@jobshimo/browser-link 0.41.0 → 0.42.0

package/dist/admin/i18n.js

@@ -0,0 +1,203 @@
+const v = (version) => (version === null ? 'unversioned' : `v${version}`);
+export const ADMIN_I18N = {
+    en: {
+        ui: {
+            confirm: 'Confirm',
+            cancel: 'Cancel',
+            apply: 'Apply',
+            notConnected: 'Connect a tab to manage browser-link from here.',
+            restartRequired: 'Restart your MCP client for this change to take effect.',
+            changed: 'Saved.',
+        },
+        sections: { status: 'Status', setup: 'Setup', diagnose: 'Diagnose', reference: 'Reference' },
+        on: 'on',
+        off: 'off',
+        unknown: 'unknown',
+        server: 'Server',
+        serverRunning: (version) => `running v${version}`,
+        serverNotRunning: 'not running',
+        serverNotRunningHint: 'Your MCP client starts it; open a session that uses browser-link.',
+        installed: 'Installed version',
+        installedOutdated: (installed) => `${installed} (outdated: restart needed)`,
+        pid: 'PID',
+        uptime: 'Uptime',
+        tabs: 'Tabs connected',
+        tabsUnknownHint: 'Only the running server knows; open the extension popup.',
+        ports: 'Ports',
+        multiAgentStatus: 'Multi-agent',
+        extension: 'Extension',
+        extensionAligned: (version) => `v${version} (aligned)`,
+        extensionMismatch: (ext, server) => `v${ext} (server v${server}: reload or update one)`,
+        extensionNotConnected: 'no tab connected',
+        instructionsFor: (client) => `Instructions — ${client}`,
+        instructionsState: (state) => {
+            switch (state.kind) {
+                case 'installed':
+                    return `installed ${v(state.version)}`;
+                case 'installed-outdated':
+                    return `outdated ${v(state.version)}`;
+                case 'not-installed':
+                    return 'not installed';
+                case 'no-file':
+                    return 'no instructions file';
+                case 'corrupt':
+                    return 'corrupt (fix it by hand)';
+            }
+        },
+        cdpDirect: 'cdp-direct',
+        cdpDirectGranted: (minutes) => minutes === null ? 'on, granted (no expiry)' : `on, granted (${minutes} min left)`,
+        cdpDirectNoGrant: 'on, no active grant (browser-link cdp allow)',
+        update: 'Updates',
+        updateAvailable: (latest) => `v${latest} available`,
+        upToDate: 'up to date',
+        activity: 'Activity trail',
+        language: 'Language',
+        tool: (name) => `Tool ${name}`,
+        multiAgent: 'Multi-agent mode',
+        autoReelect: 'Auto-reelect on primary close',
+        instructionsAutoRefresh: 'Refresh the instructions block at server start',
+        cdpDirectEnabled: 'cdp-direct enabled',
+        cdpDirectPort: 'cdp-direct port',
+        cdpDirectGrantTtl: 'cdp-direct grant lifetime',
+        minutes: (n) => `${n} min`,
+        never: 'never expires',
+        activityEnabled: 'Record the activity trail',
+        activityRecordPayloads: 'Record tool payloads in the trail',
+        downloadsDir: 'Downloads folder',
+        idleTtl: 'Idle disconnect',
+        idleTtlHint: "Change it in the popup's Idle disconnect control or with browser-link config set idle-ttl",
+        flowRecording: 'Flow recording',
+        flowRecordingHint: "Change it in the popup's flow recording control or with browser-link config set flow-recording",
+        popupDefault: 'popup choice',
+        doctor: 'Run doctor',
+        updatesCheck: 'Check for updates',
+        instructionsInstall: (client) => `Install instructions block — ${client}`,
+        instructionsUninstall: (client) => `Remove instructions block — ${client}`,
+        register: (client) => `Register with ${client}`,
+        registered: 'registered',
+        notRegistered: 'not registered',
+        stop: 'Stop the server / free the port',
+        stopDescription: 'Ends the running server, so it is only available from a terminal.',
+        selfUpdate: 'Update browser-link',
+        selfUpdateDescription: 'Replaces the running server, so it is only available from a terminal.',
+        about: 'About',
+        aboutText: 'browser-link is an MCP server that lets agents observe and act on the Chrome tabs you connect.',
+        repo: 'GitHub repository',
+        extensionPath: 'Extension folder',
+        extensionNotFound: 'not found next to the server',
+        unknownAction: (id) => `Unknown admin action: ${id}`,
+        notAnAction: (id) => `${id} is read-only`,
+        invalidValue: (id) => `Invalid value for ${id}`,
+        previewToolOn: (name) => `Enable tool ${name} for every agent`,
+        previewToolOff: (name) => `Disable tool ${name} for every agent`,
+        previewToggle: (label, on) => `Turn ${on ? 'on' : 'off'}: ${label}`,
+        previewSelect: (label, option) => `Set ${label} to ${option}`,
+        previewInstall: (client) => `Write the browser-link instructions block into ${client}'s file`,
+        previewUninstall: (client) => `Remove the browser-link instructions block from ${client}'s file`,
+        previewRegister: (client) => `Register browser-link in ${client}'s MCP config`,
+    },
+    es: {
+        ui: {
+            confirm: 'Confirmar',
+            cancel: 'Cancelar',
+            apply: 'Aplicar',
+            notConnected: 'Conectá una pestaña para administrar browser-link desde acá.',
+            restartRequired: 'Reiniciá tu cliente MCP para que el cambio tenga efecto.',
+            changed: 'Guardado.',
+        },
+        sections: {
+            status: 'Estado',
+            setup: 'Configuración',
+            diagnose: 'Diagnóstico',
+            reference: 'Referencia',
+        },
+        on: 'activado',
+        off: 'desactivado',
+        unknown: 'desconocido',
+        server: 'Servidor',
+        serverRunning: (version) => `en marcha v${version}`,
+        serverNotRunning: 'detenido',
+        serverNotRunningHint: 'Lo arranca tu cliente MCP; abrí una sesión que use browser-link.',
+        installed: 'Versión instalada',
+        installedOutdated: (installed) => `${installed} (desactualizado: hace falta reiniciar)`,
+        pid: 'PID',
+        uptime: 'Tiempo en marcha',
+        tabs: 'Pestañas conectadas',
+        tabsUnknownHint: 'Solo lo sabe el servidor en marcha; abrí el popup de la extensión.',
+        ports: 'Puertos',
+        multiAgentStatus: 'Multi-agente',
+        extension: 'Extensión',
+        extensionAligned: (version) => `v${version} (alineada)`,
+        extensionMismatch: (ext, server) => `v${ext} (servidor v${server}: recargá o actualizá uno de los dos)`,
+        extensionNotConnected: 'ninguna pestaña conectada',
+        instructionsFor: (client) => `Instrucciones — ${client}`,
+        instructionsState: (state) => {
+            switch (state.kind) {
+                case 'installed':
+                    return `instalado ${state.version === null ? 'sin versión' : `v${state.version}`}`;
+                case 'installed-outdated':
+                    return `desactualizado ${state.version === null ? 'sin versión' : `v${state.version}`}`;
+                case 'not-installed':
+                    return 'no instalado';
+                case 'no-file':
+                    return 'sin archivo de instrucciones';
+                case 'corrupt':
+                    return 'corrupto (arreglalo a mano)';
+            }
+        },
+        cdpDirect: 'cdp-direct',
+        cdpDirectGranted: (minutes) => minutes === null
+            ? 'activado, con permiso (sin vencimiento)'
+            : `activado, con permiso (quedan ${minutes} min)`,
+        cdpDirectNoGrant: 'activado, sin permiso vigente (browser-link cdp allow)',
+        update: 'Actualizaciones',
+        updateAvailable: (latest) => `v${latest} disponible`,
+        upToDate: 'al día',
+        activity: 'Registro de actividad',
+        language: 'Idioma',
+        tool: (name) => `Tool ${name}`,
+        multiAgent: 'Modo multi-agente',
+        autoReelect: 'Re-elección automática al cerrar el primary',
+        instructionsAutoRefresh: 'Refrescar el bloque de instrucciones al arrancar el servidor',
+        cdpDirectEnabled: 'cdp-direct activado',
+        cdpDirectPort: 'Puerto de cdp-direct',
+        cdpDirectGrantTtl: 'Duración del permiso de cdp-direct',
+        minutes: (n) => `${n} min`,
+        never: 'no vence',
+        activityEnabled: 'Guardar el registro de actividad',
+        activityRecordPayloads: 'Guardar los payloads de las tools en el registro',
+        downloadsDir: 'Carpeta de descargas',
+        idleTtl: 'Desconexión por inactividad',
+        idleTtlHint: 'Se cambia desde el popup (Desconexión por inactividad) o con browser-link config set idle-ttl',
+        flowRecording: 'Grabación de flows',
+        flowRecordingHint: 'Se cambia desde el popup (grabación de flows) o con browser-link config set flow-recording',
+        popupDefault: 'lo elegido en el popup',
+        doctor: 'Ejecutar doctor',
+        updatesCheck: 'Buscar actualizaciones',
+        instructionsInstall: (client) => `Instalar el bloque de instrucciones — ${client}`,
+        instructionsUninstall: (client) => `Quitar el bloque de instrucciones — ${client}`,
+        register: (client) => `Registrar en ${client}`,
+        registered: 'registrado',
+        notRegistered: 'sin registrar',
+        stop: 'Detener el servidor / liberar el puerto',
+        stopDescription: 'Termina el servidor en marcha, por eso solo se hace desde una terminal.',
+        selfUpdate: 'Actualizar browser-link',
+        selfUpdateDescription: 'Reemplaza el servidor en marcha, por eso solo se hace desde una terminal.',
+        about: 'Acerca de',
+        aboutText: 'browser-link es un servidor MCP que deja a los agentes ver y actuar sobre las pestañas de Chrome que conectás.',
+        repo: 'Repositorio en GitHub',
+        extensionPath: 'Carpeta de la extensión',
+        extensionNotFound: 'no se encontró junto al servidor',
+        unknownAction: (id) => `Acción de administración desconocida: ${id}`,
+        notAnAction: (id) => `${id} es de solo lectura`,
+        invalidValue: (id) => `Valor inválido para ${id}`,
+        previewToolOn: (name) => `Habilitar la tool ${name} para todos los agentes`,
+        previewToolOff: (name) => `Deshabilitar la tool ${name} para todos los agentes`,
+        previewToggle: (label, on) => `${on ? 'Activar' : 'Desactivar'}: ${label}`,
+        previewSelect: (label, option) => `Cambiar ${label} a ${option}`,
+        previewInstall: (client) => `Escribir el bloque de instrucciones de browser-link en el archivo de ${client}`,
+        previewUninstall: (client) => `Quitar el bloque de instrucciones de browser-link del archivo de ${client}`,
+        previewRegister: (client) => `Registrar browser-link en la configuración MCP de ${client}`,
+    },
+};
+//# sourceMappingURL=i18n.js.map

package/dist/admin/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/admin/i18n.ts"],"names":[],"mappings":"AA2FA,MAAM,CAAC,GAAG,CAAC,OAAsB,EAAU,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;AAEjG,MAAM,CAAC,MAAM,UAAU,GAAgC;IACrD,EAAE,EAAE;QACF,EAAE,EAAE;YACF,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,OAAO;YACd,YAAY,EAAE,iDAAiD;YAC/D,eAAe,EAAE,yDAAyD;YAC1E,OAAO,EAAE,QAAQ;SAClB;QACD,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE;QAC5F,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,KAAK;QACV,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,OAAO,EAAE;QACjD,gBAAgB,EAAE,aAAa;QAC/B,oBAAoB,EAAE,mEAAmE;QACzF,SAAS,EAAE,mBAAmB;QAC9B,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,6BAA6B;QAC3E,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,gBAAgB;QACtB,eAAe,EAAE,0DAA0D;QAC3E,KAAK,EAAE,OAAO;QACd,gBAAgB,EAAE,aAAa;QAC/B,SAAS,EAAE,WAAW;QACtB,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,YAAY;QACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,aAAa,MAAM,yBAAyB;QACvF,qBAAqB,EAAE,kBAAkB;QACzC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,MAAM,EAAE;QACvD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,OAAO,aAAa,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,KAAK,oBAAoB;oBACvB,OAAO,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,KAAK,eAAe;oBAClB,OAAO,eAAe,CAAC;gBACzB,KAAK,SAAS;oBACZ,OAAO,sBAAsB,CAAC;gBAChC,KAAK,SAAS;oBACZ,OAAO,0BAA0B,CAAC;YACtC,CAAC;QACH,CAAC;QACD,SAAS,EAAE,YAAY;QACvB,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,gBAAgB,OAAO,YAAY;QACpF,gBAAgB,EAAE,8CAA8C;QAChE,MAAM,EAAE,SAAS;QACjB,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,YAAY;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;QAC9B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,+BAA+B;QAC5C,uBAAuB,EAAE,gDAAgD;QACzE,gBAAgB,EAAE,oBAAoB;QACtC,aAAa,EAAE,iBAAiB;QAChC,iBAAiB,EAAE,2BAA2B;QAC9C,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM;QAC1B,KAAK,EAAE,eAAe;QACtB,eAAe,EAAE,2BAA2B;QAC5C,sBAAsB,EAAE,mCAAmC;QAC3D,YAAY,EAAE,kBAAkB;QAChC,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,2FAA2F;QAC7F,aAAa,EAAE,gBAAgB;QAC/B,iBAAiB,EACf,gGAAgG;QAClG,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,mBAAmB;QACjC,mBAAmB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,MAAM,EAAE;QACzE,qBAAqB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,MAAM,EAAE;QAC1E,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,MAAM,EAAE;QAC/C,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,iCAAiC;QACvC,eAAe,EAAE,mEAAmE;QACpF,UAAU,EAAE,qBAAqB;QACjC,qBAAqB,EAAE,uEAAuE;QAC9F,KAAK,EAAE,OAAO;QACd,SAAS,EACP,gGAAgG;QAClG,IAAI,EAAE,mBAAmB;QACzB,aAAa,EAAE,kBAAkB;QACjC,iBAAiB,EAAE,8BAA8B;QACjD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE;QACpD,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,eAAe;QACzC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,EAAE,EAAE;QAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,IAAI,kBAAkB;QAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,IAAI,kBAAkB;QAChE,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE;QACnE,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,MAAM,EAAE;QAC7D,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kDAAkD,MAAM,SAAS;QAC7F,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3B,mDAAmD,MAAM,SAAS;QACpE,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,MAAM,eAAe;KAC/E;IACD,EAAE,EAAE;QACF,EAAE,EAAE;YACF,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,8DAA8D;YAC5E,eAAe,EAAE,0DAA0D;YAC3E,OAAO,EAAE,WAAW;SACrB;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,YAAY;SACxB;QACD,EAAE,EAAE,UAAU;QACd,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,UAAU;QAClB,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,OAAO,EAAE;QACnD,gBAAgB,EAAE,UAAU;QAC5B,oBAAoB,EAAE,kEAAkE;QACxF,SAAS,EAAE,mBAAmB;QAC9B,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,yCAAyC;QACvF,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,eAAe,EAAE,oEAAoE;QACrF,KAAK,EAAE,SAAS;QAChB,gBAAgB,EAAE,cAAc;QAChC,SAAS,EAAE,WAAW;QACtB,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,aAAa;QACvD,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACjC,IAAI,GAAG,eAAe,MAAM,uCAAuC;QACrE,qBAAqB,EAAE,2BAA2B;QAClD,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,EAAE;QACxD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,OAAO,aAAa,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrF,KAAK,oBAAoB;oBACvB,OAAO,kBAAkB,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1F,KAAK,eAAe;oBAClB,OAAO,cAAc,CAAC;gBACxB,KAAK,SAAS;oBACZ,OAAO,8BAA8B,CAAC;gBACxC,KAAK,SAAS;oBACZ,OAAO,6BAA6B,CAAC;YACzC,CAAC;QACH,CAAC;QACD,SAAS,EAAE,YAAY;QACvB,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,iCAAiC,OAAO,OAAO;QACrD,gBAAgB,EAAE,wDAAwD;QAC1E,MAAM,EAAE,iBAAiB;QACzB,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,aAAa;QACpD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;QAC9B,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,6CAA6C;QAC1D,uBAAuB,EAAE,8DAA8D;QACvF,gBAAgB,EAAE,qBAAqB;QACvC,aAAa,EAAE,sBAAsB;QACrC,iBAAiB,EAAE,oCAAoC;QACvD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM;QAC1B,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,kCAAkC;QACnD,sBAAsB,EAAE,kDAAkD;QAC1E,YAAY,EAAE,sBAAsB;QACpC,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,+FAA+F;QACjG,aAAa,EAAE,oBAAoB;QACnC,iBAAiB,EACf,4FAA4F;QAC9F,YAAY,EAAE,wBAAwB;QACtC,MAAM,EAAE,iBAAiB;QACzB,YAAY,EAAE,wBAAwB;QACtC,mBAAmB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,yCAAyC,MAAM,EAAE;QAClF,qBAAqB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uCAAuC,MAAM,EAAE;QAClF,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,MAAM,EAAE;QAC9C,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,eAAe;QAC9B,IAAI,EAAE,yCAAyC;QAC/C,eAAe,EAAE,yEAAyE;QAC1F,UAAU,EAAE,yBAAyB;QACrC,qBAAqB,EACnB,2EAA2E;QAC7E,KAAK,EAAE,WAAW;QAClB,SAAS,EACP,gHAAgH;QAClH,IAAI,EAAE,uBAAuB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,iBAAiB,EAAE,kCAAkC;QACrD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,yCAAyC,EAAE,EAAE;QACpE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,qBAAqB;QAC/C,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,EAAE,EAAE;QACjD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,IAAI,yBAAyB;QAC3E,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,IAAI,yBAAyB;QAC/E,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,EAAE;QAC1E,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,MAAM,EAAE;QAChE,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CACzB,wEAAwE,MAAM,EAAE;QAClF,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3B,oEAAoE,MAAM,EAAE;QAC9E,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qDAAqD,MAAM,EAAE;KAC3F;CACF,CAAC"}

package/dist/admin/primary.d.ts

@@ -0,0 +1,21 @@
+import { type UpdateCheckResult } from '../commands/update-check.js';
+import type { AdminHandlers } from '../bridge/ws-bridge.js';
+/**
+ * The primary's admin handlers for the WS bridge. In process: the server
+ * rows describe this very process, the tab count and the extension version
+ * come from the live sessions. The update check never runs at boot: the
+ * first `admin.describe` starts one in the background (honouring the 6 h
+ * disk cache) and later states carry its result; the `updates.check` button
+ * forces a fresh one. `doctor` runs only on its button, because it is slow.
+ */
+export interface PrimaryAdminOptions {
+    version: string;
+    tabsConnected: () => number;
+    connectedExtensionVersion: () => string | null;
+    /** Test seams; production leaves them unset. */
+    checkUpdates?: (opts: {
+        force?: boolean;
+    }) => Promise<UpdateCheckResult>;
+    doctor?: () => Promise<string[]>;
+}
+export declare function createPrimaryAdminHandlers(opts: PrimaryAdminOptions): AdminHandlers;

package/dist/admin/primary.js

@@ -0,0 +1,56 @@
+import { loadConfig } from '../config.js';
+import { buildServerStatus } from '../commands/doctor.js';
+import { checkForUpdates } from '../commands/update-check.js';
+import { formatUpdate } from '../commands/updates.js';
+import { buildVersionInfo } from '../lifecycle/version-endpoint.js';
+import { readInstalledVersion } from '../version.js';
+import { applyAdminAction } from './actions.js';
+import { adminLanguage, buildAdminState } from './descriptor.js';
+import { gatherAdminInput } from './sources.js';
+async function runDoctorLines() {
+    const { runDoctor, formatDoctor } = await import('../commands/doctor.js');
+    return formatDoctor(await runDoctor(), adminLanguage(loadConfig())).split('\n');
+}
+export function createPrimaryAdminHandlers(opts) {
+    const check = opts.checkUpdates ?? checkForUpdates;
+    let update = null;
+    let backgroundCheck = null;
+    const input = () => gatherAdminInput({
+        server: () => Promise.resolve(buildServerStatus({ kind: 'version', info: buildVersionInfo(opts.version) }, readInstalledVersion())),
+        version: opts.version,
+        tabsConnected: opts.tabsConnected,
+        connectedExtensionVersion: opts.connectedExtensionVersion,
+        update: () => update,
+    });
+    const startBackgroundCheck = () => {
+        if (backgroundCheck)
+            return;
+        backgroundCheck = check({})
+            .then((r) => {
+            update = { latest: r.latest, isNewer: r.isNewer };
+        })
+            .catch(() => {
+            /* passive: an unreachable registry leaves "unknown" */
+        });
+    };
+    const checkUpdatesLines = async () => {
+        const r = await check({ force: true });
+        update = { latest: r.latest, isNewer: r.isNewer };
+        const info = r.latest === null
+            ? { current: r.current, latest: null, newer: null }
+            : { current: r.current, latest: r.latest, newer: r.isNewer };
+        return formatUpdate(info, adminLanguage(loadConfig())).split('\n');
+    };
+    return {
+        describe: async () => {
+            startBackgroundCheck();
+            return buildAdminState(await input());
+        },
+        action: (req) => applyAdminAction(req, {
+            input,
+            doctor: opts.doctor ?? runDoctorLines,
+            checkUpdates: checkUpdatesLines,
+        }),
+    };
+}
+//# sourceMappingURL=primary.js.map

package/dist/admin/primary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primary.js","sourceRoot":"","sources":["../../src/admin/primary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAA0B,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAmB,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAoBhD,KAAK,UAAU,cAAc;IAC3B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC1E,OAAO,YAAY,CAAC,MAAM,SAAS,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAyB;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC;IACnD,IAAI,MAAM,GAAuD,IAAI,CAAC;IACtE,IAAI,eAAe,GAAyB,IAAI,CAAC;IAEjD,MAAM,KAAK,GAAG,GAAwB,EAAE,CACtC,gBAAgB,CAAC;QACf,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,OAAO,CACb,iBAAiB,CACf,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EACzD,oBAAoB,EAAE,CACvB,CACF;QACH,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;KACrB,CAAC,CAAC;IAEL,MAAM,oBAAoB,GAAG,GAAS,EAAE;QACtC,IAAI,eAAe;YAAE,OAAO;QAC5B,eAAe,GAAG,KAAK,CAAC,EAAE,CAAC;aACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,uDAAuD;QACzD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,IAAuB,EAAE;QACtD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YACnD,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACjE,OAAO,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,oBAAoB,EAAE,CAAC;YACvB,OAAO,eAAe,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,gBAAgB,CAAC,GAAG,EAAE;YACpB,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,cAAc;YACrC,YAAY,EAAE,iBAAiB;SAChC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/admin/sources.d.ts

