mcp-browser-extension 0.9.31 → 0.9.32

package/dist/src/access-browser.js

@@ -22,27 +22,70 @@ function openBrowserEmailPrompt(url) {
     catch { /* Keep the form available even if the operating system cannot open it. */ }
 }
 const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+// Native form submission still works without JavaScript. This only provides
+// immediate feedback; the server also deduplicates concurrent submissions.
+const FORM_SCRIPT = `
+const form = document.querySelector('form');
+if (form) {
+  const button = form.querySelector('button');
+  const email = form.querySelector('[name="email"]');
+  const status = document.getElementById('verification-status');
+  const originalStatus = status.textContent;
+  let sending = false;
+  form.addEventListener('submit', (event) => {
+    if (sending) { event.preventDefault(); return; }
+    sending = true;
+    button.disabled = true;
+    button.textContent = 'Sending…';
+    email.readOnly = true;
+    form.setAttribute('aria-busy', 'true');
+    status.textContent = 'Sending your sign-in link…';
+  });
+  window.addEventListener('pageshow', () => {
+    sending = false;
+    button.disabled = false;
+    button.textContent = 'Send verification link';
+    email.readOnly = false;
+    form.removeAttribute('aria-busy');
+    status.textContent = originalStatus;
+  });
+}
+`;
+const FORM_SCRIPT_HASH = (0, node_crypto_1.createHash)('sha256').update(FORM_SCRIPT).digest('base64');
 function page(path, csrf, message, sent) {
     return `<!doctype html><html lang="en"><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Verify your email | MCP Browser Extension</title>
 <style>
-  :root{color-scheme:light dark;font-family:system-ui,sans-serif}
-  body{max-width:440px;margin:12vh auto;padding:24px;line-height:1.5}
-  h1{font-size:28px;line-height:1.2} label{display:block;font-weight:600}
-  input,button{box-sizing:border-box;width:100%;font:inherit;padding:12px;margin-top:8px;border:1px solid #888;border-radius:6px}
-  button{margin-top:18px;background:#175cd3;color:white;border-color:#175cd3;cursor:pointer}
-  p{margin:20px 0} .brand{font-size:14px} small{display:block;margin-top:18px}
+  /* Match the extension popup's existing light/dark theme. */
+  :root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif;
+    --bg:#ffffff;--panel:#f6f7f9;--fg:#0f172a;--muted:#64748b;--line:#e6e8ec;
+    --accent:oklch(0.58 0.19 255);--accent-foreground:oklch(0.99 0 0);--ring:oklch(0.58 0.19 255 / 35%)}
+  @media(prefers-color-scheme:dark){:root{--bg:#0b0d12;--panel:#11141b;--fg:#e8ebf2;--muted:#8b93a7;--line:#232836;
+    --accent:oklch(0.7 0.16 255);--accent-foreground:oklch(0.12 0.02 255);--ring:oklch(0.7 0.16 255 / 45%)}}
+  *{box-sizing:border-box}
+  body{max-width:488px;margin:12vh auto;padding:24px;background:var(--bg);color:var(--fg);line-height:1.5;-webkit-font-smoothing:antialiased}
+  h1{font-size:28px;line-height:1.2;font-weight:500;letter-spacing:-0.025em}
+  label{display:block;font-weight:500}
+  input,button{width:100%;font:inherit;padding:12px;margin-top:8px;border:1px solid var(--line);border-radius:9px}
+  input{background:var(--panel);color:var(--fg)}
+  input:focus-visible,button:focus-visible{outline:2px solid var(--accent);outline-offset:3px;box-shadow:0 0 0 4px var(--ring)}
+  button{margin-top:18px;background:var(--accent);color:var(--accent-foreground);border-color:transparent;font-weight:500;cursor:pointer}
+  button:hover:not(:disabled){background:color-mix(in oklch,var(--accent) 88%,var(--fg))}
+  button:disabled{cursor:wait}
+  p{margin:20px 0;color:var(--muted)} .brand{font-size:14px;color:var(--fg)}
+  small{display:block;margin-top:18px;color:var(--muted)}
 </style>
 <body><p class="brand">MCP Browser Extension</p><h1>${sent ? 'Check your inbox' : 'Verify your email'}</h1>
-<p role="status">${escapeHtml(message)}</p>
+<p id="verification-status" role="status">${escapeHtml(message)}</p>
 ${sent ? '<p>After opening the sign-in link, return to your assistant to continue.</p>' : `
 <form method="post" action="${path}">
   <input type="hidden" name="csrf" value="${csrf}">
   <label for="email">Email address</label>
   <input id="email" name="email" type="email" autocomplete="email" maxlength="254" required autofocus>
   <button type="submit">Send verification link</button>
-</form><small>Your email is sent to mcp-browser-extension.com to verify and manage access.</small>`}
+</form><small>Your email is sent to mcp-browser-extension.com to verify and manage access.</small>
+<script>${FORM_SCRIPT}</script>`}
 </body></html>`;
 }
 /** Only the person submitting this form can start an email. GET never sends one. */
@@ -51,7 +94,7 @@ async function createBrowserEmailPrompt(submit, options = {}) {
     const csrf = (0, node_crypto_1.randomBytes)(32).toString('hex');
     let origin = '';
     let sent = false;
-    let busy = false;
+    let sending;
     let closed = false;
     let expiry;
     const sentMessage = 'A sign-in link has been sent. Open it from your email and click Verify this device to finish verification.';
@@ -64,7 +107,7 @@ async function createBrowserEmailPrompt(submit, options = {}) {
             'referrer-policy': 'same-origin',
             'x-content-type-options': 'nosniff',
             'x-frame-options': 'DENY',
-            'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+            'content-security-policy': `default-src 'none'; script-src 'sha256-${FORM_SCRIPT_HASH}'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
         });
         res.end(page(path, csrf, message, sent));
     };
@@ -77,7 +120,10 @@ async function createBrowserEmailPrompt(submit, options = {}) {
                 return;
             }
             if (req.method === 'GET') {
-                respond(res, 200, sent ? sentMessage : 'Enter your email below. We will send you a one-time sign-in link.');
+                // A reload during delivery must wait for the same result instead of
+                // restoring an email-entry form that is already being submitted.
+                const outcome = sending ? await sending : undefined;
+                respond(res, 200, sent ? sentMessage : outcome?.message ?? 'Enter your email below. We will send you a one-time sign-in link.');
                 return;
             }
             if (req.method !== 'POST') {
@@ -111,19 +157,16 @@ async function createBrowserEmailPrompt(submit, options = {}) {
                 respond(res, 200, sentMessage);
                 return;
             }
-            if (busy) {
-                respond(res, 409, 'Your request is already being sent. Please wait.');
-                return;
-            }
-            busy = true;
-            try {
-                const outcome = await submit(fields.get('email') ?? '');
-                sent = outcome.ok;
-                respond(res, outcome.ok ? 200 : 400, outcome.ok ? sentMessage : outcome.message);
-            }
-            finally {
-                busy = false;
+            if (!sending) {
+                // A repeated click replaces the browser's pending navigation. Share
+                // its result so the latest page shows the outcome of the one email.
+                sending = Promise.resolve()
+                    .then(() => submit(fields.get('email') ?? ''))
+                    .then((outcome) => { sent = outcome.ok; return outcome; })
+                    .finally(() => { sending = undefined; });
             }
+            const outcome = await sending;
+            respond(res, outcome.ok ? 200 : 400, outcome.ok ? sentMessage : outcome.message);
         })().catch(() => { if (!res.headersSent)
             respond(res, 503, 'The verification service could not be reached. Please try again.'); });
     });

package/dist/src/access.js

@@ -190,7 +190,8 @@ const inputRequired = (url) => ({
     message: '[ACCESS_INPUT_REQUIRED] Complete email verification in the browser form. It opens automatically when the client does not display its email prompt. ' +
         `If no form appeared, open this local page on the computer running MCP Browser Extension:\n${url}\n` +
         'Enter your email there, open the sign-in link from your inbox, and click Verify this device. This page expires in 10 minutes. ' +
-        'Show this link to the user; do not fill the form or open their email for them. After they submit their email, call chrome_status to wait for verification. Access remains blocked until verification succeeds.',
+        'Show this link only as a backup. Do not open it again or ask for the email in chat while this form is active. ' +
+        'Do not fill the form or open their email for them. After they submit their email, call chrome_status to wait for verification. Access remains blocked until verification succeeds.',
 });
 function startEmail(server, dataDir, state, input) {
     const existing = pendingEmailStarts.get(dataDir);

package/dist/src/bridge/client-identity.d.ts

@@ -0,0 +1,10 @@
+import { type ClientProof } from '../../shared/client-auth';
+import type { CommandFrame } from '../../shared/protocol';
+/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
+export declare function createClientIdentity(name: () => string): {
+    id: string;
+    sign(cmd: Pick<CommandFrame, "v" | "method" | "params" | "tabId" | "timeoutMs">, challenge: string): ClientProof;
+};
+export type ClientIdentity = ReturnType<typeof createClientIdentity>;
+export declare const withClientIdentity: <T>(identity: ClientIdentity, fn: () => T) => T;
+export declare const currentClientIdentity: () => ClientIdentity | undefined;

package/dist/src/bridge/client-identity.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentClientIdentity = exports.withClientIdentity = void 0;
+exports.createClientIdentity = createClientIdentity;
+const node_async_hooks_1 = require("node:async_hooks");
+const node_crypto_1 = require("node:crypto");
+const client_auth_1 = require("../../shared/client-auth");
+/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
+function createClientIdentity(name) {
+    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ec', { namedCurve: 'prime256v1' });
+    const der = publicKey.export({ type: 'spki', format: 'der' });
+    const encoded = der.toString('base64');
+    return {
+        id: (0, node_crypto_1.createHash)('sha256').update(der).digest('hex'),
+        sign(cmd, challenge) {
+            const proof = { publicKey: encoded, name: (0, client_auth_1.clientName)(name()), challenge, issuedAt: Date.now(), nonce: (0, node_crypto_1.randomUUID)() };
+            return { ...proof, signature: (0, node_crypto_1.sign)('sha256', Buffer.from((0, client_auth_1.clientSigningPayload)(cmd, proof)), {
+                    key: privateKey, dsaEncoding: 'ieee-p1363',
+                }).toString('base64') };
+        },
+    };
+}
+const current = new node_async_hooks_1.AsyncLocalStorage();
+const withClientIdentity = (identity, fn) => current.run(identity, fn);
+exports.withClientIdentity = withClientIdentity;
+const currentClientIdentity = () => current.getStore();
+exports.currentClientIdentity = currentClientIdentity;
+//# sourceMappingURL=client-identity.js.map

package/dist/src/bridge/connection.d.ts

@@ -1,3 +1,4 @@
+import type { ClientProof } from '../../shared/client-auth';
 /**
  * src/bridge/connection.ts — one authenticated extension connection.
  *
@@ -13,10 +14,12 @@
 import type { WebSocket } from 'ws';
 import { type ServerFrame, type WireEvent, type WireMethod } from '../../shared/protocol';
 import { type ExecutorErrorCodeLocal } from '../executor/types';
+export declare function defaultTimeoutFor(method: WireMethod): number;
 /** Map a wire error code onto a local ExecutorError code (the wire enum is a
  *  near-superset; unknown codes degrade to CDP_ERROR while keeping the message). */
 export declare function mapWireErrorCode(code: string): ExecutorErrorCodeLocal;
 export interface ConnectionDeps {
+    approvalChallenge?: string;
     ws: WebSocket;
     extId: string;
     sessionId: string;
@@ -30,6 +33,7 @@ export interface ConnectionDeps {
     onLog?: (message: string) => void;
 }
 export declare class ExtensionConnection {
+    readonly approvalChallenge?: string;
     readonly extId: string;
     readonly sessionId: string;
     private readonly ws;
@@ -57,6 +61,7 @@ export declare class ExtensionConnection {
     sendCommand(method: WireMethod, params: Record<string, unknown>, opts?: {
         tabId?: string;
         timeoutMs?: number;
+        authorization?: ClientProof;
     }): Promise<unknown>;
     close(code: number, reason?: string): void;
     /** Push an unsolicited frame (a policy change, a blocked-site notice). Best-effort. */

package/dist/src/bridge/connection.js

@@ -1,18 +1,7 @@
 "use strict";
-/**
- * src/bridge/connection.ts — one authenticated extension connection.
- *
- * Owns the pending-request table: each `sendCommand` mints an id, sends a
- * CommandFrame, and parks a {resolve,reject,timer} until the matching
- * result/error frame arrives. Guarantees:
- *   - method-aware per-request timeout that rejects the ONE call (never closes
- *     the socket),
- *   - reject-ALL-pending with EXTENSION_DISCONNECTED on close,
- *   - backpressure rejection (screenshots are large; never queue unboundedly),
- *   - app-level ping/pong heartbeat (optional; disabled when heartbeatMs<=0).
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExtensionConnection = void 0;
+exports.defaultTimeoutFor = defaultTimeoutFor;
 exports.mapWireErrorCode = mapWireErrorCode;
 const protocol_1 = require("../../shared/protocol");
 const types_1 = require("../executor/types");
@@ -42,6 +31,7 @@ const ACTIVE_TAB_CHANGERS = new Set(['tab_select', 'tab_new', 'tab_close']);
 /** Bound on the per-tab URL cache; entries beyond it are evicted oldest-first. */
 const MAX_TAB_URL_ENTRIES = 256;
 class ExtensionConnection {
+    approvalChallenge;
     extId;
     sessionId;
     ws;
@@ -66,6 +56,7 @@ class ExtensionConnection {
     onLog;
     constructor(deps) {
         this.ws = deps.ws;
+        this.approvalChallenge = deps.approvalChallenge;
         this.extId = deps.extId;
         this.sessionId = deps.sessionId;
         this.caps = new Set(deps.caps ?? []);
@@ -103,6 +94,7 @@ class ExtensionConnection {
             params,
             tabId: opts?.tabId,
             timeoutMs,
+            authorization: opts?.authorization,
         };
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {

package/dist/src/bridge/peer.d.ts

@@ -1,21 +1,4 @@
-/**
- * src/bridge/peer.ts — let several mcp-browser-extension servers share one Chrome.
- *
- * Every MCP host session (each Claude terminal/tab) spawns its own mcp-browser-extension,
- * but a browser's extension dials exactly one port. So the first server to bind
- * the port is the HUB: it owns the extension connections. A later server that
- * finds the port held by a live mcp-browser-extension joins it as a PEER over the same
- * port and relays its commands through the hub, instead of killing it. If the
- * hub exits, its peers race to bind the port; the winner becomes the new hub
- * (with the same token, so the extension re-pairs on its own) and the rest join
- * it.
- *
- * Peers authenticate with the same token the extension uses — the handshake
- * file is 0600, so only the same OS user can read it — and speak a small
- * server-to-server protocol that the extension never sees:
- *   peer → hub:  peer_hello, relay (a wire command), peer_rename, peer_blocked
- *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant
- */
+import type { ClientProof } from '../../shared/client-auth';
 import { PROTOCOL_VERSION, type WireMethod } from '../../shared/protocol';
 import type { PairedProfile } from './server';
 /** How long a joining server waits for the hub's welcome before giving up. */
@@ -35,9 +18,11 @@ export interface RelayFrame {
         tabId?: string;
         timeoutMs?: number;
         profile?: string;
+        authorization?: ClientProof;
     };
 }
 export interface PeerRenameFrame {
+    authorization?: ClientProof;
     type: 'peer_rename';
     id: string;
     from: string;
@@ -99,7 +84,7 @@ export declare class HubLink {
     static join(host: string, port: number, token: string, onClose: () => void, onGrant?: (host: string, allow: boolean) => void): Promise<HubLink | null>;
     isOpen(): boolean;
     relay(method: WireMethod, params: Record<string, unknown>, opts?: RelayFrame['opts']): Promise<unknown>;
-    rename(from: string, to: string): Promise<unknown>;
+    rename(from: string, to: string, authorization: ClientProof): Promise<unknown>;
     /** Tell the hub our gate refused `host`, so it can offer the person an Allow. */
     blocked(host: string, method: string): void;
     close(): void;

