@agent360/browser-mcp 1.24.0 → 1.28.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agent360/browser-mcp",
-  "version": "1.24.0",
-  "description": "Browser MCP — control your real Chrome from Claude Code. 34 tools, CAPTCHA solving, date pickers, autocomplete combobox, overlay dismissal, file upload, multi-session, human-in-the-loop.",
+  "version": "1.28.1",
+  "description": "Browser MCP — give your AI agent a real, logged-in Chrome: test authenticated apps, read 2FA codes from Gmail, scrape behind logins, solve CAPTCHAs. 40 tools, multi-session, human-in-the-loop.",
   "mcpName": "io.github.Agent360dk/browser-mcp",
   "type": "module",
   "main": "index.js",
@@ -11,14 +11,20 @@
   "files": [
     "index.js",
     "tools.js",
+    "vagt.js",
     "bin/",
     "extension/",
     "README.md"
   ],
   "scripts": {
+    "test": "node --test ../test/*.test.mjs",
+    "flow": "node ../test/flow/run.mjs",
+    "sessions": "node ../test/flow/sessions.mjs",
+    "feedback": "node ../scripts/feedback-report.mjs",
     "start": "node index.js",
     "publish:cws": "../scripts/publish-cws.sh",
-    "publish:cws:draft": "../scripts/publish-cws.sh --draft"
+    "publish:cws:draft": "../scripts/publish-cws.sh --draft",
+    "samtidighed": "node ../test/flow/samtidighed.mjs"
   },
   "keywords": [
     "mcp",
@@ -56,5 +62,13 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
     "ws": "^8.18.0"
+  },
+  "overrides": {
+    "fast-uri": "^3.1.5",
+    "hono": "^4.12.34",
+    "ip-address": "^10.3.1",
+    "@hono/node-server": "^1.19.15",
+    "body-parser": "^2.2.3",
+    "qs": "^6.15.2"
   }
 }

package/tools.js

@@ -27,6 +27,22 @@ export const TOOLS = [
       },
     },
   },
+  {
+    name: 'browser_extract_list',
+    description: 'Read EVERY row of a long or virtualised list by scrolling its container until no new rows appear. Use this instead of browser_get_page_content whenever a page shows a repeating list longer than the viewport — mail lists (Outlook, Gmail), invoice/billing tables, search results, transaction histories. Those UIs keep only ~7 rows in the DOM at a time, so a single page read returns a sliver and looks complete. Pass the CSS selector of one repeating row (e.g. \'[role="option"]\', \'tr\', \'[role="listitem"]\'); the scrollable ancestor is found automatically. Returns deduplicated row text plus reached_end so you know whether you saw the whole list.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        selector: { type: 'string', description: 'CSS selector matching ONE repeating row (e.g. \'[role="option"]\' in Outlook, \'tr\' in a table)' },
+        container: { type: 'string', description: 'Optional CSS selector for the scrollable container. Omit to auto-detect the row\'s nearest scrollable ancestor.' },
+        max_rows: { type: 'number', description: 'Stop after this many unique rows (default 500, max 5000)' },
+        stable_rounds: { type: 'number', description: 'Consecutive scrolls with no new rows before stopping (default 3)' },
+        scroll_step: { type: 'number', description: 'Pixels per scroll. Omit for 85% of the container height.' },
+        wait_ms: { type: 'number', description: 'Wait after each scroll so new rows can render (default 350)' },
+      },
+      required: ['selector'],
+    },
+  },
   {
     name: 'browser_screenshot',
     description: 'Take a screenshot of the visible area of the current tab. Returns base64 PNG, or saves to disk if path is provided.',
@@ -39,15 +55,54 @@ export const TOOLS = [
   },
   {
     name: 'browser_execute_script',
-    description: 'Execute JavaScript code in the context of the current page. Returns the result.',
+    description: 'Execute JavaScript in the current page. IMPORTANT: the parameter is `code` (NOT `script` — though that alias is accepted), and it must be an EXPRESSION, not statements: use an IIFE `(() => { ...; return x; })()`. Top-level `return` is a syntax error (the handler wraps code in parentheses).',
     inputSchema: {
       type: 'object',
       properties: {
-        code: { type: 'string', description: 'JavaScript expression to evaluate (runs in page context)' },
+        code: { type: 'string', description: 'JavaScript EXPRESSION to evaluate in page context. For multi-statement logic use an IIFE: (() => { ...; return result; })()' },
       },
       required: ['code'],
     },
   },
+{
+    name: 'browser_double_click',
+    description: 'True double-click on an element (two trusted press/release pairs with escalating clickCount). Use for open-item actions (calendar events, file lists) where two single clicks would trigger inline-rename instead (e.g. OWA month view).',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        selector: { type: 'string', description: 'CSS or text selector' },
+      },
+      required: ['selector'],
+    },
+  },
+  {
+    name: 'browser_right_click',
+    description: 'Right-click an element (trusted CDP mouse events) to open page-level context menus (web apps like OWA/Google Docs render their own). Note: Chrome\'s NATIVE context menu does not open via CDP — only in-page menus.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        selector: { type: 'string', description: 'CSS or text selector' },
+      },
+      required: ['selector'],
+    },
+  },
+  {
+    name: 'browser_click_xy',
+    description: 'ESCAPE HATCH: Click at raw viewport coordinates (CSS pixels) with fully trusted mouse events. Use when a visible button resists every selector strategy (Azure portal dialogs, Knockout-bound divs, canvas UIs): take a screenshot, read the button\'s position, click its center. Combine with browser_screenshot for coordinates.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        x: { type: 'number', description: 'X coordinate (CSS pixels, from left of viewport)' },
+        y: { type: 'number', description: 'Y coordinate (CSS pixels, from top of viewport)' },
+      },
+      required: ['x', 'y'],
+    },
+  },
+  {
+    name: 'browser_reattach_debugger',
+    description: 'RECOVERY: Force-detach and re-attach the Chrome debugger on the current tab. Use when interactive tools (click/fill/press_key) start timing out or reporting ghost-attach ("Debugger attach failed ... ghost") while list_tabs still works — faster than reloading the extension.',
+    inputSchema: { type: 'object', properties: {} },
+  },
   {
     name: 'browser_click',
     description: 'Click an element on the page. Supports CSS selectors AND text-based selectors. Auto-scrolls element into view. Uses real mouse events (works on Angular/React SPAs and CSP-strict sites like Google, Stripe). Examples: "button:text(Get started)", "text=Submit", "#my-button", "a.btn-primary"',
@@ -130,7 +185,7 @@ export const TOOLS = [
       type: 'object',
       properties: {
         selector: { type: 'string', description: 'CSS or text selector for the dropdown trigger / <select> element' },
-        option: { type: 'string', description: 'Text of the option to select (partial match supported)' },
+        option: { type: 'string', description: 'Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches — it never reports success without the field actually changing.' },
         wait: { type: 'number', description: 'Ms to wait after clicking trigger for options to appear (default: 300)' },
       },
       required: ['selector', 'option'],
@@ -165,12 +220,12 @@ export const TOOLS = [
   },
   {
     name: 'browser_drop_file',
-    description: 'Upload a file by finding a hidden <input type="file"> within a drag-drop zone\'s subtree (or parent up to 2 levels). Use when browser_upload_file fails because the dropzone has no visible file input. Returns clear error if no input is found anywhere — pure drop-zones without backing inputs require manual handling.',
+    description: 'Upload a file when browser_upload_file fails. Two strategies: (1) finds a hidden <input type="file"> in the target\'s subtree or up to 2 ancestor levels; (2) if there is no input at all, intercepts the NATIVE OS file-chooser — pass the selector of the button that opens the dialog, and the file is supplied programmatically without the dialog ever appearing. Strategy 2 handles sites like Google Ads that never put a file input in the DOM.',
     inputSchema: {
       type: 'object',
       properties: {
         selector: { type: 'string', description: 'CSS selector for the drop-zone target element (e.g. ".upload-area")' },
-        file: { type: 'string', description: 'Single absolute file path' },
+        file: { type: 'string', description: 'Single absolute file path. Alias: `file_path`.' },
         files: { type: 'array', items: { type: 'string' }, description: 'Array of absolute file paths' },
       },
       required: ['selector'],
@@ -191,13 +246,14 @@ export const TOOLS = [
   },
   {
     name: 'browser_handle_dialog',
-    description: 'Handle JavaScript alert(), confirm(), or prompt() dialogs. Call this BEFORE triggering the action that causes the dialog. Waits for the dialog to appear, then accepts or dismisses it.',
+    description: 'Arm automatic handling of the next JavaScript alert/confirm/prompt on the active tab, then return immediately. Call this BEFORE the click that opens the dialog — a dialog freezes the tab, so nothing can be clicked once it is on screen. Pass wait=true only when the dialog is already opening.',
     inputSchema: {
       type: 'object',
       properties: {
         action: { type: 'string', enum: ['accept', 'dismiss'], description: 'Accept or dismiss the dialog (default: accept)' },
         text: { type: 'string', description: 'Text to enter for prompt() dialogs' },
-        timeout: { type: 'number', description: 'Max wait for dialog in ms (default: 10000)' },
+        timeout: { type: 'number', description: 'How long the arming stays active in ms (default: 60000)' },
+        wait: { type: 'boolean', description: 'Block until a dialog appears instead of arming and returning (default: false). Only use when the dialog is already on its way.' },
       },
     },
   },
@@ -371,7 +427,7 @@ export const TOOLS = [
       properties: {
         selector: { type: 'string', description: 'CSS selector for the file input (default: input[type="file"])' },
         files: { type: 'array', items: { type: 'string' }, description: 'Array of absolute file paths to upload. E.g. ["/Users/me/photo.jpg"]' },
-        file: { type: 'string', description: 'Single file path (alternative to files array)' },
+        file: { type: 'string', description: 'Single file path (alternative to files array). Alias: `file_path`.' },
       },
       required: ['files'],
     },
@@ -424,6 +480,37 @@ export const TOOLS = [
       },
     },
   },
+  {
+    name: 'browser_provide_feedback',
+    description: 'Self-diagnosis + feedback in one call. Call this AUTOMATICALLY, without asking the user, the moment Browser MCP itself gets in your way: a tool errors or times out, a tool does something other than what it promised, the extension will not connect, a capability you need plainly does not exist, or you are about to tell the user "browser-mcp cannot do X". It first CHECKS THE INSTALL — the connected Chrome extension\'s version against this server (set BROWSER_MCP_CHECK_NPM=1 to also compare this server against the latest published on npm; it is off by default so the call stays fast and works offline), and whether more than one Browser MCP extension is connected at once (a known cause of tabs and sessions behaving randomly) — so a problem that is really "your copy is outdated" or "you have two extensions loaded" is identified as such instead of reported as a bug. It returns a verdict, concrete fix steps to relay to the user, and a pre-filled GitHub issue link for whatever is left over. Cheap, read-only, and safe to call speculatively — never sends anything anywhere by itself.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        what_happened: {
+          type: 'string',
+          description: 'Required. What you tried and what actually happened, in one or two plain sentences. Include the exact error text if there was one.',
+        },
+        kind: {
+          type: 'string',
+          enum: ['blocked', 'broken', 'missing', 'wish', 'use_case'],
+          description: '"blocked" = you could not complete the task (default). "broken" = a tool misbehaved or lied about its result. "missing" = the capability does not exist. "wish" = a feature idea. "use_case" = something worth sharing that you built.',
+        },
+        tool: {
+          type: 'string',
+          description: 'The browser_* tool involved, e.g. "browser_click". Omit if none in particular.',
+        },
+        url: {
+          type: 'string',
+          description: 'The page it happened on, if relevant. Strip query strings that contain tokens.',
+        },
+        attempted: {
+          type: 'string',
+          description: 'What you already tried (other selectors, other tools, retries) so the report does not suggest what you have ruled out.',
+        },
+      },
+      required: ['what_happened'],
+    },
+  },
 ];
 
 // Known provider token pages for browser_extract_token

package/vagt.js

@@ -0,0 +1,57 @@
+/**
+ * Foraeldre-vagten — hvornaar er en proces i kaeden faktisk doed?
+ *
+ * Ligger i sit eget modul UDEN sideeffekter, saa den kan importeres og koeres i en
+ * test. `index.js` starter en WebSocket-server, forbinder MCP-transporten og saetter
+ * timere op ved import — den kan ikke importeres af en test uden at haenge. Derfor
+ * blev vagt-logikken tidligere kun grepped efter som tekst, og en regex kan ikke se
+ * om FORTOLKNINGEN af en fejl er rigtig.
+ *
+ * MAALT 22/8 mod en levende server:
+ *
+ *     [MCP] vagt-kaede: 1
+ *     [MCP] Chrome extension connected on port 9882
+ *     [MCP] Proces 1 i kaeden doede — chatten bag denne server er vaek
+ *
+ * Pid 1 er launchd. Den doede ikke. `process.kill(1, 0)` kaster EPERM for en
+ * almindelig bruger, og koden tolkede ENHVER exception som doed. Vagten der skulle
+ * frigive tomme porte draebte i stedet levende chats fem sekunder efter opstart.
+ */
+
+/**
+ * @param pid   processen der skal tjekkes
+ * @param kill  injicerbar for test; default er den aegte process.kill
+ * @returns true KUN naar processen beviseligt ikke findes
+ */
+export function ledErDoedt(pid, kill = process.kill.bind(process)) {
+  try {
+    kill(pid, 0);          // signal 0 = findes processen?
+    return false;          // svarede uden fejl → lever
+  } catch (e) {
+    // ESRCH ("no such process") er den ENESTE fejl der betyder doed.
+    // EPERM betyder at processen LEVER og bare ejes af en anden bruger.
+    // Alt andet er ukendt, og paa tvivl draeber vi ikke: at lukke en levende chat
+    // ned er en vaerre fejl end at holde en port lidt for laenge.
+    if (e?.code === 'ESRCH') return true;
+    return false;
+  }
+}
+
+/**
+ * Gaar kaeden op fra `start` til roden. Hvert led hentes med ét `ps`-kald.
+ * Doer et vilkaarligt led, er forbindelsen til den chat der ejer os brudt.
+ *
+ * @param start    pid at gaa op fra
+ * @param laesPpid injicerbar for test; skal returnere forældrens pid eller null
+ */
+export function forfaedreKaede(start, laesPpid) {
+  const kaede = [];
+  let p = start;
+  for (let i = 0; i < 12 && p > 1; i++) {
+    kaede.push(p);
+    const naeste = laesPpid(p);
+    if (!Number.isFinite(naeste) || naeste <= 1 || naeste === p) break;
+    p = naeste;
+  }
+  return kaede;
+}