fix(mcp): tighten clear-recordings target gating and validate page upfront

Enforce actions, agent.tools, and inspector settings together before exposing or clearing each target, and validate router page presence upfront before clearing recordings. Also refresh the committed extension bundle for the updated devtools build.

Author: Kaap10

…s/browser-agent-rpc-BXhoSh1z-C0NC0d_x.js …s/browser-agent-rpc-BXhoSh1z-DG2zOM1d.jsextension/ui/assets/browser-agent-rpc-BXhoSh1z-C0NC0d_x.js renamed to extension/ui/assets/browser-agent-rpc-BXhoSh1z-DG2zOM1d.js extension/ui/assets/browser-agent-rpc-BXhoSh1z-C0NC0d_x.js renamed to extension/ui/assets/browser-agent-rpc-BXhoSh1z-DG2zOM1d.js

@@ -259,4 +259,52 @@ describe('clear-recordings agent tool', () => {
     });
     expect(tools).not.toContain('clear-recordings');
   });
+
+  it('drops clear-recordings when no target has both actions and agent tools enabled', async () => {
+    const { tools } = await boot({
+      actions: { http: true, router: false, analog: false },
+      agent: { tools: { http: false, router: true, analog: true } },
+    });
+    expect(tools).not.toContain('clear-recordings');
+  });
+
+  it('blocks target when agent.tools is false even if action is true', async () => {
+    const { call } = await boot({
+      actions: { http: true, router: true },
+      agent: { tools: { http: false, router: true } },
+    });
+    await expect(call('clear-recordings', { target: 'http' })).rejects.toThrow(
+      'HTTP recording is disabled in the devtools config (agent.tools.http is turned off).',
+    );
+  });
+
+  it('returns unknown page text when requested router page is absent', async () => {
+    const { call } = await boot();
+    const result = await call('clear-recordings', { target: 'router', page: 'missing-page-id' });
+    expect(result).toContain('No page `missing-page-id` is reporting a router report.');
+  });
+
+  it('validates router page upfront and preserves other recordings when target is all and page is unknown', async () => {
+    const { push, call } = await boot();
+    await push(
+      'push-http',
+      httpReport('page-1', [
+        {
+          id: 'call-keep',
+          url: '/api/preserve',
+          method: 'GET',
+          status: 200,
+          durationMs: 10,
+          side: 'client',
+        },
+      ]),
+    );
+
+    const result = await call('clear-recordings', { target: 'all', page: 'non-existent-page' });
+    expect(result).toContain('No page `non-existent-page` is reporting a router report.');
+
+    // HTTP calls must not have been cleared
+    const httpList = await call('list-http-calls');
+    expect(httpList).toContain('/api/preserve');
+  });
 });

extension/ui/assets/index-CI9Z1pj3.js extension/ui/assets/index-Cq99gFIS.jsextension/ui/assets/index-CI9Z1pj3.js renamed to extension/ui/assets/index-Cq99gFIS.js

@@ -680,10 +680,10 @@ export function agentAllowed(
     return false;
   }
   if (name === 'clear-recordings') {
-    return (
-      (config.agent.tools.http && config.inspectors.http) ||
-      (config.agent.tools.router && config.inspectors.router) ||
-      (config.agent.tools.analog && config.inspectors.analog)
+    return Boolean(
+      (config.agent.tools.http && config.inspectors.http && config.actions.http) ||
+      (config.agent.tools.router && config.inspectors.router && config.actions.router) ||
+      (config.agent.tools.analog && config.inspectors.analog && config.actions.analog),
     );
   }
   const inspector = agentInspector(entry.id);

extension/ui/index.html

@@ -1183,25 +1183,51 @@ const pangular = defineDevframe({
           throw new Error('Provide a valid target: "http", "router", "analog", or "all".');
         }
 
+        const pageId = pageArgument(args as Record<string, unknown> | undefined);
+        if (pageId && (target === 'router' || target === 'all') && !routerPages.has(pageId)) {
+          return {
+            markdown: unknownPageText(pageId, byRecency(routerPages.values()), 'a router report'),
+          };
+        }
+
         const cleared: string[] = [];
         const skipped: string[] = [];
 
+        const httpEligible =
+          config.actions.http && config.agent.tools.http && config.inspectors.http;
         if (target === 'http' || target === 'all') {
-          if (!config.actions.http) {
-            if (target === 'http') throw new Error(actionBlockedMessage('http'));
-            skipped.push('HTTP calls (actions.http is turned off)');
+          if (!httpEligible) {
+            const reason = !config.actions.http
+              ? 'actions.http is turned off'
+              : !config.agent.tools.http
+                ? 'agent.tools.http is turned off'
+                : 'inspectors.http is turned off';
+            if (target === 'http') {
+              if (!config.actions.http) throw new Error(actionBlockedMessage('http'));
+              throw new Error(`HTTP recording is disabled in the devtools config (${reason}).`);
+            }
+            skipped.push(`HTTP calls (${reason})`);
           } else {
             clearHttpCalls();
             cleared.push('recorded HTTP calls');
           }
         }
 
+        const routerEligible =
+          config.actions.router && config.agent.tools.router && config.inspectors.router;
         if (target === 'router' || target === 'all') {
-          if (!config.actions.router) {
-            if (target === 'router') throw new Error(actionBlockedMessage('router'));
-            skipped.push('router navigations (actions.router is turned off)');
+          if (!routerEligible) {
+            const reason = !config.actions.router
+              ? 'actions.router is turned off'
+              : !config.agent.tools.router
+                ? 'agent.tools.router is turned off'
+                : 'inspectors.router is turned off';
+            if (target === 'router') {
+              if (!config.actions.router) throw new Error(actionBlockedMessage('router'));
+              throw new Error(`Router recording is disabled in the devtools config (${reason}).`);
+            }
+            skipped.push(`router navigations (${reason})`);
           } else {
-            const pageId = pageArgument(args as Record<string, unknown> | undefined);
             if (pageId) {
               if (clearRouterNavigations(routerPages, pageId)) {
                 applyRouter(currentRouter(routerPages));
@@ -1223,10 +1249,20 @@ const pangular = defineDevframe({
           }
         }
 
+        const analogEligible =
+          config.actions.analog && config.agent.tools.analog && config.inspectors.analog;
         if (target === 'analog' || target === 'all') {
-          if (!config.actions.analog) {
-            if (target === 'analog') throw new Error(actionBlockedMessage('analog'));
-            skipped.push('Analog calls (actions.analog is turned off)');
+          if (!analogEligible) {
+            const reason = !config.actions.analog
+              ? 'actions.analog is turned off'
+              : !config.agent.tools.analog
+                ? 'agent.tools.analog is turned off'
+                : 'inspectors.analog is turned off';
+            if (target === 'analog') {
+              if (!config.actions.analog) throw new Error(actionBlockedMessage('analog'));
+              throw new Error(`Analog recording is disabled in the devtools config (${reason}).`);
+            }
+            skipped.push(`Analog calls (${reason})`);
           } else {
             clearCalls();
             cleared.push('Analog server calls');