@mehmoodqureshi/chrome-mcp 0.6.7 → 0.7.0

package/dist/src/security/policy.d.ts

@@ -27,6 +27,11 @@ export { isReadMethod, isMutatingMethod, isUrlGated, hostOf, isDomainAllowed };
 export interface Policy extends WirePolicy {
     /** If set, `upload_file` may only read files inside this directory (absolute path). */
     uploadsDir?: string;
+    /** Pattern-based secret redaction on content reads (`--redact`). Password
+     *  field values are suppressed regardless of this setting. */
+    redact?: boolean;
+    /** Extra redaction patterns (regex sources) supplied by the operator. */
+    redactPatterns?: string[];
 }
 /** The SAFE default: deny everything until the user opts in. */
 export declare const DEFAULT_POLICY: Readonly<Policy>;

package/dist/src/security/policy.js

@@ -40,6 +40,9 @@ exports.DEFAULT_POLICY = Object.freeze({
     uploadsDir: undefined,
     allowAllTabs: false,
     enableMutations: false,
+    allowObservers: false,
+    redact: false,
+    redactPatterns: [],
 });
 /** Merge a partial (from a policy file and/or CLI flags) over the safe default. */
 function resolvePolicy(partial) {
@@ -51,6 +54,9 @@ function resolvePolicy(partial) {
         uploadsDir: partial?.uploadsDir ?? exports.DEFAULT_POLICY.uploadsDir,
         allowAllTabs: partial?.allowAllTabs ?? exports.DEFAULT_POLICY.allowAllTabs,
         enableMutations: partial?.enableMutations ?? exports.DEFAULT_POLICY.enableMutations,
+        allowObservers: partial?.allowObservers ?? exports.DEFAULT_POLICY.allowObservers,
+        redact: partial?.redact ?? exports.DEFAULT_POLICY.redact,
+        redactPatterns: partial?.redactPatterns ?? [...(exports.DEFAULT_POLICY.redactPatterns ?? [])],
     };
 }
 // ---------------------------------------------------------------------------

package/docs/BLUEPRINT.md

@@ -350,7 +350,7 @@ export type ExecutorErrorCode =
 
 ## 5. The Complete MCP Tool Surface
 
-26 tools. `readOnly` is metadata (not a JSON-Schema field) consumed by the host
+38 tools. `readOnly` is metadata (not a JSON-Schema field) consumed by the host
 and by **safe-mode** (shipped in v1, default ON). Every handler:
 `withReadyExecutor()` → validate args (`requireTarget` for selector|ref) →
 **`policy.assertUrlAllowed(currentTabUrl, method)`** → call executor/helper →
@@ -381,9 +381,23 @@ never-throw firewall converting any thrown `Error` to `{isError:true}`.
 | `read_as_markdown` | `{selector?, tabId?}` | raw markdown text | read | **server helper** (md-reducer IIFE) |
 | `fill_form` | `{fields:{[selector]:string\|bool}, submitSelector?, tabId?}` | `{filled, submitted}` | mutate | **server helper** (seq `ex.fill`/`ex.click`) |
 | `download_file` | `{url?\|(selector?\|ref?), suggestedName?, tabId?}` | `DownloadResult` | mutate | **executor `download`** (privileged) |
+| `frames_list` | `{tabId?}` | `{frames:[{frameId,top,url,title}]}` | read | executor primitive |
+| `console_logs` | `{level?, sinceSeq?, limit?, clear?, tabId?}` | `{entries,count}` | read | executor `observers` |
+| `network_log` | `{urlContains?, failedOnly?, includeResources?, …}` | `{entries,count}` | read | executor `observers` |
+| `dialogs` | `{policy?, promptText?, sinceSeq?, …}` | `{entries,count,policy}` | read | executor `observers` |
+| `print_pdf` | `{landscape?, printBackground?, scale?, …}` | `{path,bytes,url,title}` | read* | executor `printPdf` (CDP `Page.printToPDF`) |
 | `chrome_status` | `{}` | `ExecutorStatus` + displacement/heartbeat flags | read | manager (defensive cached fallback) |
 
 Notes:
+- **Frame targeting.** Every target-taking tool also accepts `frameId` (pin one
+  frame) or `allFrames` (act in whichever frame has the element). Frame ids come
+  from `frames_list`. Each frame is gated against ITS OWN url by the extension
+  before injection, so a scan can never reach a frame the allowlist excludes.
+- **Locators.** `click`/`type`/`hover`/`select_option` accept `role` + `name`
+  (+ `nth`) in place of selector|ref; `mcp/locate.ts` resolves it through one
+  snapshot server-side and fails loudly on ambiguity.
+- **`observers` is one wire method** behind three tools, gated by `allowObservers`
+  (`--enable-observers`) on top of the domain allowlist.
 - **`screenshot` is `readOnly:true` but auto-scrolls the target into view** before capture — documented benign side effect. Returns a real `{type:'image',data,mimeType}` block (the one envelope extension over the LinkedIn repo). `read*` = read with a benign side effect.
 - **`eval` is `readOnly:false`** (arbitrary JS). Safe-mode disables `eval` and the entire mutating set unless `--unsafe-enable-eval` / `--enable-mutations`. [RESOLVED — security major eval]
 - **`eval`/all reads/all navigations call `policy.assertUrlAllowed(tab.currentUrl, method)`** before dispatch — reads are gated because reads are the exfil payload. [RESOLVED — security major 4]