chromex-mcp 1.8.0 → 1.8.1

package/README.md

@@ -78,7 +78,7 @@ Chromex is a direct CDP layer for coding agents. It sits between raw Chrome DevT
 
 The core runtime uses only Node.js built-in modules. Chromex does not install heavy browser automation runtimes, Selenium, browser drivers, telemetry SDKs, update checkers, or bundled browsers.
 
-The only exception is the optional `audit` command: it shells out to Lighthouse with `npx --yes lighthouse` when you explicitly run an audit. All other CLI and MCP commands run through Chromex's own CDP client.
+The only exception is the optional `audit` command: it runs Lighthouse as a subprocess with `npx --yes lighthouse` when you explicitly run an audit. All other CLI and MCP commands run through Chromex's own CDP client.
 
 Development dependencies are used only for tests and token benchmarks.
 

package/docs/security.md

@@ -2,6 +2,12 @@
 
 Chromex is designed for AI agents interacting with real browsers. Security is a first-class concern.
 
+## Reporting Vulnerabilities
+
+Report suspected vulnerabilities privately to `whallysson.dev@gmail.com`. Do not open a public issue for an undisclosed vulnerability.
+
+Include the affected versions and platforms, reproducible steps or a proof of concept, the expected impact, and any suggested remediation. Keep the report and technical details private until a fixed release is available or a disclosure date is agreed.
+
 ## Config File
 
 All security settings live in `~/.chromex/config.json` (auto-created on first run).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chromex-mcp",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Agent-first Chrome DevTools toolkit with a token-efficient CLI, 85 typed MCP tools, modal-free pipe transport, diagnostics, memory analysis, extensions, and WebMCP.",
   "type": "module",
   "bin": {
@@ -50,6 +50,13 @@
   },
   "devDependencies": {
     "js-tiktoken": "^1.0.21",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1",
+    "nanoid": "^3.3.16",
+    "picomatch": "^4.0.4",
+    "postcss": "^8.5.23",
+    "vite": "^7.3.5"
   }
 }

package/plugins/chromex/skills/chromex/scripts/lib/commands/audit.mjs

@@ -2,7 +2,7 @@
 // Chrome: connects to existing browser via --port (reuses session)
 // Other browsers (Brave, Edge, etc.): Lighthouse launches its own headless Chrome
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { existsSync } from 'fs';
 import { resolveArtifactPath } from '../artifacts.mjs';
 import { evalStr } from './evaluate.mjs';
@@ -30,8 +30,9 @@ function findChromiumPath() {
 // Check if Chrome's HTTP debug endpoint is available (Brave/Edge don't expose it)
 function isHttpDebugAvailable(port) {
   try {
-    const result = execSync(`curl -sf http://127.0.0.1:${port}/json/version`, {
+    const result = execFileSync('curl', ['-sf', `http://127.0.0.1:${port}/json/version`], {
       encoding: 'utf8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'],
+      shell: false,
     });
     return result.length > 0;
   } catch {
@@ -88,7 +89,7 @@ export async function auditStr(cdp, sid, categories, device, reportPath) {
     mode = 'standalone (headless Chrome)';
   }
 
-  const cmd = `npx --yes lighthouse ${JSON.stringify(url)} ${args.join(' ')}`;
+  const lighthouseArgs = ['--yes', 'lighthouse', url, ...args];
 
   // Set CHROME_PATH for standalone mode (Lighthouse uses chrome-launcher which reads it)
   const env = { ...process.env };
@@ -99,16 +100,17 @@ export async function auditStr(cdp, sid, categories, device, reportPath) {
 
   let jsonOutput;
   try {
-    jsonOutput = execSync(cmd, {
+    jsonOutput = execFileSync('npx', lighthouseArgs, {
       encoding: 'utf8',
       timeout: 120000,
       stdio: ['pipe', 'pipe', 'pipe'],
       maxBuffer: 50 * 1024 * 1024,
       env,
+      shell: false,
     });
   } catch (e) {
     const stderr = e.stderr?.toString().trim() || '';
-    if (stderr.includes('not found') || stderr.includes('ENOENT')) {
+    if (e.code === 'ENOENT' || stderr.includes('not found') || stderr.includes('ENOENT')) {
       throw new Error('lighthouse not found. Install: npm i -g lighthouse');
     }
     if (stderr.includes('No Chrome installations found')) {

package/plugins/chromex/skills/chromex/scripts/mcp-server.mjs

@@ -801,7 +801,7 @@ const TOOLS = [
       categories: { type: 'string', description: 'Comma-separated: performance,accessibility,seo,best-practices (default: all)' },
       device: { type: 'string', enum: ['mobile', 'desktop'], description: 'Device preset (default: mobile)' },
       reportPath: { type: 'string', description: 'Path to save full HTML report' },
-    }, ['target'], RO),
+    }, ['target'], RW),
 
   tool('chromex_stats',
     'Session analytics: command counts, average timing, error rates, action timeline. All data is local, never sent externally.',