        if (prefix) return prefix.clientId || prefix.id;
+
+        const byLabel = clients.find((c: any) =>
+          c.deviceLabel?.toLowerCase().includes(trimmed.toLowerCase()),
+        );
+        if (byLabel) return byLabel.clientId || byLabel.id;
+
+        return trimmed;
+      }
+
+      if (typeof controlPlane.getActiveClientId === "function") {
+        const active = controlPlane.getActiveClientId();
+        if (active) return active;
+      }
+
       return clients[0].clientId || clients[0].id || "";
     }
   } catch (_) {}
 
-  return "";
+  return typeof requestedId === "string" ? requestedId.trim() : "";
 }
 
 export function registerBuiltInTools(
@@ -356,6 +400,37 @@ export function registerBuiltInTools(
           };
         }
 
+        case "shadowclaw_set_active_client": {
+          const targetId = resolveTargetClientId(controlPlane, args.clientId);
+          if (!targetId) {
+            return {
+              isError: true,
+              content: [
+                {
+                  type: "text",
+                  text: `Error: Client '${args.clientId}' not found among connected clients.`,
+                },
+              ],
+            };
+          }
+
+          if (typeof controlPlane.setActiveClientId === "function") {
+            controlPlane.setActiveClientId(targetId);
+          }
+
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Active default client set to: ${targetId}`,
+              },
+            ],
+            _meta: {
+              activeClientId: targetId,
+            },
+          };
+        }
+
         case "shadowclaw_server_status": {
           const clients =
             typeof controlPlane.getConnectedClients === "function"