yunti-browser-runtime 0.1.2 → 0.2.0

package/mcp/bridge-hub.js

@@ -5,6 +5,7 @@ import {
   normalizeCdpEvent,
   sanitizeNetworkEvent,
   sanitizeUrl,
+  redactLikelySensitiveText,
   truncateText,
 } from "./redaction.js"
 import { toolUsageHints } from "./tools.js"
@@ -13,6 +14,7 @@ export const DEFAULT_TOOL_TIMEOUT_MS = 30_000
 const MAX_NETWORK_EVENTS = 1000
 const MAX_CDP_EVENTS = 2000
 const MAX_CONSOLE_MESSAGES = 1000
+const MAX_ACTIVITY_EVENTS = 100
 const MAX_MEMORY_ITEMS = 500
 export const DEFAULT_SESSION_TTL_MS = Number(
   process.env.YUNTI_BROWSER_SESSION_TTL_MS || 90_000
@@ -41,6 +43,47 @@ function stripBrowserSessionId(args) {
   return next
 }
 
+function summarizeObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { type: typeof value }
+  }
+  const summary = {
+    type: "object",
+    keys: Object.keys(value).slice(0, 12),
+  }
+  if (typeof value.ok === "boolean") summary.ok = value.ok
+  if (typeof value.code === "string") summary.code = redactLikelySensitiveText(value.code, 120)
+  if (typeof value.action === "string") summary.action = redactLikelySensitiveText(value.action, 120)
+  if (typeof value.nextStepHint === "string") {
+    summary.nextStepHint = redactLikelySensitiveText(value.nextStepHint, 240)
+  }
+  return summary
+}
+
+function summarizeSession(session, activeSessionId) {
+  const meta = session.meta || {}
+  const client = meta.client && typeof meta.client === "object" ? meta.client : {}
+  return {
+    browserSessionId: session.browserSessionId,
+    active: session.browserSessionId === activeSessionId,
+    userId: redactLikelySensitiveText(meta.userId || "", 120),
+    userName: redactLikelySensitiveText(meta.userName || "", 120),
+    displayName: redactLikelySensitiveText(meta.displayName || "", 160),
+    title: redactLikelySensitiveText(meta.title || "", 240),
+    url: meta.url ? sanitizeUrl(meta.url) : "",
+    tabId: meta.tabId ?? null,
+    windowId: meta.windowId ?? null,
+    clientFamily: redactLikelySensitiveText(client.family || "", 80),
+    extensionVersion: redactLikelySensitiveText(client.extensionVersion || meta.extensionVersion || "", 80),
+    queuedRequests: session.queue.length,
+    pollers: session.pollers.length,
+    updatedAt: meta.updatedAt || "",
+    lastSeenAt: meta.lastSeenAt || "",
+    expiresAt: meta.expiresAt || "",
+    staleReason: redactLikelySensitiveText(meta.staleReason || session.staleReason || "", 240),
+  }
+}
+
 export function normalizeRouteUserId(value) {
   const userId = String(value || "").trim()
   return userId && userId !== "anonymous" ? userId : ""
@@ -60,14 +103,34 @@ export class BridgeHub {
     this.networkEvents = []
     this.cdpEvents = []
     this.consoleMessages = []
+    this.activityEvents = []
     this.nextNetworkEventId = 1
     this.nextCdpEventId = 1
     this.nextConsoleMsgId = 1
+    this.nextActivityEventId = 1
     this.activeSessionId = null
     this.activeSessionByUser = new Map()
     this.sessionTtlMs = Math.max(5_000, Number(sessionTtlMs) || DEFAULT_SESSION_TTL_MS)
   }
 
+  recordActivity(input = {}) {
+    const event = {
+      id: this.nextActivityEventId++,
+      timestamp: new Date().toISOString(),
+      type: redactLikelySensitiveText(input.type || "event", 80),
+      tool: input.tool ? redactLikelySensitiveText(input.tool, 120) : "",
+      browserSessionId: input.browserSessionId ? redactLikelySensitiveText(input.browserSessionId, 160) : "",
+      status: input.status ? redactLikelySensitiveText(input.status, 80) : "",
+      message: input.message ? redactLikelySensitiveText(input.message, 300) : "",
+      summary: input.summary && typeof input.summary === "object" ? input.summary : undefined,
+    }
+    this.activityEvents.push(event)
+    if (this.activityEvents.length > MAX_ACTIVITY_EVENTS) {
+      this.activityEvents.splice(0, this.activityEvents.length - MAX_ACTIVITY_EVENTS)
+    }
+    return event
+  }
+
   sessionExpiresAt(now = Date.now()) {
     return now + this.sessionTtlMs
   }
@@ -105,6 +168,12 @@ export class BridgeHub {
     for (const poller of session.pollers.splice(0)) {
       poller({ type: "noop", id: randomUUID(), stale: true, reason })
     }
+    this.recordActivity({
+      type: "stale-session",
+      browserSessionId,
+      status: "stale",
+      message: reason,
+    })
     return session.meta
   }
 
@@ -328,6 +397,13 @@ export class BridgeHub {
     const promise = new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pendingRequests.delete(requestId)
+        this.recordActivity({
+          type: "tool-result",
+          tool,
+          browserSessionId,
+          status: "timeout",
+          message: `Timed out waiting for browser tool result: ${tool}`,
+        })
         reject(new Error(`Timed out waiting for browser tool result: ${tool}`))
       }, timeoutMs)
       this.pendingRequests.set(requestId, { resolve, reject, timer, browserSessionId, tool })
@@ -339,6 +415,12 @@ export class BridgeHub {
     } else {
       session.queue.push(payload)
     }
+    this.recordActivity({
+      type: "tool-request",
+      tool,
+      browserSessionId,
+      status: poller ? "sent" : "queued",
+    })
     return promise
   }
 
@@ -460,13 +542,13 @@ export class BridgeHub {
       browserSessionId: truncateText(input.browserSessionId || "", 160),
       tabId: Number.isFinite(Number(input.tabId)) ? Number(input.tabId) : null,
       level: ["error", "warning", "info", "debug", "log", "verbose"].includes(input.level) ? input.level : "log",
-      text: truncateText(String(input.text || ""), 2000),
+      text: redactLikelySensitiveText(input.text || "", 2000),
       source: ["console-api", "javascript", "network", "other"].includes(input.source) ? input.source : "other",
       url: input.url ? sanitizeUrl(input.url) : "",
       lineNumber: Number.isFinite(Number(input.lineNumber)) ? Number(input.lineNumber) : null,
       columnNumber: Number.isFinite(Number(input.columnNumber)) ? Number(input.columnNumber) : null,
-      stackTrace: input.stackTrace ? truncateText(String(input.stackTrace), 4000) : "",
-      args: Array.isArray(input.args) ? input.args.slice(0, 20).map(a => truncateText(String(a), 500)) : [],
+      stackTrace: input.stackTrace ? redactLikelySensitiveText(input.stackTrace, 4000) : "",
+      args: Array.isArray(input.args) ? input.args.slice(0, 20).map(a => redactLikelySensitiveText(a, 500)) : [],
       timestamp: input.timestamp || new Date().toISOString(),
     }
     if (!event.browserSessionId) return { accepted: false, error: "browserSessionId is required" }
@@ -595,10 +677,182 @@ export class BridgeHub {
     clearTimeout(pending.timer)
     this.pendingRequests.delete(requestId)
     if (ok) {
+      this.recordActivity({
+        type: "tool-result",
+        tool: pending.tool,
+        browserSessionId: pending.browserSessionId,
+        status: "ok",
+        summary: summarizeObject(result),
+      })
       pending.resolve(result ?? null)
     } else {
+      this.recordActivity({
+        type: "tool-result",
+        tool: pending.tool,
+        browserSessionId: pending.browserSessionId,
+        status: "error",
+        message: error || "Browser tool failed",
+      })
       pending.reject(new Error(error || "Browser tool failed"))
     }
     return { accepted: true }
   }
+
+  cancelPendingRequests(args = {}) {
+    this.cleanupExpiredSessions()
+    const userId = normalizeRouteUserId(args.userId)
+    const explicitSessionId = String(args.browserSessionId || "").trim()
+    const browserSessionIds = explicitSessionId
+      ? new Set([explicitSessionId])
+      : userId
+        ? this.sessionIdsForUser(userId)
+        : new Set([...this.sessions.keys()])
+    const reason = redactLikelySensitiveText(
+      args.reason || "cancelled from local runtime console",
+      240
+    )
+    let queuedCancelled = 0
+    const queuedRequestIds = new Set()
+    for (const session of this.sessions.values()) {
+      if (!browserSessionIds.has(session.browserSessionId)) continue
+      queuedCancelled += session.queue.length
+      for (const item of session.queue) {
+        queuedRequestIds.add(item.id)
+        const pending = this.pendingRequests.get(item.id)
+        if (pending) {
+          clearTimeout(pending.timer)
+          this.pendingRequests.delete(item.id)
+          pending.reject(new Error(reason))
+        }
+        this.recordActivity({
+          type: "tool-result",
+          tool: item.tool,
+          browserSessionId: session.browserSessionId,
+          status: "cancelled",
+          message: reason,
+        })
+      }
+      session.queue = []
+    }
+    let pendingCancelled = 0
+    for (const [requestId, pending] of [...this.pendingRequests.entries()]) {
+      if (queuedRequestIds.has(requestId)) continue
+      if (!browserSessionIds.has(pending.browserSessionId)) continue
+      clearTimeout(pending.timer)
+      this.pendingRequests.delete(requestId)
+      pending.reject(new Error(reason))
+      pendingCancelled += 1
+      this.recordActivity({
+        type: "tool-result",
+        tool: pending.tool,
+        browserSessionId: pending.browserSessionId,
+        status: "cancelled",
+        message: reason,
+      })
+    }
+    return {
+      ok: true,
+      pendingCancelled,
+      queuedCancelled,
+      note: "Only runtime pending or queued requests are cancelled; already completed browser-side effects cannot be undone.",
+    }
+  }
+
+  consoleState(args = {}) {
+    this.cleanupExpiredSessions()
+    const userId = normalizeRouteUserId(args.userId)
+    const sessions = [...this.sessions.values()]
+      .filter((session) => !userId || normalizeRouteUserId(session.meta?.userId) === userId)
+      .map((session) => summarizeSession(session, this.activeSessionId))
+    const browserSessionIds = new Set(sessions.map((session) => session.browserSessionId))
+    const pendingRequests = [...this.pendingRequests.entries()]
+      .filter(([, pending]) => browserSessionIds.has(pending.browserSessionId))
+      .map(([requestId, pending]) => ({
+        requestId,
+        browserSessionId: pending.browserSessionId,
+        tool: pending.tool,
+      }))
+    const queuedRequests = [...this.sessions.values()]
+      .filter((session) => browserSessionIds.has(session.browserSessionId))
+      .flatMap((session) =>
+        session.queue.map((item) => ({
+          requestId: item.id,
+          browserSessionId: session.browserSessionId,
+          tool: item.tool,
+          createdAt: item.createdAt || "",
+        }))
+      )
+    return {
+      ok: true,
+      name: "yunti-browser-runtime-console",
+      generatedAt: new Date().toISOString(),
+      runtime: {
+        version: redactLikelySensitiveText(args.runtimeVersion || "", 80),
+        expectedExtensionVersion: redactLikelySensitiveText(args.expectedExtensionVersion || "", 80),
+      },
+      sessionCount: sessions.length,
+      activeSessionId: userId ? this.activeSessionByUser.get(userId) || null : this.activeSessionId,
+      sessions,
+      pendingRequests,
+      queuedRequests,
+      diagnostics: {
+        networkEvents: this.networkEvents.filter((event) => browserSessionIds.has(event.browserSessionId)).length,
+        consoleMessages: this.consoleMessages.filter((event) => browserSessionIds.has(event.browserSessionId)).length,
+        cdpEvents: this.cdpEvents.filter((event) => browserSessionIds.has(event.browserSessionId)).length,
+        activityEvents: this.activityEvents.length,
+      },
+      recentActivity: this.activityEvents
+        .filter((event) => !event.browserSessionId || browserSessionIds.has(event.browserSessionId))
+        .slice(-30)
+        .reverse(),
+      warnings: consoleWarnings(sessions, {
+        expectedExtensionVersion: args.expectedExtensionVersion,
+      }),
+      guidance: {
+        noSessions:
+          "Keep this bridge running, load or reload the extension, open an http/https page, refresh that page, then run yunti-browser-runtime doctor.",
+        staleSession:
+          "Refresh the page or reload the extension, then call yunti_list_browser_targets before retrying browser tools.",
+        versionMismatch:
+          "Reload the unpacked extension from the current package directory, then refresh open http/https pages.",
+        cancellation:
+          "Cancel only clears runtime pending/queued requests; it does not undo browser-side effects that already happened.",
+      },
+    }
+  }
+}
+
+function consoleWarnings(sessions, { expectedExtensionVersion = "" } = {}) {
+  const warnings = []
+  if (sessions.length === 0) {
+    warnings.push({
+      code: "NO_CONNECTED_PAGES",
+      severity: "warning",
+      message:
+        "No browser pages are connected. Load or reload the extension, open an http/https page, and refresh the page.",
+    })
+    return warnings
+  }
+  const expected = String(expectedExtensionVersion || "").trim()
+  if (!expected) return warnings
+  const versions = new Set(sessions.map((session) => session.extensionVersion).filter(Boolean))
+  if (versions.size === 0) {
+    warnings.push({
+      code: "EXTENSION_VERSION_UNKNOWN",
+      severity: "info",
+      message:
+        "Connected extension did not report a version. Reload the extension if you recently upgraded the runtime.",
+    })
+    return warnings
+  }
+  for (const version of versions) {
+    if (version !== expected) {
+      warnings.push({
+        code: "EXTENSION_VERSION_MISMATCH",
+        severity: "warning",
+        message: `Connected extension version ${version} does not match runtime package version ${expected}. Reload the unpacked extension from the current package directory.`,
+      })
+    }
+  }
+  return warnings
 }

