iframer-toolkit 0.10.6 → 0.11.0

package/extension/background.js

@@ -12,10 +12,17 @@
 const PORT_START = 3022;
 const PORT_END = 3042;
 const RECONNECT_MS = 2000;
+// Windows takes about 2s to refuse a dead port, and a busy server can take a
+// moment to accept, so don't call a port a miss too quickly.
+const OPEN_TIMEOUT_MS = 1500;
+// The server answers a good token with server_info and a bad one with close 4001.
+const AUTH_TIMEOUT_MS = 5000;
+// A cold node start can take seconds on Windows (antivirus scanning).
+const NATIVE_TIMEOUT_MS = 8000;
 
 let ws = null;
 let currentPort = null;
-let scanning = false;
+let scanPromise = null;
 
 async function getToken() {
   const { token } = await chrome.storage.local.get("token");
@@ -28,12 +35,16 @@ async function getToken() {
 // isn't installed (→ legacy port scan).
 function nativeCall(msg) {
   return new Promise((resolve) => {
+    // A host that never answers must not block connecting: treat it as absent.
+    const timer = setTimeout(() => resolve(null), NATIVE_TIMEOUT_MS);
     try {
       chrome.runtime.sendNativeMessage("com.iframer.token", msg, (resp) => {
         void chrome.runtime.lastError; // host not installed — that's fine
+        clearTimeout(timer);
         resolve(resp || null);
       });
     } catch {
+      clearTimeout(timer);
       resolve(null);
     }
   });
@@ -51,6 +62,9 @@ async function fetchTokenNatively() {
 // DISPLAY NAME. Returns {email, id} or null if not signed in.
 function getChromeProfile() {
   return new Promise((resolve) => {
+    // Not every Chromium build implements this API. The email is only a display
+    // name, so a call that never returns must not hold up connecting.
+    setTimeout(() => resolve(null), 1000);
     try {
       chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => {
         if (chrome.runtime.lastError) return resolve(null);
@@ -111,9 +125,17 @@ async function sendHello(sock) {
   }
 }
 
-async function setStatus(patch) {
-  const prev = (await chrome.storage.local.get("status")).status || {};
-  await chrome.storage.local.set({ status: { ...prev, ...patch } });
+// One at a time: this reads, merges, then writes, so two overlapping calls could
+// put back the old value (a live connection showing as "disconnected").
+let statusWrites = Promise.resolve();
+function setStatus(patch) {
+  statusWrites = statusWrites
+    .then(async () => {
+      const prev = (await chrome.storage.local.get("status")).status || {};
+      await chrome.storage.local.set({ status: { ...prev, ...patch } });
+    })
+    .catch(() => {});
+  return statusWrites;
 }
 
 // Numeric semver compare: is `a` newer than `b`? (x.y.z, extra parts ignored.)
@@ -156,71 +178,104 @@ async function checkForUpdate(serverVersion) {
 let nextScanAt = 0;
 let scanBackoffMs = 0;
 const SCAN_BACKOFF_MAX_MS = 60_000;
+// Asking the native host dials nothing, so there's no console noise to back off
+// from: keep it quick, so a server that just started gets found.
+const HOST_POLL_MAX_MS = 10_000;
 
 function resetScanBackoff() {
   nextScanAt = 0;
   scanBackoffMs = 0;
 }
 
-function bumpScanBackoff() {
-  scanBackoffMs = Math.min(scanBackoffMs ? scanBackoffMs * 2 : 5_000, SCAN_BACKOFF_MAX_MS);
+function bumpScanBackoff(maxMs = SCAN_BACKOFF_MAX_MS) {
+  scanBackoffMs = Math.min(scanBackoffMs ? scanBackoffMs * 2 : 5_000, maxMs);
   nextScanAt = Date.now() + scanBackoffMs;
 }
 
-async function connectLoop() {
-  if (scanning || (ws && ws.readyState === WebSocket.OPEN)) return;
-  if (Date.now() < nextScanAt) return;
-  scanning = true;
-  try {
-    // Ask the native host where the server is. When it answers, we never dial
-    // blind: a dead port dialed = a console error logged, so we only open a
-    // socket to a port the registry says a LIVE server process owns.
-    const info = await nativeCall({ cmd: "get-info" });
-
-    let token = await getToken();
-    if (info && info.ok && info.token && info.token !== token) {
-      token = String(info.token);
-      await chrome.storage.local.set({ token });
-    }
-    if (!token) {
-      await setStatus({ connected: false, reason: "no-token" });
-      bumpScanBackoff();
-      return;
-    }
+function connectLoop() {
+  if (ws && ws.readyState === WebSocket.OPEN) return Promise.resolve();
+  if (scanPromise) return scanPromise;
+  if (Date.now() < nextScanAt) return Promise.resolve();
+  scanPromise = runScan()
+    .catch(() => {})
+    .finally(() => {
+      scanPromise = null;
+    });
+  return scanPromise;
+}
 
-    if (info && info.ok && "alive" in info) {
-      if (!info.alive || !info.port) {
-        // Server simply isn't running (it starts with an iframer session).
-        // Don't attempt any connection — zero console noise.
-        await setStatus({ connected: false, reason: "server-not-running" });
-        bumpScanBackoff();
-        return;
-      }
-      const ok = await tryConnect(info.port, token);
-      if (ok) {
-        resetScanBackoff();
-        return;
-      }
-      await setStatus({ connected: false, reason: "server-not-found" });
-      bumpScanBackoff();
+// For an explicit action (new token, auto-pair): skip the backoff, let any scan
+// still using the old token finish, then connect fresh and wait for the outcome.
+async function reconnectNow() {
+  resetScanBackoff();
+  if (scanPromise) await scanPromise;
+  try { if (ws) ws.close(); } catch {}
+  ws = null;
+  await connectLoop();
+}
+
+// Try each known token on this port. Returns "ok", "bad-token" or "miss".
+async function connectToPort(port, tokens) {
+  let result = "miss";
+  for (const token of tokens) {
+    result = await tryConnect(port, token);
+    if (result === "ok") await chrome.storage.local.set({ token });
+    if (result !== "bad-token") return result;
+  }
+  return result;
+}
+
+async function runScan() {
+  // Ask the native host where the server is. When it answers, we never dial
+  // blind: a dead port dialed = a console error logged, so we only open a
+  // socket to a port it found a live server on.
+  const info = await nativeCall({ cmd: "get-info" });
+  const stored = await getToken();
+  // The host's token first, then any stored or pasted one. Neither overwrites
+  // the other until the server has actually accepted it.
+  const tokens = [...new Set([info && info.token, stored].filter(Boolean).map(String))];
+  if (!tokens.length) {
+    await setStatus({ connected: false, reason: "no-token" });
+    bumpScanBackoff();
+    return;
+  }
+  if (!stored) await chrome.storage.local.set({ token: tokens[0] });
+
+  let result = "miss";
+  const hostKnowsServer = !!(info && info.ok && "alive" in info);
+  if (hostKnowsServer) {
+    if (!info.alive || !info.port) {
+      // Server simply isn't running (it starts with an iframer session).
+      // Don't attempt any connection — zero console noise.
+      await setStatus({ connected: false, reason: "server-not-running" });
+      bumpScanBackoff(HOST_POLL_MAX_MS);
       return;
     }
-
+    result = await connectToPort(info.port, tokens);
+  } else {
     // No native host (or an old copy) — legacy full port scan.
     for (let port = PORT_START; port <= PORT_END; port++) {
-      const ok = await tryConnect(port, token);
-      if (ok) {
-        resetScanBackoff();
-        return;
+      const r = await connectToPort(port, tokens);
+      if (r === "ok") {
+        result = r;
+        break;
       }
+      // Keep looking after a rejection: another user's server can hold a lower
+      // port on the same machine, with ours further up the window.
+      if (r === "bad-token") result = r;
     }
-    await setStatus({ connected: false, reason: "server-not-found" });
-    bumpScanBackoff();
-  } finally {
-    scanning = false;
   }
+
+  if (result === "ok") {
+    resetScanBackoff();
+    return;
+  }
+  await setStatus({ connected: false, reason: result === "bad-token" ? "bad-token" : "server-not-found" });
+  bumpScanBackoff(hostKnowsServer ? HOST_POLL_MAX_MS : SCAN_BACKOFF_MAX_MS);
 }
 
+// Resolves "ok" only after the server has accepted the token. An open socket
+// proves nothing: auth happens after it opens.
 function tryConnect(port, token) {
   return new Promise((resolve) => {
     let settled = false;
@@ -230,47 +285,44 @@ function tryConnect(port, token) {
       // goes in a first {type:"auth"} message instead; the server waits for it.
       sock = new WebSocket(`ws://127.0.0.1:${port}/extension/ws`);
     } catch {
-      resolve(false);
+      resolve("miss");
       return;
     }
+    let timer;
     const done = (val) => {
+      clearTimeout(timer);
       if (!settled) {
         settled = true;
         resolve(val);
       }
     };
-    // If it doesn't open quickly, treat this port as a miss.
-    const timer = setTimeout(() => {
-      try { sock.close(); } catch {}
-      done(false);
-    }, 800);
+    const giveUpAfter = (ms) => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        try { sock.close(); } catch {}
+        done("miss");
+      }, ms);
+    };
+    giveUpAfter(OPEN_TIMEOUT_MS);
 
     sock.onopen = () => {
-      clearTimeout(timer);
-      ws = sock;
-      currentPort = port;
-      wire(sock);
+      giveUpAfter(AUTH_TIMEOUT_MS);
       try {
         sock.send(JSON.stringify({ type: "auth", token }));
       } catch {}
+    };
+    // The server only sends us anything once the token is accepted.
+    sock.onmessage = (ev) => {
+      ws = sock;
+      currentPort = port;
+      wire(sock);
+      handleMessage(sock, ev.data);
       sendHello(sock);
       setStatus({ connected: true, port, reason: null });
-      done(true);
-    };
-    sock.onclose = (ev) => {
-      clearTimeout(timer);
-      // 4001 = server is there but rejected our token. Stop scanning; surface it.
-      if (ev.code === 4001) {
-        setStatus({ connected: false, reason: "bad-token" });
-        done(true); // "found" the server, just unauthorized — don't keep scanning
-        return;
-      }
-      done(false);
-    };
-    sock.onerror = () => {
-      clearTimeout(timer);
-      done(false);
+      done("ok");
     };
+    sock.onclose = (ev) => done(ev.code === 4001 ? "bad-token" : "miss");
+    sock.onerror = () => done("miss");
   });
 }
 
@@ -561,6 +613,11 @@ chrome.debugger.onDetach.addListener((source, reason) => {
 chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
   (async () => {
     if (msg.cmd === "get-state") {
+      // Opening the popup means someone is waiting: retry now, not on the backoff.
+      if (!ws || ws.readyState !== WebSocket.OPEN) {
+        resetScanBackoff();
+        connectLoop();
+      }
       const { status } = await chrome.storage.local.get("status");
       const { profileId, profileName } = await ensureProfile();
       sendResponse({ ok: true, status: status || { connected: false }, profileId, profileName });
@@ -595,24 +652,18 @@ chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
       if (!token) {
         sendResponse({
           ok: false,
-          error: "Pairing host not reachable. Run `iframer install extension` in a terminal, then restart the browser.",
+          error: "Pairing host not reachable. Run `iframer install extension chrome` in a terminal, then try again.",
         });
         return;
       }
       await chrome.storage.local.set({ token });
-      resetScanBackoff();
-      try { if (ws) ws.close(); } catch {}
-      ws = null;
-      await connectLoop();
+      await reconnectNow();
       const { status } = await chrome.storage.local.get("status");
       sendResponse({ ok: true, token, status: status || { connected: false } });
     } else if (msg.cmd === "set-token") {
       await chrome.storage.local.set({ token: msg.token || "" });
       // Force a fresh connection attempt with the new token.
-      resetScanBackoff();
-      try { if (ws) ws.close(); } catch {}
-      ws = null;
-      await connectLoop();
+      await reconnectNow();
       const { status } = await chrome.storage.local.get("status");
       sendResponse({ ok: true, status: status || { connected: false } });
     } else {

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "iframer",
-  "version": "0.10.6",
+  "version": "0.11.0",
   "description": "Let iframer drive a Chrome tab you choose, on your real logged-in session.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp2wbce98k+xDnEgtuzLyNXYBLEDY0nqChuvolb94B3VV1HsHFUulUyNe92eN6MjQuadDohQ2j5mj7zWs4yQoixgTQPe7Gm/+GHWdgxwM2s9t5opnLHwF90LPiJm6q1NGWLM4aK6JT+2I6FnUGmj2bzB4WIlf55C3aMEBoXTqIzG2U8s2cxkXGebWWqbPlMK/Phsmsvo4POWnidbGHPhBOq0iyPTu7RdSDlNdJdJ+dtdNXkMmltKUS881MQI9T6GcCCKhIKcZrJGGnk0xphlWyl+ublTAO0tbQSVB/K7D3JmCxMv690TPtYUPPhGi+C6VCv3IeutLmNo60mvux3wbGQIDAQAB",
   "permissions": [

package/extension/native-host.cjs

@@ -12,9 +12,16 @@
 // stdlib) and must read the same secret locations as src/lib/auth/crypto.ts.
 
 const fs = require("fs");
+const http = require("http");
 const os = require("os");
 const path = require("path");
 
+// Same window the local server allocates its port from
+// (src/mcp/local-server.ts, extension/background.js).
+const PORT_START = 3022;
+const PORT_END = 3042;
+const PROBE_TIMEOUT_MS = 1500;
+
 function readToken() {
   if (process.env.IFRAMER_SECRET) return process.env.IFRAMER_SECRET;
   const dataDir = process.env.IFRAMER_DATA_DIR || path.join(os.homedir(), ".iframer");
@@ -33,34 +40,107 @@ function readToken() {
   return "";
 }
 
-// Where is the iframer server right now? Reads the server registry the local
-// server writes on startup (src/lib/browser/registry.ts) and checks the pid is
-// actually alive — so the extension can connect straight to the right port
-// instead of blind-scanning 21 ports (each dead dial logs a console error).
-function readServerInfo() {
+function readRegisteredPort() {
   const dataDir = process.env.IFRAMER_DATA_DIR || path.join(os.homedir(), ".iframer");
   try {
     const info = JSON.parse(fs.readFileSync(path.join(dataDir, "server.json"), "utf8"));
-    let alive = false;
-    if (info && typeof info.pid === "number") {
-      try {
-        process.kill(info.pid, 0);
-        alive = true;
-      } catch {
-        /* pid gone — stale registry */
-      }
-    }
-    return { port: info && typeof info.port === "number" ? info.port : null, alive };
+    return info && typeof info.port === "number" ? info.port : null;
   } catch {
-    return { port: null, alive: false };
+    return null;
   }
 }
 
-function send(msg) {
+function probe(port) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (ok) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(ok);
+    };
+    const req = http.get({ host: "127.0.0.1", port, path: "/health", agent: false }, (res) => {
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (d) => {
+        if (body.length < 4096) body += d;
+      });
+      res.on("end", () => {
+        try {
+          finish(JSON.parse(body).ok === true);
+        } catch {
+          finish(false);
+        }
+      });
+      res.on("error", () => finish(false));
+    });
+    req.on("error", () => finish(false));
+    const timer = setTimeout(() => {
+      req.destroy();
+      finish(false);
+    }, PROBE_TIMEOUT_MS);
+  });
+}
+
+// Where is the iframer server right now? Only a server that actually answers
+// counts. A pid check can't decide this: on Windows a reused pid looks alive,
+// and a server running as another user looks dead. Probing from here also lets
+// the extension find the port without dialing dead ones (each dead dial logs a
+// console error in the extension).
+async function locateServer() {
+  const registered = readRegisteredPort();
+  if (registered && (await probe(registered))) return { port: registered, alive: true };
+
+  const ports = [];
+  for (let p = PORT_START; p <= PORT_END; p++) if (p !== registered) ports.push(p);
+  // All at once: Windows takes about 2s to refuse a closed port, one by one
+  // would take most of a minute.
+  const found = await new Promise((resolve) => {
+    let left = ports.length;
+    for (const p of ports) {
+      probe(p).then((ok) => {
+        if (ok) resolve(p);
+        else if (--left === 0) resolve(null);
+      });
+    }
+  });
+  return found ? { port: found, alive: true } : { port: registered, alive: false };
+}
+
+function send(msg, done) {
   const payload = Buffer.from(JSON.stringify(msg), "utf8");
   const header = Buffer.alloc(4);
   header.writeUInt32LE(payload.length, 0);
-  process.stdout.write(Buffer.concat([header, payload]));
+  process.stdout.write(Buffer.concat([header, payload]), done);
+}
+
+// Chrome may close stdin while a reply is still being worked out, so exit only
+// once stdin has ended AND every reply has been written.
+let pending = 0;
+let stdinEnded = false;
+function exitIfDone() {
+  if (stdinEnded && pending === 0) process.exit(0);
+}
+
+async function reply(msg) {
+  let out;
+  try {
+    if (msg && msg.cmd === "get-token") {
+      const token = readToken();
+      out = token ? { ok: true, token } : { ok: false, error: "no secret file found — run any iframer command once to create it" };
+    } else if (msg && msg.cmd === "get-info") {
+      // Token + live server location in one call.
+      out = { ok: true, token: readToken() || null, ...(await locateServer()) };
+    } else {
+      out = { ok: false, error: "unknown command" };
+    }
+  } catch (e) {
+    out = { ok: false, error: String((e && e.message) || e) };
+  }
+  send(out, () => {
+    pending--;
+    exitIfDone();
+  });
 }
 
 let buf = Buffer.alloc(0);
@@ -75,17 +155,13 @@ process.stdin.on("data", (chunk) => {
     try {
       msg = JSON.parse(body.toString("utf8"));
     } catch {
-      /* respond with error below */
-    }
-    if (msg && msg.cmd === "get-token") {
-      const token = readToken();
-      send(token ? { ok: true, token } : { ok: false, error: "no secret file found — run any iframer command once to create it" });
-    } else if (msg && msg.cmd === "get-info") {
-      // Token + live server location in one call.
-      send({ ok: true, token: readToken() || null, ...readServerInfo() });
-    } else {
-      send({ ok: false, error: "unknown command" });
+      /* answered as an unknown command */
     }
+    pending++;
+    reply(msg);
   }
 });
-process.stdin.on("end", () => process.exit(0));
+process.stdin.on("end", () => {
+  stdinEnded = true;
+  exitIfDone();
+});

package/extension/popup.js

@@ -15,10 +15,10 @@ function renderStatus(status) {
   const connected = status && status.connected;
   $("dot").className = "dot" + (connected ? " on" : "");
   const reasonText = {
-    "no-token": "No token set — try Pair automatically, or paste it below.",
-    "server-not-found": "iframer server not found. Is Claude Code / iframer running?",
+    "no-token": "No token yet. Run `iframer install extension chrome` in a terminal and this pairs by itself, or paste the output of `iframer extension token` below.",
+    "server-not-found": "iframer server not found. It starts with your Claude/iframer session. Will connect by itself.",
     "server-not-running": "iframer server not running — it starts with your Claude/iframer session. Will connect by itself.",
-    "bad-token": "Token rejected. Check it matches ~/.iframer/secret.",
+    "bad-token": "Token rejected by the server. Paste the output of `iframer extension token` below.",
     disconnected: "Disconnected — retrying…",
   };
   if (connected) {
@@ -86,7 +86,7 @@ $("autopair").addEventListener("click", async () => {
   const res = await send("auto-pair");
   if (res.ok) {
     if (res.token) $("token").value = res.token;
-    $("pairmsg").textContent = "✓ Paired.";
+    $("pairmsg").textContent = res.status && res.status.connected ? "✓ Paired." : "Token saved. See the status above.";
     renderStatus(res.status);
   } else {
     $("pairmsg").textContent = res.error || "Auto-pair failed — paste the token manually below.";
@@ -105,4 +105,13 @@ $("save").addEventListener("click", async () => {
   $("save").textContent = "Save & connect";
 });
 
+// Keep the popup live: pairing usually finishes while it's open.
+chrome.storage.onChanged.addListener((changes, area) => {
+  if (area !== "local") return;
+  if (changes.status) renderStatus(changes.status.newValue);
+  if (changes.token && changes.token.newValue && document.activeElement !== $("token")) {
+    $("token").value = changes.token.newValue;
+  }
+});
+
 init();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iframer-toolkit",
-  "version": "0.10.6",
+  "version": "0.11.0",
   "description": "Browser access toolkit for AI agents — CLI and MCP server for headless/headful browsing, login flows, and pipeline execution.",
   "keywords": [
     "iframer",
@@ -39,9 +39,6 @@
   },
   "scripts": {
     "start": "bun run index.ts",
-    "start:docker": "docker compose up --build -d",
-    "stop:docker": "docker compose down",
-    "logs:docker": "docker compose logs -f api",
     "test:smoke": "node tests/smoke.js",
     "mcp:install": "node bin/cli.js install-mcp",
     "mcp:remove": "node bin/cli.js remove-mcp",
@@ -50,13 +47,13 @@
     "test": "bun test tests/unit",
     "test:extension": "node tests/integration/extension-bridge.mjs",
     "prepublishOnly": "bun run build",
-    "test:cdp-relay": "bun tests/integration/cdp-relay.mjs"
+    "test:cdp-relay": "bun tests/integration/cdp-relay.mjs",
+    "test:kit": "bun tests/integration/kit-bridge.mjs"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.80.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.8.0",
-    "fingerprint-generator": "^2.1.81",
     "patchright": "^1.58.2",
     "playwright-core": "^1.58.0",
     "ws": "^8.18.0",