@@ -0,0 +1,22 @@
+import { type DoctorServerStatus } from '../commands/doctor.js';
+import type { AdminInput } from './descriptor.js';
+export interface AdminSourceOptions {
+    /** The running primary against the installed version. */
+    server: () => Promise<DoctorServerStatus>;
+    /** `null` when unknown (out of process). */
+    tabsConnected?: () => number | null;
+    /** Version a connected tab's extension reported; `null` when none did. */
+    connectedExtensionVersion?: () => string | null;
+    /** Version of the running server; default this module's `VERSION`. */
+    version?: string;
+    /** Last known update check; `null` when none ran yet. */
+    update?: () => {
+        latest: string | null;
+        isNewer: boolean;
+    } | null;
+    now?: () => number;
+}
+export declare function gatherAdminInput(opts: AdminSourceOptions): Promise<AdminInput>;
+/** The console's view of the running primary: its `/version`, or "not
+ * running" when nothing answers. */
+export declare function probeRunningServer(): Promise<DoctorServerStatus>;

package/dist/admin/sources.js

@@ -0,0 +1,82 @@
+import { loadConfig } from '../config.js';
+import { IPC_PORT } from '../bridge/protocol.js';
+import { detectInstructionsStatus } from '../manual/status.js';
+import { INSTALLERS } from '../installers/index.js';
+import { isGrantLive, loadGrant, remainingMs } from '../cdp/grant.js';
+import { resolveDownloadsDir } from '../downloads.js';
+import { getDataDir } from '../map/paths.js';
+import { TOOL_CATALOGUE } from '../permissions.js';
+import { resolveExtensionPath } from '../commands/extension.js';
+import { buildServerStatus } from '../commands/doctor.js';
+import { probeVersion } from '../lifecycle/election.js';
+import { VERSION, readInstalledVersion } from '../version.js';
+/**
+ * Gathers the facts `buildAdminState` needs from the real machine. Shared by
+ * the primary (in process: it knows its tabs and is the running server) and
+ * the console's status view (out of process: it asks the primary's
+ * `/version`, and the tab count stays unknown). Every source is a
+ * best-effort read: one that throws degrades to an empty or unknown value.
+ */
+/** The WS bridge port; `ws-bridge.ts` owns it, repeated here (as `doctor`
+ * does) so the console does not load the bridge to read a number. */
+const WS_BRIDGE_PORT = 17529;
+function safe(read, fallback) {
+    try {
+        return read();
+    }
+    catch {
+        return fallback;
+    }
+}
+function detectClients() {
+    const out = [];
+    for (const installer of INSTALLERS) {
+        try {
+            const d = installer.detect();
+            out.push({
+                id: installer.id,
+                displayName: installer.displayName,
+                installed: d.installed,
+                registered: d.registered,
+            });
+        }
+        catch {
+            /* best effort: an unreadable client is left out */
+        }
+    }
+    return out;
+}
+export async function gatherAdminInput(opts) {
+    const config = safe(() => loadConfig(), {});
+    const grant = safe(() => loadGrant(), null);
+    const now = opts.now?.() ?? Date.now();
+    const server = await opts.server().catch(() => ({
+        running: null,
+        installed: readInstalledVersion(),
+        outdated: false,
+    }));
+    return {
+        config,
+        now,
+        version: opts.version ?? VERSION,
+        server,
+        tabsConnected: opts.tabsConnected?.() ?? null,
+        ports: { ws: WS_BRIDGE_PORT, ipc: IPC_PORT },
+        extension: {
+            path: safe(() => resolveExtensionPath(), null),
+            connectedVersion: opts.connectedExtensionVersion?.() ?? null,
+        },
+        instructions: safe(() => detectInstructionsStatus(), []),
+        clients: detectClients(),
+        cdpGrant: { live: isGrantLive(grant, now), remainingMs: remainingMs(grant, now) },
+        update: opts.update?.() ?? null,
+        toolNames: TOOL_CATALOGUE.map((t) => t.name),
+        downloadsDir: safe(() => resolveDownloadsDir(config, getDataDir()), ''),
+    };
+}
+/** The console's view of the running primary: its `/version`, or "not
+ * running" when nothing answers. */
+export async function probeRunningServer() {
+    return buildServerStatus(await probeVersion(WS_BRIDGE_PORT), readInstalledVersion());
+}
+//# sourceMappingURL=sources.js.map

package/dist/admin/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../src/admin/sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAA2B,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG9D;;;;;;GAMG;AAEH;qEACqE;AACrE,MAAM,cAAc,GAAG,KAAK,CAAC;AAgB7B,SAAS,IAAI,CAAI,IAAa,EAAE,QAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAwB;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAuB,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,oBAAoB,EAAE;QACjC,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,MAAM;QACN,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;QAChC,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,IAAI;QAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC;YAC9C,gBAAgB,EAAE,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,IAAI;SAC7D;QACD,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,EAAE,EAAE,CAAC;QACxD,OAAO,EAAE,aAAa,EAAE;QACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;QACjF,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;QAC/B,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;oCACoC;AACpC,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,iBAAiB,CAAC,MAAM,YAAY,CAAC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/bridge/ws-bridge.d.ts

@@ -1,5 +1,5 @@
 import { WebSocket, WebSocketServer } from 'ws';
-import type { ActivityPurgeMessage, ActivityQueryMessage, FlowRecordedPayload, ServerToExtension, SettingsUpdateMessage, TabRegisterPayload, TabRegisteredPayload } from '../messages.js';
+import type { ActivityPurgeMessage, AdminActionMessage, AdminActionResult, AdminDescribeMessage, AdminState, ActivityQueryMessage, ExtensionToServer, FlowRecordedPayload, ServerToExtension, SettingsUpdateMessage, TabRegisterPayload, TabRegisteredPayload } from '../messages.js';
 import { type BridgeEventLog } from './events.js';
 export declare const WS_HOST = "127.0.0.1";
 export declare const WS_PORT = 17529;
@@ -26,6 +26,19 @@ export interface WsBridgeOptions {
     /** Starts the popup "Repair connection" restart (see lifecycle/repair.ts).
      * Absent → `bridge.repair` is answered with `ok: false`. */
     onRepair?: () => boolean;
+    /** The admin panel (admin/descriptor.ts, admin/actions.ts), wired by the
+     * primary. Absent → `admin.*` is answered with `ok: false`. */
+    admin?: AdminHandlers;
+}
+/** What the primary hands the bridge to answer `admin.describe` and
+ * `admin.action`. Both may reject; the bridge turns that into `ok: false`. */
+export interface AdminHandlers {
+    describe: () => Promise<AdminState>;
+    action: (req: {
+        id: string;
+        value?: string | number | boolean;
+        confirm?: boolean;
+    }) => Promise<AdminActionResult>;
 }
 /** The effective bind target and reported version. Exported so the
  * defaults are testable without binding the fixed port. */
@@ -47,6 +60,15 @@ export declare function buildTabRegisteredPayload(tabId: string, serverVersion:
  * `WebSocketServer` (same Chromium-only `verifyClient`), `GET /version`
  * answers the election probe and every other plain request is a 404.
  * Closing the returned `WebSocketServer` also closes the HTTP server. */
+/**
+ * Whether a WebSocket handshake's `Origin` may open the bridge. A web page
+ * running inside Chrome passes the peer-process check (the owning process is
+ * Chromium) but always announces its own http(s) origin; only the extension's
+ * own context (`chrome-extension://<id>`) is allowed, and a missing `Origin`
+ * (non-browser clients) is left to the peer-process check. Pure; exported for
+ * tests. Since 0.42.0.
+ */
+export declare function isAllowedHandshakeOrigin(origin: string | undefined): boolean;
 export declare function startWsBridge(tabs: Map<string, TabSession>, pendingRequests: Map<string, PendingRequest>, events: BridgeEventLog, options?: WsBridgeOptions): Promise<WebSocketServer>;
 /**
  * Build the `settings.update` a freshly-registered tab should receive, or
@@ -140,6 +162,21 @@ export declare function handleFlowRecordedMessage(payload: FlowRecordedPayload,
  * audit panel must not take the bridge connection down with it.
  */
 export declare function handleActivityQueryMessage(msg: ActivityQueryMessage): ServerToExtension;
+/**
+ * Answer one `admin.describe` or `admin.action` frame. Exported so it is
+ * unit-testable directly, like `handleActivityQueryMessage`. Never rejects:
+ * a handler that throws, a malformed frame or a bridge without handlers
+ * comes back as `ok: false`. Only the typed fields of an action reach the
+ * handler.
+ */
+export declare function handleAdminMessage(msg: AdminDescribeMessage | AdminActionMessage, admin?: AdminHandlers): Promise<ServerToExtension>;
+/**
+ * The request/response frames the bridge answers without a tab scope:
+ * `activity.query` (synchronous, as before) and `admin.*` (asynchronous).
+ * `null` for every other kind. Exported so the dispatch is testable without
+ * binding the bridge port.
+ */
+export declare function routeRequestMessage(msg: ExtensionToServer, admin?: AdminHandlers): ServerToExtension | Promise<ServerToExtension> | null;
 /**
  * Answer one `activity.purge` frame.
  *

package/dist/bridge/ws-bridge.js

@@ -84,6 +84,19 @@ export function buildTabRegisteredPayload(tabId, serverVersion, installedVersion
  * `WebSocketServer` (same Chromium-only `verifyClient`), `GET /version`
  * answers the election probe and every other plain request is a 404.
  * Closing the returned `WebSocketServer` also closes the HTTP server. */
+/**
+ * Whether a WebSocket handshake's `Origin` may open the bridge. A web page
+ * running inside Chrome passes the peer-process check (the owning process is
+ * Chromium) but always announces its own http(s) origin; only the extension's
+ * own context (`chrome-extension://<id>`) is allowed, and a missing `Origin`
+ * (non-browser clients) is left to the peer-process check. Pure; exported for
+ * tests. Since 0.42.0.
+ */
+export function isAllowedHandshakeOrigin(origin) {
+    if (origin === undefined || origin === '')
+        return true;
+    return origin.startsWith('chrome-extension://');
+}
 export function startWsBridge(tabs, pendingRequests, events, options = {}) {
     const { host, port, version } = resolveBridgeOptions(options);
     return new Promise((resolve, reject) => {
@@ -95,6 +108,13 @@ export function startWsBridge(tabs, pendingRequests, events, options = {}) {
             // Refuse the upgrade unless the OS confirms the peer is a Chromium-based
             // browser. The check happens before any application bytes are exchanged.
             verifyClient: (info, cb) => {
+                // ws fills info.origin from the Origin header (undefined when absent).
+                const origin = info.origin;
+                if (!isAllowedHandshakeOrigin(origin)) {
+                    log(`Rejected WS handshake from origin ${origin}: only the extension may connect.`);
+                    cb(false, 403, 'Origin not allowed');
+                    return;
+                }
                 const remoteAddress = normaliseLoopback(info.req.socket.remoteAddress ?? '');
                 const remotePort = info.req.socket.remotePort;
                 if (!remoteAddress || remotePort == null) {
@@ -274,6 +294,19 @@ export function startWsBridge(tabs, pendingRequests, events, options = {}) {
                     }, options.onRepair);
                     return;
                 }
+                if (msg.kind === 'admin.describe' || msg.kind === 'admin.action') {
+                    // Same boundary as activity.query below: not tab-scoped, any
+                    // authenticated extension connection may ask. The action side is a
+                    // closed allowlist with a confirm step for every disk write
+                    // (admin/actions.ts), so the socket can only reach the writes the
+                    // console already offers. Async (doctor, update check): the reply
+                    // goes out only while the socket is still open.
+                    void handleAdminMessage(msg, options.admin).then((reply) => {
+                        if (ws.readyState === WebSocket.OPEN)
+                            send(ws, reply);
+                    });
+                    return;
+                }
                 if (msg.kind === 'activity.query') {
                     // Read-only and deliberately NOT scoped to `assignedTabId`, unlike
                     // `flow.recorded` above. The Activity window's whole job is showing
@@ -506,6 +539,87 @@ export function handleActivityQueryMessage(msg) {
         };
     }
 }
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const ADMIN_UNAVAILABLE = 'admin panel unavailable';
+/**
+ * Answer one `admin.describe` or `admin.action` frame. Exported so it is
+ * unit-testable directly, like `handleActivityQueryMessage`. Never rejects:
+ * a handler that throws, a malformed frame or a bridge without handlers
+ * comes back as `ok: false`. Only the typed fields of an action reach the
+ * handler.
+ */
+export async function handleAdminMessage(msg, admin) {
+    if (msg.kind === 'admin.describe') {
+        if (!admin) {
+            return {
+                kind: 'admin.state',
+                request_id: msg.request_id,
+                ok: false,
+                error: ADMIN_UNAVAILABLE,
+            };
+        }
+        try {
+            return {
+                kind: 'admin.state',
+                request_id: msg.request_id,
+                ok: true,
+                state: await admin.describe(),
+            };
+        }
+        catch (error) {
+            return {
+                kind: 'admin.state',
+                request_id: msg.request_id,
+                ok: false,
+                error: errorMessage(error),
+            };
+        }
+    }
+    const fail = (error) => ({
+        kind: 'admin.action.result',
+        request_id: msg.request_id,
+        result: { ok: false, error },
+    });
+    if (!admin)
+        return fail(ADMIN_UNAVAILABLE);
+    const raw = msg.id;
+    if (typeof raw !== 'string')
+        return fail('admin.action: id must be a string');
+    const value = msg.value;
+    const req = {
+        id: raw,
+        ...(typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean'
+            ? { value }
+            : {}),
+        ...(msg.confirm === true ? { confirm: true } : {}),
+    };
+    try {
+        return {
+            kind: 'admin.action.result',
+            request_id: msg.request_id,
+            result: await admin.action(req),
+        };
+    }
+    catch (error) {
+        return fail(errorMessage(error));
+    }
+}
+/**
+ * The request/response frames the bridge answers without a tab scope:
+ * `activity.query` (synchronous, as before) and `admin.*` (asynchronous).
+ * `null` for every other kind. Exported so the dispatch is testable without
+ * binding the bridge port.
+ */
+export function routeRequestMessage(msg, admin) {
+    if (msg.kind === 'activity.query')
+        return handleActivityQueryMessage(msg);
+    if (msg.kind === 'admin.describe' || msg.kind === 'admin.action') {
+        return handleAdminMessage(msg, admin);
+    }
+    return null;
+}
 /** camelCase store shape → snake_case wire shape. One mapper so the two can
  * never drift into reporting different numbers under the same name. */
 function toStatsPayload(s) {