swarmbox 0.12.0 → 0.14.0

package/dist/hooks.js

@@ -4,7 +4,9 @@
 //
 // They answer on the product's bare host only, never a tenant's (where testers' browsers are signed in), so
 // requests go to a loopback base such as http://127.0.0.1:<port>/_sandbox. A product build without them
-// answers 404 on /health; every call then says so instead of failing obscurely.
+// answers 404 on /health; every call then says so instead of failing obscurely. A product may serve only some
+// of them (the clock, say, and no feed): a hook it doesn't serve answers a plain 404, not the protocol's
+// {ok: false}, and is reported as missing, so the harness goes on without it.
 //
 //   GET  /health                       200 when the hooks are there
 //   GET  /clock, POST /clock           sandbox time; move it: {jumpMs} | {to} | {pause} | {play}
@@ -44,6 +46,8 @@ export function hooksFor(base, token, fetchImpl = fetch) {
         catch {
             // Not JSON: reported below with the status.
         }
+        if (res.status === 404 && json.ok !== false)
+            throw new HooksMissing(`this product serves no ${prefix}${path.split('?')[0]} hook`);
         if (!res.ok || json.ok === false)
             throw new HooksRefused(`${method} ${prefix}${path}: ${res.status}${json.error ? ` ${json.error.code ?? ''}: ${json.error.message ?? ''}` : ` ${text.slice(0, 200)}`}`);
         return (json.result ?? json);

package/dist/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,0GAA0G;AAC1G,6DAA6D;AAC7D,EAAE;AACF,4GAA4G;AAC5G,wGAAwG;AACxG,gFAAgF;AAChF,EAAE;AACF,oEAAoE;AACpE,iGAAiG;AACjG,0FAA0F;AAC1F,qGAAqG;AACrG,iEAAiE;AACjE,kGAAkG;AAClG,EAAE;AACF,0GAA0G;AAC1G,wGAAwG;AACxG,uGAAuG;AACvG,kFAAkF;AAElF,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAC1C,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAiD1C,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,YAA0B,KAAK;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACtC,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS;YAC1C,MAAM,IAAI,YAAY,CAAC,0CAA0C,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,GAA8E,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;YAC9B,MAAM,IAAI,YAAY,CACpB,GAAG,MAAM,IAAI,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAC/I,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,MAAM,IAAK,IAAgB,CAAM,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAwD,EAAE,EAAE;QACrE,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,SAAS;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAQ,CAAW,CAAC,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAa,KAAK,EAAE,QAAQ,CAAC;QAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAa,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QAC7D,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CACxB,IAAI,CACF,KAAK,EACL,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CACrG;QACH,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAChC,IAAI,CAAW,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACzE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAuB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK;QAChF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9C,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC;QACvD,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,0GAA0G;AAC1G,6DAA6D;AAC7D,EAAE;AACF,4GAA4G;AAC5G,wGAAwG;AACxG,8GAA8G;AAC9G,yGAAyG;AACzG,8EAA8E;AAC9E,EAAE;AACF,oEAAoE;AACpE,iGAAiG;AACjG,0FAA0F;AAC1F,qGAAqG;AACrG,iEAAiE;AACjE,kGAAkG;AAClG,EAAE;AACF,0GAA0G;AAC1G,wGAAwG;AACxG,uGAAuG;AACvG,kFAAkF;AAElF,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAC1C,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAiD1C,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,YAA0B,KAAK;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACtC,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS;YAC1C,MAAM,IAAI,YAAY,CAAC,0CAA0C,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,GAA8E,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;YACzC,MAAM,IAAI,YAAY,CAAC,0BAA0B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;YAC9B,MAAM,IAAI,YAAY,CACpB,GAAG,MAAM,IAAI,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAC/I,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,MAAM,IAAK,IAAgB,CAAM,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAwD,EAAE,EAAE;QACrE,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,SAAS;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAQ,CAAW,CAAC,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAa,KAAK,EAAE,QAAQ,CAAC;QAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAa,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QAC7D,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CACxB,IAAI,CACF,KAAK,EACL,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CACrG;QACH,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAChC,IAAI,CAAW,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACzE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAuB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK;QAChF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9C,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC;QACvD,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export type { FindingSink, Persona, Product, ProductWorld, SignIn, SinkFinding, SinkRun, StartCookie, ToolContext, WorldSpec, } from './product.ts';
+export { redactBody, redactUrl, type RequestLog, type RequestQuery, type RequestRecord } from './requests.ts';
 export { serve, DEFAULT_PORTS, type ServeOptions, type Served } from './serve.ts';
 export { createHarness, feedLine, globMatches, HarnessError, linkPath, type Action, type Controller, type Harness, type HarnessOptions, type NetworkMode, type OpenScreenOptions, type ScreenEntry, type Signal, type WorldEntry, } from './harness.ts';
 export { serveMcp, buildServer, guard, type McpHttp } from './mcp/server.ts';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,YAAY,EACV,WAAW,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,MAAM,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,QAAQ,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,OAAO,EACP,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,SAAS,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,KAAK,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,GAAG,GACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,OAAO,EACP,WAAW,EACX,IAAI,EACJ,MAAM,EACN,WAAW,EACX,SAAS,EACT,aAAa,EACb,SAAS,EACT,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,MAAM,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,UAAU,IAAI,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtG,OAAO,EACL,aAAa,EACb,KAAK,EACL,IAAI,EACJ,cAAc,EACd,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,YAAY,EACV,WAAW,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,MAAM,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9G,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,QAAQ,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,OAAO,EACP,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,SAAS,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,KAAK,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,GAAG,GACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,OAAO,EACP,WAAW,EACX,IAAI,EACJ,MAAM,EACN,WAAW,EACX,SAAS,EACT,aAAa,EACb,SAAS,EACT,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,MAAM,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,UAAU,IAAI,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtG,OAAO,EACL,aAAa,EACb,KAAK,EACL,IAAI,EACJ,cAAc,EACd,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 // Swarmbox: a sandbox where AI agents use your product the way people do, in real browsers against
 // throwaway worlds, and see what a person sees and what the server did. A product plugs in with one object
 // (Product, in product.ts); everything else here is the same for every product.
+export { redactBody, redactUrl } from "./requests.js";
 export { serve, DEFAULT_PORTS } from "./serve.js";
 export { createHarness, feedLine, globMatches, HarnessError, linkPath, } from "./harness.js";
 export { serveMcp, buildServer, guard } from "./mcp/server.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,2GAA2G;AAC3G,gFAAgF;AAchF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,GAUT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAgB,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,UAAU,GAMX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkD,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,OAAO,EACP,YAAY,GAMb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,GAOb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAA2C,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EACL,OAAO,EACP,WAAW,EACX,YAAY,GAMb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,OAAO,EACP,WAAW,EACX,IAAI,EACJ,MAAM,EACN,WAAW,EACX,SAAS,EACT,aAAa,EACb,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,GAEZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA8C,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAoD,MAAM,sBAAsB,CAAC;AACtG,OAAO,EACL,aAAa,EACb,KAAK,EACL,IAAI,EACJ,cAAc,GAKf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAuB,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,SAAS,EAA4C,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,2GAA2G;AAC3G,gFAAgF;AAchF,OAAO,EAAE,UAAU,EAAE,SAAS,EAA0D,MAAM,eAAe,CAAC;AAC9G,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,GAUT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAgB,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,UAAU,GAMX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkD,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,OAAO,EACP,YAAY,GAMb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,GAOb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAA2C,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EACL,OAAO,EACP,WAAW,EACX,YAAY,GAMb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,OAAO,EACP,WAAW,EACX,IAAI,EACJ,MAAM,EACN,WAAW,EACX,SAAS,EACT,aAAa,EACb,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,GAEZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA8C,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAoD,MAAM,sBAAsB,CAAC;AACtG,OAAO,EACL,aAAa,EACb,KAAK,EACL,IAAI,EACJ,cAAc,GAKf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAuB,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,SAAS,EAA4C,MAAM,mBAAmB,CAAC"}

