chrome-bridge-mcp 1.29.1 → 1.29.2

package/README.md

@@ -332,6 +332,11 @@ its own Chromium with `extension/`) · `npm run measure` (schema cost) ·
 `npm run bench:latency` (milliseconds per tool, launches its own Chromium,
 writes `docs/PERFORMANCE.md`).
 
+## Related projects
+
+- [agent-webbridge](https://github.com/jeet-dhandha/agent-webbridge) — drives several Chrome profiles at once, with parallel tabs
+- [awb-recipes](https://github.com/jeet-dhandha/awb-recipes) — community-maintained, dated per-site recipes for automating logged-in websites
+
 ## License
 
 MIT

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "chrome-bridge-mcp",
   "mcpName": "io.github.frsorrentino/chrome-bridge",
-  "version": "1.29.1",
+  "version": "1.29.2",
   "type": "module",
   "description": "Chrome Bridge by frsorrentino: MCP server that lets Claude Code borrow a tab from your own logged-in Chrome and hand it back — logins, 2FA and CAPTCHAs stay with you (handoff). 66 tools; 2.8-4.3× cheaper and up to 9.3× fewer turns than Claude in Chrome, measured; ChromeOS included.",
   "main": "server/index.js",

package/server/protocol.js

@@ -99,7 +99,7 @@ export const MessageType = Object.freeze({
 });
 
 // Versione
-export const VERSION               = '1.29.1';
+export const VERSION               = '1.29.2';
 
 // Configurazione
 export const DEFAULT_PORT          = 8765;

package/server/ws-manager.js

@@ -257,7 +257,7 @@ export class WSManager {
   /**
    * Ogni connessione DEVE identificarsi col primo messaggio:
    * - { type: 'ext_init', token? }  → estensione Chrome (Origin chrome-extension:// obbligatorio)
-   * - { type: 'relay_init' }        → relay client (solo loopback)
+   * - { type: 'relay_init' }        → relay client (solo loopback, senza Origin)
    * Connessioni mute o non valide vengono terminate.
    */
   _handleNewConnection(ws, req) {
@@ -292,6 +292,14 @@ export class WSManager {
           ws.terminate();
           return;
         }
+        // I relay legittimi (server e CLI, ws di Node) non mandano Origin; un
+        // browser lo manda sempre. Senza questo controllo una pagina web
+        // aperta sullo stesso computer diventava un relay e pilotava Chrome.
+        if (origin) {
+          console.error(`[chrome-bridge] relay_init with origin "${origin}" — rejected`);
+          ws.terminate();
+          return;
+        }
         // Il token proteggeva solo ext_init: un relay locale non autenticato
         // aggirava interamente il segreto condiviso.
         if (this.token && msg.token !== this.token) {