package/mcp/http-server.js

@@ -1,4 +1,7 @@
 import http from "node:http"
+import { readFileSync } from "node:fs"
+import { dirname, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
 import {
   BridgeHub,
   DEFAULT_SESSION_TTL_MS,
@@ -22,6 +25,9 @@ const RELAY_TOKEN = process.env.YUNTI_BROWSER_RELAY_TOKEN || ""
 const SERVER_NAME = process.env.YUNTI_BROWSER_SERVER_NAME || "Yunti Browser Runtime"
 const _ROUTE_USER_ID = process.env.YUNTI_BROWSER_USER_ID || "local"
 const _ROUTE_USER_NAME = process.env.YUNTI_BROWSER_USER_NAME || "local"
+const PACKAGE_VERSION = readJsonFile(resolve(dirname(fileURLToPath(import.meta.url)), "..", "package.json")).version || ""
+const EXTENSION_VERSION =
+  readJsonFile(resolve(dirname(fileURLToPath(import.meta.url)), "..", "extension", "manifest.json")).version || ""
 const MAX_JSON_BYTES = 2 * 1024 * 1024
 const SESSION_CLEANUP_INTERVAL_MS = Number(
   process.env.YUNTI_BROWSER_SESSION_CLEANUP_INTERVAL_MS || 15_000
@@ -35,6 +41,8 @@ const PROTECTED_BRIDGE_PATHS = new Set([
   "/extension/network-event",
   "/extension/cdp-event",
   "/extension/console-event",
+  "/console/state",
+  "/console/cancel-pending",
   "/mcp/request",
   "/mcp/local-tool",
 ])
@@ -45,6 +53,14 @@ function normalizeBaseUrl(value) {
     .replace(/\/+$/, "")
 }
 
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"))
+  } catch {
+    return {}
+  }
+}
+
 function normalizeBridgeToken(value) {
   return String(value || "").trim()
 }
@@ -112,6 +128,14 @@ function sendJson(req, res, statusCode, value, { allowOrigins = DEFAULT_ALLOWED_
   res.end(body)
 }
 
+function sendHtml(req, res, statusCode, html) {
+  res.writeHead(statusCode, {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+  })
+  res.end(req.method === "HEAD" ? "" : html)
+}
+
 function bridgeRequestToken(req) {
   const headerValue = req.headers[BRIDGE_TOKEN_HEADER]
   if (Array.isArray(headerValue)) return normalizeBridgeToken(headerValue[0])
@@ -226,6 +250,11 @@ export async function startBridgeServer({
         return
       }
 
+      if ((req.method === "GET" || req.method === "HEAD") && (url.pathname === "/console" || url.pathname === "/console/")) {
+        sendHtml(req, res, 200, localConsoleHtml({ authRequired, tokenHeader: BRIDGE_TOKEN_HEADER }))
+        return
+      }
+
       if (PROTECTED_BRIDGE_PATHS.has(url.pathname) && !authorized) {
         sendJson(
           req,
@@ -241,6 +270,32 @@ export async function startBridgeServer({
         return
       }
 
+      if (req.method === "GET" && url.pathname === "/console/state") {
+        const userId = url.searchParams.get("userId") || _ROUTE_USER_ID
+        sendJson(
+          req,
+          res,
+          200,
+          hub.consoleState({
+            userId,
+            runtimeVersion: PACKAGE_VERSION,
+            expectedExtensionVersion: EXTENSION_VERSION || PACKAGE_VERSION,
+          }),
+          { allowOrigins }
+        )
+        return
+      }
+
+      if (req.method === "POST" && url.pathname === "/console/cancel-pending") {
+        const body = await readJson(req)
+        const result = hub.cancelPendingRequests({
+          ...body,
+          userId: body.userId || _ROUTE_USER_ID,
+        })
+        sendJson(req, res, 200, result, { allowOrigins })
+        return
+      }
+
       if (req.method === "GET" && url.pathname === "/sessions") {
         const userId = url.searchParams.get("userId")
         const sessions = hub.listSessions({ userId })
@@ -349,3 +404,161 @@ export async function startBridgeServer({
   }
   return { mode: "owner", host, port, bridgeToken: activeBridgeToken, authRequired, allowOrigins, hub, server }
 }
+
+function localConsoleHtml({ authRequired, tokenHeader }) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Yunti Browser Runtime Console</title>
+    <style>
+      :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+      body { margin: 0; background: Canvas; color: CanvasText; }
+      main { max-width: 1120px; margin: 0 auto; padding: 24px; }
+      header { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px; }
+      h1 { margin: 0; font-size: 24px; line-height: 1.2; }
+      h2 { margin: 0 0 10px; font-size: 16px; }
+      button { border: 1px solid ButtonBorder; background: ButtonFace; color: ButtonText; border-radius: 6px; padding: 8px 10px; cursor: pointer; }
+      button:disabled { opacity: .55; cursor: not-allowed; }
+      .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(240px, 1fr)); gap: 12px; }
+      .panel { border: 1px solid color-mix(in srgb, CanvasText 20%, transparent); border-radius: 8px; padding: 14px; }
+      .metric { font-size: 28px; font-weight: 700; }
+      .muted { color: color-mix(in srgb, CanvasText 62%, transparent); }
+      .sessions, .activity { display: grid; gap: 10px; }
+      .row { border-top: 1px solid color-mix(in srgb, CanvasText 14%, transparent); padding-top: 10px; }
+      .row:first-child { border-top: 0; padding-top: 0; }
+      code { overflow-wrap: anywhere; }
+      .status { display: inline-flex; border-radius: 999px; padding: 2px 8px; font-size: 12px; background: color-mix(in srgb, LinkText 16%, transparent); }
+      .warn { color: #9f4e00; }
+      .error { color: #b3261e; }
+      .warning-list { display: grid; gap: 8px; margin: 0 0 12px; }
+      .warning-item { border: 1px solid color-mix(in srgb, #9f4e00 50%, transparent); border-radius: 8px; padding: 10px; }
+      .toolbar { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; }
+      @media (max-width: 640px) { main { padding: 16px; } header { align-items: flex-start; flex-direction: column; } }
+    </style>
+  </head>
+  <body>
+    <main>
+      <header>
+        <div>
+          <h1>Yunti Browser Runtime</h1>
+          <div class="muted">Local console for bridge status, connected pages, diagnostics, and pending tasks.</div>
+        </div>
+        <div class="toolbar">
+          <button id="refresh" type="button">Refresh</button>
+          <button id="cancel" type="button">Cancel Pending</button>
+        </div>
+      </header>
+      <section id="auth" class="panel" hidden></section>
+      <section id="warnings" class="warning-list" aria-live="polite"></section>
+      <section class="grid" aria-live="polite">
+        <div class="panel"><h2>Sessions</h2><div id="sessionCount" class="metric">-</div><div class="muted">connected browser pages</div></div>
+        <div class="panel"><h2>Pending</h2><div id="pendingCount" class="metric">-</div><div class="muted">runtime requests waiting for results</div></div>
+        <div class="panel"><h2>Diagnostics</h2><div id="diagCount" class="metric">-</div><div class="muted">sanitized network, console, and CDP summaries</div></div>
+        <div class="panel"><h2>Runtime</h2><div id="runtimeVersion" class="metric">-</div><div class="muted">expected extension <span id="extensionVersion">-</span></div></div>
+      </section>
+      <section class="panel" style="margin-top: 12px;">
+        <h2>Connected Pages</h2>
+        <div id="sessions" class="sessions muted">Loading...</div>
+      </section>
