mcp-browser-extension 0.9.30 → 0.9.32

package/dist/src/bridge/peer.d.ts

@@ -1,21 +1,4 @@
-/**
- * src/bridge/peer.ts — let several mcp-browser-extension servers share one Chrome.
- *
- * Every MCP host session (each Claude terminal/tab) spawns its own mcp-browser-extension,
- * but a browser's extension dials exactly one port. So the first server to bind
- * the port is the HUB: it owns the extension connections. A later server that
- * finds the port held by a live mcp-browser-extension joins it as a PEER over the same
- * port and relays its commands through the hub, instead of killing it. If the
- * hub exits, its peers race to bind the port; the winner becomes the new hub
- * (with the same token, so the extension re-pairs on its own) and the rest join
- * it.
- *
- * Peers authenticate with the same token the extension uses — the handshake
- * file is 0600, so only the same OS user can read it — and speak a small
- * server-to-server protocol that the extension never sees:
- *   peer → hub:  peer_hello, relay (a wire command), peer_rename, peer_blocked
- *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant
- */
+import type { ClientProof } from '../../shared/client-auth';
 import { PROTOCOL_VERSION, type WireMethod } from '../../shared/protocol';
 import type { PairedProfile } from './server';
 /** How long a joining server waits for the hub's welcome before giving up. */
@@ -35,9 +18,11 @@ export interface RelayFrame {
         tabId?: string;
         timeoutMs?: number;
         profile?: string;
+        authorization?: ClientProof;
     };
 }
 export interface PeerRenameFrame {
+    authorization?: ClientProof;
     type: 'peer_rename';
     id: string;
     from: string;
@@ -99,7 +84,7 @@ export declare class HubLink {
     static join(host: string, port: number, token: string, onClose: () => void, onGrant?: (host: string, allow: boolean) => void): Promise<HubLink | null>;
     isOpen(): boolean;
     relay(method: WireMethod, params: Record<string, unknown>, opts?: RelayFrame['opts']): Promise<unknown>;
-    rename(from: string, to: string): Promise<unknown>;
+    rename(from: string, to: string, authorization: ClientProof): Promise<unknown>;
     /** Tell the hub our gate refused `host`, so it can offer the person an Allow. */
     blocked(host: string, method: string): void;
     close(): void;

package/dist/src/bridge/peer.js

@@ -1,4 +1,7 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubLink = exports.JOIN_TIMEOUT_MS = void 0;
+exports.relayError = relayError;
 /**
  * src/bridge/peer.ts — let several mcp-browser-extension servers share one Chrome.
  *
@@ -17,9 +20,6 @@
  *   peer → hub:  peer_hello, relay (a wire command), peer_rename, peer_blocked
  *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HubLink = exports.JOIN_TIMEOUT_MS = void 0;
-exports.relayError = relayError;
 const ws_1 = require("ws");
 const protocol_1 = require("../../shared/protocol");
 const types_1 = require("../executor/types");
@@ -70,6 +70,7 @@ class HubLink {
     static join(host, port, token, onClose, onGrant) {
         return new Promise((resolve) => {
             let settled = false;
+            let joined = null;
             const ws = new ws_1.WebSocket(`ws://${host}:${port}`);
             const done = (link) => {
                 if (settled)
@@ -97,9 +98,17 @@ class HubLink {
                 catch {
                     return done(null);
                 }
-                if (frame.type !== 'peer_welcome')
-                    return done(null); // 'unauthorized' or anything else
-                done(new HubLink(ws, typeof frame.hubPid === 'number' ? frame.hubPid : 0, onClose, onGrant));
+                if (!joined && frame.type === 'peer_welcome') {
+                    joined = new HubLink(ws, typeof frame.hubPid === 'number' ? frame.hubPid : 0, onClose, onGrant);
+                    return;
+                }
+                if (joined && frame.type === 'peer_state' && Array.isArray(frame.profiles)) {
+                    // The first command needs the extension's signing challenge. Do not
+                    // report a successful join before the initial browser state arrives.
+                    joined.profiles = frame.profiles;
+                    return done(joined);
+                }
+                done(null); // unauthorized or an incomplete/incompatible handshake
             };
             ws.on('message', onFirst);
             ws.once('open', () => {
@@ -117,8 +126,8 @@ class HubLink {
         const timeoutMs = (opts?.timeoutMs ?? RELAY_DEFAULT_TIMEOUT_MS - RELAY_GRACE_MS) + RELAY_GRACE_MS;
         return this.request({ type: 'relay', id: '', method, params, ...(opts ? { opts } : {}) }, timeoutMs);
     }
-    rename(from, to) {
-        return this.request({ type: 'peer_rename', id: '', from, to }, exports.JOIN_TIMEOUT_MS * 2);
+    rename(from, to, authorization) {
+        return this.request({ type: 'peer_rename', id: '', from, to, authorization }, exports.JOIN_TIMEOUT_MS * 2);
     }
     /** Tell the hub our gate refused `host`, so it can offer the person an Allow. */
     blocked(host, method) {

package/dist/src/bridge/server.d.ts

@@ -1,18 +1,3 @@
-/**
- * src/bridge/server.ts — the localhost WebSocket bridge.
- *
- * The server is the WS SERVER; the extension dials in as the single privileged
- * CLIENT. The token is the ONLY trust boundary (the loopback bind is merely
- * defense-in-depth; Origin is NOT a gate). Flow:
- *   1. Accept any loopback upgrade.
- *   2. Require a valid `hello` (matching version + token) within HELLO_TIMEOUT;
- *      otherwise send `unauthorized` and close 4401.
- *   3. On success, send `welcome` and file the connection under its profile
- *      (superseding only that profile's prior one — a security-relevant
- *      displacement event).
- * Other mcp-browser-extension servers (one per Claude session) may join the same port as
- * peers with `peer_hello` and relay their commands through us; see ./peer.
- */
 import { type WireEvent, type WireMethod, type WirePolicy } from '../../shared/protocol';
 /** Where a person gets the extension. */
 export declare const WEB_STORE_URL: "https://chromewebstore.google.com/detail/mcp-browser-extension/jelfhdlkhbfmlpbghoeaepijllcnplgh";
@@ -29,6 +14,8 @@ export type PairState = 'ok' | 'profile_mismatch' | 'token_mismatch' | 'version_
 export type ProfileNaming = 'options' | 'auto' | 'legacy';
 /** One paired browser, as reported by chrome_status. */
 export interface PairedProfile {
+    /** Public, extension-generated replay scope; not a credential. */
+    approvalChallenge?: string;
     name: string;
     /** options = typed in the extension's Options; auto = assigned by the server
      *  (renamable with profile_rename); legacy = an older extension, "default". */
@@ -86,6 +73,7 @@ export interface BridgeOptions {
 export type BridgeRole = 'hub' | 'peer';
 export declare class BridgeServer {
     private readonly opts;
+    private readonly clientIdentity;
     private wss;
     /** Profile routing key → its live connection. Multiple browsers stay paired at
      *  once; a command is routed to the connection for its target profile. A new
@@ -167,6 +155,8 @@ export declare class BridgeServer {
         timeoutMs?: number;
         profile?: string;
     }): Promise<unknown>;
+    /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
+    private forwardCommand;
     /** Whether the browser paired as `profile` advertised capability `cap`. A peer
      *  cannot see the hub's handshake, so it answers false (the conservative path). */
     hasCap(profile: string | undefined, cap: string): boolean;
@@ -201,13 +191,14 @@ export declare class BridgeServer {
     /** How to pair a browser for `profile` — surfaced whenever that profile has no live connection. */
     noPairMessage(profile: string): string;
     /** Every paired browser with how it was named — for chrome_status. */
-    pairedProfiles(): PairedProfile[];
+    pairedProfiles(includeChallenge?: boolean): PairedProfile[];
     /**
      * Rename an automatically named browser. The new name sticks across restarts
      * (it's stored against the extension install); a live connection is re-keyed
      * in place, so it keeps working without re-pairing.
      */
     renameProfile(from: string, to: string): Promise<string>;
+    private renameApprovedProfile;
     status(): {
         extensionConnected: boolean;
         port: number;

package/dist/src/bridge/server.js

@@ -1,10 +1,14 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BridgeServer = exports.WEB_STORE_URL = void 0;
+const client_auth_1 = require("../../shared/client-auth");
+const client_identity_1 = require("./client-identity");
 /**
  * src/bridge/server.ts — the localhost WebSocket bridge.
  *
  * The server is the WS SERVER; the extension dials in as the single privileged
- * CLIENT. The token is the ONLY trust boundary (the loopback bind is merely
- * defense-in-depth; Origin is NOT a gate). Flow:
+ * CLIENT. The token authenticates this transport; the extension separately
+ * verifies each command against its approved client keys. Flow:
  *   1. Accept any loopback upgrade.
  *   2. Require a valid `hello` (matching version + token) within HELLO_TIMEOUT;
  *      otherwise send `unauthorized` and close 4401.
@@ -14,8 +18,6 @@
  * Other mcp-browser-extension servers (one per Claude session) may join the same port as
  * peers with `peer_hello` and relay their commands through us; see ./peer.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BridgeServer = exports.WEB_STORE_URL = void 0;
 const ws_1 = require("ws");
 const node_crypto_1 = require("node:crypto");
 const protocol_1 = require("../../shared/protocol");
@@ -75,6 +77,12 @@ const MAX_PREAUTH_FRAMES = 10;
 const PORT_WAIT_MS = 4_000;
 /** Pause between port-bind retries while waiting for the old listener to exit. */
 const PORT_RETRY_MS = 250;
+/** Bridge frames are small JSON control messages; cap unauthenticated memory use. */
+const MAX_BRIDGE_FRAME_BYTES = 4 * 1024 * 1024;
+/** Native clients omit Origin; Chrome extensions use their own isolated origin. */
+function allowBridgeOrigin(origin) {
+    return origin === undefined || /^chrome-extension:\/\/[a-p]{32}$/.test(origin);
+}
 const delay = (ms) => new Promise((r) => setTimeout(r, ms));
 /** A friendly, actionable message for the rare case the port stays busy past PORT_WAIT_MS. */
 function portBusyMessage(host, port) {
@@ -88,6 +96,7 @@ function portBusyMessage(host, port) {
 }
 class BridgeServer {
     opts;
+    clientIdentity = (0, client_identity_1.createClientIdentity)(() => 'Local browser client');
     wss = null;
     /** Profile routing key → its live connection. Multiple browsers stay paired at
      *  once; a command is routed to the connection for its target profile. A new
@@ -295,7 +304,13 @@ class BridgeServer {
     /** One bind attempt. Resolves with a listening server or rejects with the listen error. */
     listenOnce(host, port) {
         return new Promise((resolve, reject) => {
-            const wss = new ws_1.WebSocketServer({ host, port });
+            const wss = new ws_1.WebSocketServer({
+                host,
+                port,
+                maxPayload: MAX_BRIDGE_FRAME_BYTES,
+                perMessageDeflate: false,
+                verifyClient: ({ origin }) => allowBridgeOrigin(origin || undefined),
+            });
             const onError = (err) => {
                 wss.off('listening', onListening);
                 // Close so the failed server doesn't linger and leak a handle on retry.
@@ -365,12 +380,33 @@ class BridgeServer {
      * Rejects with an actionable message if that profile has no live browser.
      */
     async sendCommand(method, params, opts) {
+        const profile = routeKey(opts?.profile);
+        const timeoutMs = opts?.timeoutMs ?? (0, connection_1.defaultTimeoutFor)(method);
+        const intent = { v: protocol_1.PROTOCOL_VERSION, method, params, tabId: opts?.tabId, timeoutMs };
+        const challenge = this.hub
+            ? this.hub.profiles.find((p) => p.name === profile)?.approvalChallenge
+            : this.conns.get(profile)?.approvalChallenge;
+        let authorization;
+        if (!(0, client_auth_1.isHealthProbe)(intent)) {
+            if (!this.hasConnection(profile))
+                throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
+            if (!challenge)
+                throw new types_1.ExecutorError('POLICY_DENIED', 'Update the extension and MCP server together: this browser cannot enforce client approval yet.');
+            authorization = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, challenge);
+        }
+        const options = { ...opts, timeoutMs, authorization };
         if (this.hub)
-            return this.hub.relay(method, params, opts);
+            return this.hub.relay(method, params, options);
+        return this.forwardCommand(method, params, options);
+    }
+    /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
+    async forwardCommand(method, params, opts) {
         const profile = routeKey(opts?.profile);
         const conn = this.conns.get(profile);
-        if (!conn || !conn.isOpen()) {
+        if (!conn?.isOpen())
             throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
+        if (!(0, client_auth_1.isHealthProbe)({ method, params }) && (!conn.hasCap(client_auth_1.CLIENT_APPROVAL_CAP) || !opts?.authorization)) {
+            throw new types_1.ExecutorError('POLICY_DENIED', 'Signed client authorization and an updated extension are required.');
         }
         return conn.sendCommand(method, params, opts);
     }
@@ -478,19 +514,18 @@ class BridgeServer {
         return steps.length > 0 ? `${head} ${steps.join(' ')}` : head;
     }
     /** Every paired browser with how it was named — for chrome_status. */
-    pairedProfiles() {
+    pairedProfiles(includeChallenge = false) {
         if (this.hub)
-            return [...this.hub.profiles];
+            return this.hub.profiles.map(({ approvalChallenge, ...p }) => includeChallenge ? { ...p, approvalChallenge } : p);
         const out = [];
         for (const [name, conn] of this.conns) {
             if (!conn.isOpen())
                 continue;
-            const activeUrl = conn.lastActiveUrl(Number.POSITIVE_INFINITY) ?? undefined;
             const o = this.origins.get(name);
             out.push({
                 name,
                 naming: o?.naming ?? 'legacy',
-                ...(activeUrl ? { activeUrl } : {}),
+                ...(includeChallenge && conn.approvalChallenge ? { approvalChallenge: conn.approvalChallenge } : {}),
                 ...(o?.extVersion ? { extVersion: o.extVersion } : {}),
                 ...(o?.extId || o?.install ? { extSource: extensionSource(o) } : {}),
             });
@@ -503,8 +538,18 @@ class BridgeServer {
      * in place, so it keeps working without re-pairing.
      */
     async renameProfile(from, to) {
-        if (this.hub)
-            return String(await this.hub.rename(from, to));
+        if (this.hub) {
+            const challenge = this.hub.profiles.find((p) => p.name === routeKey(from))?.approvalChallenge;
+            if (!challenge)
+                throw new types_1.ExecutorError('POLICY_DENIED', 'Connect an updated browser before renaming it.');
+            const intent = { v: protocol_1.PROTOCOL_VERSION, method: 'ping_probe', params: { requireClientApproval: true, renameProfile: { from, to } }, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe') };
+            const authorization = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, challenge);
+            return String(await this.hub.rename(from, to, authorization));
+        }
+        await this.sendCommand('ping_probe', { requireClientApproval: true, renameProfile: { from, to } }, { profile: from });
+        return this.renameApprovedProfile(from, to);
+    }
+    async renameApprovedProfile(from, to) {
         const src = routeKey(from);
         const live = this.conns.get(src);
         if (live?.isOpen() && this.origins.get(src)?.naming === 'options') {
@@ -600,6 +645,7 @@ class BridgeServer {
             this.promote(ws, frame.ext ?? { id: 'unknown', version: '0', chrome: '0' }, profile, Array.isArray(frame.caps) ? frame.caps : undefined, {
                 naming,
                 installId,
+                approvalChallenge: typeof frame.approvalChallenge === 'string' && /^[a-f0-9-]{36}$/.test(frame.approvalChallenge) ? frame.approvalChallenge : undefined,
                 ...(typeof frame.ext?.version === 'string' ? { extVersion: frame.ext.version.slice(0, 32) } : {}),
                 ...(typeof frame.ext?.id === 'string' ? { extId: frame.ext.id.slice(0, 64) } : {}),
                 ...(typeof frame.install === 'string' ? { install: frame.install.slice(0, 32) } : {}),
@@ -634,7 +680,7 @@ class BridgeServer {
         this.peers.add(ws);
         this.log(`mcp-browser-extension pid ${pid ?? '?'} joined as a peer (${this.peers.size} sharing these browsers)`);
         this.sendPeer(ws, { type: 'peer_welcome', hubPid: process.pid });
-        this.sendPeer(ws, { type: 'peer_state', profiles: this.pairedProfiles() });
+        this.sendPeer(ws, { type: 'peer_state', profiles: this.pairedProfiles(true) });
         ws.on('message', (raw) => this.handlePeerFrame(ws, raw.toString()));
         ws.on('close', () => this.peers.delete(ws));
         ws.on('error', () => {
@@ -653,9 +699,9 @@ class BridgeServer {
             work.then((data) => this.sendPeer(ws, { type: 'relay_result', id, ok: true, data }), (err) => this.sendPeer(ws, (0, peer_1.relayError)(id, err)));
         };
         if (frame.type === 'relay')
-            answer(frame.id, this.sendCommand(frame.method, frame.params ?? {}, frame.opts));
+            answer(frame.id, this.forwardCommand(frame.method, frame.params ?? {}, frame.opts));
         else if (frame.type === 'peer_rename')
-            answer(frame.id, this.renameProfile(frame.from, frame.to));
+            answer(frame.id, this.forwardCommand('ping_probe', { requireClientApproval: true, renameProfile: { from: frame.from, to: frame.to } }, { profile: frame.from, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe'), authorization: frame.authorization }).then(() => this.renameApprovedProfile(frame.from, frame.to)));
         else if (frame.type === 'peer_blocked' && typeof frame.host === 'string')
             this.noteBlocked(frame.host, String(frame.method ?? ''));
     }
@@ -663,7 +709,7 @@ class BridgeServer {
     broadcastState() {
         if (this.peers.size === 0)
             return;
-        const state = { type: 'peer_state', profiles: this.pairedProfiles() };
+        const state = { type: 'peer_state', profiles: this.pairedProfiles(true) };
         for (const peer of this.peers)
             this.sendPeer(peer, state);
     }
@@ -709,6 +755,7 @@ class BridgeServer {
             sessionId,
             heartbeatMs: this.heartbeatMs,
             caps,
+            approvalChallenge: origin.approvalChallenge,
             onEvent: this.opts.onEvent,
             onSiteGrant: (host, allow) => this.applySiteGrant(host, allow),
             onLog: (m) => this.log(m),

package/dist/src/bridge/site-grants.d.ts

@@ -12,8 +12,7 @@
  *
  * Grants only ever ADD to the flags' list, and only grants can be removed again:
  * a site that came from `--allow-domain` stays until the flags change. A grant
- * is always one concrete host (or `*.host`), never the `*` catch-all — allowing
- * every site stays a deliberate flag (`--unsafe-all-domains`).
+ * is always one concrete host (or `*.host`), never an all-site catch-all.
  */
 export declare const GRANTS_FILE = "allowed-sites.json";
 /**

package/dist/src/bridge/site-grants.js

@@ -13,8 +13,7 @@
  *
  * Grants only ever ADD to the flags' list, and only grants can be removed again:
  * a site that came from `--allow-domain` stays until the flags change. A grant
- * is always one concrete host (or `*.host`), never the `*` catch-all — allowing
- * every site stays a deliberate flag (`--unsafe-all-domains`).
+ * is always one concrete host (or `*.host`), never an all-site catch-all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SiteGrants = exports.GRANTS_FILE = void 0;
@@ -59,7 +58,9 @@ class SiteGrants {
     constructor(allowDomains, dataDir) {
         this.allowDomains = allowDomains;
         this.dataDir = dataDir;
-        this.base = new Set(allowDomains.map((d) => d.toLowerCase()));
+        const namedSites = allowDomains.map(policy_1.normalizeDomainPattern).filter(Boolean);
+        allowDomains.splice(0, allowDomains.length, ...namedSites);
+        this.base = new Set(namedSites);
         for (const site of this.load())
             this.add(site);
     }

package/dist/src/cli.js

@@ -400,6 +400,7 @@ async function main() {
                 userDataDir: workspace.profileDir,
                 downloadDir: workspace.downloadDir,
                 headless: cfg.headless,
+                policy: (0, policy_1.toWirePolicy)(cfg.policy),
             },
         }),
     });
@@ -526,9 +527,6 @@ async function serveRemote(cfg, dataDir, stopBridge) {
         'Anyone with this URL can drive this Chrome within the allowed sites. Keep it private.',
         'Cut everyone off: restart with --rotate-remote-key.',
         ...(tunnel ? ['The tunnel URL changes every time this starts.'] : []),
-        ...(cfg.policy.allowDomains.includes('*')
-            ? ['', 'WARNING: --unsafe-all-domains is on, so remote clients can reach every site you are signed in to.']
-            : []),
         '',
     ];
     process.stdout.write(`${lines.join('\n')}\n`);

package/dist/src/config.js

@@ -20,7 +20,8 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const node_fs_1 = require("node:fs");
 const protocol_1 = require("../shared/protocol");
-const policy_1 = require("./security/policy");
+const policy_1 = require("../shared/policy");
+const policy_2 = require("./security/policy");
 const compat_1 = require("./compat");
 /** Local port for `--http` (one above the bridge's). */
 exports.DEFAULT_HTTP_PORT = 38018;
@@ -131,8 +132,7 @@ function parseArgs(argv) {
                 policyFile = readPolicyFile(requireValue(argv[++i], '--policy'));
                 break;
             case '--unsafe-all-domains':
-                policyFlags.allowDomains = ['*'];
-                break;
+                throw new Error('All-site access is no longer supported. Remove --unsafe-all-domains from your MCP configuration and approve websites in the Chrome extension popup.');
             case '--allow-domain':
                 (policyFlags.allowDomains ??= []).push(requireValue(argv[++i], '--allow-domain'));
                 break;
@@ -157,6 +157,9 @@ function parseArgs(argv) {
             case '--enable-observers':
                 policyFlags.allowObservers = true;
                 break;
+            case '--enable-cookie-values':
+                policyFlags.allowCookieValues = true;
+                break;
             case '--redact':
                 policyFlags.redact = true;
                 break;
@@ -244,7 +247,13 @@ function parseArgs(argv) {
         throw new Error('--no-email-verification cannot be used with --tunnel');
     }
     // File first, then flags win.
-    const policy = (0, policy_1.resolvePolicy)({ ...policyFile, ...policyFlags });
+    for (const source of [policyFile, policyFlags]) {
+        if (source?.allowDomains !== undefined && (!Array.isArray(source.allowDomains) ||
+            source.allowDomains.some((domain) => typeof domain !== 'string' || !(0, policy_1.normalizeDomainPattern)(domain)))) {
+            throw new Error('Each allowed site must name a website. All-site access is no longer supported; approve websites in the Chrome extension popup.');
+        }
+    }
+    const policy = (0, policy_2.resolvePolicy)({ ...policyFile, ...policyFlags });
     // Uploads must be confined to a directory — refuse to start with uploads enabled
     // but no dir, rather than silently allow unrestricted local-file access.
     if (policy.allowUploads && !policy.uploadsDir) {
@@ -408,7 +417,6 @@ Security (default: deny-all safe mode):
                          to <data-dir>/allowed-sites.json; no restart needed)
   --no-site-grants       Ignore sites allowed from the extension's Options page; the
                          allowlist is exactly what these flags and --policy say
-  --unsafe-all-domains   Allow every domain (loud footgun)
   --enable-mutations     Enable click/type/navigate/… (off by default)
   --unsafe-enable-eval   Enable the eval primitive (off by default)
   --enable-downloads     Enable download_file (off by default)
@@ -419,6 +427,9 @@ Security (default: deny-all safe mode):
                          in-page hook on allowlisted sites that records console
                          output, fetch/XHR traffic, and intercepts alert/confirm/
                          prompt (off by default: it patches page globals).
+  --enable-cookie-values Let get_cookies return cookie values. Off by default:
+                         a session cookie is the login itself, so get_cookies
+                         returns names and flags with every value hidden.
   --redact               Scrub secret-shaped strings (JWTs, cloud keys, bearer
                          tokens, private keys) out of page reads. Password field
                          values are always suppressed, with or without this.

package/dist/src/executor/cdp-executor.d.ts

@@ -12,6 +12,7 @@
  * stealth init on the launch path only, and tab resolution. `tabId`s are stamped
  * `cdp:<sessionId>:<n>` so a handle never mis-routes across a backend switch.
  */
+import type { WirePolicy } from '../../shared/protocol';
 import { type ActionOk, type BackendKind, type CookieItem, type DownloadResult, type EvalResult, type Executor, type ExecutorStatus, type KeyModifier, type NavResult, type ScreenshotEncoding, type ScreenshotResult, type SnapshotLocator, type SnapshotResult, type StorageOp, type StorageResult, type TabId, type TabInfo, type Target, type WaitResult, type WaitUntil } from './types';
 export interface CdpOptions {
     mode: 'connect' | 'launch';
@@ -19,6 +20,8 @@ export interface CdpOptions {
     userDataDir: string;
     headless?: boolean;
     downloadDir?: string;
+    /** The same URL/method policy enforced by the MCP tool layer. */
+    policy?: WirePolicy;
 }
 export declare class CdpExecutor implements Executor {
     private readonly opts;

package/dist/src/executor/cdp-executor.js

@@ -21,6 +21,7 @@ const node_path_1 = require("node:path");
 const node_crypto_1 = require("node:crypto");
 const playwright_1 = require("playwright");
 const download_1 = require("../../shared/download");
+const policy_1 = require("../../shared/policy");
 const snapshot_1 = require("../../shared/snapshot");
 const screenshot_1 = require("../../shared/screenshot");
 const types_1 = require("./types");
@@ -29,6 +30,7 @@ const STEALTH = `Object.defineProperty(navigator,'webdriver',{get:()=>undefined}
 const NON_CONTENT = /^(file|data|devtools|chrome|about):/i;
 /** Playwright errors that mean the page/context/browser died under us → DETACHED. */
 const CLOSED_TARGET = /Target closed|Browser has been closed|Target page, context or browser has been closed|Execution context was destroyed/i;
+const MAX_CDP_DOWNLOAD_BYTES = 50 * 1024 * 1024;
 /** Minimal CSS attribute-value escape for ref selectors (refs are `e\d+`, but be safe). */
 function cssEscape(s) {
     return s.replace(/["\\]/g, '\\$&');
@@ -587,38 +589,80 @@ class CdpExecutor {
         const ctx = await this.getContext();
         const dir = this.opts.downloadDir ?? (0, node_path_1.join)(this.opts.userDataDir, 'downloads');
         (0, node_fs_1.mkdirSync)(dir, { recursive: true });
-        const safeName = (0, download_1.sanitizeDownloadName)(args.suggestedName);
-        const dest = (0, node_path_1.join)(dir, safeName);
-        if (args.url) {
-            const resp = await ctx.request.get(args.url);
-            const body = await resp.body();
-            if (!(0, download_1.isWithinSizeCap)(body.length)) {
-                throw new types_1.ExecutorError('DOWNLOAD_FAILED', `download exceeds the ${download_1.MAX_DOWNLOAD_BYTES}-byte cap`);
+        let url = args.url ?? '';
+        let suggestedName = args.suggestedName;
+        if (!url) {
+            const p = await this.resolveTab(args.tabId);
+            const target = args.target;
+            if (!target)
+                throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'provide a url or a target');
+            const locator = this.locator(p, target);
+            const href = await locator.getAttribute('href');
+            if (!href)
+                throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'the target must be a link with an href');
+            const baseUrl = await locator.evaluate((el) => el.ownerDocument.baseURI);
+            try {
+                url = new URL(href, baseUrl).href;
             }
-            (0, node_fs_1.writeFileSync)(dest, body);
-            return { path: dest, backend: this.backend, bytes: body.length, mimeType: resp.headers()['content-type'] };
+            catch {
+                throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'the target has an invalid download URL');
+            }
+            suggestedName = (await locator.getAttribute('download')) || suggestedName;
         }
-        // Element-triggered download.
-        const p = await this.resolveTab(args.tabId);
-        const target = args.target;
-        if (!target)
-            throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'provide a url or a target');
-        const [dl] = await Promise.all([p.waitForEvent('download'), this.locator(p, target).click()]);
-        let bytes = 0;
+        const policy = this.opts.policy ?? { allowDomains: [], allowEval: false, allowDownloads: false, allowUploads: false, allowAllTabs: false, enableMutations: false, allowObservers: false };
+        const verdict = (0, policy_1.evaluatePolicy)(url, 'download_file', policy);
+        if (!verdict.ok)
+            throw new types_1.ExecutorError('POLICY_DENIED', verdict.reason);
+        let response;
         try {
-            // Surface a cancelled/interrupted download instead of reporting a phantom success.
-            const failure = await dl.failure();
-            if (failure)
-                throw new types_1.ExecutorError('DOWNLOAD_FAILED', `download failed: ${failure}`);
-            await dl.saveAs(dest);
-            bytes = (0, node_fs_1.statSync)(dest).size;
+            // Node fetch has no browser cookie jar; error mode refuses every redirect
+            // before any intermediate destination is contacted.
+            response = await fetch(url, { redirect: 'error', signal: AbortSignal.timeout(120_000) });
         }
-        catch (err) {
-            if (err instanceof types_1.ExecutorError)
+        catch {
+            throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'download request failed or redirects are not supported');
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new types_1.ExecutorError('DOWNLOAD_FAILED', `download returned HTTP ${response.status}`);
+        }
+        const declaredLength = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_CDP_DOWNLOAD_BYTES) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'download exceeds the 50 MiB limit');
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        const reader = response.body?.getReader();
+        if (reader) {
+            try {
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    totalBytes += value.byteLength;
+                    if (totalBytes > MAX_CDP_DOWNLOAD_BYTES) {
+                        await reader.cancel();
+                        throw new types_1.ExecutorError('DOWNLOAD_FAILED', 'download exceeds the 50 MiB limit');
+                    }
+                    chunks.push(value);
+                }
+            }
+            catch (err) {
+                await reader.cancel().catch(() => undefined);
                 throw err;
+            }
+        }
+        const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), totalBytes);
+        const safeName = (0, download_1.sanitizeDownloadName)(suggestedName);
+        const dest = (0, node_path_1.join)(dir, safeName);
+        try {
+            (0, node_fs_1.writeFileSync)(dest, body);
+        }
+        catch (err) {
             throw new types_1.ExecutorError('DOWNLOAD_FAILED', `failed to save download: ${err.message}`);
         }
-        return { path: dest, backend: this.backend, bytes, suggestedName: dl.suggestedFilename() };
+        return { path: dest, backend: this.backend, bytes: body.length, mimeType: response.headers.get('content-type') ?? undefined, suggestedName: safeName };
     }
     async uploadFile(t, files, opts) {
         return this.guard(async () => {

package/dist/src/mcp/server.js

@@ -36,16 +36,18 @@ const SERVER_VERSION = '0.1.0';
  * than retry.
  */
 exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, signed-in Chrome. " +
-    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
+    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you, then click Verify this device on the website. If it returns ACCESS_INPUT_REQUIRED, the local verification form opens automatically in the browser; also show its URL as a backup so the user can enter their email. Do not open the backup URL again or add another chat email prompt while that form is active. Do not fill it or read their email for them. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
+    'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +
-    'toolbar icon (its popup has an Allow button). It applies at once, with no restart. You cannot approve a site yourself. ' +
+    'toolbar icon (its popup has an Allow button). Relay the friendly one-line approval steps from the error and wait for the person. It applies at once, with no restart. You cannot approve a site yourself or enable all-site access. ' +
     "Work in your own tab: tab_new opens one in the background, and calls without a tabId go to it, never to the tab the user is on. " +
     "To act on the user's current page, pass its tabId from tabs_list.";
 const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
+    'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
-    'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s toolbar icon. ' +
+    'If a tool fails with POLICY_DENIED because a site is not allowed, relay its friendly one-line approval steps and wait for the person to allow it from the extension\'s toolbar icon. Never approve it yourself or enable all-site access. ' +
     "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";
 /** Default version reported when no explicit version is passed in (legacy callers/tests). */
 const DEFAULT_VERSION = SERVER_VERSION;

package/dist/src/mcp/tools.d.ts

@@ -1,15 +1,3 @@
-/**
- * src/mcp/tools.ts — the MCP tool surface: the advertised catalog
- * (`TOOL_DEFINITIONS`, each with a zod `inputSchema`), the name→handler dispatch
- * (`TOOL_HANDLERS`), the never-throw firewall (`dispatchToolCall`), and
- * `registerTools()` which registers every tool on an `McpServer` via
- * `registerTool` — the SDK validates the zod schema before dispatch runs.
- *
- * Each handler: validate args → **policy-gate against the relevant URL** → call
- * the active Executor (or a server-side helper) → serialize via an envelope.
- * Nothing here throws to the transport: `dispatchToolCall` renders any thrown
- * `Error` as an `isError` result.
- */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';