@agent360/browser-mcp 1.29.0 → 1.29.1

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Agent360 Browser MCP",
-  "version": "1.29.0",
+  "version": "1.29.1",
   "description": "Give Claude Code your real logged-in Chrome. Two parts: this extension + one npx command. Multi-session, local, MIT.",
   "permissions": [
     "tabs",

package/extension/offscreen.js

@@ -14,12 +14,54 @@
 // samtidig den rigtige semantik: et dokument oprettet af en aeldre udgave baerer
 // den aeldre version, saa `offscreenSvarer()` kan se forskel paa "svarer" og
 // "er den udgave vi koerer nu".
+// Plan 1.10 / R2 (Astra): versionsnummeret beviser ikke hvilken KODE der koerer - to kopier med samme nummer kan vaere
+// forskellige, og udgivelsens flowtest kunne derfor godkendes mod gammel kode. Udvidelsen sender derfor et fingeraftryk af
+// sin egen background.js. Kun et hash, og kun til 127.0.0.1: ingen kode forlader maskinen.
+// MAALT 12/9: aftrykket daekkede kun background.js. Samme dag aendrede offscreen.js sig, og den aendring var USYNLIG for
+// udgivelsens spaerre - en gammel kopi af broen kunne passere som kandidaten. Begge kodefiler taeller nu med, i fast
+// raekkefoelge. Det er stadig en byggekontrol: filerne laeses fra den indlaeste udvidelses egen mappe, saa aftrykket
+// beviser hvilke FILER der er indlaest - ikke hvilken kode der koerer i et gammelt offscreen-dokument.
+const KODEFILER = ['background.js', 'offscreen.js'];
+let kodeAftrykCache = null;
+async function kodeAftryk() {
+  if (kodeAftrykCache) return kodeAftrykCache;
+  try {
+    const dele = [];
+    for (const fil of KODEFILER) {
+      const svar = await fetch(chrome.runtime.getURL(fil));
+      dele.push(new Uint8Array(await svar.arrayBuffer()));
+    }
+    const samlet = new Uint8Array(dele.reduce((n, d) => n + d.length, 0));
+    let i = 0;
+    for (const d of dele) { samlet.set(d, i); i += d.length; }
+    const bytes = new Uint8Array(await crypto.subtle.digest('SHA-256', samlet));
+    kodeAftrykCache = Array.from(bytes.slice(0, 6)).map((b) => b.toString(16).padStart(2, '0')).join('');
+  } catch (e) {
+    console.warn('[Offscreen] kunne ikke beregne kode-aftrykket:', e?.message || e);
+  }
+  return kodeAftrykCache;
+}
+
 function minVersion() {
   try { return new URLSearchParams(location.search).get('v') || null; } catch { return null; }
 }
 
-const BASE_PORT = 9876;
-const MAX_PORT = 9895;
+// Portomraadet kommer fra dokumentets egen adresse, sat af background.js ud fra chrome.storage.local.
+// Standarden er 9876-9895. En isoleret testbrowser kan flytte den UDEN at repoets filer aendrer sig, saa
+// kode-aftrykket - og dermed udgivelsens spaerre - er uroert. Vagten staar begge steder: en vaerdi er kun gyldig
+// hvis den er to tal i et fornuftigt spaend. (Astra 12/9.)
+function portOmraade() {
+  try {
+    const v = new URLSearchParams(location.search).get('porte');
+    const m = /^(\d{4,5})-(\d{4,5})$/.exec(v || '');
+    if (m) {
+      const fra = Number(m[1]), til = Number(m[2]);
+      if (fra >= 1024 && til <= 65535 && til >= fra && til - fra < 200) return [fra, til];
+    }
+  } catch {}
+  return [9876, 9895];
+}
+const [BASE_PORT, MAX_PORT] = portOmraade();
 const connections = new Map(); // port → WebSocket
 
 // ── Hvorfor porte foerst PROBES med fetch, og ikke bare aabnes (MAALT 22/8) ──────
@@ -122,7 +164,7 @@ function tryConnect(port) {
     if (ws.readyState !== WebSocket.OPEN) ws.close();
   }, 8000);
 
