chromex-mcp 1.8.0 → 1.8.2

package/README.md

@@ -78,7 +78,7 @@ Chromex is a direct CDP layer for coding agents. It sits between raw Chrome DevT
 
 The core runtime uses only Node.js built-in modules. Chromex does not install heavy browser automation runtimes, Selenium, browser drivers, telemetry SDKs, update checkers, or bundled browsers.
 
-The only exception is the optional `audit` command: it shells out to Lighthouse with `npx --yes lighthouse` when you explicitly run an audit. All other CLI and MCP commands run through Chromex's own CDP client.
+The only exception is the optional `audit` command: it uses `npx` to resolve Lighthouse on demand, then runs the Lighthouse JavaScript CLI directly with Node when you explicitly run an audit. All other CLI and MCP commands run through Chromex's own CDP client.
 
 Development dependencies are used only for tests and token benchmarks.
 

package/docs/security.md

@@ -2,6 +2,12 @@
 
 Chromex is designed for AI agents interacting with real browsers. Security is a first-class concern.
 
+## Reporting Vulnerabilities
+
+Report suspected vulnerabilities privately to `whallysson.dev@gmail.com`. Do not open a public issue for an undisclosed vulnerability.
+
+Include the affected versions and platforms, reproducible steps or a proof of concept, the expected impact, and any suggested remediation. Keep the report and technical details private until a fixed release is available or a disclosure date is agreed.
+
 ## Config File
 
 All security settings live in `~/.chromex/config.json` (auto-created on first run).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chromex-mcp",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Agent-first Chrome DevTools toolkit with a token-efficient CLI, 85 typed MCP tools, modal-free pipe transport, diagnostics, memory analysis, extensions, and WebMCP.",
   "type": "module",
   "bin": {
@@ -50,6 +50,13 @@
   },
   "devDependencies": {
     "js-tiktoken": "^1.0.21",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1",
+    "nanoid": "^3.3.16",
+    "picomatch": "^4.0.4",
+    "postcss": "^8.5.23",
+    "vite": "^7.3.5"
   }
 }

package/plugins/chromex/skills/chromex/scripts/lib/commands/audit.mjs

@@ -1,13 +1,59 @@
-// Lighthouse audit via subprocess (zero deps -- invokes npx lighthouse externally)
 // Chrome: connects to existing browser via --port (reuses session)
 // Other browsers (Brave, Edge, etc.): Lighthouse launches its own headless Chrome
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { existsSync } from 'fs';
 import { resolveArtifactPath } from '../artifacts.mjs';
 import { evalStr } from './evaluate.mjs';
 
 const VALID_CATEGORIES = ['performance', 'accessibility', 'seo', 'best-practices'];
+const LIGHTHOUSE_PACKAGE = 'lighthouse';
+const LIGHTHOUSE_RESOLVER = `
+const { existsSync, realpathSync } = require('node:fs');
+const { delimiter, join } = require('node:path');
+const executablePath = (process.env.PATH || '')
+  .split(delimiter)
+  .map(directory => join(directory, 'lighthouse'))
+  .find(existsSync);
+if (!executablePath) throw new Error('Lighthouse executable not found');
+process.stdout.write(realpathSync(executablePath));
+`;
+let cachedLighthouseCliPath;
+
+function resolveLighthouseCliPath() {
+  if (cachedLighthouseCliPath && existsSync(cachedLighthouseCliPath)) {
+    return cachedLighthouseCliPath;
+  }
+
+  try {
+    const cliPath = execFileSync('npx', [
+      '--yes',
+      `--package=${LIGHTHOUSE_PACKAGE}`,
+      '--',
+      process.execPath,
+      '-e',
+      LIGHTHOUSE_RESOLVER,
+    ], {
+      encoding: 'utf8',
+      timeout: 120000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      shell: false,
+    }).trim();
+
+    if (!cliPath || !existsSync(cliPath)) {
+      throw new Error('Lighthouse executable not found after installation');
+    }
+
+    cachedLighthouseCliPath = cliPath;
+    return cachedLighthouseCliPath;
+  } catch (error) {
+    const stderr = error.stderr?.toString().trim() || '';
+    if (error.code === 'ENOENT') {
+      throw new Error('npx not found. Install Node.js with npm.');
+    }
+    throw new Error(`Lighthouse setup failed: ${stderr || error.message}`);
+  }
+}
 
 // Find any Chromium-based browser for CHROME_PATH env var
 function findChromiumPath() {
@@ -30,8 +76,9 @@ function findChromiumPath() {
 // Check if Chrome's HTTP debug endpoint is available (Brave/Edge don't expose it)
 function isHttpDebugAvailable(port) {
   try {
-    const result = execSync(`curl -sf http://127.0.0.1:${port}/json/version`, {
+    const result = execFileSync('curl', ['-sf', `http://127.0.0.1:${port}/json/version`], {
       encoding: 'utf8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'],
+      shell: false,
     });
     return result.length > 0;
   } catch {
@@ -88,7 +135,8 @@ export async function auditStr(cdp, sid, categories, device, reportPath) {
     mode = 'standalone (headless Chrome)';
   }
 
-  const cmd = `npx --yes lighthouse ${JSON.stringify(url)} ${args.join(' ')}`;
+  const lighthouseArgs = [url, ...args];
+  const lighthouseCliPath = resolveLighthouseCliPath();
 
   // Set CHROME_PATH for standalone mode (Lighthouse uses chrome-launcher which reads it)
   const env = { ...process.env };
@@ -99,18 +147,16 @@ export async function auditStr(cdp, sid, categories, device, reportPath) {
 
   let jsonOutput;
   try {
-    jsonOutput = execSync(cmd, {
+    jsonOutput = execFileSync(process.execPath, [lighthouseCliPath, ...lighthouseArgs], {
       encoding: 'utf8',
       timeout: 120000,
       stdio: ['pipe', 'pipe', 'pipe'],
       maxBuffer: 50 * 1024 * 1024,
       env,
+      shell: false,
     });
   } catch (e) {
     const stderr = e.stderr?.toString().trim() || '';
-    if (stderr.includes('not found') || stderr.includes('ENOENT')) {
-      throw new Error('lighthouse not found. Install: npm i -g lighthouse');
-    }
     if (stderr.includes('No Chrome installations found')) {
       throw new Error('Lighthouse needs Chrome installed to run in standalone mode. Install Google Chrome or run against a Chrome instance with debug port.');
     }

package/plugins/chromex/skills/chromex/scripts/mcp-server.mjs

@@ -801,7 +801,7 @@ const TOOLS = [
       categories: { type: 'string', description: 'Comma-separated: performance,accessibility,seo,best-practices (default: all)' },
       device: { type: 'string', enum: ['mobile', 'desktop'], description: 'Device preset (default: mobile)' },
       reportPath: { type: 'string', description: 'Path to save full HTML report' },
-    }, ['target'], RO),
+    }, ['target'], DESTRUCTIVE),
 
   tool('chromex_stats',
     'Session analytics: command counts, average timing, error rates, action timeline. All data is local, never sent externally.',
@@ -1053,7 +1053,7 @@ function toolToCmd(name, p) {
       return { cmd: 'webmcp', args: a };
     }
     case 'chromex_webauthn':   return { cmd: 'webauthn', args: [p.action] };
-    case 'chromex_audit':      return { cmd: 'audit', args: [p.categories || '', p.device || '', p.reportPath || ''].filter(Boolean) };
+    case 'chromex_audit':      return { cmd: 'audit', args: [p.categories ?? '', p.device ?? '', p.reportPath ?? ''] };
     case 'chromex_stats': {
       const a = [];
       if (p.full) a.push('--full');