mcp-browser-extension 0.9.31 → 0.9.33

package/README.md

@@ -63,6 +63,12 @@ for one), so the question is what you get on top of the session:
   keys and JWTs out of page reads.
 - **An audit trail**: every call is logged with the URL, the allow/deny
   verdict, duration and bytes returned.
+- **Recent activity in Chrome**: the popup shows the latest five activity rows (a tab's open/close pair shares one row);
+  Settings shows up to 100 with outcome filters. This session history contains
+  website names and app keys, without page text, entered values or full URLs.
+- **Stop access**: disconnect all apps from the popup or Settings. The stop
+  survives restarts; Resume connection requires fresh approval for each app.
+  A command already running may finish, and completed actions cannot be undone.
 - **It stays out of your tab**: the agent opens its own tabs in the background
   and works there, so the page you are on is never navigated, clicked or pulled
   out of focus. `batch` reads many of them at once in one call.
@@ -138,14 +144,15 @@ with `/mcp` inside a session — no restart needed.
 
 By default everything is **deny-all** (no domains, no eval, no mutations). Grant
 exactly what you need with `--allow-domain <glob>` (repeatable), `--enable-mutations`,
-`--enable-downloads`, `--enable-uploads`, `--unsafe-enable-eval`, or `--unsafe-all-domains`.
+`--enable-downloads`, `--enable-uploads`, or `--unsafe-enable-eval`. All-site access
+is not supported; approve named websites in the Chrome extension popup.
 
 Email verification is on by default. For a trusted, local unattended setup, you
 can opt out with `--no-email-verification` (or set
 `MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0`). This skips the email prompt and
 the Firebase access service, so no email or device grant is sent there. The
-local MCP client can then use the browser within the configured domain and
-capability policy without an account check. Treat every process that can launch
+local MCP client still needs approval inside Chrome before using the extension,
+and stays within the configured domain and capability policy. Treat every process that can launch
 or reach this local server as trusted. This option is rejected with `--tunnel`
 and does not turn off telemetry or the npm update check.
 
@@ -155,7 +162,7 @@ and does not turn off telemetry or the npm update check.
 > with `--uploads-dir <path>` to restrict uploads to files inside that directory
 > (`..` traversal is blocked) — strongly recommended for unattended use.
 
-**Pair once, never again.** Both examples above include `--persist-token`, which
+**Keep transport pairing across restarts.** Both examples above include `--persist-token`, which
 is what makes the pairing survive a restart — drop it if you'd rather have the
 stricter default described next.
 
@@ -163,7 +170,8 @@ Without `--persist-token` a fresh token is minted every boot (the secure
 default), which means re-pairing the extension on each restart. With it, the
 token is stored 0600 at `~/.mcp-browser-extension/token` and reused; the extension's
 keepalive auto-reconnects with no manual step. `MCP_BROWSER_EXTENSION_TOKEN` pins the token
-explicitly (and is never written to disk).
+explicitly (and is never written to disk). This transport pairing does not grant
+an app access: every new app session has a separate key and needs Chrome approval.
 
 **2. Install the extension** — **required**; the server can drive nothing without it.
 
@@ -202,6 +210,44 @@ token. Chrome lets only this extension talk to that helper. If the server ever
 changes its token, the extension fetches the new one by itself. Nothing to copy
 or paste.
 
