shadow-claw 1.31.0 → 1.33.0

package/dist/server.js

@@ -1,4 +1,4 @@
-import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{basename as c}from"node:path";import l,{constants as u,createReadStream as d,promises as f,statSync as p}from"node:fs";import m,{tmpdir as h}from"node:os";import g,{URL as _,fileURLToPath as v,format as y}from"node:url";import b from"tcp-port-used";import x from"compression";import S from"express";import C from"web-push";import{DatabaseSync as w}from"node:sqlite";import{createHash as T,randomBytes as E,randomUUID as D}from"node:crypto";import O from"cors";import{Buffer as k}from"buffer";import A from"express-urlrewrite";import{BedrockClient as j,ListFoundationModelsCommand as M,ListInferenceProfilesCommand as N}from"@aws-sdk/client-bedrock";import{BedrockRuntimeClient as P,ConverseCommand as F,ConverseStreamCommand as I}from"@aws-sdk/client-bedrock-runtime";import{fromNodeProviderChain as L,fromSSO as ee}from"@aws-sdk/credential-providers";import*as te from"fs";import{createWriteStream as ne}from"fs";import*as R from"stream";import re from"node:zlib";import ie,{PassThrough as ae,Readable as oe,pipeline as se}from"node:stream";import{Buffer as z}from"node:buffer";import{deprecate as ce,promisify as le,types as ue}from"node:util";import{isIP as de}from"node:net";import*as fe from"path";import*as pe from"fs/promises";import{writeFile as me}from"fs/promises";import{finished as he}from"node:stream/promises";import{access as ge,mkdir as _e,readFile as ve,readdir as ye,stat as be,unlink as xe,writeFile as Se}from"node:fs/promises";import{execFileSync as Ce,spawn as we}from"node:child_process";import{EventEmitter as Te}from"node:events";var Ee=Object.create,De=Object.defineProperty,Oe=Object.getOwnPropertyDescriptor,ke=Object.getOwnPropertyNames,Ae=Object.getPrototypeOf,je=Object.prototype.hasOwnProperty,B=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(e){throw n=[e],e}},V=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),Me=(e,t)=>{let n={};for(var r in e)De(n,r,{get:e[r],enumerable:!0});return t||De(n,Symbol.toStringTag,{value:`Module`}),n},Ne=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var i=ke(t),a=0,o=i.length,s;a<o;a++)s=i[a],!je.call(e,s)&&s!==n&&De(e,s,{get:(e=>t[e]).bind(null,s),enumerable:!(r=Oe(t,s))||r.enumerable});return e},Pe=(e,t,n)=>(n=e==null?{}:Ee(Ae(e)),Ne(t||!e||!e.__esModule?De(n,`default`,{value:e,enumerable:!0}):n,e)),H=t(import.meta.url);const Fe=new class{loading=!1;models=new Map;getModelInfo(e){return this.models.get(e.toLowerCase())??null}registerModelInfo(e,t){this.models.set(e.toLowerCase(),t)}clear(){this.models.clear()}async fetchModelInfo(e,t,n){if(e.modelsUrl){this.loading=!0;try{let r=new Headers;if(r.set(`Content-Type`,`application/json`),e.headers)for(let[t,n]of Object.entries(e.headers))r.set(t,n);if(n)for(let[e,t]of Object.entries(n))r.set(e,t);if(t&&e.apiKeyHeader){let n=e.apiKeyHeaderFormat;r.set(e.apiKeyHeader,n?n.replace(`{key}`,t):t)}let i=await fetch(e.modelsUrl,{headers:r});if(!i.ok)throw Error(`HTTP ${i.status} ${i.statusText}`);let a=await i.json(),o=Array.isArray(a.data)?a.data:Array.isArray(a.models)?a.models:[];for(let e of o){if(!e.id)continue;let t=e.context_length??e.context_window??0,n=e.max_completion_tokens||e.per_request_limits?.completion_tokens||e.top_provider?.max_completion_tokens||null,r=typeof e.supports_tools==`boolean`?e.supports_tools:typeof e.supportsTools==`boolean`?e.supportsTools:void 0,i=this.extractModalities(e,`input`),a=this.extractModalities(e,`output`),o=this.modalitiesInclude(i,`image`,`vision`),s=this.modalitiesInclude(i,`audio`,`voice`,`hearing`),c=this.modalitiesInclude(i,`video`),l=e.id===`openrouter/free`||this.supportedParametersInclude(e,`image`,`vision`,`audio`,`tool`,`structured`),u=this.extractReasoning(e);!t&&Array.isArray(e.providers)&&e.providers.length>0&&(t=e.providers[0]?.context_length||0),this.registerModelInfo(e.id,{contextWindow:t,maxOutput:n,...r!==void 0&&{supportsTools:r},...i.length>0&&{inputModalities:i},...a.length>0&&{outputModalities:a},...o!==void 0&&{supportsImageInput:o},...s!==void 0&&{supportsAudioInput:s},...c!==void 0&&{supportsVideoInput:c},...u&&{reasoning:u},...l&&{routesByRequestFeatures:l}})}o.length>0&&console.log(`[ModelRegistry] Registered ${o.length} models for provider "${e.id}"`)}catch(t){console.error(`[ModelRegistry] Error fetching models for ${e.id}:`,t)}finally{this.loading=!1}}}extractModalities(e,t){let n=t===`input`?e.input_modalities||e.inputModalities:e.output_modalities||e.outputModalities,r=e.architecture||{},i=t===`input`?r.input_modalities||r.inputModalities:r.output_modalities||r.outputModalities,a=typeof r.modality==`string`?r.modality:``,o=this.parseArchitectureModality(a,t),s=[...this.normalizeStringArray(n),...this.normalizeStringArray(i),...o];return Array.from(new Set(s))}extractReasoning(e){let t=e?.reasoning;if(!t||typeof t!=`object`)return;let n=this.normalizeStringArray(t.supported_efforts),r=typeof t.default_effort==`string`?t.default_effort.toLowerCase():void 0,i=typeof t.default_enabled==`boolean`?t.default_enabled:void 0,a=typeof t.supports_max_tokens==`boolean`?t.supports_max_tokens:void 0,o=typeof t.mandatory==`boolean`?t.mandatory:void 0;if(!(n.length===0&&r===void 0&&i===void 0&&a===void 0&&o===void 0))return{...n.length>0&&{supportedEfforts:n},...r!==void 0&&{defaultEffort:r},...i!==void 0&&{defaultEnabled:i},...a!==void 0&&{supportsMaxTokens:a},...o!==void 0&&{mandatory:o}}}modalitiesInclude(e,...t){if(e.length!==0)return t.some(t=>e.some(e=>e.includes(t)))}normalizeStringArray(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`).map(e=>e.toLowerCase()):[]}parseArchitectureModality(e,t){if(!e)return[];let[n=``,r=``]=e.toLowerCase().split(`->`).map(e=>e.trim());return(t===`input`?n:r).split(/[+,/\s]+/).map(e=>e.trim()).filter(Boolean)}supportedParametersInclude(e,...t){let n=this.normalizeStringArray(e.supported_parameters||e.supportedParameters);return t.some(e=>n.some(t=>t.includes(e)))}};function Ie(e){return e.replace(/^\/+|\/+$/g,``)}function Le(e){let t=Ie(e);return t.endsWith(`/index.html`)?t=t.slice(0,-11):t.endsWith(`index.html`)&&(t=t.slice(0,-10)),Ie(t)}function Re(e){let t=Ie(e),n=t.split(`/`).filter(Boolean);if(n.length===0)return null;let r=n[0].toLowerCase();if(r===`pages`){if(n.length>=3){let e=n[1];return{page:`pages`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e,path:n.slice(2).join(`/`)}}return{page:`pages`,groupId:`br:main`,path:n.slice(1).join(`/`)}}if(r===`files`){let e=n[1]||`main`;return{page:`files`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e,path:n.slice(2).join(`/`)||void 0}}if(r===`chat`){let e=n[1]||`main`;return{page:`chat`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e}}if(r===`tasks`){let e=n[1]||`main`;return{page:`tasks`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e}}return r===`main`?{page:`pages`,groupId:`br:main`,path:n.slice(1).join(`/`)}:{page:`pages`,groupId:`br:main`,path:t}}function ze(){if(typeof document<`u`){let e=document.getElementById(`shadow-claw-static-routing`);if(e&&e.textContent)try{let t=JSON.parse(e.textContent);if(t&&typeof t==`object`&&t.routes)return t}catch(e){console.warn(`Failed to parse embedded static routing manifest:`,e)}}return null}function Be(e,t){let n=t||ze();if(!n||!n.routes)return null;let r=Le(e);if(!r)return null;for(let[e,t]of Object.entries(n.routes))if(!(!t||!t.prettyPath)&&Le(t.prettyPath)===r)return Re(e);return null}let Ve=null;const He=new Set([`chat`,`files`,`tasks`,`pages`,`settings`,`tools`,`channels`]);function Ue(){Ve=null}typeof globalThis<`u`&&(globalThis.__applyBasePathCacheReset=Ue);function We(){let e=typeof window<`u`?window:typeof self<`u`?self:globalThis;if(e&&e.__SHADOWCLAW_DEPLOY_ID__){let t=String(e.__SHADOWCLAW_DEPLOY_ID__).trim();if(t)return t.replace(/[^a-zA-Z0-9_-]/g,`-`)}let t=globalThis.process;if(t&&t.env&&t.env.SHADOWCLAW_DEPLOY_ID){let e=String(t.env.SHADOWCLAW_DEPLOY_ID).trim();if(e)return e.replace(/[^a-zA-Z0-9_-]/g,`-`)}let n=Ge();return!n||n===`/`?``:n.replace(/^\/+|\/+$/g,``).replace(/[^a-zA-Z0-9_-]/g,`-`)}function Ge(){if(Ve!==null)return Ve;if((typeof window>`u`||globalThis.WorkerGlobalScope!==void 0&&typeof self<`u`&&self instanceof globalThis.WorkerGlobalScope)&&typeof self<`u`&&self.location){let e=(self.location.pathname||`/`).split(`/`).filter(Boolean);if(e.length<=1)return Ve=`/`,Ve;let t=e[0].toLowerCase(),n=t===`service-worker.js`||t===`sw.js`||t===`manifest.json`||t===`sitemap.xml`||t===`favicon.ico`||t===`index.html`||t===`service-worker`||t===`assets`||t===`dist`||t===`public`;if(n&&e.length===2)return Ve=`/`,Ve;if(!n)return Ve=`/`+e[0]+`/`,Ve}let e=typeof window<`u`&&window.location?window.location:typeof self<`u`&&self.location?self.location:null;if(!e)return`/`;if(typeof document<`u`&&typeof document.querySelector==`function`){let t=document.querySelector(`base[href]`);if(t){let n=t.getAttribute(`href`);if(n)try{let t=new URL(n,e.origin).pathname;return t.endsWith(`/`)||(t+=`/`),Ve=t,Ve}catch{}}}let t=e.pathname||`/`;if(t===`/`)return Ve=`/`,Ve;let n=t.split(`/`).filter(Boolean),r=n.findIndex(e=>He.has(e.toLowerCase()));return r>=0?r===0?(Ve=`/`,Ve):(Ve=`/`+n.slice(0,r).join(`/`)+`/`,Ve):Be(t)?(Ve=`/`,Ve):n.length===1&&!t.includes(`.`)?(Ve=`/`+n[0]+`/`,Ve):(Ve=`/`,Ve)}function Ke(e){let t=e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`);return RegExp(`(^|\\s)@${t}\\b`,`i`)}Ke(`ShadowClaw`);function qe(){let e=We();return e?`shadowclaw-${e}`:`shadowclaw`}qe();const Je={github:{providerId:`github`,name:`GitHub`,aliases:[`github`,`api.github.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`token `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://github.com/login/oauth/authorize`,tokenUrl:`https://github.com/login/oauth/access_token`,defaultScopes:[`repo`,`read:user`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},gitlab:{providerId:`gitlab`,name:`GitLab`,aliases:[`gitlab`,`gitlab.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`PRIVATE-TOKEN`,headerPrefix:``},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},tokenAuthByServiceType:{git_remote:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}}},oauth:{authorizeUrl:`https://gitlab.com/oauth/authorize`,tokenUrl:`https://gitlab.com/oauth/token`,defaultScopes:[`read_api`,`read_user`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},figma:{providerId:`figma`,name:`Figma`,aliases:[`figma`,`api.figma.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`X-Figma-Token`,headerPrefix:``},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://www.figma.com/oauth`,tokenUrl:`https://api.figma.com/v1/oauth/token`,refreshUrl:`https://api.figma.com/v1/oauth/refresh`,defaultScopes:[],usePkce:!0,clientAuthMethod:`basic_header`,scopeSeparator:`space`}},notion:{providerId:`notion`,name:`Notion`,aliases:[`notion`,`api.notion.com`,`notion.so`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://api.notion.com/v1/oauth/authorize`,tokenUrl:`https://api.notion.com/v1/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`basic_header`,scopeSeparator:`space`}},microsoft_graph:{providerId:`microsoft_graph`,name:`Microsoft Graph`,aliases:[`microsoft`,`graph.microsoft.com`,`microsoft_graph`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://login.microsoftonline.com/common/oauth2/v2.0/authorize`,tokenUrl:`https://login.microsoftonline.com/common/oauth2/v2.0/token`,defaultScopes:[`openid`,`profile`,`offline_access`,`User.Read`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},yahoo_mail:{providerId:`yahoo_mail`,name:`Yahoo Mail`,aliases:[`yahoo`,`yahoo_mail`,`mail.yahoo.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://api.login.yahoo.com/oauth2/request_auth`,tokenUrl:`https://api.login.yahoo.com/oauth2/get_token`,defaultScopes:[`mail-r`,`mail-w`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},google:{providerId:`google`,name:`Google`,aliases:[`google`,`googleapis.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://accounts.google.com/o/oauth2/v2/auth`,tokenUrl:`https://oauth2.googleapis.com/token`,defaultScopes:[`openid`,`profile`,`email`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},atlassian:{providerId:`atlassian`,name:`Atlassian`,aliases:[`atlassian`,`api.atlassian.com`],modes:[`oauth`,`token`,`basic`],defaultMode:`basic`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`,`basic_userpass`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `},basic:{headerName:`Authorization`,headerPrefix:`Basic `}},oauth:{authorizeUrl:`https://auth.atlassian.com/authorize`,tokenUrl:`https://auth.atlassian.com/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},slack:{providerId:`slack`,name:`Slack`,aliases:[`slack`,`slack.