shadow-claw 1.54.0 → 1.55.0

package/src/components/shadow-claw-pages/shadow-claw-pages-scripts.test.ts

@@ -0,0 +1,266 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+const mockLoadApprovedCustomElementScript = jest.fn(async () =>
+  document.createElement("script"),
+);
+const mockGetApprovedCustomElementScriptDescriptors = jest.fn(() => [
+  {
+    id: "feed-scroller",
+    src: "/pages/main/assets/feed-scroller.js",
+    global: true,
+    hasInit: true,
+  },
+  {
+    id: "x-hook-component",
+    src: "/pages/main/assets/x-hook-component.js",
+    hasInit: true,
+  },
+  {
+    name: "x-postpress-code",
+    src: "/pages/main/assets/x-postpress-code.js",
+    hasInit: true,
+  },
+]);
+
+jest.unstable_mockModule("../../security/custom-element-security.js", () => ({
+  getApprovedCustomElementScriptDescriptors:
+    mockGetApprovedCustomElementScriptDescriptors,
+  loadApprovedCustomElementScript: mockLoadApprovedCustomElementScript,
+  isApprovedScript: jest.fn((_src: string) => true),
+  isAllowedCustomElement: jest.fn(() => true),
+  getIframeCsp: jest.fn(() => ""),
+  getIframeSandboxPolicy: jest.fn(() => "allow-scripts"),
+  hasApprovedCustomElement: jest.fn(() => false),
+}));
+
+jest.unstable_mockModule("../../core/effect.js", () => ({
+  effect: jest.fn(() => () => undefined),
+}));
+
+jest.unstable_mockModule("../../content/markdown.js", () => ({
+  renderMarkdown: jest.fn(
+    async (value: string) =>
+      `<article>${value.replace(/<script[\s\S]*?<\/script>/gi, "")}</article>`,
+  ),
+}));
+
+jest.unstable_mockModule("../../security/trusted-types.js", () => ({
+  sanitizeToTrustedHtml: jest.fn((html: string) => html),
+  sanitizeSrcdocHtml: jest.fn((html: string) => html),
+  setSanitizedHtml: jest.fn((element: Element, html: string) => {
+    element.innerHTML = html;
+    return html;
+  }),
+  setTrustedSrcdoc: jest.fn((iframe: HTMLIFrameElement, html: string) => {
+    iframe.srcdoc = html;
+    return html;
+  }),
+  toTrustedScriptUrl: jest.fn((url: string) => url),
+  toTrustedHtmlPresanitized: jest.fn((html: string) => html),
+}));
+
+let mockActivePinnedPage: any = null;
+jest.unstable_mockModule("../../stores/orchestrator.js", () => ({
+  orchestratorStore: {
+    whenInitialized: Promise.resolve(),
+    whenReady: Promise.resolve(),
+    pages: [],
+    groups: [],
+    activeGroupId: "group-1",
+    isPageAllowed: jest.fn(() => true),
+    get activePinnedPage() {
+      return mockActivePinnedPage;
+    },
+    setActivePinnedPage: jest.fn(async (_db: any, val: any) => {
+      mockActivePinnedPage = val;
+    }),
+    _activePinnedPage: {
+      set: jest.fn((val: any) => {
+        mockActivePinnedPage = val;
+      }),
+    },
+  },
+}));
+
+jest.unstable_mockModule("../../storage/read-group-file.js", () => ({
+  readGroupFile: jest.fn(),
+}));
+
+jest.unstable_mockModule("../../storage/static-main-site.js", () => ({
+  getStaticMainManifest: jest.fn(async () => ({ pages: [] })),
+  getStaticPageContent: jest.fn(async () => null),
+  seedStaticMainSite: jest.fn(),
+  getSiteConfigSeoSettings: jest.fn(() => ({ siteTitle: "ShadowClaw" })),
+}));
+
+jest.unstable_mockModule("../../db/db.js", () => ({
+  getDb: jest.fn(async () => ({})),
+}));
+
+jest.unstable_mockModule("../../db/get-config.js", () => ({
+  getConfig: jest.fn(async () => "0"),
+}));
+
+const { ShadowClawPages } = await import("./shadow-claw-pages.js");
+const { readGroupFile } = await import("../../storage/read-group-file.js");
+const { setSanitizedHtml } = await import("../../security/trusted-types.js");
+
+describe("ShadowClawPages - Script Dependencies Loading", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("loads global scripts and frontmatter-declared script dependencies", async () => {
+    const component = new ShadowClawPages();
+    component.db = {} as any;
+    component.selectedPage = { groupId: "group-1", path: "posts/dynamic.md" };
+
+    const postContent = [
+      "---",
+      'title: "The Web Is Dynamic"',
+      "dependencies:",
+      '  - "x-hook-component"',
+      "---",
+      "# The Web Is Dynamic",
+      "<x-hook-component></x-hook-component>",
+    ].join("\n");
+
+    (
+      readGroupFile as jest.MockedFunction<typeof readGroupFile>
+    ).mockResolvedValueOnce(postContent);
+
+    await component.renderSelectedPage();
+
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/feed-scroller.js",
+    );
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/x-hook-component.js",
+    );
+    expect(mockLoadApprovedCustomElementScript).not.toHaveBeenCalledWith(
+      "/pages/main/assets/x-postpress-code.js",
+    );
+    expect(setSanitizedHtml).toHaveBeenCalledTimes(1);
+  });
+
+  it("fails gracefully when an unresolvable dependency is in frontmatter without breaking rendering", async () => {
+    const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+    const component = new ShadowClawPages();
+    component.db = {} as any;
+    component.selectedPage = { groupId: "group-1", path: "posts/unknown.md" };
+
+    const postContent = [
+      "---",
+      'title: "Unknown Script Page"',
+      "dependencies:",
+      '  - "unknown-script-id"',
+      "---",
+      "# Unknown Script Page",
+      "<p>Some content</p>",
+    ].join("\n");
+
+    (
+      readGroupFile as jest.MockedFunction<typeof readGroupFile>
+    ).mockResolvedValueOnce(postContent);
+
+    await component.renderSelectedPage();
+
+    // Global script should still load
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/feed-scroller.js",
+    );
+    // Page rendering should still succeed
+    expect(setSanitizedHtml).toHaveBeenCalledTimes(1);
+
+    warnSpy.mockRestore();
+  });
+
+  it("fails gracefully when loadApprovedCustomElementScript throws without breaking rendering", async () => {
+    const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+    mockLoadApprovedCustomElementScript.mockRejectedValueOnce(
+      new Error("Network connection failed"),
+    );
+
+    const component = new ShadowClawPages();
+    component.db = {} as any;
+    component.selectedPage = { groupId: "group-1", path: "posts/faulty.md" };
+
+    const postContent = [
+      "---",
+      'title: "Faulty Script Page"',
+      "dependencies:",
+      '  - "x-hook-component"',
+      "---",
+      "# Faulty Script Page",
+    ].join("\n");
+
+    (
+      readGroupFile as jest.MockedFunction<typeof readGroupFile>
+    ).mockResolvedValueOnce(postContent);
+
+    // Should not throw
+    await expect(component.renderSelectedPage()).resolves.toBeUndefined();
+    expect(setSanitizedHtml).toHaveBeenCalledTimes(1);
+
+    warnSpy.mockRestore();
+  });
+
+  it("extracts and loads inline script tags from raw markdown content before DOMPurify strips them", async () => {
+    const component = new ShadowClawPages();
+    component.db = {} as any;
+    component.selectedPage = { groupId: "group-1", path: "posts/inline.md" };
+
+    const postContent = [
+      "---",
+      'title: "Inline Script Page"',
+      "---",
+      "# Inline Script Page",
+      '<script type="module" src="/pages/main/assets/x-postpress-code.js"></script>',
+    ].join("\n");
+
+    (
+      readGroupFile as jest.MockedFunction<typeof readGroupFile>
+    ).mockResolvedValueOnce(postContent);
+
+    await component.renderSelectedPage();
+
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/x-postpress-code.js",
+    );
+    expect(setSanitizedHtml).toHaveBeenCalledTimes(1);
+  });
+
+  it("resolves and loads scripts by filename stem when existing config does not specify an id", async () => {
+    mockGetApprovedCustomElementScriptDescriptors.mockReturnValueOnce([
+      { src: "/pages/main/assets/feed-scroller.js", global: true },
+      { src: "/pages/main/assets/x-hook-component.js" },
+    ] as any);
+
+    const component = new ShadowClawPages();
+    component.db = {} as any;
+    component.selectedPage = { groupId: "group-1", path: "posts/legacy.md" };
+
+    const postContent = [
+      "---",
+      'title: "Legacy Post"',
+      "dependencies:",
+      '  - "x-hook-component"',
+      "---",
+      "# Legacy Post",
+    ].join("\n");
+
+    (
+      readGroupFile as jest.MockedFunction<typeof readGroupFile>
+    ).mockResolvedValueOnce(postContent);
+
+    await component.renderSelectedPage();
+
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/feed-scroller.js",
+    );
+    expect(mockLoadApprovedCustomElementScript).toHaveBeenCalledWith(
+      "/pages/main/assets/x-hook-component.js",
+    );
+    expect(setSanitizedHtml).toHaveBeenCalledTimes(1);
+  });
+});

