ToolsEngine 0.1.6

ToolsEngine 0.1.6

A patch release of 0.1.5 (0.1.3 was the first public release of
@toolsenabled/toolsengine): a local MCP server over stdio that gives an
agent client a sandboxed headless Chromium browser, file tools inside one
workspace folder, and a reader for public web pages. It runs on Windows 10 or
11 and on Linux (64-bit) with Node.js 22.14 or newer. The browser tools drive
Google Chrome or Microsoft Edge that is already on the machine; no browser is
bundled or downloaded.

The server offers the same tools as 0.1.5: 27 core tools, 19 browser.*, 4
workspace.*, 2 web.*, system.status and capability.find.
Attached-browser modes offer 26; without a browser, 8. Four desktop.* tools
for signed-in Windows apps exist only on Windows and only when the server is
started with the desktop option. This release corrects what a code review of
0.1.5 found. The most important: a browser click, key press or navigation
that had already acted on the page could be reported as an error saying
nothing was saved, which invites the assistant to do it again; and the
automatic page snapshots were never removed, so in a workspace that is kept
every browser call came back that way after about 256 of them.

Source: commit eff891050be0c92427d37110d47b21be206e17cf (branch main). Built on Linux with Node
v22.19.0; the archive timestamps are the commit time, 2026-10-13T18:01:55Z. Licence:
MIT.

Files in this release

File	Bytes	SHA-256
toolsengine-0.1.6-linux-x64.tar.gz	7935943	6a57126a4d64c7169298da63cccbfa72eb648ad26ff2a89c62f9e296de8443aa
toolsengine-0.1.6-windows-x64.zip	9883946	7d75cabfabe4272211e08994a3b5790de0b39a961f8e3f052c812285ab9c899b
toolsenabled-toolsengine-0.1.6.tgz (the npm package, 22 files)	122830	a85e995dd181a68fdf1f4ceeafe71cb44404674bae1c5e8cdfd4853477839986
SHA256SUMS		the two archive hashes above, sha256sum -c format
toolsenabled-toolsengine-0.1.6.tgz.sha256		the npm package hash, same format
release-report.json		the build record: commit, test counts, bundled packages, archive hashes

Each archive holds the program, the installer, SECURITY.md and the 97
third-party packages the program needs (THIRD-PARTY-NOTICES.txt lists them
with their licence texts: MIT 84, Apache-2.0 3, BSD-3-Clause 2, ISC 7, BSD-2-Clause 1). The npm package is the same program without the dependency
tree: npm fetches the dependencies from the registry when it installs the
file. It takes the four that package.json names at their exact versions
and resolves the packages they depend on itself, so some of those can be
newer than the tested versions listed in npm-shrinkwrap.json; the
archives carry exactly the tested versions.

Install

From an archive (nothing is downloaded; the installer uses no network).
Verify first; --ignore-missing lets the check pass with only the archive
for your platform downloaded:

sha256sum -c --ignore-missing SHA256SUMS
tar -xzf toolsengine-0.1.6-linux-x64.tar.gz
cd toolsengine-0.1.6-linux-x64
./install.sh --register claude codex

On Windows: certutil -hashfile toolsengine-0.1.6-windows-x64.zip SHA256
must print the hash in the table above; then Extract All on the .zip, open
a terminal in the extracted folder and run install.cmd --register claude codex. Name only the client you use. The installer copies the program to
ToolsEngine/0.1.6 under your profile, creates a workspace folder, finds
Chrome or Edge, starts the server once to check it, and registers it with
each named client's own command. INSTALL.txt in the archive and
app/README.md (the manual) have the details and every option.

From the npm package in this release (@toolsenabled/toolsengine is not
on the npm registry yet; the README says so and shows this route):

sha256sum -c toolsenabled-toolsengine-0.1.6.tgz.sha256
npm install -g ./toolsenabled-toolsengine-0.1.6.tgz
claude mcp add --scope user toolsengine -- toolsengine --workspace /absolute/path/to/workspace --browser-channel chrome
codex mcp add toolsengine -- toolsengine --workspace /absolute/path/to/workspace --browser-channel chrome

--browser-channel msedge chooses Edge, --browser-executable PATH a
browser by path, --no-browser leaves the browser tools out. With no Chrome
and no Edge on the machine, use --no-browser in place of
--browser-channel chrome: the server does not start with a browser it
cannot find, and Claude Code then shows only "Failed to connect".
Hand-written client configuration (JSON for Claude Code, TOML for Codex) is
in docs/clients.md in the package.

Then open a new session in the client: the tools appear under the server
name toolsengine, and system.status shows what is switched on.

Changes in 0.1.6

Compared with 0.1.5 (the full history is at the end of app/README.md):

• A browser call that had already clicked, typed or navigated was reported
  as an error ("Saved artifact size or number limit reached; nothing was
  saved." or "Another artifact writer is active or its output lock needs
  review; nothing was saved.") when the page-snapshot file that is written
  after it could not be saved. The page had changed, and the error invited
  the assistant to repeat the action: to place an order or send a message
  twice. Now the call's own result stands; the link to the missing file is
  replaced, and one sentence says that the action was carried out, that
  only its snapshot file was not saved and why, and not to repeat it.
• Automatic page snapshots (page-<date and time>.yml in
  artifacts/toolsengine) are no longer kept forever. In 0.1.5 the 256-file
  limit filled after about 256 browser calls in a workspace that is kept,
  and from then on every browser call failed as above, install.mjs check
  included. Now the newest 64 (within 16 MiB) are kept and older ones are
  deleted when a new one is written and when the server starts, so a
  workspace that 0.1.5 filled keeps only its newest 64 after the first
  start. Files saved under a name given to a tool, screenshots, PDFs, logs,
  downloads and files you put there yourself are never deleted.
• A write waits up to 2 seconds for another ToolsEngine on the same
  workspace that holds the output lock (Claude Code and Codex registered on
  one workspace, for example) instead of being refused at once. A lock that
  is still held after that is named in the refusal:
  .toolsengine-runtime/artifact-write.lock.
• workspace.search no longer fails as a whole, losing the matches it had
  found, when a file or folder in the tree has a name that Linux allows and
  Windows does not: a colon, as in server-2026-10-13T10:00:00.log, a
  trailing dot or space, a device name such as aux.c. It passes them by
  and counts them as skipped.nonPortableNames. The descriptions of
  workspace.read_file, workspace.write_file and workspace.search and
  the README say which names the file tools refuse.
• Case-insensitive workspace.search reports the column in the line as
  written on lines with letters whose lower case is longer, such as the
  Turkish "İ" (0.1.5 reported column 10 instead of 6 for İİİİ token).
• web.extract finds the end of a script or a style on pages that contain
  "İ": script source no longer comes out as text there, and the text after
  a style is no longer lost.
• install.mjs uninstall no longer stops with "ReferenceError: unexpected
  is not defined" after removing the files when a leftover folder cannot be
  read; it names that folder as unreadable and goes on to name the
  workspace and the commands that remove the client registrations.
• workspace.write_file writes names of up to 255 bytes (0.1.5 failed on
  names of about 214 to 255 bytes, because its temporary file was named
  after the target), and a longer name is refused with "... has a name that
  is longer than this file system allows" instead of the system's
  ENAMETOOLONG error with the workspace's full path.

What was tested

The release build runs the whole test suite first, one file at a time, and
builds nothing unless every test passes and the browser tests ran. For this
build: 252 tests, 232 pass, 0 fail, 20 skipped for
the system they ran on (19 Windows-only cases: 16 desktop-tool tests, 2 installer tests and 1 NTFS short-name test; and 1 sandbox case that applies only to Playwright's own Chromium), in 48 test files, with
Google Chrome (/opt/google/chrome/chrome) and the browser sandbox on, on
Linux. The build was run twice from the same commit and gave byte-identical
archives, and npm pack run twice gave the same package file. The package
audit (npm run audit:package) passed: 27 offered tools, 4 optional Windows
desktop tools, the two tool catalogues equal to the running server, all 22
packed files world-readable.

