@mehmoodqureshi/chrome-mcp 0.6.1 → 0.6.3

package/dist/shared/policy.js

@@ -80,17 +80,38 @@ function hostOf(url) {
 function isAboutBlank(url) {
     return url === 'about:blank' || url === '' || url.startsWith('about:');
 }
+/**
+ * Reduce an allowlist entry to the bare host it constrains. Users routinely paste
+ * a full URL ("https://example.com/app") or a "host:port/path" instead of a bare
+ * host; those forms would never equal a hostname and so silently match nothing.
+ * We strip the scheme, userinfo, port, and path/query/fragment, preserving a
+ * leading "*." wildcard and the two catch-all forms. Returns '' for a pattern
+ * that carries no host (which then matches nothing).
+ */
+function normalizeDomainPattern(pattern) {
+    let p = pattern.trim().toLowerCase();
+    if (p === '*' || p === '*://*/*')
+        return '*';
+    // Strip a leading scheme ("https://", "http://", any "scheme://").
+    p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, '');
+    // Drop everything from the first path/query/fragment separator onward.
+    p = p.replace(/[/?#].*$/, '');
+    // Strip userinfo ("user:pass@") then a trailing port (":8080").
+    p = p.replace(/^[^@]*@/, '').replace(/:\d+$/, '');
+    return p;
+}
 /** Convert a single domain glob to a predicate. '*' matches everything;
- *  '*.example.com' matches example.com and any subdomain; otherwise exact host. */
+ *  '*.example.com' matches example.com and any subdomain; otherwise exact host.
+ *  URL/port/path forms are normalized to their bare host first. */
 function globMatches(host, pattern) {
-    const p = pattern.trim().toLowerCase();
-    if (p === '*' || p === '*://*/*')
+    const p = normalizeDomainPattern(pattern);
+    if (p === '*')
         return true;
     if (p.startsWith('*.')) {
         const base = p.slice(2);
         return host === base || host.endsWith('.' + base);
     }
-    return host === p;
+    return p !== '' && host === p;
 }
 function isDomainAllowed(url, policy) {
     const host = hostOf(url);

package/dist/src/config.js

@@ -162,6 +162,14 @@ function parseArgs(argv) {
                 throw new Error(`unknown argument: ${arg}`);
         }
     }
+    // Fallback permanently removed — this build is EXTENSION-ONLY. It NEVER
+    // launches or attaches a Chromium of its own; it only ever drives the user's
+    // real Chrome through the paired extension. Any CDP flags (--cdp-fallback,
+    // --cdp-endpoint, --prefer cdp) are still accepted for back-compat but are
+    // hard-overridden here so no separate/"fallback" browser can ever open.
+    cdpFallback = false;
+    cdpEndpoint = undefined;
+    prefer = 'extension';
     // File first, then flags win.
     const policy = (0, policy_1.resolvePolicy)({ ...policyFile, ...policyFlags });
     // Uploads must be confined to a directory — refuse to start with uploads enabled
@@ -242,13 +250,14 @@ Connection:
                          CHROME_MCP_TOKEN env, if set, pins the token explicitly.
 
 Backend:
-  --cdp-fallback         Opt in to launching/attaching Chromium when no extension
-                         is paired. OFF by default — extension-only, never opens
-                         a browser of its own.
-  --no-cdp-fallback      Explicitly disable the fallback (already the default).
-  --cdp-endpoint <url>   Attach to an existing Chrome (e.g. http://127.0.0.1:9222)
-  --prefer <which>       "extension" (default) or "cdp"
-  --headless             Run the CDP-fallback Chromium headless
+  This build is EXTENSION-ONLY — it drives ONLY your real Chrome via the paired
+  extension and never launches or attaches a Chromium of its own. The CDP flags
+  below are accepted for back-compat but IGNORED (there is no fallback).
+  --cdp-fallback         (ignored — fallback permanently removed)
+  --no-cdp-fallback      (ignored — extension-only is always on)
+  --cdp-endpoint <url>   (ignored — no CDP attach)
+  --prefer <which>       (ignored — always "extension")
+  --headless             (ignored — no CDP Chromium to run headless)
 
 Security (default: deny-all safe mode):
   --policy <file>        Load a JSON policy file

package/dist/src/mcp/helpers.d.ts

@@ -13,10 +13,16 @@ export interface LinkOut {
 /**
  * Collect anchors from the page (or a subtree). Implemented as a single page
  * eval so it is one round-trip; falls back to parsing getHtml if eval is denied.
+ *
+ * `dedupe` collapses anchors that share an href (nav/footer repetition is common
+ * noise when crawling); `limit` caps the number of links returned. Both are
+ * applied server-side after collection, so they work on either code path.
  */
 export declare function extractLinks(ex: Executor, args: {
     selector?: string;
     sameOriginOnly?: boolean;
+    dedupe?: boolean;
+    limit?: number;
     tabId?: string;
 }): Promise<{
     links: LinkOut[];

package/dist/src/mcp/helpers.js

@@ -13,6 +13,10 @@ const markdown_extract_1 = require("./markdown-extract");
 /**
  * Collect anchors from the page (or a subtree). Implemented as a single page
  * eval so it is one round-trip; falls back to parsing getHtml if eval is denied.
+ *
+ * `dedupe` collapses anchors that share an href (nav/footer repetition is common
+ * noise when crawling); `limit` caps the number of links returned. Both are
+ * applied server-side after collection, so they work on either code path.
  */
 async function extractLinks(ex, args) {
     const root = args.selector ? JSON.stringify(args.selector) : 'null';
@@ -24,21 +28,46 @@ async function extractLinks(ex, args) {
       href: a.href, text: (a.textContent || '').trim().slice(0, 200),
     })).filter(l => l.href && (${args.sameOriginOnly ? 'l.href.startsWith(here)' : 'true'}));
   })()`;
+    let links;
     const res = await ex.eval(expr, { tabId: args.tabId });
     if (res.ok && Array.isArray(res.value)) {
-        return { links: res.value };
+        links = res.value;
     }
-    // Fallback: parse hrefs out of the HTML (e.g. when eval is policy-denied).
-    const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
-        tabId: args.tabId,
-    });
-    const links = [];
-    const re = /<a[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi;
-    let m;
-    while ((m = re.exec(html)) !== null) {
-        links.push({ href: m[1], text: m[2].replace(/<[^>]+>/g, '').trim().slice(0, 200) });
+    else {
+        // Fallback: parse hrefs out of the HTML (e.g. when eval is policy-denied).
+        const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
+            tabId: args.tabId,
+        });
+        links = [];
+        const re = /<a[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi;
+        let m;
+        while ((m = re.exec(html)) !== null) {
+            links.push({ href: m[1], text: m[2].replace(/<[^>]+>/g, '').trim().slice(0, 200) });
+        }
+    }
+    return { links: refineLinks(links, args) };
+}
+/**
+ * Collapse links that share an href (keeping the first, but preferring a
+ * non-empty label) when `dedupe` is set, then cap to `limit`. Order is
+ * preserved so the first occurrence of each href wins.
+ */
+function refineLinks(links, opts) {
+    let out = links;
+    if (opts.dedupe) {
+        const byHref = new Map();
+        for (const l of links) {
+            const existing = byHref.get(l.href);
+            if (!existing)
+                byHref.set(l.href, { ...l });
+            else if (!existing.text && l.text)
+                existing.text = l.text;
+        }
+        out = [...byHref.values()];
     }
-    return { links };
+    if (opts.limit !== undefined && out.length > opts.limit)
+        out = out.slice(0, opts.limit);
+    return out;
 }
 /** Read a page (or subtree) as readable markdown. */
 async function readAsMarkdown(ex, args) {