package/dist/mcp/authenticator.d.ts

@@ -0,0 +1,17 @@
+export type Algorithm = 'SHA1' | 'SHA256' | 'SHA512';
+export interface TotpKey {
+    secret: Buffer;
+    digits: number;
+    period: number;
+    algorithm: Algorithm;
+}
+/** RFC 4648 base32, as a setup screen shows it: any case, spaces and dashes between groups, padding optional. */
+export declare function base32Decode(text: string): Buffer;
+/** A key as typed into the app: the base32 secret alone, or the otpauth:// link a QR code holds. */
+export declare function parseKey(input: string): TotpKey;
+/** The code at an instant (ms), and how many seconds it has left. */
+export declare function totp(key: TotpKey, atMs: number): {
+    code: string;
+    secondsLeft: number;
+};
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/mcp/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/mcp/authenticator.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,CAAC;CACtB;AAID,iHAAiH;AACjH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBjD;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiB/C;AAED,qEAAqE;AACrE,wBAAgB,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAWtF"}

package/dist/mcp/authenticator.js

@@ -0,0 +1,63 @@
+// The authenticator app on a person's phone: a TOTP code (RFC 6238) from the key a product's two-step setup
+// shows, at the world's own time, since that's the clock the product checks it against. Without it an agent
+// can't turn two-step sign-in on, or play anything a product puts behind it.
+import { createHmac } from 'node:crypto';
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/** RFC 4648 base32, as a setup screen shows it: any case, spaces and dashes between groups, padding optional. */
+export function base32Decode(text) {
+    const clean = text
+        .replace(/[\s-]+/g, '')
+        .replace(/=+$/, '')
+        .toUpperCase();
+    if (!clean || /[^A-Z2-7]/.test(clean))
+        throw new Error('the key isn’t base32 (letters A–Z and digits 2–7)');
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const c of clean) {
+        value = (value << 5) | BASE32.indexOf(c);
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+/** A key as typed into the app: the base32 secret alone, or the otpauth:// link a QR code holds. */
+export function parseKey(input) {
+    const given = input.trim();
+    if (!given.toLowerCase().startsWith('otpauth://'))
+        return { secret: base32Decode(given), digits: 6, period: 30, algorithm: 'SHA1' };
+    const url = new URL(given);
+    if (url.host.toLowerCase() !== 'totp')
+        throw new Error(`an otpauth link for ${url.host}, not totp`);
+    const q = url.searchParams;
+    const secret = q.get('secret');
+    if (!secret)
+        throw new Error('the otpauth link has no secret');
+    const digits = Number(q.get('digits') ?? 6);
+    const period = Number(q.get('period') ?? 30);
+    const algorithm = (q.get('algorithm') ?? 'SHA1').toUpperCase();
+    if (![6, 7, 8].includes(digits))
+        throw new Error(`digits ${digits}: an app shows 6, 7 or 8`);
+    if (!Number.isInteger(period) || period < 1)
+        throw new Error(`period ${q.get('period')}: whole seconds`);
+    if (algorithm !== 'SHA1' && algorithm !== 'SHA256' && algorithm !== 'SHA512')
+        throw new Error(`algorithm ${algorithm}: SHA1, SHA256 or SHA512`);
+    return { secret: base32Decode(secret), digits, period, algorithm };
+}
+/** The code at an instant (ms), and how many seconds it has left. */
+export function totp(key, atMs) {
+    const step = Math.floor(atMs / 1000 / key.period);
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(step));
+    const mac = createHmac(key.algorithm.toLowerCase(), key.secret).update(counter).digest();
+    const at = mac[mac.length - 1] & 0x0f;
+    const n = mac.readUInt32BE(at) & 0x7fffffff;
+    return {
+        code: String(n % 10 ** key.digits).padStart(key.digits, '0'),
+        secondsLeft: key.period - (Math.floor(atMs / 1000) % key.period),
+    };
+}
+//# sourceMappingURL=authenticator.js.map

package/dist/mcp/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/mcp/authenticator.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,4GAA4G;AAC5G,6EAA6E;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC5G,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC;IACpG,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,0BAA0B,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzG,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ;QAC1E,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,0BAA0B,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,IAAI,CAAC,GAAY,EAAE,IAAY;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QAC5D,WAAW,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/mcp/inbox.d.ts

@@ -0,0 +1,16 @@
+import type { FeedPage, Hooks } from '../hooks.ts';
+/** One cursor for the two mailboxes, as `next`: each one's own, kept apart. */
+export declare function joinCursor(own: string, platform: string): string;
+/** The two cursors a joined one holds. A product's own cursor (from before the merge) is the tenant's. */
+export declare function splitCursor(after: string | undefined): {
+    own?: string;
+    platform?: string;
+};
+/**
+ * The tenant's messages to `to`, and the platform mailbox's when the product has one, in time order. A platform
+ * mailbox the product refuses to read leaves the tenant's messages, with a note saying why.
+ */
+export declare function readInbox(hooks: Pick<Hooks, 'messages'>, tenant: string, to: string, after: string | undefined, platformMailbox: string | undefined): Promise<FeedPage & {
+    note?: string;
+}>;
+//# sourceMappingURL=inbox.d.ts.map

package/dist/mcp/inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.d.ts","sourceRoot":"","sources":["../../src/mcp/inbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAY,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAI7D,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY1F;AAWD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAC9B,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,QAAQ,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBvC"}

package/dist/mcp/inbox.js

@@ -0,0 +1,55 @@
+// One person's inbox, as phone_inbox gives it: the tenant's own messages to them, and the ones the product
+// sends as itself (sign-in codes, invites, sign-up confirmations), which a product files under its platform
+// mailbox, not under any tenant. Read apart, a tester looking in the company's mailbox finds no code and
+// says it never came, though it was sent.
+const BOTH = 'both:';
+/** One cursor for the two mailboxes, as `next`: each one's own, kept apart. */
+export function joinCursor(own, platform) {
+    return BOTH + Buffer.from(JSON.stringify([own, platform])).toString('base64url');
+}
+/** The two cursors a joined one holds. A product's own cursor (from before the merge) is the tenant's. */
+export function splitCursor(after) {
+    if (!after)
+        return {};
+    if (!after.startsWith(BOTH))
+        return { own: after };
+    try {
+        const [own, platform] = JSON.parse(Buffer.from(after.slice(BOTH.length), 'base64url').toString());
+        return { ...(own ? { own } : {}), ...(platform ? { platform } : {}) };
+    }
+    catch {
+        return { own: after };
+    }
+}
+/** A platform message, marked so the agent reads who sent it. */
+const asPlatform = ({ cursor, kind, at, ...rest }) => ({
+    cursor,
+    kind,
+    at,
+    sentAs: 'the platform',
+    ...rest,
+});
+/**
+ * The tenant's messages to `to`, and the platform mailbox's when the product has one, in time order. A platform
+ * mailbox the product refuses to read leaves the tenant's messages, with a note saying why.
+ */
+export async function readInbox(hooks, tenant, to, after, platformMailbox) {
+    const at = splitCursor(after);
+    const own = await hooks.messages(tenant, to, at.own ? { after: at.own } : {});
+    if (!platformMailbox || platformMailbox === tenant)
+        return own;
+    let platform;
+    try {
+        platform = await hooks.messages(platformMailbox, to, at.platform ? { after: at.platform } : {});
+    }
+    catch (e) {
+        return { ...own, note: `the platform mailbox (${platformMailbox}) wasn’t read: ${e.message}` };
+    }
+    const items = [...own.items, ...platform.items.map(asPlatform)].sort((a, b) => Date.parse(a.at) - Date.parse(b.at));
+    return {
+        items,
+        next: joinCursor(own.next, platform.next),
+        lagMs: Math.max(own.lagMs, platform.lagMs),
+    };
+}
+//# sourceMappingURL=inbox.js.map

package/dist/mcp/inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.js","sourceRoot":"","sources":["../../src/mcp/inbox.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,4GAA4G;AAC5G,yGAAyG;AACzG,0CAA0C;AAI1C,MAAM,IAAI,GAAG,OAAO,CAAC;AAErB,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAAgB;IACtD,OAAO,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAG/F,CAAC;QACF,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAY,EAAY,EAAE,CAAC,CAAC;IACzE,MAAM;IACN,IAAI;IACJ,EAAE;IACF,MAAM,EAAE,cAAc;IACtB,GAAG,IAAI;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAA8B,EAC9B,MAAc,EACd,EAAU,EACV,KAAyB,EACzB,eAAmC;IAEnC,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAC/D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,yBAAyB,eAAe,kBAAmB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5G,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;IACF,OAAO;QACL,KAAK;QACL,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAOzE,OAAO,EAA6B,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAKvD,2FAA2F;AAC3F,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAatF;AAmBD,wBAAgB,WAAW,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,IAAoB,GAAG,SAAS,CAkyBxG;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,0FAA0F;AAC1F,wBAAsB,QAAQ,CAAC,CAAC,SAAS,YAAY,EACnD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,IAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CAuDlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAWzE,OAAO,EAA6C,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAExF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAKvD,2FAA2F;AAC3F,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAatF;AAsBD,wBAAgB,WAAW,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,IAAoB,GAAG,SAAS,CAo4BxG;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,0FAA0F;AAC1F,wBAAsB,QAAQ,CAAC,CAAC,SAAS,YAAY,EACnD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,IAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CAuDlB"}

package/dist/mcp/server.js

@@ -13,9 +13,13 @@ import { z } from 'zod';
 import { failing, formatReport } from "../checks.js";
 import { DEVICES } from "../fleet/browser.js";
 import { registerDeviceTools } from "./device.js";
+import { parseKey, totp } from "./authenticator.js";
+import { readInbox } from "./inbox.js";
 import { registerStandInTools } from "./standins.js";
 import { describeProvenance } from "../provenance.js";
-import { HarnessError } from "../harness.js";
+import { REQUESTS_KEPT, requestLine } from "../requests.js";
+import { wallClock } from "../time.js";
+import { HarnessError, refreshTenants } from "../harness.js";
 import { StandInError } from "../standins/runner.js";
 import { createRuns } from "../runs/run.js";
 import { listScenarios, loadScenario, saveScenario, Scenario } from "../scenarios/spec.js";
@@ -44,6 +48,9 @@ function describeWorld(h, id) {
         ...(w.world.notes?.() ?? []).map((n) => `  ${n}`),
         ...w.world.tenants.map((t) => `  ${t}: ${w.world.origin(t)}`),
         `  screens: ${open.map((s) => `${s.id} ${s.persona.label} [${s.controller}]`).join('; ') || 'none'}`,
+        w.contained
+            ? '  browsers: contained (only the world, its stand-ins and browserAllow)'
+            : '  browsers: not contained (Product.contain is off): its pages can reach anything this machine can',
         ...(w.standins.size
             ? [
                 `  stand-ins: ${[...w.standins.values()].map((s) => `${s.manifest.name} (${s.manifest.provider}) at ${s.origin}`).join('; ')}`,
@@ -58,8 +65,8 @@ export function buildServer(h, runs = createRuns(h)) {
     server.registerTool('world_create', {
         title: 'Create a world',
         description: `Start a world: a running copy of ${product.name} with its own data and the ${noun}s given (default ` +
-            'one), started the way it is deployed. Outside services are fakes; nothing leaves this machine. Seed ' +
-            'adds demo data and takes longer.',
+            'one), started the way it is deployed, with stand-ins for the outside services the product names. ' +
+            'world_list says whether its browsers are contained. Seed adds demo data and takes longer.',
         inputSchema: {
             tenants: z
                 .array(z.string().regex(/^[a-z][a-z0-9-]{1,38}[a-z0-9]$/))
@@ -124,10 +131,14 @@ export function buildServer(h, runs = createRuns(h)) {
         title: 'List worlds',
         description: `The worlds running now, their ${noun}s' addresses and open screens.`,
         annotations: { readOnlyHint: true },
-    }, async () => guard(async () => text(h
-        .worlds()
-        .map((w) => describeWorld(h, w.id))
-        .join('\n\n') || 'no worlds running')));
+    }, async () => guard(async () => {
+        // A tenant made during a run (the product's own sign-up) is listed with the rest.
+        await Promise.all(h.worlds().map((w) => refreshTenants(w)));
+        return text(h
+            .worlds()
+            .map((w) => describeWorld(h, w.id))
+            .join('\n\n') || 'no worlds running');
+    }));
     const hooksOf = (world) => h.hooks(world);
     const feedText = (p) => [
         `${p.items.length} items; next ${p.next}; lag ${p.lagMs} ms`,
@@ -139,6 +150,10 @@ export function buildServer(h, runs = createRuns(h)) {
     server.registerTool('world_clock', {
         title: 'A world’s clock',
         description: 'Read the world’s sandbox time, or move it: jumpMs forward, to an instant, pause or play. Forward only. ' +
+            'It also gives the wall clock in each zone the world’s people are in, with its offset: check a screen’s times ' +
+            'against that. ' +
+            'Moving the clock doesn’t make the product’s work go faster: a long job (an import, a sync) still takes real ' +
+            'time, so wait for it on the screen rather than jumping past it. ' +
             'The product follows it, and so does every open screen’s browser, since "today" is decided there. Needs ' +
             'the product’s hooks.',
         inputSchema: {
@@ -163,8 +178,12 @@ export function buildServer(h, runs = createRuns(h)) {
                         : undefined;
         const st = await h.moveClock(world, move);
         const screensFollowing = h.screens().filter((x) => x.worldId === world && x.clockInstalled).length;