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://slack.com/oauth/v2/authorize`,tokenUrl:`https://slack.com/api/oauth.v2.access`,defaultScopes:[],usePkce:!1,clientAuthMethod:`request_body`,scopeSeparator:`comma`}},linear:{providerId:`linear`,name:`Linear`,aliases:[`linear`,`api.linear.app`,`linear.app`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://linear.app/oauth/authorize`,tokenUrl:`https://api.linear.app/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},azure_devops:{providerId:`azure_devops`,name:`Azure DevOps`,aliases:[`azure_devops`,`dev.azure.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`,`basic_userpass`,`ssh_key`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},tokenAuthByServiceType:{git_remote:{token:{headerName:`Authorization`,headerPrefix:`Basic `},oauth:{headerName:`Authorization`,headerPrefix:`Basic `}}},oauth:{authorizeUrl:`https://app.vssps.visualstudio.com/oauth2/authorize`,tokenUrl:`https://app.vssps.visualstudio.com/oauth2/token`,defaultScopes:[`vso.code`,`vso.profile`,`offline_access`],usePkce:!1,clientAuthMethod:`request_body`,scopeSeparator:`space`}},custom_mcp:{providerId:`custom_mcp`,name:`Custom MCP`,aliases:[`custom_mcp`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`mcp_remote`,`webmcp_local`],authTypes:[`none`,`token`,`oauth`,`custom_header`,`ssh_key`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://example.com/oauth/authorize`,tokenUrl:`https://example.com/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}}},Ye=Object.fromEntries(Object.values(Je).filter(e=>!!e.oauth).map(e=>{let t=e.oauth;return[e.providerId,{id:e.providerId,name:e.name,authorizeUrl:t.authorizeUrl,tokenUrl:t.tokenUrl,redirectUri:t.redirectUri,defaultScopes:t.defaultScopes,usePkce:t.usePkce,clientAuthMethod:t.clientAuthMethod,scopeSeparator:t.scopeSeparator}]}));Object.fromEntries(Object.values(Je).map(e=>[e.providerId,{providerId:e.providerId,modes:e.modes,defaultMode:e.defaultMode}]));function Xe(e){return Ye[e]||null}let Ze=null;function Qe(e=`database/push-subscriptions.db`){if(Ze)return Ze;Ze=new w(e),Ze.exec(`
+import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{basename as c}from"node:path";import l,{constants as u,createReadStream as d,promises as f,statSync as p}from"node:fs";import m,{tmpdir as h}from"node:os";import g,{URL as _,fileURLToPath as v,format as y}from"node:url";import b from"tcp-port-used";import x from"compression";import S from"express";import C from"web-push";import{DatabaseSync as w}from"node:sqlite";import{createHash as T,randomBytes as E,randomUUID as D}from"node:crypto";import O from"cors";import{Buffer as k}from"buffer";import A from"express-urlrewrite";import{BedrockClient as j,ListFoundationModelsCommand as M,ListInferenceProfilesCommand as N}from"@aws-sdk/client-bedrock";import{BedrockRuntimeClient as P,ConverseCommand as F,ConverseStreamCommand as I}from"@aws-sdk/client-bedrock-runtime";import{fromNodeProviderChain as L,fromSSO as ee}from"@aws-sdk/credential-providers";import*as te from"fs";import{createWriteStream as ne}from"fs";import*as R from"stream";import re from"node:zlib";import ie,{PassThrough as ae,Readable as oe,pipeline as se}from"node:stream";import{Buffer as z}from"node:buffer";import{deprecate as ce,promisify as le,types as ue}from"node:util";import{isIP as de}from"node:net";import*as fe from"path";import*as pe from"fs/promises";import{writeFile as me}from"fs/promises";import{finished as he}from"node:stream/promises";import{access as ge,mkdir as _e,readFile as ve,readdir as ye,stat as be,unlink as xe,writeFile as Se}from"node:fs/promises";import{execFileSync as Ce,spawn as we}from"node:child_process";import{EventEmitter as Te}from"node:events";var Ee=Object.create,De=Object.defineProperty,Oe=Object.getOwnPropertyDescriptor,ke=Object.getOwnPropertyNames,Ae=Object.getPrototypeOf,je=Object.prototype.hasOwnProperty,B=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(e){throw n=[e],e}},V=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),Me=(e,t)=>{let n={};for(var r in e)De(n,r,{get:e[r],enumerable:!0});return t||De(n,Symbol.toStringTag,{value:`Module`}),n},Ne=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var i=ke(t),a=0,o=i.length,s;a<o;a++)s=i[a],!je.call(e,s)&&s!==n&&De(e,s,{get:(e=>t[e]).bind(null,s),enumerable:!(r=Oe(t,s))||r.enumerable});return e},Pe=(e,t,n)=>(n=e==null?{}:Ee(Ae(e)),Ne(t||!e||!e.__esModule?De(n,`default`,{value:e,enumerable:!0}):n,e)),H=t(import.meta.url);const Fe=new class{loading=!1;models=new Map;getModelInfo(e){if(!e||typeof e!=`string`)return null;let t=e.toLowerCase().trim(),n=this.models.get(t);if(n)return n;if(t.includes(`/`)){let e=t.split(`/`).pop();if(e&&this.models.has(e))return this.models.get(e)}else for(let[e,n]of this.models.entries())if(e.endsWith(`/${t}`))return n;if(t.includes(`:`)){let e=t.split(`:`)[0],n=this.getModelInfo(e);if(n)return n}return null}registerModelInfo(e,t){this.models.set(e.toLowerCase(),t)}clear(){this.models.clear()}async fetchModelInfo(e,t,n){if(e.modelsUrl){this.loading=!0;try{let r=new Headers;if(r.set(`Content-Type`,`application/json`),e.headers)for(let[t,n]of Object.entries(e.headers))r.set(t,n);if(n)for(let[e,t]of Object.entries(n))r.set(e,t);if(t&&e.apiKeyHeader){let n=e.apiKeyHeaderFormat;r.set(e.apiKeyHeader,n?n.replace(`{key}`,t):t)}let i=await fetch(e.modelsUrl,{headers:r});if(!i.ok)throw Error(`HTTP ${i.status} ${i.statusText}`);let a=await i.json(),o=Array.isArray(a.data)?a.data:Array.isArray(a.models)?a.models:[];for(let e of o){if(!e.id)continue;let t=e.context_length??e.context_window??0,n=e.max_completion_tokens||e.per_request_limits?.completion_tokens||e.top_provider?.max_completion_tokens||null,r=typeof e.supports_tools==`boolean`?e.supports_tools:typeof e.supportsTools==`boolean`?e.supportsTools:void 0,i=this.extractModalities(e,`input`),a=this.extractModalities(e,`output`),o=this.modalitiesInclude(i,`image`,`vision`),s=this.modalitiesInclude(i,`audio`,`voice`,`hearing`),c=this.modalitiesInclude(i,`video`),l=e.id===`openrouter/free`||this.supportedParametersInclude(e,`image`,`vision`,`audio`,`tool`,`structured`),u=this.extractReasoning(e),d=typeof e.supports_prompt_caching==`boolean`?e.supports_prompt_caching:typeof e.supportsPromptCaching==`boolean`?e.supportsPromptCaching:this.supportedParametersInclude(e,`cache_control`,`prompt_caching`)?!0:void 0;!t&&Array.isArray(e.providers)&&e.providers.length>0&&(t=e.providers[0]?.context_length||0),this.registerModelInfo(e.id,{contextWindow:t,maxOutput:n,...r!