+**5. Approve the app connection in Chrome.** Run `chrome_status`, then open
+the extension popup's **App connections** section. Compare the key
+fingerprint with the one in the tool result and click **Approve for 8 hours**.
+App names are supplied by the app; the key identifies this particular session.
+Retry the tool after approving. A question-mark badge and the popup show pending
+requests, even if the client hides its prompts. Approve, deny, revoke and restore
+connections directly in the popup or in Settings.
+
+Each app session has its own signing key, held only in that server session's memory.
+Approval applies to this Chrome profile for eight hours. Restarting the app's MCP
+connection creates a new key and needs a new approval. **Remove access** blocks further
+commands from that key; an action already running may finish. YOLO, bypass-permission
+mode and `--no-email-verification` cannot skip this extension check.
+
+**6. Allow the websites you need.** The popup shows a Website access request.
+Click **Allow**, then accept Chrome's website permission prompt if shown. This
+single flow grants that named website in both Chrome and the server's allowlist.
+Allowing a website lets approved apps read and take actions there, including
+sending messages, deleting information and making purchases, subject to the
+configured tool permissions. There is no separate extension approval for each
+action. Website access is remembered until removed and shared by approved app
+sessions; each app still needs its own unexpired connection approval.
+Removing the website also removes its Chrome permission. Existing server flags
+do not grant Chrome access, and an upgrade may ask you to approve websites again.
+
+Cookies and downloads ask separately under **Extra permissions** when needed.
+They start off, and their buttons also let you remove permission. Downloads are
+fetched without browser cookies, redirects are refused, and files are limited to
+50 MiB. Links that require a signed-in browser session or redirect may not
+work. Proxy
+authentication and IP lookups request permission from Settings. Chrome does not
+support making `debugger` or `proxy` optional; those remain required, and debugger
+commands still check website permission before they run.
+
+Update both the extension and server before using client approval. An older
+extension cannot enforce it, and the updated server refuses browser commands
+until the extension is updated. See [client approval details](docs/CLIENT-APPROVAL.md).
+
 <details>
 <summary>Developers: load it unpacked instead</summary>
 
@@ -232,7 +278,8 @@ stays in the toolbar. Hover it for the status in words.
 
 | Badge | Meaning |
 |---|---|
-| green dot | paired and connected |
+| green dot | transport paired and connected |
+| question mark | a connection or site needs your review |
 | yellow dots | connecting |
 | grey circle | not paired yet (no server has run, or no pairing file) |
 | red exclamation mark | token rejected; the server rotated it, re-pairs by itself in a moment |
@@ -291,8 +338,9 @@ and the rest join the new hub. A call that was in flight at that moment fails
 once with `EXTENSION_DISCONNECTED` and is retried automatically when it is safe
 to repeat.
 
-Peers authenticate with the pairing token from the 0600 handshake file, so only
-your own OS user can join. A server too old to share the port is replaced as
+Peers authenticate to the local transport with the pairing token from the 0600
+handshake file. That token alone cannot authorize browser commands: each session
+must sign its own commands with a key approved inside Chrome. A server too old to share the port is replaced as
 before: it is verified to be an MCP Browser Extension server, then stopped. Anything that isn't a
 verified MCP Browser Extension server is never touched — a port held by some other program is
 reported, never killed.
@@ -665,7 +713,6 @@ status badge, and a stable pairing token (`--persist-token`).
 ```
 mcp-browser-extension --allow-domain example.com --enable-mutations
 mcp-browser-extension --policy ./policy.json          # see policy.example.json
-mcp-browser-extension --unsafe-all-domains            # loud footgun
 mcp-browser-extension --enable-observers              # console/network/dialog capture (patches page globals)
 mcp-browser-extension --redact                        # scrub secret-shaped strings out of page reads
 ```
@@ -677,7 +724,8 @@ is allowed (with its own Allow), and lists the allowed sites. The Options page
 (Settings in the popup) also has a box to allow any other site. An allowed site applies at once to every session sharing that Chrome, and
 is saved to `~/.mcp-browser-extension/allowed-sites.json` so it survives restarts. Sites
 allowed there can be removed there; sites from `--allow-domain` stay until the
-flags change. The catch-all `*` can only come from `--unsafe-all-domains`. The
+flags change. Catch-all patterns do not grant access. Remove the retired
+`--unsafe-all-domains` option from older configurations before starting. The
 agent cannot approve a site itself: MCP Browser Extension never reads or drives the
 extension's own pages. Run with `--no-site-grants` to keep the allowlist exactly
 what the flags say.

package/SETUP.md

@@ -14,8 +14,10 @@ inside Chrome's own UI (loading the extension, pasting the pairing token).
   fix it. Do not proceed on a broken step.
 - The server is **deny-all by default**: no domains, no clicks, no eval, no
   downloads, no uploads. Ask the human which domains they want to automate and
-  grant only those with `--allow-domain`. Never reach for `--unsafe-all-domains`
-  or `--unsafe-enable-eval` unless the human asks for them by name.
+  grant only those with `--allow-domain`, or let the person allow them from the
+  Chrome extension popup. All-site access is not supported. Remove
+  `--unsafe-all-domains` from older configurations; never replace it with a
+  catch-all pattern. Only enable `--unsafe-enable-eval` if the human asks by name.
 - Never print or log the pairing token. It lives in a 0600 file; show the human
   its path, not its contents.
 - Requires Node 18 or newer (`node --version`) and Chrome 116 or newer.
@@ -140,14 +142,23 @@ If the client suppresses or cannot display the prompt, or it is dismissed,
 the server automatically opens a temporary local browser form and returns
 `ACCESS_INPUT_REQUIRED` with its link. Show the link as a backup if the form
 did not appear on the computer running the server.
+Do not open that link again or ask for the email in chat while the browser form
+is active. An accepted chat email prompt does not open a browser input form;
+repeated tool calls reuse the active prompt or pending verification.
 The human enters their email, opens the sign-in link from their inbox, and clicks
 **Verify this device**. Do not fill
 the form or open their email for them. The form expires after 10 minutes.
 After they submit it, call `chrome_status` to wait for verification.
 YOLO/bypass permission mode does not skip email verification.
 
+Website access also needs Chrome permission. Relay the tool's one-line Allow
+instructions; the person clicks Allow in the popup and accepts Chrome's native
+prompt if shown. A server allow-domain flag does not supply this permission.
+For a blocked optional feature, relay the Extra permissions instructions. Never
+request or grant these permissions through browser automation.
+
 If the human explicitly configured `--no-email-verification`, there is no email
-step; continue to pairing. This option is intended only for trusted local
+step; continue to pairing and Chrome client approval. This option is intended only for trusted local
 clients and cannot be combined with a public tunnel.
 
 Each verification wait lasts up to 45 seconds. If the result says
@@ -165,6 +176,19 @@ is still unpaired, the human clicks **Connect** in the extension popup after
 email verification. If Chrome reports no paired browser, follow that step and
 retry the tool.
 
+When the tool asks for Chrome approval, relay its friendly one-line steps with
+the app name and key fingerprint. They click the extension's toolbar icon, review **App
+connections**, compare the key, then click **Approve for 8 hours**. The same
+controls are in Settings. Never click
+Approve for them or attempt to change the extension's approval storage. Retry
+the tool after they approve. YOLO, bypass-permission mode and
+`--no-email-verification` do not disable this check.
+
+Approval belongs to one app session and one Chrome profile. A restarted MCP
+connection creates a new key; expired access requires approval again. The person
+can revoke one key from the popup or Settings without revoking the others. Update both the
+server and extension; old versions cannot silently bypass this gate.
+
 ## Step 6 — Check the pairing
 
 Pairing needs no paste. Every time the server boots it writes `pairing.json`

package/dist/shared/activity.d.ts

@@ -0,0 +1,25 @@
+export declare const ACCESS_STOPPED_KEY = "accessStopped";
+export declare const ACTIVITY_KEY = "recentActivity";
+export declare const ACTIVITY_LIMIT = 100;
+export type ActivityOutcome = 'running' | 'done' | 'blocked' | 'failed' | 'interrupted';
+export interface ActivityEntry {
+    id: string;
+    at: number;
+    method: string;
+    host: string;
+    /** Browser-session tab identity, used only to pair opening and closing. */
+    tabId?: number;
+    app: string;
+    key: string;
+    outcome: ActivityOutcome;
+}
+/** Deliberately excludes paths, queries, fragments, credentials and page data. */
+export declare function activityHost(url: string): string;
+/** Reconstruct a fixed schema; never spread caller-supplied command data into storage. */
+export declare function activityEntry(value: ActivityEntry): ActivityEntry;
+export interface ActivityRow extends ActivityEntry {
+    opened?: ActivityEntry;
+}
+/** Pair completed actions on the same tab and app; never merge by website alone. */
+export declare function activityRows(entries: ActivityEntry[]): ActivityRow[];
+export declare const activityLabel: (method: string) => string;

