@modootoday/datalab-extension-mcp 1.8.23 → 1.8.24

package/README.en.md

@@ -61,7 +61,7 @@ One command finds **every** AI app on your computer and connects them automatica
 2. **Paste this command and press Enter.** The saved command names an exact bootstrap version. At startup and while idle, the connector checks the canonical release and promotes itself to the current secure, compatible version. Diagnostic environments can opt out with `--no-self-update`.
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.23 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.24 install
    ```
 
    Lines of English scrolling by is normal. This only downloads and runs the connector — it touches nothing else.
@@ -145,10 +145,10 @@ Registration is once per browser. The connection itself lives only while the sid
 Installing also places the bundled **writing skills**. An AI app reads the name and description of every installed skill on every start, so the more are installed the less room the conversation has. The default therefore places only the ones that work right away.
 
 ```
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills list
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills status
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills attach <name>
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills detach <name>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills list
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills status
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills attach <name>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills detach <name>
 ```
 
 - `list` shows everything in this version, name and description.
@@ -167,10 +167,10 @@ The **workbench** is this computer, where the connector runs. If you use more th
 Make the code in extension settings → **다른 AI 앱에 연결 (MCP)** → expand **[다른 브라우저 추가 (선택)]** (add another browser, optional) below box 3 → [등록 코드 만들기]. Or from the terminal.
 
 ```
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers add "Work Chrome"
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers list
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers revoke <handle>
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers repair
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers add "Work Chrome"
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers list
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers revoke <handle>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers repair
 ```
 
 `add` **asks you to paste the install key** — the same value you used to
@@ -272,7 +272,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 - **When the connection disappears** — run the very command you used at the start once more; it safely re-registers. (Some AI apps clean up their settings file and drop the connection.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.23 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.24 install
   ```
 
 - **`'npx' is not recognized...`** — Node.js isn't installed. The "No Node.js?" one-liner in Step 2 is the simplest fix.
@@ -302,7 +302,7 @@ Start it again after a full quit and it picks the tools up. If they still aren't
 1. Run this in a terminal (it removes the entries registered in your AI apps).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.23 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.24 uninstall
    ```
 
 2. Turn **MCP 연결** off in the extension settings. The panel is the bridge, so with it off a leftover config line can look nothing up.

package/README.md

@@ -55,7 +55,7 @@ Claude 같은 AI 앱을 데이터랩툴즈에 연결해 주는 작은 무료 프
 2. **아래 명령을 붙여넣고 Enter를 눌러요.** 저장되는 명령은 정확한 시작 버전을 적습니다. 연결 프로그램은 시작할 때와 유휴 상태에서 정본 릴리스를 확인해 현재의 안전하고 호환되는 버전으로 승격합니다. 진단 환경에서는 `--no-self-update`로 승격을 끌 수 있어요.
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.23 install
+   npx -y @modootoday/datalab-extension-mcp@1.8.24 install
    ```
 
    영어 글자가 여러 줄 올라오는 건 정상이에요. 이 명령은 연결 프로그램을 다운로드해 실행할 뿐, 다른 건 건드리지 않아요.
@@ -133,10 +133,10 @@ Claude 같은 AI 앱을 데이터랩툴즈에 연결해 주는 작은 무료 프
 설치할 때 **글쓰기 도움말(스킬)** 도 함께 놓입니다. AI 앱은 켜질 때마다 설치된 도움말의 이름과 설명을 전부 읽기 때문에, 많이 깔수록 대화에 쓸 자리가 줄어들어요. 그래서 기본은 **바로 쓸 수 있는 것만** 놓습니다.
 
 ```
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills list
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills status
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills attach <이름>
-npx -y @modootoday/datalab-extension-mcp@1.8.23 skills detach <이름>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills list
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills status
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills attach <이름>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 skills detach <이름>
 ```
 
 - `list` 는 이 버전에 들어 있는 전부를 이름과 설명으로 보여 줘요.
@@ -155,10 +155,10 @@ npx -y @modootoday/datalab-extension-mcp@1.8.23 skills detach <이름>
 확장 설정 → **다른 AI 앱에 연결 (MCP)** → 3번 아래의 **[다른 브라우저 추가 (선택)]** 를 펼쳐 [등록 코드 만들기]를 눌러도 되고, 터미널을 쓰셔도 돼요.
 
 ```
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers add "회사 크롬"
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers list
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers revoke <handle>
-npx -y @modootoday/datalab-extension-mcp@1.8.23 browsers repair
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers add "회사 크롬"
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers list
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers revoke <handle>
+npx -y @modootoday/datalab-extension-mcp@1.8.24 browsers repair
 ```
 
 `add` 를 실행하면 **설치 인증키를 붙여넣으라고 물어봐요** — 설치할 때와 같은 값이고, 설정 화면 1번의 `복사` 버튼으로 얻습니다. 그러면 브라우저 등록 코드가 **한 번만** 출력돼요. 연결 프로그램은 그 코드를 저장하지 않고 지문만 남기므로 다시 보여 줄 수 없어요.
@@ -237,7 +237,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 - **연결이 사라졌을 때** — 처음 실행했던 그 명령을 한 번 더 실행하면 안전하게 다시 등록돼요. (일부 AI 앱이 설정 파일을 정리하며 연결을 지우기도 해요.)
 
   ```
-  npx -y @modootoday/datalab-extension-mcp@1.8.23 install
+  npx -y @modootoday/datalab-extension-mcp@1.8.24 install
   ```
 
 - **`'npx'을(는) 내부 또는 외부 명령...`** — Node.js가 없는 거예요. 위 2단계의 "Node.js가 없다면" 한 줄 설치가 가장 간단해요.
@@ -267,7 +267,7 @@ AI가 "그런 기능은 없다" 고 답하면, **"도구 목록을 확인해 보
 1. 터미널에서 아래 명령을 실행해요(AI 앱에 등록된 설정을 지워 줘요).
 
    ```
-   npx -y @modootoday/datalab-extension-mcp@1.8.23 uninstall
+   npx -y @modootoday/datalab-extension-mcp@1.8.24 uninstall
    ```
 
 2. 확장 설정에서 **MCP 연결을 꺼요.** 패널이 브릿지라, 꺼 두면 어딘가 설정 줄이 남아 있어도 AI 앱이 아무것도 조회할 수 없어요.

package/dist/{browsers-T6B6IUYR.js → browsers-WRKF6F25.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_HOST,
   DEFAULT_PORT
-} from "./chunk-EGSZC33X.js";
+} from "./chunk-KAEK57JP.js";
 import {
   TOKEN_PROMPT_GUIDE,
   TOKEN_PROMPT_QUESTION,

package/dist/{chunk-KE5ZJQKG.js → chunk-4EOWBJT2.js}

@@ -6,7 +6,7 @@ import {
   readTakeoverSecret,
   spawnDaemon,
   tryConnect
-} from "./chunk-EGSZC33X.js";
+} from "./chunk-KAEK57JP.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";

package/dist/{chunk-EGSZC33X.js → chunk-KAEK57JP.js}

@@ -1,4 +1,4 @@
-// ../mcp-server/dist/chunk-5F4SKHY3.js
+// ../mcp-server/dist/chunk-6LCDUQNO.js
 import { createHash } from "crypto";
 import {
   appendFileSync,
@@ -15802,6 +15802,31 @@ var Bridge = class {
   verifyRootToken(presented) {
     return checkToken(presented ?? void 0, this.#deps.token).ok;
   }
+  /**
+   * May this credential add a browser to this machine?
+   *
+   * The root token, or a browser already registered here. Binding this to the
+   * root alone tied the right to add a browser to whoever installed last, so
+   * the second browser's only offered path was to install again -- which moved
+   * the right away from the first one, which then had the same problem.
+   *
+   * Deliberately NOT the same predicate as verifyRootToken: that one also
+   * authorises shutdown, and a browser must not be able to end another's
+   * unattended run. Widening is limited to adding and listing; revoking still
+   * needs the root, because taking a browser off is the destructive half.
+   */
+  verifyBrowserAddToken(presented) {
+    if (presented === void 0 || presented === null || presented === "") {
+      return false;
+    }
+    if (this.verifyRootToken(presented)) return true;
+    const hash2 = digestToken(presented);
+    if (this.#deps.wasRevoked(hash2)) return false;
+    for (const current of this.#deps.claimedBrowsers.values()) {
+      if (timingSafeEqual(hash2, current)) return true;
+    }
+    return false;
+  }
   /**
    * Does the presented value belong to somebody currently holding the bridge?
    *
@@ -17669,13 +17694,13 @@ function createHttpBridge(opts) {
       res.setHeader("cache-control", "no-store");
       void readJson(req, MAX_BODY_BYTES).then(async (body) => {
         const b = body;
-        if (!opts.bridge.verifyRootToken(
-          typeof b?.["token"] === "string" ? b["token"] : ""
-        )) {
+        const presented = typeof b?.["token"] === "string" ? b["token"] : "";
+        const action = b?.["action"];
+        const mayAdd = action === "add" || action === "list" ? opts.bridge.verifyBrowserAddToken(presented) : opts.bridge.verifyRootToken(presented);
+        if (!mayAdd) {
           json2(res, 403, { error: "unauthorized" });
           return;
         }
-        const action = b?.["action"];
         if (action === "list") {
           const active = new Set(
             opts.bridge.connectedBrowsers().map((row) => row.id)

package/dist/cli.js

@@ -2,10 +2,10 @@
 import {
   dispatchCli,
   runAdapter
-} from "./chunk-KE5ZJQKG.js";
+} from "./chunk-4EOWBJT2.js";
 import {
   runDaemon
-} from "./chunk-EGSZC33X.js";
+} from "./chunk-KAEK57JP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
@@ -62,7 +62,7 @@ async function main() {
     // Loaded lazily, like the installer: the adapter path is what an MCP host
     // spawns and must not pay for a command only an operator types.
     browsers: async (argv) => {
-      const { runBrowsers } = await import("./browsers-T6B6IUYR.js");
+      const { runBrowsers } = await import("./browsers-WRKF6F25.js");
       const { createNodeIo } = await import("./dist-VANK7DDE.js");
       const io = createNodeIo();
       const code = await runBrowsers(argv, {

package/dist/index.js

@@ -3,8 +3,8 @@ import {
   dispatchCli,
   ensureDaemonRunning,
   runAdapter
-} from "./chunk-KE5ZJQKG.js";
-import "./chunk-EGSZC33X.js";
+} from "./chunk-4EOWBJT2.js";
+import "./chunk-KAEK57JP.js";
 import "./chunk-MLKGABMK.js";
 export {
   createAdapterServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/datalab-extension-mcp",
-  "version": "1.8.23",
+  "version": "1.8.24",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",