@mehmoodqureshi/chrome-mcp 0.6.6 → 0.7.0

package/dist/src/mcp/redact.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * src/mcp/redact.ts — keep secrets that happen to be on the page out of the
+ * model's context.
+ *
+ * The premise of this tool is that it drives a browser you are already logged
+ * into. That is also the problem: `get_text` / `get_html` / `read_as_markdown` /
+ * `eval` return whatever is on the page, and on a logged-in page that routinely
+ * includes a session token rendered into a script tag, an API key on a settings
+ * screen, or the value sitting in a password field. The domain allowlist decides
+ * WHICH pages may be read; it has nothing to say about what comes back from one
+ * that is allowed.
+ *
+ * Two layers, deliberately different in strength:
+ *   - password-field values are ALWAYS suppressed. That one is unambiguous — no
+ *     caller ever wants the characters in a `<input type=password>` — so it
+ *     needs no flag and has no false positives.
+ *   - pattern redaction (JWTs, cloud keys, bearer tokens, private key blocks) is
+ *     opt-in via `--redact`, because a pattern can and will fire on something a
+ *     user legitimately asked to read.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_REDACTION = void 0;
+exports.compileRedactionPattern = compileRedactionPattern;
+exports.redactText = redactText;
+exports.redactHtml = redactHtml;
+exports.NO_REDACTION = { enabled: false, extra: [] };
+/** Well-known secret shapes. Each is anchored enough not to fire on prose. */
+const BUILTIN = [
+    { kind: 'private-key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]{0,8000}?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { kind: 'jwt', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    { kind: 'aws-key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { kind: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+    { kind: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { kind: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { kind: 'api-key', re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    { kind: 'bearer', re: /\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g },
+];
+/**
+ * Compile a user-supplied pattern. Invalid regexes are a configuration error
+ * worth failing loudly on — silently ignoring one would leave the user believing
+ * a secret is being scrubbed when it is not.
+ */
+function compileRedactionPattern(source) {
+    return new RegExp(source, 'g');
+}
+/** Replace every match of the configured patterns with a labelled marker. */
+function redactText(text, cfg) {
+    if (!cfg.enabled || !text)
+        return { value: text, redactions: 0 };
+    let out = text;
+    let count = 0;
+    for (const { kind, re } of BUILTIN) {
+        out = out.replace(new RegExp(re.source, re.flags), () => {
+            count++;
+            return `[redacted:${kind}]`;
+        });
+    }
+    for (const re of cfg.extra) {
+        out = out.replace(new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`), () => {
+            count++;
+            return '[redacted:custom]';
+        });
+    }
+    return { value: out, redactions: count };
+}
+/** Matches one complete `<input …>` tag so its attributes can be inspected. */
+const INPUT_TAG = /<input\b[^>]*>/gi;
+const VALUE_ATTR = /\bvalue\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/i;
+const PASSWORD_TYPE = /\btype\s*=\s*["']?password["']?/i;
+/**
+ * Strip the `value` of every password input, then apply pattern redaction.
+ *
+ * The value attribute is emptied rather than removed so the markup keeps its
+ * shape — a caller reasoning about the form still sees the field, just not
+ * what is in it.
+ */
+function redactHtml(html, cfg) {
+    if (!html)
+        return { value: html, redactions: 0 };
+    let count = 0;
+    let out = html.replace(INPUT_TAG, (tag) => {
+        if (!PASSWORD_TYPE.test(tag) || !VALUE_ATTR.test(tag))
+            return tag;
+        count++;
+        return tag.replace(VALUE_ATTR, 'value="[redacted:password]"');
+    });
+    const patterned = redactText(out, cfg);
+    out = patterned.value;
+    return { value: out, redactions: count + patterned.redactions };
+}
+//# sourceMappingURL=redact.js.map

package/dist/src/mcp/server.d.ts

@@ -7,8 +7,7 @@
  * go to stderr via `logErr`.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-/** stderr only — never stdout in stdio mode. */
-export declare function logErr(message: string): void;
+export { getLogLevel, logDebug, logErr, setLogLevel } from './log';
 /** Build a fresh `Server` with the full tool surface registered (no transport). */
 export declare function createServer(version?: string): McpServer;
 /** Start over stdio. Idempotent. */

package/dist/src/mcp/server.js

@@ -8,38 +8,42 @@
  * go to stderr via `logErr`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logErr = logErr;
+exports.setLogLevel = exports.logErr = exports.logDebug = exports.getLogLevel = void 0;
 exports.createServer = createServer;
 exports.startMcpServer = startMcpServer;
 exports.stopMcpServer = stopMcpServer;
 exports.isMcpServerRunning = isMcpServerRunning;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const log_1 = require("./log");
 const tools_1 = require("./tools");
+// Re-exported so existing callers (and the CLI) keep importing the logger from
+// here; the implementation lives in ./log to avoid a server↔tools import cycle.
+var log_2 = require("./log");
+Object.defineProperty(exports, "getLogLevel", { enumerable: true, get: function () { return log_2.getLogLevel; } });
+Object.defineProperty(exports, "logDebug", { enumerable: true, get: function () { return log_2.logDebug; } });
+Object.defineProperty(exports, "logErr", { enumerable: true, get: function () { return log_2.logErr; } });
+Object.defineProperty(exports, "setLogLevel", { enumerable: true, get: function () { return log_2.setLogLevel; } });
 const SERVER_NAME = 'chrome-mcp';
 const SERVER_VERSION = '0.1.0';
 /** Default version reported when no explicit version is passed in (legacy callers/tests). */
 const DEFAULT_VERSION = SERVER_VERSION;
 let server = null;
 let transport = null;
-/** stderr only — never stdout in stdio mode. */
-function logErr(message) {
-    process.stderr.write(`[chrome-mcp] ${message}\n`);
-}
 /** Build a fresh `Server` with the full tool surface registered (no transport). */
 function createServer(version = DEFAULT_VERSION) {
     const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, { capabilities: { tools: {} } });
     (0, tools_1.registerTools)(srv);
     // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
     srv.server.onerror = (err) => {
-        logErr(`server error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+        (0, log_1.logErr)(`server error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
     };
     return srv;
 }
 /** Start over stdio. Idempotent. */
 async function startMcpServer(version = DEFAULT_VERSION) {
     if (server) {
-        logErr('startMcpServer called but already running; ignoring.');
+        (0, log_1.logErr)('startMcpServer called but already running; ignoring.');
         return;
     }
     const srv = createServer(version);
@@ -48,14 +52,14 @@ async function startMcpServer(version = DEFAULT_VERSION) {
         await srv.connect(tx);
     }
     catch (err) {
-        logErr(`failed to connect stdio transport: ${String(err)}`);
+        (0, log_1.logErr)(`failed to connect stdio transport: ${String(err)}`);
         server = null;
         transport = null;
         throw err;
     }
     server = srv;
     transport = tx;
-    logErr(`${SERVER_NAME} v${version} connected over stdio.`);
+    (0, log_1.logErr)(`${SERVER_NAME} v${version} connected over stdio.`);
 }
 /** Stop and release the transport. Idempotent, best-effort. */
 async function stopMcpServer() {
@@ -69,15 +73,15 @@ async function stopMcpServer() {
         await srv.close();
     }
     catch (err) {
-        logErr(`error closing server: ${String(err)}`);
+        (0, log_1.logErr)(`error closing server: ${String(err)}`);
     }
     try {
         await tx?.close();
     }
     catch (err) {
-        logErr(`error closing transport: ${String(err)}`);
+        (0, log_1.logErr)(`error closing transport: ${String(err)}`);
     }
-    logErr('MCP server stopped.');
+    (0, log_1.logErr)('MCP server stopped.');
 }
 function isMcpServerRunning() {
     return server !== null;

package/dist/src/mcp/snapdiff.d.ts

@@ -0,0 +1,43 @@
+/**
+ * src/mcp/snapdiff.ts — remember the last accessibility snapshot per tab and
+ * answer "what changed" instead of re-sending the page.
+ *
+ * A snapshot is the most token-expensive read in the tool surface, and the agent
+ * loop that leans on it hardest — snapshot, click, snapshot, click — re-sends a
+ * page that is mostly identical every time. The diff is what the caller actually
+ * wanted: this button appeared, that error text is new, submit is no longer
+ * disabled.
+ *
+ * Refs (`e1`, `e2`, ...) are minted in document order on every snapshot, so they
+ * are NOT identity across snapshots: `e7` is a different element the moment
+ * anything above it is inserted. Nodes are therefore matched on role + tag +
+ * accessible name, and every diff entry carries the CURRENT ref, so anything the
+ * caller is told about is immediately targetable.
+ */
+import type { SnapshotNode, SnapshotResult } from '../executor/types';
+export interface StoredSnapshot {
+    id: string;
+    ts: number;
+    url: string;
+    nodes: SnapshotNode[];
+}
+export interface SnapshotDiff {
+    /** The snapshot this was compared against, or null when there was none. */
+    since: string | null;
+    added: SnapshotNode[];
+    removed: SnapshotNode[];
+    changed: Array<{
+        node: SnapshotNode;
+        was: Partial<SnapshotNode>;
+    }>;
+    unchanged: number;
+}
+/** Identity of a node ACROSS snapshots - deliberately not the ref. */
+export declare function nodeKey(n: SnapshotNode): string;
+/** Scope key: snapshots are per browser profile and per tab. */
+export declare function scopeOf(profile: string, tabId?: string): string;
+export declare function rememberSnapshot(scope: string, snap: SnapshotResult): StoredSnapshot;
+export declare function lastSnapshot(scope: string): StoredSnapshot | undefined;
+/** Forget everything - for tests, and whenever the active profile changes. */
+export declare function resetSnapshots(): void;
+export declare function diffSnapshots(prev: StoredSnapshot | undefined, next: SnapshotResult): SnapshotDiff;

package/dist/src/mcp/snapdiff.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * src/mcp/snapdiff.ts — remember the last accessibility snapshot per tab and
+ * answer "what changed" instead of re-sending the page.
+ *
+ * A snapshot is the most token-expensive read in the tool surface, and the agent
+ * loop that leans on it hardest — snapshot, click, snapshot, click — re-sends a
+ * page that is mostly identical every time. The diff is what the caller actually
+ * wanted: this button appeared, that error text is new, submit is no longer
+ * disabled.
+ *
+ * Refs (`e1`, `e2`, ...) are minted in document order on every snapshot, so they
+ * are NOT identity across snapshots: `e7` is a different element the moment
+ * anything above it is inserted. Nodes are therefore matched on role + tag +
+ * accessible name, and every diff entry carries the CURRENT ref, so anything the
+ * caller is told about is immediately targetable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeKey = nodeKey;
+exports.scopeOf = scopeOf;
+exports.rememberSnapshot = rememberSnapshot;
+exports.lastSnapshot = lastSnapshot;
+exports.resetSnapshots = resetSnapshots;
+exports.diffSnapshots = diffSnapshots;
+/** How many tabs' snapshots to keep. Small: a convenience cache, not state. */
+const MAX_SCOPES = 32;
+const store = new Map();
+let counter = 0;
+/** Identity of a node ACROSS snapshots - deliberately not the ref. */
+function nodeKey(n) {
+    return `${n.role} | ${n.tag} | ${n.name}`;
+}
+/** Scope key: snapshots are per browser profile and per tab. */
+function scopeOf(profile, tabId) {
+    return `${profile} | ${tabId ?? 'active'}`;
+}
+function rememberSnapshot(scope, snap) {
+    const stored = { id: `snap_${++counter}`, ts: Date.now(), url: snap.url, nodes: snap.nodes };
+    store.set(scope, stored);
+    // Bounded: drop the oldest insertion once over the ceiling.
+    while (store.size > MAX_SCOPES) {
+        const oldest = store.keys().next();
+        if (oldest.done)
+            break;
+        store.delete(oldest.value);
+    }
+    return stored;
+}
+function lastSnapshot(scope) {
+    return store.get(scope);
+}
+/** Forget everything - for tests, and whenever the active profile changes. */
+function resetSnapshots() {
+    store.clear();
+    counter = 0;
+}
+/** The state fields a diff reports as "changed" (the ref is expected to move). */
+const STATE_FIELDS = ['value', 'disabled', 'checked'];
+function diffSnapshots(prev, next) {
+    if (!prev) {
+        return { since: null, added: next.nodes, removed: [], changed: [], unchanged: 0 };
+    }
+    const before = new Map();
+    for (const n of prev.nodes)
+        if (!before.has(nodeKey(n)))
+            before.set(nodeKey(n), n);
+    const added = [];
+    const changed = [];
+    let unchanged = 0;
+    const matched = new Set();
+    for (const n of next.nodes) {
+        const key = nodeKey(n);
+        const old = before.get(key);
+        if (!old) {
+            added.push(n);
+            continue;
+        }
+        matched.add(key);
+        const was = {};
+        for (const f of STATE_FIELDS) {
+            if (old[f] !== n[f])
+                was[f] = old[f];
+        }
+        if (Object.keys(was).length > 0)
+            changed.push({ node: n, was });
+        else
+            unchanged++;
+    }
+    const removed = prev.nodes.filter((n) => !matched.has(nodeKey(n)));
+    return { since: prev.id, added, removed, changed, unchanged };
+}
+//# sourceMappingURL=snapdiff.js.map