package/dist/src/bridge/peer.js

@@ -1,4 +1,7 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubLink = exports.JOIN_TIMEOUT_MS = void 0;
+exports.relayError = relayError;
 /**
  * src/bridge/peer.ts — let several mcp-browser-extension servers share one Chrome.
  *
@@ -17,9 +20,6 @@
  *   peer → hub:  peer_hello, relay (a wire command), peer_rename, peer_blocked
  *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HubLink = exports.JOIN_TIMEOUT_MS = void 0;
-exports.relayError = relayError;
 const ws_1 = require("ws");
 const protocol_1 = require("../../shared/protocol");
 const types_1 = require("../executor/types");
@@ -70,6 +70,7 @@ class HubLink {
     static join(host, port, token, onClose, onGrant) {
         return new Promise((resolve) => {
             let settled = false;
+            let joined = null;
             const ws = new ws_1.WebSocket(`ws://${host}:${port}`);
             const done = (link) => {
                 if (settled)
@@ -97,9 +98,17 @@ class HubLink {
                 catch {
                     return done(null);
                 }
-                if (frame.type !== 'peer_welcome')
-                    return done(null); // 'unauthorized' or anything else
-                done(new HubLink(ws, typeof frame.hubPid === 'number' ? frame.hubPid : 0, onClose, onGrant));
+                if (!joined && frame.type === 'peer_welcome') {
+                    joined = new HubLink(ws, typeof frame.hubPid === 'number' ? frame.hubPid : 0, onClose, onGrant);
+                    return;
+                }
+                if (joined && frame.type === 'peer_state' && Array.isArray(frame.profiles)) {
+                    // The first command needs the extension's signing challenge. Do not
+                    // report a successful join before the initial browser state arrives.
+                    joined.profiles = frame.profiles;
+                    return done(joined);
+                }
+                done(null); // unauthorized or an incomplete/incompatible handshake
             };
             ws.on('message', onFirst);
             ws.once('open', () => {
@@ -117,8 +126,8 @@ class HubLink {
         const timeoutMs = (opts?.timeoutMs ?? RELAY_DEFAULT_TIMEOUT_MS - RELAY_GRACE_MS) + RELAY_GRACE_MS;
         return this.request({ type: 'relay', id: '', method, params, ...(opts ? { opts } : {}) }, timeoutMs);
     }
-    rename(from, to) {
-        return this.request({ type: 'peer_rename', id: '', from, to }, exports.JOIN_TIMEOUT_MS * 2);
+    rename(from, to, authorization) {
+        return this.request({ type: 'peer_rename', id: '', from, to, authorization }, exports.JOIN_TIMEOUT_MS * 2);
     }
     /** Tell the hub our gate refused `host`, so it can offer the person an Allow. */
     blocked(host, method) {

package/dist/src/bridge/server.d.ts

@@ -1,18 +1,3 @@
-/**
- * src/bridge/server.ts — the localhost WebSocket bridge.
- *
- * The server is the WS SERVER; the extension dials in as the single privileged
- * CLIENT. The token is the ONLY trust boundary (the loopback bind is merely
- * defense-in-depth; Origin is NOT a gate). Flow:
- *   1. Accept any loopback upgrade.
- *   2. Require a valid `hello` (matching version + token) within HELLO_TIMEOUT;
- *      otherwise send `unauthorized` and close 4401.
- *   3. On success, send `welcome` and file the connection under its profile
- *      (superseding only that profile's prior one — a security-relevant
- *      displacement event).
- * Other mcp-browser-extension servers (one per Claude session) may join the same port as
- * peers with `peer_hello` and relay their commands through us; see ./peer.
- */
 import { type WireEvent, type WireMethod, type WirePolicy } from '../../shared/protocol';
 /** Where a person gets the extension. */
 export declare const WEB_STORE_URL: "https://chromewebstore.google.com/detail/mcp-browser-extension/jelfhdlkhbfmlpbghoeaepijllcnplgh";
@@ -29,6 +14,8 @@ export type PairState = 'ok' | 'profile_mismatch' | 'token_mismatch' | 'version_
 export type ProfileNaming = 'options' | 'auto' | 'legacy';
 /** One paired browser, as reported by chrome_status. */
 export interface PairedProfile {
+    /** Public, extension-generated replay scope; not a credential. */
+    approvalChallenge?: string;
     name: string;
     /** options = typed in the extension's Options; auto = assigned by the server
      *  (renamable with profile_rename); legacy = an older extension, "default". */
@@ -86,6 +73,7 @@ export interface BridgeOptions {
 export type BridgeRole = 'hub' | 'peer';
 export declare class BridgeServer {
     private readonly opts;
+    private readonly clientIdentity;
     private wss;
     /** Profile routing key → its live connection. Multiple browsers stay paired at
      *  once; a command is routed to the connection for its target profile. A new
@@ -167,6 +155,8 @@ export declare class BridgeServer {
         timeoutMs?: number;
         profile?: string;
     }): Promise<unknown>;
+    /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
+    private forwardCommand;
     /** Whether the browser paired as `profile` advertised capability `cap`. A peer
      *  cannot see the hub's handshake, so it answers false (the conservative path). */
     hasCap(profile: string | undefined, cap: string): boolean;
@@ -201,13 +191,14 @@ export declare class BridgeServer {
     /** How to pair a browser for `profile` — surfaced whenever that profile has no live connection. */
     noPairMessage(profile: string): string;
     /** Every paired browser with how it was named — for chrome_status. */
-    pairedProfiles(): PairedProfile[];
+    pairedProfiles(includeChallenge?: boolean): PairedProfile[];
     /**
      * Rename an automatically named browser. The new name sticks across restarts
      * (it's stored against the extension install); a live connection is re-keyed
      * in place, so it keeps working without re-pairing.
      */
     renameProfile(from: string, to: string): Promise<string>;
+    private renameApprovedProfile;
     status(): {
         extensionConnected: boolean;
         port: number;

package/dist/src/bridge/server.js

@@ -1,10 +1,14 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BridgeServer = exports.WEB_STORE_URL = void 0;
+const client_auth_1 = require("../../shared/client-auth");
+const client_identity_1 = require("./client-identity");
 /**
  * src/bridge/server.ts — the localhost WebSocket bridge.
  *
  * The server is the WS SERVER; the extension dials in as the single privileged
- * CLIENT. The token is the ONLY trust boundary (the loopback bind is merely
- * defense-in-depth; Origin is NOT a gate). Flow:
+ * CLIENT. The token authenticates this transport; the extension separately
+ * verifies each command against its approved client keys. Flow:
  *   1. Accept any loopback upgrade.
  *   2. Require a valid `hello` (matching version + token) within HELLO_TIMEOUT;
  *      otherwise send `unauthorized` and close 4401.
@@ -14,8 +18,6 @@
  * Other mcp-browser-extension servers (one per Claude session) may join the same port as
  * peers with `peer_hello` and relay their commands through us; see ./peer.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BridgeServer = exports.WEB_STORE_URL = void 0;
 const ws_1 = require("ws");
 const node_crypto_1 = require("node:crypto");
 const protocol_1 = require("../../shared/protocol");
@@ -75,6 +77,12 @@ const MAX_PREAUTH_FRAMES = 10;
 const PORT_WAIT_MS = 4_000;
 /** Pause between port-bind retries while waiting for the old listener to exit. */
 const PORT_RETRY_MS = 250;
+/** Bridge frames are small JSON control messages; cap unauthenticated memory use. */
+const MAX_BRIDGE_FRAME_BYTES = 4 * 1024 * 1024;
+/** Native clients omit Origin; Chrome extensions use their own isolated origin. */
+function allowBridgeOrigin(origin) {
+    return origin === undefined || /^chrome-extension:\/\/[a-p]{32}$/.test(origin);
+}
 const delay = (ms) => new Promise((r) => setTimeout(r, ms));
 /** A friendly, actionable message for the rare case the port stays busy past PORT_WAIT_MS. */
 function portBusyMessage(host, port) {
@@ -88,6 +96,7 @@ function portBusyMessage(host, port) {
 }
 class BridgeServer {
     opts;
+    clientIdentity = (0, client_identity_1.createClientIdentity)(() => 'Local browser client');
     wss = null;
     /** Profile routing key → its live connection. Multiple browsers stay paired at
      *  once; a command is routed to the connection for its target profile. A new
@@ -295,7 +304,13 @@ class BridgeServer {
     /** One bind attempt. Resolves with a listening server or rejects with the listen error. */
     listenOnce(host, port) {
         return new Promise((resolve, reject) => {
-            const wss = new ws_1.WebSocketServer({ host, port });
+            const wss = new ws_1.WebSocketServer({
+                host,
+                port,
+                maxPayload: MAX_BRIDGE_FRAME_BYTES,
+                perMessageDeflate: false,
+                verifyClient: ({ origin }) => allowBridgeOrigin(origin || undefined),
+            });
             const onError = (err) => {
                 wss.off('listening', onListening);
                 // Close so the failed server doesn't linger and leak a handle on retry.
@@ -365,12 +380,33 @@ class BridgeServer {
      * Rejects with an actionable message if that profile has no live browser.
      */
     async sendCommand(method, params, opts) {
+        const profile = routeKey(opts?.profile);
+        const timeoutMs = opts?.timeoutMs ?? (0, connection_1.defaultTimeoutFor)(method);
+        const intent = { v: protocol_1.PROTOCOL_VERSION, method, params, tabId: opts?.tabId, timeoutMs };
+        const challenge = this.hub
+            ? this.hub.profiles.find((p) => p.name === profile)?.approvalChallenge
+            : this.conns.get(profile)?.approvalChallenge;
+        let authorization;
+        if (!(0, client_auth_1.isHealthProbe)(intent)) {
+            if (!this.hasConnection(profile))
+                throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
+            if (!challenge)
+                throw new types_1.ExecutorError('POLICY_DENIED', 'Update the extension and MCP server together: this browser cannot enforce client approval yet.');
+            authorization = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, challenge);
+        }
+        const options = { ...opts, timeoutMs, authorization };
         if (this.hub)
-            return this.hub.relay(method, params, opts);
+            return this.hub.relay(method, params, options);
+        return this.forwardCommand(method, params, options);
+    }
+    /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
+    async forwardCommand(method, params, opts) {
         const profile = routeKey(opts?.profile);
         const conn = this.conns.get(profile);
-        if (!conn || !conn.isOpen()) {
+        if (!conn?.isOpen())
             throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
+        if (!(0, client_auth_1.isHealthProbe)({ method, params }) && (!conn.hasCap(client_auth_1.CLIENT_APPROVAL_CAP) || !opts?.authorization)) {
+            throw new types_1.ExecutorError('POLICY_DENIED', 'Signed client authorization and an updated extension are required.');
         }
         return conn.sendCommand(method, params, opts);
     }
@@ -478,19 +514,18 @@ class BridgeServer {
         return steps.length > 0 ? `${head} ${steps.join(' ')}` : head;
     }
     /** Every paired browser with how it was named — for chrome_status. */
-    pairedProfiles() {
+    pairedProfiles(includeChallenge = false) {
         if (this.hub)
-            return [...this.hub.profiles];
+            return this.hub.profiles.map(({ approvalChallenge, ...p }) => includeChallenge ? { ...p, approvalChallenge } : p);
         const out = [];
         for (const [name, conn] of this.conns) {
             if (!conn.isOpen())
                 continue;
-            const activeUrl = conn.lastActiveUrl(Number.POSITIVE_INFINITY) ?? undefined;
             const o = this.origins.get(name);
             out.push({
                 name,
                 naming: o?.naming ?? 'legacy',
-                ...(activeUrl ? { activeUrl } : {}),
+                ...(includeChallenge && conn.approvalChallenge ? { approvalChallenge: conn.approvalChallenge } : {}),
                 ...(o?.extVersion ? { extVersion: o.extVersion } : {}),
                 ...(o?.extId || o?.install ? { extSource: extensionSource(o) } : {}),
             });
@@ -503,8 +538,18 @@ class BridgeServer {
      * in place, so it keeps working without re-pairing.
      */
     async renameProfile(from, to) {
-        if (this.hub)
-            return String(await this.hub.rename(from, to));
+        if (this.hub) {
+            const challenge = this.hub.profiles.find((p) => p.name === routeKey(from))?.approvalChallenge;
+            if (!challenge)
+                throw new types_1.ExecutorError('POLICY_DENIED', 'Connect an updated browser before renaming it.');
+            const intent = { v: protocol_1.PROTOCOL_VERSION, method: 'ping_probe', params: { requireClientApproval: true, renameProfile: { from, to } }, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe') };
+            const authorization = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, challenge);
+            return String(await this.hub.rename(from, to, authorization));
+        }
+        await this.sendCommand('ping_probe', { requireClientApproval: true, renameProfile: { from, to } }, { profile: from });
+        return this.renameApprovedProfile(from, to);
+    }
+    async renameApprovedProfile(from, to) {
         const src = routeKey(from);
         const live = this.conns.get(src);
         if (live?.isOpen() && this.origins.get(src)?.naming === 'options') {
@@ -600,6 +645,7 @@ class BridgeServer {
             this.promote(ws, frame.ext ?? { id: 'unknown', version: '0', chrome: '0' }, profile, Array.isArray(frame.caps) ? frame.caps : undefined, {
                 naming,
                 installId,
+                approvalChallenge: typeof frame.approvalChallenge === 'string' && /^[a-f0-9-]{36}$/.test(frame.approvalChallenge) ? frame.approvalChallenge : undefined,
                 ...(typeof frame.ext?.version === 'string' ? { extVersion: frame.ext.version.slice(0, 32) } : {}),
                 ...(typeof frame.ext?.id === 'string' ? { extId: frame.ext.id.slice(0, 64) } : {}),
                 ...(typeof frame.install === 'string' ? { install: frame.install.slice(0, 32) } : {}),
@@ -634,7 +680,7 @@ class BridgeServer {
         this.peers.add(ws);
         this.log(`mcp-browser-extension pid ${pid ?? '?'} joined as a peer (${this.peers.size} sharing these browsers)`);
         this.sendPeer(ws, { type: 'peer_welcome', hubPid: process.pid });
-        this.sendPeer(ws, { type: 'peer_state', profiles: this.pairedProfiles() });
+        this.sendPeer(ws, { type: 'peer_state', profiles: this.pairedProfiles(true) });
         ws.on('message', (raw) => this.handlePeerFrame(ws, raw.toString()));
         ws.on('close', () => this.peers.delete(ws));
         ws.on('error', () => {
@@ -653,9 +699,9 @@ class BridgeServer {
             work.then((data) => this.sendPeer(ws, { type: 'relay_result', id, ok: true, data }), (err) => this.sendPeer(ws, (0, peer_1.relayError)(id, err)));
         };
         if (frame.type === 'relay')
-            answer(frame.id, this.sendCommand(frame.method, frame.params ?? {}, frame.opts));
+            answer(frame.id, this.forwardCommand(frame.method, frame.params ?? {}, frame.opts));
         else if (frame.type === 'peer_rename')
-            answer(frame.id, this.renameProfile(frame.from, frame.to));
+            answer(frame.id, this.forwardCommand('ping_probe', { requireClientApproval: true, renameProfile: { from: frame.from, to: frame.to } }, { profile: frame.from, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe'), authorization: frame.authorization }).then(() => this.renameApprovedProfile(frame.from, frame.to)));
         else if (frame.type === 'peer_blocked' && typeof frame.host === 'string')
             this.noteBlocked(frame.host, String(frame.method ?? ''));
     }
@@ -663,7 +709,7 @@ class BridgeServer {
     broadcastState() {
         if (this.peers.size === 0)
             return;
-        const state = { type: 'peer_state', profiles: this.pairedProfiles() };
+        const state = { type: 'peer_state', profiles: this.pairedProfiles(true) };
         for (const peer of this.peers)
             this.sendPeer(peer, state);
     }
@@ -709,6 +755,7 @@ class BridgeServer {
             sessionId,
             heartbeatMs: this.heartbeatMs,
             caps,
+            approvalChallenge: origin.approvalChallenge,
             onEvent: this.opts.onEvent,
             onSiteGrant: (host, allow) => this.applySiteGrant(host, allow),
             onLog: (m) => this.log(m),

