mcp-browser-extension 0.9.30 → 0.9.32

package/dist/shared/protocol.js

@@ -1,4 +1,7 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
+exports.fillFormTimeoutMs = fillFormTimeoutMs;
 /**
  * shared/protocol.ts — THE SINGLE SOURCE OF TRUTH for the wire contract.
  *
@@ -14,9 +17,6 @@
  * beyond the primitives, and so is `fill_form` (a batch of `type`/`click` writes
  * in one round-trip; capability-gated, see `WIRE_CAP_FILL_FORM`).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
-exports.fillFormTimeoutMs = fillFormTimeoutMs;
 /** Bumped on any breaking change to the frames below. */
 exports.PROTOCOL_VERSION = 1;
 /**

package/dist/shared/screenshot.d.ts

@@ -14,8 +14,10 @@ export interface PageDims {
     /** Full content box (document) width/height. */
     fullW: number;
     fullH: number;
-    /** window.devicePixelRatio (default 1). Output pixels = CSS px * dpr * clip.scale. */
+    /** window.devicePixelRatio, including page zoom (default 1). */
     dpr?: number;
+    /** Chrome tab zoom: CSS pixels to device-independent pixels (default 1). */
+    zoom?: number;
     /** Current scroll offset of the top document (default 0,0); a viewport clip starts here. */
     scrollX?: number;
     scrollY?: number;
@@ -35,7 +37,7 @@ export interface ElementRect {
     w: number;
     h: number;
 }
-/** A CDP `Page.captureScreenshot` clip (CSS px; `scale` multiplies output). */
+/** A CDP `Page.captureScreenshot` clip (device-independent px, not CSS px). */
 export interface CaptureClip {
     x: number;
     y: number;

package/dist/shared/screenshot.js

@@ -27,15 +27,20 @@ exports.MAX_CAPTURE_PX = 16384;
  * viewport capture. Heights are clamped to MAX_CAPTURE_PX with `truncated` set.
  */
 function planScreenshot(dims, opts = {}) {
-    // CDP's clip.scale multiplies on top of the device scale factor, so dividing
-    // by the DPR yields exactly `opts.scale` output pixels per CSS pixel.
+    // Page.Viewport uses device-independent pixels, so convert the CSS geometry
+    // by the tab zoom. DPR already includes that zoom: dividing the output scale
+    // by DPR then yields exactly `opts.scale` output pixels per CSS pixel.
     const dpr = dims.dpr && dims.dpr > 0 ? dims.dpr : 1;
+    const zoom = dims.zoom && dims.zoom > 0 ? dims.zoom : 1;
     const scale = (opts.scale && opts.scale > 0 ? opts.scale : exports.DEFAULT_SCREENSHOT_SCALE) / dpr;
+    const clip = (x, y, width, height) => ({
+        x: x * zoom, y: y * zoom, width: width * zoom, height: height * zoom, scale,
+    });
     if (opts.element) {
         const realH = Math.max(1, Math.round(opts.element.h));
         const clipH = Math.min(opts.element.h, exports.MAX_CAPTURE_PX);
         return {
-            clip: { x: opts.element.x, y: opts.element.y, width: opts.element.w, height: clipH, scale },
+            clip: clip(opts.element.x, opts.element.y, opts.element.w, clipH),
             captureBeyondViewport: true,
             width: Math.max(1, Math.round(opts.element.w)),
             height: Math.min(realH, exports.MAX_CAPTURE_PX),
@@ -46,7 +51,7 @@ function planScreenshot(dims, opts = {}) {
     if (opts.fullPage) {
         const clipH = Math.min(dims.fullH, exports.MAX_CAPTURE_PX);
         return {
-            clip: { x: 0, y: 0, width: dims.fullW, height: clipH, scale },
+            clip: clip(0, 0, dims.fullW, clipH),
             captureBeyondViewport: true,
             width: dims.fullW,
             height: clipH,
@@ -54,11 +59,11 @@ function planScreenshot(dims, opts = {}) {
             fullHeight: dims.fullH,
         };
     }
-    // Plain viewport: capture what's visible. A clip is only needed to apply a
-    // scale; at scale 1 on a 1x display the bare capture is identical and cheaper.
+    // Plain viewport: a clip is needed to apply an output scale or page zoom.
+    // The caller can also force a fresh paint with a viewport clip at 100%.
     return {
-        ...(scale !== 1
-            ? { clip: { x: dims.scrollX ?? 0, y: dims.scrollY ?? 0, width: dims.w, height: dims.h, scale } }
+        ...(scale !== 1 || zoom !== 1
+            ? { clip: clip(dims.scrollX ?? 0, dims.scrollY ?? 0, dims.w, dims.h) }
             : {}),
         captureBeyondViewport: false,
         width: dims.w,

package/dist/src/access-browser.d.ts

@@ -0,0 +1,15 @@
+export interface BrowserEmailPrompt {
+    url: string;
+    close(): void;
+}
+export interface EmailSubmission {
+    ok: boolean;
+    message: string;
+}
+/** Best effort: the tool also returns the link for remote/headless computers. */
+export declare function openBrowserEmailPrompt(url: string): void;
+/** Only the person submitting this form can start an email. GET never sends one. */
+export declare function createBrowserEmailPrompt(submit: (email: string) => Promise<EmailSubmission>, options?: {
+    onClose?: () => void;
+    ttlMs?: number;
+}): Promise<BrowserEmailPrompt>;

package/dist/src/access-browser.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowserEmailPrompt = openBrowserEmailPrompt;
+exports.createBrowserEmailPrompt = createBrowserEmailPrompt;
+/** A temporary loopback email form for clients that cannot display elicitation. */
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const node_child_process_1 = require("node:child_process");
+/** Best effort: the tool also returns the link for remote/headless computers. */
+function openBrowserEmailPrompt(url) {
+    // Only launch a form we host, never a URL received from an MCP request.
+    if (!/^http:\/\/127\.0\.0\.1:\d+\/verify\/[a-f0-9]{64}$/.test(url))
+        return;
+    const command = process.platform === 'darwin' ? 'open'
+        : process.platform === 'win32' ? 'rundll32.exe' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    try {
+        const child = (0, node_child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch { /* Keep the form available even if the operating system cannot open it. */ }
+}
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+// Native form submission still works without JavaScript. This only provides
+// immediate feedback; the server also deduplicates concurrent submissions.
+const FORM_SCRIPT = `
+const form = document.querySelector('form');
+if (form) {
+  const button = form.querySelector('button');
+  const email = form.querySelector('[name="email"]');
+  const status = document.getElementById('verification-status');
+  const originalStatus = status.textContent;
+  let sending = false;
+  form.addEventListener('submit', (event) => {
+    if (sending) { event.preventDefault(); return; }
+    sending = true;
+    button.disabled = true;
+    button.textContent = 'Sending…';
+    email.readOnly = true;
+    form.setAttribute('aria-busy', 'true');
+    status.textContent = 'Sending your sign-in link…';
+  });
+  window.addEventListener('pageshow', () => {
+    sending = false;
+    button.disabled = false;
+    button.textContent = 'Send verification link';
+    email.readOnly = false;
+    form.removeAttribute('aria-busy');
+    status.textContent = originalStatus;
+  });
+}
+`;
+const FORM_SCRIPT_HASH = (0, node_crypto_1.createHash)('sha256').update(FORM_SCRIPT).digest('base64');
+function page(path, csrf, message, sent) {
+    return `<!doctype html><html lang="en"><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Verify your email | MCP Browser Extension</title>
+<style>
+  /* Match the extension popup's existing light/dark theme. */
+  :root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif;
+    --bg:#ffffff;--panel:#f6f7f9;--fg:#0f172a;--muted:#64748b;--line:#e6e8ec;
+    --accent:oklch(0.58 0.19 255);--accent-foreground:oklch(0.99 0 0);--ring:oklch(0.58 0.19 255 / 35%)}
+  @media(prefers-color-scheme:dark){:root{--bg:#0b0d12;--panel:#11141b;--fg:#e8ebf2;--muted:#8b93a7;--line:#232836;
+    --accent:oklch(0.7 0.16 255);--accent-foreground:oklch(0.12 0.02 255);--ring:oklch(0.7 0.16 255 / 45%)}}
+  *{box-sizing:border-box}
+  body{max-width:488px;margin:12vh auto;padding:24px;background:var(--bg);color:var(--fg);line-height:1.5;-webkit-font-smoothing:antialiased}
+  h1{font-size:28px;line-height:1.2;font-weight:500;letter-spacing:-0.025em}
+  label{display:block;font-weight:500}
+  input,button{width:100%;font:inherit;padding:12px;margin-top:8px;border:1px solid var(--line);border-radius:9px}
+  input{background:var(--panel);color:var(--fg)}
+  input:focus-visible,button:focus-visible{outline:2px solid var(--accent);outline-offset:3px;box-shadow:0 0 0 4px var(--ring)}
+  button{margin-top:18px;background:var(--accent);color:var(--accent-foreground);border-color:transparent;font-weight:500;cursor:pointer}
+  button:hover:not(:disabled){background:color-mix(in oklch,var(--accent) 88%,var(--fg))}
+  button:disabled{cursor:wait}
+  p{margin:20px 0;color:var(--muted)} .brand{font-size:14px;color:var(--fg)}
+  small{display:block;margin-top:18px;color:var(--muted)}
+</style>
+<body><p class="brand">MCP Browser Extension</p><h1>${sent ? 'Check your inbox' : 'Verify your email'}</h1>
+<p id="verification-status" role="status">${escapeHtml(message)}</p>
+${sent ? '<p>After opening the sign-in link, return to your assistant to continue.</p>' : `
+<form method="post" action="${path}">
+  <input type="hidden" name="csrf" value="${csrf}">
+  <label for="email">Email address</label>
+  <input id="email" name="email" type="email" autocomplete="email" maxlength="254" required autofocus>
+  <button type="submit">Send verification link</button>
+</form><small>Your email is sent to mcp-browser-extension.com to verify and manage access.</small>
+<script>${FORM_SCRIPT}</script>`}
+</body></html>`;
+}
+/** Only the person submitting this form can start an email. GET never sends one. */
+async function createBrowserEmailPrompt(submit, options = {}) {
+    const path = `/verify/${(0, node_crypto_1.randomBytes)(32).toString('hex')}`;
+    const csrf = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let origin = '';
+    let sent = false;
+    let sending;
+    let closed = false;
+    let expiry;
+    const sentMessage = 'A sign-in link has been sent. Open it from your email and click Verify this device to finish verification.';
+    const respond = (res, status, message) => {
+        res.writeHead(status, {
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            // Keep Origin on same-origin form POSTs; no-referrer makes Chromium send
+            // Origin: null. Cross-origin destinations still receive no referrer.
+            'referrer-policy': 'same-origin',
+            'x-content-type-options': 'nosniff',
+            'x-frame-options': 'DENY',
+            'content-security-policy': `default-src 'none'; script-src 'sha256-${FORM_SCRIPT_HASH}'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
+        });
+        res.end(page(path, csrf, message, sent));
+    };
+    const server = (0, node_http_1.createServer)((req, res) => {
+        void (async () => {
+            // Exact Host + Origin checks also prevent DNS rebinding and cross-site
+            // submissions. The random path is independent of every device credential.
+            if (req.headers.host !== origin.slice('http://'.length) || req.url !== path) {
+                res.writeHead(404).end();
+                return;
+            }
+            if (req.method === 'GET') {
+                // A reload during delivery must wait for the same result instead of
+                // restoring an email-entry form that is already being submitted.
+                const outcome = sending ? await sending : undefined;
+                respond(res, 200, sent ? sentMessage : outcome?.message ?? 'Enter your email below. We will send you a one-time sign-in link.');
+                return;
+            }
+            if (req.method !== 'POST') {
+                res.writeHead(405, { allow: 'GET, POST' }).end();
+                return;
+            }
+            if (req.headers.origin !== origin) {
+                res.writeHead(403).end();
+                return;
+            }
+            if (req.headers['content-type']?.split(';')[0] !== 'application/x-www-form-urlencoded') {
+                res.writeHead(415).end();
+                return;
+            }
+            let body = '';
+            let bytes = 0;
+            for await (const chunk of req) {
+                bytes += Buffer.byteLength(chunk);
+                if (bytes > 2048) {
+                    res.writeHead(413).end();
+                    return;
+                }
+                body += chunk.toString();
+            }
+            const fields = new URLSearchParams(body);
+            if (fields.get('csrf') !== csrf) {
+                res.writeHead(403).end();
+                return;
+            }
+            if (sent) {
+                respond(res, 200, sentMessage);
+                return;
+            }
+            if (!sending) {
+                // A repeated click replaces the browser's pending navigation. Share
+                // its result so the latest page shows the outcome of the one email.
+                sending = Promise.resolve()
+                    .then(() => submit(fields.get('email') ?? ''))
+                    .then((outcome) => { sent = outcome.ok; return outcome; })
+                    .finally(() => { sending = undefined; });
+            }
+            const outcome = await sending;
+            respond(res, outcome.ok ? 200 : 400, outcome.ok ? sentMessage : outcome.message);
+        })().catch(() => { if (!res.headersSent)
+            respond(res, 503, 'The verification service could not be reached. Please try again.'); });
+    });
+    server.requestTimeout = 10_000;
+    server.headersTimeout = 10_000;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        clearTimeout(expiry);
+        server.close();
+        server.closeAllConnections();
+        options.onClose?.();
+    };
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        close();
+        throw new Error('No loopback address');
+    }
+    origin = `http://127.0.0.1:${address.port}`;
+    expiry = setTimeout(close, options.ttlMs ?? 10 * 60_000);
+    expiry.unref();
+    server.unref();
+    return { url: origin + path, close };
+}
+//# sourceMappingURL=access-browser.js.map

package/dist/src/access.d.ts

@@ -9,6 +9,8 @@ export type AccessRequest = {
 };
 /** @internal Test seam for the verification watcher. */
 export declare function setAccessPollIntervalForTesting(ms: number, waitMs?: number): void;
+/** Close a pending form when verification finishes or its owner shuts down. */
+export declare function closeAccessBrowserPrompt(dataDir: string): void;
 declare function result(message: string): {
     content: {
         type: "text";

package/dist/src/access.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bypassEmailVerification = void 0;
 exports.setAccessPollIntervalForTesting = setAccessPollIntervalForTesting;
+exports.closeAccessBrowserPrompt = closeAccessBrowserPrompt;
 exports.requireAccess = requireAccess;
 /** Email-link access gate for the MCP tool surface. */
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const compat_1 = require("./compat");
+const access_browser_1 = require("./access-browser");
 const SITE = ((0, compat_1.runtimeEnv)('ACCESS_API') ?? 'https://mcp-browser-extension.com/api/access').replace(/\/$/, '');
 let accessPollMs = 2_000;
 let accessWaitMs = 45_000;
@@ -18,10 +20,12 @@ const EMAIL_SCHEMA = {
 };
 const validUntil = new Map();
 const currentChecks = new Map();
+const pendingEmailStarts = new Map();
 const pollingChallenges = new Map();
 const completionToReport = new Map();
+const browserPrompts = new Map();
 const VERIFIED = { status: 'verified', message: 'Email verified. MCP Browser Extension access is active.' };
-const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
+const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email and click Verify this device. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
 const CANCELLED = { status: 'cancelled', message: 'Email verification wait was cancelled. The browser action was not run.' };
 const UNAVAILABLE = { status: 'unavailable', message: 'Email verification could not be confirmed because the verification service is unavailable. Access remains blocked. Retry chrome_status shortly.' };
 /** @internal Test seam for the verification watcher. */
@@ -29,6 +33,10 @@ function setAccessPollIntervalForTesting(ms, waitMs = 45_000) {
     accessPollMs = Math.max(1, ms);
     accessWaitMs = Math.max(1, waitMs);
 }
+/** Close a pending form when verification finishes or its owner shuts down. */
+function closeAccessBrowserPrompt(dataDir) {
+    browserPrompts.get(dataDir)?.close();
+}
 function statePath(dataDir) { return (0, node_path_1.join)(dataDir, 'access.json'); }
 function loadOrCreate(dataDir) {
     (0, node_fs_1.mkdirSync)(dataDir, { recursive: true, mode: 0o700 });
@@ -68,6 +76,7 @@ function watchForEmailApproval(server, dataDir, challengeId) {
         let delayMs = accessPollMs;
         const finish = (outcome) => {
             pollingChallenges.delete(challengeId);
+            closeAccessBrowserPrompt(dataDir);
             completionToReport.set(dataDir, outcome);
             void notifyAccess(server, outcome);
             resolve(outcome);
@@ -133,10 +142,10 @@ async function waitForEmailApproval(server, dataDir, challengeId, request) {
         }
         catch { /* Progress is optional; the tool result still carries the outcome. */ }
     };
-    await report('Sign-in link sent. Open it in your email; this tool is waiting for verification automatically.');
+    await report('Sign-in link sent. Open it in your email and click Verify this device; this tool is waiting for verification automatically.');
     let timeout;
     let onAbort;
-    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email.'); }, 5_000);
+    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email and click Verify this device.'); }, 5_000);
     try {
         const outcome = await Promise.race([
             approval.promise,
@@ -176,6 +185,75 @@ async function api(path, body) {
 function result(message) {
     return { content: [{ type: 'text', text: message }], isError: true };
 }
+const inputRequired = (url) => ({
+    status: 'input-required',
+    message: '[ACCESS_INPUT_REQUIRED] Complete email verification in the browser form. It opens automatically when the client does not display its email prompt. ' +
+        `If no form appeared, open this local page on the computer running MCP Browser Extension:\n${url}\n` +
+        'Enter your email there, open the sign-in link from your inbox, and click Verify this device. This page expires in 10 minutes. ' +
+        'Show this link only as a backup. Do not open it again or ask for the email in chat while this form is active. ' +
+        'Do not fill the form or open their email for them. After they submit their email, call chrome_status to wait for verification. Access remains blocked until verification succeeds.',
+});
+function startEmail(server, dataDir, state, input) {
+    const existing = pendingEmailStarts.get(dataDir);
+    if (existing)
+        return existing;
+    const sending = sendVerificationEmail(server, dataDir, state, input)
+        .finally(() => { pendingEmailStarts.delete(dataDir); });
+    pendingEmailStarts.set(dataDir, sending);
+    return sending;
+}
+async function sendVerificationEmail(server, dataDir, state, input) {
+    const email = input.trim().toLowerCase();
+    if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return { status: 'denied', message: 'Enter a valid email address.' };
+    }
+    state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let started;
+    try {
+        started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
+    }
+    catch {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        return { status: 'unavailable', message: 'The verification service could not be reached. Please try again.' };
+    }
+    if (!started.ok) {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and try again.';
+        return { status: 'unavailable', message };
+    }
+    // Other tool calls and local processes must not poll a challenge before the
+    // backend creates it; a premature 410 would discard a valid sign-in request.
+    saveState(dataDir, state);
+    await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+    return { challengeId: state.challengeId };
+}
+async function offerBrowserPrompt(server, dataDir, request) {
+    if (request.signal?.aborted)
+        return CANCELLED;
+    const existing = browserPrompts.get(dataDir);
+    if (existing)
+        return inputRequired(existing.url);
+    const prompt = await (0, access_browser_1.createBrowserEmailPrompt)(async (email) => {
+        const state = loadOrCreate(dataDir);
+        if (state.verified || state.challengeId)
+            return { ok: false, message: 'A verification request is already active. Return to your assistant and call chrome_status.' };
+        const outcome = await startEmail(server, dataDir, state, email);
+        if (outcome && 'challengeId' in outcome) {
+            watchForEmailApproval(server, dataDir, outcome.challengeId);
+            return { ok: true, message: '' };
+        }
+        return { ok: false, message: outcome?.message ?? UNAVAILABLE.message };
+    }, { onClose: () => { browserPrompts.delete(dataDir); } });
+    browserPrompts.set(dataDir, prompt);
+    if (request.signal?.aborted) {
+        prompt.close();
+        return CANCELLED;
+    }
+    (0, access_browser_1.openBrowserEmailPrompt)(prompt.url);
+    return inputRequired(prompt.url);
+}
 /** Returns null when authorized, otherwise a user-facing tool error. */
 async function requireAccess(server, dataDir, request = {}) {
     if (request.signal?.aborted)
@@ -214,11 +292,15 @@ async function requireAccess(server, dataDir, request = {}) {
 const bypassEmailVerification = async () => null;
 exports.bypassEmailVerification = bypassEmailVerification;
 async function check(server, dataDir, request) {
+    const sending = pendingEmailStarts.get(dataDir);
+    if (sending)
+        return sending;
     const state = loadOrCreate(dataDir);
     try {
         if (state.verified) {
             const revalidated = await api('validate', { deviceId: state.deviceId, deviceSecret: state.deviceSecret });
             if (revalidated.ok && revalidated.data.authorized === true) {
+                closeAccessBrowserPrompt(dataDir);
                 validUntil.set(dataDir, Date.now() + 60_000);
                 if (completionToReport.delete(dataDir))
                     return VERIFIED;
@@ -235,6 +317,9 @@ async function check(server, dataDir, request) {
             return { status: 'unavailable', message: 'Access could not be checked right now. Retry the browser tool shortly.' };
         }
         if (!state.challengeId) {
+            const existing = browserPrompts.get(dataDir);
+            if (existing)
+                return inputRequired(existing.url);
             let elicitation;
             // The SDK retains the signal listener after an elicitation completes.
             // Detach our forwarding listener so later cancellation cannot cancel a finished prompt.
@@ -253,28 +338,17 @@ async function check(server, dataDir, request) {
             catch {
                 if (request.signal?.aborted)
                     return CANCELLED;
-                return { status: 'unavailable', message: 'Your MCP client did not display the email prompt. This access flow requires an MCP client that supports elicitation. Enable elicitation or connect from a supported client, then retry.' };
+                return await offerBrowserPrompt(server, dataDir, request);
             }
             finally {
                 request.signal?.removeEventListener('abort', cancelPrompt);
             }
             if (request.signal?.aborted)
                 return CANCELLED;
-            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string')
-                return { status: 'cancelled', message: 'Email verification was not completed. Retry the browser tool to start again.' };
-            const email = elicitation.content.email.trim().toLowerCase();
-            if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
-                return { status: 'denied', message: 'That email address is invalid. Retry the browser tool and enter a valid address.' };
-            state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
-            saveState(dataDir, state);
-            const started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
-            if (!started.ok) {
-                delete state.challengeId;
-                saveState(dataDir, state);
-                const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and retry the browser tool.';
-                return { status: 'unavailable', message };
+            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string' || !elicitation.content.email.trim()) {
+                return await offerBrowserPrompt(server, dataDir, request);
             }
-            await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+            return await startEmail(server, dataDir, state, elicitation.content.email);
         }
         return { challengeId: state.challengeId };
     }

package/dist/src/bridge/client-identity.d.ts

@@ -0,0 +1,10 @@
+import { type ClientProof } from '../../shared/client-auth';
+import type { CommandFrame } from '../../shared/protocol';
+/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
+export declare function createClientIdentity(name: () => string): {
+    id: string;
+    sign(cmd: Pick<CommandFrame, "v" | "method" | "params" | "tabId" | "timeoutMs">, challenge: string): ClientProof;
+};
+export type ClientIdentity = ReturnType<typeof createClientIdentity>;
+export declare const withClientIdentity: <T>(identity: ClientIdentity, fn: () => T) => T;
+export declare const currentClientIdentity: () => ClientIdentity | undefined;

package/dist/src/bridge/client-identity.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentClientIdentity = exports.withClientIdentity = void 0;
+exports.createClientIdentity = createClientIdentity;
+const node_async_hooks_1 = require("node:async_hooks");
+const node_crypto_1 = require("node:crypto");
+const client_auth_1 = require("../../shared/client-auth");
+/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
+function createClientIdentity(name) {
+    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ec', { namedCurve: 'prime256v1' });
+    const der = publicKey.export({ type: 'spki', format: 'der' });
+    const encoded = der.toString('base64');
+    return {
+        id: (0, node_crypto_1.createHash)('sha256').update(der).digest('hex'),
+        sign(cmd, challenge) {
+            const proof = { publicKey: encoded, name: (0, client_auth_1.clientName)(name()), challenge, issuedAt: Date.now(), nonce: (0, node_crypto_1.randomUUID)() };
+            return { ...proof, signature: (0, node_crypto_1.sign)('sha256', Buffer.from((0, client_auth_1.clientSigningPayload)(cmd, proof)), {
+                    key: privateKey, dsaEncoding: 'ieee-p1363',
+                }).toString('base64') };
+        },
+    };
+}
+const current = new node_async_hooks_1.AsyncLocalStorage();
+const withClientIdentity = (identity, fn) => current.run(identity, fn);
+exports.withClientIdentity = withClientIdentity;
+const currentClientIdentity = () => current.getStore();
+exports.currentClientIdentity = currentClientIdentity;
+//# sourceMappingURL=client-identity.js.map

package/dist/src/bridge/connection.d.ts

@@ -1,3 +1,4 @@
+import type { ClientProof } from '../../shared/client-auth';
 /**
  * src/bridge/connection.ts — one authenticated extension connection.
  *
@@ -13,10 +14,12 @@
 import type { WebSocket } from 'ws';
 import { type ServerFrame, type WireEvent, type WireMethod } from '../../shared/protocol';
 import { type ExecutorErrorCodeLocal } from '../executor/types';
+export declare function defaultTimeoutFor(method: WireMethod): number;
 /** Map a wire error code onto a local ExecutorError code (the wire enum is a
  *  near-superset; unknown codes degrade to CDP_ERROR while keeping the message). */
 export declare function mapWireErrorCode(code: string): ExecutorErrorCodeLocal;
 export interface ConnectionDeps {
+    approvalChallenge?: string;
     ws: WebSocket;
     extId: string;
     sessionId: string;
@@ -30,6 +33,7 @@ export interface ConnectionDeps {
     onLog?: (message: string) => void;
 }
 export declare class ExtensionConnection {
+    readonly approvalChallenge?: string;
     readonly extId: string;
     readonly sessionId: string;
     private readonly ws;
@@ -57,6 +61,7 @@ export declare class ExtensionConnection {
     sendCommand(method: WireMethod, params: Record<string, unknown>, opts?: {
         tabId?: string;
         timeoutMs?: number;
+        authorization?: ClientProof;
     }): Promise<unknown>;
     close(code: number, reason?: string): void;
     /** Push an unsolicited frame (a policy change, a blocked-site notice). Best-effort. */

package/dist/src/bridge/connection.js

@@ -1,18 +1,7 @@
 "use strict";
-/**
- * src/bridge/connection.ts — one authenticated extension connection.
- *
- * Owns the pending-request table: each `sendCommand` mints an id, sends a
- * CommandFrame, and parks a {resolve,reject,timer} until the matching
- * result/error frame arrives. Guarantees:
- *   - method-aware per-request timeout that rejects the ONE call (never closes
- *     the socket),
- *   - reject-ALL-pending with EXTENSION_DISCONNECTED on close,
- *   - backpressure rejection (screenshots are large; never queue unboundedly),
- *   - app-level ping/pong heartbeat (optional; disabled when heartbeatMs<=0).
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExtensionConnection = void 0;
+exports.defaultTimeoutFor = defaultTimeoutFor;
 exports.mapWireErrorCode = mapWireErrorCode;
 const protocol_1 = require("../../shared/protocol");
 const types_1 = require("../executor/types");
@@ -42,6 +31,7 @@ const ACTIVE_TAB_CHANGERS = new Set(['tab_select', 'tab_new', 'tab_close']);
 /** Bound on the per-tab URL cache; entries beyond it are evicted oldest-first. */
 const MAX_TAB_URL_ENTRIES = 256;
 class ExtensionConnection {
+    approvalChallenge;
     extId;
     sessionId;
     ws;
@@ -66,6 +56,7 @@ class ExtensionConnection {
     onLog;
     constructor(deps) {
         this.ws = deps.ws;
+        this.approvalChallenge = deps.approvalChallenge;
         this.extId = deps.extId;
         this.sessionId = deps.sessionId;
         this.caps = new Set(deps.caps ?? []);
@@ -103,6 +94,7 @@ class ExtensionConnection {
             params,
             tabId: opts?.tabId,
             timeoutMs,
+            authorization: opts?.authorization,
         };
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {