mcp-browser-extension 0.9.33 → 0.9.35

package/README.md

@@ -630,7 +630,7 @@ PDF is megabytes of base64 no model can read.
 ### Paying less per turn — `--tools`
 
 Every MCP server you connect costs context before you ask it anything: the host
-sends the whole tool catalog to the model on **every** turn. MCP Browser Extension's 40
+sends the whole tool catalog to the model on **every** turn. MCP Browser Extension's 43
 tools are 28 KB of JSON Schema, about 7.1k tokens, on each one.
 
 Most runs need a handful of them. `--tools` advertises only those:
@@ -652,7 +652,7 @@ for a run that was never going to print a PDF or upload a file.
   `--unsafe-enable-eval`.
 - An unknown name fails at startup and prints the catalog, so a typo can never
   quietly drop `click` from the surface.
-- `mcp-browser-extension --help` prints the full catalog of 42 names to pick from.
+- `mcp-browser-extension --help` prints the full catalog of 43 names to pick from.
 
 ## Status
 
@@ -822,6 +822,11 @@ live on the website: **[MCP Browser Extension docs](https://mcp-browser-extensio
 - [Use Claude in your signed-in Chrome](https://mcp-browser-extension.com/logged-in-chrome)
 - [Give Claude Code browser access](https://mcp-browser-extension.com/blog/claude-code-browser)
 - [Give Cursor a real browser with MCP](https://mcp-browser-extension.com/blog/cursor-browser-mcp)
+- [Let VS Code Copilot use your real Chrome](https://mcp-browser-extension.com/blog/vscode-copilot-browser-mcp)
+- [Test a login flow end to end with an AI agent](https://mcp-browser-extension.com/blog/test-login-flow-ai-agent)
+- [Check a release page through a browser MCP tunnel](https://mcp-browser-extension.com/blog/check-release-page-remote-browser)
+- [Chrome DevTools MCP vs Playwright MCP vs an MCP extension](https://mcp-browser-extension.com/blog/chrome-devtools-mcp-vs-playwright-mcp)
+- [Best browser MCP servers in 2026](https://mcp-browser-extension.com/blog/best-browser-mcp-servers)
 - [How it compares with other browser MCP servers](https://mcp-browser-extension.com/docs/compare)
 
 ## Develop

package/SETUP.md

@@ -20,7 +20,7 @@ inside Chrome's own UI (loading the extension, pasting the pairing token).
   catch-all pattern. Only enable `--unsafe-enable-eval` if the human asks by name.
 - Never print or log the pairing token. It lives in a 0600 file; show the human
   its path, not its contents.
-- Requires Node 18 or newer (`node --version`) and Chrome 116 or newer.
+- Requires Node 20 or newer (`node --version`) and Chrome 116 or newer.
 - On Windows, MCP hosts must launch the server through `cmd /c npx ...`. See
   step 3.
 

package/dist/shared/policy.js

@@ -186,7 +186,9 @@ function evaluatePolicy(url, method, policy) {
  * wait; only the person can approve the site in Chrome.
  */
 function blockedDomainMessage(host) {
-    return `Please allow access to ${host}: Chrome → MCP Browser Extension icon → Allow next to ${host}, then try again.`;
+    // New installs sit inside Chrome's puzzle-piece menu, where the "?" badge is
+    // hidden, so the steps say where to find the icon.
+    return `Please allow access to ${host}: in Chrome, click the MCP Browser Extension icon (inside the puzzle-piece Extensions menu if it is not pinned), then click Allow next to ${host}.`;
 }
 /** A wire policy that allows nothing — the safe default when none was delivered. */
 exports.DENY_ALL_WIRE_POLICY = {

package/dist/shared/protocol.d.ts

@@ -150,6 +150,9 @@ export interface HelloFrame extends BaseFrame {
      *  Chrome profile. With no `profile` label, the server names the browser from it
      *  ("default", "profile-2", ...) so two blank-profile browsers never collide. */
     installId?: string;
+    /** A name the pairing helper proposed (the server's --profile). Used only when
+     *  no other browser has it; unlike `profile`, it never takes a name over. */
+    suggestedProfile?: string;
     /** How Chrome installed this copy (`chrome.management` installType):
      *  "normal" for the store, "development" for unpacked. Unpacked builds carry
      *  the store key, so the id alone cannot tell them apart. */
@@ -267,10 +270,14 @@ export interface SiteGrantFrame extends BaseFrame {
     host: string;
     allow: boolean;
 }
+/** Extension → server: the person approved or revoked an app, so waiting calls can retry. */
+export interface ApprovalChangedFrame extends BaseFrame {
+    type: 'approval_changed';
+}
 /** Frames the SERVER sends to the extension. */
 export type ServerFrame = CommandFrame | WelcomeFrame | UnauthFrame | PingFrame | PolicyFrame | BlockedFrame;
 /** Frames the EXTENSION sends to the server. */
-export type ExtensionFrame = HelloFrame | ResultFrame | ErrorFrame | EventFrame | PongFrame | SiteGrantFrame;
+export type ExtensionFrame = HelloFrame | ResultFrame | ErrorFrame | EventFrame | PongFrame | SiteGrantFrame | ApprovalChangedFrame;
 export type Frame = ServerFrame | ExtensionFrame;
 /** Shape of `$MCP_BROWSER_EXTENSION_DATA/handshake.json`. The token is a secret. */
 export interface HandshakeFile {

package/dist/src/bridge/chrome-profile-name.d.ts

@@ -0,0 +1,19 @@
+/**
+ * src/bridge/chrome-profile-name.ts — the Chrome profile an extension install runs in.
+ *
+ * Chrome never tells an extension which profile it runs in, but this server runs
+ * on the same computer. Each profile keeps the extension's chrome.storage.local
+ * under `<profile>/Local Extension Settings/<extension id>/`, and that storage
+ * holds the install's random installId. Finding the id names the profile folder;
+ * `Local State` maps the folder to the name on Chrome's profile icon. Read-only
+ * and best effort: anything unclear returns undefined and naming falls back.
+ */
+/**
+ * The display name of the Chrome profile holding this install, e.g. "Mehmood701".
+ * Only answers when exactly one profile matches.
+ */
+export declare function chromeProfileName(extId: unknown, installId: string, roots?: string[]): string | undefined;
+/** Routing keys for every Chrome profile on this computer, e.g. ["mehmood", "muhammad"]. */
+export declare function chromeProfileKeys(roots?: string[]): string[];
+/** A Chrome profile name as a routing key: "Mehmood 701" → "mehmood-701". */
+export declare function profileKeyFromChromeName(name: string): string | undefined;