+      <section class="panel" style="margin-top: 12px;">
+        <h2>Recent Activity</h2>
+        <div id="activity" class="activity muted">Loading...</div>
+      </section>
+    </main>
+    <script>
+      const stateUrl = "/console/state";
+      const authRequired = ${JSON.stringify(Boolean(authRequired))};
+      const tokenHeader = ${JSON.stringify(tokenHeader)};
+      const refreshButton = document.querySelector("#refresh");
+      const cancelButton = document.querySelector("#cancel");
+      const authPanel = document.querySelector("#auth");
+      const text = (value) => value == null || value === "" ? "-" : String(value);
+
+      if (authRequired) {
+        authPanel.hidden = false;
+        authPanel.innerHTML = '<strong>Bridge auth is enabled.</strong> This page shell is visible, but state requests require the <code>' + tokenHeader + '</code> header. Use <code>yunti-browser-runtime doctor</code> or curl with the header for protected diagnostics.';
+      }
+
+      async function loadState() {
+        refreshButton.disabled = true;
+        try {
+          const response = await fetch(stateUrl, { cache: "no-store" });
+          if (!response.ok) throw new Error("HTTP " + response.status);
+          const state = await response.json();
+          render(state);
+        } catch (error) {
+          document.querySelector("#sessions").innerHTML = '<span class="error">' + escapeHtml(error.message || String(error)) + '</span>';
+          document.querySelector("#activity").textContent = authRequired ? "State is protected by bridge auth." : "Unable to read console state.";
+        } finally {
+          refreshButton.disabled = false;
+        }
+      }
+
+      async function cancelPending() {
+        cancelButton.disabled = true;
+        try {
+          await fetch("/console/cancel-pending", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ reason: "cancelled from local runtime console" })
+          });
+          await loadState();
+        } finally {
+          cancelButton.disabled = false;
+        }
+      }
+
+      function render(state) {
+        const diagnostics = state.diagnostics || {};
+        const pending = (state.pendingRequests || []).length + (state.queuedRequests || []).length;
+        document.querySelector("#sessionCount").textContent = state.sessionCount || 0;
+        document.querySelector("#pendingCount").textContent = pending;
+        document.querySelector("#diagCount").textContent = (diagnostics.networkEvents || 0) + (diagnostics.consoleMessages || 0) + (diagnostics.cdpEvents || 0);
+        document.querySelector("#runtimeVersion").textContent = state.runtime?.version || "-";
+        document.querySelector("#extensionVersion").textContent = state.runtime?.expectedExtensionVersion || "-";
+        document.querySelector("#warnings").innerHTML = renderWarnings(state);
+        document.querySelector("#sessions").innerHTML = renderSessions(state);
+        document.querySelector("#activity").innerHTML = renderActivity(state);
+      }
+
+      function renderWarnings(state) {
+        if (!state.warnings || state.warnings.length === 0) return "";
+        return state.warnings.map((warning) => '<div class="warning-item"><strong>' + escapeHtml(text(warning.code)) + '</strong><div>' + escapeHtml(text(warning.message)) + '</div></div>').join("");
+      }
+
+      function renderSessions(state) {
+        if (!state.sessions || state.sessions.length === 0) {
+          return '<div>No connected pages. ' + escapeHtml(state.guidance?.noSessions || "") + '</div>';
+        }
+        return state.sessions.map((session) => '<div class="row"><div><span class="status">' + (session.active ? "active" : "connected") + '</span> <strong>' + escapeHtml(text(session.title || session.displayName)) + '</strong></div><div><code>' + escapeHtml(text(session.url)) + '</code></div><div class="muted">tab ' + escapeHtml(text(session.tabId)) + ' · extension ' + escapeHtml(text(session.extensionVersion)) + ' · queued ' + escapeHtml(text(session.queuedRequests)) + ' · last seen ' + escapeHtml(text(session.lastSeenAt)) + '</div></div>').join("");
+      }
+
+      function renderActivity(state) {
+        if (!state.recentActivity || state.recentActivity.length === 0) return '<div>No recent activity yet.</div>';
+        return state.recentActivity.map((event) => '<div class="row"><div><span class="status">' + escapeHtml(text(event.status || event.type)) + '</span> <strong>' + escapeHtml(text(event.tool || event.type)) + '</strong></div><div class="muted">' + escapeHtml(text(event.timestamp)) + ' · ' + escapeHtml(text(event.browserSessionId)) + '</div><div>' + escapeHtml(text(event.message || summarize(event.summary))) + '</div></div>').join("");
+      }
+
+      function summarize(summary) {
+        if (!summary) return "";
+        const parts = [];
+        if (summary.ok != null) parts.push("ok=" + summary.ok);
+        if (summary.code) parts.push("code=" + summary.code);
+        if (summary.action) parts.push("action=" + summary.action);
+        if (summary.keys) parts.push("keys=" + summary.keys.join(","));
+        return parts.join(" · ");
+      }
+
+      function escapeHtml(value) {
+        return String(value).replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[char]));
+      }
+
+      refreshButton.addEventListener("click", loadState);
+      cancelButton.addEventListener("click", cancelPending);
+      loadState();
+      setInterval(loadState, 5000);
+    </script>
+  </body>
+</html>`
+}