package/dist/src/bridge/site-grants.d.ts

@@ -12,8 +12,7 @@
  *
  * Grants only ever ADD to the flags' list, and only grants can be removed again:
  * a site that came from `--allow-domain` stays until the flags change. A grant
- * is always one concrete host (or `*.host`), never the `*` catch-all — allowing
- * every site stays a deliberate flag (`--unsafe-all-domains`).
+ * is always one concrete host (or `*.host`), never an all-site catch-all.
  */
 export declare const GRANTS_FILE = "allowed-sites.json";
 /**

package/dist/src/bridge/site-grants.js

@@ -13,8 +13,7 @@
  *
  * Grants only ever ADD to the flags' list, and only grants can be removed again:
  * a site that came from `--allow-domain` stays until the flags change. A grant
- * is always one concrete host (or `*.host`), never the `*` catch-all — allowing
- * every site stays a deliberate flag (`--unsafe-all-domains`).
+ * is always one concrete host (or `*.host`), never an all-site catch-all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SiteGrants = exports.GRANTS_FILE = void 0;
@@ -59,7 +58,9 @@ class SiteGrants {
     constructor(allowDomains, dataDir) {
         this.allowDomains = allowDomains;
         this.dataDir = dataDir;
-        this.base = new Set(allowDomains.map((d) => d.toLowerCase()));
+        const namedSites = allowDomains.map(policy_1.normalizeDomainPattern).filter(Boolean);
+        allowDomains.splice(0, allowDomains.length, ...namedSites);
+        this.base = new Set(namedSites);
         for (const site of this.load())
             this.add(site);
     }