mcp-browser-extension 0.9.35 → 0.9.38

package/dist/src/bridge/server.js

@@ -81,8 +81,6 @@ const MAX_PREAUTH_FRAMES = 10;
 const PORT_WAIT_MS = 4_000;
 /** Pause between port-bind retries while waiting for the old listener to exit. */
 const PORT_RETRY_MS = 250;
-/** Bridge frames are small JSON control messages; cap unauthenticated memory use. */
-const MAX_BRIDGE_FRAME_BYTES = 4 * 1024 * 1024;
 /** Native clients omit Origin; Chrome extensions use their own isolated origin. */
 function allowBridgeOrigin(origin) {
     return origin === undefined || /^chrome-extension:\/\/[a-p]{32}$/.test(origin);
@@ -319,7 +317,7 @@ class BridgeServer {
             const wss = new ws_1.WebSocketServer({
                 host,
                 port,
-                maxPayload: MAX_BRIDGE_FRAME_BYTES,
+                maxPayload: protocol_1.MAX_BRIDGE_FRAME_BYTES,
                 perMessageDeflate: false,
                 verifyClient: ({ origin }) => allowBridgeOrigin(origin || undefined),
             });
@@ -393,6 +391,11 @@ class BridgeServer {
      */
     async sendCommand(method, params, opts) {
         const profile = routeKey(opts?.profile);
+        const identity = (0, client_identity_1.currentClientIdentity)();
+        identity?.assertAccess?.();
+        if (identity?.profile && identity.profile !== profile) {
+            throw new types_1.ExecutorError('POLICY_DENIED', 'This phone is paired with a different browser profile.');
+        }
         const timeoutMs = opts?.timeoutMs ?? (0, connection_1.defaultTimeoutFor)(method);
         const intent = { v: protocol_1.PROTOCOL_VERSION, method, params, tabId: opts?.tabId, timeoutMs };
         const challenge = this.hub
@@ -429,13 +432,23 @@ class BridgeServer {
         return this.forwardCommand(method, params, options);
     }
     /** Never sign a peer's request using the hub's identity. Chrome verifies its original proof. */
-    async forwardCommand(method, params, opts) {
+    async forwardCommand(method, params, opts, peerPid) {
         const profile = routeKey(opts?.profile);
         const conn = this.conns.get(profile);
         if (!conn?.isOpen())
             throw new types_1.ExecutorError('EXTENSION_DISCONNECTED', this.noPairMessage(profile));
-        if (!(0, client_auth_1.isHealthProbe)({ method, params }) && (!conn.hasCap(client_auth_1.CLIENT_APPROVAL_CAP) || !opts?.authorization)) {
-            throw new types_1.ExecutorError('POLICY_DENIED', 'Signed client authorization and an updated extension are required.');
+        if (!(0, client_auth_1.isHealthProbe)({ method, params })) {
+            if (!conn.hasCap(client_auth_1.CLIENT_APPROVAL_CAP)) {
+                throw new types_1.ExecutorError('POLICY_DENIED', `Signed client authorization and an updated extension are required. The browser paired as "${profile}" ` +
+                    'runs an extension too old to check app approvals: update MCP Browser Extension from the Chrome Web Store ' +
+                    '(or click Reload on it in chrome://extensions), then retry.');
+            }
+            if (!opts?.authorization) {
+                throw new types_1.ExecutorError('POLICY_DENIED', `Signed client authorization is missing: ${peerPid === undefined ? 'an AI app on this computer' : `an AI app on this computer (process ${peerPid})`} ` +
+                    'is running an MCP Browser Extension server older than 0.9.32, which cannot sign browser commands. ' +
+                    'In that app\'s MCP settings start "npx -y mcp-browser-extension@latest" (remove any pinned older version), ' +
+                    'then fully quit and reopen the app.');
+            }
         }
         // A peer signs with the challenge it last heard about. If this browser has
         // reconnected since, Chrome would refuse the proof as stale: say so instead,
@@ -449,7 +462,7 @@ class BridgeServer {
      *  cannot see the hub's handshake, so it answers false (the conservative path). */
     hasCap(profile, cap) {
         if (this.hub)
-            return false;
+            return cap === protocol_1.WIRE_CAP_SITE_CHECKS && this.hub.profiles.some((p) => p.name === routeKey(profile) && p.siteChecks === true);
         const conn = this.conns.get(routeKey(profile));
         return !!conn?.isOpen() && conn.hasCap(cap);
     }
@@ -559,6 +572,7 @@ class BridgeServer {
             const o = this.origins.get(name);
             out.push({
                 name,
+                ...(conn.hasCap(protocol_1.WIRE_CAP_SITE_CHECKS) ? { siteChecks: true } : {}),
                 naming: o?.naming ?? 'legacy',
                 ...(includeChallenge && conn.approvalChallenge ? { approvalChallenge: conn.approvalChallenge } : {}),
                 ...(o?.extVersion ? { extVersion: o.extVersion } : {}),
@@ -701,6 +715,13 @@ class BridgeServer {
     nameFor(frame) {
         const installId = (0, profiles_1.isValidInstallId)(frame.installId) ? frame.installId : undefined;
         const helperProfile = this.opts.helperProfile ?? (0, config_1.resolveProfile)();
+        // Chrome won't tell an extension its profile, but we can look it up on disk.