+        // Each zone its people are in, as their screens should show it.
+        const zones = [...new Set((await h.people(world)).map((p) => p.timeZone))];
+        const at = new Date(st.process.at);
         return text(`${world}: sandbox time ${st.process.at}${st.clock.frozenAt ? ' (paused)' : ''}; offset ${Math.round(st.clock.offsetMs / 1000)} s` +
-            (move ? `; ${screensFollowing} screens follow it` : ''));
+            (move ? `; ${screensFollowing} screens follow it` : '') +
+            zones.map((z) => `\n  in ${z}: ${wallClock(at, z)}`).join(''));
     }));
     server.registerTool('feed_read', {
         title: `What happened in a ${noun}`,
@@ -189,17 +208,48 @@ export function buildServer(h, runs = createRuns(h)) {
     server.registerTool('phone_inbox', {
         title: 'A phone’s or inbox’s messages',
         description: `Every text and email between the ${noun} and one number or address, as the fakes delivered them: ` +
-            'the phone a customer holds. Needs the product’s hooks.',
+            'the phone a customer holds. ' +
+            (product.platformMailbox
+                ? `With them, what ${product.name} sent that person as itself, not as a ${noun} (sign-in codes, invites, ` +
+                    'sign-up confirmations), marked sentAs "the platform". '
+                : '') +
+            'Needs the product’s hooks.',
         inputSchema: {
             world: z.string(),
-            tenant: z.string(),
+            tenant: z.string().optional().describe(`Which ${noun}; default the world’s first`),
             to: z.string().min(3).describe('Whose: a phone number (+1555…) or an email address'),
-            after: z.string().optional(),
+            after: z.string().optional().describe('The `next` of an earlier read: only what came since'),
         },
         annotations: { readOnlyHint: true },
     }, async ({ world, tenant, to, after }) => guard(async () => {
         const hooks = await hooksOf(world);
-        return text(feedText((await hooks.messages(tenant, to, after ? { after } : {}))));
+        const t = tenant ?? h.world(world).world.tenants[0];
+        const page = await readInbox(hooks, t, to, after, product.platformMailbox);
+        return text([feedText(page), ...(page.note ? [page.note] : [])].join('\n'));
+    }));
+    server.registerTool('phone_authenticator', {
+        title: 'The authenticator app on a person’s phone',
+        description: 'The code an authenticator app shows for a key, at the world’s time (the clock the product checks it ' +
+            'against): give the key a two-step setup screen shows (the letters and digits under the QR code, spaces ' +
+            'and all) or its otpauth:// link. Read the key off the screen; a key is the person’s, so don’t put it in a ' +
+            'finding. Needs the product’s hooks.',
+        inputSchema: {
+            world: z.string(),
+            key: z.string().min(16).describe('The setup key, or an otpauth://totp/ link'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ world, key }) => guard(async () => {
+        let parsed;
+        try {
+            parsed = parseKey(key);
+        }
+        catch (e) {
+            throw new HarnessError(e.message);
+        }
+        const at = Date.parse((await h.moveClock(world)).process.at);
+        const now = totp(parsed, at);
+        const next = totp(parsed, at + now.secondsLeft * 1000);
+        return text(`${now.code} (for ${now.secondsLeft} s more; then ${next.code})`);
     }));
     server.registerTool('fake_rule', {
         title: 'Make a provider misbehave',
@@ -337,11 +387,12 @@ export function buildServer(h, runs = createRuns(h)) {
         description: 'Do one thing on a screen: click {role, name}, fill {label, text}, select {label, option}, press {key}, ' +
             'draw {label} (pointer strokes, e.g. a signature pad; strokes default to a signature), drag {role, name} ' +
             'onto another element (to {role, name, at}) or by a distance (by {x, y} CSS px), held at grab (fractions ' +
-            'of its box: an edge to resize; default its middle), or goto {path} (a ' +
+            'of its box: an edge to resize; default its middle; a drop off the screen is scrolled to on the way), ' +
+            'scroll {role, name} into view, or by {x, y} / to top|bottom over that panel (or the page), or goto {path} (a ' +
             `path, or a full link on the ${noun}’s host as a text gives it). Elements are found by accessible role and ` +
             'name, as in screen_read; of several, the one in the open dialog is taken, else each is described for index. ' +
-            'Something behind a modal dialog is refused with the dialog’s name. Returns what it did, what changed ' +
-            '(dialogs, status lines, the address), what the server did (yours, with what it set off, and any failure ' +
+            'Something behind a modal dialog is refused with the dialog’s name. Waits for the requests it started (up ' +
+            'to 15 s). Returns what it did, what changed (dialogs, status lines, headings, the address), what the server did (yours, with what it set off, and any failure ' +
             `in the ${noun} since the last action), requests refused, then the screen as it is. Refused while a ` +
             'person has the screen.',
         inputSchema: {
@@ -396,6 +447,21 @@ export function buildServer(h, runs = createRuns(h)) {
                         .optional()
                         .describe('Or move it this far, in CSS pixels (screen_image is in them)'),
                 }),
+                z.object({
+                    kind: z.literal('scroll'),
+                    role: z.string().optional(),
+                    name: z.string().optional(),
+                    exact: z.boolean().optional(),
+                    index: z.int().optional(),
+                    by: z
+                        .object({ x: z.number().min(-20000).max(20000), y: z.number().min(-20000).max(20000) })
+                        .optional()
+                        .describe('Turn the wheel this far, in CSS pixels, over the element given (a panel) or the page'),
+                    to: z
+                        .enum(['top', 'bottom'])
+                        .optional()
+                        .describe('Or to its top or bottom. With neither, the element given is brought into view; with no element either, the page goes to its bottom'),
+                }),
                 z.object({ kind: z.literal('press'), key: z.string() }),
                 z.object({ kind: z.literal('goto'), path: z.string() }),
                 z.object({
@@ -439,6 +505,28 @@ export function buildServer(h, runs = createRuns(h)) {
                 : { mode });
         return text(`${screen}: network ${mode}${match ? ` for ${match}` : ''}`);
     }));
+    server.registerTool('screen_requests', {
+        title: 'Read a screen’s requests',
+        description: 'What a screen asked its servers for, newest last: method, address, status and time, and with bodies the ' +
+            'start of what was sent and what came back. A request still open (a live stream, a long poll) says so. ' +
+            'The readout’s "refused:" lines give each one’s #number. Pages’ scripts, styles, images and fonts are left ' +
+            'out unless all is set. Headers are never kept, and secrets in addresses and bodies are redacted.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            screen: z.string(),
+            match: z.string().min(1).optional().describe('Only addresses containing this, e.g. "/api/live"'),
+            after: z.int().min(0).optional().describe('Only requests after this #number'),
+            bodies: z.boolean().optional().describe('Show what was sent and what came back; default no'),
+            all: z.boolean().optional().describe('Include the page’s own scripts, styles, images and fonts'),
+            limit: z.int().min(1).max(REQUESTS_KEPT).optional().describe('The most recent this many; default 40'),
+        },
+    }, async ({ screen, bodies, ...q }) => guard(async () => {
+        const got = h.requests(screen, q);
+        const now = Date.now();
+        return text(got.length
+            ? got.map((r) => requestLine(r, now, bodies ?? false)).join('\n')
+            : `${screen}: no requests${q.match ? ` matching "${q.match}"` : ''}${q.after !== undefined ? ` after #${q.after}` : ''}`);
+    }));
     server.registerTool('scenario_list', {
         title: 'List scenarios',
         description: 'The written scenarios a run can play: what each tests.',