==void 0&&{supportsTools:r},...i.length>0&&{inputModalities:i},...a.length>0&&{outputModalities:a},...o!==void 0&&{supportsImageInput:o},...s!==void 0&&{supportsAudioInput:s},...c!==void 0&&{supportsVideoInput:c},...u&&{reasoning:u},...l&&{routesByRequestFeatures:l},...d!==void 0&&{supportsPromptCaching:d}})}o.length>0&&console.log(`[ModelRegistry] Registered ${o.length} models for provider "${e.id}"`)}catch(t){console.error(`[ModelRegistry] Error fetching models for ${e.id}:`,t)}finally{this.loading=!1}}}extractModalities(e,t){let n=t===`input`?e.input_modalities||e.inputModalities:e.output_modalities||e.outputModalities,r=e.architecture||{},i=t===`input`?r.input_modalities||r.inputModalities:r.output_modalities||r.outputModalities,a=typeof r.modality==`string`?r.modality:``,o=this.parseArchitectureModality(a,t),s=[...this.normalizeStringArray(n),...this.normalizeStringArray(i),...o];return Array.from(new Set(s))}extractReasoning(e){let t=e?.reasoning;if(!t||typeof t!=`object`)return;let n=this.normalizeStringArray(t.supported_efforts),r=typeof t.default_effort==`string`?t.default_effort.toLowerCase():void 0,i=typeof t.default_enabled==`boolean`?t.default_enabled:void 0,a=typeof t.supports_max_tokens==`boolean`?t.supports_max_tokens:void 0,o=typeof t.mandatory==`boolean`?t.mandatory:void 0;if(!(n.length===0&&r===void 0&&i===void 0&&a===void 0&&o===void 0))return{...n.length>0&&{supportedEfforts:n},...r!==void 0&&{defaultEffort:r},...i!==void 0&&{defaultEnabled:i},...a!==void 0&&{supportsMaxTokens:a},...o!==void 0&&{mandatory:o}}}modalitiesInclude(e,...t){if(e.length!==0)return t.some(t=>e.some(e=>e.includes(t)))}normalizeStringArray(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`).map(e=>e.toLowerCase()):[]}parseArchitectureModality(e,t){if(!e)return[];let[n=``,r=``]=e.toLowerCase().split(`->`).map(e=>e.trim());return(t===`input`?n:r).split(/[+,/\s]+/).map(e=>e.trim()).filter(Boolean)}supportedParametersInclude(e,...t){let n=this.normalizeStringArray(e.supported_parameters||e.supportedParameters);return t.some(e=>n.some(t=>t.includes(e)))}};function Ie(e){return e.replace(/^\/+|\/+$/g,``)}function Le(e){let t=Ie(e);return t.endsWith(`/index.html`)?t=t.slice(0,-11):t.endsWith(`index.html`)&&(t=t.slice(0,-10)),Ie(t)}function Re(e){let t=Ie(e),n=t.split(`/`).filter(Boolean);if(n.length===0)return null;let r=n[0].toLowerCase();if(r===`pages`){if(n.length>=3){let e=n[1];return{page:`pages`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e,path:n.slice(2).join(`/`)}}return{page:`pages`,groupId:`br:main`,path:n.slice(1).join(`/`)}}if(r===`files`){let e=n[1]||`main`;return{page:`files`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e,path:n.slice(2).join(`/`)||void 0}}if(r===`chat`){let e=n[1]||`main`;return{page:`chat`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e}}if(r===`tasks`){let e=n[1]||`main`;return{page:`tasks`,groupId:e===`main`?`br:main`:e.startsWith(`br-`)?`br:${e.slice(3)}`:e}}return r===`main`?{page:`pages`,groupId:`br:main`,path:n.slice(1).join(`/`)}:{page:`pages`,groupId:`br:main`,path:t}}function ze(){if(typeof document<`u`){let e=document.getElementById(`shadow-claw-static-routing`);if(e&&e.textContent)try{let t=JSON.parse(e.textContent);if(t&&typeof t==`object`&&t.routes)return t}catch(e){console.warn(`Failed to parse embedded static routing manifest:`,e)}}return null}function Be(e,t){let n=t||ze();if(!n||!n.routes)return null;let r=Le(e);if(!r)return null;for(let[e,t]of Object.entries(n.routes))if(!(!t||!t.prettyPath)&&Le(t.prettyPath)===r)return Re(e);return null}let Ve=null;const He=new Set([`chat`,`files`,`tasks`,`pages`,`settings`,`tools`,`channels`]);function Ue(){Ve=null}typeof globalThis<`u`&&(globalThis.__applyBasePathCacheReset=Ue);function We(){let e=typeof window<`u`?window:typeof self<`u`?self:globalThis;if(e&&e.__SHADOWCLAW_DEPLOY_ID__){let t=String(e.__SHADOWCLAW_DEPLOY_ID__).trim();if(t)return t.replace(/[^a-zA-Z0-9_-]/g,`-`)}let t=globalThis.process;if(t&&t.env&&t.env.SHADOWCLAW_DEPLOY_ID){let e=String(t.env.SHADOWCLAW_DEPLOY_ID).trim();if(e)return e.replace(/[^a-zA-Z0-9_-]/g,`-`)}let n=Ge();return!n||n===`/`?``:n.replace(/^\/+|\/+$/g,``).replace(/[^a-zA-Z0-9_-]/g,`-`)}function Ge(){if(Ve!==null)return Ve;if((typeof window>`u`||globalThis.WorkerGlobalScope!==void 0&&typeof self<`u`&&self instanceof globalThis.WorkerGlobalScope)&&typeof self<`u`&&self.location){let e=(self.location.pathname||`/`).split(`/`).filter(Boolean);if(e.length<=1)return Ve=`/`,Ve;let t=e[0].toLowerCase(),n=t===`service-worker.js`||t===`sw.js`||t===`manifest.json`||t===`sitemap.xml`||t===`favicon.ico`||t===`index.html`||t===`service-worker`||t===`assets`||t===`dist`||t===`public`;if(n&&e.length===2)return Ve=`/`,Ve;if(!n)return Ve=`/`+e[0]+`/`,Ve}let e=typeof window<`u`&&window.location?window.location:typeof self<`u`&&self.location?self.location:null;if(!e)return`/`;if(typeof document<`u`&&typeof document.querySelector==`function`){let t=document.querySelector(`base[href]`);if(t){let n=t.getAttribute(`href`);if(n)try{let t=new URL(n,e.origin).pathname;return t.endsWith(`/`)||(t+=`/`),Ve=t,Ve}catch{}}}let t=e.pathname||`/`;if(t===`/`)return Ve=`/`,Ve;let n=t.split(`/`).filter(Boolean),r=n.findIndex(e=>He.has(e.toLowerCase()));return r>=0?r===0?(Ve=`/`,Ve):(Ve=`/`+n.slice(0,r).join(`/`)+`/`,Ve):Be(t)?(Ve=`/`,Ve):n.length===1&&!t.includes(`.`)?(Ve=`/`+n[0]+`/`,Ve):(Ve=`/`,Ve)}function Ke(e){let t=e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`);return RegExp(`(^|\\s)@${t}\\b`,`i`)}Ke(`ShadowClaw`);function qe(){let e=We();return e?`shadowclaw-${e}`:`shadowclaw`}qe();const Je={github:{providerId:`github`,name:`GitHub`,aliases:[`github`,`api.github.