package/dist/src/mcp/tools.js

@@ -58,7 +58,7 @@ exports.TOOL_DEFINITIONS = [
     { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: { selector: zod_1.z.string().optional(), textContains: zod_1.z.string().optional(), gone: zod_1.z.boolean().optional(), timeoutMs: zod_1.z.number().optional(), tabId: tabIdField } },
-    { name: 'extract_links', description: 'Extract anchors from the page or a subtree.', inputSchema: { selector: zod_1.z.string().optional(), sameOriginOnly: zod_1.z.boolean().optional(), tabId: tabIdField } },
+    { name: 'extract_links', description: 'Extract anchors from the page or a subtree. dedupe=true collapses links sharing an href (nav/footer noise); limit caps the count.', inputSchema: { selector: zod_1.z.string().optional(), sameOriginOnly: zod_1.z.boolean().optional(), dedupe: zod_1.z.boolean().optional(), limit: zod_1.z.number().optional(), tabId: tabIdField } },
     { name: 'read_as_markdown', description: 'Read the page (or subtree) as readable markdown.', inputSchema: { selector: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'fill_form', description: 'Fill multiple fields (keyed by selector) and optionally submit.', inputSchema: { fields: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.boolean()])), submitSelector: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'download_file', description: 'Download a file by URL or from a link element.', inputSchema: { url: zod_1.z.string().optional(), ...TARGET_PROPS, suggestedName: zod_1.z.string().optional(), tabId: tabIdField } },
@@ -276,6 +276,8 @@ exports.TOOL_HANDLERS = {
         const res = await (0, helpers_1.extractLinks)(ctx.ex, {
             selector: (0, validators_1.optionalString)(a, 'selector'),
             sameOriginOnly: (0, validators_1.optionalBoolean)(a, 'sameOriginOnly'),
+            dedupe: (0, validators_1.optionalBoolean)(a, 'dedupe'),
+            limit: (0, validators_1.optionalNumber)(a, 'limit', { min: 1, max: 10_000 }),
             tabId: tabId(a),
         });
         (0, workspace_1.saveResult)('extract_links', 'json', JSON.stringify(res, null, 2));

package/extension-dist/background.js

@@ -39,7 +39,6 @@
     constructor(deps) {
       this.deps = deps;
     }
-    deps;
     ws = null;
     state = "idle";
     isConnected() {
@@ -160,14 +159,22 @@
   function isAboutBlank(url) {
     return url === "about:blank" || url === "" || url.startsWith("about:");
   }
+  function normalizeDomainPattern(pattern) {
+    let p = pattern.trim().toLowerCase();
+    if (p === "*" || p === "*://*/*") return "*";
+    p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
+    p = p.replace(/[/?#].*$/, "");
+    p = p.replace(/^[^@]*@/, "").replace(/:\d+$/, "");
+    return p;
+  }
   function globMatches(host, pattern) {
-    const p = pattern.trim().toLowerCase();
-    if (p === "*" || p === "*://*/*") return true;
+    const p = normalizeDomainPattern(pattern);
+    if (p === "*") return true;
     if (p.startsWith("*.")) {
       const base = p.slice(2);
       return host === base || host.endsWith("." + base);
     }
-    return host === p;
+    return p !== "" && host === p;
   }
   function isDomainAllowed(url, policy) {
     const host = hostOf(url);
@@ -425,7 +432,6 @@
       super(message);
       this.code = code;
     }
-    code;
   };
   var DOWNLOAD_TIMEOUT_MS = 12e4;
   function waitForDownloadComplete(id) {
@@ -527,7 +533,7 @@
   async function waitForSelector(tabId, selector, timeoutMs = 5e3) {
     const found = await execInTab(
       tabId,
-      ((s, timeout, interval) => new Promise((resolve) => {
+      (s, timeout, interval) => new Promise((resolve) => {
         const deadline = Date.now() + timeout;
         const tick = () => {
           if (document.querySelector(s)) return resolve(true);
@@ -535,7 +541,7 @@
           setTimeout(tick, interval);
         };
         tick();
-      })),
+      }),
       [selector, timeoutMs, 120]
     );
     return found === true;
@@ -1036,7 +1042,7 @@
           const start = Date.now();
           const matched = await execInTab(
             id,
-            ((sel, text, gone, timeoutMs, interval) => new Promise((resolve) => {
+            (sel, text, gone, timeoutMs, interval) => new Promise((resolve) => {
               const deadline = Date.now() + timeoutMs;
               const hit = () => {
                 let present;
@@ -1051,7 +1057,7 @@
                 setTimeout(tick, interval);
               };
               tick();
-            })),
+            }),
             [cmd.params.selector ?? null, cmd.params.textContains ?? null, cmd.params.gone === true, timeout, 150]
           );
           return { matched: matched === true, waitedMs: Date.now() - start };
@@ -1115,7 +1121,6 @@
         if (!HANDLED.has(m)) throw new Error(`router drift: no handler for wire method "${m}"`);
       }
     }
-    deps;
     async dispatch(cmd) {
       try {
         const policy = this.deps.getPolicy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mehmoodqureshi/chrome-mcp",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Drive a real Chrome browser over MCP. A stdio MCP server (CLI) plus an MV3 extension, behind one pluggable Executor (extension via chrome.scripting, or a Playwright CDP fallback).",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",