+        const chrome = !installId || this.opts.chromeProfiles === null ? null
+            : this.opts.chromeProfiles ?? { nameOf: chrome_profile_name_1.chromeProfileName, keys: () => (0, chrome_profile_name_1.chromeProfileKeys)() };
+        const own = installId ? chrome?.nameOf(frame.ext?.id, installId) : undefined;
+        const ownKey = own ? (0, chrome_profile_name_1.profileKeyFromChromeName)(own) : undefined;
+        let otherProfiles;
+        const isOtherChromeProfile = (name) => name !== ownKey && (otherProfiles ??= chrome?.keys() ?? []).includes(name);
         let suggested;
         if (typeof frame.suggestedProfile === 'string' && frame.suggestedProfile.trim()) {
             try {
@@ -712,8 +733,10 @@ class BridgeServer {
             const label = routeKey(frame.profile);
             // Extensions before 0.9.35 saved the helper's name as if it was typed, so
             // every browser paired with Connect claimed it and knocked the others off.
-            // That exact name is a suggestion; any other label is the person's choice.
-            if (!installId || helperProfile === DEFAULT_PROFILE || label !== helperProfile) {
+            // A label that is the helper's name, or another Chrome profile's name on
+            // this computer, is a suggestion; any other label is the person's choice.
+            const fromHelper = helperProfile !== DEFAULT_PROFILE && label === helperProfile;
+            if (!installId || !(fromHelper || isOtherChromeProfile(label))) {
                 return { profile: label, naming: 'options', installId };
             }
             suggested = label;
@@ -724,13 +747,8 @@ class BridgeServer {
             const conn = this.conns.get(name);
             return !!conn && conn.isOpen() && this.origins.get(name)?.installId !== installId;
         };
-        // Chrome won't tell an extension its profile, but we can look it up on disk.
-        const chrome = this.opts.chromeProfiles === null ? null
-            : this.opts.chromeProfiles ?? { nameOf: chrome_profile_name_1.chromeProfileName, keys: () => (0, chrome_profile_name_1.chromeProfileKeys)() };
-        const own = chrome?.nameOf(frame.ext?.id, installId);
-        const ownKey = own ? (0, chrome_profile_name_1.profileKeyFromChromeName)(own) : undefined;
         // Never hand a browser the name of a different Chrome profile on this computer.
-        if (suggested && suggested !== ownKey && chrome?.keys().includes(suggested))
+        if (suggested && isOtherChromeProfile(suggested))
             suggested = undefined;
         return { profile: this.registry.assign(installId, heldByOther, [suggested], ownKey), naming: 'auto', installId };
     }
@@ -740,13 +758,13 @@ class BridgeServer {
         this.log(`mcp-browser-extension pid ${pid ?? '?'} joined as a peer (${this.peers.size} sharing these browsers)`);
         this.sendPeer(ws, { type: 'peer_welcome', hubPid: process.pid });
         this.sendPeer(ws, { type: 'peer_state', profiles: this.pairedProfiles(true) });
-        ws.on('message', (raw) => this.handlePeerFrame(ws, raw.toString()));
+        ws.on('message', (raw) => this.handlePeerFrame(ws, raw.toString(), pid));
         ws.on('close', () => this.peers.delete(ws));
         ws.on('error', () => {
             /* the close that follows cleans up */
         });
     }
-    handlePeerFrame(ws, raw) {
+    handlePeerFrame(ws, raw, pid) {
         let frame;
         try {
             frame = JSON.parse(raw);
@@ -758,9 +776,9 @@ class BridgeServer {
             work.then((data) => this.sendPeer(ws, { type: 'relay_result', id, ok: true, data }), (err) => this.sendPeer(ws, (0, peer_1.relayError)(id, err)));
         };
         if (frame.type === 'relay')
-            answer(frame.id, this.forwardCommand(frame.method, frame.params ?? {}, frame.opts));
+            answer(frame.id, this.forwardCommand(frame.method, frame.params ?? {}, frame.opts, pid));
         else if (frame.type === 'peer_rename')
-            answer(frame.id, this.forwardCommand('ping_probe', { requireClientApproval: true, renameProfile: { from: frame.from, to: frame.to } }, { profile: frame.from, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe'), authorization: frame.authorization }).then(() => this.renameApprovedProfile(frame.from, frame.to)));
+            answer(frame.id, this.forwardCommand('ping_probe', { requireClientApproval: true, renameProfile: { from: frame.from, to: frame.to } }, { profile: frame.from, timeoutMs: (0, connection_1.defaultTimeoutFor)('ping_probe'), authorization: frame.authorization }, pid).then(() => this.renameApprovedProfile(frame.from, frame.to)));
         else if (frame.type === 'peer_blocked' && typeof frame.host === 'string')
             this.noteBlocked(frame.host, String(frame.method ?? ''));
     }
@@ -838,6 +856,7 @@ class BridgeServer {
             type: 'welcome',
             v: protocol_1.PROTOCOL_VERSION,
             serverVersion: this.opts.serverVersion,
+            siteChecks: this.grants !== null,
             sessionId,
             heartbeatMs: this.heartbeatMs,
             policy: this.policy,

package/dist/src/bridge/workspace.d.ts

@@ -12,6 +12,7 @@
  * switch) is logged to stderr and swallowed so it can never break a tool call.
  */
 import { type Workspace } from './datadir';
+export declare const withWorkspace: <T>(workspace: Workspace, fn: () => T) => T;
 /** Install the initial workspace at boot (from cli.ts). */
 export declare function setActiveWorkspace(w: Workspace): void;
 /** The current workspace. Throws if the boot path never installed one. */

package/dist/src/bridge/workspace.js

@@ -13,6 +13,7 @@
  * switch) is logged to stderr and swallowed so it can never break a tool call.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.withWorkspace = void 0;
 exports.setActiveWorkspace = setActiveWorkspace;
 exports.getActiveWorkspace = getActiveWorkspace;
 exports.peekActiveWorkspace = peekActiveWorkspace;
@@ -25,6 +26,7 @@ exports.captureDownload = captureDownload;
 exports.appendHistory = appendHistory;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_async_hooks_1 = require("node:async_hooks");
 const config_1 = require("../config");
 // `mcp/log` (not `mcp/server`) so this stays free of the server import cycle
 // while still honouring `--log-level silent`.
@@ -32,6 +34,9 @@ const log_1 = require("../mcp/log");
 const download_1 = require("../../shared/download");
 const datadir_1 = require("./datadir");
 let active = null;
+const scoped = new node_async_hooks_1.AsyncLocalStorage();
+const withWorkspace = (workspace, fn) => scoped.run(workspace, fn);
+exports.withWorkspace = withWorkspace;
 /** Monotonic counter so saved result/screenshot filenames sort in capture order. */
 let seq = 0;
 /** Install the initial workspace at boot (from cli.ts). */
@@ -40,13 +45,14 @@ function setActiveWorkspace(w) {
 }
 /** The current workspace. Throws if the boot path never installed one. */
 function getActiveWorkspace() {
-    if (!active)
+    const workspace = peekActiveWorkspace();
+    if (!workspace)
         throw new Error('no active workspace (server not fully booted)');
-    return active;
+    return workspace;
 }
 /** The current workspace, or null before boot completes (for non-throwing callers). */
 function peekActiveWorkspace() {
-    return active;
+    return scoped.getStore() ?? active;
 }
 /** Reset for tests. */
 function resetActiveWorkspaceForTesting() {
@@ -60,6 +66,8 @@ function resetActiveWorkspaceForTesting() {
  * the resolved workspace.
  */
 function switchWorkspace(opts) {
+    if (scoped.getStore())
+        throw new Error('A paired phone cannot switch browser or task workspaces.');
     const cur = getActiveWorkspace();
     const profile = opts.profile === undefined ? cur.profile : (0, config_1.sanitizeName)(opts.profile, 'profile');
     // A profile switch resets the task to "default" unless the caller names one.

package/dist/src/cli.js

@@ -28,6 +28,9 @@ const server_2 = require("./mcp/server");
 const http_1 = require("./remote/http");
 const key_1 = require("./remote/key");
 const tunnel_1 = require("./remote/tunnel");
+const relay_1 = require("./remote/relay");
+const phone_pairing_1 = require("./remote/phone-pairing");
+const phone_control_1 = require("./remote/phone-control");
 const tools_1 = require("./mcp/tools");
 const telemetry_1 = require("./telemetry");
 const auto_update_1 = require("./auto-update");
@@ -475,6 +478,10 @@ async function main() {
  */
 async function serveRemote(cfg, dataDir, stopBridge) {
     const key = (0, key_1.resolveRemoteKey)(dataDir, { rotate: cfg.rotateRemoteKey });
+    const phonePairing = new phone_pairing_1.PhonePairing(dataDir, cfg.profile);
+    if (cfg.rotateRemoteKey)
+        for (const phone of phonePairing.state().devices)
+            phonePairing.remove(phone.id);
     if (cfg.rotateRemoteKey)
         (0, server_2.logErr)('remote key rotated: every earlier connector URL stops working.');
     const http = await (0, http_1.startHttpMcp)({
@@ -484,15 +491,20 @@ async function serveRemote(cfg, dataDir, stopBridge) {
         policy: cfg.policy,
         log: (m) => (0, server_2.logErr)(m),
         accessGuard: cfg.noEmailVerification ? access_1.bypassEmailVerification : undefined,
+        phonePairing,
+        phoneChat: process.env.MBE_PHONE_CODEX === '1' || process.env.MBE_PHONE_CHAT === '1',
     });
+    const phoneControl = await (0, phone_control_1.startPhoneControl)(phonePairing).catch(async (err) => { await http.close(); throw err; });
     let tunnel = null;
+    let relay = null;
     let shuttingDown = false;
     const shutdown = () => {
         if (shuttingDown)
             return;
         shuttingDown = true;
         tunnel?.stop();
-        exitWithDeadline(Promise.allSettled([http.close(), stopBridge()]));
+        relay?.stop();
+        exitWithDeadline(Promise.allSettled([phoneControl.close(), http.close(), stopBridge()]));
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
@@ -502,34 +514,65 @@ async function serveRemote(cfg, dataDir, stopBridge) {
                 localPort: http.port,
                 log: (m) => (0, server_2.logErr)(m),
                 onExit: (code) => {
+                    phonePairing.setPublicUrl();
                     if (shuttingDown)
                         return;
                     (0, server_2.logErr)(`the tunnel closed (cloudflared exit ${code}); remote clients are cut off. Restart to get a new URL.`);
                 },
             });
+            phonePairing.setPublicUrl(tunnel.url);
         }
         catch (err) {
+            await phoneControl.close();
             await http.close();
             throw err;
         }
     }
-    const base = tunnel ? tunnel.url : `http://127.0.0.1:${http.port}`;
-    const lines = [
-        '',
-        tunnel ? 'MCP Browser Extension is reachable from anywhere.' : `MCP Browser Extension is serving MCP over HTTP on 127.0.0.1:${http.port}.`,
-        '',
-        'Connector URL (paste into claude.ai > Settings > Connectors, ChatGPT, or any MCP client):',
-        `  ${base}/mcp/${key}`,
-        '',
-        'Or send the key as a header, e.g. for Claude Code on another computer:',
-        `  claude mcp add --transport http browser ${base}/mcp --header "Authorization: Bearer ${key}"`,
-        '',
-        'Anyone with this URL can drive this Chrome within the allowed sites. Keep it private.',
-        'Cut everyone off: restart with --rotate-remote-key.',
-        ...(tunnel ? ['The tunnel URL changes every time this starts.'] : []),
-        '',
-    ];
-    process.stdout.write(`${lines.join('\n')}\n`);
+    const printConnector = (base, headline, notes = []) => {
+        const lines = [
+            '',
+            headline,
+            '',
+            'Connector URL (paste into claude.ai > Settings > Connectors, ChatGPT, or any MCP client):',
+            `  ${base}/mcp/${key}`,
+            '',
+            'Or send the key as a header, e.g. for Claude Code on another computer:',
+            `  claude mcp add --transport http browser ${base}/mcp --header "Authorization: Bearer ${key}"`,
+            '',
+            'Anyone with this URL can drive this Chrome within the allowed sites. Keep it private.',
+            'Cut everyone off: restart with --rotate-remote-key.',
+            ...notes,
+            '',
+        ];
+        process.stdout.write(`${lines.join('\n')}\n`);
+    };
+    if (cfg.relay) {
+        // The relay names the public address once it accepts this computer; print
+        // the connector then, and only once (the link reconnects after outages).
+        let announced = false;
+        (0, server_2.logErr)(`linking to the relay at ${cfg.relay} (relay token: ${(0, relay_1.relayTokenPath)(dataDir)})`);
+        relay = (0, relay_1.connectRelay)({
+            url: cfg.relay,
+            token: (0, relay_1.resolveRelayToken)(dataDir),
+            localPort: http.port,
+            log: (m) => (0, server_2.logErr)(m),
+            onOffline: () => phonePairing.setPublicUrl(),
+            onReady: (publicUrl) => {
+                try {
+                    phonePairing.setPublicUrl(publicUrl);
+                }
+                catch {
+                    (0, server_2.logErr)('phone pairing requires an HTTPS relay address');
+                }
+                if (announced)
+                    return (0, server_2.logErr)('relay link restored');
+                announced = true;
+                printConnector(publicUrl.replace(/\/+$/, ''), 'MCP Browser Extension is reachable from anywhere through your relay.', ['The address stays the same; this computer reconnects to the relay on its own.']);
+            },
+        });
+        return;
+    }
+    printConnector(tunnel ? tunnel.url : `http://127.0.0.1:${http.port}`, tunnel ? 'MCP Browser Extension is reachable from anywhere.' : `MCP Browser Extension is serving MCP over HTTP on 127.0.0.1:${http.port}.`, tunnel ? ['The tunnel URL changes every time this starts.'] : []);
 }
 main().catch((err) => {
     // Port-busy and bad-flag failures carry a plain-English message already

package/dist/src/config.d.ts

@@ -53,6 +53,8 @@ export interface CliConfig {
     httpPort: number;
     /** `--tunnel`: also open a Cloudflare quick tunnel to the HTTP port. Implies `--http`. */
     tunnel: boolean;
+    /** `--relay <url>`: also link to a relay server for a permanent public address. Implies `--http`. */
+    relay?: string;
     /** `--rotate-remote-key`: replace the remote key, cutting off every remote client. */
     rotateRemoteKey: boolean;
     /**

package/dist/src/config.js

@@ -90,6 +90,7 @@ function parseArgs(argv) {
     let http = false;
     let httpPort = envInt('MCP_BROWSER_EXTENSION_HTTP_PORT') ?? exports.DEFAULT_HTTP_PORT;
     let tunnel = false;
+    let relay;
     let rotateRemoteKey = false;
     let showHelp = false;
     let showVersion = false;
@@ -218,6 +219,10 @@ function parseArgs(argv) {
                 tunnel = true;
                 http = true;
                 break;
+            case '--relay':
+                relay = requireValue(argv[++i], '--relay');
+                http = true;
+                break;
             case '--rotate-remote-key':
                 rotateRemoteKey = true;
                 break;
@@ -246,6 +251,22 @@ function parseArgs(argv) {
     if (noEmailVerification && tunnel) {
         throw new Error('--no-email-verification cannot be used with --tunnel');
     }
+    if (noEmailVerification && relay) {
+        throw new Error('--no-email-verification cannot be used with --relay');
+    }
+    if (relay && tunnel) {
+        throw new Error('--relay and --tunnel each give a public address; use one');
+    }
+    if (relay) {
+        let protocol = '';
+        try {
+            protocol = new URL(relay).protocol;
+        }
+        catch { /* reported below */ }
+        if (protocol !== 'https:' && !(protocol === 'http:' && /^http:\/\/(127\.0\.0\.1|localhost)[:/]/.test(relay))) {
+            throw new Error(`--relay needs an https URL (plain http only for a relay on this computer), got ${relay}`);
+        }
+    }
     // File first, then flags win.
     for (const source of [policyFile, policyFlags]) {
         if (source?.allowDomains !== undefined && (!Array.isArray(source.allowDomains) ||
@@ -296,6 +317,7 @@ function parseArgs(argv) {
         http,
         httpPort,
         tunnel,
+        relay,
         rotateRemoteKey,
         showHelp,
         showVersion,
@@ -384,6 +406,9 @@ Connection:
   --tunnel               --http plus a Cloudflare quick tunnel, and print a public
                          connector URL for claude.ai, ChatGPT or any MCP client.
                          Needs cloudflared. The URL changes on every start.
+  --relay <url>          --http plus a link out to your own relay server (for example
+                         on AWS), for a permanent public address. The relay checks
+                         this computer's relay token, kept in <data-dir>/relay-token.
   --rotate-remote-key    Make a new remote key: every remote client is cut off and
                          needs the new URL.
   --no-auto-update       Run this copy even when a newer mcp-browser-extension is published.
@@ -397,7 +422,7 @@ Connection:
   --no-email-verification  Skip the hosted email/device access gate for trusted local use.
                          Email and device data are not sent to the access service.
                          Same as MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0.
-                         Cannot be combined with --tunnel; the domain allowlist,
+                         Cannot be combined with --tunnel or --relay; the domain allowlist,
                          deny-all defaults, and other safety gates still apply.
 
 Backend:

package/dist/src/executor/extension-executor.d.ts

@@ -39,6 +39,7 @@ export declare class ExtensionExecutor implements Executor {
         active?: boolean;
     }): Promise<TabInfo>;
     isOpeningTab(tabId: TabId): boolean;
+    checkSiteAccess(url: string): Promise<boolean>;
     tabClose(tabId: TabId): Promise<{
         closed: true;
         tabId: TabId;

package/dist/src/executor/extension-executor.js

@@ -134,6 +134,14 @@ class ExtensionExecutor {
         const until = this.openingTabs.get(tabId);
         return until !== undefined && until >= Date.now();
     }
+    async checkSiteAccess(url) {
+        if (!this.bridge.hasCap(this.activeProfile(), protocol_1.WIRE_CAP_SITE_CHECKS))
+            return false;
+        const result = await this.send('site_check', { url });
+        if (result?.checked !== true)
+            throw new types_1.ExecutorError('POLICY_DENIED', 'The extension did not confirm website access.');
+        return true;
+    }
     async tabClose(tabId) {
         return (await this.send('tab_close', {}, { tabId }));
     }
@@ -155,7 +163,8 @@ class ExtensionExecutor {
         return (await this.send('click', { ...targetParams(t), ...frameParams(opts), button: opts?.button, clickCount: opts?.clickCount, trusted: opts?.trusted }, { tabId: opts?.tabId }));
     }
     async draw(strokes, opts) {
-        return (await this.send('draw', { strokes }, { tabId: opts?.tabId }));
+        const points = strokes.reduce((sum, stroke) => sum + stroke.points.length, 0);
+        return (await this.send('draw', { strokes }, { tabId: opts?.tabId, timeoutMs: (0, protocol_1.drawTimeoutMs)(points, strokes.length) }));
     }
     async type(t, text, opts) {
         return (await this.send('type', { ...targetParams(t), ...frameParams(opts), text, clear: opts?.clear, pressEnter: opts?.pressEnter, keyEvents: opts?.keyEvents, trusted: opts?.trusted }, { tabId: opts?.tabId }));

package/dist/src/executor/types.d.ts

@@ -234,6 +234,8 @@ export interface Executor {
      * gate should wait for one rather than fail. Optional: false when absent.
      */
     isOpeningTab?(tabId: TabId): boolean;
+    /** True only after the paired extension has authorised this URL; false for old extensions. */
+    checkSiteAccess?(url: string): Promise<boolean>;
     tabsList(): Promise<TabInfo[]>;
     tabSelect(tabId: TabId): Promise<TabInfo>;
     /** Open a tab. `active` (default true) focuses it; pass false to open in the background. */
@@ -405,7 +407,7 @@ export interface Executor {
  * (which only carries codes that originate inside the extension); these extra
  * codes describe failures on the server half (no backend, launch failed, etc.).
  */
-export type ExecutorErrorCodeLocal = 'NO_BACKEND' | 'EXTENSION_DISCONNECTED' | 'TIMEOUT' | 'TAB_NOT_FOUND' | 'STALE_TAB' | 'SELECTOR_NOT_FOUND' | 'REF_EXPIRED' | 'EVAL_FAILED' | 'LAUNCH_FAILED' | 'DETACHED' | 'TARGET_GONE' | 'POLICY_DENIED' | 'DEVTOOLS_OPEN' | 'DOWNLOAD_FAILED' | 'UPLOAD_FAILED' | 'FRAME_NOT_FOUND' | 'OBSERVERS_DISABLED' | 'UNSUPPORTED' | 'BACKPRESSURE'
+export type ExecutorErrorCodeLocal = 'RESULT_TOO_LARGE' | 'NO_BACKEND' | 'EXTENSION_DISCONNECTED' | 'TIMEOUT' | 'TAB_NOT_FOUND' | 'STALE_TAB' | 'SELECTOR_NOT_FOUND' | 'REF_EXPIRED' | 'EVAL_FAILED' | 'LAUNCH_FAILED' | 'DETACHED' | 'TARGET_GONE' | 'POLICY_DENIED' | 'DEVTOOLS_OPEN' | 'DOWNLOAD_FAILED' | 'UPLOAD_FAILED' | 'FRAME_NOT_FOUND' | 'OBSERVERS_DISABLED' | 'UNSUPPORTED' | 'BACKPRESSURE'
 /** The page is a sign-in wall (session expired mid-run). Raised only when the caller opts in via `failOnAuthWall`. */
  | 'AUTH_REQUIRED';
 export declare class ExecutorError extends Error {

package/dist/src/mcp/helpers.js

@@ -144,12 +144,24 @@ function refineLinks(links, opts) {
 }
 /** Read a page (or subtree) as readable markdown. */
 async function readAsMarkdown(ex, args) {
-    const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
-        tabId: args.tabId,
-        frameId: args.frameId,
-        allFrames: args.allFrames,
-    });
-    return (0, markdown_extract_1.htmlToMarkdown)(html);
+    const target = args.selector ? { selector: args.selector } : undefined;
+    const frames = { tabId: args.tabId, frameId: args.frameId, allFrames: args.allFrames };
+    try {
+        const { html } = await ex.getHtml(target, frames);
+        return (0, markdown_extract_1.htmlToMarkdown)(html);
+    }
+    catch (error) {
+        // An older shared bridge maps unknown wire codes to TARGET_GONE but
+        // preserves the message. Support that mixed-version installation too.
+        if (!(error instanceof types_1.ExecutorError) || !(error.code === 'RESULT_TOO_LARGE' ||
+            (error.code === 'TARGET_GONE' && error.message.startsWith('[RESULT_TOO_LARGE]'))))
+            throw error;
+        // Large embedded scripts/assets can dwarf a page's readable content.
+        // Keep the same target and frame, and let the extension recheck access.
+        // A text result that is itself too large still fails explicitly.
+        const { text } = await ex.getText(target, frames);
+        return `Text-only view of this page:\n\n${text}`;
+    }
 }
 /**
  * Fill a set of fields (keyed by selector) and optionally submit. All writes go

package/dist/src/mcp/person-wait.js

@@ -32,13 +32,14 @@ function notifyPersonStep() {
 }
 const APPROVAL = /Please approve "/;
 const SITE = /^\[POLICY_DENIED\] Please allow access to /;
+const SITE_WARNING = /^\[POLICY_DENIED\] (Suspicious website |Automatic website access needs Chrome permission\.)/;
 /** The person-only step a result is blocked on, or undefined when it is not. */
 function personStep(result) {
     if (!result.isError)
         return undefined;
     const first = result.content[0];
     const text = first?.type === 'text' ? first.text : '';
-    return APPROVAL.test(text) || SITE.test(text) ? text : undefined;
+    return APPROVAL.test(text) || SITE.test(text) || SITE_WARNING.test(text) ? text : undefined;
 }
 exports.STILL_WAITING = 'Still waiting for the person. Call the same tool again to keep waiting; it continues on its own once they approve. ' +
     'Do not use shell sleeps or ask them to confirm in chat.';

package/dist/src/mcp/server.d.ts

@@ -9,6 +9,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { requireAccess } from '../access';
 import type { Policy } from '../security/policy';
+import type { ClientIdentity } from '../bridge/client-identity';
 export { getLogLevel, logDebug, logErr, setLogLevel } from './log';
 /**
  * Sent to the host once, at initialize. It covers the two walls new users hit
@@ -25,7 +26,7 @@ export declare const SERVER_INSTRUCTIONS: string;
  * POLICY_DENIED, and the catalog is re-sent on every turn). Omit it and the
  * full catalog is advertised, which is what the tests want.
  */
-export declare function createServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): McpServer;
+export declare function createServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess, phoneIdentity?: ClientIdentity): McpServer;
 /** Start over stdio. Idempotent. */
 export declare function startMcpServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): Promise<void>;
 /** Stop and release the transport. Idempotent, best-effort. */

package/dist/src/mcp/server.js

@@ -43,7 +43,7 @@ exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, sig
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +
-    'toolbar icon (its popup has an Allow button). Relay the friendly one-line approval steps from the error and wait for the person. It applies at once, with no restart. You cannot approve a site yourself or enable all-site access. ' +
+    'toolbar icon (its popup has an Allow button). Relay the friendly one-line approval steps from the error and wait for the person. It applies at once, with no restart. Only the person can approve a website warning or enable automatic website access. In automatic mode ordinary websites work without Allow; relay suspicious-site warning reasons and wait for the person. These local checks do not guarantee safety. ' +
     "Work in your own tab: tab_new opens one in the background, and calls without a tabId go to it, never to the tab the user is on. " +
     "To act on the user's current page, pass its tabId from tabs_list.";
 const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
@@ -51,7 +51,7 @@ const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local o
     'Approval and site refusals wait automatically: the tool call stays open (about 45 seconds) and continues on its own as soon as the person clicks Approve or Allow. Tell the person once. If it returns "Still waiting", call the same tool again; never use shell sleeps, timers or "I will check again later" messages, and never ask them to confirm in chat. ' +
     'Chrome blocks every extension from Chrome Web Store pages (chromewebstore.google.com and chrome.google.com/webstore, including the developer dashboard): they fail with TARGET_GONE "The extensions gallery cannot be scripted". Do not ask the person to allow those sites; it cannot help. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
-    'If a tool fails with POLICY_DENIED because a site is not allowed, relay its friendly one-line approval steps and wait for the person to allow it from the extension\'s toolbar icon. Never approve it yourself or enable all-site access. ' +
+    'If a tool fails with POLICY_DENIED because a site is not allowed, relay its friendly one-line approval steps and wait for the person to allow it from the extension\'s toolbar icon. Only the person can approve a website warning or enable automatic website access. Ordinary websites need no Allow in automatic mode; relay any suspicious-site warning and wait for the person. ' +
     "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";
 /** Default version reported when no explicit version is passed in (legacy callers/tests). */
 const DEFAULT_VERSION = SERVER_VERSION;
@@ -65,12 +65,12 @@ let transport = null;
  * POLICY_DENIED, and the catalog is re-sent on every turn). Omit it and the
  * full catalog is advertised, which is what the tests want.
  */
-function createServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess) {
+function createServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess, phoneIdentity) {
     const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, {
         capabilities: { tools: {}, logging: {} },
         instructions: accessGuard === access_1.bypassEmailVerification ? LOCAL_BYPASS_INSTRUCTIONS : exports.SERVER_INSTRUCTIONS,
     });
-    const advertised = (0, tools_1.registerTools)(srv, policy, accessGuard);
+    const advertised = (0, tools_1.registerTools)(srv, policy, accessGuard, phoneIdentity);
     watchInitialize(srv, advertised);
     // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
     srv.server.onerror = (err) => {

package/dist/src/mcp/tools.d.ts

@@ -1,3 +1,4 @@
+import { type ClientIdentity } from '../bridge/client-identity';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
@@ -68,6 +69,5 @@ export declare function dispatchToolCall(name: string, rawArgs: unknown, opts?:
 }): Promise<CallToolResult>;
 /** Assert the catalog and the dispatch table describe the same tool set. */
 export declare function assertNoDrift(): void;
-/** Register the tool surface; returns the names actually advertised. */
-export declare function registerTools(server: McpServer, policy?: Policy, accessGuard?: typeof requireAccess): string[];
+export declare function registerTools(server: McpServer, policy?: Policy, accessGuard?: typeof requireAccess, phoneIdentity?: ClientIdentity): string[];
 export {};