mcp-browser-extension 0.9.32 → 0.9.34

package/README.md

@@ -630,7 +630,7 @@ PDF is megabytes of base64 no model can read.
 ### Paying less per turn — `--tools`
 
 Every MCP server you connect costs context before you ask it anything: the host
-sends the whole tool catalog to the model on **every** turn. MCP Browser Extension's 40
+sends the whole tool catalog to the model on **every** turn. MCP Browser Extension's 43
 tools are 28 KB of JSON Schema, about 7.1k tokens, on each one.
 
 Most runs need a handful of them. `--tools` advertises only those:
@@ -652,7 +652,7 @@ for a run that was never going to print a PDF or upload a file.
   `--unsafe-enable-eval`.
 - An unknown name fails at startup and prints the catalog, so a typo can never
   quietly drop `click` from the surface.
-- `mcp-browser-extension --help` prints the full catalog of 42 names to pick from.
+- `mcp-browser-extension --help` prints the full catalog of 43 names to pick from.
 
 ## Status
 

package/SETUP.md

@@ -20,7 +20,7 @@ inside Chrome's own UI (loading the extension, pasting the pairing token).
   catch-all pattern. Only enable `--unsafe-enable-eval` if the human asks by name.
 - Never print or log the pairing token. It lives in a 0600 file; show the human
   its path, not its contents.
-- Requires Node 18 or newer (`node --version`) and Chrome 116 or newer.
+- Requires Node 20 or newer (`node --version`) and Chrome 116 or newer.
 - On Windows, MCP hosts must launch the server through `cmd /c npx ...`. See
   step 3.
 

package/dist/src/mcp/person-wait.d.ts

@@ -0,0 +1,31 @@
+/**
+ * src/mcp/person-wait.ts — hold a tool call open while the PERSON approves the
+ * app or allows a site in Chrome, then continue on its own.
+ *
+ * Without this the agent gets an error, tells the person, and has to invent its
+ * own polling (shell sleeps, "I'll check again in a minute"). Waiting here means
+ * one tool call simply completes once the person clicks Approve/Allow.
+ */
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+export interface PersonWaitRequest {
+    signal?: AbortSignal;
+    progressToken?: string | number;
+    sendNotification?: (n: {
+        method: 'notifications/progress';
+        params: {
+            progressToken: string | number;
+            progress: number;
+            message: string;
+        };
+    }) => Promise<void>;
+}
+export declare function setPersonWaitForTesting(poll: number, wait: number): void;
+/** The person-only step a result is blocked on, or undefined when it is not. */
+export declare function personStep(result: CallToolResult): string | undefined;
+export declare const STILL_WAITING: string;
+/**
+ * Run `attempt` until it is no longer blocked on the person, the wait expires,
+ * or the call is cancelled. Only results that ran nothing (approval / site
+ * gate refusals) are retried.
+ */
+export declare function waitForPerson(attempt: () => Promise<CallToolResult>, request: PersonWaitRequest): Promise<CallToolResult>;

package/dist/src/mcp/person-wait.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * src/mcp/person-wait.ts — hold a tool call open while the PERSON approves the
+ * app or allows a site in Chrome, then continue on its own.
+ *
+ * Without this the agent gets an error, tells the person, and has to invent its
+ * own polling (shell sleeps, "I'll check again in a minute"). Waiting here means
+ * one tool call simply completes once the person clicks Approve/Allow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STILL_WAITING = void 0;
+exports.setPersonWaitForTesting = setPersonWaitForTesting;
+exports.personStep = personStep;
+exports.waitForPerson = waitForPerson;
+let pollMs = 1_500;
+// Stay under the 60 s default tool timeout some MCP clients enforce.
+let waitMs = 45_000;
+function setPersonWaitForTesting(poll, wait) {
+    pollMs = Math.max(1, poll);
+    waitMs = Math.max(1, wait);
+}
+const APPROVAL = /Please approve "/;
+const SITE = /^\[POLICY_DENIED\] Please allow access to /;
+/** The person-only step a result is blocked on, or undefined when it is not. */
+function personStep(result) {
+    if (!result.isError)
+        return undefined;
+    const first = result.content[0];
+    const text = first?.type === 'text' ? first.text : '';
+    return APPROVAL.test(text) || SITE.test(text) ? text : undefined;
+}
+exports.STILL_WAITING = 'Still waiting for the person. Call the same tool again to keep waiting; it continues on its own once they approve. ' +
+    'Do not use shell sleeps or ask them to confirm in chat.';
+/**
+ * Run `attempt` until it is no longer blocked on the person, the wait expires,
+ * or the call is cancelled. Only results that ran nothing (approval / site
+ * gate refusals) are retried.
+ */
+async function waitForPerson(attempt, request) {
+    let result = await attempt();
+    let step = personStep(result);
+    if (!step)
+        return result;
+    const deadline = Date.now() + waitMs;
+    let progress = 0;
+    const report = async (message) => {
+        if (request.progressToken === undefined || !request.sendNotification || request.signal?.aborted)
+            return;
+        try {
+            await request.sendNotification({ method: 'notifications/progress', params: { progressToken: request.progressToken, progress: ++progress, message } });
+        }
+        catch { /* Progress is optional; the tool result still carries the outcome. */ }
+    };
+    await report(`${step} Waiting for this automatically.`);
+    while (Date.now() < deadline && !request.signal?.aborted) {
+        await new Promise((resolve) => {
+            const timer = setTimeout(done, Math.min(pollMs, Math.max(1, deadline - Date.now())));
+            function done() { clearTimeout(timer); request.signal?.removeEventListener('abort', done); resolve(); }
+            request.signal?.addEventListener('abort', done, { once: true });
+        });
+        if (request.signal?.aborted)
+            break;
+        result = await attempt();
+        const next = personStep(result);
+        if (!next)
+            return result;
+        // Approving the app can uncover the site gate; say what is awaited now.
+        if (next !== step)
+            await report(`${next} Waiting for this automatically.`);
+        step = next;
+    }
+    return { ...result, content: [...result.content, { type: 'text', text: exports.STILL_WAITING }] };
+}
+//# sourceMappingURL=person-wait.js.map

package/dist/src/mcp/server.js

@@ -38,6 +38,8 @@ const SERVER_VERSION = '0.1.0';
 exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, signed-in Chrome. " +
     'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you, then click Verify this device on the website. If it returns ACCESS_INPUT_REQUIRED, the local verification form opens automatically in the browser; also show its URL as a backup so the user can enter their email. Do not open the backup URL again or add another chat email prompt while that form is active. Do not fill it or read their email for them. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
     'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
+    'Approval and site refusals wait automatically: the tool call stays open (about 45 seconds) and continues on its own as soon as the person clicks Approve or Allow. Tell the person once. If it returns "Still waiting", call the same tool again; never use shell sleeps, timers or "I will check again later" messages, and never ask them to confirm in chat. ' +
+    'Chrome blocks every extension from Chrome Web Store pages (chromewebstore.google.com and chrome.google.com/webstore, including the developer dashboard): they fail with TARGET_GONE "The extensions gallery cannot be scripted". Do not ask the person to allow those sites; it cannot help. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +
@@ -46,6 +48,8 @@ exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, sig
     "To act on the user's current page, pass its tabId from tabs_list.";
 const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
     'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
+    'Approval and site refusals wait automatically: the tool call stays open (about 45 seconds) and continues on its own as soon as the person clicks Approve or Allow. Tell the person once. If it returns "Still waiting", call the same tool again; never use shell sleeps, timers or "I will check again later" messages, and never ask them to confirm in chat. ' +
+    'Chrome blocks every extension from Chrome Web Store pages (chromewebstore.google.com and chrome.google.com/webstore, including the developer dashboard): they fail with TARGET_GONE "The extensions gallery cannot be scripted". Do not ask the person to allow those sites; it cannot help. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, relay its friendly one-line approval steps and wait for the person to allow it from the extension\'s toolbar icon. Never approve it yourself or enable all-site access. ' +
     "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";

package/dist/src/mcp/tools.js

@@ -35,6 +35,7 @@ const policy_2 = require("../../shared/policy");
 const envelopes_1 = require("./envelopes");
 const limits_1 = require("./limits");
 const batch_1 = require("./batch");
+const person_wait_1 = require("./person-wait");
 const helpers_1 = require("./helpers");
 const redact_1 = require("./redact");
 const locate_1 = require("./locate");
@@ -1544,17 +1545,25 @@ function registerTools(server, policy, accessGuard = access_1.requireAccess) {
             });
             if (accessError)
                 return accessError;
-            if (profileBridge?.hasActiveExtension()) {
-                const active = (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default';
-                const profile = profileBridge.hasConnection(active) ? active : profileBridge.pairedProfiles()[0]?.name;
-                try {
-                    await profileBridge.sendCommand('ping_probe', { requireClientApproval: true }, { profile });
+            // Approval and site refusals run nothing, so the call waits for the
+            // person here and continues once they click Approve or Allow.
+            const result = await (0, person_wait_1.waitForPerson)(async () => {
+                if (profileBridge?.hasActiveExtension()) {
+                    const active = (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default';
+                    const profile = profileBridge.hasConnection(active) ? active : profileBridge.pairedProfiles()[0]?.name;
+                    try {
+                        await profileBridge.sendCommand('ping_probe', { requireClientApproval: true }, { profile });
+                    }
+                    catch (err) {
+                        return (0, envelopes_1.errorResult)(err instanceof Error ? err.message : 'Chrome client approval is required.');
+                    }
                 }
-                catch (err) {
-                    return (0, envelopes_1.errorResult)(err instanceof Error ? err.message : 'Chrome client approval is required.');
-                }
-            }
-            const result = await dispatchToolCall(d.name, args);
+                return dispatchToolCall(d.name, args);
+            }, {
+                signal: extra.signal,
+                progressToken: extra._meta?.progressToken,
+                sendNotification: extra.sendNotification,
+            });
             if (verifiedNow)
                 result.content.unshift({ type: 'text', text: 'Email verified. MCP Browser Extension access is active.' });
             return result;

package/docs/CLIENT-APPROVAL.md

@@ -1,5 +1,11 @@
 # Client approval
 
+Related security steps: [Step 1: App and Website Approval](SECURITY-STEP-1.md),
+[Step 2: Optional Browser Permissions](SECURITY-STEP-2.md),
+[Step 3: Per-Action Approval Decision](SECURITY-STEP-3.md),
+[Step 4: Activity and Stop Access](SECURITY-STEP-4.md), and
+[Step 5: Download and Bridge Hardening](SECURITY-STEP-5.md).
+
 The extension requires a person to approve each new MCP app session in its Chrome
 popup or Settings before it can read or act on browser pages. This is independent of
 email verification, transport pairing, domain restrictions and client permission

package/extension-dist/background.js

@@ -3683,7 +3683,9 @@
       void operation.then((changed) => reply({
         ok: changed || !msg.allow,
         ...!changed && msg.allow ? { error: "No access was added. You can allow it whenever you are ready." } : {}
-      }), () => reply({ ok: false, error: "Could not change this permission. Please try again." }));
+      }), () => reply({ ok: false, error: "Could not change this permission. Please try again." })).finally(() => {
+        if (msg.allow) void reopenPopup(sender);
+      });
       return true;
     }
     if (["access_stop", "access_resume", "activity_clear"].includes(msg?.type)) {
@@ -3761,7 +3763,9 @@
         ws.send(frame);
         if (currentPolicy) await onAllowlist(currentPolicy);
         reply({ ok: true });
-      })().catch(() => reply({ ok: false, error: "Could not update this website permission. Please try again." }));
+      })().catch(() => reply({ ok: false, error: "Could not update this website permission. Please try again." })).finally(() => {
+        if (msg.type === "site_access" && msg.allow) void reopenPopup(sender);
+      });
       return true;
     }
     const fromOwnPage = sender.id === chrome.runtime.id && sender.url?.startsWith(chrome.runtime.getURL(""));
@@ -3791,6 +3795,15 @@
       return true;
     }
   });
+  async function reopenPopup(sender) {
+    if (sender.url !== chrome.runtime.getURL("popup.html")) return;
+    try {
+      const open = await chrome.runtime.getContexts({ contextTypes: [chrome.runtime.ContextType.POPUP] });
+      if (open.length) return;
+      await chrome.action.openPopup();
+    } catch {
+    }
+  }
   async function healFromHelper() {
     try {
       if (!await chrome.permissions.contains({ permissions: ["nativeMessaging"] })) return false;

package/extension-dist/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "MCP Browser Extension – AI agent in your logged-in Chrome",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Lets your AI agent use the Chrome you are signed into, through a local MCP server. Deny-all by default.",
   "homepage_url": "https://mcp-browser-extension.com",
   "minimum_chrome_version": "116",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-browser-extension",
   "mcpName": "io.github.Mehmoodqureshi/mcp-browser-extension",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
@@ -78,6 +78,6 @@
     "typescript": "^5.7.2"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }