mcp-browser-extension 0.9.30 → 0.9.32

package/dist/src/mcp/tools.js

@@ -1,16 +1,4 @@
 "use strict";
-/**
- * src/mcp/tools.ts — the MCP tool surface: the advertised catalog
- * (`TOOL_DEFINITIONS`, each with a zod `inputSchema`), the name→handler dispatch
- * (`TOOL_HANDLERS`), the never-throw firewall (`dispatchToolCall`), and
- * `registerTools()` which registers every tool on an `McpServer` via
- * `registerTool` — the SDK validates the zod schema before dispatch runs.
- *
- * Each handler: validate args → **policy-gate against the relevant URL** → call
- * the active Executor (or a server-side helper) → serialize via an envelope.
- * Nothing here throws to the transport: `dispatchToolCall` renders any thrown
- * `Error` as an `isError` result.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TOOL_HANDLERS = exports.TOOL_NAMES = exports.TOOL_DEFINITIONS = void 0;
 exports.setToolAllowlist = setToolAllowlist;
@@ -24,6 +12,19 @@ exports.resetRateLimiter = resetRateLimiter;
 exports.dispatchToolCall = dispatchToolCall;
 exports.assertNoDrift = assertNoDrift;
 exports.registerTools = registerTools;
+const client_identity_1 = require("../bridge/client-identity");
+/**
+ * src/mcp/tools.ts — the MCP tool surface: the advertised catalog
+ * (`TOOL_DEFINITIONS`, each with a zod `inputSchema`), the name→handler dispatch
+ * (`TOOL_HANDLERS`), the never-throw firewall (`dispatchToolCall`), and
+ * `registerTools()` which registers every tool on an `McpServer` via
+ * `registerTool` — the SDK validates the zod schema before dispatch runs.
+ *
+ * Each handler: validate args → **policy-gate against the relevant URL** → call
+ * the active Executor (or a server-side helper) → serialize via an envelope.
+ * Nothing here throws to the transport: `dispatchToolCall` renders any thrown
+ * `Error` as an `isError` result.
+ */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const zod_1 = require("zod");
@@ -124,7 +125,7 @@ exports.TOOL_DEFINITIONS = [
     { name: 'get_html', description: 'Get HTML of the page or an element. Output is capped (see maxBytes) and cut at a tag boundary; narrow it with `selector` rather than raising the cap when you can. Password field values are always blanked.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, outer: zod_1.z.boolean().optional(), tabId: tabIdField, maxBytes: maxBytesField } },
     { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with refs to target by `ref` (more reliable than guessing CSS selectors). Pass diff:true to get only what changed since the last snapshot of this tab - far cheaper in a click/read loop. Password fields appear as secret:true with no value.', inputSchema: { interactiveOnly: zod_1.z.boolean().optional(), max: zod_1.z.number().optional(), diff: zod_1.z.boolean().describe('Return added/removed/changed elements since the previous snapshot of this tab instead of the whole tree').optional(), failOnAuthWall: authWallField, ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'page_watch', description: 'Save a local page checkpoint and compare it later. Actions: create (name), compare (watchId), list, delete. Stores accessibility labels and state, never form values. Site allowlist still applies.', inputSchema: { action: zod_1.z.enum(['create', 'compare', 'list', 'delete']), name: zod_1.z.string().optional(), watchId: zod_1.z.string().optional(), tabId: tabIdField } },
-    { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'get_cookies', description: "Cookies for the tab's URL (or url); values need --enable-cookie-values.", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: { selector: zod_1.z.string().optional(), textContains: zod_1.z.string().optional(), gone: zod_1.z.boolean().optional(), timeoutMs: zod_1.z.number().optional(), ...FRAME_PROPS, tabId: tabIdField, failOnAuthWall: authWallField } },
@@ -327,13 +328,13 @@ const TOOL_GATE = {
  *
  * Runs the REAL `evaluatePolicy` — the same function the gate and the extension
  * router run, so this can never disagree with them — but with the domain
- * allowlist widened to `*`. Only the capability gates (eval / downloads /
+ * allowlist set to the single probe host. Only the capability gates (eval / downloads /
  * uploads / observers / mutations) can then reject, which is exactly the
  * question we want: a tool blocked merely because the current tab is off the
  * allowlist stays advertised, since another tab may well be on it.
  */
 function isCapabilityDenied(method, policy) {
-    return !(0, policy_2.evaluatePolicy)('https://probe.invalid/', method, { ...policy, allowDomains: ['*'] }).ok;
+    return !(0, policy_2.evaluatePolicy)('https://probe.invalid/', method, { ...policy, allowDomains: ['probe.invalid'] }).ok;
 }
 /**
  * Is `name` usable at all under `policy`? Undefined policy = advertise
@@ -400,6 +401,8 @@ function enabledToolNames() {
 const GATE_CONTEXT = 'cannot resolve the target tab URL for the policy gate';
 /** How long the gate waits for a just-opened background tab to report its URL. */
 const OPENING_TAB_WAIT_MS = 5_000;
+/** What `get_cookies` returns in place of a value unless --enable-cookie-values is set. */
+const COOKIE_VALUE_HIDDEN = '[hidden]';
 /**
  * Resolve the URL the policy should be evaluated against: the URL of the tab
  * this very call will act on — the explicit `tabId` when the caller gave one,
@@ -965,7 +968,16 @@ exports.TOOL_HANDLERS = {
         const url = (0, validators_1.optionalString)(a, 'url');
         if (url !== undefined)
             await gate(ctx, 'get_text', { url });
-        return (0, envelopes_1.jsonResult)(await ctx.ex.getCookies({ tabId: tabId(a), url }));
+        const result = await ctx.ex.getCookies({ tabId: tabId(a), url });
+        if (ctx.policy.allowCookieValues)
+            return (0, envelopes_1.jsonResult)(result);
+        // A session cookie is the login itself: whoever holds its value can use the
+        // account from anywhere. The browser stays signed in without the agent ever
+        // seeing it, so hide every value unless the operator opted in.
+        return (0, envelopes_1.jsonResult)({
+            cookies: result.cookies.map((c) => ({ ...c, value: COOKIE_VALUE_HIDDEN })),
+            valuesHidden: 'Cookie values are hidden. Ask the user to restart the server with --enable-cookie-values if they need them.',
+        });
     },
     storage: async (a, ctx) => {
         const op = (0, validators_1.requireString)(a, 'op');
@@ -1075,9 +1087,9 @@ exports.TOOL_HANDLERS = {
         const target = (0, validators_1.optionalTarget)(a);
         if (!url && !target)
             throw new validators_1.McpToolError('provide "url" or a target (selector|ref)');
-        // By URL, the bytes come from that URL with the person's cookies: gate the
-        // URL, not whichever tab the agent is on. By element, gate the tab it is in
-        // (the extension then gates where the link leads).
+        // By URL, gate the destination rather than whichever tab the agent is on.
+        // For links, the extension/CDP executor also gates the resolved href before
+        // fetching it; downloads omit browser cookies and refuse redirects.
         await gate(ctx, 'download_file', url ? { url } : { tabId: tabId(a) });
         return (0, envelopes_1.jsonResult)(await ctx.ex.download({ url, target, tabId: tabId(a), suggestedName: (0, validators_1.optionalString)(a, 'suggestedName') }));
     },
@@ -1215,7 +1227,7 @@ exports.TOOL_HANDLERS = {
         });
     },
     chrome_status: async (_a, ctx) => {
-        const profiles = profileBridge ? { profiles: profileBridge.pairedProfiles() } : {};
+        const profiles = profileBridge ? { profiles: profileBridge.pairedProfiles().map(({ approvalChallenge: _challenge, activeUrl: _url, ...profile }) => profile) } : {};
         const capabilities = capabilityStatus(ctx.policy);
         // Why nothing is paired, and the steps to fix it, so the agent can relay them
         // on the FIRST call instead of after a run of NO_BACKEND failures.
@@ -1501,6 +1513,10 @@ function modelFromMeta(meta) {
 /** Register the tool surface; returns the names actually advertised. */
 function registerTools(server, policy, accessGuard = access_1.requireAccess) {
     assertNoDrift();
+    const identity = (0, client_identity_1.createClientIdentity)(() => {
+        const client = server.server.getClientVersion();
+        return client ? `${client.name} ${client.version}` : 'Unnamed app';
+    });
     // Register each tool with its zod `inputSchema`. The SDK advertises it in
     // `tools/list` and validates arguments before invoking the handler, which
     // just routes back through `dispatchToolCall` — our never-throw firewall that
@@ -1516,7 +1532,7 @@ function registerTools(server, policy, accessGuard = access_1.requireAccess) {
             policyDropped.push(d.name);
             continue;
         }
-        server.registerTool(d.name, { description: d.description, inputSchema: d.inputSchema }, async (args, extra) => {
+        server.registerTool(d.name, { description: d.description, inputSchema: d.inputSchema }, async (args, extra) => (0, client_identity_1.withClientIdentity)(identity, async () => {
             (0, telemetry_1.noteMcpModel)(modelFromMeta(extra?._meta));
             let verifiedNow = false;
             const accessError = await accessGuard(server.server, (0, config_1.resolveDataDir)(), {
@@ -1528,11 +1544,21 @@ function registerTools(server, policy, accessGuard = access_1.requireAccess) {
             });
             if (accessError)
                 return accessError;
+            if (profileBridge?.hasActiveExtension()) {
+                const active = (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default';
+                const profile = profileBridge.hasConnection(active) ? active : profileBridge.pairedProfiles()[0]?.name;
+                try {
+                    await profileBridge.sendCommand('ping_probe', { requireClientApproval: true }, { profile });
+                }
+                catch (err) {
+                    return (0, envelopes_1.errorResult)(err instanceof Error ? err.message : 'Chrome client approval is required.');
+                }
+            }
             const result = await dispatchToolCall(d.name, args);
             if (verifiedNow)
                 result.content.unshift({ type: 'text', text: 'Email verified. MCP Browser Extension access is active.' });
             return result;
-        });
+        }));
         registered.push(d.name);
     }
     const advertised = enabledToolNames();

package/dist/src/remote/key.js

@@ -16,6 +16,14 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const KEY_FILE = 'remote-key';
 const KEY_SHAPE = /^[A-Za-z0-9_-]{43}$/;
+function enforcePrivateMode(path) {
+    if (process.platform === 'win32')
+        return;
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    if (((0, node_fs_1.statSync)(path).mode & 0o077) !== 0) {
+        throw new Error(`remote key ${path} is group/other-accessible; refusing to expose the key`);
+    }
+}
 function remoteKeyPath(dataDir) {
     return (0, node_path_1.join)(dataDir, KEY_FILE);
 }
@@ -24,12 +32,14 @@ function resolveRemoteKey(dataDir, opts = {}) {
     const path = remoteKeyPath(dataDir);
     if (!opts.rotate && (0, node_fs_1.existsSync)(path)) {
         const stored = (0, node_fs_1.readFileSync)(path, 'utf8').trim();
-        if (KEY_SHAPE.test(stored))
+        if (KEY_SHAPE.test(stored)) {
+            enforcePrivateMode(path);
             return stored;
+        }
     }
     const key = (0, node_crypto_1.randomBytes)(32).toString('base64url');
     (0, node_fs_1.writeFileSync)(path, `${key}\n`, { mode: 0o600 });
-    (0, node_fs_1.chmodSync)(path, 0o600); // a file that already existed keeps its old mode otherwise
+    enforcePrivateMode(path);
     return key;
 }
 /** Constant-time comparison, so response timing reveals nothing about the key. */

package/dist/src/security/policy.d.ts

@@ -36,6 +36,10 @@ export interface Policy extends WirePolicy {
      *  `AUTH_REQUIRED` when the page it lands on is a high-confidence sign-in
      *  wall, so an expired session is never scored as some other failure. */
     failOnAuthWall?: boolean;
+    /** `--enable-cookie-values`: `get_cookies` returns each cookie's value. Off by
+     *  default, because a session cookie is the login itself: whoever holds it can
+     *  use the account from anywhere, with no password and no browser. */
+    allowCookieValues?: boolean;
 }
 /** The SAFE default: deny everything until the user opts in. */
 export declare const DEFAULT_POLICY: Readonly<Policy>;

package/dist/src/security/policy.js

@@ -45,11 +45,12 @@ exports.DEFAULT_POLICY = Object.freeze({
     redact: false,
     redactPatterns: [],
     failOnAuthWall: false,
+    allowCookieValues: false,
 });
 /** Merge a partial (from a policy file and/or CLI flags) over the safe default. */
 function resolvePolicy(partial) {
     return {
-        allowDomains: partial?.allowDomains ?? [...exports.DEFAULT_POLICY.allowDomains],
+        allowDomains: (partial?.allowDomains ?? exports.DEFAULT_POLICY.allowDomains).map(policy_1.normalizeDomainPattern).filter(Boolean),
         allowEval: partial?.allowEval ?? exports.DEFAULT_POLICY.allowEval,
         allowDownloads: partial?.allowDownloads ?? exports.DEFAULT_POLICY.allowDownloads,
         allowUploads: partial?.allowUploads ?? exports.DEFAULT_POLICY.allowUploads,
@@ -60,6 +61,7 @@ function resolvePolicy(partial) {
         redact: partial?.redact ?? exports.DEFAULT_POLICY.redact,
         redactPatterns: partial?.redactPatterns ?? [...(exports.DEFAULT_POLICY.redactPatterns ?? [])],
         failOnAuthWall: partial?.failOnAuthWall ?? exports.DEFAULT_POLICY.failOnAuthWall,
+        allowCookieValues: partial?.allowCookieValues ?? exports.DEFAULT_POLICY.allowCookieValues,
     };
 }
 /**

package/docs/BLUEPRINT.md

@@ -1,5 +1,10 @@
 # Chrome MCP — Build-Ready Blueprint (v1)
 
+Current client authorization: see [Client approval](CLIENT-APPROVAL.md). The
+extension now requires a separate signed, human-approved session key in addition
+to the transport token. This supersedes descriptions below that treat the
+transport token alone as sufficient authorization.
+
 > An MCP server that lets Claude drive a real Chrome browser. One pluggable
 > `Executor` interface, two backends: an MV3 **extension** (primary, drives the
 > user's real Chrome via `chrome.debugger`/CDP) and a **CDP fallback** (the
@@ -554,7 +559,7 @@ threat** (this tool feeds untrusted page text to an LLM that can call `eval`).
 3. **Origin is NOT a security layer.** Documented as defense-in-depth against *browser-page* attackers only (a web page cannot forge a `chrome-extension://` Origin; a native process can). The token holds independently. We never relax token strength on Origin's account. Never reject a valid-token dev connection solely on Origin mismatch. [RESOLVED — blocker 2, mv3 major Origin]
 4. **No `/connect` HTTP endpoint.** Token bootstrap is the **native-messaging trampoline** reading the 0600 file (the model/attacker can't read it), with a manual file-path-pairing fallback. No race-able network token vendor exists. [RESOLVED — blocker 3]
 5. **Token never logged.** Never on stdout or stderr; only in the 0600 file (mode verified post-write, fail-closed). Any human-readable pairing artifact is also 0600 and short-lived. `policy.test.ts` asserts the token appears on neither stream. `logErr` redacts. [RESOLVED — major 5]
-6. **Default-deny domain policy, ON by default, gating READS too.** `Policy { allowDomains: glob[]; allowEval; allowDownloads; allowAllTabs }`. Absent config → **SAFE DEFAULT**: navigate only to `about:blank` + already-open allowlisted tabs, **eval denied cross-domain, reads (`get_text`/`get_html`/`screenshot`/`eval`) denied outside the allowlist**, downloads off. The shared `evaluatePolicy(url, method, policy)` runs at **both ends** — wrapped server-side as `assertUrlAllowed` in the executor dispatch (both backends), and re-run by the extension router against the policy delivered in `welcome` — before any attach/navigate/eval/read. `--unsafe-all-domains` (= `allowDomains:['*']`) is the loud-logged escape hatch. [RESOLVED — major 4]
+6. **Default-deny domain policy, ON by default, gating READS too.** `Policy { allowDomains: glob[]; allowEval; allowDownloads; allowAllTabs }`. Absent config → **SAFE DEFAULT**: navigate only to `about:blank` + already-open allowlisted tabs, **eval denied cross-domain, reads (`get_text`/`get_html`/`screenshot`/`eval`) denied outside the allowlist**, downloads off. The shared `evaluatePolicy(url, method, policy)` runs at **both ends** — wrapped server-side as `assertUrlAllowed` in the executor dispatch (both backends), and re-run by the extension router against the policy delivered in `welcome` — before any attach/navigate/eval/read. All-site access is unsupported; catch-all entries never grant access and named websites require approval. [RESOLVED — major 4]
 7. **Safe-mode shipped in v1 (not "future").** Default disables `eval` and the entire mutating tool set; `--enable-mutations` / `--unsafe-enable-eval` opt in. `eval`'s effective target origin (the tab's current URL) is allowlist-checked before dispatch. [RESOLVED — major eval]
 8. **Narrowed manifest:** no `<all_urls>`; `host_permissions:[]` + `optional_host_permissions` requested on demand after an explicit user action-click grant before first attach. [RESOLVED — major 4]
 9. **Displacement is a security event:** superseding connects are logged loudly + surfaced in `chrome_status`; the active connection is pinned to the first `hello` ext id and won't be displaced by a different id without re-pair. [RESOLVED — minor 9]

package/docs/CLIENT-APPROVAL.md

@@ -0,0 +1,150 @@
+# Client approval
+
+The extension requires a person to approve each new MCP app session in its Chrome
+popup or Settings before it can read or act on browser pages. This is independent of
+email verification, transport pairing, domain restrictions and client permission
+modes. No command-line flag disables this extension gate.
+
+## Using it
+
+1. Start the app's MCP connection and run `chrome_status`.
+2. Click the extension's toolbar icon to open **App connections** in the popup.
+   The same controls are available in **Settings**.
+3. Compare the key fingerprint with the tool result. The app name is supplied by
+   the requesting app and is not proof of its identity.
+4. Click **Approve for 8 hours**, then retry the tool.
+
+A request expires after ten minutes. Approval lasts eight hours in that Chrome
+profile. Expired access requires a new approval. Each initialized MCP session,
+including each remote HTTP session, receives a new key. Restarting a session
+requires approval again. Several sessions with the same name are separate keys.
+
+App approval does not approve websites. Each website must also be on the allowed
+sites list. A blocked request gives one line of instructions to click Allow next
+to that website in the Chrome popup. All-site access is no longer supported:
+remove `--unsafe-all-domains` from older configurations. Catch-all policy entries
+grant no access, including when sent by an older server.
+
+Allowing a website permits approved apps to read and take actions there, subject
+to configured tool permissions. This includes sending messages, deleting
+information and making purchases. The extension does not ask again for each
+action. Website grants are remembered until removed and apply to all approved
+app sessions; app access still expires after eight hours.
+
+These controls restrict which apps and websites are accessible. They do not
+prevent an approved app from making a mistake or following malicious page
+instructions on an allowed website. Removing access blocks new commands; it
+cannot undo completed actions.
+
+Use **Remove access** to block subsequent commands from one key. An action already
+running may finish. **Approve again for 8 hours** explicitly restores that key. If
+either view reports a storage error, the decision was not saved: resolve the error
+and retry before relying on it across an extension restart.
+
+## Activity and stopping access
+
+The popup shows the latest five activity rows received by the extension. Settings
+shows history from up to 100 requests, filtered by Running, Done, Blocked, Failed
+or Interrupted. Successful opening and closing of the same tab by the same app
+share one row; expand it to see the app, key and times. Browser-session tab IDs
+are stored only to match those actions. Blank tabs display their blank-page address.
+Entries contain a timestamp, command name, website hostname, app-supplied name,
+verified signing-key fingerprint and outcome. Invalid or unsigned identities
+are shown as Unverified app. Health and approval probes are omitted.
+
+This history stays in trusted Chrome session storage and is cleared when Chrome
+closes or the extension reloads. Clear history removes it from both views;
+results from requests already running when cleared do not recreate their entries.
+No request arguments, page contents, screenshots, cookies, typed values, full URLs
+or raw error messages are recorded. Requests refused before reaching Chrome may
+be absent. It is a convenience history, not a complete or tamper-proof audit.
+Interrupted means that a result was withheld or lost; an action may still have
+finished. A successful command does not establish that a website accepted its
+business operation.
+
+**Stop access** immediately invalidates pending command checks, closes the
+extension's bridge connection and saves a durable stop. It revokes all app keys,
+clears activity borders and unregisters observer scripts for future pages.
+Already-injected hooks and commands already executing may finish; Stop cannot
+undo completed actions. Results from old requests are not delivered after Stop
+or to a replacement connection.
+
+The stop survives worker eviction, Chrome/extension restarts, keepalive alarms,
+pairing changes and ordinary Reconnect requests. **Resume connection** is a
+separate trusted click in the popup or Settings. It reconnects using the saved
+pairing; each app must then be approved again. Website permissions and proxy
+settings are preserved. Stop applies to this Chrome profile, not other profiles
+or the local MCP server process.
+
+Failed stop persistence blocks access in the current worker and reports an error;
+retry before relying on the setting across restarts. No CLI flag or ordinary
+page message can resume access or erase this history.
+
+## Enforcement
+
+Each session creates a P-256 key pair in memory. Only the public key travels to
+the bridge and extension. Chrome saves the public key, its SHA-256 fingerprint,
+the supplied app name, decision and expiration. Private keys never enter pairing
+files, extension storage, logs or tool results.
+
+The session signs the method, JSON parameters, target tab, timeout, protocol
+version, app identity, timestamp, random nonce and a challenge generated by the
+extension for that WebSocket connection. Chrome verifies the signature and grant
+before resolving the target tab, then rechecks the grant before execution.
+Commands older than two minutes, invalid signatures and replayed nonces are
+refused. Reconnecting changes the challenge, including after a worker restart.
+
+A hub forwards a peer's original signed request. It never lends its own key to
+an incoming peer. The shared bridge token remains a transport credential; knowing
+it does not provide an approved signing key. Profile renames also require a
+signed approval probe for the exact rename. Peer status no longer broadcasts
+cached page URLs.
+
+The only unsigned command is an empty health probe. It returns a constant response
+without looking up a tab or exposing a URL. Client approval requests carry valid
+signatures; pending requests and replay tracking are bounded. An unavailable
+approval store blocks access. Grant writes must succeed before access is enabled.
+
+Only the exact top-level extension Settings or popup page can send decisions.
+Approval buttons ignore synthetic clicks. Browser commands cannot read or drive
+the extension's own approval pages. Extension local storage is restricted to
+trusted extension contexts.
+
+## Compatibility and limits
+
+Update the MCP server and extension together. The additive `client-approval-v1`
+capability signals support. Updated servers refuse browser commands to older
+extensions; updated extensions refuse unsigned commands from older servers.
+Transport pairing may succeed while browser access remains blocked.
+
+This is session authorization for the extension, not isolation between approved
+apps. Approved apps still share permitted tabs and the existing browser policy.
+Website content access additionally requires a named Chrome host permission.
+The popup's Allow action requests Chrome permission before adding the server
+grant, and Remove revokes the host permission. Server flags, saved app approval
+and YOLO mode cannot supply the Chrome grant. Cookies and downloads also require
+their optional API permission. Debugger and proxy remain required permissions
+because Chrome does not support them as optional; debugger access is checked
+against website permission by the extension, rather than isolated by Chrome.
+The published CLI is extension-only; development CDP executors outside this
+extension do not inherit its approval gate.
+
+It cannot protect against someone who controls the operating system, modifies
+the installed extension or server, steals a live approved private key or an
+approved remote session's credentials, or persuades the
+person to approve the attacker's key. A stolen approved key remains useful until
+revoked or expired. No independent security audit has been completed for this
+change, and it is not a claim that the extension is unhackable.
+
+## Verification
+
+`test/client-approval.test.ts` exercises signatures, tampering, replay,
+independent keys, expiry, revocation, storage errors, sender restrictions and
+concurrent session identity propagation. `test/e2e/client-approval.test.ts` uses
+the real extension in isolated Chromium to verify trusted approval clicks,
+self-approval rejection, popup and Settings synchronization, revocation, shared-token attacks and separate MCP
+sessions when email verification is bypassed. The existing browser suites also
+exercise commands after explicitly approving their test client in Chrome.
+
+For an isolated build that does not overwrite a folder loaded in your main
+Chrome profile, set `MBE_EXTENSION_BUILD_DIR` when building and running E2E tests.

package/extension-dist/activity-dashboard.css

@@ -0,0 +1,43 @@
+.access-controls { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 10px; }
+.access-controls button { margin: 0; min-height: 34px; }
+#access-stop { color: #b91c1c; border: 1px solid #fca5a5; background: transparent; }
+#access-stop:hover { background: #fef2f2; }
+#access-note, #activity-note { font-size: 12px; line-height: 1.5; }
+#access-note[data-error="true"], #activity-note[data-error="true"] { color: #b91c1c; }
+.activity-list { list-style: none; margin: 8px 0; padding: 0; }
+body:not([data-view="popup"]) .activity-list {
+  max-height: 24rem;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  padding-inline-end: 8px;
+  scrollbar-color: var(--site-primary, #2563eb) #f3f4f6;
+  scrollbar-width: thin;
+}
+body:not([data-view="popup"]) .activity-list:focus-visible { outline: 2px solid var(--site-ring, #2563eb); outline-offset: 2px; }
+.activity-item { border-bottom: 1px solid var(--line, #e6e8ec); overflow-wrap: anywhere; font-size: 12px; }
+.activity-item:last-child { border-bottom: 0; }
+.activity-row { display: flex; align-items: center; gap: 8px; min-width: 0; padding: 10px 0; cursor: pointer; list-style: none; }
+.activity-row::-webkit-details-marker { display: none; }
+.activity-row::before { content: ''; width: 5px; height: 5px; flex: none; border-right: 1px solid currentColor; border-bottom: 1px solid currentColor; transform: rotate(-45deg); }
+details[open] > .activity-row::before { transform: rotate(45deg); }
+.activity-host { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-weight: 600; }
+.activity-label { max-width: 48%; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.activity-outcome { flex: none; color: var(--muted, #555); font-size: 11px; }
+[data-outcome="blocked"] .activity-outcome, [data-outcome="failed"] .activity-outcome { color: var(--warn, #9a3412); }
+.activity-meta { display: flex; flex-wrap: wrap; gap: 4px 12px; padding: 0 0 10px 13px; color: var(--muted, #555); font-size: 11px; }
+.activity-meta span { flex: 1; min-width: 0; }
+.activity-meta .activity-opened { flex-basis: 100%; }
+.activity-meta time { white-space: nowrap; }
+.activity-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.activity-actions button { margin: 0; }
+.activity-help { margin-top: 10px; font-size: 12px; color: var(--muted, #555); }
+.activity-help summary { cursor: pointer; }
+.activity-help p { margin: 6px 0; }
+#activity-filter { max-width: 100%; }
+#activity-section button:focus-visible, .access-controls button:focus-visible, #activity-filter:focus-visible, .activity-help summary:focus-visible, .activity-row:focus-visible { outline: 2px solid var(--accent, #2563eb); outline-offset: 2px; }
+[hidden] { display: none !important; }
+@media (prefers-color-scheme: dark) {
+  body[data-view="popup"] #access-stop { color: #fca5a5; border-color: #7f1d1d; }
+  body[data-view="popup"] #access-stop:hover { background: #450a0a; }
+  body[data-view="popup"] #access-note[data-error="true"], body[data-view="popup"] #activity-note[data-error="true"] { color: #fca5a5; }
+}