-  ws.onopen = () => {
+  ws.onopen = async () => {
     clearTimeout(connectTimeout);
     connections.set(port, ws);   // stadig vores? scanPorts har ikke lavet en nyere
 
@@ -141,9 +183,15 @@ function tryConnect(port) {
     // To rettelser: haandtrykket sendes nu UANSET om manifest-opslaget lykkes (det er
     // selve beskeden serveren har brug for, ikke felterne i den), og en fejl bliver
     // logget i stedet for at forsvinde.
-    let hilsen = { type: 'hello', extensionId: null, version: minVersion(), name: null };
+    // MAALT 11/9 af Astra (e2e runde 2): haenger hentningen af background.js, blev haandtrykket ALDRIG sendt - og
+    // serveren saa en forbindelse uden version. Aftrykket er en bekvemmelighed for udgivelsens gate; hilsenen er ikke.
+    // MAALT 12/9 af Astra (efterproevning): fristen paa 1 s var et kaploeb. Tog hentningen 1,3 s, sendte vi `kode: null`,
+    // og udgivelsens gate afviste sin EGEN kandidat - et langsomt svar er ikke et forkert svar. Hilsenen sendes derfor
+    // med det aftryk der allerede ER beregnet (som regel intet ved foerste forbindelse), og aftrykket EFTERSENDES.
+    const kode = kodeAftrykCache;
+    let hilsen = { type: 'hello', extensionId: null, version: minVersion(), name: null, kode };
     try {
-      hilsen = { type: 'hello', extensionId: chrome.runtime.id, version: minVersion(), name: null };
+      hilsen = { type: 'hello', extensionId: chrome.runtime.id, version: minVersion(), name: null, kode };
     } catch (e) {
       console.warn('[Offscreen] kunne ikke bygge haandtrykket:', e?.message || e);
     }
@@ -153,6 +201,15 @@ function tryConnect(port) {
       console.warn('[Offscreen] kunne ikke sende haandtrykket:', e?.message || e);
     }
 
+    // Eftersendelsen: naar aftrykket er beregnet, faar serveren det - uanset hvor lang tid hentningen tog.
+    if (!kode) {
+      kodeAftryk().then((k) => {
+        if (!k || ws.readyState !== WebSocket.OPEN) return;
+        try { ws.send(JSON.stringify({ type: 'kode', kode: k })); }
+        catch (e) { console.warn('[Offscreen] kunne ikke eftersende kode-aftrykket:', e?.message || e); }
+      });
+    }
+
     console.log(`[Offscreen] Connected to MCP server on port ${port} (${connections.size} total)`);
     updateStatus();
   };

package/extension/popup.html

@@ -37,16 +37,18 @@
     .color-purple { border-color: #a855f7; } .color-purple .session-header { color: #a855f7; }
     .color-cyan { border-color: #06b6d4; } .color-cyan .session-header { color: #06b6d4; }
     .color-orange { border-color: #f97316; } .color-orange .session-header { color: #f97316; }
-    /* Shown only while the MCP server is missing — the store can't install it for you */
+    /* Shown only while the MCP server is missing - the store can't install it for you */
     .setup { display: none; background: #1e293b; border: 1px solid #334155; border-left: 3px solid #f59e0b; border-radius: 8px; padding: 10px; margin-bottom: 8px; }
     .setup.show { display: block; }
     .setup p { font-size: 11px; line-height: 1.5; color: #94a3b8; margin-bottom: 8px; }
     .setup p b { color: #e2e8f0; }
     .setup code { display: block; background: #0f172a; border-radius: 6px; padding: 8px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 10px; color: #22c55e; word-break: break-all; margin-bottom: 6px; }
+    /* De andre klienters kommandoer staar inde i en saetning - de maa ikke blive til blokke som hovedkommandoen. */
+    .setup p.clients code { display: inline; padding: 1px 5px; margin: 0; font-size: 10px; }
     .setup .row { display: flex; gap: 6px; }
     .setup .row button, .setup .row a { flex: 1; margin: 0; padding: 6px; border-radius: 6px; background: #334155; color: #e2e8f0; font-size: 11px; text-align: center; text-decoration: none; border: none; cursor: pointer; }
     .setup .row a:hover, .setup .row button:hover { background: #475569; }
-    /* Shown once both halves are up but the agent has not touched a tab yet — the
+    /* Shown once both halves are up but the agent has not touched a tab yet - the
        moment a new user checks "did it work?" and needs to know what to say next. */
     .try { display: none; background: #1e293b; border: 1px solid #334155; border-left: 3px solid #22c55e; border-radius: 8px; padding: 10px; margin-bottom: 8px; }
     .try.show { display: block; }
@@ -66,8 +68,11 @@
   </div>
 
   <div class="setup" id="setup">
-    <p><b>This extension is only half of Browser MCP.</b> It needs a local MCP server to talk to — the Chrome Web Store cannot install that part. Register it once, then restart your agent. Claude Code:</p>
+    <p><b>Already registered the server?</b> Then this is normal: the server only takes a port the first time your agent actually uses the browser. Ask it for a screenshot once, and this turns into "Connected".</p>
+    <p><b>Otherwise: this extension is only half of Browser MCP.</b> It needs a local MCP server to talk to - the Chrome Web Store cannot install that part. Register it once, then restart your agent. Claude Code:</p>
     <code id="setupCmd">claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest</code>
+    <p class="clients">Codex: <code>codex mcp add browser-mcp -- npx @agent360/browser-mcp@latest</code><br>
+      Cursor, VS Code and the rest: run <code>npx @agent360/browser-mcp install</code> - it registers with the clients you have.</p>
     <div class="row">
       <button id="copyCmd">Copy command</button>
       <a href="https://browsermcp.dev/docs/install-claude-code/" target="_blank" rel="noopener">Setup guide</a>
@@ -75,7 +80,7 @@
   </div>
 
   <div class="try" id="try">
-    <p><b>Connected — you're ready.</b> Nothing happens until you ask your agent for something. Try saying:</p>
+    <p><b>Connected - you're ready.</b> Nothing happens until you ask your agent for something. Try saying:</p>
     <span class="prompt">"Take a screenshot of my current Chrome tab."</span>
     <span class="prompt">"Open my Gmail tab and tell me who sent my last 3 emails."</span>
     <a href="https://browsermcp.dev/#try" target="_blank" rel="noopener">More things to try</a>

package/extension/popup.js

@@ -1,17 +1,17 @@
 // ── Status ──────────────────────────────────────────────────────────────────
 
 // mcpCount = agent clients on the socket. `sessions` = agents that have actually claimed a
-// tab. They differ, and showing "Connected — 1 session" above "No active sessions" read as a
+// tab. They differ, and showing "Connected - 1 session" above "No active sessions" read as a
 // contradiction at exactly the moment a new user checks whether the install worked.
 function paintStatus(connected, count, sessionCount) {
   document.getElementById('dot').className = `dot ${connected ? 'on' : 'off'}`;
   document.getElementById('label').textContent = !connected
-    ? 'Not connected — no MCP server found'
+    ? 'Not connected - nothing on ports 9876-9895 yet'
     : sessionCount > 0
-      ? `Connected — ${sessionCount} active session${sessionCount === 1 ? '' : 's'}`
-      : `Connected — ready (${count} agent${count === 1 ? '' : 's'} listening)`;
+      ? `Connected - ${sessionCount} active session${sessionCount === 1 ? '' : 's'}`
+      : `Connected - ready (${count} agent${count === 1 ? '' : 's'} listening)`;
   // The Chrome Web Store can only install the extension. If nothing is listening on
-  // ports 9876-9895, the user almost certainly never ran the npx install — say so.
+  // ports 9876-9895, the user almost certainly never ran the npx install - say so.
   document.getElementById('setup').classList.toggle('show', !connected);
   // Connected but idle: they got it working and now need to know what to say.
   document.getElementById('try').classList.toggle('show', connected && sessionCount === 0);