package/src/components/shadow-claw-pages/shadow-claw-pages.ts

@@ -3,6 +3,7 @@ import { Signal } from "signal-polyfill";
 import { effect } from "../../core/effect.js";
 
 import { splitFrontmatter } from "../../utils/frontmatter.js";
+import { resolvePageScriptDependencies } from "../../utils/resolve-page-script-dependencies.js";
 import { formatSeoTitle } from "../../utils/seo.js";
 import { getSiteConfigSeoSettings } from "../../storage/static-main-site.js";
 import { CONFIG_KEYS } from "../../config/config.js";
@@ -1524,16 +1525,16 @@ export class ShadowClawPages extends ShadowClawElement {
           return;
         }
 
-        // Extract approved script srcs from the raw HTML *before* DOMPurify
+        // Extract approved script srcs from the raw content *before* DOMPurify
         // strips <script> tags. DOMPurify removes scripts during sanitization,
         // so we must collect them here from the raw string, not from the DOM.
-        const approvedScriptSrcs: string[] = [];
+        const rawScriptSrcs: string[] = [];
         const scriptSrcRegex = /<script\b[^>]*\bsrc=["']([^"']+)["'][^>]*>/gi;
         let scriptMatch: RegExpExecArray | null;
-        while ((scriptMatch = scriptSrcRegex.exec(html)) !== null) {
+        while ((scriptMatch = scriptSrcRegex.exec(content)) !== null) {
           const src = scriptMatch[1];
           if (src && isApprovedScript(src)) {
-            approvedScriptSrcs.push(src);
+            rawScriptSrcs.push(src);
           }
         }
 
@@ -1543,22 +1544,45 @@ export class ShadowClawPages extends ShadowClawElement {
         // connectedCallback fires correctly and slotchange is captured on
         // first connection rather than after a late upgrade.
         const scriptDescriptors = getApprovedCustomElementScriptDescriptors();
+        const combinedFrontmatter = {
+          ...(parsedFrontmatter?.data || {}),
+          scripts: [
+            ...(Array.isArray(parsedFrontmatter?.data?.scripts)
+              ? parsedFrontmatter.data.scripts
+              : parsedFrontmatter?.data?.scripts
+                ? [parsedFrontmatter.data.scripts]
+                : []),
+            ...rawScriptSrcs,
+          ],
+        };
+        const resolvedScripts = resolvePageScriptDependencies(
+          scriptDescriptors,
+          combinedFrontmatter,
+          content,
+        );
+
         await Promise.all(
-          approvedScriptSrcs.map(async (src) => {
-            await loadApprovedCustomElementScript(src);
-            const desc = scriptDescriptors.find((d) => d.src === src);
-            if (desc?.hasInit) {
-              try {
-                const mod = await import(/* @vite-ignore */ src);
-                if (typeof mod?.init === "function") {
-                  await mod.init();
+          resolvedScripts.map(async (desc) => {
+            try {
+              await loadApprovedCustomElementScript(desc.src);
+              if (desc.hasInit) {
+                try {
+                  const mod = await import(/* @vite-ignore */ desc.src);
+                  if (typeof mod?.init === "function") {
+                    await mod.init();
+                  }
+                } catch (e) {
+                  console.error(
+                    "[ShadowClaw] Error executing init for " + desc.src,
+                    e,
+                  );
                 }
-              } catch (e) {
-                console.error(
-                  "[ShadowClaw] Error executing init for " + src,
-                  e,
-                );
               }
+            } catch (err) {
+              console.warn(
+                `[ShadowClaw] Error loading custom element script ${desc.src}:`,
+                err,
+              );
             }
           }),
         );

