mcp-browser-extension 0.9.29 → 0.9.31

package/dist/src/access.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bypassEmailVerification = void 0;
 exports.setAccessPollIntervalForTesting = setAccessPollIntervalForTesting;
+exports.closeAccessBrowserPrompt = closeAccessBrowserPrompt;
 exports.requireAccess = requireAccess;
 /** Email-link access gate for the MCP tool surface. */
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const compat_1 = require("./compat");
+const access_browser_1 = require("./access-browser");
 const SITE = ((0, compat_1.runtimeEnv)('ACCESS_API') ?? 'https://mcp-browser-extension.com/api/access').replace(/\/$/, '');
 let accessPollMs = 2_000;
 let accessWaitMs = 45_000;
@@ -18,10 +20,12 @@ const EMAIL_SCHEMA = {
 };
 const validUntil = new Map();
 const currentChecks = new Map();
+const pendingEmailStarts = new Map();
 const pollingChallenges = new Map();
 const completionToReport = new Map();
+const browserPrompts = new Map();
 const VERIFIED = { status: 'verified', message: 'Email verified. MCP Browser Extension access is active.' };
-const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
+const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email and click Verify this device. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
 const CANCELLED = { status: 'cancelled', message: 'Email verification wait was cancelled. The browser action was not run.' };
 const UNAVAILABLE = { status: 'unavailable', message: 'Email verification could not be confirmed because the verification service is unavailable. Access remains blocked. Retry chrome_status shortly.' };
 /** @internal Test seam for the verification watcher. */
@@ -29,6 +33,10 @@ function setAccessPollIntervalForTesting(ms, waitMs = 45_000) {
     accessPollMs = Math.max(1, ms);
     accessWaitMs = Math.max(1, waitMs);
 }
+/** Close a pending form when verification finishes or its owner shuts down. */
+function closeAccessBrowserPrompt(dataDir) {
+    browserPrompts.get(dataDir)?.close();
+}
 function statePath(dataDir) { return (0, node_path_1.join)(dataDir, 'access.json'); }
 function loadOrCreate(dataDir) {
     (0, node_fs_1.mkdirSync)(dataDir, { recursive: true, mode: 0o700 });
@@ -68,6 +76,7 @@ function watchForEmailApproval(server, dataDir, challengeId) {
         let delayMs = accessPollMs;
         const finish = (outcome) => {
             pollingChallenges.delete(challengeId);
+            closeAccessBrowserPrompt(dataDir);
             completionToReport.set(dataDir, outcome);
             void notifyAccess(server, outcome);
             resolve(outcome);
@@ -133,10 +142,10 @@ async function waitForEmailApproval(server, dataDir, challengeId, request) {
         }
         catch { /* Progress is optional; the tool result still carries the outcome. */ }
     };
-    await report('Sign-in link sent. Open it in your email; this tool is waiting for verification automatically.');
+    await report('Sign-in link sent. Open it in your email and click Verify this device; this tool is waiting for verification automatically.');
     let timeout;
     let onAbort;
-    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email.'); }, 5_000);
+    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email and click Verify this device.'); }, 5_000);
     try {
         const outcome = await Promise.race([
             approval.promise,
@@ -176,6 +185,74 @@ async function api(path, body) {
 function result(message) {
     return { content: [{ type: 'text', text: message }], isError: true };
 }
+const inputRequired = (url) => ({
+    status: 'input-required',
+    message: '[ACCESS_INPUT_REQUIRED] Complete email verification in the browser form. It opens automatically when the client does not display its email prompt. ' +
+        `If no form appeared, open this local page on the computer running MCP Browser Extension:\n${url}\n` +
+        'Enter your email there, open the sign-in link from your inbox, and click Verify this device. This page expires in 10 minutes. ' +
+        'Show this link to the user; do not fill the form or open their email for them. After they submit their email, call chrome_status to wait for verification. Access remains blocked until verification succeeds.',
+});
+function startEmail(server, dataDir, state, input) {
+    const existing = pendingEmailStarts.get(dataDir);
+    if (existing)
+        return existing;
+    const sending = sendVerificationEmail(server, dataDir, state, input)
+        .finally(() => { pendingEmailStarts.delete(dataDir); });
+    pendingEmailStarts.set(dataDir, sending);
+    return sending;
+}
+async function sendVerificationEmail(server, dataDir, state, input) {
+    const email = input.trim().toLowerCase();
+    if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return { status: 'denied', message: 'Enter a valid email address.' };
+    }
+    state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let started;
+    try {
+        started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
+    }
+    catch {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        return { status: 'unavailable', message: 'The verification service could not be reached. Please try again.' };
+    }
+    if (!started.ok) {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and try again.';
+        return { status: 'unavailable', message };
+    }
+    // Other tool calls and local processes must not poll a challenge before the
+    // backend creates it; a premature 410 would discard a valid sign-in request.
+    saveState(dataDir, state);
+    await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+    return { challengeId: state.challengeId };
+}
+async function offerBrowserPrompt(server, dataDir, request) {
+    if (request.signal?.aborted)
+        return CANCELLED;
+    const existing = browserPrompts.get(dataDir);
+    if (existing)
+        return inputRequired(existing.url);
+    const prompt = await (0, access_browser_1.createBrowserEmailPrompt)(async (email) => {
+        const state = loadOrCreate(dataDir);
+        if (state.verified || state.challengeId)
+            return { ok: false, message: 'A verification request is already active. Return to your assistant and call chrome_status.' };
+        const outcome = await startEmail(server, dataDir, state, email);
+        if (outcome && 'challengeId' in outcome) {
+            watchForEmailApproval(server, dataDir, outcome.challengeId);
+            return { ok: true, message: '' };
+        }
+        return { ok: false, message: outcome?.message ?? UNAVAILABLE.message };
+    }, { onClose: () => { browserPrompts.delete(dataDir); } });
+    browserPrompts.set(dataDir, prompt);
+    if (request.signal?.aborted) {
+        prompt.close();
+        return CANCELLED;
+    }
+    (0, access_browser_1.openBrowserEmailPrompt)(prompt.url);
+    return inputRequired(prompt.url);
+}
 /** Returns null when authorized, otherwise a user-facing tool error. */
 async function requireAccess(server, dataDir, request = {}) {
     if (request.signal?.aborted)
@@ -214,11 +291,15 @@ async function requireAccess(server, dataDir, request = {}) {
 const bypassEmailVerification = async () => null;
 exports.bypassEmailVerification = bypassEmailVerification;
 async function check(server, dataDir, request) {
+    const sending = pendingEmailStarts.get(dataDir);
+    if (sending)
+        return sending;
     const state = loadOrCreate(dataDir);
     try {
         if (state.verified) {
             const revalidated = await api('validate', { deviceId: state.deviceId, deviceSecret: state.deviceSecret });
             if (revalidated.ok && revalidated.data.authorized === true) {
+                closeAccessBrowserPrompt(dataDir);
                 validUntil.set(dataDir, Date.now() + 60_000);
                 if (completionToReport.delete(dataDir))
                     return VERIFIED;
@@ -235,6 +316,9 @@ async function check(server, dataDir, request) {
             return { status: 'unavailable', message: 'Access could not be checked right now. Retry the browser tool shortly.' };
         }
         if (!state.challengeId) {
+            const existing = browserPrompts.get(dataDir);
+            if (existing)
+                return inputRequired(existing.url);
             let elicitation;
             // The SDK retains the signal listener after an elicitation completes.
             // Detach our forwarding listener so later cancellation cannot cancel a finished prompt.
@@ -253,28 +337,17 @@ async function check(server, dataDir, request) {
             catch {
                 if (request.signal?.aborted)
                     return CANCELLED;
-                return { status: 'unavailable', message: 'Your MCP client did not display the email prompt. This access flow requires an MCP client that supports elicitation. Enable elicitation or connect from a supported client, then retry.' };
+                return await offerBrowserPrompt(server, dataDir, request);
             }
             finally {
                 request.signal?.removeEventListener('abort', cancelPrompt);
             }
             if (request.signal?.aborted)
                 return CANCELLED;
-            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string')
-                return { status: 'cancelled', message: 'Email verification was not completed. Retry the browser tool to start again.' };
-            const email = elicitation.content.email.trim().toLowerCase();
-            if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
-                return { status: 'denied', message: 'That email address is invalid. Retry the browser tool and enter a valid address.' };
-            state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
-            saveState(dataDir, state);
-            const started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
-            if (!started.ok) {
-                delete state.challengeId;
-                saveState(dataDir, state);
-                const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and retry the browser tool.';
-                return { status: 'unavailable', message };
+            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string' || !elicitation.content.email.trim()) {
+                return await offerBrowserPrompt(server, dataDir, request);
             }
-            await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+            return await startEmail(server, dataDir, state, elicitation.content.email);
         }
         return { challengeId: state.challengeId };
     }

package/dist/src/config.js

@@ -157,6 +157,9 @@ function parseArgs(argv) {
             case '--enable-observers':
                 policyFlags.allowObservers = true;
                 break;
+            case '--enable-cookie-values':
+                policyFlags.allowCookieValues = true;
+                break;
             case '--redact':
                 policyFlags.redact = true;
                 break;
@@ -419,6 +422,9 @@ Security (default: deny-all safe mode):
                          in-page hook on allowlisted sites that records console
                          output, fetch/XHR traffic, and intercepts alert/confirm/
                          prompt (off by default: it patches page globals).
+  --enable-cookie-values Let get_cookies return cookie values. Off by default:
+                         a session cookie is the login itself, so get_cookies
+                         returns names and flags with every value hidden.
   --redact               Scrub secret-shaped strings (JWTs, cloud keys, bearer
                          tokens, private keys) out of page reads. Password field
                          values are always suppressed, with or without this.

package/dist/src/executor/cdp-executor.d.ts

@@ -97,6 +97,9 @@ export declare class CdpExecutor implements Executor {
     selectOption(t: Target, values: string[], opts?: {
         tabId?: TabId;
     }): Promise<ActionOk>;
+    setChecked(t: Target, checked: boolean, opts?: {
+        tabId?: TabId;
+    }): Promise<ActionOk>;
     fill(t: Target, value: string, opts?: {
         tabId?: TabId;
     }): Promise<ActionOk>;

package/dist/src/executor/cdp-executor.js

@@ -272,8 +272,15 @@ class CdpExecutor {
         catch (err) {
             const msg = err.message ?? '';
             if (CLOSED_TARGET.test(msg)) {
+                const stale = this.context;
                 this.context = null;
                 this.tabs.clear();
+                // A browser we launched is ours to close; otherwise the relaunch on the
+                // next call leaves this one running. Never close the user's Chrome.
+                if (this.opts.mode !== 'connect' && this.launched) {
+                    this.launched = false;
+                    void stale?.close().catch(() => undefined);
+                }
                 throw new types_1.ExecutorError('DETACHED', 'browser target closed or crashed; reconnect and retry');
             }
             throw err;
@@ -397,6 +404,13 @@ class CdpExecutor {
             return this.ok;
         });
     }
+    async setChecked(t, checked, opts) {
+        return this.guard(async () => {
+            const p = await this.resolveTab(opts?.tabId);
+            await this.locator(p, t).setChecked(checked);
+            return this.ok;
+        });
+    }
     async fill(t, value, opts) {
         return this.guard(async () => {
             const p = await this.resolveTab(opts?.tabId);

package/dist/src/executor/extension-executor.js

@@ -168,10 +168,20 @@ class ExtensionExecutor {
         return (await this.send('type', { ...targetParams(t), ...frameParams(opts), text: value, clear: true, keyEvents: false }, { tabId: opts?.tabId }));
     }
     async fillFields(fields, opts) {
-        // An extension that predates the op never advertised it: let the caller go field by field.
-        if (!this.bridge.hasCap(this.activeProfile(), protocol_1.WIRE_CAP_FILL_FORM))
-            return null;
-        const res = (await this.send('fill_form', { ops: fields, ...frameParams(opts) }, { tabId: opts?.tabId, timeoutMs: (0, protocol_1.fillFormTimeoutMs)(fields.length) }));
+        // No capability pre-check alone: a server relaying through another one (a
+        // second AI session) cannot see the extension's caps, so ask and read the
+        // answer. An extension that predates the op says it has no such method:
+        // then let the caller go field by field.
+        let res;
+        try {
+            res = (await this.send('fill_form', { ops: fields, ...frameParams(opts) }, { tabId: opts?.tabId, timeoutMs: (0, protocol_1.fillFormTimeoutMs)(fields.length) }));
+        }
+        catch (err) {
+            if (!this.bridge.hasCap(this.activeProfile(), protocol_1.WIRE_CAP_FILL_FORM) && err instanceof types_1.ExecutorError && /unhandled method/.test(err.message)) {
+                return null;
+            }
+            throw err;
+        }
         if (res.error) {
             // Say how far the batch got: the fields before this one DID land, and a
             // blind retry of the whole form would write them a second time.