Each fix has a test that fails on 0.1.5 and passes on this commit. For the
first: with the saved-output limit full of other files, and then with
another writer's lock held, a click on a "Place order" button in Chrome is
reported as carried out and the page counts one order per click (on 0.1.5
the navigation before it already returned "nothing was saved"); 300
automatic snapshots written into one workspace all succeed and leave the
newest 64 (0.1.5 refused the 257th and every one after it).

npm test with every file at once on the same commit: 252 tests, 232 pass, 0 fail, 20 skipped with
Chrome named by TOOLSENGINE_TEST_BROWSER; 252 tests, 208 pass, 0 fail, 44 skipped as a plain npm test
(on this Ubuntu machine Playwright's own Chromium cannot set its sandbox up,
so the tests that would use it are skipped with that reason); 252 tests, 200 pass, 0 fail, 52 skipped
with Chrome hidden; and 252 tests, 193 pass, 0 fail, 59 skipped with no browser at all.

From the extracted Linux archive on the build machine: sha256sum -c --ignore-missing SHA256SUMS answered OK for the Linux archive (exit 0), and sha256sum -c on the npm package's .sha256 file answered OK. The test file shipped in the package (tests/browser-extension.test.js, run from app/ with the bundled packages) passed 17 of 17 with Chrome, and with Chrome hidden passed 13 and skipped 4 with the reason, 0 failed. ./install.sh --home DIR --browser none copied the 3,855 files, checking each against release.json; the installed server answered as toolsengine 0.1.6 with 8 tools, and install.mjs check and list worked. Over stdio the installed server found matches beside a file named server-2026-10-13T10:00:00.log (counted in nonPortableNames), reported column 6 after "İİİİ", wrote a 255-byte name and refused a 304-byte one without the workspace's path. install.mjs uninstall with an unreadable leftover folder named it as unreadable and named the workspace (exit 0). The claude mcp add command the installer printed, run with a separate Claude Code configuration folder, gave ✔ Connected in claude mcp list. npm install -g ./toolsenabled-toolsengine-0.1.6.tgz installed the program without running any install script or downloading a browser; toolsengine --version printed ToolsEngine 0.1.6, and claude mcp add ... -- toolsengine --workspace DIR --no-browser gave ✔ Connected. With Chrome, the installed server started in a workspace that held 256 automatic snapshots, as 0.1.5 leaves one, kept the newest 64, and reported a navigation and two clicks on a "Place order" button without an error; the page counted 2 orders, and with another writer's lock held a third click was reported as carried out and counted once. 0.1.5 in the same workspace returned "nothing was saved" errors for each of those calls while the page counted every click.

Tested platforms: Linux with Node.js 22 for this release; the Windows
archive was built and listed on Linux and was not run on Windows for this
patch (0.1.3 was tested on Windows 10; the changed code is platform-neutral
JavaScript, and the Windows desktop code is unchanged). macOS is untested.

Not included

• A Firefox-desktop mode that exists only in a separate, unreleased fork.
  It is not part of this package or its documentation.
• Native desktop input on Linux or macOS. The desktop tools exist on Windows
  only.
• A web browser. Chrome or Edge must already be installed.
• Publication on the npm registry. The npm package is the .tgz above.

Known limits

From "Tested platforms and known limits" in app/README.md:

• --browser-extension uses Microsoft's Playwright Extension installed by the
  person; its tests use stand-ins, and a real signed-in Chrome or Edge
  extension workflow was not verified.
• Browser network access is ordinary browser access, private networks
  included; only web.fetch has the public-address checks.
• The filesystem checks do not defeat a hostile local process racing path
  components; use an OS sandbox when that threat applies.
• There is no per-action confirmation, no on-screen "being controlled"
  indicator and no emergency stop key in this package; the MCP client's
  approval settings are the only check before an action.
• web.extract is a bounded tokenizer, not a full HTML rendering engine.
• Queued calls are refused once shutdown starts; a browser action already
  delivered cannot be rolled back.

Support and security contact: support@toolsenabled.ai (security policy:
https://toolsenabled.ai/security/, stated in SECURITY.md at the top of
each archive and in the npm package; private reports also through the
repository's Security tab).