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`token `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://github.com/login/oauth/authorize`,tokenUrl:`https://github.com/login/oauth/access_token`,defaultScopes:[`repo`,`read:user`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},gitlab:{providerId:`gitlab`,name:`GitLab`,aliases:[`gitlab`,`gitlab.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`PRIVATE-TOKEN`,headerPrefix:``},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},tokenAuthByServiceType:{git_remote:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}}},oauth:{authorizeUrl:`https://gitlab.com/oauth/authorize`,tokenUrl:`https://gitlab.com/oauth/token`,defaultScopes:[`read_api`,`read_user`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},figma:{providerId:`figma`,name:`Figma`,aliases:[`figma`,`api.figma.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`X-Figma-Token`,headerPrefix:``},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://www.figma.com/oauth`,tokenUrl:`https://api.figma.com/v1/oauth/token`,refreshUrl:`https://api.figma.com/v1/oauth/refresh`,defaultScopes:[],usePkce:!0,clientAuthMethod:`basic_header`,scopeSeparator:`space`}},notion:{providerId:`notion`,name:`Notion`,aliases:[`notion`,`api.notion.com`,`notion.so`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://api.notion.com/v1/oauth/authorize`,tokenUrl:`https://api.notion.com/v1/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`basic_header`,scopeSeparator:`space`}},microsoft_graph:{providerId:`microsoft_graph`,name:`Microsoft Graph`,aliases:[`microsoft`,`graph.microsoft.com`,`microsoft_graph`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://login.microsoftonline.com/common/oauth2/v2.0/authorize`,tokenUrl:`https://login.microsoftonline.com/common/oauth2/v2.0/token`,defaultScopes:[`openid`,`profile`,`offline_access`,`User.Read`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},yahoo_mail:{providerId:`yahoo_mail`,name:`Yahoo Mail`,aliases:[`yahoo`,`yahoo_mail`,`mail.yahoo.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://api.login.yahoo.com/oauth2/request_auth`,tokenUrl:`https://api.login.yahoo.com/oauth2/get_token`,defaultScopes:[`mail-r`,`mail-w`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},google:{providerId:`google`,name:`Google`,aliases:[`google`,`googleapis.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://accounts.google.com/o/oauth2/v2/auth`,tokenUrl:`https://oauth2.googleapis.com/token`,defaultScopes:[`openid`,`profile`,`email`],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},atlassian:{providerId:`atlassian`,name:`Atlassian`,aliases:[`atlassian`,`api.atlassian.com`],modes:[`oauth`,`token`,`basic`],defaultMode:`basic`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`,`basic_userpass`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `},basic:{headerName:`Authorization`,headerPrefix:`Basic `}},oauth:{authorizeUrl:`https://auth.atlassian.com/authorize`,tokenUrl:`https://auth.atlassian.com/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},slack:{providerId:`slack`,name:`Slack`,aliases:[`slack`,`slack.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://slack.com/oauth/v2/authorize`,tokenUrl:`https://slack.com/api/oauth.v2.access`,defaultScopes:[],usePkce:!1,clientAuthMethod:`request_body`,scopeSeparator:`comma`}},linear:{providerId:`linear`,name:`Linear`,aliases:[`linear`,`api.linear.app`,`linear.app`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`],authTypes:[`token`,`oauth`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://linear.app/oauth/authorize`,tokenUrl:`https://api.linear.app/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}},azure_devops:{providerId:`azure_devops`,name:`Azure DevOps`,aliases:[`azure_devops`,`dev.azure.com`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`http_api`,`git_remote`],authTypes:[`token`,`oauth`,`basic_userpass`,`ssh_key`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},tokenAuthByServiceType:{git_remote:{token:{headerName:`Authorization`,headerPrefix:`Basic `},oauth:{headerName:`Authorization`,headerPrefix:`Basic `}}},oauth:{authorizeUrl:`https://app.vssps.visualstudio.com/oauth2/authorize`,tokenUrl:`https://app.vssps.visualstudio.com/oauth2/token`,defaultScopes:[`vso.code`,`vso.profile`,`offline_access`],usePkce:!1,clientAuthMethod:`request_body`,scopeSeparator:`space`}},custom_mcp:{providerId:`custom_mcp`,name:`Custom MCP`,aliases:[`custom_mcp`],modes:[`oauth`,`token`],defaultMode:`oauth`,serviceTypes:[`mcp_remote`,`webmcp_local`],authTypes:[`none`,`token`,`oauth`,`custom_header`,`ssh_key`],tokenAuth:{token:{headerName:`Authorization`,headerPrefix:`Bearer `},oauth:{headerName:`Authorization`,headerPrefix:`Bearer `}},oauth:{authorizeUrl:`https://example.com/oauth/authorize`,tokenUrl:`https://example.com/oauth/token`,defaultScopes:[],usePkce:!0,clientAuthMethod:`request_body`,scopeSeparator:`space`}}},Ye=Object.fromEntries(Object.values(Je).filter(e=>!!e.oauth).map(e=>{let t=e.oauth;return[e.providerId,{id:e.providerId,name:e.name,authorizeUrl:t.authorizeUrl,tokenUrl:t.tokenUrl,redirectUri:t.redirectUri,defaultScopes:t.defaultScopes,usePkce:t.usePkce,clientAuthMethod:t.clientAuthMethod,scopeSeparator:t.scopeSeparator}]}));Object.fromEntries(Object.values(Je).map(e=>[e.providerId,{providerId:e.providerId,modes:e.modes,defaultMode:e.defaultMode}]));function Xe(e){return Ye[e]||null}let Ze=null;function Qe(e=`database/push-subscriptions.db`){if(Ze)return Ze;Ze=new w(e),Ze.exec(`
     CREATE TABLE IF NOT EXISTS vapid_keys (
       id INTEGER PRIMARY KEY CHECK (id = 1),
       public_key TEXT NOT NULL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadow-claw",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "type": "module",
   "license": "AGPL-3.0",
   "description": "Browser-native personal AI assistant.",
@@ -132,8 +132,8 @@
     "web-push": "^3.6.7"
   },
   "devDependencies": {
-    "@mcp-b/webmcp-polyfill": "^3.0.0",
-    "@mcp-b/webmcp-types": "^3.0.0",
+    "@mcp-b/webmcp-polyfill": "^5.1.0",
+    "@mcp-b/webmcp-types": "^5.1.0",
     "@playwright/test": "^1.59.2",
     "@storybook/addon-docs": "^10.6.0",
     "@storybook/web-components-vite": "^10.6.0",

package/src/core/utils/initControlPlane.test.ts

@@ -703,7 +703,8 @@ describe("initControlPlane", () => {
         });
         expect(mockExecuteTool).toHaveBeenCalledWith(
           nativeModelContextTool,
-          "{}",
+          {},
+          undefined,
         );
       } finally {
         if (origDocMC)
@@ -713,6 +714,126 @@ describe("initControlPlane", () => {
       }
     });
 
+    it("handles Chrome 155+ WebMCP invoke-tool passing JavaScript object directly to executeTool", async () => {
+      const origDocMC = Object.getOwnPropertyDescriptor(
+        document,
+        "modelContext",
+      );
+      const origNavMC = Object.getOwnPropertyDescriptor(
+        navigator,
+        "modelContext",
+      );
+      delete (navigator as any).modelContext;
+
+      const nativeModelContextTool = {
+        name: "list_files",
+        description: "List files and directories",
+        inputSchema: { type: "object" },
+        title: "list_files",
+        origin: "http://localhost:8888",
+        window: globalThis.window,
+      };
+
+      const mockExecuteTool = jest.fn(async (tool: any, input: any) => {
+        if (tool !== nativeModelContextTool) {
+          throw new TypeError("parameter 1 is not of type 'ModelContextTool'");
+        }
+        if (typeof input !== "object" || input === null) {
+          throw new TypeError("parameter 2 is not of type 'Object'");
+        }
+        return "chrome-155-object-result";
+      });
+
+      Object.defineProperty(document, "modelContext", {
+        value: {
+          getTools: jest.fn(async () => [nativeModelContextTool]),
+          executeTool: mockExecuteTool,
+        },
+        configurable: true,
+      });
+
+      try {
+        const res = await executeClientControlCommand(
+          "invoke-tool",
+          { toolName: "list_files", input: { recursive: true } },
+          {},
+        );
+
+        expect(res).toEqual({ result: "chrome-155-object-result" });
+        expect(mockExecuteTool).toHaveBeenCalledTimes(1);
+        expect(mockExecuteTool).toHaveBeenCalledWith(
+          nativeModelContextTool,
+          {
+            recursive: true,
+          },
+          undefined,
+        );
+      } finally {
+        if (origDocMC)
+          Object.defineProperty(document, "modelContext", origDocMC);
+        if (origNavMC)
+          Object.defineProperty(navigator, "modelContext", origNavMC);
+      }
+    });
+
+    it("gracefully falls back to stringified input in invoke-tool when executeTool throws 'Failed to parse input'", async () => {
+      const origDocMC = Object.getOwnPropertyDescriptor(
+        document,
+        "modelContext",
+      );
+      const origNavMC = Object.getOwnPropertyDescriptor(
+        navigator,
+        "modelContext",
+      );
+      delete (navigator as any).modelContext;
+
+      const nativeModelContextTool = {
+        name: "list_files",
+        description: "List files and directories",
+        inputSchema: '{"type":"object"}',
+        title: "list_files",
+        origin: "http://localhost:8888",
+        window: globalThis.window,
+      };
+
+      const calls: any[] = [];
+      const mockExecuteTool = jest.fn(async (_tool: any, input: any) => {
+        calls.push(input);
+        if (typeof input !== "string") {
+          throw new Error(
+            "Failed to parse input arguments: expected DOMString",
+          );
+        }
+        return "legacy-chrome-string-result";
+      });
+
+      Object.defineProperty(document, "modelContext", {
+        value: {
+          getTools: jest.fn(async () => [nativeModelContextTool]),
+          executeTool: mockExecuteTool,
+        },
+        configurable: true,
+      });
+
+      try {
+        const res = await executeClientControlCommand(
+          "invoke-tool",
+          { toolName: "list_files", input: { path: "src" } },
+          {},
+        );
+
+        expect(res).toEqual({ result: "legacy-chrome-string-result" });
+        expect(calls).toHaveLength(2);
+        expect(calls[0]).toEqual({ path: "src" });
+        expect(calls[1]).toBe(JSON.stringify({ path: "src" }));
+      } finally {
+        if (origDocMC)
+          Object.defineProperty(document, "modelContext", origDocMC);
+        if (origNavMC)
+          Object.defineProperty(navigator, "modelContext", origNavMC);
+      }
+    });
+
     it("refuses to execute tool when tool is not registered on client or not enabled in active conversation", async () => {
       const origDocMC = Object.getOwnPropertyDescriptor(
         document,

package/src/core/utils/initControlPlane.ts

@@ -466,36 +466,40 @@ export async function executeClientControlCommand(
           }
         }
 
-        const inputStr =
-          typeof args.input === "string"
-            ? args.input
-            : JSON.stringify(args.input || {});
+        const { executeWebMcpTool } =
+          await import("../../subsystems/mcp/webmcp.js");
 
         if (typeof ctx.executeTool === "function") {
           // 1. Pass the actual ModelContextTool object from getTools() if available (required by native Chromium)
           if (matchedTool) {
             try {
-              const res = await ctx.executeTool(matchedTool, inputStr);
+              const res = await executeWebMcpTool(ctx, matchedTool, args.input);
               return { result: res };
             } catch (_) {}
           }
 
           // 2. Pass { name: toolName } object (accepted by polyfill / mocks)
           try {
-            const res = await ctx.executeTool(
+            const res = await executeWebMcpTool(
+              ctx,
               { name: args.toolName },
-              inputStr,
+              args.input,
             );
             return { result: res };
           } catch (_) {}
 
           // 3. Pass toolName string directly (accepted by some preview shims)
           try {
-            const res = await ctx.executeTool(args.toolName, inputStr);
+            const res = await executeWebMcpTool(ctx, args.toolName, args.input);
             return { result: res };
           } catch (_) {}
         }
 
+        const inputStr =
+          typeof args.input === "string"
+            ? args.input
+            : JSON.stringify(args.input || {});
+
         // 4. Check navigator.modelContextTesting if present
         if (
           typeof navigator !== "undefined" &&

package/src/storage/staticMainSite.ts

@@ -425,7 +425,21 @@ export async function seedStaticMainSite(
     try {
       await deleteGroupDirectory(db, groupId, ".agents/skills/main");
     } catch (error) {
-      // A fresh workspace has no bundled-skill directory to remove yet.
+      if (
+        !(
+          error &&
+          typeof error === "object" &&
+          "name" in error &&
+          error.name === "NotFoundError"
+        )
+      ) {
+        throw error;
+      }
+    }
+    try {
+      await deleteGroupDirectory(db, groupId, ".agents/tools/main");
+    } catch (error) {
+      // A fresh workspace has no bundled-tool directory to remove yet.
       if (
         !(
           error &&
@@ -543,7 +557,7 @@ export async function seedStaticMainSite(
     for (const tool of manifest.tools || []) {
       const toolPath = `.agents/tools/main/${tool.displayPath}`;
       try {
-        if (!(await groupFileExists(db, groupId, toolPath))) {
+        if (didPurgeSkills || !(await groupFileExists(db, groupId, toolPath))) {
           await writeGroupFile(db, groupId, toolPath, tool.content);
         }
       } catch (error) {

package/src/stores/orchestrator.test.ts

@@ -2853,6 +2853,39 @@ describe("OrchestratorStore", () => {
       }
     });
 
+    it("applies internetAccess from site-config to vmBashFullInternetAccess", async () => {
+      const store = new OrchestratorStore();
+      const events = createEvents();
+      const orch: any = {
+        events,
+        getUseProxy: () => false,
+        getProxyUrl: () => "",
+        getGitProxyUrl: () => "",
+        getVMBashFullInternetAccess: () => false,
+        getTaskServerUrl: () => "/schedule",
+        taskServerEnabled: true,
+        vmBashFullInternetAccess: false,
+      };
+
+      const configElement = document.createElement("script");
+      configElement.id = "shadow-claw-site-config";
+      configElement.type = "application/json";
+      configElement.textContent = JSON.stringify({
+        settings: {
+          internetAccess: true,
+        },
+      });
+      document.head.appendChild(configElement);
+
+      try {
+        await store.init({} as any, orch);
+        expect(orch.vmBashFullInternetAccess).toBe(true);
+        expect(store._vmBashFullInternetAccess.get()).toBe(true);
+      } finally {
+        configElement.remove();
+      }
+    });
+
     it("clears legacy group-level toolTags on DEFAULT_GROUP_ID if present", async () => {
       const store = new OrchestratorStore();
       const events = createEvents();

package/src/stores/orchestrator.ts

@@ -2558,6 +2558,26 @@ export class OrchestratorStore {
         await updateGroupToolTags(db, DEFAULT_GROUP_ID, undefined);
       }
 
+      // If site configuration declares internet access, ensure it is honored
+      const declaredInternetAccess =
+        config.settings?.internetAccess ??
+        config.settings?.vm_bash_full_internet_access ??
+        config.settings?.fullInternetAccess ??
+        config.internetAccess;
+      if (declaredInternetAccess === true) {
+        const currentInternet = await getConfig(
+          db,
+          CONFIG_KEYS.VM_BASH_FULL_INTERNET_ACCESS,
+        );
+        if (currentInternet !== "true") {
+          await setConfig(db, CONFIG_KEYS.VM_BASH_FULL_INTERNET_ACCESS, "true");
+          if (this.orchestrator) {
+            this.orchestrator.vmBashFullInternetAccess = true;
+          }
+          this._vmBashFullInternetAccess.set(true);
+        }
+      }
+
       const isSeeded = await getConfig(db, CONFIG_KEYS.SITE_CONFIG_SEEDED);
       if (isSeeded) {
         return;
@@ -2635,6 +2655,22 @@ export class OrchestratorStore {
         if (assistantName && typeof assistantName === "string") {
           await setConfig(db, CONFIG_KEYS.ASSISTANT_NAME, assistantName);
         }
+        const allowInternet =
+          config.settings.internetAccess ??
+          config.settings.vm_bash_full_internet_access ??
+          config.settings.fullInternetAccess ??
+          config.internetAccess;
+        if (typeof allowInternet === "boolean") {
+          await setConfig(
+            db,
+            CONFIG_KEYS.VM_BASH_FULL_INTERNET_ACCESS,
+            String(allowInternet),
+          );
+          if (this.orchestrator) {
+            this.orchestrator.vmBashFullInternetAccess = allowInternet;
+          }
+          this._vmBashFullInternetAccess.set(allowInternet);
+        }
       }
 
       const defaultToolsProfile =

package/src/subsystems/git/git.test.ts

@@ -83,6 +83,7 @@ jest.unstable_mockModule("@zip.js/zip.js", () => ({}) as any);
 describe("git", () => {
   let buildAuthCallbacks: Function;
   let ensureDir: Function;
+  let getGitTargetAddressSpace: Function;
   let getProxyUrl: Function;
   let gitAdd: Function;
   let gitBranch: Function;
@@ -124,6 +125,7 @@ describe("git", () => {
 
     buildAuthCallbacks = mod.buildAuthCallbacks;
     ensureDir = mod.ensureDir;
+    getGitTargetAddressSpace = mod.getGitTargetAddressSpace;
     getProxyUrl = mod.getProxyUrl;
     gitAdd = mod.gitAdd;
     gitBranch = mod.gitBranch;
@@ -744,6 +746,103 @@ describe("git", () => {
 