package/dist/src/bridge/chrome-profile-name.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * src/bridge/chrome-profile-name.ts — the Chrome profile an extension install runs in.
+ *
+ * Chrome never tells an extension which profile it runs in, but this server runs
+ * on the same computer. Each profile keeps the extension's chrome.storage.local
+ * under `<profile>/Local Extension Settings/<extension id>/`, and that storage
+ * holds the install's random installId. Finding the id names the profile folder;
+ * `Local State` maps the folder to the name on Chrome's profile icon. Read-only
+ * and best effort: anything unclear returns undefined and naming falls back.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chromeProfileName = chromeProfileName;
+exports.chromeProfileKeys = chromeProfileKeys;
+exports.profileKeyFromChromeName = profileKeyFromChromeName;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const extension_repair_1 = require("../extension-repair");
+/** Storage files bigger than this are skipped; ours are a few hundred KB at most. */
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+const found = new Map();
+function profileNames(root) {
+    try {
+        const state = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'Local State'), 'utf8'));
+        const out = {};
+        for (const [dir, info] of Object.entries(state.profile?.info_cache ?? {})) {
+            if (typeof info?.name === 'string' && info.name.trim())
+                out[dir] = info.name.trim();
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+function storageHolds(folder, needle) {
+    let files;
+    try {
+        files = (0, node_fs_1.readdirSync)(folder).filter((f) => f.endsWith('.log') || f.endsWith('.ldb'));
+    }
+    catch {
+        return false;
+    }
+    for (const f of files) {
+        try {
+            const path = (0, node_path_1.join)(folder, f);
+            if ((0, node_fs_1.statSync)(path).size > MAX_FILE_BYTES)
+                continue;
+            if ((0, node_fs_1.readFileSync)(path).includes(needle))
+                return true;
+        }
+        catch {
+            /* locked or vanished: try the next file */
+        }
+    }
+    return false;
+}
+/**
+ * The display name of the Chrome profile holding this install, e.g. "Mehmood701".
+ * Only answers when exactly one profile matches.
+ */
+function chromeProfileName(extId, installId, roots = (0, extension_repair_1.browserDataDirs)()) {
+    if (typeof extId !== 'string' || !/^[a-p]{32}$/.test(extId))
+        return undefined;
+    const key = `${extId}/${installId}`;
+    if (found.has(key))
+        return found.get(key);
+    const needle = Buffer.from(installId, 'utf8');
+    const matches = [];
+    for (const root of roots) {
+        if (!(0, node_fs_1.existsSync)(root))
+            continue;
+        for (const [dir, name] of Object.entries(profileNames(root))) {
+            if (storageHolds((0, node_path_1.join)(root, dir, 'Local Extension Settings', extId), needle))
+                matches.push(name);
+        }
+    }
+    const name = matches.length === 1 ? matches[0] : undefined;
+    // Remember only a hit: a brand-new install may not have flushed its storage yet.
+    if (name)
+        found.set(key, name);
+    return name;
+}
+/** Routing keys for every Chrome profile on this computer, e.g. ["mehmood", "muhammad"]. */
+function chromeProfileKeys(roots = (0, extension_repair_1.browserDataDirs)()) {
+    const keys = new Set();
+    for (const root of roots) {
+        if (!(0, node_fs_1.existsSync)(root))
+            continue;
+        for (const name of Object.values(profileNames(root))) {
+            const key = profileKeyFromChromeName(name);
+            if (key)
+                keys.add(key);
+        }
+    }
+    return [...keys];
+}
+/** A Chrome profile name as a routing key: "Mehmood 701" → "mehmood-701". */
+function profileKeyFromChromeName(name) {
+    const key = name.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[-.]+|-+$/g, '');
+    return key || undefined;
+}
+//# sourceMappingURL=chrome-profile-name.js.map

package/dist/src/bridge/connection.d.ts

@@ -29,6 +29,7 @@ export interface ConnectionDeps {
     onEvent?: (event: WireEvent, data: Record<string, unknown>) => void;
     /** The person allowed or removed a site on this browser's Options page. */
     onSiteGrant?: (host: unknown, allow: boolean) => void;
+    onApprovalChanged?: () => void;
     onClose?: (code: number) => void;
     onLog?: (message: string) => void;
 }
@@ -54,6 +55,7 @@ export declare class ExtensionConnection {
     private readonly tabUrls;
     private readonly onEvent?;
     private readonly onSiteGrant?;
+    private readonly onApprovalChanged?;
     private readonly onClose?;
     private readonly onLog?;
     constructor(deps: ConnectionDeps);

package/dist/src/bridge/connection.js

@@ -52,6 +52,7 @@ class ExtensionConnection {
     tabUrls = new Map();
     onEvent;
     onSiteGrant;
+    onApprovalChanged;
     onClose;
     onLog;
     constructor(deps) {
@@ -63,6 +64,7 @@ class ExtensionConnection {
         this.reportsTabUrl = this.caps.has(protocol_1.WIRE_CAP_TAB_URL);
         this.onEvent = deps.onEvent;
         this.onSiteGrant = deps.onSiteGrant;
+        this.onApprovalChanged = deps.onApprovalChanged;
         this.onClose = deps.onClose;
         this.onLog = deps.onLog;
         this.ws.on('message', (raw) => this.handleMessage(raw));
@@ -168,6 +170,9 @@ class ExtensionConnection {
                 this.onSiteGrant?.(g.host, g.allow === true);
                 break;
             }
+            case 'approval_changed':
+                this.onApprovalChanged?.();
+                break;
             default:
                 // hello arrives only pre-auth (handled by the server); ignore here.
                 break;

package/dist/src/bridge/peer.d.ts

@@ -58,7 +58,11 @@ export interface PeerGrantFrame {
     host: string;
     allow: boolean;
 }
-export type HubToPeerFrame = PeerWelcomeFrame | PeerStateFrame | RelayResultFrame | PeerGrantFrame;
+/** An app was approved in a browser: peers retry calls waiting on the person. */
+export interface PeerWakeFrame {
+    type: 'peer_wake';
+}
+export type HubToPeerFrame = PeerWelcomeFrame | PeerStateFrame | RelayResultFrame | PeerGrantFrame | PeerWakeFrame;
 /** Encode a hub-side failure so the peer can rethrow it with its code intact. */
 export declare function relayError(id: string, err: unknown): RelayResultFrame;
 /**

package/dist/src/bridge/peer.js

@@ -18,11 +18,12 @@ exports.relayError = relayError;
  * file is 0600, so only the same OS user can read it — and speak a small
  * server-to-server protocol that the extension never sees:
  *   peer → hub:  peer_hello, relay (a wire command), peer_rename, peer_blocked
- *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant
+ *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result, peer_grant, peer_wake
  */
 const ws_1 = require("ws");
 const protocol_1 = require("../../shared/protocol");
 const types_1 = require("../executor/types");
+const person_wait_1 = require("../mcp/person-wait");
 /** How long a joining server waits for the hub's welcome before giving up. */
 exports.JOIN_TIMEOUT_MS = 2_000;
 /** Slack on top of the hub's own command timeout, so the hub always answers first. */
@@ -182,6 +183,10 @@ class HubLink {
                 this.onGrant?.(frame.host, frame.allow === true);
             return;
         }
+        if (frame.type === 'peer_wake') {
+            (0, person_wait_1.notifyPersonStep)();
+            return;
+        }
         if (frame.type !== 'relay_result')
             return;
         const p = this.pending.get(frame.id);

package/dist/src/bridge/profiles.d.ts

@@ -28,11 +28,18 @@ export declare class ProfileRegistry {
     /** The install that owns `name` in the registry, if any. */
     ownerOf(name: string): string | undefined;
     /**
-     * Name for an install with no explicit label: its remembered name, else the
-     * first of "default", "profile-2", ... that no other install owns and
-     * `isLive(name)` doesn't report as held by someone else right now.
+     * Name for an install with no explicit label, first that fits:
+     *   1. a name given with profile_rename, kept for good;
+     *   2. each of `preferred` in order (the pairing helper's suggestion, then the
+     *      Chrome profile's own name), but only while no other install owns it or
+     *      holds it live: a preference never takes a name from another browser;
+     *   3. `own`, the Chrome profile's own name: unlike a preference it may be
+     *      taken back from an install that is offline (an old copy that profile
+     *      no longer runs), unless that one was named with profile_rename;
+     *   4. its remembered name, unless another browser holds it right now;
+     *   5. the first of "default", "profile-2", ... nobody owns or holds.
      */
-    assign(installId: string, isLive: (name: string) => boolean): string;
+    assign(installId: string, isLive: (name: string) => boolean, preferred?: (string | undefined)[], own?: string): string;
     /**
      * Give the install currently named `from` the name `to`. Throws when `from`
      * isn't an auto-named install or `to` is already owned by another one; the

package/dist/src/bridge/profiles.js

@@ -47,24 +47,49 @@ class ProfileRegistry {
         return undefined;
     }
     /**
-     * Name for an install with no explicit label: its remembered name, else the
-     * first of "default", "profile-2", ... that no other install owns and
-     * `isLive(name)` doesn't report as held by someone else right now.
+     * Name for an install with no explicit label, first that fits:
+     *   1. a name given with profile_rename, kept for good;
+     *   2. each of `preferred` in order (the pairing helper's suggestion, then the
+     *      Chrome profile's own name), but only while no other install owns it or
+     *      holds it live: a preference never takes a name from another browser;
+     *   3. `own`, the Chrome profile's own name: unlike a preference it may be
+     *      taken back from an install that is offline (an old copy that profile
+     *      no longer runs), unless that one was named with profile_rename;
+     *   4. its remembered name, unless another browser holds it right now;
+     *   5. the first of "default", "profile-2", ... nobody owns or holds.
      */
-    assign(installId, isLive) {
+    assign(installId, isLive, preferred = [], own) {
         const now = new Date().toISOString();
         const known = this.installs[installId];
-        if (known) {
-            known.lastSeen = now;
+        const keep = (name, renamed = false) => {
+            this.installs[installId] = { name, firstSeen: known?.firstSeen ?? now, lastSeen: now, ...(renamed ? { renamed } : {}) };
             this.save();
-            return known.name;
+            return name;
+        };
+        if (known?.renamed && !isLive(known.name))
+            return keep(known.name, true);
+        for (const name of preferred) {
+            if (!name)
+                continue;
+            const owner = this.ownerOf(name);
+            if ((owner === undefined || owner === installId) && !isLive(name))
+                return keep(name);
         }
+        if (own && !isLive(own)) {
+            const owner = this.ownerOf(own);
+            if (owner === undefined || owner === installId || !this.installs[owner].renamed) {
+                // The old owner is offline; if it ever returns it is named afresh.
+                if (owner !== undefined && owner !== installId)
+                    delete this.installs[owner];
+                return keep(own);
+            }
+        }
+        if (known && !isLive(known.name))
+            return keep(known.name);
         let name = exports.FIRST_AUTO_NAME;
-        for (let n = 2; this.ownerOf(name) !== undefined || isLive(name); n++)
+        for (let n = 2; (this.ownerOf(name) ?? installId) !== installId || isLive(name); n++)
             name = `profile-${n}`;
-        this.installs[installId] = { name, firstSeen: now, lastSeen: now };
-        this.save();
-        return name;
+        return keep(name);
     }
     /**
      * Give the install currently named `from` the name `to`. Throws when `from`
@@ -83,6 +108,7 @@ class ProfileRegistry {
         if (this.ownerOf(target) !== undefined)
             throw new Error(`profile "${target}" is already taken`);
         this.installs[id].name = target;
+        this.installs[id].renamed = true;
         this.save();
         return target;
     }

package/dist/src/bridge/server.d.ts

@@ -28,6 +28,8 @@ export interface PairedProfile {
     /** store = the Chrome Web Store copy (Chrome updates it); unpacked = any other id. */
     extSource?: 'store' | 'unpacked';
 }
+/** Hub → peer: the proof was signed for an older connection of this browser. */
+export declare const STALE_RELAY_MESSAGE = "The browser reconnected while this command was being sent. Retry it.";
 export interface DisplacementInfo {
     oldExtId: string;
     newExtId: string;
@@ -48,6 +50,13 @@ export interface BridgeOptions {
     siteGrants?: boolean;
     /** The extension version bundled with this server: what an up-to-date copy reports. */
     latestExtensionVersion?: string;
+    /** Reads Chrome's profiles on this computer for naming; null turns it off (tests). */
+    chromeProfiles?: {
+        nameOf(extId: unknown, installId: string): string | undefined;
+        keys(): string[];
+    } | null;
+    /** The name the pairing helper hands every browser (this server's --profile). */
+    helperProfile?: string;
     port?: number;
     host?: string;
     heartbeatMs?: number;
@@ -115,6 +124,8 @@ export declare class BridgeServer {
      * the live allowlist, saves it, and pushes it to every browser and peer.
      */
     private applySiteGrant;
+    /** The person approved or revoked an app in a browser: wake waiting calls here and on peers. */
+    private approvalChanged;
     /** Peer side: the hub reports a grant made in a browser; mirror it in our own gate. */
     private mirrorSiteGrant;
     /** 'hub' or 'peer' once started; null before start and between roles. */

package/dist/src/bridge/server.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BridgeServer = exports.WEB_STORE_URL = void 0;
+exports.BridgeServer = exports.STALE_RELAY_MESSAGE = exports.WEB_STORE_URL = void 0;
 const client_auth_1 = require("../../shared/client-auth");
 const client_identity_1 = require("./client-identity");
+const chrome_profile_name_1 = require("./chrome-profile-name");
 /**
  * src/bridge/server.ts — the localhost WebSocket bridge.
  *
@@ -31,6 +32,7 @@ const profiles_1 = require("./profiles");
 const peer_1 = require("./peer");
 const site_grants_1 = require("./site-grants");
 const datadir_1 = require("./datadir");
+const person_wait_1 = require("../mcp/person-wait");
 /** Where a person gets the extension. */
 exports.WEB_STORE_URL = protocol_1.STORE_EXTENSION_URL;
 /** The routing label for a hello with no/blank profile — the back-compat default. */
@@ -69,6 +71,8 @@ function routeKey(profile) {
         return DEFAULT_PROFILE;
     }
 }
+/** Hub → peer: the proof was signed for an older connection of this browser. */
+exports.STALE_RELAY_MESSAGE = 'The browser reconnected while this command was being sent. Retry it.';
 const HELLO_TIMEOUT_MS = 5_000;
 const DEFAULT_HEARTBEAT_MS = 15_000;
 /** Max pre-auth frames a socket may send before a valid hello (anti-idle-hold). */
@@ -167,12 +171,20 @@ class BridgeServer {
             conn.push(frame);
         for (const peer of this.peers)
             this.sendPeer(peer, { type: 'peer_grant', host: site, allow });
+        (0, person_wait_1.notifyPersonStep)();
+    }
+    /** The person approved or revoked an app in a browser: wake waiting calls here and on peers. */
+    approvalChanged() {
+        for (const peer of this.peers)
+            this.sendPeer(peer, { type: 'peer_wake' });
+        (0, person_wait_1.notifyPersonStep)();
     }
     /** Peer side: the hub reports a grant made in a browser; mirror it in our own gate. */
     mirrorSiteGrant(host, allow) {
         // The hub already saved it (to its data dir, normally the same one).
         if (this.grants?.apply(host, allow, false))
             this.log(`${allow ? 'allowed' : 'removed'} site "${host}" (shared by the hub)`);
+        (0, person_wait_1.notifyPersonStep)();
     }
     /** 'hub' or 'peer' once started; null before start and between roles. */
     get role() {
@@ -390,13 +402,30 @@ class BridgeServer {
         if (!(0, client_auth_1.isHealthProbe)(intent)) {
             if (!this.hasConnection(profile))
                 throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
-            if (!challenge)
-                throw new types_1.ExecutorError('POLICY_DENIED', 'Update the extension and MCP server together: this browser cannot enforce client approval yet.');
+            if (!challenge) {
+                throw new types_1.ExecutorError('POLICY_DENIED', `The browser paired as "${profile}" is running extension code too old to check app approvals. ` +
+                    'Chrome can keep running old code even after the files update: open chrome://extensions in that Chrome profile ' +
+                    'and click Reload on MCP Browser Extension (or update it from the Chrome Web Store), then retry.');
+            }
             authorization = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, challenge);
         }
         const options = { ...opts, timeoutMs, authorization };
-        if (this.hub)
-            return this.hub.relay(method, params, options);
+        if (this.hub) {
+            try {
+                return await this.hub.relay(method, params, options);
+            }
+            catch (err) {
+                // The browser reconnected between our signature and the hub's send. The
+                // hub pushed its new challenge before refusing, so re-sign once.
+                if (!(err instanceof types_1.ExecutorError) || err.message !== exports.STALE_RELAY_MESSAGE || !authorization)
+                    throw err;
+                const fresh = this.hub?.profiles.find((p) => p.name === profile)?.approvalChallenge;
+                if (!this.hub || !fresh || fresh === challenge)
+                    throw err;
+                const resigned = ((0, client_identity_1.currentClientIdentity)() ?? this.clientIdentity).sign(intent, fresh);
+                return this.hub.relay(method, params, { ...options, authorization: resigned });
+            }
+        }
         return this.forwardCommand(method, params, options);
     }
     /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
@@ -408,6 +437,12 @@ class BridgeServer {
         if (!(0, client_auth_1.isHealthProbe)({ method, params }) && (!conn.hasCap(client_auth_1.CLIENT_APPROVAL_CAP) || !opts?.authorization)) {
             throw new types_1.ExecutorError('POLICY_DENIED', 'Signed client authorization and an updated extension are required.');
         }
+        // A peer signs with the challenge it last heard about. If this browser has
+        // reconnected since, Chrome would refuse the proof as stale: say so instead,
+        // so the peer re-signs (it already has the new challenge from broadcastState).
+        if (opts?.authorization && conn.approvalChallenge && opts.authorization.challenge !== conn.approvalChallenge) {
+            throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', exports.STALE_RELAY_MESSAGE);
+        }
         return conn.sendCommand(method, params, opts);
     }
     /** Whether the browser paired as `profile` advertised capability `cap`. A peer
@@ -665,15 +700,39 @@ class BridgeServer {
      */
     nameFor(frame) {
         const installId = (0, profiles_1.isValidInstallId)(frame.installId) ? frame.installId : undefined;
-        if (frame.profile && frame.profile.trim())
-            return { profile: routeKey(frame.profile), naming: 'options', installId };
+        const helperProfile = this.opts.helperProfile ?? (0, config_1.resolveProfile)();
+        let suggested;
+        if (typeof frame.suggestedProfile === 'string' && frame.suggestedProfile.trim()) {
+            try {
+                suggested = (0, config_1.sanitizeName)(frame.suggestedProfile, 'profile');
+            }
+            catch { /* ignore an unusable hint */ }
+        }
+        if (frame.profile && frame.profile.trim()) {
+            const label = routeKey(frame.profile);
+            // Extensions before 0.9.35 saved the helper's name as if it was typed, so
+            // every browser paired with Connect claimed it and knocked the others off.
+            // That exact name is a suggestion; any other label is the person's choice.
+            if (!installId || helperProfile === DEFAULT_PROFILE || label !== helperProfile) {
+                return { profile: label, naming: 'options', installId };
+            }
+            suggested = label;
+        }
         if (!installId)
             return { profile: DEFAULT_PROFILE, naming: 'legacy' };
         const heldByOther = (name) => {
             const conn = this.conns.get(name);
             return !!conn && conn.isOpen() && this.origins.get(name)?.installId !== installId;
         };
-        return { profile: this.registry.assign(installId, heldByOther), naming: 'auto', installId };
+        // Chrome won't tell an extension its profile, but we can look it up on disk.
+        const chrome = this.opts.chromeProfiles === null ? null
+            : this.opts.chromeProfiles ?? { nameOf: chrome_profile_name_1.chromeProfileName, keys: () => (0, chrome_profile_name_1.chromeProfileKeys)() };
+        const own = chrome?.nameOf(frame.ext?.id, installId);
+        const ownKey = own ? (0, chrome_profile_name_1.profileKeyFromChromeName)(own) : undefined;
+        // Never hand a browser the name of a different Chrome profile on this computer.
+        if (suggested && suggested !== ownKey && chrome?.keys().includes(suggested))
+            suggested = undefined;
+        return { profile: this.registry.assign(installId, heldByOther, [suggested], ownKey), naming: 'auto', installId };
     }
     /** Hub side: serve a joined peer's relayed commands against our browsers. */
     acceptPeer(ws, pid) {
@@ -758,6 +817,7 @@ class BridgeServer {
             approvalChallenge: origin.approvalChallenge,
             onEvent: this.opts.onEvent,
             onSiteGrant: (host, allow) => this.applySiteGrant(host, allow),
+            onApprovalChanged: () => this.approvalChanged(),
             onLog: (m) => this.log(m),
             onClose: () => {
                 // Only clear if a newer re-pair hasn't already replaced this slot. Look it

package/dist/src/mcp/person-wait.d.ts

@@ -0,0 +1,37 @@
+/**
+ * src/mcp/person-wait.ts — hold a tool call open while the PERSON approves the
+ * app or allows a site in Chrome, then continue on its own.
+ *
+ * Without this the agent gets an error, tells the person, and has to invent its
+ * own polling (shell sleeps, "I'll check again in a minute"). Waiting here means
+ * one tool call simply completes once the person clicks Approve/Allow.
+ */
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+export interface PersonWaitRequest {
+    signal?: AbortSignal;
+    progressToken?: string | number;
+    sendNotification?: (n: {
+        method: 'notifications/progress';
+        params: {
+            progressToken: string | number;
+            progress: number;
+            message: string;
+        };
+    }) => Promise<void>;
+}
+export declare function setPersonWaitForTesting(poll: number, wait: number): void;
+/**
+ * The person just approved an app or allowed a site: retry every waiting call
+ * now instead of on the next fallback poll.
+ */
+export declare function notifyPersonStep(): void;
+/** The person-only step a result is blocked on, or undefined when it is not. */
+export declare function personStep(result: CallToolResult): string | undefined;
+export declare const STILL_WAITING: string;
+/**
+ * Run `attempt` until it is no longer blocked on the person, the wait expires,
+ * or the call is cancelled. Only results that ran nothing (approval / site
+ * gate refusals) are retried. `retry` is true on every attempt after the
+ * first, so the caller can count one refusal per wait instead of one per poll.
+ */
+export declare function waitForPerson(attempt: (retry: boolean) => Promise<CallToolResult>, request: PersonWaitRequest): Promise<CallToolResult>;

package/dist/src/mcp/person-wait.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * src/mcp/person-wait.ts — hold a tool call open while the PERSON approves the
+ * app or allows a site in Chrome, then continue on its own.
+ *
+ * Without this the agent gets an error, tells the person, and has to invent its
+ * own polling (shell sleeps, "I'll check again in a minute"). Waiting here means
+ * one tool call simply completes once the person clicks Approve/Allow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STILL_WAITING = void 0;
+exports.setPersonWaitForTesting = setPersonWaitForTesting;
+exports.notifyPersonStep = notifyPersonStep;
+exports.personStep = personStep;
+exports.waitForPerson = waitForPerson;
+// A fallback only: an approval or site grant wakes the wait at once (below).
+let pollMs = 10_000;
+// Stay under the 60 s default tool timeout some MCP clients enforce.
+let waitMs = 45_000;
+function setPersonWaitForTesting(poll, wait) {
+    pollMs = Math.max(1, poll);
+    waitMs = Math.max(1, wait);
+}
+const wakers = new Set();
+/**
+ * The person just approved an app or allowed a site: retry every waiting call
+ * now instead of on the next fallback poll.
+ */
+function notifyPersonStep() {
+    for (const wake of [...wakers])
+        wake();
+}
+const APPROVAL = /Please approve "/;
+const SITE = /^\[POLICY_DENIED\] Please allow access to /;
+/** The person-only step a result is blocked on, or undefined when it is not. */
+function personStep(result) {
+    if (!result.isError)
+        return undefined;
+    const first = result.content[0];
+    const text = first?.type === 'text' ? first.text : '';
+    return APPROVAL.test(text) || SITE.test(text) ? text : undefined;
+}
+exports.STILL_WAITING = 'Still waiting for the person. Call the same tool again to keep waiting; it continues on its own once they approve. ' +
+    'Do not use shell sleeps or ask them to confirm in chat.';
+/**
+ * Run `attempt` until it is no longer blocked on the person, the wait expires,
+ * or the call is cancelled. Only results that ran nothing (approval / site
+ * gate refusals) are retried. `retry` is true on every attempt after the
+ * first, so the caller can count one refusal per wait instead of one per poll.
+ */
+async function waitForPerson(attempt, request) {
+    let result = await attempt(false);
+    let step = personStep(result);
+    if (!step)
+        return result;
+    const deadline = Date.now() + waitMs;
+    let progress = 0;
+    const report = async (message) => {
+        if (request.progressToken === undefined || !request.sendNotification || request.signal?.aborted)
+            return;
+        try {
+            await request.sendNotification({ method: 'notifications/progress', params: { progressToken: request.progressToken, progress: ++progress, message } });
+        }
+        catch { /* Progress is optional; the tool result still carries the outcome. */ }
+    };
+    await report(`${step} Waiting for this automatically.`);
+    while (Date.now() < deadline && !request.signal?.aborted) {
+        await new Promise((resolve) => {
+            const timer = setTimeout(done, Math.min(pollMs, Math.max(1, deadline - Date.now())));
+            function done() { clearTimeout(timer); wakers.delete(done); request.signal?.removeEventListener('abort', done); resolve(); }
+            wakers.add(done);
+            request.signal?.addEventListener('abort', done, { once: true });
+        });
+        if (request.signal?.aborted)
+            break;
+        result = await attempt(true);
+        const next = personStep(result);
+        if (!next)
+            return result;
+        // Approving the app can uncover the site gate; say what is awaited now.
+        if (next !== step)
+            await report(`${next} Waiting for this automatically.`);
+        step = next;
+    }
+    return { ...result, content: [...result.content, { type: 'text', text: exports.STILL_WAITING }] };
+}
+//# sourceMappingURL=person-wait.js.map

package/dist/src/mcp/server.js

@@ -38,6 +38,8 @@ const SERVER_VERSION = '0.1.0';
 exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, signed-in Chrome. " +
     'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you, then click Verify this device on the website. If it returns ACCESS_INPUT_REQUIRED, the local verification form opens automatically in the browser; also show its URL as a backup so the user can enter their email. Do not open the backup URL again or add another chat email prompt while that form is active. Do not fill it or read their email for them. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
     'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
+    'Approval and site refusals wait automatically: the tool call stays open (about 45 seconds) and continues on its own as soon as the person clicks Approve or Allow. Tell the person once. If it returns "Still waiting", call the same tool again; never use shell sleeps, timers or "I will check again later" messages, and never ask them to confirm in chat. ' +
+    'Chrome blocks every extension from Chrome Web Store pages (chromewebstore.google.com and chrome.google.com/webstore, including the developer dashboard): they fail with TARGET_GONE "The extensions gallery cannot be scripted". Do not ask the person to allow those sites; it cannot help. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +
@@ -46,6 +48,8 @@ exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, sig
     "To act on the user's current page, pass its tabId from tabs_list.";
 const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
     'When Chrome approval is required, show the app name and key fingerprint and ask the person to review App connections in the extension popup or Settings. Approval lasts eight hours. Never approve a client yourself; YOLO and email-verification bypass do not bypass Chrome approval. ' +
+    'Approval and site refusals wait automatically: the tool call stays open (about 45 seconds) and continues on its own as soon as the person clicks Approve or Allow. Tell the person once. If it returns "Still waiting", call the same tool again; never use shell sleeps, timers or "I will check again later" messages, and never ask them to confirm in chat. ' +
+    'Chrome blocks every extension from Chrome Web Store pages (chromewebstore.google.com and chrome.google.com/webstore, including the developer dashboard): they fail with TARGET_GONE "The extensions gallery cannot be scripted". Do not ask the person to allow those sites; it cannot help. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, relay its friendly one-line approval steps and wait for the person to allow it from the extension\'s toolbar icon. Never approve it yourself or enable all-site access. ' +
     "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";

package/dist/src/mcp/tools.d.ts

@@ -63,7 +63,9 @@ export declare function setProfileBridge(bridge: BridgeServer | null): void;
 export declare const TOOL_HANDLERS: Record<string, ToolHandler>;
 /** Reset limiter state — for tests that exercise the ceiling. */
 export declare function resetRateLimiter(): void;
-export declare function dispatchToolCall(name: string, rawArgs: unknown): Promise<CallToolResult>;
+export declare function dispatchToolCall(name: string, rawArgs: unknown, opts?: {
+    quietRefusal?: boolean;
+}): Promise<CallToolResult>;
 /** Assert the catalog and the dispatch table describe the same tool set. */
 export declare function assertNoDrift(): void;
 /** Register the tool surface; returns the names actually advertised. */

package/dist/src/mcp/tools.js

@@ -35,6 +35,7 @@ const policy_2 = require("../../shared/policy");
 const envelopes_1 = require("./envelopes");
 const limits_1 = require("./limits");
 const batch_1 = require("./batch");
+const person_wait_1 = require("./person-wait");
 const helpers_1 = require("./helpers");
 const redact_1 = require("./redact");
 const locate_1 = require("./locate");
@@ -1429,7 +1430,7 @@ const RETRY_SAFE_TOOLS = new Set([
 function isRetryableFault(name, err) {
     return err instanceof types_1.ExecutorError && err.code === 'EXTENSION_DISCONNECTED' && RETRY_SAFE_TOOLS.has(name);
 }
-async function dispatchToolCall(name, rawArgs) {
+async function dispatchToolCall(name, rawArgs, opts = {}) {
     // The allowlist is checked here, not only at registration, so a `batch` op
     // cannot reach a tool the operator kept off the surface.
     if (!isToolEnabled(name))
@@ -1442,10 +1443,17 @@ async function dispatchToolCall(name, rawArgs) {
     const started = Date.now();
     // One audit record per call, carried through async hops so a parallel `batch`
     // cannot cross-attribute one op's target URL to another's log line.
-    const { result: outcome } = await (0, audit_1.withAudit)(async (audit) => dispatchInner(name, handler, rawArgs, audit, started));
+    const { result: outcome } = await (0, audit_1.withAudit)(async (audit) => dispatchInner(name, handler, rawArgs, audit, started, opts.quietRefusal === true));
     return outcome;
 }
-async function dispatchInner(name, handler, rawArgs, audit, started) {
+async function dispatchInner(name, handler, rawArgs, audit, started, quietRefusal) {
+    // A person-wait poll that is still refused ran nothing; the first refusal
+    // was already counted, so recording every poll would log ~30 per wait.
+    const record = (result, extra) => {
+        if (quietRefusal && (0, person_wait_1.personStep)(result))
+            return;
+        recordHistory(name, rawArgs, !result.isError, extra);
+    };
     try {
         const mgr = (0, manager_1.getManager)();
         // Workspace-management tools run server-side and must work even with no
@@ -1470,13 +1478,14 @@ async function dispatchInner(name, handler, rawArgs, audit, started) {
             result = await handler((0, validators_1.asArgs)(rawArgs), { ex: reconnected, policy: mgr.policy });
             (0, log_1.logDebug)(`${name}: retry after reconnect succeeded`);
         }
-        recordHistory(name, rawArgs, !result.isError, { ms: Date.now() - started, audit });
+        record(result, { ms: Date.now() - started, audit });
         return result;
     }
     catch (err) {
         const message = errMessage(err);
-        recordHistory(name, rawArgs, false, { error: message, ms: Date.now() - started, audit });
-        return (0, envelopes_1.errorResult)(message);
+        const result = (0, envelopes_1.errorResult)(message);
+        record(result, { error: message, ms: Date.now() - started, audit });
+        return result;
     }
 }
 /** Assert the catalog and the dispatch table describe the same tool set. */
@@ -1544,17 +1553,25 @@ function registerTools(server, policy, accessGuard = access_1.requireAccess) {
             });
             if (accessError)
                 return accessError;
-            if (profileBridge?.hasActiveExtension()) {
-                const active = (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default';
-                const profile = profileBridge.hasConnection(active) ? active : profileBridge.pairedProfiles()[0]?.name;
-                try {
-                    await profileBridge.sendCommand('ping_probe', { requireClientApproval: true }, { profile });
+            // Approval and site refusals run nothing, so the call waits for the
+            // person here and continues once they click Approve or Allow.
+            const result = await (0, person_wait_1.waitForPerson)(async (retry) => {
+                if (profileBridge?.hasActiveExtension()) {
+                    const active = (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default';
+                    const profile = profileBridge.hasConnection(active) ? active : profileBridge.pairedProfiles()[0]?.name;
+                    try {
+                        await profileBridge.sendCommand('ping_probe', { requireClientApproval: true }, { profile });
+                    }
+                    catch (err) {
+                        return (0, envelopes_1.errorResult)(err instanceof Error ? err.message : 'Chrome client approval is required.');
+                    }
                 }
-                catch (err) {
-                    return (0, envelopes_1.errorResult)(err instanceof Error ? err.message : 'Chrome client approval is required.');
-                }
-            }
-            const result = await dispatchToolCall(d.name, args);
+                return dispatchToolCall(d.name, args, { quietRefusal: retry });
+            }, {
+                signal: extra.signal,
+                progressToken: extra._meta?.progressToken,
+                sendNotification: extra.sendNotification,
+            });
             if (verifiedNow)
                 result.content.unshift({ type: 'text', text: 'Email verified. MCP Browser Extension access is active.' });
             return result;

package/docs/CLIENT-APPROVAL.md

@@ -1,5 +1,11 @@
 # Client approval
 
+Related security steps: [Step 1: App and Website Approval](SECURITY-STEP-1.md),
+[Step 2: Optional Browser Permissions](SECURITY-STEP-2.md),
+[Step 3: Per-Action Approval Decision](SECURITY-STEP-3.md),
+[Step 4: Activity and Stop Access](SECURITY-STEP-4.md), and
+[Step 5: Download and Bridge Hardening](SECURITY-STEP-5.md).
+
 The extension requires a person to approve each new MCP app session in its Chrome
 popup or Settings before it can read or act on browser pages. This is independent of
 email verification, transport pairing, domain restrictions and client permission

package/extension-dist/background.js

@@ -424,7 +424,7 @@
     isConnected() {
       return this.state === "connected" && this.ws?.readyState === WebSocket.OPEN;
     }
-    connect(port, token, profile, installId, install) {
+    connect(port, token, profile, installId, install, suggestedProfile) {
       if (this.ws && (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING)) {
         return;
       }
@@ -448,6 +448,7 @@
           ext: { id: chrome.runtime.id, version: chrome.runtime.getManifest().version, chrome: chromeVersion() },
           profile: profile && profile.trim() ? profile.trim() : void 0,
           installId,
+          ...suggestedProfile ? { suggestedProfile } : {},
           ...install ? { install } : {},
           // This build gates fail-closed and reports tab URLs on results, so the
           // server may skip its pre-flight tabs_list. An older build omits this and
@@ -645,7 +646,7 @@
     return { ok: true };
   }
   function blockedDomainMessage(host) {
-    return `Please allow access to ${host}: Chrome \u2192 MCP Browser Extension icon \u2192 Allow next to ${host}, then try again.`;
+    return `Please allow access to ${host}: in Chrome, click the MCP Browser Extension icon (inside the puzzle-piece Extensions menu if it is not pinned), then click Allow next to ${host}.`;
   }
 
   // shared/fill-form.ts
@@ -3302,6 +3303,9 @@
   // extension/src/connect.ts
   var NATIVE_HOST = "com.mehmoodqureshi.mcp_browser_extension";
   async function fetchPairing() {
+    if (typeof chrome.runtime.sendNativeMessage !== "function") {
+      return { ok: false, error: "restart_needed", message: "Finishing setup. Click Connect again if this stays." };
+    }
     try {
       const reply = await chrome.runtime.sendNativeMessage(NATIVE_HOST, { type: "pairing" });
       return reply ?? { ok: false, message: "The helper gave no answer." };
@@ -3321,8 +3325,9 @@
     await chrome.storage.local.set({
       wsPort: reply.port,
       token: reply.token,
-      // The server's own --profile when it set one; otherwise let the server name us.
-      ...reply.profile ? { profile: reply.profile } : {},
+      // The server's own --profile, as a suggestion only: another browser may
+      // already use that name, and taking it over would disconnect that one.
+      suggestedProfile: reply.profile ?? "",
       pairingSource: "native"
     });
   }
@@ -3338,8 +3343,43 @@
   }
 
   // extension/src/sw/background.ts
+  var PAIR_AFTER_RESTART_KEY = "pairAfterRestart";
+  var commandsRunning = 0;
+  var updateReady = false;
+  var updateCheckedFor = "";
+  function runningVersion() {
+    return true ? "0.9.35" : chrome.runtime.getManifest().version;
+  }
+  function isNewer(a, b) {
+    const parse = (v) => (/^(\d+)\.(\d+)\.(\d+)/.exec(v) ?? []).slice(1).map(Number);
+    const x = parse(a);
+    const y = parse(b);
+    if (x.length !== 3 || y.length !== 3) return false;
+    for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i];
+    return false;
+  }
+  function checkForStoreUpdate(latest) {
+    if (!latest || latest === updateCheckedFor || !isNewer(latest, runningVersion())) return;
+    updateCheckedFor = latest;
+    void chrome.runtime.requestUpdateCheck().catch(() => void 0);
+  }
+  function applyUpdateWhenIdle() {
+    updateReady = true;
+    if (commandsRunning > 0) return;
+    console.info("[mcp-browser-extension] applying the downloaded update");
+    chrome.runtime.reload();
+  }
+  chrome.runtime.onUpdateAvailable.addListener(() => applyUpdateWhenIdle());
   var pendingClients = 0;
   var pendingFeatures = 0;
+  var seenPendingClients = {};
+  var seenMissingFeatures = {};
+  function newlyPending(seen, now) {
+    const first = !seen.ids;
+    const added = now.some((id) => !seen.ids?.has(id));
+    seen.ids = new Set(now);
+    return !first && added;
+  }
   var KEEPALIVE_ALARM = "chrome-mcp-keepalive";
   var MAX_BLOCKED = 10;
   var currentPolicy = null;
@@ -3366,7 +3406,13 @@
     reconnectAttempt = 0;
   }
   var ws = new WsClient({
-    onCommand: (cmd, reply) => void router.dispatch(cmd, reply),
+    onCommand: (cmd, reply) => {
+      commandsRunning++;
+      void router.dispatch(cmd, reply).finally(() => {
+        commandsRunning--;
+        if (updateReady) applyUpdateWhenIdle();
+      });
+    },
     onState: (state) => {
       void persistState(state);
       if (state === "connected") clearReconnect();
@@ -3391,7 +3437,10 @@
     onProfile: (profile) => void chrome.storage.local.set({ pairedProfile: profile }),
     onGranted: (granted) => void chrome.storage.local.set({ grantedSites: granted }),
     onBlocked: (host, method) => void rememberBlocked(host, method),
-    onLatestExtension: (version) => void chrome.storage.local.set({ latestExtension: version }),
+    onLatestExtension: (version) => {
+      void chrome.storage.local.set({ latestExtension: version });
+      checkForStoreUpdate(version);
+    },
     log: (m) => console.debug("[mcp-browser-extension]", m)
   });
   var approvals = new ClientApprovals({
@@ -3401,8 +3450,11 @@
     },
     challenge: () => ws.approvalChallenge,
     changed: (clients) => {
-      pendingClients = clients.filter((c) => c.state === "pending" && c.expiresAt > Date.now()).length;
+      const pending = clients.filter((c) => c.state === "pending" && c.expiresAt > Date.now());
+      pendingClients = pending.length;
       reflectBadge(ws.state);
+      if (newlyPending(seenPendingClients, pending.map((c) => c.id))) void showPopup();
+      if (ws.isConnected()) ws.send({ type: "approval_changed", v: PROTOCOL_VERSION });
     }
   });
   var activity = new ActivityLog({
@@ -3476,7 +3528,7 @@
       const res = await fetch(chrome.runtime.getURL("manifest.json"), { cache: "no-store" });
       if (!res.ok) return;
       const onDisk = await res.json();
-      const loaded = chrome.runtime.getManifest().version;
+      const loaded = true ? "0.9.35" : chrome.runtime.getManifest().version;
       if (typeof onDisk.version !== "string" || onDisk.version === loaded) return;
       const { reloadedFor } = await chrome.storage.local.get("reloadedFor");
       if (reloadedFor === onDisk.version) return;
@@ -3493,15 +3545,25 @@
     return fresh;
   }
   async function getConfig() {
-    const { wsPort, token, profile, installId } = await chrome.storage.local.get([
+    const { wsPort, token, profile, suggestedProfile, pairingSource, installId } = await chrome.storage.local.get([
       "wsPort",
       "token",
       "profile",
+      "suggestedProfile",
+      "pairingSource",
       "installId"
     ]);
     if (typeof wsPort === "number" && wsPort > 0 && typeof token === "string" && token.length > 0) {
       const label = typeof profile === "string" ? profile.trim() : "";
-      return { wsPort, token, profile: label, installId: await ensureInstallId(installId) };
+      const suggested = typeof suggestedProfile === "string" ? suggestedProfile.trim() : "";
+      const fromHelper = pairingSource === "native" && label !== "";
+      return {
+        wsPort,
+        token,
+        profile: fromHelper ? "" : label,
+        suggestedProfile: suggested || (fromHelper ? label : ""),
+        installId: await ensureInstallId(installId)
+      };
     }
     return null;
   }
@@ -3518,7 +3580,8 @@
   }
   async function rememberBlocked(host, method) {
     const { blockedSites, dismissedSites } = await chrome.storage.local.get(["blockedSites", "dismissedSites"]);
-    const prior = (Array.isArray(blockedSites) ? blockedSites : []).filter((b) => b.host !== host);
+    const listed = Array.isArray(blockedSites) ? blockedSites : [];
+    const prior = listed.filter((b) => b.host !== host);
     const next = [{ host, method, at: Date.now() }, ...prior].slice(0, MAX_BLOCKED);
     await chrome.storage.local.set({
       blockedSites: next,
@@ -3526,7 +3589,30 @@
     });
     pendingBlocked = next.length;
     reflectBadge(ws.state);
+    if (prior.length === listed.length) void showPopup();
   }
+  var POPUP_OWED_KEY = "popupOwed";
+  async function showPopup() {
+    try {
+      const open = await chrome.runtime.getContexts({ contextTypes: [chrome.runtime.ContextType.POPUP] });
+      if (open.length) return;
+      if (!(await chrome.windows.getLastFocused()).focused) {
+        await chrome.storage.session.set({ [POPUP_OWED_KEY]: true });
+        return;
+      }
+      await chrome.action.openPopup();
+    } catch {
+    }
+  }
+  chrome.windows.onFocusChanged.addListener((windowId) => {
+    if (windowId === chrome.windows.WINDOW_ID_NONE) return;
+    void (async () => {
+      if (!(await chrome.storage.session.get(POPUP_OWED_KEY))[POPUP_OWED_KEY]) return;
+      await chrome.storage.session.remove(POPUP_OWED_KEY);
+      if (await chrome.action.getBadgeText({}) !== "?") return;
+      await chrome.action.openPopup({ windowId });
+    })().catch(() => void 0);
+  });
   var pendingBlocked = 0;
   void chrome.storage.local.get("blockedSites").then(({ blockedSites }) => {
     pendingBlocked = Array.isArray(blockedSites) ? blockedSites.length : 0;
@@ -3582,7 +3668,7 @@
     const cfg = await getConfig();
     if (!cfg) return;
     const install = await installType();
-    if (!access.stopped) ws.connect(cfg.wsPort, cfg.token, cfg.profile, cfg.installId, install);
+    if (!access.stopped) ws.connect(cfg.wsPort, cfg.token, cfg.profile, cfg.installId, install, cfg.suggestedProfile);
   }
   async function keepalivePulse() {
     await chrome.storage.local.get("connState");
@@ -3627,8 +3713,10 @@
     const requested = Array.isArray(saved) ? saved.filter((p) => typeof p === "string" && p in OPTIONAL_FEATURES) : [];
     const missing = await Promise.all(requested.map(async (permission) => !await chrome.permissions.contains({ permissions: [permission] })));
     if (generation !== featureBadgeGeneration) return;
-    pendingFeatures = missing.filter(Boolean).length;
+    const stillMissing = requested.filter((_, i) => missing[i]);
+    pendingFeatures = stillMissing.length;
     reflectBadge(ws.state);
+    if (newlyPending(seenMissingFeatures, stillMissing)) void showPopup();
   }
   chrome.permissions.onAdded.addListener((permissions) => {
     void (async () => {
@@ -3643,9 +3731,9 @@
     if (area === "local" && changes[FEATURE_REQUESTS_KEY]) void refreshFeatureBadge();
     if (area === "local" && changes.tabBorder?.newValue === false) void border.clearAll();
     if (area === "local" && changes[PROXY_STORAGE_KEY]) void syncProxy();
-    if (area === "local" && (changes.wsPort || changes.token || changes.profile)) {
+    if (area === "local" && (changes.wsPort || changes.token || changes.profile || changes.suggestedProfile)) {
       if (ws.state === "unauthorized" || ws.state === "superseded") ws.state = "idle";
-      if (changes.profile) ws.close();
+      if (changes.profile || changes.suggestedProfile) ws.close();
       clearReconnect();
       void ensureConnected();
     }
@@ -3657,6 +3745,12 @@
         return;
       }
       void requestPairingFromClick().then(async (result) => {
+        if (!result.ok && result.error === "restart_needed") {
+          await chrome.storage.local.set({ [PAIR_AFTER_RESTART_KEY]: true });
+          reply({ ok: true });
+          setTimeout(() => chrome.runtime.reload(), 200);
+          return;
+        }
         if (!result.ok) {
           reply(result);
           return;
@@ -3683,7 +3777,9 @@
       void operation.then((changed) => reply({
         ok: changed || !msg.allow,
         ...!changed && msg.allow ? { error: "No access was added. You can allow it whenever you are ready." } : {}
-      }), () => reply({ ok: false, error: "Could not change this permission. Please try again." }));
+      }), () => reply({ ok: false, error: "Could not change this permission. Please try again." })).finally(() => {
+        if (msg.allow) void reopenPopup(sender);
+      });
       return true;
     }
     if (["access_stop", "access_resume", "activity_clear"].includes(msg?.type)) {
@@ -3761,7 +3857,9 @@
         ws.send(frame);
         if (currentPolicy) await onAllowlist(currentPolicy);
         reply({ ok: true });
-      })().catch(() => reply({ ok: false, error: "Could not update this website permission. Please try again." }));
+      })().catch(() => reply({ ok: false, error: "Could not update this website permission. Please try again." })).finally(() => {
+        if (msg.type === "site_access" && msg.allow) void reopenPopup(sender);
+      });
       return true;
     }
     const fromOwnPage = sender.id === chrome.runtime.id && sender.url?.startsWith(chrome.runtime.getURL(""));
@@ -3791,6 +3889,10 @@
       return true;
     }
   });
+  async function reopenPopup(sender) {
+    if (sender.url !== chrome.runtime.getURL("popup.html")) return;
+    await showPopup();
+  }
   async function healFromHelper() {
     try {
       if (!await chrome.permissions.contains({ permissions: ["nativeMessaging"] })) return false;
@@ -3828,6 +3930,10 @@
     await chrome.alarms.create(KEEPALIVE_ALARM, { periodInMinutes: 0.5 });
     await syncProxy();
     await reloadIfFilesChanged();
+    if ((await chrome.storage.local.get(PAIR_AFTER_RESTART_KEY))[PAIR_AFTER_RESTART_KEY]) {
+      await chrome.storage.local.remove(PAIR_AFTER_RESTART_KEY);
+      if (await healFromHelper()) return;
+    }
     if (await adoptBundledPairing()) return;
     if (!await getConfig() && await healFromHelper()) return;
     await ensureConnected();

package/extension-dist/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "MCP Browser Extension – AI agent in your logged-in Chrome",
-  "version": "0.9.32",
+  "version": "0.9.35",
   "description": "Lets your AI agent use the Chrome you are signed into, through a local MCP server. Deny-all by default.",
   "homepage_url": "https://mcp-browser-extension.com",
   "minimum_chrome_version": "116",

package/extension-dist/options.js

@@ -563,13 +563,17 @@
     connectEl.textContent = "Connecting\u2026";
     const res = await connectWithOneClick();
     connectEl.disabled = false;
-    connectEl.textContent = "Connect";
     connectMsgEl.className = res.ok ? "hint" : "hint error";
-    connectMsgEl.textContent = res.ok ? "Connecting\u2026" : res.message ?? "Could not connect.";
+    connectMsgEl.textContent = res.ok ? "" : res.message ?? "Could not connect.";
+    const { connState } = await chrome.storage.local.get("connState");
+    render3(typeof connState === "string" ? connState : "connecting");
   });
   function render3(state) {
     quickEl.hidden = false;
     if (!connectEl.disabled) connectEl.textContent = state === "connected" ? "Connect again" : "Connect";
+    if (!connectMsgEl.classList.contains("error")) {
+      connectMsgEl.textContent = state === "connected" ? "Connected." : state === "connecting" ? "Connecting\u2026" : "";
+    }
     const labels = {
       connected: "connected",
       connecting: "\u2026 connecting",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-browser-extension",
   "mcpName": "io.github.Mehmoodqureshi/mcp-browser-extension",
-  "version": "0.9.33",
+  "version": "0.9.35",
   "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
@@ -78,6 +78,6 @@
     "typescript": "^5.7.2"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }