mcp-browser-extension 0.9.28 → 0.9.30

package/dist/src/mcp/tools.js

@@ -38,6 +38,7 @@ const helpers_1 = require("./helpers");
 const redact_1 = require("./redact");
 const locate_1 = require("./locate");
 const snapdiff_1 = require("./snapdiff");
+const page_watch_1 = require("./page-watch");
 const auth_wall_1 = require("../../shared/auth-wall");
 const audit_1 = require("./audit");
 const log_1 = require("./log");
@@ -104,7 +105,7 @@ const maxBytesField = zod_1.z
 const waitUntilField = zod_1.z.enum(['load', 'domcontentloaded', 'networkidle']).describe('When to consider navigation done').optional();
 exports.TOOL_DEFINITIONS = [
     { name: 'tabs_list', description: 'List open browser tabs.', inputSchema: {} },
-    { name: 'tab_select', description: 'Make a tab active by tabId.', inputSchema: { tabId: zod_1.z.string() } },
+    { name: 'tab_select', description: "Make a tab the agent's tab by tabId, in the background: calls without tabId go to it and the user stays on their own tab. Pass show:true only to bring it to the front for the user.", inputSchema: { tabId: zod_1.z.string(), show: zod_1.z.boolean().optional() } },
     { name: 'tab_new', description: "Open a NEW tab (optionally at a URL) in the background, leaving the user's tab alone; it becomes the agent's tab, where calls without tabId go. Pass active:true to show it to the user.", inputSchema: { url: zod_1.z.string().optional(), active: zod_1.z.boolean().optional() } },
     { name: 'tab_close', description: 'Close a tab by tabId.', inputSchema: { tabId: zod_1.z.string() } },
     { name: 'navigate', description: "Navigate the agent's tab to a URL, replacing its page. With no agent's tab yet it opens one in the background: the user's own tab is only navigated when you pass its tabId.", inputSchema: { url: zod_1.z.string(), tabId: tabIdField, waitUntil: waitUntilField, failOnAuthWall: authWallField } },
@@ -122,6 +123,7 @@ exports.TOOL_DEFINITIONS = [
     { name: 'get_text', description: 'Get visible text of the page or an element.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, tabId: tabIdField, maxBytes: maxBytesField } },
     { name: 'get_html', description: 'Get HTML of the page or an element. Output is capped (see maxBytes) and cut at a tag boundary; narrow it with `selector` rather than raising the cap when you can. Password field values are always blanked.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, outer: zod_1.z.boolean().optional(), tabId: tabIdField, maxBytes: maxBytesField } },
     { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with refs to target by `ref` (more reliable than guessing CSS selectors). Pass diff:true to get only what changed since the last snapshot of this tab - far cheaper in a click/read loop. Password fields appear as secret:true with no value.', inputSchema: { interactiveOnly: zod_1.z.boolean().optional(), max: zod_1.z.number().optional(), diff: zod_1.z.boolean().describe('Return added/removed/changed elements since the previous snapshot of this tab instead of the whole tree').optional(), failOnAuthWall: authWallField, ...FRAME_PROPS, tabId: tabIdField } },
+    { name: 'page_watch', description: 'Save a local page checkpoint and compare it later. Actions: create (name), compare (watchId), list, delete. Stores accessibility labels and state, never form values. Site allowlist still applies.', inputSchema: { action: zod_1.z.enum(['create', 'compare', 'list', 'delete']), name: zod_1.z.string().optional(), watchId: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), ...FRAME_PROPS, tabId: tabIdField } },
@@ -304,6 +306,7 @@ const TOOL_GATE = {
     get_text: 'get_text',
     get_html: 'get_html',
     snapshot: 'get_text',
+    page_watch: 'get_text',
     get_cookies: 'get_text',
     extract_links: 'get_text',
     read_as_markdown: 'get_text',
@@ -704,14 +707,27 @@ exports.TOOL_HANDLERS = {
     tabs_list: async (_a, ctx) => (0, envelopes_1.jsonResult)(await ctx.ex.tabsList()),
     tab_select: async (a, ctx) => {
         await gate(ctx, 'tab_select');
-        const tab = await ctx.ex.tabSelect((0, validators_1.requireString)(a, 'tabId'));
+        const id = (0, validators_1.requireString)(a, 'tabId');
+        // Showing the tab pulls the person off whatever they are doing, so only on request.
+        if ((0, validators_1.optionalBoolean)(a, 'show') === true) {
+            const tab = await ctx.ex.tabSelect(id);
+            workTab = tab.tabId; // an explicit pick: later calls follow it
+            return (0, envelopes_1.jsonResult)(tab);
+        }
+        const tab = (await ctx.ex.tabsList()).find((t) => t.tabId === id);
+        if (!tab)
+            throw new validators_1.McpToolError(`no open tab with tabId ${id}; call tabs_list for the current ids`);
         workTab = tab.tabId; // an explicit pick: later calls follow it
-        return (0, envelopes_1.jsonResult)(tab);
+        return (0, envelopes_1.jsonResult)({ ...tab, shown: false });
     },
     tab_new: async (a, ctx) => {
         await gate(ctx, 'tab_new');
+        // Opening a tab at a URL loads it like navigate does, so gate it the same way.
+        const url = (0, validators_1.optionalString)(a, 'url');
+        if (url !== undefined)
+            await gate(ctx, 'navigate', { url });
         // Background unless asked: focusing it would pull the person off their tab.
-        const tab = await ctx.ex.tabNew((0, validators_1.optionalString)(a, 'url'), { active: (0, validators_1.optionalBoolean)(a, 'active') ?? false });
+        const tab = await ctx.ex.tabNew(url, { active: (0, validators_1.optionalBoolean)(a, 'active') ?? false });
         workTab = tab.tabId;
         return (0, envelopes_1.jsonResult)(tab);
     },
@@ -917,9 +933,39 @@ exports.TOOL_HANDLERS = {
                 : {}),
         });
     },
+    page_watch: async (a, ctx) => {
+        const action = (0, validators_1.requireString)(a, 'action');
+        const ws = (0, workspace_1.getActiveWorkspace)();
+        if (action === 'list')
+            return (0, envelopes_1.jsonResult)({ watches: (0, page_watch_1.listWatches)(ws.profileDir) });
+        if (action === 'delete') {
+            (0, page_watch_1.removeWatch)(ws.profileDir, (0, validators_1.requireString)(a, 'watchId'));
+            return (0, envelopes_1.jsonResult)({ deleted: true });
+        }
+        await gate(ctx, 'get_text', { tabId: tabId(a) });
+        const snap = await ctx.ex.snapshot({ tabId: tabId(a), ...frameOpts(a), max: 500 });
+        const clean = (0, page_watch_1.safeSnapshot)(snap, (s) => (0, redact_1.redactText)(s, redaction(ctx.policy)).value);
+        if (action === 'create') {
+            const name = (0, validators_1.requireWithinLength)((0, validators_1.requireString)(a, 'name'), 'name', 80);
+            const saved = (0, page_watch_1.createWatch)(ws.profileDir, name, clean);
+            return (0, envelopes_1.jsonResult)({ watchId: saved.id, name: saved.name, url: saved.url, title: clean.title, elements: clean.nodes.length, savedAt: new Date(saved.ts).toISOString(), note: 'Checkpoint saved locally for this Chrome profile. Form values are not stored.' });
+        }
+        if (action === 'compare') {
+            const previous = (0, page_watch_1.readWatch)(ws.profileDir, (0, validators_1.requireString)(a, 'watchId'));
+            // The site's grant may have been revoked since the checkpoint was saved.
+            (0, policy_1.assertUrlAllowed)(previous.url, 'get_text', ctx.policy);
+            const diff = (0, page_watch_1.compareWatch)(previous, clean, (s) => (0, redact_1.redactText)(s, redaction(ctx.policy)).value);
+            return (0, envelopes_1.jsonResult)({ watchId: previous.id, name: previous.name, previousUrl: previous.url, currentUrl: clean.url, previousAt: new Date(previous.ts).toISOString(), checkedAt: new Date().toISOString(), ...diff });
+        }
+        throw new validators_1.McpToolError(`unknown page_watch action: ${action}`);
+    },
     get_cookies: async (a, ctx) => {
         await gate(ctx, 'get_text', { tabId: tabId(a) }); // reads tab-scoped secrets; same domain gate as content reads
-        return (0, envelopes_1.jsonResult)(await ctx.ex.getCookies({ tabId: tabId(a), url: (0, validators_1.optionalString)(a, 'url') }));
+        // Cookies for another URL are that site's secrets: it must be allowed too.
+        const url = (0, validators_1.optionalString)(a, 'url');
+        if (url !== undefined)
+            await gate(ctx, 'get_text', { url });
+        return (0, envelopes_1.jsonResult)(await ctx.ex.getCookies({ tabId: tabId(a), url }));
     },
     storage: async (a, ctx) => {
         const op = (0, validators_1.requireString)(a, 'op');
@@ -1025,11 +1071,14 @@ exports.TOOL_HANDLERS = {
         return (0, envelopes_1.jsonResult)(res);
     },
     download_file: async (a, ctx) => {
-        await gate(ctx, 'download_file');
         const url = (0, validators_1.optionalString)(a, 'url');
         const target = (0, validators_1.optionalTarget)(a);
         if (!url && !target)
             throw new validators_1.McpToolError('provide "url" or a target (selector|ref)');
+        // By URL, the bytes come from that URL with the person's cookies: gate the
+        // URL, not whichever tab the agent is on. By element, gate the tab it is in
+        // (the extension then gates where the link leads).
+        await gate(ctx, 'download_file', url ? { url } : { tabId: tabId(a) });
         return (0, envelopes_1.jsonResult)(await ctx.ex.download({ url, target, tabId: tabId(a), suggestedName: (0, validators_1.optionalString)(a, 'suggestedName') }));
     },
     upload_file: async (a, ctx) => {
@@ -1045,9 +1094,20 @@ exports.TOOL_HANDLERS = {
         if (!ctx.policy.uploadsDir) {
             throw new validators_1.McpToolError('upload denied: uploads require an --uploads-dir to be configured (refusing unrestricted local-file access)');
         }
-        const dir = (0, node_path_1.resolve)(ctx.policy.uploadsDir);
+        // Compare real paths: Chrome reads a symlink's target, so a link inside the
+        // dir pointing outside it must be judged by where it points.
+        const real = (p) => {
+            try {
+                return (0, node_fs_1.realpathSync)(p);
+            }
+            catch {
+                // Not there (yet): resolve its folder, so /tmp vs /private/tmp still compare.
+                return p === (0, node_path_1.dirname)(p) ? p : (0, node_path_1.join)(real((0, node_path_1.dirname)(p)), (0, node_path_1.basename)(p));
+            }
+        };
+        const dir = real((0, node_path_1.resolve)(ctx.policy.uploadsDir));
         for (const f of files) {
-            const abs = (0, node_path_1.resolve)(f);
+            const abs = real((0, node_path_1.resolve)(f));
             if (abs !== dir && !abs.startsWith(dir + node_path_1.sep)) {
                 throw new validators_1.McpToolError(`upload denied: "${f}" is outside the allowed uploads dir (${dir})`);
             }
@@ -1378,7 +1438,11 @@ async function dispatchInner(name, handler, rawArgs, audit, started) {
         const mgr = (0, manager_1.getManager)();
         // Workspace-management tools run server-side and must work even with no
         // browser paired, so they skip the executor readiness check.
-        const ex = NO_BACKEND_TOOLS.has(name) ? null : await mgr.ensureReady();
+        const args = (0, validators_1.asArgs)(rawArgs);
+        const workspaceOnlyWatchAction = name === 'page_watch' && (args.action === 'list' || args.action === 'delete');
+        const ex = NO_BACKEND_TOOLS.has(name) || workspaceOnlyWatchAction
+            ? null
+            : await mgr.ensureReady();
         let result;
         try {
             result = await handler((0, validators_1.asArgs)(rawArgs), { ex, policy: mgr.policy });

package/dist/src/security/policy.d.ts

@@ -41,6 +41,13 @@ export interface Policy extends WirePolicy {
 export declare const DEFAULT_POLICY: Readonly<Policy>;
 /** Merge a partial (from a policy file and/or CLI flags) over the safe default. */
 export declare function resolvePolicy(partial?: Partial<Policy>): Policy;
+/**
+ * The wire-serializable subset delivered to the extension in `welcome`, so it
+ * mirrors the server gate. `uploadsDir` (a local path) stays server-side.
+ * `allowDomains` is passed BY REFERENCE: sites allowed from the extension's
+ * Options are spliced into this same array, which the tool gate reads too.
+ */
+export declare function toWirePolicy(policy: Policy): WirePolicy;
 /**
  * Throw `POLICY_DENIED` unless `method` against `url` is permitted by `policy`.
  * `url` is the DESTINATION for navigation, otherwise the current tab URL.

package/dist/src/security/policy.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_POLICY = exports.isDomainAllowed = exports.hostOf = exports.isUrlGated = exports.isMutatingMethod = exports.isReadMethod = void 0;
 exports.resolvePolicy = resolvePolicy;
+exports.toWirePolicy = toWirePolicy;
 exports.assertUrlAllowed = assertUrlAllowed;
 const types_1 = require("../executor/types");
 const policy_1 = require("../../shared/policy");
@@ -61,6 +62,16 @@ function resolvePolicy(partial) {
         failOnAuthWall: partial?.failOnAuthWall ?? exports.DEFAULT_POLICY.failOnAuthWall,
     };
 }
+/**
+ * The wire-serializable subset delivered to the extension in `welcome`, so it
+ * mirrors the server gate. `uploadsDir` (a local path) stays server-side.
+ * `allowDomains` is passed BY REFERENCE: sites allowed from the extension's
+ * Options are spliced into this same array, which the tool gate reads too.
+ */
+function toWirePolicy(policy) {
+    const { allowDomains, allowEval, allowDownloads, allowUploads, allowAllTabs, enableMutations, allowObservers } = policy;
+    return { allowDomains, allowEval, allowDownloads, allowUploads, allowAllTabs, enableMutations, allowObservers };
+}
 // ---------------------------------------------------------------------------
 // The gate
 // ---------------------------------------------------------------------------