package/dist/src/executor/types.d.ts

@@ -361,6 +361,10 @@ export interface Executor {
     } & FrameOpts): Promise<{
         filled: number;
     } | null>;
+    /** Put a checkbox/radio into `checked` (no-op when it already is). */
+    setChecked?(t: Target, checked: boolean, opts?: {
+        tabId?: TabId;
+    } & FrameOpts): Promise<ActionOk>;
     /** Every frame of a tab that the extension can inject into, with its URL. */
     framesList?(opts?: {
         tabId?: TabId;

package/dist/src/mcp/helpers.js

@@ -166,8 +166,17 @@ async function fillForm(ex, args) {
         for (const { selector, value } of ops) {
             const target = { selector };
             if (typeof value === 'boolean') {
-                // Checkbox/radio: a click toggles it.
-                await ex.click(target, opts);
+                // Checkbox/radio: set the state. A bare click toggles, so it is only
+                // right for a backend that cannot set it, and only to turn it on.
+                if (ex.setChecked)
+                    await ex.setChecked(target, value, opts);
+                else if (value)
+                    await ex.click(target, opts);
+                else {
+                    // Unticking needs the current state, which this backend cannot read;
+                    // a silent no-op would report a field as filled that was not.
+                    throw new types_1.ExecutorError('UNSUPPORTED', `cannot set ${selector} to unchecked with this browser backend; update the MCP Browser Extension`);
+                }
             }
             else {
                 await ex.fill(target, value, opts);

package/dist/src/mcp/server.js

@@ -36,7 +36,7 @@ const SERVER_VERSION = '0.1.0';
  * than retry.
  */
 exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, signed-in Chrome. " +
-    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
+    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you, then click Verify this device on the website. If it returns ACCESS_INPUT_REQUIRED, the local verification form opens automatically in the browser; also show its URL as a backup so the user can enter their email. Do not fill it or read their email for them. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +

package/dist/src/mcp/tools.js

@@ -105,7 +105,7 @@ const maxBytesField = zod_1.z
 const waitUntilField = zod_1.z.enum(['load', 'domcontentloaded', 'networkidle']).describe('When to consider navigation done').optional();
 exports.TOOL_DEFINITIONS = [
     { name: 'tabs_list', description: 'List open browser tabs.', inputSchema: {} },
-    { name: 'tab_select', description: 'Make a tab active by tabId.', inputSchema: { tabId: zod_1.z.string() } },
+    { name: 'tab_select', description: "Make a tab the agent's tab by tabId, in the background: calls without tabId go to it and the user stays on their own tab. Pass show:true only to bring it to the front for the user.", inputSchema: { tabId: zod_1.z.string(), show: zod_1.z.boolean().optional() } },
     { name: 'tab_new', description: "Open a NEW tab (optionally at a URL) in the background, leaving the user's tab alone; it becomes the agent's tab, where calls without tabId go. Pass active:true to show it to the user.", inputSchema: { url: zod_1.z.string().optional(), active: zod_1.z.boolean().optional() } },
     { name: 'tab_close', description: 'Close a tab by tabId.', inputSchema: { tabId: zod_1.z.string() } },
     { name: 'navigate', description: "Navigate the agent's tab to a URL, replacing its page. With no agent's tab yet it opens one in the background: the user's own tab is only navigated when you pass its tabId.", inputSchema: { url: zod_1.z.string(), tabId: tabIdField, waitUntil: waitUntilField, failOnAuthWall: authWallField } },
@@ -124,7 +124,7 @@ exports.TOOL_DEFINITIONS = [
     { name: 'get_html', description: 'Get HTML of the page or an element. Output is capped (see maxBytes) and cut at a tag boundary; narrow it with `selector` rather than raising the cap when you can. Password field values are always blanked.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, outer: zod_1.z.boolean().optional(), tabId: tabIdField, maxBytes: maxBytesField } },
     { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with refs to target by `ref` (more reliable than guessing CSS selectors). Pass diff:true to get only what changed since the last snapshot of this tab - far cheaper in a click/read loop. Password fields appear as secret:true with no value.', inputSchema: { interactiveOnly: zod_1.z.boolean().optional(), max: zod_1.z.number().optional(), diff: zod_1.z.boolean().describe('Return added/removed/changed elements since the previous snapshot of this tab instead of the whole tree').optional(), failOnAuthWall: authWallField, ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'page_watch', description: 'Save a local page checkpoint and compare it later. Actions: create (name), compare (watchId), list, delete. Stores accessibility labels and state, never form values. Site allowlist still applies.', inputSchema: { action: zod_1.z.enum(['create', 'compare', 'list', 'delete']), name: zod_1.z.string().optional(), watchId: zod_1.z.string().optional(), tabId: tabIdField } },
-    { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'get_cookies', description: "Cookies for the tab's URL (or url); values need --enable-cookie-values.", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: { selector: zod_1.z.string().optional(), textContains: zod_1.z.string().optional(), gone: zod_1.z.boolean().optional(), timeoutMs: zod_1.z.number().optional(), ...FRAME_PROPS, tabId: tabIdField, failOnAuthWall: authWallField } },
@@ -400,6 +400,8 @@ function enabledToolNames() {
 const GATE_CONTEXT = 'cannot resolve the target tab URL for the policy gate';
 /** How long the gate waits for a just-opened background tab to report its URL. */
 const OPENING_TAB_WAIT_MS = 5_000;
+/** What `get_cookies` returns in place of a value unless --enable-cookie-values is set. */
+const COOKIE_VALUE_HIDDEN = '[hidden]';
 /**
  * Resolve the URL the policy should be evaluated against: the URL of the tab
  * this very call will act on — the explicit `tabId` when the caller gave one,
@@ -707,14 +709,27 @@ exports.TOOL_HANDLERS = {
     tabs_list: async (_a, ctx) => (0, envelopes_1.jsonResult)(await ctx.ex.tabsList()),
     tab_select: async (a, ctx) => {
         await gate(ctx, 'tab_select');
-        const tab = await ctx.ex.tabSelect((0, validators_1.requireString)(a, 'tabId'));
+        const id = (0, validators_1.requireString)(a, 'tabId');
+        // Showing the tab pulls the person off whatever they are doing, so only on request.
+        if ((0, validators_1.optionalBoolean)(a, 'show') === true) {
+            const tab = await ctx.ex.tabSelect(id);
+            workTab = tab.tabId; // an explicit pick: later calls follow it
+            return (0, envelopes_1.jsonResult)(tab);
+        }
+        const tab = (await ctx.ex.tabsList()).find((t) => t.tabId === id);
+        if (!tab)
+            throw new validators_1.McpToolError(`no open tab with tabId ${id}; call tabs_list for the current ids`);
         workTab = tab.tabId; // an explicit pick: later calls follow it
-        return (0, envelopes_1.jsonResult)(tab);
+        return (0, envelopes_1.jsonResult)({ ...tab, shown: false });
     },
     tab_new: async (a, ctx) => {
         await gate(ctx, 'tab_new');
+        // Opening a tab at a URL loads it like navigate does, so gate it the same way.
+        const url = (0, validators_1.optionalString)(a, 'url');
+        if (url !== undefined)
+            await gate(ctx, 'navigate', { url });
         // Background unless asked: focusing it would pull the person off their tab.
-        const tab = await ctx.ex.tabNew((0, validators_1.optionalString)(a, 'url'), { active: (0, validators_1.optionalBoolean)(a, 'active') ?? false });
+        const tab = await ctx.ex.tabNew(url, { active: (0, validators_1.optionalBoolean)(a, 'active') ?? false });
         workTab = tab.tabId;
         return (0, envelopes_1.jsonResult)(tab);
     },
@@ -948,7 +963,20 @@ exports.TOOL_HANDLERS = {
     },
     get_cookies: async (a, ctx) => {
         await gate(ctx, 'get_text', { tabId: tabId(a) }); // reads tab-scoped secrets; same domain gate as content reads
-        return (0, envelopes_1.jsonResult)(await ctx.ex.getCookies({ tabId: tabId(a), url: (0, validators_1.optionalString)(a, 'url') }));
+        // Cookies for another URL are that site's secrets: it must be allowed too.
+        const url = (0, validators_1.optionalString)(a, 'url');
+        if (url !== undefined)
+            await gate(ctx, 'get_text', { url });
+        const result = await ctx.ex.getCookies({ tabId: tabId(a), url });
+        if (ctx.policy.allowCookieValues)
+            return (0, envelopes_1.jsonResult)(result);
+        // A session cookie is the login itself: whoever holds its value can use the
+        // account from anywhere. The browser stays signed in without the agent ever
+        // seeing it, so hide every value unless the operator opted in.
+        return (0, envelopes_1.jsonResult)({
+            cookies: result.cookies.map((c) => ({ ...c, value: COOKIE_VALUE_HIDDEN })),
+            valuesHidden: 'Cookie values are hidden. Ask the user to restart the server with --enable-cookie-values if they need them.',
+        });
     },
     storage: async (a, ctx) => {
         const op = (0, validators_1.requireString)(a, 'op');
@@ -1054,11 +1082,14 @@ exports.TOOL_HANDLERS = {
         return (0, envelopes_1.jsonResult)(res);
     },
     download_file: async (a, ctx) => {
-        await gate(ctx, 'download_file');
         const url = (0, validators_1.optionalString)(a, 'url');
         const target = (0, validators_1.optionalTarget)(a);
         if (!url && !target)
             throw new validators_1.McpToolError('provide "url" or a target (selector|ref)');
+        // By URL, the bytes come from that URL with the person's cookies: gate the
+        // URL, not whichever tab the agent is on. By element, gate the tab it is in
+        // (the extension then gates where the link leads).
+        await gate(ctx, 'download_file', url ? { url } : { tabId: tabId(a) });
         return (0, envelopes_1.jsonResult)(await ctx.ex.download({ url, target, tabId: tabId(a), suggestedName: (0, validators_1.optionalString)(a, 'suggestedName') }));
     },
     upload_file: async (a, ctx) => {
@@ -1074,9 +1105,20 @@ exports.TOOL_HANDLERS = {
         if (!ctx.policy.uploadsDir) {
             throw new validators_1.McpToolError('upload denied: uploads require an --uploads-dir to be configured (refusing unrestricted local-file access)');
         }
-        const dir = (0, node_path_1.resolve)(ctx.policy.uploadsDir);
+        // Compare real paths: Chrome reads a symlink's target, so a link inside the
+        // dir pointing outside it must be judged by where it points.
+        const real = (p) => {
+            try {
+                return (0, node_fs_1.realpathSync)(p);
+            }
+            catch {
+                // Not there (yet): resolve its folder, so /tmp vs /private/tmp still compare.
+                return p === (0, node_path_1.dirname)(p) ? p : (0, node_path_1.join)(real((0, node_path_1.dirname)(p)), (0, node_path_1.basename)(p));
+            }
+        };
+        const dir = real((0, node_path_1.resolve)(ctx.policy.uploadsDir));
         for (const f of files) {
-            const abs = (0, node_path_1.resolve)(f);
+            const abs = real((0, node_path_1.resolve)(f));
             if (abs !== dir && !abs.startsWith(dir + node_path_1.sep)) {
                 throw new validators_1.McpToolError(`upload denied: "${f}" is outside the allowed uploads dir (${dir})`);
             }

package/dist/src/security/policy.d.ts

@@ -36,6 +36,10 @@ export interface Policy extends WirePolicy {
      *  `AUTH_REQUIRED` when the page it lands on is a high-confidence sign-in
      *  wall, so an expired session is never scored as some other failure. */
     failOnAuthWall?: boolean;
+    /** `--enable-cookie-values`: `get_cookies` returns each cookie's value. Off by
+     *  default, because a session cookie is the login itself: whoever holds it can
+     *  use the account from anywhere, with no password and no browser. */
+    allowCookieValues?: boolean;
 }
 /** The SAFE default: deny everything until the user opts in. */
 export declare const DEFAULT_POLICY: Readonly<Policy>;

package/dist/src/security/policy.js

@@ -45,6 +45,7 @@ exports.DEFAULT_POLICY = Object.freeze({
     redact: false,
     redactPatterns: [],
     failOnAuthWall: false,
+    allowCookieValues: false,
 });
 /** Merge a partial (from a policy file and/or CLI flags) over the safe default. */
 function resolvePolicy(partial) {
@@ -60,6 +61,7 @@ function resolvePolicy(partial) {
         redact: partial?.redact ?? exports.DEFAULT_POLICY.redact,
         redactPatterns: partial?.redactPatterns ?? [...(exports.DEFAULT_POLICY.redactPatterns ?? [])],
         failOnAuthWall: partial?.failOnAuthWall ?? exports.DEFAULT_POLICY.failOnAuthWall,
+        allowCookieValues: partial?.allowCookieValues ?? exports.DEFAULT_POLICY.allowCookieValues,
     };
 }
 /**