Fix some fundamental flaws

Co-authored-by: Copilot <copilot@github.com>

Author: snlr308

README.md

@@ -607,7 +607,7 @@ npm run generate:manifest
 - **POST, not PUT.** All updates use POST. The API does not support PUT.
 - **Custom credentials header.** `credentials: username:password` (raw, not base64, not standard Basic Auth).
 - **Eventual consistency.** After creating or updating entities, changes may take up to 3 minutes to propagate through the API cache.
-- **GET /setting limited.** Only works at merchant and channel level. POST /setting works at all levels (PSP, division, merchant, channel).
+- **GET /setting limited.** Only works at merchant and channel level. POST /setting works at all levels (PSP, division, merchant, channel). Settings are inherited, so an empty value means "not set here" rather than "off". The extension resolves effective values upward where the API permits it, e.g. channel -> merchant. If the chain reaches division or PSP, the effective value is unknown through the API; the result includes the known default and the agent can use context binding to inspect the dashboard manually when the user needs the true operational value.
 
 ### Settings coverage
 

background/service-worker.ts

@@ -11,27 +11,14 @@
 
 import { swStartJob, swPauseJob, swCancelJob, swCancelJobById, swGetActiveJobId, type SwJobStartInput } from "./sw-job-executor";
 import { clearChatContext, upsertChatContext } from "../src/chat/context-store";
-import { createExecuteMap } from "../src/tools/internal-router";
+import { createExecuteMap, resolveSession } from "../src/tools/internal-router";
 import { TOOL_SCHEMAS } from "../src/webmcp/tool-schemas";
 import type { ToolSchema } from "../src/webmcp/tool-schemas";
 import type { EntityType } from "../src/lib/entity-types";
+import type { WritePreview } from "../src/bridge/confirm-bridge";
+import { buildWebMcpWritePreview, isWebMcpReadOnlyInvocation } from "../src/webmcp/execution-policy";
 
-const WEBMCP_EXECUTE_MAP = createExecuteMap();
-
-const WEBMCP_READ_ACTIONS: Record<string, Set<string>> = {
-  manage_settings: new Set(["get", "batch_get", "list_non_default"]),
-};
-
-function isWebMcpReadOnlyInvocation(tool: string, params: Record<string, unknown>): boolean {
-  const schema = TOOL_SCHEMAS.find((entry) => entry.name === tool);
-  if (!schema) return false;
-  if (schema.annotations?.readOnlyHint === true) return true;
-
-  const allowedActions = WEBMCP_READ_ACTIONS[tool];
-  if (!allowedActions) return false;
-  const action = params.action;
-  return typeof action === "string" && allowedActions.has(action);
-}
+const WEBMCP_EXECUTE_MAP = createExecuteMap({ bypassWriteConfirmation: true });
 
 // -- Side panel activation ------------------------------------------------
 
@@ -135,6 +122,7 @@ export interface WebMcpExecuteToolMessage {
   payload: {
     tool: string;
     params?: Record<string, unknown>;
+    confirmed?: boolean;
   };
 }
 
@@ -278,20 +266,23 @@ chrome.runtime.onMessage.addListener(
 
 async function handleWebMcpExecuteTool(
   payload: WebMcpExecuteToolMessage["payload"],
-): Promise<{ ok: boolean; result?: string; error?: string }> {
+): Promise<{ ok: boolean; result?: string; error?: string; needsConfirmation?: boolean; preview?: WritePreview }> {
   const params = payload.params ?? {};
   const execute = WEBMCP_EXECUTE_MAP[payload.tool];
   if (!execute) {
     return { ok: false, error: `Unknown tool: ${payload.tool}` };
   }
 
   if (!isWebMcpReadOnlyInvocation(payload.tool, params)) {
-    return {
-      ok: false,
-      error:
-        "WebMCP write execution is temporarily disabled while the service-worker confirmation path is implemented. " +
-        "Read tools are available; use the side panel or Chat tab for confirmed writes for now.",
-    };
+    const session = await resolveSession();
+    if (!session) {
+      return { ok: false, error: "Session not unlocked. Open the side panel and enter your PIN first." };
+    }
+
+    const preview = buildWebMcpWritePreview(payload.tool, params, session.env);
+    if (preview && payload.confirmed !== true) {
+      return { ok: false, needsConfirmation: true, preview };
+    }
   }
 
   const result = await execute(params);

background/sw-job-executor.ts

@@ -51,8 +51,8 @@ async function flushProgress(jobId: string, force = false) {
 
 // -- SDK facade for SW (no confirm bridge) --------------------------------
 
-function buildSwSdk(creds: ApiCredentials, env: Environment, writes: WriteRecord[]) {
-  const ctx: SdkContext = { creds, env };
+function buildSwSdk(creds: ApiCredentials, env: Environment, writes: WriteRecord[], signal?: AbortSignal, throttleRate?: number) {
+  const ctx: SdkContext = { creds, env, signal, throttleRate };
   const virtualSdk = createSdk(ctx);
 
   function recordWrite(
@@ -355,7 +355,7 @@ async function executeInSw(jobId: string, creds: ApiCredentials, env: Environmen
   const results: unknown[] = [];
   const writes: WriteRecord[] = [];
 
-  const sdk = buildSwSdk(creds, env, writes);
+  const sdk = buildSwSdk(creds, env, writes, signal, job.throttleRate);
 
   const consoleProxy = {
     log: (...args: unknown[]) => logs.push({ level: "log", args, timestamp: new Date().toISOString() }),

content/bridge.ts

@@ -10,6 +10,51 @@
  * script via chrome.scripting.executeScript (bypasses page CSP).
  */
 
+interface BridgeResponse {
+  ok?: boolean;
+  result?: string;
+  error?: string;
+  needsConfirmation?: boolean;
+  preview?: {
+    tool: string;
+    action: string;
+    method: "POST" | "DELETE";
+    description: string;
+    params: Record<string, unknown>;
+    env: "uat" | "prod";
+  };
+}
+
+async function sendExecuteTool(
+  tool: string,
+  params: Record<string, unknown>,
+  confirmed = false,
+): Promise<BridgeResponse | undefined> {
+  return chrome.runtime.sendMessage({
+    type: "webmcp:execute-tool",
+    payload: { tool, params, confirmed },
+  }) as Promise<BridgeResponse | undefined>;
+}
+
+function confirmWrite(preview: NonNullable<BridgeResponse["preview"]>): boolean {
+  const prettyParams = Object.keys(preview.params).length > 0
+    ? JSON.stringify(preview.params, null, 2)
+    : "(none)";
+
+  const message = [
+    `Confirm write (${preview.env.toUpperCase()})`,
+    "",
+    preview.description,
+    "",
+    `Method: ${preview.method}`,
+    `Tool: ${preview.tool}/${preview.action}`,
+    "",
+    `Params: ${prettyParams}`,
+  ].join("\n");
+
+  return window.confirm(message);
+}
+
 // -- Message listener (main world -> isolated world) ----------------------
 
 window.addEventListener("message", async (event: MessageEvent) => {
@@ -24,10 +69,19 @@ window.addEventListener("message", async (event: MessageEvent) => {
   };
 
   try {
-    const response = await chrome.runtime.sendMessage({
-      type: "webmcp:execute-tool",
-      payload: { tool, params },
-    }) as { ok?: boolean; result?: string; error?: string } | undefined;
+    let response = await sendExecuteTool(tool, params);
+
+    if (response?.needsConfirmation && response.preview) {
+      if (!confirmWrite(response.preview)) {
+        window.postMessage({
+          type: "webmcp:tool-result",
+          callId,
+          error: "Operation cancelled by user.",
+        }, "*");
+        return;
+      }
+      response = await sendExecuteTool(tool, params, true);
+    }
 
     if (!response?.ok) {
       window.postMessage({

content/register-main.ts

@@ -16,6 +16,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:live": "WEBAPI_TEST_LIVE=1 vitest run --dir src --testNamePattern=. src/**/*.live.test.ts",
+    "smoke:webmcp": "node tools-cli/webmcp-smoke.mjs",
     "verify:tokens": "node tools-cli/token-benchmark.mjs",
     "verify:security": "node tools-cli/security-verify.mjs",
     "generate:manifest": "node tools-cli/generate-manifest.mjs",

package.json

@@ -1,10 +1,6 @@
 import React from "react";
 import ReactDOM from "react-dom/client";
 import { App } from "./App";
-import { registerAllTools } from "../src/webmcp/register-tools";
-
-// Register WebMCP tools with retry (handles async navigator.modelContext injection)
-registerAllTools();
 
 // Tab-close job pausing is handled directly by the service worker (sw-job-executor).
 // The side panel monitors job state via chrome.storage change events (see job-runner.ts).

sidepanel/index.tsx

@@ -1,8 +1,7 @@
 /**
  * Shared utilities for write confirmation across bridge.ts and register-tools.ts.
  *
- * Extracted to avoid duplication of describeDirectWrite and related helpers
- * which had identical copies in content/bridge.ts and src/webmcp/register-tools.ts.
+ * Keeps write descriptions consistent across Chat, side panel, sandbox, and WebMCP paths.
  */
 
 import type { Environment } from "../lib/types";
@@ -53,6 +52,21 @@ export function describeDirectWrite(tool: string, action: string, params: Record
   }
 }
 
+export function describeMutatingCall(
+  tool: string,
+  params: Record<string, unknown>,
+): { action: string; method: "POST" | "DELETE"; description: string } | null {
+  const actions = MUTATING_ACTIONS[tool];
+  if (!actions) return null;
+  const action = params.action as string;
+  if (!actions.has(action)) return null;
+  return {
+    action,
+    method: httpMethod(action),
+    description: describeDirectWrite(tool, action, params),
+  };
+}
+
 /**
  * Check whether a tool call is mutating; if so, request user confirmation.
  * Returns the write description if the call was mutating and confirmed,
@@ -62,21 +76,18 @@ export function describeDirectWrite(tool: string, action: string, params: Record
 export async function confirmIfMutating(
   tool: string, params: Record<string, unknown>, env: Environment
 ): Promise<string | undefined> {
-  const actions = MUTATING_ACTIONS[tool];
-  if (!actions) return undefined;
-  const action = params.action as string;
-  if (!actions.has(action)) return undefined;
+  const mutatingCall = describeMutatingCall(tool, params);
+  if (!mutatingCall) return undefined;
 
-  const description = describeDirectWrite(tool, action, params);
   const preview: WritePreview = {
     tool,
-    action,
-    method: httpMethod(action),
-    description,
+    action: mutatingCall.action,
+    method: mutatingCall.method,
+    description: mutatingCall.description,
     params,
     env,
   };
   const choice = await requestConfirm(preview);
   if (choice === "cancel") throw new Error("Operation cancelled by user.");
-  return description;
+  return mutatingCall.description;
 }

src/bridge/write-confirm-utils.ts

@@ -58,6 +58,7 @@ export function buildChatSystemPrompt(options: ChatSystemPromptOptions = {}): st
       : "Never attempt writes or code execution.",
     ...PLAYBOOK.principles,
     "Entities with state DISABLED are soft-deleted. List and hierarchy tools automatically hide them unless includeDisabled=true. If the result includes _hiddenDisabled, mention how many were hidden. Do not count or list disabled entities unless the user explicitly asks about deleted items.",
+    "For settings results with source: unknown, state the API limitation briefly and include the default value if present. Do not offer UI inspection from Chat Tab.",
     "Discovery playbook:",
     ...PLAYBOOK.playbooks.map((entry) => `${entry.trigger}: ${entry.steps.join(" ")}`),
     "Response style:",