package/src/core/orchestrator/utils/sync-web-mcp-registration.test.ts

@@ -25,8 +25,10 @@ const mockApplyWebMcpMode = jest.fn<(mode: WebMcpMode) => void>();
 
 let lastActivatedListener: ((event: any) => void) | null = null;
 let lastCancelListener: ((event: any) => void) | null = null;
+let lastChangeListener: ((event: any) => void) | null = null;
 const mockUnsubscribeActivated = jest.fn<() => void>();
 const mockUnsubscribeCancel = jest.fn<() => void>();
+const mockUnsubscribeChange = jest.fn<() => void>();
 const mockOnWebMcpToolActivated = jest.fn((cb: any) => {
   lastActivatedListener = cb;
   return mockUnsubscribeActivated;
@@ -35,6 +37,10 @@ const mockOnWebMcpToolCancel = jest.fn((cb: any) => {
   lastCancelListener = cb;
   return mockUnsubscribeCancel;
 });
+const mockOnWebMcpToolChange = jest.fn((cb: any) => {
+  lastChangeListener = cb;
+  return mockUnsubscribeChange;
+});
 
 jest.unstable_mockModule("../../../subsystems/mcp/webmcp.js", () => ({
   registerWebMcpTools: mockRegisterWebMcpTools,
@@ -42,6 +48,7 @@ jest.unstable_mockModule("../../../subsystems/mcp/webmcp.js", () => ({
   setWebMcpMode: mockApplyWebMcpMode,
   onWebMcpToolActivated: mockOnWebMcpToolActivated,
   onWebMcpToolCancel: mockOnWebMcpToolCancel,
+  onWebMcpToolChange: mockOnWebMcpToolChange,
 }));
 
 const mockHandleWorkerMessage = jest
@@ -234,6 +241,7 @@ describe("syncWebMcpRegistration", () => {
 
     expect(mockOnWebMcpToolActivated).toHaveBeenCalled();
     expect(mockOnWebMcpToolCancel).toHaveBeenCalled();
+    expect(mockOnWebMcpToolChange).toHaveBeenCalled();
 
     // Trigger activated listener
     lastActivatedListener?.({ toolName: "read_file" });
@@ -248,9 +256,17 @@ describe("syncWebMcpRegistration", () => {
       "webmcp-tool-cancel",
       { toolName: "read_file" },
     );
+
+    // Trigger change listener
+    const dummyEvt = new Event("toolchange");
+    lastChangeListener?.(dummyEvt);
+    expect(mockOrchestrator.events?.emit).toHaveBeenCalledWith(
+      "webmcp-tool-change",
+      { event: dummyEvt },
+    );
   });
 
-  it("should unsubscribe from toolactivated and toolcancel when webMcpEffectCleanup is executed", async () => {
+  it("should unsubscribe from toolactivated, toolcancel, and toolchange when webMcpEffectCleanup is executed", async () => {
     syncWebMcpRegistration(mockOrchestrator as unknown as Orchestrator, mockDb);
     await mockOrchestrator.webMcpRegistrationLock;
 
@@ -261,6 +277,7 @@ describe("syncWebMcpRegistration", () => {
 
     expect(mockUnsubscribeActivated).toHaveBeenCalled();
     expect(mockUnsubscribeCancel).toHaveBeenCalled();
+    expect(mockUnsubscribeChange).toHaveBeenCalled();
   });
 
   it("should setup effect and register tools filtered by group toolTags", async () => {

package/src/core/orchestrator/utils/sync-web-mcp-registration.ts

@@ -7,6 +7,7 @@ import {
   unregisterWebMcpTools,
   onWebMcpToolActivated,
   onWebMcpToolCancel,
+  onWebMcpToolChange,
 } from "../../../subsystems/mcp/webmcp.js";
 
 import { effect } from "../../effect.js";
@@ -53,6 +54,10 @@ export function syncWebMcpRegistration(
     });
   });
 
+  const unsubscribeChange = onWebMcpToolChange((event) => {
+    orchestrator.events?.emit("webmcp-tool-change", { event });
+  });
+
   // Register WebMCP tools and re-register when tool config changes.
   // This effect runs once immediately to perform the initial registration.
   // We intentionally do NOT call isWebMcpSupported() here — that accesses
@@ -132,6 +137,9 @@ export function syncWebMcpRegistration(
     try {
       unsubscribeCancel();
     } catch {}
+    try {
+      unsubscribeChange();
+    } catch {}
     if (typeof disposeEffect === "function") {
       disposeEffect();
     }

package/src/core/utils/init-control-plane.test.ts

@@ -861,14 +861,19 @@ describe("initControlPlane", () => {
       });
 
       try {
-        // 1. Client has WebMCP tools registered, but ask_user is not among them
+        // 1. Client has WebMCP tools registered, but read_file is not among them
         await expect(
-          executeClientControlCommand("invoke-tool", { toolName: "ask_user" }),
+          executeClientControlCommand("invoke-tool", { toolName: "read_file" }),
         ).rejects.toThrow(
-          "Tool 'ask_user' is not enabled or registered on this client.",
+          "Tool 'read_file' is not enabled or registered on this client.",
         );
 
-        // 2. Conversation group has restricted toolTags
+        // 2. Tool is not enabled on this client
+        await expect(
+          executeClientControlCommand("invoke-tool", { toolName: "ask_user" }),
+        ).rejects.toThrow("Tool 'ask_user' is not enabled on this client.");
+
+        // 3. Conversation group has restricted toolTags
         const { orchestratorStore } =
           await import("../../stores/orchestrator.js");
         const groupsSpy = jest

package/src/security/custom-element-security.test.ts

@@ -465,6 +465,58 @@ describe("custom-element-security", () => {
         siteConfigScript.remove();
       }
     });
+
+    it("preserves id, name, global, and autoload in script descriptors and approves by id", () => {
+      const siteConfigScript = document.createElement("script");
+      siteConfigScript.id = "shadow-claw-site-config";
+      siteConfigScript.type = "application/json";
+      siteConfigScript.textContent = JSON.stringify({
+        customElements: {
+          allowedDomains: ["kherrick.github.io"],
+          scripts: [
+            {
+              id: "feed-scroller",
+              src: "/pages/main/assets/feed-scroller.js",
+              global: true,
+              hasInit: true,
+            },
+            {
+              name: "x-hook-component",
+              src: "/pages/main/assets/x-hook-component.js",
+              hasInit: true,
+            },
+          ],
+        },
+      });
+      document.head.appendChild(siteConfigScript);
+
+      try {
+        installCustomElementsRegistryGuard();
+
+        const descriptors = getApprovedCustomElementScriptDescriptors();
+        expect(descriptors).toEqual([
+          {
+            id: "feed-scroller",
+            src: "/pages/main/assets/feed-scroller.js",
+            global: true,
+            autoload: true,
+            hasInit: true,
+          },
+          {
+            name: "x-hook-component",
+            src: "/pages/main/assets/x-hook-component.js",
+            hasInit: true,
+          },
+        ]);
+
+        expect(isApprovedScript("feed-scroller")).toBe(true);
+        expect(isApprovedScript("x-hook-component")).toBe(true);
+        expect(isApprovedScript("unknown-id")).toBe(false);
+      } finally {
+        uninstallCustomElementsRegistryGuard();
+        siteConfigScript.remove();
+      }
+    });
   });
 
   describe("hasApprovedCustomElement", () => {
@@ -564,6 +616,19 @@ describe("custom-element-security", () => {
       ).toBe(true);
     });
 
+    it("approves script by stem or filename when config has no id", () => {
+      setApprovedCustomElementScripts([
+        "/pages/main/assets/x-hook-component.js",
+        { src: "/pages/main/assets/x-postpress-code.js" },
+      ]);
+
+      expect(isApprovedScript("x-hook-component")).toBe(true);
+      expect(isApprovedScript("x-hook-component.js")).toBe(true);
+      expect(isApprovedScript("x-postpress-code")).toBe(true);
+      expect(isApprovedScript("x-postpress-code.js")).toBe(true);
+      expect(isApprovedScript("missing-widget")).toBe(false);
+    });
+
     it("rejects unapproved script paths", () => {
       setApprovedCustomElementScripts([
         "/pages/main/assets/x-hook-component.js",

package/src/security/custom-element-security.ts

@@ -206,6 +206,13 @@ setEmbeddedConfigHook(configureCustomElementSecurity);
 
 export interface CustomElementScriptDescriptor {
   src: string;
+  id?: string;
+  name?: string;
+  global?: boolean;
+  autoload?: boolean;
+  type?: string;
+  async?: boolean;
+  defer?: boolean;
   hasInit: boolean;
 }
 
@@ -215,15 +222,50 @@ let activeApprovedScripts: CustomElementScriptDescriptor[] = [];
  * Set approved custom element scripts in memory.
  */
 export function setApprovedCustomElementScripts(
-  scripts: Array<string | { src: string; hasInit?: boolean }>,
+  scripts: Array<string | Partial<CustomElementScriptDescriptor> | any>,
 ): void {
   if (Array.isArray(scripts)) {
     activeApprovedScripts = scripts
       .map((s: any) => {
         const src = typeof s === "string" ? s : s?.src;
+        const id =
+          typeof s === "object" && s !== null && typeof s.id === "string"
+            ? s.id.trim()
+            : undefined;
+        const name =
+          typeof s === "object" && s !== null && typeof s.name === "string"
+            ? s.name.trim()
+            : undefined;
+        const global =
+          typeof s === "object" && s !== null
+            ? Boolean(s.global || s.autoload)
+            : false;
+        const type =
+          typeof s === "object" && s !== null && typeof s.type === "string"
+            ? s.type
+            : undefined;
+        const async =
+          typeof s === "object" && s !== null && typeof s.async === "boolean"
+            ? s.async
+            : undefined;
+        const defer =
+          typeof s === "object" && s !== null && typeof s.defer === "boolean"
+            ? s.defer
+            : undefined;
         const hasInit =
           typeof s === "object" && s !== null ? Boolean(s.hasInit) : false;
-        return { src, hasInit };
+
+        const descriptor: CustomElementScriptDescriptor = {
+          src,
+          ...(id ? { id } : {}),
+          ...(name ? { name } : {}),
+          ...(global ? { global: true, autoload: true } : {}),
+          ...(type ? { type } : {}),
+          ...(async ? { async } : {}),
+          ...(defer ? { defer } : {}),
+          hasInit,
+        };
+        return descriptor;
       })
       .filter(
         (entry): entry is CustomElementScriptDescriptor =>
@@ -292,11 +334,32 @@ export function isApprovedScript(src: string): boolean {
     return false;
   }
 
-  const approved = getApprovedCustomElementScripts();
-  if (approved.length === 0) {
+  const descriptors = getApprovedCustomElementScriptDescriptors();
+  if (descriptors.length === 0) {
     return false;
   }
 
+  const trimmedLower = trimmed.toLowerCase();
+  const matchByIdOrName = descriptors.some(
+    (d) =>
+      (d.id && d.id.toLowerCase() === trimmedLower) ||
+      (d.name && d.name.toLowerCase() === trimmedLower),
+  );
+  if (matchByIdOrName) {
+    return true;
+  }
+
+  const matchByStemOrFilename = descriptors.some((d) => {
+    const base = (d.src.split("/").pop() || "").toLowerCase();
+    const stem = base.replace(/\.(js|mjs|cjs|ts)$/i, "");
+    return base === trimmedLower || stem === trimmedLower;
+  });
+  if (matchByStemOrFilename) {
+    return true;
+  }
+
+  const approved = getApprovedCustomElementScripts();
+
   const clean = trimmed.split("?")[0].split("#")[0].trim();
   const stripPrefix = (s: string) =>
     s

package/src/stores/tools.test.ts

@@ -237,9 +237,11 @@ describe("ToolsStore — declarative tools management", () => {
     store = new ToolsStore();
   });
 
-  it("defaults to enabling all declarative tools when not explicitly configured", () => {
+  it("defaults to having declarative tools not enabled when not explicitly configured", () => {
     expect(store.declarativeToolNamesEnabled).toBeNull();
-    expect(store.isDeclarativeToolEnabled("generate_random_number")).toBe(true);
+    expect(store.isDeclarativeToolEnabled("generate_random_number")).toBe(
+      false,
+    );
   });
 
   it("toggles declarative tools and persists enabled state", async () => {
@@ -298,7 +300,7 @@ describe("ToolsStore — declarative tools management", () => {
     const refreshed = await store.refreshDeclarativeTools(db, "br:main");
     expect(refreshed).toHaveLength(1);
     expect(store.declarativeTools).toHaveLength(1);
-    expect(store.enabledDeclarativeTools).toHaveLength(1);
+    expect(store.enabledDeclarativeTools).toHaveLength(0);
   });
 
   describe("Remote Site Integration", () => {