package/dist/shared/activity.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.activityLabel = exports.ACTIVITY_LIMIT = exports.ACTIVITY_KEY = exports.ACCESS_STOPPED_KEY = void 0;
+exports.activityHost = activityHost;
+exports.activityEntry = activityEntry;
+exports.activityRows = activityRows;
+const protocol_1 = require("./protocol");
+const client_auth_1 = require("./client-auth");
+exports.ACCESS_STOPPED_KEY = 'accessStopped';
+exports.ACTIVITY_KEY = 'recentActivity';
+exports.ACTIVITY_LIMIT = 100;
+/** Deliberately excludes paths, queries, fragments, credentials and page data. */
+function activityHost(url) {
+    if (url === 'about:blank')
+        return url;
+    if (url === 'chrome://newtab/' || url === 'chrome://newtab' || url === 'chrome://new-tab-page/')
+        return 'chrome://newtab';
+    try {
+        const parsed = new URL(url);
+        return ['http:', 'https:'].includes(parsed.protocol) ? parsed.hostname.slice(0, 253) : '';
+    }
+    catch {
+        return '';
+    }
+}
+/** Reconstruct a fixed schema; never spread caller-supplied command data into storage. */
+function activityEntry(value) {
+    return {
+        id: value.id.slice(0, 80),
+        at: value.at,
+        method: protocol_1.WIRE_METHODS.includes(value.method) ? value.method : 'unknown',
+        host: activityHost(value.host) || activityHost(`https://${value.host}/`),
+        ...(Number.isSafeInteger(value.tabId) && value.tabId >= 0 ? { tabId: value.tabId } : {}),
+        app: value.key ? (0, client_auth_1.clientName)(value.app) : 'Unverified app',
+        key: /^[a-f0-9]{64}$/.test(value.key) ? value.key : '',
+        outcome: ['running', 'done', 'blocked', 'failed', 'interrupted'].includes(value.outcome) ? value.outcome : 'failed',
+    };
+}
+/** Pair completed actions on the same tab and app; never merge by website alone. */
+function activityRows(entries) {
+    const rows = [];
+    const opens = new Map();
+    for (const entry of entries) {
+        const key = entry.tabId !== undefined && entry.key ? `${entry.key}:${entry.tabId}` : '';
+        if (key && entry.method === 'tab_new' && entry.outcome === 'done')
+            opens.set(key, entry);
+        const opened = key && entry.method === 'tab_close' && entry.outcome === 'done' ? opens.get(key) : undefined;
+        if (opened) {
+            const index = rows.findIndex((row) => row.id === opened.id);
+            if (index !== -1)
+                rows.splice(index, 1);
+            rows.push({ ...entry, host: entry.host || opened.host, opened });
+            opens.delete(key);
+        }
+        else
+            rows.push(entry);
+    }
+    return rows;
+}
+const LABELS = {
+    tabs_list: 'List tabs', tab_select: 'Select tab', tab_new: 'Open tab', tab_close: 'Close tab',
+    navigate: 'Navigate', back: 'Go back', forward: 'Go forward', reload: 'Reload page',
+    click: 'Click', draw: 'Draw', type: 'Type text', press: 'Press key', hover: 'Hover',
+    scroll: 'Scroll', screenshot: 'Take screenshot', get_text: 'Read text', get_html: 'Read HTML',
+    eval: 'Run page script', snapshot: 'Read page structure', fill_form: 'Fill form',
+    get_cookies: 'Read cookies', storage: 'Access site storage', download_file: 'Download file',
+    upload_file: 'Upload file', print_pdf: 'Print PDF', select_option: 'Choose option',
+    observers: 'Read page observations', proxy_status: 'Check proxy', frames: 'List frames',
+};
+const activityLabel = (method) => LABELS[method] ?? method.replaceAll('_', ' ');
+exports.activityLabel = activityLabel;
+//# sourceMappingURL=activity.js.map

package/dist/shared/browser-permissions.d.ts

@@ -0,0 +1,20 @@
+/** Only named HTTP(S) sites may be requested; never a catch-all or a file URL. */
+export declare function siteOrigins(input: string): string[];
+/** Match patterns have no port or path scope for host permissions. */
+export declare function originForUrl(url: string): string | null;
+export declare function isGlobalOrigin(origin: string): boolean;
+export declare const OPTIONAL_FEATURES: {
+    readonly cookies: {
+        readonly label: "Cookies";
+        readonly explanation: "Read cookies on websites you have allowed. Cookie values still follow your server settings.";
+    };
+    readonly downloads: {
+        readonly label: "Downloads";
+        readonly explanation: "Save files from websites you have allowed.";
+    };
+};
+export type OptionalFeature = keyof typeof OPTIONAL_FEATURES;
+export declare const FEATURE_REQUESTS_KEY = "browserPermissionRequests";
+export declare const PERMISSIONS_MIGRATION_KEY = "optionalBrowserPermissionsV1";
+export declare const PROXY_AUTH_PERMISSIONS: string[];
+export declare const IP_LOOKUP_ORIGINS: string[];

package/dist/shared/browser-permissions.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IP_LOOKUP_ORIGINS = exports.PROXY_AUTH_PERMISSIONS = exports.PERMISSIONS_MIGRATION_KEY = exports.FEATURE_REQUESTS_KEY = exports.OPTIONAL_FEATURES = void 0;
+exports.siteOrigins = siteOrigins;
+exports.originForUrl = originForUrl;
+exports.isGlobalOrigin = isGlobalOrigin;
+const policy_1 = require("./policy");
+/** Only named HTTP(S) sites may be requested; never a catch-all or a file URL. */
+function siteOrigins(input) {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(input) && !/^https?:\/\//i.test(input))
+        return [];
+    const pattern = (0, policy_1.normalizeDomainPattern)(input);
+    const host = pattern.startsWith('*.') ? pattern.slice(2) : pattern;
+    if (!host || host.length > 253 ||
+        !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/.test(host))
+        return [];
+    return [`http://${pattern}/*`, `https://${pattern}/*`];
+}
+/** Match patterns have no port or path scope for host permissions. */
+function originForUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return /^https?:$/.test(parsed.protocol) ? `${parsed.protocol}//${parsed.hostname}/*` : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isGlobalOrigin(origin) {
+    return origin === '<all_urls>' || /^(?:\*|[a-z]+):\/\/\*\/.*$/i.test(origin);
+}
+exports.OPTIONAL_FEATURES = {
+    cookies: { label: 'Cookies', explanation: 'Read cookies on websites you have allowed. Cookie values still follow your server settings.' },
+    downloads: { label: 'Downloads', explanation: 'Save files from websites you have allowed.' },
+};
+exports.FEATURE_REQUESTS_KEY = 'browserPermissionRequests';
+exports.PERMISSIONS_MIGRATION_KEY = 'optionalBrowserPermissionsV1';
+exports.PROXY_AUTH_PERMISSIONS = ['webRequest', 'webRequestAuthProvider'];
+exports.IP_LOOKUP_ORIGINS = ['https://ipinfo.io/*', 'https://api.ipify.org/*'];
+//# sourceMappingURL=browser-permissions.js.map

package/dist/shared/client-auth.d.ts

@@ -0,0 +1,28 @@
+/** Per-session authorization, enforced by the extension independently of the bridge token. */
+import type { CommandFrame } from './protocol';
+export declare const CLIENT_APPROVAL_CAP = "client-approval-v1";
+export declare const CLIENT_GRANT_MS: number;
+export declare const CLIENT_CLOCK_SKEW_MS: number;
+export declare const CLIENT_REQUEST_MS: number;
+export declare const CLIENT_STORAGE_KEY = "clientConnections";
+export interface ClientProof {
+    publicKey: string;
+    name: string;
+    challenge: string;
+    issuedAt: number;
+    nonce: string;
+    signature: string;
+}
+export interface ClientConnection {
+    id: string;
+    publicKey: string;
+    name: string;
+    state: 'pending' | 'approved' | 'revoked';
+    requestedAt: number;
+    expiresAt: number;
+}
+export declare function clientName(value: string): string;
+/** Correlation id is assigned by the hub; every executable field is signed. */
+export declare function clientSigningPayload(cmd: Pick<CommandFrame, 'v' | 'method' | 'params' | 'tabId' | 'timeoutMs'>, proof: Omit<ClientProof, 'signature'>): string;
+/** The only unsigned command allowed returns a fixed health response, without a tab lookup. */
+export declare function isHealthProbe(cmd: Pick<CommandFrame, 'method' | 'params'>): boolean;

package/dist/shared/client-auth.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_STORAGE_KEY = exports.CLIENT_REQUEST_MS = exports.CLIENT_CLOCK_SKEW_MS = exports.CLIENT_GRANT_MS = exports.CLIENT_APPROVAL_CAP = void 0;
+exports.clientName = clientName;
+exports.clientSigningPayload = clientSigningPayload;
+exports.isHealthProbe = isHealthProbe;
+exports.CLIENT_APPROVAL_CAP = 'client-approval-v1';
+exports.CLIENT_GRANT_MS = 8 * 60 * 60 * 1000;
+exports.CLIENT_CLOCK_SKEW_MS = 2 * 60 * 1000;
+exports.CLIENT_REQUEST_MS = 10 * 60 * 1000;
+exports.CLIENT_STORAGE_KEY = 'clientConnections';
+function clientName(value) {
+    return value.replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, '').trim().slice(0, 80) || 'Unnamed app';
+}
+/** Normalize as JSON first: omitted properties must sign identically across the wire. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const obj = value;
+        return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+/** Correlation id is assigned by the hub; every executable field is signed. */
+function clientSigningPayload(cmd, proof) {
+    return canonical(JSON.parse(JSON.stringify({
+        domain: exports.CLIENT_APPROVAL_CAP, v: cmd.v, method: cmd.method, params: cmd.params,
+        tabId: cmd.tabId ?? null, timeoutMs: cmd.timeoutMs,
+        publicKey: proof.publicKey, name: proof.name, challenge: proof.challenge,
+        issuedAt: proof.issuedAt, nonce: proof.nonce,
+    })));
+}
+/** The only unsigned command allowed returns a fixed health response, without a tab lookup. */
+function isHealthProbe(cmd) {
+    return cmd.method === 'ping_probe' && Object.keys(cmd.params ?? {}).length === 0;
+}
+//# sourceMappingURL=client-auth.js.map

package/dist/shared/observers.d.ts

@@ -103,7 +103,7 @@ export declare function readObservers(globalName: string, opts: {
  * Translate the domain allowlist into Chrome match patterns for registering the
  * hook as a content script. A bare host becomes `*://host/*`; `*.host` becomes
  * `*://*.host/*` (which Chrome reads as the host AND its subdomains, matching
- * how the allowlist itself behaves); `*` becomes `<all_urls>`. Entries carrying
+ * how the allowlist itself behaves). Catch-all entries and entries carrying
  * no host are dropped rather than widened — the page the tool may not read is
  * also the page it must not instrument.
  */

package/dist/shared/observers.js

@@ -106,7 +106,7 @@ function readObservers(globalName, opts) {
  * Translate the domain allowlist into Chrome match patterns for registering the
  * hook as a content script. A bare host becomes `*://host/*`; `*.host` becomes
  * `*://*.host/*` (which Chrome reads as the host AND its subdomains, matching
- * how the allowlist itself behaves); `*` becomes `<all_urls>`. Entries carrying
+ * how the allowlist itself behaves). Catch-all entries and entries carrying
  * no host are dropped rather than widened — the page the tool may not read is
  * also the page it must not instrument.
  */
@@ -118,8 +118,6 @@ function observerMatches(policy) {
         const p = (0, policy_1.normalizeDomainPattern)(raw);
         if (!p)
             continue;
-        if (p === '*')
-            return ['<all_urls>'];
         out.add(`*://${p}/*`);
     }
     return [...out];

package/dist/shared/policy.d.ts

@@ -22,8 +22,8 @@ export declare function hostOf(url: string): string;
  * a full URL ("https://example.com/app") or a "host:port/path" instead of a bare
  * host; those forms would never equal a hostname and so silently match nothing.
  * We strip the scheme, userinfo, port, and path/query/fragment, preserving a
- * leading "*." wildcard and the two catch-all forms. Returns '' for a pattern
- * that carries no host (which then matches nothing).
+ * leading "*." for a named site's subdomains. Catch-all patterns and patterns
+ * without a host return '' and never grant access.
  */
 export declare function normalizeDomainPattern(pattern: string): string;
 export declare function isDomainAllowed(url: string, policy: WirePolicy): boolean;
@@ -40,11 +40,9 @@ export type PolicyVerdict = {
  */
 export declare function evaluatePolicy(url: string, method: WireMethod, policy: WirePolicy): PolicyVerdict;
 /**
- * A plain-English, actionable message for a blocked domain. Tells the user what
- * happened, why it's blocked (safety, not a bug), which sites ARE allowed, and
- * the exact one-line change to permit this one — so a non-technical user is never
- * left at a dead end. Never includes the token or any other secret.
+ * One friendly line with the person's next step. The agent must relay it and
+ * wait; only the person can approve the site in Chrome.
  */
-export declare function blockedDomainMessage(method: string, host: string, policy: WirePolicy): string;
+export declare function blockedDomainMessage(host: string): string;
 /** A wire policy that allows nothing — the safe default when none was delivered. */
 export declare const DENY_ALL_WIRE_POLICY: WirePolicy;

package/dist/shared/policy.js

@@ -103,28 +103,26 @@ function isAboutBlank(url) {
  * a full URL ("https://example.com/app") or a "host:port/path" instead of a bare
  * host; those forms would never equal a hostname and so silently match nothing.
  * We strip the scheme, userinfo, port, and path/query/fragment, preserving a
- * leading "*." wildcard and the two catch-all forms. Returns '' for a pattern
- * that carries no host (which then matches nothing).
+ * leading "*." for a named site's subdomains. Catch-all patterns and patterns
+ * without a host return '' and never grant access.
  */
 function normalizeDomainPattern(pattern) {
     let p = pattern.trim().toLowerCase();
-    if (p === '*' || p === '*://*/*')
-        return '*';
+    if (p === '*' || p === '*://*/*' || p === '<all_urls>')
+        return '';
     // Strip a leading scheme ("https://", "http://", any "scheme://").
     p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, '');
     // Drop everything from the first path/query/fragment separator onward.
     p = p.replace(/[/?#].*$/, '');
     // Strip userinfo ("user:pass@") then a trailing port (":8080").
     p = p.replace(/^[^@]*@/, '').replace(/:\d+$/, '');
-    return p;
+    return p === '*' || p === '*.' ? '' : p;
 }
-/** Convert a single domain glob to a predicate. '*' matches everything;
+/** Convert a named domain pattern to a predicate.
  *  '*.example.com' matches example.com and any subdomain; otherwise exact host.
  *  URL/port/path forms are normalized to their bare host first. */
 function globMatches(host, pattern) {
     const p = normalizeDomainPattern(pattern);
-    if (p === '*')
-        return true;
     if (p.startsWith('*.')) {
         const base = p.slice(2);
         return host === base || host.endsWith('.' + base);
@@ -179,29 +177,16 @@ function evaluatePolicy(url, method, policy) {
         return { ok: true };
     if (!isDomainAllowed(url, policy)) {
         const host = hostOf(url) || url;
-        return { ok: false, reason: blockedDomainMessage(method, host, policy) };
+        return { ok: false, reason: blockedDomainMessage(host) };
     }
     return { ok: true };
 }
 /**
- * A plain-English, actionable message for a blocked domain. Tells the user what
- * happened, why it's blocked (safety, not a bug), which sites ARE allowed, and
- * the exact one-line change to permit this one — so a non-technical user is never
- * left at a dead end. Never includes the token or any other secret.
+ * One friendly line with the person's next step. The agent must relay it and
+ * wait; only the person can approve the site in Chrome.
  */
-function blockedDomainMessage(method, host, policy) {
-    const allowed = policy.allowDomains.filter((d) => d !== '*');
-    const allowedLine = allowed.length
-        ? `Currently allowed: ${allowed.join(', ')}.`
-        : `Right now no sites are allowed.`;
-    return (`Blocked: "${method}" can't run on ${host} because it isn't on this browser tool's allowed-sites list. ` +
-        `This is a safety limit (the tool drives your real, logged-in browser, so it only touches sites you've approved) — not an error. ` +
-        `${allowedLine} ` +
-        `To allow ${host} right now, ask the user to click the MCP Browser Extension's toolbar icon in Chrome ` +
-        `and click Allow next to ${host}: it applies at once, no restart. ` +
-        `You cannot approve a site yourself. ` +
-        `Or add --allow-domain "${host}" (or "*.${host}" to include subdomains) to the MCP Browser Extension server settings (its entry in your MCP config) and restart. ` +
-        `To allow every site (less safe), use --unsafe-all-domains.`);
+function blockedDomainMessage(host) {
+    return `Please allow access to ${host}: Chrome → MCP Browser Extension icon → Allow next to ${host}, then try again.`;
 }
 /** A wire policy that allows nothing — the safe default when none was delivered. */
 exports.DENY_ALL_WIRE_POLICY = {

package/dist/shared/protocol.d.ts

@@ -1,3 +1,4 @@
+import type { ClientProof } from './client-auth';
 /**
  * shared/protocol.ts — THE SINGLE SOURCE OF TRUTH for the wire contract.
  *
@@ -132,6 +133,8 @@ export interface BaseFrame {
     v: ProtocolVersion;
 }
 export interface HelloFrame extends BaseFrame {
+    /** Random challenge chosen by the extension for this WebSocket, never by the hub. */
+    approvalChallenge?: string;
     type: 'hello';
     token: string;
     ext: {
@@ -200,6 +203,7 @@ export interface UnauthFrame extends BaseFrame {
     reason: 'bad_token' | 'bad_version' | 'timeout';
 }
 export interface CommandFrame extends BaseFrame {
+    authorization?: ClientProof;
     type: 'command';
     id: string;
     method: WireMethod;

package/dist/shared/protocol.js

@@ -1,4 +1,7 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
+exports.fillFormTimeoutMs = fillFormTimeoutMs;
 /**
  * shared/protocol.ts — THE SINGLE SOURCE OF TRUTH for the wire contract.
  *
@@ -14,9 +17,6 @@
  * beyond the primitives, and so is `fill_form` (a batch of `type`/`click` writes
  * in one round-trip; capability-gated, see `WIRE_CAP_FILL_FORM`).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
-exports.fillFormTimeoutMs = fillFormTimeoutMs;
 /** Bumped on any breaking change to the frames below. */
 exports.PROTOCOL_VERSION = 1;
 /**