0.2.0: make the MCP authority boundary explicit and honest
An external review of the MCP surface (and the doc claims around it) found
that the gate only covered browse/goal while the README implied the whole
tool set, direct primitives left no trace, upload_files could read any host
path, goto accepted file://, and lighthouse ran an unpinned npx with a
caller-controlled argv.
- every acting MCP tool writes a kind:"action" record to the same trace as
decisions (typed values, JS expressions and single-character keys masked);
read_trace skips action records, read_actions exposes them, SPEC documents
the record - fill_form/upload_files intent resolution goes through the same gate as
browse (upload's target choice matches the element only, since "upload"
itself is on the risky list) - --file-root (default cwd) bounds upload reads and artifact writes, and
refuses a default root that is / or the home directory; --allow-file-urls
opts file:// back in for goto/new_page - lighthouse: http(s) only, pinned 13.5.0, URL validated before npx
- annotations: screenshot/heap_snapshot/trace_stop/dialog_policy destructive
- cli: --no-eval/--max-candidates now actually reach serve() (dropped before)
- README/SECURITY/SPEC: gate scope, traced vs replayed, readers not traced,
--no-trace, masking limits - tests: 239 (action records, intent gate + decision steps, file-root and
symlink escapes, scheme guards, replay --execute on an intent step,
single-char key masking)
Reviewed by oc-review over three passes (last pass only doc/test nits).