       expect(url).toContain("git-proxy");
     });
+
+    it("uses https when running under https on localhost:8888", () => {
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "https:",
+          host: "localhost:8888",
+          hostname: "localhost",
+        }),
+      ).toBe("https://localhost:8888/git-proxy");
+    });
+
+    it("uses https when running under https on a remote host", () => {
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "https:",
+          host: "xt-ml.github.io",
+          hostname: "xt-ml.github.io",
+        }),
+      ).toBe("https://localhost:8888/git-proxy");
+    });
+
+    it("uses https when running under https with empty or loopback hostname", () => {
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "https:",
+          host: "localhost:8888",
+          hostname: "",
+        }),
+      ).toBe("https://localhost:8888/git-proxy");
+
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "https:",
+          host: "[::1]:8888",
+          hostname: "[::1]",
+        }),
+      ).toBe("https://[::1]:8888/git-proxy");
+    });
+
+    it("preserves http when running under http", () => {
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "http:",
+          host: "localhost:8888",
+          hostname: "localhost",
+        }),
+      ).toBe("http://localhost:8888/git-proxy");
+
+      expect(
+        getProxyUrl("local", undefined, {
+          protocol: "http:",
+          host: "xt-ml.github.io",
+          hostname: "xt-ml.github.io",
+        }),
+      ).toBe("http://localhost:8888/git-proxy");
+    });
+
+    it("uses custom URL when provided", () => {
+      expect(getProxyUrl("custom", "https://proxy.example.com/git")).toBe(
+        "https://proxy.example.com/git",
+      );
+    });
+  });
+
+  describe("getGitTargetAddressSpace", () => {
+    it("returns loopback for localhost and 127.0.0.1 and [::1]", () => {
+      expect(
+        getGitTargetAddressSpace("http://localhost:8888/git-proxy/test"),
+      ).toBe("loopback");
+      expect(
+        getGitTargetAddressSpace("https://127.0.0.1:8888/git-proxy/test"),
+      ).toBe("loopback");
+      expect(
+        getGitTargetAddressSpace("https://[::1]:8888/git-proxy/test"),
+      ).toBe("loopback");
+    });
+
+    it("returns private for private networks and local domains", () => {
+      expect(
+        getGitTargetAddressSpace("https://192.168.1.10:8888/git-proxy/test"),
+      ).toBe("private");
+      expect(
+        getGitTargetAddressSpace("https://10.0.0.5:8888/git-proxy/test"),
+      ).toBe("private");
+      expect(getGitTargetAddressSpace("https://tv:8888/git-proxy/test")).toBe(
+        "private",
+      );
+      expect(
+        getGitTargetAddressSpace("https://my-nas.local:8888/git-proxy/test"),
+      ).toBe("private");
+    });
+
+    it("returns undefined for public domains", () => {
+      expect(
+        getGitTargetAddressSpace("https://github.com/user/repo.git"),
+      ).toBeUndefined();
+    });
   });
 
   describe("repoDir", () => {

package/src/subsystems/git/git.ts

@@ -17,6 +17,39 @@ if (!globalThis.Buffer) {
   globalThis.Buffer = Buffer;
 }
 
+export function getGitTargetAddressSpace(
+  url: string,
+): "loopback" | "private" | undefined {
+  try {
+    const locOrigin =
+      typeof location !== "undefined" && location.origin
+        ? location.origin
+        : typeof globalThis !== "undefined" && globalThis.location?.origin
+          ? globalThis.location.origin
+          : "http://127.0.0.1:8888";
+    const u = new URL(url, locOrigin);
+    const host = u.hostname.toLowerCase();
+    if (
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]"
+    ) {
+      return "loopback";
+    } else if (
+      /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host) ||
+      !host.includes(".") ||
+      host.endsWith(".local") ||
+      host.endsWith(".lan") ||
+      host.endsWith(".home") ||
+      host.endsWith(".internal")
+    ) {
+      return "private";
+    }
+  } catch (_) {}
+  return undefined;
+}
+
 const httpClient = {
   async request({
     url,
@@ -34,12 +67,18 @@ const httpClient = {
       body = await collectBody(body);
     }
 
-    const res = await fetch(url, {
+    const targetAddressSpace = getGitTargetAddressSpace(url);
+    const fetchOptions: RequestInit & { targetAddressSpace?: string } = {
       method,
       headers,
       body,
       credentials: "omit",
-    });
+    };
+    if (targetAddressSpace) {
+      fetchOptions.targetAddressSpace = targetAddressSpace;
+    }
+
+    const res = await fetch(url, fetchOptions);
 
     const iter =
       res.body && typeof res.body.getReader === "function"
@@ -572,6 +611,13 @@ const DEFAULT_DEPTH = 20;
 export function getProxyUrl(
   preference: "local" | "public" | "custom",
   customUrl?: string,
+  loc?: {
+    protocol?: string;
+    host?: string;
+    hostname?: string;
+    origin?: string;
+    href?: string;
+  },
 ): string {
   if (preference === "custom" && customUrl) {
     return customUrl;
@@ -582,16 +628,50 @@ export function getProxyUrl(
   }
 
   // Default to local proxy
-  const { protocol, host, hostname } = globalThis.location;
-
-  // If running on localhost/127.0.0.1, use the current host (works for dev)
-  if (hostname === "localhost" || hostname === "127.0.0.1") {
-    return `${protocol}//${host}/git-proxy`;
-  }
-
-  // If on a remote host, default to local dev server port
-
-  return `http://${DEFAULT_DEV_HOST}:${DEFAULT_DEV_PORT}/git-proxy`;
+  const currentLoc =
+    loc ||
+    (typeof globalThis !== "undefined" && globalThis.location
+      ? globalThis.location
+      : typeof self !== "undefined" && (self as any).location
+        ? (self as any).location
+        : typeof window !== "undefined" && window.location
+          ? window.location
+          : null);
+
+  const rawProtocol = currentLoc?.protocol || "";
+  const isHttps =
+    rawProtocol === "https:" ||
+    rawProtocol === "https" ||
+    (typeof currentLoc?.origin === "string" &&
+      currentLoc.origin.startsWith("https:")) ||
+    (typeof currentLoc?.href === "string" &&
+      currentLoc.href.startsWith("https://"));
+  const scheme = isHttps ? "https:" : "http:";
+
+  const host = currentLoc?.host || "";
+  const hostname = currentLoc?.hostname || "";
+
+  const isLoopback =
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    hostname === "[::1]" ||
+    hostname === "0.0.0.0" ||
+    host.startsWith("localhost:") ||
+    host.startsWith("127.0.0.1:") ||
+    host.startsWith("[::1]:");
+
+  const isStaticHost =
+    currentLoc &&
+    (currentLoc.protocol === "file:" ||
+      (hostname &&
+        (hostname.endsWith(".github.io") || hostname.endsWith(".pages.dev"))));
+
+  if (host && (isLoopback || !isStaticHost)) {
+    return `${scheme}//${host}/git-proxy`;
+  }
+
+  return `${scheme}//${DEFAULT_DEV_HOST}:${DEFAULT_DEV_PORT}/git-proxy`;
 }
 
 /**