package/mcp/memory.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto"
 import { mkdir, readFile, writeFile } from "node:fs/promises"
 import { yuntiMemoryDir, yuntiMemoryFile } from "../lib/runtime-paths.js"
-import { clampNumber, redactLikelySecrets, truncateText } from "./redaction.js"
+import { clampNumber, redactLikelySensitiveText, truncateText } from "./redaction.js"
 
 const MAX_MEMORY_ITEMS = 500
 const DEFAULT_ROUTE_USER_ID = process.env.YUNTI_BROWSER_USER_ID || "local"
@@ -47,13 +47,13 @@ function sanitizeMemoryInput(args = {}) {
   return {
     id: randomUUID(),
     kind: truncateText(args.kind || "other", 80),
-    title: redactLikelySecrets(truncateText(args.title, 300)),
-    detail: redactLikelySecrets(truncateText(args.detail, 4000)),
+    title: redactLikelySensitiveText(args.title, 300),
+    detail: redactLikelySensitiveText(args.detail, 4000),
     tags: Array.isArray(args.tags)
-      ? args.tags.map((x) => truncateText(x, 80)).filter(Boolean).slice(0, 20)
+      ? args.tags.map((x) => redactLikelySensitiveText(x, 80)).filter(Boolean).slice(0, 20)
       : [],
     confidence: clampNumber(args.confidence ?? 0.5, 0, 1, 0.5),
-    source: redactLikelySecrets(truncateText(args.source || "", 500)),
+    source: redactLikelySensitiveText(args.source || "", 500),
     relatedNetworkEventIds: Array.isArray(args.relatedNetworkEventIds)
       ? args.relatedNetworkEventIds.map((x) => Number(x)).filter(Number.isFinite).slice(0, 50)
       : [],