iframer-toolkit 0.10.8 → 0.11.1

package/dist/mcp-server.cjs

@@ -112,8 +112,8 @@ function isPidAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (e) {
+    return e.code === "EPERM";
   }
 }
 function readServerInfo() {
@@ -208,7 +208,6 @@ var LocalServerManager = class {
       const env = {
         ...process.env,
         PORT: String(port),
-        IFRAMER_MODE: "local",
         IFRAMER_DATA_DIR: dataDir
       };
       if (process.env.IFRAMER_SECRET) {
@@ -223,8 +222,12 @@ var LocalServerManager = class {
       const child = (0, import_child_process.spawn)(command, args, {
         env,
         stdio: ["ignore", logFd, logFd],
-        detached: true
+        detached: true,
+        // On Windows a detached child otherwise gets its own console window,
+        // and closing that window kills the server.
+        windowsHide: true
       });
+      child.on("error", (e) => console.error(`[iframer] could not start the local server: ${e.message}`));
       child.unref();
       import_fs3.default.closeSync(logFd);
       const deadline = Date.now() + STARTUP_TIMEOUT_MS;
@@ -374,9 +377,7 @@ function getErrorMessage(err2) {
 
 // src/mcp/helpers.ts
 var log2 = createLogger("mcp");
-var BASE_URL = process.env.IFRAMER_URL || "http://localhost:3021";
 var IFRAMER_SECRET = process.env.IFRAMER_SECRET;
-var IFRAMER_MODE = process.env.IFRAMER_MODE;
 var LOCAL_TOKEN = getLocalToken();
 var localServer = new LocalServerManager();
 async function ensureLocalServer() {
@@ -388,19 +389,6 @@ function authHeaders(secret) {
   if (key) headers["x-api-key"] = key;
   return headers;
 }
-async function apiPost(endpoint, body) {
-  const res = await fetch(`${BASE_URL}${endpoint}`, {
-    method: "POST",
-    headers: authHeaders(),
-    body: body ? JSON.stringify(body) : void 0,
-    signal: AbortSignal.timeout(18e4)
-  });
-  return res.json();
-}
-async function apiGet(endpoint) {
-  const res = await fetch(`${BASE_URL}${endpoint}`, { headers: authHeaders(), signal: AbortSignal.timeout(3e4) });
-  return res.json();
-}
 async function localApiPost(endpoint, body, timeoutMs = 18e4) {
   await ensureLocalServer();
   const url = localServer.getBaseUrl();
@@ -424,15 +412,6 @@ async function localApiDelete(endpoint) {
   const res = await fetch(`${url}${endpoint}`, { method: "DELETE", headers: authHeaders(LOCAL_TOKEN), signal: AbortSignal.timeout(3e4) });
   return res.json();
 }
-async function isDockerRunning() {
-  try {
-    const res = await fetch(`${BASE_URL}/health`, { signal: AbortSignal.timeout(3e3) });
-    const data = await res.json();
-    return data.ok === true;
-  } catch {
-    return false;
-  }
-}
 async function resolveScreenshotPath(url) {
   try {
     if (url.startsWith("file://")) {
@@ -448,7 +427,7 @@ async function resolveScreenshotPath(url) {
     const fs10 = await import("fs");
     const dir = import_path5.default.join(import_os3.default.tmpdir(), "iframer-screenshots", "screenshots");
     fs10.mkdirSync(dir, { recursive: true });
-    const filePath = import_path5.default.join(dir, `docker-${Date.now()}.jpg`);
+    const filePath = import_path5.default.join(dir, `screenshot-${Date.now()}.jpg`);
     fs10.writeFileSync(filePath, buf);
     return filePath;
   } catch {
@@ -467,7 +446,7 @@ function defaultFile() {
   return import_path6.default.join(getDataDir(), "domain-modes.json");
 }
 var TTL_DAYS = 14;
-var ESCALATION_LADDER = ["headless", "docker-headful", "binary-headful"];
+var ESCALATION_LADDER = ["headless", "binary-headful"];
 var DomainModeStore = class {
   data = {};
   filePath;
@@ -572,8 +551,6 @@ function registerStatusTool(server2) {
     async () => {
       try {
         const status = {};
-        const dockerRunning = await isDockerRunning();
-        status.dockerApi = dockerRunning;
         try {
           const localHealth = await localApiGet("/health");
           status.localServer = localHealth.ok;
@@ -591,13 +568,6 @@ function registerStatusTool(server2) {
           if (inst.instances && inst.instances.length) status.liveInstances = inst.instances;
         } catch {
         }
-        if (dockerRunning) {
-          try {
-            const sessionData = await apiGet("/interactive/status");
-            status.dockerSession = sessionData.active ? { active: true, noVncUrl: sessionData.noVncUrl } : { active: false };
-          } catch {
-          }
-        }
         try {
           const credData = await localApiGet("/credentials");
           status.credentials = credData.domains || [];
@@ -706,8 +676,8 @@ A captcha is blocking this run. Use the "recaptcha" step with an action:
   {type:"recaptcha", action:"click"}               \u2192 click the "I'm not a robot" checkbox
   {type:"recaptcha", action:"answer", tiles:[...]} \u2192 select tiles + verify + re-check (handles refreshing grids)
   {type:"recaptcha", action:"select"|"verify"}     \u2192 manual tile-select / submit, if you need finer control
-  {type:"recaptcha", action:"solve"}               \u2192 automatic vision solve (docker-headful)
-Or {type:"solve-captcha"} for one-shot auto-detect + solve.
+  {type:"recaptcha", action:"solve"}               \u2192 automatic vision solve (needs ANTHROPIC_API_KEY)
+Or {type:"solve-captcha"} for one-shot auto-detect + solve (needs ANTHROPIC_API_KEY).
 In binary-headful mode, prefer asking the user to solve it in the visible window.`;
 function captchaBlocked(data) {
   if (data.error?.errorType === "captcha-unsolvable") return true;
@@ -840,7 +810,7 @@ Returns: ok, completedSteps, output for snapshot/find/read/extract steps, obstac
         continueOnObstacle: import_zod3.z.boolean().optional().describe("Try to auto-resolve obstacles (default: true)"),
         continueOnError: import_zod3.z.boolean().optional().describe("Continue past failing steps (default: false)"),
         captureApi: import_zod3.z.boolean().optional().describe("Record all API calls (XHR/fetch) the page makes. Also surfaces every HTTP >= 400 response per step \u2014 turn it on when a form submit fails with only a vague on-page message, to read the server's real answer."),
-        mode: import_zod3.z.enum(["headless", "binary-headful", "docker-headful", "extension"]).optional().describe("DO NOT SET unless the user explicitly requests a mode \u2014 iframer auto-selects and auto-escalates. 'extension' drives a real-Chrome tab (requires options.tabId from the `tabs` tool)."),
+        mode: import_zod3.z.enum(["headless", "binary-headful", "extension"]).optional().describe("DO NOT SET unless the user explicitly requests a mode \u2014 iframer auto-selects and auto-escalates. 'extension' drives a real-Chrome tab (requires options.tabId from the `tabs` tool)."),
         autoEscalate: import_zod3.z.boolean().optional().describe("Auto-retry with a stronger mode if blocked (default: true)"),
         instanceId: import_zod3.z.string().optional().describe("Named parallel browser (default 'default') \u2014 distinct ids drive several browsers at once, each with its own session state."),
         tabId: import_zod3.z.number().optional().describe("mode='extension': the real-Chrome tab id to drive (from the `tabs` tool)."),
@@ -850,6 +820,13 @@ Returns: ok, completedSteps, output for snapshot/find/read/extract steps, obstac
     },
     async (params) => {
       try {
+        let runWithMode2 = function(mode) {
+          return localApiPost("/execute", {
+            steps,
+            options: { ...params.options, mode: mode || void 0 }
+          });
+        };
+        var runWithMode = runWithMode2;
         const steps = normalizeSteps(params.steps);
         if (params.options?.mode === "extension") {
           const tabId = params.options?.tabId;
@@ -873,43 +850,9 @@ Returns: ok, completedSteps, output for snapshot/find/read/extract steps, obstac
           if (!extResult.ok) return { content: content2, isError: true };
           return { content: content2 };
         }
-        const dockerRunning = await isDockerRunning();
-        async function runWithMode(mode) {
-          if (mode === "docker-headful") {
-            if (!dockerRunning) {
-              return {
-                ok: false,
-                completedSteps: 0,
-                totalSteps: steps.length,
-                results: [],
-                finalState: { url: "", title: "" },
-                obstacles: [],
-                durationMs: 0,
-                modeUsed: "docker-headful",
-                error: {
-                  failedAtStep: 0,
-                  failedStep: steps[0],
-                  errorType: "action-failed",
-                  message: "docker-headful mode was requested but the Docker API is not reachable.",
-                  pageState: { url: "", title: "" },
-                  suggestion: "Start Docker with `bun run start:docker`, or omit options.mode.",
-                  retryable: false
-                }
-              };
-            }
-            return apiPost("/execute", {
-              steps,
-              options: { ...params.options, mode: "docker-headful", autoEscalate: false }
-            });
-          }
-          return localApiPost("/execute", {
-            steps,
-            options: { ...params.options, mode: mode || void 0 }
-          });
-        }
         let execResult;
         try {
-          execResult = await runWithMode(params.options?.mode);
+          execResult = await runWithMode2(params.options?.mode);
         } catch (execErr) {
           const msg = execErr instanceof Error ? execErr.message : String(execErr);
           const isCrash = /ECONNREFUSED|ECONNRESET|EPIPE|socket hang up|fetch failed/i.test(msg);
@@ -920,7 +863,7 @@ Returns: ok, completedSteps, output for snapshot/find/read/extract steps, obstac
             } catch {
             }
             try {
-              execResult = await runWithMode(params.options?.mode);
+              execResult = await runWithMode2(params.options?.mode);
             } catch (retryErr) {
               return err(
                 `Browser server crashed and retry also failed.
@@ -936,14 +879,8 @@ Call \`session restart\` to reset, then retry.`
         }
         const requestedMode = params.options?.mode;
         if (!execResult.ok && execResult.error?.errorType === "bot-blocked" && params.options?.autoEscalate !== false && !requestedMode) {
-          const escalation = ["docker-headful", "binary-headful"];
-          for (const nextMode of escalation) {
-            if (nextMode === "docker-headful" && !dockerRunning) continue;
-            log2.info(`Auto-escalating to ${nextMode}`);
-            execResult = await runWithMode(nextMode);
-            if (execResult.ok) break;
-            if (execResult.error?.errorType !== "bot-blocked") break;
-          }
+          log2.info("Auto-escalating to binary-headful");
+          execResult = await runWithMode2("binary-headful");
         }
         const lines = formatExecuteResult(execResult);
         let screenshotUrl = null;
@@ -991,7 +928,7 @@ During capture, drive the site like a user (open the inbox, send a message\u2026
         staleTimeoutMs: import_zod4.z.number().optional().describe("Override the 20s stale-state timeout per step"),
         continueOnObstacle: import_zod4.z.boolean().optional().describe("Try to auto-resolve obstacles (default: true)"),
         continueOnError: import_zod4.z.boolean().optional().describe("Continue past failing steps (default: false)"),
-        mode: import_zod4.z.enum(["headless", "binary-headful", "docker-headful", "extension"]).optional().describe("Mode override. 'extension' captures a tab already open in the user's real Chrome (requires options.tabId from `tabs`)."),
+        mode: import_zod4.z.enum(["headless", "binary-headful", "extension"]).optional().describe("Mode override. 'extension' captures a tab already open in the user's real Chrome (requires options.tabId from `tabs`)."),
         tabId: import_zod4.z.number().optional().describe("mode='extension': the real-Chrome tab id (from `tabs`)."),
         clientId: import_zod4.z.string().optional().describe("mode='extension': owning profile's clientId when the tab is ambiguous.")
       }).optional()
@@ -1004,7 +941,6 @@ During capture, drive the site like a user (open the inbox, send a message\u2026
           options: { ...params.options, captureApi: true }
         };
         const mode = params.options?.mode;
-        const dockerRunning = await isDockerRunning();
         let captureResult;
         if (mode === "extension") {
           if (typeof params.options?.tabId !== "number") {
@@ -1016,8 +952,6 @@ During capture, drive the site like a user (open the inbox, send a message\u2026
             steps,
             options: { ...params.options, captureApi: true }
           });
-        } else if (mode === "docker-headful" && dockerRunning) {
-          captureResult = await apiPost("/execute", execParams);
         } else {
           captureResult = await localApiPost("/execute", execParams);
         }
@@ -1253,13 +1187,6 @@ stop: save cookies/localStorage and close the browser \u2014 ALWAYS call when br
               parts.push(`Local restart failed: ${e instanceof Error ? e.message : String(e)}`);
             }
           }
-          try {
-            if (await isDockerRunning()) {
-              await apiPost("/browser/restart");
-              parts.push("Docker browser restarted.");
-            }
-          } catch {
-          }
           parts.push("Credentials and knowledge cache are untouched. Next execute launches a fresh browser.");
           return { content: [{ type: "text", text: parts.join(" ") }] };
         }
@@ -2091,18 +2018,7 @@ function safeJsonLen(v) {
 }
 
 // src/mcp/server.ts
-var IS_DEV = process.env.IFRAMER_URL?.includes("localhost") || process.env.IFRAMER_URL?.includes("127.0.0.1");
-var INSTRUCTIONS = IS_DEV ? `iframer-dev \u2014 local development instance of iframer (connects to ${BASE_URL}).
-
-CRITICAL RULES:
-1. NEVER ask the user "do you have credentials?". Call credentials action=list and read the response.
-2. NEVER ask the user for passwords in chat. Use credentials action=store (secure form) or the CLI fallback.
-3. DO NOT present options when you can just act. Check credentials, execute, show results.
-4. If execute fails, read the error. It tells you exactly what happened and where.
-5. Call "session" action=stop when done to save session state.
-
-CAPTCHA: Use the "solve-captcha" step \u2014 auto-detects reCAPTCHA/hCaptcha and solves with vision AI.
-REVERSE ENGINEERING: Use the "reverse-engineer" tool when the user asks to capture/map APIs.` : `iframer \u2014 browser access for AI agents when normal methods fail.
+var INSTRUCTIONS = `iframer \u2014 browser access for AI agents when normal methods fail.
 
 CRITICAL RULES:
 1. NEVER ask "do you have credentials?". Call credentials action=list and read the response.
@@ -2119,7 +2035,7 @@ If headless detects Imperva or Akamai, immediately stop headless and pivot to he
 
 BROWSER MODES: Don't specify options.mode \u2014 iframer auto-selects and auto-escalates (headless \u2192 binary-headful). Only set a mode if the user explicitly asks.
 
-CAPTCHA: In binary-headful mode, ask the user to solve it in the visible window. In docker-headful mode, use the "solve-captcha" step.
+CAPTCHA: In binary-headful mode, ask the user to solve it in the visible window. Otherwise try the "solve-captcha" step (best effort, needs ANTHROPIC_API_KEY).
 
 REVERSE ENGINEERING: Use the "reverse-engineer" tool when the user asks to capture/map/save API endpoints.`;
 var server = new import_mcp.McpServer(

package/extension/README.md

@@ -81,22 +81,24 @@ build` instead; `iframer update` detects that and says so.)
 ## Pair it (one time, zero copying)
 
 ```sh
-iframer install extension
+iframer install extension chrome
 ```
 
-then restart the browser. That installs a Chrome **native-messaging host**
+on macOS, Linux or Windows. That installs a Chrome **native-messaging host**
 (locked to this extension's pinned ID) that hands the extension the pairing
 token straight from `~/.iframer/secret` — every profile and every Chromium-family
 browser (Chrome, Brave, Edge, …) pairs itself, and re-pairs automatically after
-a reinstall or a rotated secret. No copying, ever.
+a reinstall or a rotated secret. No copying, ever. The command also tests the
+host and starts the local server, and tells you if either one fails.
 
 Manual fallback (host not installed): click the iframer toolbar icon → paste the
-token from `cat ~/.iframer/secret` → **Save & connect**.
+output of `iframer extension token` → **Save & connect**.
 
-Either way the dot turns green when it finds the running iframer server (it
-scans ports 3022–3042 on `127.0.0.1`; the server allocates its port from the
-same window). The token is the same machine-local secret the iframer CLI/MCP
-already use. It is only ever sent to `127.0.0.1`.
+Either way the dot turns green only once the running iframer server has accepted
+the token (the host locates the server; without a host the extension scans ports
+3022–3042 on `127.0.0.1`, the window the server allocates its port from). The
+token is the same machine-local secret the iframer CLI/MCP already use. It is
+only ever sent to `127.0.0.1`.
 
 ## Use it
 

package/extension/background.js

@@ -12,10 +12,17 @@
 const PORT_START = 3022;
 const PORT_END = 3042;
 const RECONNECT_MS = 2000;
+// Windows takes about 2s to refuse a dead port, and a busy server can take a
+// moment to accept, so don't call a port a miss too quickly.
+const OPEN_TIMEOUT_MS = 1500;
+// The server answers a good token with server_info and a bad one with close 4001.
+const AUTH_TIMEOUT_MS = 5000;
+// A cold node start can take seconds on Windows (antivirus scanning).
+const NATIVE_TIMEOUT_MS = 8000;
 
 let ws = null;
 let currentPort = null;
-let scanning = false;
+let scanPromise = null;
 
 async function getToken() {
   const { token } = await chrome.storage.local.get("token");
@@ -28,12 +35,16 @@ async function getToken() {
 // isn't installed (→ legacy port scan).
 function nativeCall(msg) {
   return new Promise((resolve) => {
+    // A host that never answers must not block connecting: treat it as absent.
+    const timer = setTimeout(() => resolve(null), NATIVE_TIMEOUT_MS);
     try {
       chrome.runtime.sendNativeMessage("com.iframer.token", msg, (resp) => {
         void chrome.runtime.lastError; // host not installed — that's fine
+        clearTimeout(timer);
         resolve(resp || null);
       });
     } catch {
+      clearTimeout(timer);
       resolve(null);
     }
   });
@@ -51,6 +62,9 @@ async function fetchTokenNatively() {
 // DISPLAY NAME. Returns {email, id} or null if not signed in.
 function getChromeProfile() {
   return new Promise((resolve) => {
+    // Not every Chromium build implements this API. The email is only a display
+    // name, so a call that never returns must not hold up connecting.
+    setTimeout(() => resolve(null), 1000);
     try {
       chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => {
         if (chrome.runtime.lastError) return resolve(null);
@@ -111,9 +125,17 @@ async function sendHello(sock) {
   }
 }
 
-async function setStatus(patch) {
-  const prev = (await chrome.storage.local.get("status")).status || {};
-  await chrome.storage.local.set({ status: { ...prev, ...patch } });
+// One at a time: this reads, merges, then writes, so two overlapping calls could
+// put back the old value (a live connection showing as "disconnected").
+let statusWrites = Promise.resolve();
+function setStatus(patch) {
+  statusWrites = statusWrites
+    .then(async () => {
+      const prev = (await chrome.storage.local.get("status")).status || {};
+      await chrome.storage.local.set({ status: { ...prev, ...patch } });
+    })
+    .catch(() => {});
+  return statusWrites;
 }
 
 // Numeric semver compare: is `a` newer than `b`? (x.y.z, extra parts ignored.)
@@ -156,71 +178,104 @@ async function checkForUpdate(serverVersion) {
 let nextScanAt = 0;
 let scanBackoffMs = 0;
 const SCAN_BACKOFF_MAX_MS = 60_000;
+// Asking the native host dials nothing, so there's no console noise to back off
+// from: keep it quick, so a server that just started gets found.
+const HOST_POLL_MAX_MS = 10_000;
 
 function resetScanBackoff() {
   nextScanAt = 0;
   scanBackoffMs = 0;
 }
 
-function bumpScanBackoff() {
-  scanBackoffMs = Math.min(scanBackoffMs ? scanBackoffMs * 2 : 5_000, SCAN_BACKOFF_MAX_MS);
+function bumpScanBackoff(maxMs = SCAN_BACKOFF_MAX_MS) {
+  scanBackoffMs = Math.min(scanBackoffMs ? scanBackoffMs * 2 : 5_000, maxMs);
   nextScanAt = Date.now() + scanBackoffMs;
 }
 
-async function connectLoop() {
-  if (scanning || (ws && ws.readyState === WebSocket.OPEN)) return;
-  if (Date.now() < nextScanAt) return;
-  scanning = true;
-  try {
-    // Ask the native host where the server is. When it answers, we never dial
-    // blind: a dead port dialed = a console error logged, so we only open a
-    // socket to a port the registry says a LIVE server process owns.
-    const info = await nativeCall({ cmd: "get-info" });
-
-    let token = await getToken();
-    if (info && info.ok && info.token && info.token !== token) {
-      token = String(info.token);
-      await chrome.storage.local.set({ token });
-    }
-    if (!token) {
-      await setStatus({ connected: false, reason: "no-token" });
-      bumpScanBackoff();
-      return;
-    }
+function connectLoop() {
+  if (ws && ws.readyState === WebSocket.OPEN) return Promise.resolve();
+  if (scanPromise) return scanPromise;
+  if (Date.now() < nextScanAt) return Promise.resolve();
+  scanPromise = runScan()
+    .catch(() => {})
+    .finally(() => {
+      scanPromise = null;
+    });
+  return scanPromise;
+}
 
-    if (info && info.ok && "alive" in info) {
-      if (!info.alive || !info.port) {
-        // Server simply isn't running (it starts with an iframer session).
-        // Don't attempt any connection — zero console noise.
-        await setStatus({ connected: false, reason: "server-not-running" });
-        bumpScanBackoff();
-        return;
-      }
-      const ok = await tryConnect(info.port, token);
-      if (ok) {
-        resetScanBackoff();
-        return;
-      }
-      await setStatus({ connected: false, reason: "server-not-found" });
-      bumpScanBackoff();
+// For an explicit action (new token, auto-pair): skip the backoff, let any scan
+// still using the old token finish, then connect fresh and wait for the outcome.
+async function reconnectNow() {
+  resetScanBackoff();
+  if (scanPromise) await scanPromise;
+  try { if (ws) ws.close(); } catch {}
+  ws = null;
+  await connectLoop();
+}
+
+// Try each known token on this port. Returns "ok", "bad-token" or "miss".
+async function connectToPort(port, tokens) {
+  let result = "miss";
+  for (const token of tokens) {
+    result = await tryConnect(port, token);
+    if (result === "ok") await chrome.storage.local.set({ token });
+    if (result !== "bad-token") return result;
+  }
+  return result;
+}
+
+async function runScan() {
+  // Ask the native host where the server is. When it answers, we never dial
+  // blind: a dead port dialed = a console error logged, so we only open a
+  // socket to a port it found a live server on.
+  const info = await nativeCall({ cmd: "get-info" });
+  const stored = await getToken();
+  // The host's token first, then any stored or pasted one. Neither overwrites
+  // the other until the server has actually accepted it.
+  const tokens = [...new Set([info && info.token, stored].filter(Boolean).map(String))];
+  if (!tokens.length) {
+    await setStatus({ connected: false, reason: "no-token" });
+    bumpScanBackoff();
+    return;
+  }
+  if (!stored) await chrome.storage.local.set({ token: tokens[0] });
+
+  let result = "miss";
+  const hostKnowsServer = !!(info && info.ok && "alive" in info);
+  if (hostKnowsServer) {
+    if (!info.alive || !info.port) {
+      // Server simply isn't running (it starts with an iframer session).
+      // Don't attempt any connection — zero console noise.
+      await setStatus({ connected: false, reason: "server-not-running" });
+      bumpScanBackoff(HOST_POLL_MAX_MS);
       return;
     }
-
+    result = await connectToPort(info.port, tokens);
+  } else {
     // No native host (or an old copy) — legacy full port scan.
     for (let port = PORT_START; port <= PORT_END; port++) {
-      const ok = await tryConnect(port, token);
-      if (ok) {
-        resetScanBackoff();
-        return;
+      const r = await connectToPort(port, tokens);
+      if (r === "ok") {
+        result = r;
+        break;
       }
+      // Keep looking after a rejection: another user's server can hold a lower
+      // port on the same machine, with ours further up the window.
+      if (r === "bad-token") result = r;
     }
-    await setStatus({ connected: false, reason: "server-not-found" });
-    bumpScanBackoff();
-  } finally {
-    scanning = false;
   }
+
+  if (result === "ok") {
+    resetScanBackoff();
+    return;
+  }
+  await setStatus({ connected: false, reason: result === "bad-token" ? "bad-token" : "server-not-found" });
+  bumpScanBackoff(hostKnowsServer ? HOST_POLL_MAX_MS : SCAN_BACKOFF_MAX_MS);
 }
 
+// Resolves "ok" only after the server has accepted the token. An open socket
+// proves nothing: auth happens after it opens.
 function tryConnect(port, token) {
   return new Promise((resolve) => {
     let settled = false;
@@ -230,47 +285,44 @@ function tryConnect(port, token) {
       // goes in a first {type:"auth"} message instead; the server waits for it.
       sock = new WebSocket(`ws://127.0.0.1:${port}/extension/ws`);
     } catch {
-      resolve(false);
+      resolve("miss");
       return;
     }
+    let timer;
     const done = (val) => {
+      clearTimeout(timer);
       if (!settled) {
         settled = true;
         resolve(val);
       }
     };
-    // If it doesn't open quickly, treat this port as a miss.
-    const timer = setTimeout(() => {
-      try { sock.close(); } catch {}
-      done(false);
-    }, 800);
+    const giveUpAfter = (ms) => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        try { sock.close(); } catch {}
+        done("miss");
+      }, ms);
+    };
+    giveUpAfter(OPEN_TIMEOUT_MS);
 
     sock.onopen = () => {
-      clearTimeout(timer);
-      ws = sock;
-      currentPort = port;
-      wire(sock);
+      giveUpAfter(AUTH_TIMEOUT_MS);
       try {
         sock.send(JSON.stringify({ type: "auth", token }));
       } catch {}
+    };
+    // The server only sends us anything once the token is accepted.
+    sock.onmessage = (ev) => {
+      ws = sock;
+      currentPort = port;
+      wire(sock);
+      handleMessage(sock, ev.data);
       sendHello(sock);
       setStatus({ connected: true, port, reason: null });
-      done(true);
-    };
-    sock.onclose = (ev) => {
-      clearTimeout(timer);
-      // 4001 = server is there but rejected our token. Stop scanning; surface it.
-      if (ev.code === 4001) {
-        setStatus({ connected: false, reason: "bad-token" });
-        done(true); // "found" the server, just unauthorized — don't keep scanning
-        return;
-      }
-      done(false);
-    };
-    sock.onerror = () => {
-      clearTimeout(timer);
-      done(false);
+      done("ok");
     };
+    sock.onclose = (ev) => done(ev.code === 4001 ? "bad-token" : "miss");
+    sock.onerror = () => done("miss");
   });
 }
 
@@ -561,6 +613,11 @@ chrome.debugger.onDetach.addListener((source, reason) => {
 chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
   (async () => {
     if (msg.cmd === "get-state") {
+      // Opening the popup means someone is waiting: retry now, not on the backoff.
+      if (!ws || ws.readyState !== WebSocket.OPEN) {
+        resetScanBackoff();
+        connectLoop();
+      }
       const { status } = await chrome.storage.local.get("status");
       const { profileId, profileName } = await ensureProfile();
       sendResponse({ ok: true, status: status || { connected: false }, profileId, profileName });
@@ -595,24 +652,18 @@ chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
       if (!token) {
         sendResponse({
           ok: false,
-          error: "Pairing host not reachable. Run `iframer install extension` in a terminal, then restart the browser.",
+          error: "Pairing host not reachable. Run `iframer install extension chrome` in a terminal, then try again.",
         });
         return;
       }
       await chrome.storage.local.set({ token });
-      resetScanBackoff();
-      try { if (ws) ws.close(); } catch {}
-      ws = null;
-      await connectLoop();
+      await reconnectNow();
       const { status } = await chrome.storage.local.get("status");
       sendResponse({ ok: true, token, status: status || { connected: false } });
     } else if (msg.cmd === "set-token") {
       await chrome.storage.local.set({ token: msg.token || "" });
       // Force a fresh connection attempt with the new token.
-      resetScanBackoff();
-      try { if (ws) ws.close(); } catch {}
-      ws = null;
-      await connectLoop();
+      await reconnectNow();
       const { status } = await chrome.storage.local.get("status");
       sendResponse({ ok: true, status: status || { connected: false } });
     } else {

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "iframer",
-  "version": "0.10.8",
+  "version": "0.11.1",
   "description": "Let iframer drive a Chrome tab you choose, on your real logged-in session.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp2wbce98k+xDnEgtuzLyNXYBLEDY0nqChuvolb94B3VV1HsHFUulUyNe92eN6MjQuadDohQ2j5mj7zWs4yQoixgTQPe7Gm/+GHWdgxwM2s9t5opnLHwF90LPiJm6q1NGWLM4aK6JT+2I6FnUGmj2bzB4WIlf55C3aMEBoXTqIzG2U8s2cxkXGebWWqbPlMK/Phsmsvo4POWnidbGHPhBOq0iyPTu7RdSDlNdJdJ+dtdNXkMmltKUS881MQI9T6GcCCKhIKcZrJGGnk0xphlWyl+ublTAO0tbQSVB/K7D3JmCxMv690TPtYUPPhGi+C6VCv3IeutLmNo60mvux3wbGQIDAQAB",
   "permissions": [