@mehmoodqureshi/chrome-mcp 0.6.0 → 0.6.3

package/README.md

@@ -1,5 +1,9 @@
 # chrome-mcp
 
+[![CI](https://github.com/Mehmoodqureshi/chrome-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/Mehmoodqureshi/chrome-mcp/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/%40mehmoodqureshi%2Fchrome-mcp?label=npm)](https://www.npmjs.com/package/@mehmoodqureshi/chrome-mcp)
+[![license](https://img.shields.io/npm/l/%40mehmoodqureshi%2Fchrome-mcp?label=license)](LICENSE)
+
 Drive a **real Chrome browser** from Claude (or any MCP host). One pluggable
 `Executor` interface, two backends:
 

package/dist/shared/policy.js

@@ -80,17 +80,38 @@ function hostOf(url) {
 function isAboutBlank(url) {
     return url === 'about:blank' || url === '' || url.startsWith('about:');
 }
+/**
+ * Reduce an allowlist entry to the bare host it constrains. Users routinely paste
+ * a full URL ("https://example.com/app") or a "host:port/path" instead of a bare
+ * host; those forms would never equal a hostname and so silently match nothing.
+ * We strip the scheme, userinfo, port, and path/query/fragment, preserving a
+ * leading "*." wildcard and the two catch-all forms. Returns '' for a pattern
+ * that carries no host (which then matches nothing).
+ */
+function normalizeDomainPattern(pattern) {
+    let p = pattern.trim().toLowerCase();
+    if (p === '*' || p === '*://*/*')
+        return '*';
+    // Strip a leading scheme ("https://", "http://", any "scheme://").
+    p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, '');
+    // Drop everything from the first path/query/fragment separator onward.
+    p = p.replace(/[/?#].*$/, '');
+    // Strip userinfo ("user:pass@") then a trailing port (":8080").
+    p = p.replace(/^[^@]*@/, '').replace(/:\d+$/, '');
+    return p;
+}
 /** Convert a single domain glob to a predicate. '*' matches everything;
- *  '*.example.com' matches example.com and any subdomain; otherwise exact host. */
+ *  '*.example.com' matches example.com and any subdomain; otherwise exact host.
+ *  URL/port/path forms are normalized to their bare host first. */
 function globMatches(host, pattern) {
-    const p = pattern.trim().toLowerCase();
-    if (p === '*' || p === '*://*/*')
+    const p = normalizeDomainPattern(pattern);
+    if (p === '*')
         return true;
     if (p.startsWith('*.')) {
         const base = p.slice(2);
         return host === base || host.endsWith('.' + base);
     }
-    return host === p;
+    return p !== '' && host === p;
 }
 function isDomainAllowed(url, policy) {
     const host = hostOf(url);

package/dist/src/config.js

@@ -162,6 +162,14 @@ function parseArgs(argv) {
                 throw new Error(`unknown argument: ${arg}`);
         }
     }
+    // Fallback permanently removed — this build is EXTENSION-ONLY. It NEVER
+    // launches or attaches a Chromium of its own; it only ever drives the user's
+    // real Chrome through the paired extension. Any CDP flags (--cdp-fallback,
+    // --cdp-endpoint, --prefer cdp) are still accepted for back-compat but are
+    // hard-overridden here so no separate/"fallback" browser can ever open.
+    cdpFallback = false;
+    cdpEndpoint = undefined;
+    prefer = 'extension';
     // File first, then flags win.
     const policy = (0, policy_1.resolvePolicy)({ ...policyFile, ...policyFlags });
     // Uploads must be confined to a directory — refuse to start with uploads enabled
@@ -242,13 +250,14 @@ Connection:
                          CHROME_MCP_TOKEN env, if set, pins the token explicitly.
 
 Backend:
-  --cdp-fallback         Opt in to launching/attaching Chromium when no extension
-                         is paired. OFF by default — extension-only, never opens
-                         a browser of its own.
-  --no-cdp-fallback      Explicitly disable the fallback (already the default).
-  --cdp-endpoint <url>   Attach to an existing Chrome (e.g. http://127.0.0.1:9222)
-  --prefer <which>       "extension" (default) or "cdp"
-  --headless             Run the CDP-fallback Chromium headless
+  This build is EXTENSION-ONLY — it drives ONLY your real Chrome via the paired
+  extension and never launches or attaches a Chromium of its own. The CDP flags
+  below are accepted for back-compat but IGNORED (there is no fallback).
+  --cdp-fallback         (ignored — fallback permanently removed)
+  --no-cdp-fallback      (ignored — extension-only is always on)
+  --cdp-endpoint <url>   (ignored — no CDP attach)
+  --prefer <which>       (ignored — always "extension")
+  --headless             (ignored — no CDP Chromium to run headless)
 
 Security (default: deny-all safe mode):
   --policy <file>        Load a JSON policy file

package/dist/src/mcp/helpers.d.ts

@@ -13,10 +13,16 @@ export interface LinkOut {
 /**
  * Collect anchors from the page (or a subtree). Implemented as a single page
  * eval so it is one round-trip; falls back to parsing getHtml if eval is denied.
+ *
+ * `dedupe` collapses anchors that share an href (nav/footer repetition is common
+ * noise when crawling); `limit` caps the number of links returned. Both are
+ * applied server-side after collection, so they work on either code path.
  */
 export declare function extractLinks(ex: Executor, args: {
     selector?: string;
     sameOriginOnly?: boolean;
+    dedupe?: boolean;
+    limit?: number;
     tabId?: string;
 }): Promise<{
     links: LinkOut[];

package/dist/src/mcp/helpers.js

@@ -13,6 +13,10 @@ const markdown_extract_1 = require("./markdown-extract");
 /**
  * Collect anchors from the page (or a subtree). Implemented as a single page
  * eval so it is one round-trip; falls back to parsing getHtml if eval is denied.
+ *
+ * `dedupe` collapses anchors that share an href (nav/footer repetition is common
+ * noise when crawling); `limit` caps the number of links returned. Both are
+ * applied server-side after collection, so they work on either code path.
  */
 async function extractLinks(ex, args) {
     const root = args.selector ? JSON.stringify(args.selector) : 'null';
@@ -24,21 +28,46 @@ async function extractLinks(ex, args) {
       href: a.href, text: (a.textContent || '').trim().slice(0, 200),
     })).filter(l => l.href && (${args.sameOriginOnly ? 'l.href.startsWith(here)' : 'true'}));
   })()`;
+    let links;
     const res = await ex.eval(expr, { tabId: args.tabId });
     if (res.ok && Array.isArray(res.value)) {
-        return { links: res.value };
+        links = res.value;
     }
-    // Fallback: parse hrefs out of the HTML (e.g. when eval is policy-denied).
-    const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
-        tabId: args.tabId,
-    });
-    const links = [];
-    const re = /<a[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi;
-    let m;
-    while ((m = re.exec(html)) !== null) {
-        links.push({ href: m[1], text: m[2].replace(/<[^>]+>/g, '').trim().slice(0, 200) });
+    else {
+        // Fallback: parse hrefs out of the HTML (e.g. when eval is policy-denied).
+        const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
+            tabId: args.tabId,
+        });
+        links = [];
+        const re = /<a[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi;
+        let m;
+        while ((m = re.exec(html)) !== null) {
+            links.push({ href: m[1], text: m[2].replace(/<[^>]+>/g, '').trim().slice(0, 200) });
+        }
+    }
+    return { links: refineLinks(links, args) };
+}
+/**
+ * Collapse links that share an href (keeping the first, but preferring a
+ * non-empty label) when `dedupe` is set, then cap to `limit`. Order is
+ * preserved so the first occurrence of each href wins.
+ */
+function refineLinks(links, opts) {
+    let out = links;
+    if (opts.dedupe) {
+        const byHref = new Map();
+        for (const l of links) {
+            const existing = byHref.get(l.href);
+            if (!existing)
+                byHref.set(l.href, { ...l });
+            else if (!existing.text && l.text)
+                existing.text = l.text;
+        }
+        out = [...byHref.values()];
     }
-    return { links };
+    if (opts.limit !== undefined && out.length > opts.limit)
+        out = out.slice(0, opts.limit);
+    return out;
 }
 /** Read a page (or subtree) as readable markdown. */
 async function readAsMarkdown(ex, args) {

package/dist/src/mcp/server.d.ts

@@ -6,11 +6,11 @@
  * NOTHING may be written to stdout except the JSON-RPC stream — all diagnostics
  * go to stderr via `logErr`.
  */
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 /** stderr only — never stdout in stdio mode. */
 export declare function logErr(message: string): void;
 /** Build a fresh `Server` with the full tool surface registered (no transport). */
-export declare function createServer(version?: string): Server;
+export declare function createServer(version?: string): McpServer;
 /** Start over stdio. Idempotent. */
 export declare function startMcpServer(version?: string): Promise<void>;
 /** Stop and release the transport. Idempotent, best-effort. */

package/dist/src/mcp/server.js

@@ -13,7 +13,7 @@ exports.createServer = createServer;
 exports.startMcpServer = startMcpServer;
 exports.stopMcpServer = stopMcpServer;
 exports.isMcpServerRunning = isMcpServerRunning;
-const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const tools_1 = require("./tools");
 const SERVER_NAME = 'chrome-mcp';
@@ -28,9 +28,10 @@ function logErr(message) {
 }
 /** Build a fresh `Server` with the full tool surface registered (no transport). */
 function createServer(version = DEFAULT_VERSION) {
-    const srv = new index_js_1.Server({ name: SERVER_NAME, version }, { capabilities: { tools: {} } });
+    const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, { capabilities: { tools: {} } });
     (0, tools_1.registerTools)(srv);
-    srv.onerror = (err) => {
+    // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
+    srv.server.onerror = (err) => {
         logErr(`server error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
     };
     return srv;

package/dist/src/mcp/tools.d.ts

@@ -1,22 +1,25 @@
 /**
  * src/mcp/tools.ts — the MCP tool surface: the advertised catalog
- * (`TOOL_DEFINITIONS`), the name→handler dispatch (`TOOL_HANDLERS`), the
- * never-throw firewall (`dispatchToolCall`), and `registerTools()` which wires
- * both onto a `Server`.
+ * (`TOOL_DEFINITIONS`, each with a zod `inputSchema`), the name→handler dispatch
+ * (`TOOL_HANDLERS`), the never-throw firewall (`dispatchToolCall`), and
+ * `registerTools()` which registers every tool on an `McpServer` via
+ * `registerTool` — the SDK validates the zod schema before dispatch runs.
  *
  * Each handler: validate args → **policy-gate against the relevant URL** → call
  * the active Executor (or a server-side helper) → serialize via an envelope.
  * Nothing here throws to the transport: `dispatchToolCall` renders any thrown
  * `Error` as an `isError` result.
  */
-import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { type CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { z } from 'zod';
 import type { Executor } from '../executor/types';
 import { type Policy } from '../security/policy';
 export interface ToolDefinition {
     name: string;
     description: string;
-    inputSchema: Record<string, unknown>;
+    /** zod raw shape passed to `McpServer.registerTool`; the SDK validates it before dispatch. */
+    inputSchema: z.ZodRawShape;
 }
 export declare const TOOL_DEFINITIONS: ToolDefinition[];
 interface ToolCtx {
@@ -30,5 +33,5 @@ export declare function resetRateLimiter(): void;
 export declare function dispatchToolCall(name: string, rawArgs: unknown): Promise<CallToolResult>;
 /** Assert the catalog and the dispatch table describe the same tool set. */
 export declare function assertNoDrift(): void;
-export declare function registerTools(server: Server): void;
+export declare function registerTools(server: McpServer): void;
 export {};

package/dist/src/mcp/tools.js

@@ -1,9 +1,10 @@
 "use strict";
 /**
  * src/mcp/tools.ts — the MCP tool surface: the advertised catalog
- * (`TOOL_DEFINITIONS`), the name→handler dispatch (`TOOL_HANDLERS`), the
- * never-throw firewall (`dispatchToolCall`), and `registerTools()` which wires
- * both onto a `Server`.
+ * (`TOOL_DEFINITIONS`, each with a zod `inputSchema`), the name→handler dispatch
+ * (`TOOL_HANDLERS`), the never-throw firewall (`dispatchToolCall`), and
+ * `registerTools()` which registers every tool on an `McpServer` via
+ * `registerTool` — the SDK validates the zod schema before dispatch runs.
  *
  * Each handler: validate args → **policy-gate against the relevant URL** → call
  * the active Executor (or a server-side helper) → serialize via an envelope.
@@ -17,7 +18,7 @@ exports.dispatchToolCall = dispatchToolCall;
 exports.assertNoDrift = assertNoDrift;
 exports.registerTools = registerTools;
 const node_path_1 = require("node:path");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const zod_1 = require("zod");
 const types_1 = require("../executor/types");
 const manager_1 = require("../executor/manager");
 const policy_1 = require("../security/policy");
@@ -27,62 +28,57 @@ const helpers_1 = require("./helpers");
 const tasks_1 = require("../bridge/tasks");
 const workspace_1 = require("../bridge/workspace");
 const validators_1 = require("./validators");
+/** Shared selector|ref target — both optional; a handler that needs one calls `requireTarget`. */
 const TARGET_PROPS = {
-    selector: { type: 'string', description: 'CSS selector (exactly one of selector|ref)' },
-    ref: { type: 'string', description: 'Element ref from a prior read (exactly one of selector|ref)' },
+    selector: zod_1.z.string().describe('CSS selector (exactly one of selector|ref)').optional(),
+    ref: zod_1.z.string().describe('Element ref from a prior read (exactly one of selector|ref)').optional(),
 };
-const obj = (properties, required = []) => ({
-    type: 'object',
-    properties,
-    required,
-    additionalProperties: false,
-});
+const tabIdField = zod_1.z.string().describe('Target tab id (defaults to the active tab)').optional();
+const waitUntilField = zod_1.z.enum(['load', 'domcontentloaded', 'networkidle']).describe('When to consider navigation done').optional();
 exports.TOOL_DEFINITIONS = [
-    { name: 'tabs_list', description: 'List open browser tabs.', inputSchema: obj({}) },
-    { name: 'tab_select', description: 'Make a tab active by tabId.', inputSchema: obj({ tabId: { type: 'string' } }, ['tabId']) },
-    { name: 'tab_new', description: 'Open a NEW tab (optionally at a URL) and focus it. Prefer this over `navigate` when the user says "open"/"go to" a site — `navigate` REPLACES the current tab. Pass active:false to open in the background (used by parallel batches).', inputSchema: obj({ url: { type: 'string' }, active: { type: 'boolean' } }) },
-    { name: 'tab_close', description: 'Close a tab by tabId.', inputSchema: obj({ tabId: { type: 'string' } }, ['tabId']) },
-    { name: 'navigate', description: 'Navigate a tab to a URL, REPLACING its current page. Acts on the active tab unless tabId is given — to open a site without losing the current page, use `tab_new` instead.', inputSchema: obj({ url: { type: 'string' }, tabId: { type: 'string' }, waitUntil: { type: 'string', enum: ['load', 'domcontentloaded', 'networkidle'] } }, ['url']) },
-    { name: 'back', description: 'Go back in history.', inputSchema: obj({ tabId: { type: 'string' } }) },
-    { name: 'forward', description: 'Go forward in history.', inputSchema: obj({ tabId: { type: 'string' } }) },
-    { name: 'reload', description: 'Reload the active (or given) tab.', inputSchema: obj({ tabId: { type: 'string' }, waitUntil: { type: 'string', enum: ['load', 'domcontentloaded', 'networkidle'] } }) },
-    { name: 'click', description: 'Click an element (target by selector or a snapshot ref). trusted=true uses real OS-level input.', inputSchema: obj({ ...TARGET_PROPS, tabId: { type: 'string' }, button: { type: 'string', enum: ['left', 'right', 'middle'] }, clickCount: { type: 'number' }, trusted: { type: 'boolean' } }) },
-    { name: 'type', description: 'Type text into an element. trusted=true sends real keystrokes (works on React/Vue controlled inputs).', inputSchema: obj({ ...TARGET_PROPS, text: { type: 'string' }, tabId: { type: 'string' }, clear: { type: 'boolean' }, pressEnter: { type: 'boolean' }, keyEvents: { type: 'boolean' }, trusted: { type: 'boolean' } }, ['text']) },
-    { name: 'select_option', description: 'Select option(s) of a <select> by value or visible label.', inputSchema: obj({ ...TARGET_PROPS, values: { type: 'array', items: { type: 'string' } }, tabId: { type: 'string' } }, ['values']) },
-    { name: 'press', description: 'Press a key (with optional modifiers).', inputSchema: obj({ key: { type: 'string' }, modifiers: { type: 'array', items: { type: 'string' } }, tabId: { type: 'string' } }, ['key']) },
-    { name: 'hover', description: 'Hover over an element.', inputSchema: obj({ ...TARGET_PROPS, tabId: { type: 'string' } }) },
-    { name: 'scroll', description: 'Scroll the page or to an element.', inputSchema: obj({ ...TARGET_PROPS, x: { type: 'number' }, y: { type: 'number' }, deltaX: { type: 'number' }, deltaY: { type: 'number' }, tabId: { type: 'string' } }) },
-    { name: 'screenshot', description: 'Capture a PNG screenshot (page or element).', inputSchema: obj({ ...TARGET_PROPS, fullPage: { type: 'boolean' }, tabId: { type: 'string' } }) },
-    { name: 'get_text', description: 'Get visible text of the page or an element.', inputSchema: obj({ ...TARGET_PROPS, tabId: { type: 'string' } }) },
-    { name: 'get_html', description: 'Get HTML of the page or an element.', inputSchema: obj({ ...TARGET_PROPS, outer: { type: 'boolean' }, tabId: { type: 'string' } }) },
-    { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with stable refs to target by `ref` (more reliable than guessing CSS selectors).', inputSchema: obj({ interactiveOnly: { type: 'boolean' }, max: { type: 'number' }, tabId: { type: 'string' } }) },
-    { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: obj({ url: { type: 'string' }, tabId: { type: 'string' } }) },
-    { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: obj({ op: { type: 'string', enum: ['get', 'set', 'remove', 'clear'] }, key: { type: 'string' }, value: { type: 'string' }, session: { type: 'boolean' }, tabId: { type: 'string' } }, ['op']) },
-    { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: obj({ expression: { type: 'string' }, awaitPromise: { type: 'boolean' }, tabId: { type: 'string' } }, ['expression']) },
-    { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: obj({ selector: { type: 'string' }, textContains: { type: 'string' }, gone: { type: 'boolean' }, timeoutMs: { type: 'number' }, tabId: { type: 'string' } }) },
-    { name: 'extract_links', description: 'Extract anchors from the page or a subtree.', inputSchema: obj({ selector: { type: 'string' }, sameOriginOnly: { type: 'boolean' }, tabId: { type: 'string' } }) },
-    { name: 'read_as_markdown', description: 'Read the page (or subtree) as readable markdown.', inputSchema: obj({ selector: { type: 'string' }, tabId: { type: 'string' } }) },
-    { name: 'fill_form', description: 'Fill multiple fields (keyed by selector) and optionally submit.', inputSchema: obj({ fields: { type: 'object' }, submitSelector: { type: 'string' }, tabId: { type: 'string' } }, ['fields']) },
-    { name: 'download_file', description: 'Download a file by URL or from a link element.', inputSchema: obj({ url: { type: 'string' }, ...TARGET_PROPS, suggestedName: { type: 'string' }, tabId: { type: 'string' } }) },
-    { name: 'upload_file', description: 'Set local file(s) on a file <input> (target by selector or ref) — uploads without the OS dialog. Requires --enable-uploads. `files` are absolute local paths.', inputSchema: obj({ ...TARGET_PROPS, files: { type: 'array', items: { type: 'string' } }, tabId: { type: 'string' } }, ['files']) },
-    { name: 'chrome_status', description: 'Report backend/session status.', inputSchema: obj({}) },
-    { name: 'profile_use', description: 'Switch the active browser profile (identity). Subsequent downloads, results, screenshots, and the action log are stored under profiles/<name>/. Resets the active task to "default" unless you then call task_new.', inputSchema: obj({ name: { type: 'string', description: 'Profile name (becomes a folder; sanitized to a safe path segment).' } }, ['name']) },
-    { name: 'task_new', description: 'Start a new task (run) under the active profile. Creates profiles/<profile>/tasks/<name>/ with downloads/, results/, screenshots/ and makes it the active task so all captured artifacts land there.', inputSchema: obj({ name: { type: 'string', description: 'Task name (becomes a folder; sanitized to a safe path segment).' } }, ['name']) },
-    { name: 'tasks_list', description: 'List every task across all profiles under the data dir, with sizes and download counts.', inputSchema: obj({}) },
-    { name: 'task_status', description: 'Report the active profile/task and the folder paths where this run\'s artifacts are stored.', inputSchema: obj({}) },
+    { name: 'tabs_list', description: 'List open browser tabs.', inputSchema: {} },
+    { name: 'tab_select', description: 'Make a tab active by tabId.', inputSchema: { tabId: zod_1.z.string() } },
+    { name: 'tab_new', description: 'Open a NEW tab (optionally at a URL) and focus it. Prefer this over `navigate` when the user says "open"/"go to" a site — `navigate` REPLACES the current tab. Pass active:false to open in the background (used by parallel batches).', inputSchema: { url: zod_1.z.string().optional(), active: zod_1.z.boolean().optional() } },
+    { name: 'tab_close', description: 'Close a tab by tabId.', inputSchema: { tabId: zod_1.z.string() } },
+    { name: 'navigate', description: 'Navigate a tab to a URL, REPLACING its current page. Acts on the active tab unless tabId is given — to open a site without losing the current page, use `tab_new` instead.', inputSchema: { url: zod_1.z.string(), tabId: tabIdField, waitUntil: waitUntilField } },
+    { name: 'back', description: 'Go back in history.', inputSchema: { tabId: tabIdField } },
+    { name: 'forward', description: 'Go forward in history.', inputSchema: { tabId: tabIdField } },
+    { name: 'reload', description: 'Reload the active (or given) tab.', inputSchema: { tabId: tabIdField, waitUntil: waitUntilField } },
+    { name: 'click', description: 'Click an element (target by selector or a snapshot ref). trusted=true uses real OS-level input.', inputSchema: { ...TARGET_PROPS, tabId: tabIdField, button: zod_1.z.enum(['left', 'right', 'middle']).optional(), clickCount: zod_1.z.number().optional(), trusted: zod_1.z.boolean().optional() } },
+    { name: 'type', description: 'Type text into an element. trusted=true sends real keystrokes (works on React/Vue controlled inputs).', inputSchema: { ...TARGET_PROPS, text: zod_1.z.string(), tabId: tabIdField, clear: zod_1.z.boolean().optional(), pressEnter: zod_1.z.boolean().optional(), keyEvents: zod_1.z.boolean().optional(), trusted: zod_1.z.boolean().optional() } },
+    { name: 'select_option', description: 'Select option(s) of a <select> by value or visible label.', inputSchema: { ...TARGET_PROPS, values: zod_1.z.array(zod_1.z.string()), tabId: tabIdField } },
+    { name: 'press', description: 'Press a key (with optional modifiers).', inputSchema: { key: zod_1.z.string(), modifiers: zod_1.z.array(zod_1.z.string()).optional(), tabId: tabIdField } },
+    { name: 'hover', description: 'Hover over an element.', inputSchema: { ...TARGET_PROPS, tabId: tabIdField } },
+    { name: 'scroll', description: 'Scroll the page or to an element.', inputSchema: { ...TARGET_PROPS, x: zod_1.z.number().optional(), y: zod_1.z.number().optional(), deltaX: zod_1.z.number().optional(), deltaY: zod_1.z.number().optional(), tabId: tabIdField } },
+    { name: 'screenshot', description: 'Capture a PNG screenshot (page or element).', inputSchema: { ...TARGET_PROPS, fullPage: zod_1.z.boolean().optional(), tabId: tabIdField } },
+    { name: 'get_text', description: 'Get visible text of the page or an element.', inputSchema: { ...TARGET_PROPS, tabId: tabIdField } },
+    { name: 'get_html', description: 'Get HTML of the page or an element.', inputSchema: { ...TARGET_PROPS, outer: zod_1.z.boolean().optional(), tabId: tabIdField } },
+    { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with stable refs to target by `ref` (more reliable than guessing CSS selectors).', inputSchema: { interactiveOnly: zod_1.z.boolean().optional(), max: zod_1.z.number().optional(), tabId: tabIdField } },
+    { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
+    { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), tabId: tabIdField } },
+    { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: { selector: zod_1.z.string().optional(), textContains: zod_1.z.string().optional(), gone: zod_1.z.boolean().optional(), timeoutMs: zod_1.z.number().optional(), tabId: tabIdField } },
+    { name: 'extract_links', description: 'Extract anchors from the page or a subtree. dedupe=true collapses links sharing an href (nav/footer noise); limit caps the count.', inputSchema: { selector: zod_1.z.string().optional(), sameOriginOnly: zod_1.z.boolean().optional(), dedupe: zod_1.z.boolean().optional(), limit: zod_1.z.number().optional(), tabId: tabIdField } },
+    { name: 'read_as_markdown', description: 'Read the page (or subtree) as readable markdown.', inputSchema: { selector: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'fill_form', description: 'Fill multiple fields (keyed by selector) and optionally submit.', inputSchema: { fields: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.boolean()])), submitSelector: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'download_file', description: 'Download a file by URL or from a link element.', inputSchema: { url: zod_1.z.string().optional(), ...TARGET_PROPS, suggestedName: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'upload_file', description: 'Set local file(s) on a file <input> (target by selector or ref) — uploads without the OS dialog. Requires --enable-uploads. `files` are absolute local paths.', inputSchema: { ...TARGET_PROPS, files: zod_1.z.array(zod_1.z.string()), tabId: tabIdField } },
+    { name: 'chrome_status', description: 'Report backend/session status.', inputSchema: {} },
+    { name: 'profile_use', description: 'Switch the active browser profile (identity). Subsequent downloads, results, screenshots, and the action log are stored under profiles/<name>/. Resets the active task to "default" unless you then call task_new.', inputSchema: { name: zod_1.z.string().describe('Profile name (becomes a folder; sanitized to a safe path segment).') } },
+    { name: 'task_new', description: 'Start a new task (run) under the active profile. Creates profiles/<profile>/tasks/<name>/ with downloads/, results/, screenshots/ and makes it the active task so all captured artifacts land there.', inputSchema: { name: zod_1.z.string().describe('Task name (becomes a folder; sanitized to a safe path segment).') } },
+    { name: 'tasks_list', description: 'List every task across all profiles under the data dir, with sizes and download counts.', inputSchema: {} },
+    { name: 'task_status', description: 'Report the active profile/task and the folder paths where this run\'s artifacts are stored.', inputSchema: {} },
     {
         name: 'batch',
         description: 'Run multiple tool calls in one request — parallel (default) or serial. Each op is { tool, args } and goes through the same policy gate, rate limit, and error handling as a direct call. In parallel mode, tab-scoped ops MUST pass an explicit tabId (the active-tab default is unsafe under concurrency). Use to drive several tabs at once (e.g. open tabs, then batch get_text across them). Cannot be nested.',
-        inputSchema: obj({
-            ops: {
-                type: 'array',
-                description: 'Operations to run; each is a tool name + its args.',
-                items: obj({ tool: { type: 'string' }, args: { type: 'object' } }, ['tool']),
-            },
-            mode: { type: 'string', enum: ['parallel', 'serial'], description: 'Default "parallel".' },
-            stopOnError: { type: 'boolean', description: 'Serial mode only: stop after the first failing op (the rest are skipped).' },
-            maxConcurrency: { type: 'number', description: 'Parallel mode: max ops in flight at once (default 6).' },
-        }, ['ops']),
+        inputSchema: {
+            ops: zod_1.z
+                .array(zod_1.z.object({ tool: zod_1.z.string(), args: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional() }))
+                .describe('Operations to run; each is a tool name + its args.'),
+            mode: zod_1.z.enum(['parallel', 'serial']).describe('Default "parallel".').optional(),
+            stopOnError: zod_1.z.boolean().describe('Serial mode only: stop after the first failing op (the rest are skipped).').optional(),
+            maxConcurrency: zod_1.z.number().describe('Parallel mode: max ops in flight at once (default 6).').optional(),
+        },
     },
 ];
 /** Resolve the URL the policy should be evaluated against (the active tab). */
@@ -280,6 +276,8 @@ exports.TOOL_HANDLERS = {
         const res = await (0, helpers_1.extractLinks)(ctx.ex, {
             selector: (0, validators_1.optionalString)(a, 'selector'),
             sameOriginOnly: (0, validators_1.optionalBoolean)(a, 'sameOriginOnly'),
+            dedupe: (0, validators_1.optionalBoolean)(a, 'dedupe'),
+            limit: (0, validators_1.optionalNumber)(a, 'limit', { min: 1, max: 10_000 }),
             tabId: tabId(a),
         });
         (0, workspace_1.saveResult)('extract_links', 'json', JSON.stringify(res, null, 2));
@@ -441,13 +439,12 @@ function assertNoDrift() {
 // ---------------------------------------------------------------------------
 function registerTools(server) {
     assertNoDrift();
-    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-        tools: exports.TOOL_DEFINITIONS.map((d) => ({
-            name: d.name,
-            description: d.description,
-            inputSchema: d.inputSchema,
-        })),
-    }));
-    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (req) => dispatchToolCall(req.params.name, req.params.arguments));
+    // Register each tool with its zod `inputSchema`. The SDK advertises it in
+    // `tools/list` and validates arguments before invoking the handler, which
+    // just routes back through `dispatchToolCall` — our never-throw firewall that
+    // applies the rate limit, executor readiness, policy gate, and history log.
+    for (const d of exports.TOOL_DEFINITIONS) {
+        server.registerTool(d.name, { description: d.description, inputSchema: d.inputSchema }, async (args) => dispatchToolCall(d.name, args));
+    }
 }
 //# sourceMappingURL=tools.js.map

package/extension-dist/background.js

@@ -159,14 +159,22 @@
   function isAboutBlank(url) {
     return url === "about:blank" || url === "" || url.startsWith("about:");
   }
+  function normalizeDomainPattern(pattern) {
+    let p = pattern.trim().toLowerCase();
+    if (p === "*" || p === "*://*/*") return "*";
+    p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
+    p = p.replace(/[/?#].*$/, "");
+    p = p.replace(/^[^@]*@/, "").replace(/:\d+$/, "");
+    return p;
+  }
   function globMatches(host, pattern) {
-    const p = pattern.trim().toLowerCase();
-    if (p === "*" || p === "*://*/*") return true;
+    const p = normalizeDomainPattern(pattern);
+    if (p === "*") return true;
     if (p.startsWith("*.")) {
       const base = p.slice(2);
       return host === base || host.endsWith("." + base);
     }
-    return host === p;
+    return p !== "" && host === p;
   }
   function isDomainAllowed(url, policy) {
     const host = hostOf(url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mehmoodqureshi/chrome-mcp",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "Drive a real Chrome browser over MCP. A stdio MCP server (CLI) plus an MV3 extension, behind one pluggable Executor (extension via chrome.scripting, or a Playwright CDP fallback).",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
@@ -45,15 +45,16 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "typecheck:ext": "tsc -p tsconfig.ext.json",
     "clean": "rimraf dist extension-dist",
-    "test": "npm run clean && npm run build && npm run build:ext && node --test dist/test",
+    "test": "npm run clean && npm run build && npm run build:ext && node --test dist/test/*.test.js",
     "test:hitl": "npm run build && node dist/hitl/index.js",
     "prepack": "npm run clean && npm run build && npm run build:ext",
     "postinstall": "node scripts/postinstall.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.4",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "playwright": "^1.49.1",
-    "ws": "^8.18.0"
+    "ws": "^8.18.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/chrome": "^0.0.287",