machine-bridge-mcp 0.8.2 → 0.10.0

package/docs/LOCAL_AUTOMATION.md

@@ -0,0 +1,111 @@
+# Local application and browser automation
+
+Machine Bridge exposes two structured local-automation backends under the canonical `full` profile:
+
+1. operating-system application discovery and macOS Accessibility actions;
+2. a Chromium extension connected to a loopback broker for the user's existing browser profile, windows, tabs, cookies, and login state.
+
+Neither backend accepts arbitrary caller-supplied AppleScript, JavaScript, or browser-extension code. The MCP surface is a bounded set of typed discovery, inspection, action, form, screenshot, and file-upload operations.
+
+## Why the browser backend is an extension
+
+Launching a separate automation browser is predictable but loses the user's ordinary profile, active tabs, existing login state, browser extensions, and familiar window. Machine Bridge therefore uses a packaged Manifest V3 extension as the primary backend. It is loaded once into the user's Chromium-family browser and paired with a loopback-only local broker.
+
+The extension works with the current profile and supports:
+
+- listing existing tabs;
+- reading the current serialized DOM HTML from the main frame or accessible subframes;
+- discovering interactive controls, labels, roles, placeholders, and field metadata across accessible frames and open Shadow DOM roots;
+- structured navigation, click, focus, fill, select, check, uncheck, key press, and form submission;
+- multi-field complex form filling in one operation, bounded to 200 fields and 4 MiB of aggregate text;
+- populating file inputs from registered local resource files;
+- visible-tab screenshots.
+
+Current support targets Chrome, Chromium, Microsoft Edge, Brave, Vivaldi, and compatible Chromium browsers. After upgrading Machine Bridge, reload the unpacked extension from the browser extensions page so its packaged scripts match the new runtime. Browser-internal pages, extension stores, some PDF/plugin viewers, cross-origin frames denied to the extension, and pages restricted by enterprise policy may not be scriptable.
+
+## One-time browser setup
+
+Keep `machine-mcp` running, then use either the MCP tool `pair_browser_extension` or the local CLI:
+
+```sh
+machine-mcp browser setup
+```
+
+The command prints the packaged extension directory and opens the local pairing page. In the browser:
+
+1. open the extensions page;
+2. enable Developer mode;
+3. choose **Load unpacked** and select the printed `browser-extension` directory;
+4. return to the local pairing page.
+
+The first pairing completes automatically. If the extension is already paired to different local state, the page asks for an explicit user gesture: click the Machine Bridge extension icon while the pairing page is active to confirm replacement. This prevents another localhost page from silently overwriting an established pairing. The extension badge shows `ON` when connected; clicking the icon from another page opens the saved local pairing/status page.
+
+`Load unpacked` is the self-hosted/development installation path. A mass-market release should package the same extension source as a signed Chrome Web Store and/or Microsoft Edge Add-ons build, so ordinary users install it through the browser store without enabling Developer mode. This repository change does not publish a store listing.
+
+The content script reads pairing material only from the loopback page and stores it in browser-local extension storage. Check status with:
+
+```sh
+machine-mcp browser status
+machine-mcp browser path
+```
+
+The broker is machine-global rather than workspace-global. One local owner listens on the loopback port, and additional Machine Bridge runtimes authenticate to that broker and proxy requests through the same extension connection. This prevents multiple workspaces or stdio clients from repeatedly stealing the browser connection.
+
+## Browser tools
+
+- `browser_status` reports broker role, extension connection, supported operations, pairing URL, and extension path without returning the pairing token.
+- `pair_browser_extension` opens the local pairing page and returns setup steps.
+- `browser_list_tabs` lists current tabs.
+- `browser_get_source` returns bounded current DOM HTML for selected frames.
+- `browser_inspect_page` returns bounded interactive-element metadata.
+- `browser_action` performs one structured navigation or DOM action. Navigation accepts absolute `http`, `https`, or `file` URLs; script/data schemes are rejected.
+- `browser_fill_form` fills up to 200 fields and can submit once.
+- `browser_upload_files` sets a file input from up to eight registered local resources.
+- `browser_screenshot` returns native MCP image content.
+
+Selectors can use CSS, ID, field name, label text, visible text, ARIA/implicit role, placeholder, and a zero-based match index. The fixed page module traverses open Shadow DOM roots; closed shadow roots remain inaccessible. For frame-specific work, inspect all frames first and then pass `frame_id` to an action.
+
+## Sensitive form values and files
+
+Ordinary `value` arguments travel through the MCP host, the Worker in remote mode, and the local daemon. For passwords, tokens, personal data, or uploaded files, register a local resource from the terminal:
+
+```sh
+machine-mcp resource add account-password /path/to/owner-only/password.txt
+machine-mcp resource add application-pdf /path/to/document.pdf
+```
+
+Then use `value_resource` for a text field or `resources` for `browser_upload_files`. The local daemon reads the resource only when executing the operation. Results report the alias and outcome, not the resource content. This reduces model-context and result exposure, but the destination page receives the value by design and can transmit it according to its own behavior.
+
+## Application tools
+
+- `list_local_applications` discovers installed applications or launchers.
+- `open_local_application` opens an application, URL, or document through the OS launcher.
+- `inspect_local_application` returns a bounded macOS Accessibility tree.
+- `operate_local_application` performs a structured Accessibility action.
+
+macOS UI inspection and actions require Accessibility permission for the Node/Machine Bridge process. Application discovery and opening are available on supported desktop platforms; structured UI inspection currently targets macOS. The application backend uses fixed JXA implementation code. The caller selects only an application, structured selector, action, and optional bounded value. `include_values` never returns values for secure-text roles or controls whose metadata indicates passwords, tokens, one-time codes, or payment-card secrets.
+
+## Capability discovery and automatic selection
+
+`resolve_task_capabilities` rescans instruction files, skills, registered commands, and relevant local automation metadata on every call. It ranks matching skills and commands, optionally loads the best skill, and recommends browser/application tools when the task indicates them.
+
+This is the strongest reliable server-side automation boundary available through MCP: discovery, refresh, ranking, and progressive skill loading are automatic. The MCP host still owns the model loop and decides whether a recommended tool is exposed, approved, or invoked. Machine Bridge cannot force ChatGPT web or another host to make a call that the host declines.
+
+## Security model
+
+The browser extension has broad page access because generic source inspection and complex forms require it. An authorized `full` client can read pages visible to the extension and perform user-visible actions with the user's logged-in authority. A malicious webpage can contain prompt-injection text, deceptive controls, or actions with financial, legal, account, or privacy consequences.
+
+The implementation reduces avoidable risk as follows:
+
+- all browser/app tools are `full`-only;
+- no arbitrary evaluation or caller-provided script source is accepted;
+- loopback HTTP validates `Host`; extension WebSockets require a random bearer subprotocol and a `chrome-extension://` origin;
+- runtime-to-broker connections require a separate authenticated subprotocol;
+- the pairing token is stored owner-only, embedded only in the non-cacheable local pairing page, and omitted from MCP results and logs;
+- an established extension pairing cannot be silently replaced by another localhost page; replacement requires clicking the extension action on the active pairing page;
+- arguments, form values, page source, screenshots, and results are not operational log data;
+- message, source, form-field, upload, traversal, concurrency, proxy-route, and timeout limits are enforced;
+- MCP cancellation clears local and broker pending state and propagates a cancellation signal to the extension; an action already delivered to a page or application may still have completed;
+- resource-backed text and files are not returned after injection.
+
+These controls do not turn the browser into a sandbox and do not validate business intent. Inspect the page and final values before high-impact submissions. Host confirmation and narrow profiles remain independent controls.

package/docs/LOGGING.md

@@ -78,10 +78,18 @@ The implementation omits:
 - file, patch, image, and temporary-file content;
 - OAuth request bodies;
 - connection passwords, daemon secrets, authorization codes, and access tokens;
-- registered resource values and source paths.
+- registered resource values and source paths;
+- browser pairing tokens, page URLs/source, DOM metadata, form values, uploaded file bytes, and screenshots;
+- application names, Accessibility trees, selectors, and entered values.
 
 Unexpected infrastructure failures are reduced to coarse error classes in normal logs. Client-facing tool errors may contain more detail according to the active path-display policy, but those details are not copied into operational logs.
 
+## Local automation events
+
+Browser broker ownership, extension connection, and persistent unavailability are infrastructure state. Ordinary tab/source/action/form/upload/screenshot calls remain per-tool debug events and never log their arguments or results. Pairing tokens are excluded from all structured fields.
+
+Application discovery and Accessibility operations follow the same rule: permission or runtime failures are classified, while app names, UI trees, selectors, and values are not operational log data.
+
 ## Bounding and redaction
 
 Messages, strings, object depth, object key counts, array item counts, and serialized field payloads are bounded. Control characters and Unicode display controls are neutralized. Fields with secret-like names, path-like keys, and known token formats are recursively redacted.

package/docs/OPERATIONS.md

@@ -30,6 +30,33 @@ A brief relay interruption is retried automatically and is visible only with `--
 
 Use `--verbose` only when close codes, close reasons, heartbeat timeouts, and retry delays are needed for diagnosis. A close code of 1006 means the transport ended without a normal close handshake; it does not by itself identify the cause.
 
+## Browser extension setup and diagnosis
+
+The full-profile daemon starts the loopback browser broker automatically. Install/pair the packaged extension once:
+
+```sh
+machine-mcp browser setup
+machine-mcp browser status
+```
+
+`browser setup` prints the unpacked-extension path and opens the local pairing page. Load that directory from the Chromium extensions page with Developer mode enabled. The pairing page contains the token only in non-cacheable loopback HTML; the CLI and MCP result do not print it. A first pairing is automatic. When local pairing state was reset or moved, click the extension icon on the active pairing page to authorize replacing the extension's previous broker configuration.
+
+Diagnosis:
+
+| Result | Interpretation |
+|---|---|
+| broker not reachable | no full-profile runtime owns the machine broker, state is stale, or a local security product blocked loopback listening |
+| broker running, extension disconnected | extension not loaded/enabled, pairing not completed, browser profile not running, or MV3 worker reconnect failed |
+| tab list works but page action fails | restricted browser-internal page, inaccessible frame, stale selector, page navigation, enterprise policy, or page script interference |
+| `frame_id` action fails | frame was replaced or is not accessible; inspect frames again |
+| resource-backed upload fails | resource unavailable/too large, input is not `type=file`, page replaced the input, or the site rejects the file |
+
+The machine-level broker permits multiple workspace daemons/stdio clients to share one extension. A second runtime becomes an authenticated broker client rather than selecting a new port or replacing the extension. Its owner-only `browser-bridge.json` pairing record is a recognized state-root entry, so validated uninstall can remove the complete Machine Bridge state root without treating the pairing record as unrelated data. Restarting every runtime is not normally required after adding a skill or changing a form page; capability and DOM discovery are live.
+
+## macOS application automation
+
+Application UI inspection/actions require Accessibility permission for the Node/Machine Bridge process. Grant it in macOS Privacy & Security, then retry `inspect_local_application`. Opening applications does not require the same Accessibility authority. If an app changes UI hierarchy or localizes labels, inspect again and use role/identifier/index selectors instead of assuming a stale title.
+
 ## Logs
 
 Remote autostart definitions prefer a stable PATH alias that resolves to the currently running Node executable and persist a sanitized absolute-only service `PATH` containing the Node/CLI directories, the installer's absolute PATH entries, and platform defaults. This avoids versioned Homebrew-style paths becoming invalid after upgrades and prevents launchd/systemd from falling back to a minimal system-only PATH. Re-run `machine-mcp service install` after changing Node installation families or PATH layout. A service-style `--daemon-only` start that finds the same workspace daemon already running is an idempotent no-op: it exits successfully without repeating warnings or readiness output; explicit policy/secret/change requests still report that changes were not applied. Autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Files are owner-only where supported and tail-trimmed before daemon startup. On a logging-schema upgrade, bounded prior content is moved into `daemon.out.legacy.log` and `daemon.err.legacy.log`; use the active filenames when diagnosing current behavior.
@@ -131,6 +158,9 @@ Defense-in-depth limits include:
 - managed-job timeout: 1–3,600 seconds per step;
 - managed-job output: 64 KiB per stream and 256 KiB total captured across one job;
 - registered resources: 64, 1 MiB each, 8 MiB referenced per job;
+- browser source: 4 MiB; browser WebSocket messages: 8 MiB; pending browser requests: 32 per runtime;
+- browser forms: 200 fields, 128 KiB per text value, and 4 MiB aggregate text; upload: eight resources and 5 MiB total;
+- application Accessibility inspection: 500 elements and depth 12; action text: 4,000 characters;
 - job-scoped temporary files: 16 files, 512 KiB total content.
 
 ## Upgrade behavior

package/docs/PRIVACY.md

@@ -34,7 +34,8 @@ Before committing or publishing:
 - inspect the complete staged diff, including tests, snapshots, examples, release notes, and generated metadata;
 - use reserved example domains and neutral aliases;
 - run `npm run privacy:check`, `npm run check`, and `npm pack --dry-run`;
-- treat paths, host aliases, usernames, and codenames as private metadata even when they are not authentication secrets.
+- treat paths, host aliases, usernames, codenames, real browser URLs/page captures, application names tied to a user, and form data as private metadata even when they are not authentication secrets;
+- keep browser pairing-state files and captured source/screenshots out of fixtures, documentation, support logs, and release assets.
 
 The scanner is heuristic. It cannot identify every personal or organizational name, transformed value, image, archive, binary fixture, or data already present in Git history.
 

package/docs/RELEASING.md

@@ -6,7 +6,7 @@ The release invariant is:
 - `v<package version>` points to that same commit locally and on GitHub.
 - A final GitHub Release exists for the tag.
 - The GitHub Release contains the npm tarball generated from that commit.
-- `package.json`, `package-lock.json`, and the Worker-reported version agree.
+- `package.json`, `package-lock.json`, the Worker-reported version, and `browser-extension/manifest.json` (`version`/`version_name`) agree.
 - Every release-relevant change since the prior version tag has a higher package version and matching CHANGELOG section.
 - The same reviewed change is present on GitHub and in a new npm version.
 
@@ -14,7 +14,7 @@ The release invariant is:
 
 ## Prepare a version
 
-1. Set the new version without creating an automatic npm tag:
+1. Set the new version without creating an automatic npm tag. The npm version hook synchronizes the Worker and packaged browser-extension versions:
 
    ```sh
    npm version <version> --no-git-tag-version

package/docs/TESTING.md

@@ -17,6 +17,8 @@ The suite includes:
 - generated Cloudflare Worker types and strict TypeScript checking, including unused-local and unused-parameter rejection;
 - syntax validation for every shipped JavaScript entry point;
 - shared tool-catalog schema, annotation, and profile-inventory checks;
+- global `model_instructions_file` injection in stdio/remote initialization, hierarchical agent-context precedence, live skill rescanning/fingerprints, automatic task ranking/loading, command override/removal, direct argv handling, timeout ceilings, and execution-profile denial;
+- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, and broker result redaction;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;
 - atomic create/update, optimistic hash, exact edit, and patch transaction tests;
@@ -41,8 +43,8 @@ The suite includes:
 - deterministic relay connection lifecycle coverage for transport construction/error/deadline, pre-handshake `welcome` validation, authenticated `hello_ack` readiness, identity/version mismatch, retryable Worker handshake errors, fatal protocol errors, autonomous outage-reminder backoff, handshake and heartbeat timeout, brief-outage suppression, sustained-outage escalation, recovery summaries, and supersession;
 - shared no-follow bounded-file reads for normal files, over-limit data, directories, and symbolic links;
 - CLI parsing, policy profiles, and client configuration boundaries;
-- live stdio MCP initialization, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- live local Worker OAuth registration, consent, PKCE, token replay rejection, throttling, CORS, protocol negotiation, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure.
+- live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
+- live local Worker OAuth registration, consent, PKCE, token replay rejection, throttling, CORS, protocol negotiation, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure.
 
 ## Additional release checks
 
@@ -62,7 +64,7 @@ GitHub Actions executes the main suite on Linux, macOS, and Windows using the pi
 ## Test design rules
 
 - Tests should exercise the public boundary rather than only helper functions when practical.
-- Every permission-expanding feature needs a denial test.
+- Every permission-expanding feature needs a denial test. Browser/application features also require a token/value/content non-disclosure assertion.
 - Every bounded resource needs an over-limit test.
 - Every multi-stage mutation needs a no-partial-commit test.
 - Every remote call correlation change needs daemon replacement and cancellation coverage.
@@ -77,7 +79,7 @@ Run `npm run privacy:check` before committing and before packaging. Developers s
 
 ## Package manifest
 
-`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts and credential-like file classes, and verifies that privacy/engineering guidance, the runtime/relay/secure-file modules, contribution discipline, and privacy/release-impact checkers are present in the published package. `npm run install:test` packs the real tarball, installs it into an isolated global prefix with the documented npm 12 options, rejects blocked-script warnings, confirms optional `fsevents` is absent, and runs the installed CLI.
+`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts and credential-like file classes, and verifies that privacy/engineering guidance, the runtime/relay/secure-file/browser/app modules, packaged browser extension, contribution discipline, and privacy/release-impact checkers are present in the published package. `npm run install:test` packs the real tarball, installs it into an isolated global prefix with the documented npm 12 options, rejects blocked-script warnings, confirms optional `fsevents` is absent, and runs the installed CLI.
 
 The stdio integration test also sends an oversized line, verifies bounded rejection, and confirms that the next valid request is still processed.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.8.2",
-  "description": "Cross-client MCP bridge for canonical local automation, files, Git, SSH resources, managed jobs, and processes over stdio or an OAuth-protected remote relay.",
+  "version": "0.10.0",
+  "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
   "engines": {
@@ -16,6 +16,7 @@
     "mbm",
     "mbm.cmd",
     "bin",
+    "browser-extension",
     "src/local",
     "src/shared",
     "src/worker/index.ts",
@@ -38,13 +39,13 @@
     "self-test": "node tests/local-self-test.mjs",
     "version:sync": "node scripts/sync-worker-version.mjs",
     "version:check": "node scripts/sync-worker-version.mjs --check",
-    "version": "node scripts/sync-worker-version.mjs && git add package.json package-lock.json src/worker/index.ts",
+    "version": "node scripts/sync-worker-version.mjs && git add package.json package-lock.json src/worker/index.ts browser-extension/manifest.json",
     "prepack": "npm run version:check && npm run privacy:check && npm run release-impact:check",
     "prepublishOnly": "npm run check && npm run version:check && npm run release:check",
     "worker:types": "wrangler types src/worker/worker-configuration.d.ts",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
-    "syntax": "sh -n mbm && node --check bin/machine-mcp.mjs && node --check src/local/cli.mjs && node --check src/local/runtime.mjs && node --check src/local/relay-connection.mjs && node --check src/local/secure-file.mjs && node --check src/local/patch.mjs && node --check src/local/process-sessions.mjs && node --check src/local/tools.mjs && node --check src/local/stdio.mjs && node --check src/local/state.mjs && node --check src/local/shell.mjs && node --check src/local/service.mjs && node --check src/local/log.mjs && node --check src/local/atomic-fs.mjs && node --check src/local/ssh-key.mjs && node --check src/local/resource-operations.mjs && node --check src/local/full-access-test.mjs && node --check src/local/managed-jobs.mjs && node --check src/local/job-runner.mjs && node --check scripts/sync-worker-version.mjs && node --check scripts/privacy-check.mjs && node --check scripts/release-impact-check.mjs && node --check scripts/network-retry.mjs && node --check scripts/release-state.mjs && node --check scripts/github-release.mjs && node --check tests/worker-integration-test.mjs && node --check tests/stdio-integration-test.mjs && node --check tests/catalog-test.mjs && node --check tests/local-self-test.mjs && node --check tests/runtime-self-test.mjs && node --check tests/managed-jobs-test.mjs && node --check tests/ssh-key-test.mjs && node --check tests/full-access-test.mjs && node --check tests/atomic-fs-test.mjs && node --check tests/package-test.mjs && node --check tests/release-impact-test.mjs && node --check tests/release-state-test.mjs && node --check tests/privacy-test.mjs && node --check tests/network-retry-test.mjs && node --check tests/relay-connection-test.mjs && node --check tests/install-smoke-test.mjs && node --check tests/secure-file-test.mjs && node --check tests/architecture-test.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run typecheck && npm run syntax && npm run catalog:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "syntax": "sh -n mbm && node --check bin/machine-mcp.mjs && node --check src/local/cli.mjs && node --check src/local/runtime.mjs && node --check src/local/agent-context.mjs && node --check src/local/browser-bridge.mjs && node --check src/local/app-automation.mjs && node --check src/local/relay-connection.mjs && node --check src/local/secure-file.mjs && node --check src/local/patch.mjs && node --check src/local/process-sessions.mjs && node --check src/local/tools.mjs && node --check src/local/stdio.mjs && node --check src/local/state.mjs && node --check src/local/shell.mjs && node --check src/local/service.mjs && node --check src/local/log.mjs && node --check src/local/atomic-fs.mjs && node --check src/local/ssh-key.mjs && node --check src/local/resource-operations.mjs && node --check src/local/full-access-test.mjs && node --check src/local/managed-jobs.mjs && node --check src/local/job-runner.mjs && node --check scripts/sync-worker-version.mjs && node --check scripts/privacy-check.mjs && node --check scripts/release-impact-check.mjs && node --check scripts/network-retry.mjs && node --check scripts/release-state.mjs && node --check scripts/github-release.mjs && node --check tests/worker-integration-test.mjs && node --check tests/stdio-integration-test.mjs && node --check tests/catalog-test.mjs && node --check tests/agent-context-test.mjs && node --check tests/browser-bridge-test.mjs && node --check tests/app-automation-test.mjs && node --check tests/local-self-test.mjs && node --check tests/runtime-self-test.mjs && node --check tests/managed-jobs-test.mjs && node --check tests/ssh-key-test.mjs && node --check tests/full-access-test.mjs && node --check tests/atomic-fs-test.mjs && node --check tests/package-test.mjs && node --check tests/release-impact-test.mjs && node --check tests/release-state-test.mjs && node --check tests/privacy-test.mjs && node --check tests/network-retry-test.mjs && node --check tests/relay-connection-test.mjs && node --check tests/install-smoke-test.mjs && node --check tests/secure-file-test.mjs && node --check tests/architecture-test.mjs && node --check browser-extension/service-worker.js && node --check browser-extension/pairing.js && node --check browser-extension/page-automation.js",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run typecheck && npm run syntax && npm run catalog:test && npm run agent-context:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -66,7 +67,10 @@
     "install:test": "node tests/install-smoke-test.mjs",
     "secure-file:test": "node tests/secure-file-test.mjs",
     "architecture:test": "node tests/architecture-test.mjs",
-    "release-state:test": "node tests/release-state-test.mjs"
+    "release-state:test": "node tests/release-state-test.mjs",
+    "agent-context:test": "node tests/agent-context-test.mjs",
+    "browser-bridge:test": "node tests/browser-bridge-test.mjs",
+    "app-automation:test": "node tests/app-automation-test.mjs"
   },
   "dependencies": {
     "wrangler": "4.110.0",
@@ -89,7 +93,10 @@
     "cross-platform",
     "ssh",
     "automation",
-    "managed-jobs"
+    "managed-jobs",
+    "browser-automation",
+    "desktop-automation",
+    "agent-skills"
   ],
   "repository": {
     "type": "git",

package/scripts/sync-worker-version.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const packagePath = path.join(repoRoot, "package.json");
 const workerPath = path.join(repoRoot, "src", "worker", "index.ts");
+const extensionManifestPath = path.join(repoRoot, "browser-extension", "manifest.json");
 const args = new Set(process.argv.slice(2));
 const checkOnly = args.has("--check");
 const log = message => process.stderr.write(`${message}\n`);
@@ -17,24 +18,38 @@ if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(expected)) {
   fail(`package.json version is not a valid release version: ${JSON.stringify(expected)}`);
 }
 
-const source = readFileSync(workerPath, "utf8");
-const pattern = /const SERVER_VERSION = "([^"]+)";/;
-const match = source.match(pattern);
-if (!match) fail("Could not find `const SERVER_VERSION = \"...\";` in src/worker/index.ts");
+const workerSource = readFileSync(workerPath, "utf8");
+const workerPattern = /const SERVER_VERSION = "([^"]+)";/;
+const workerMatch = workerSource.match(workerPattern);
+if (!workerMatch) fail("Could not find `const SERVER_VERSION = \"...\";` in src/worker/index.ts");
 
-const current = match[1];
-if (current === expected) {
-  log(`Worker version is in sync: ${expected}`);
-  process.exit(0);
+const extension = JSON.parse(readFileSync(extensionManifestPath, "utf8"));
+const extensionVersion = expected.split(/[+-]/, 1)[0];
+const extensionParts = extensionVersion.split(".").map((value) => Number(value));
+if (extensionParts.length < 1 || extensionParts.length > 4 || extensionParts.some((value) => !Number.isInteger(value) || value < 0 || value > 65535)) {
+  fail(`package version cannot be represented as a Chromium extension version: ${expected}`);
 }
+const mismatches = [];
+if (workerMatch[1] !== expected) mismatches.push(`Worker=${workerMatch[1]}`);
+if (String(extension.version || "") !== extensionVersion) mismatches.push(`browser-extension.version=${extension.version || "<missing>"}`);
+if (String(extension.version_name || "") !== expected) mismatches.push(`browser-extension.version_name=${extension.version_name || "<missing>"}`);
 
+if (!mismatches.length) {
+  log(`Runtime versions are in sync: ${expected}`);
+  process.exit(0);
+}
 if (checkOnly) {
-  fail(`Worker version mismatch: package.json=${expected}, src/worker/index.ts=${current}. Run npm run version:sync.`);
+  fail(`Version mismatch: package.json=${expected}; ${mismatches.join(", ")}. Run npm run version:sync.`);
 }
 
-const updated = source.replace(pattern, `const SERVER_VERSION = "${expected}";`);
-writeFileSync(workerPath, updated);
-log(`Updated Worker version: ${current} -> ${expected}`);
+if (workerMatch[1] !== expected) {
+  writeFileSync(workerPath, workerSource.replace(workerPattern, `const SERVER_VERSION = "${expected}";`));
+  log(`Updated Worker version: ${workerMatch[1]} -> ${expected}`);
+}
+extension.version = extensionVersion;
+extension.version_name = expected;
+writeFileSync(extensionManifestPath, `${JSON.stringify(extension, null, 2)}\n`);
+log(`Updated browser extension version: ${extensionVersion} (${expected})`);
 
 function fail(message) {
   console.error(message);