mcp-browser-extension 0.9.35 → 0.9.38

package/extension-dist/background.js

@@ -38,10 +38,16 @@
 
   // shared/protocol.ts
   var PROTOCOL_VERSION = 1;
+  var MAX_BRIDGE_FRAME_BYTES = 4 * 1024 * 1024;
   var CLOSE_SUPERSEDED = 4e3;
   var WIRE_CAP_TAB_URL = "tab-url";
+  var WIRE_CAP_SITE_CHECKS = "site-checks-v1";
   var WIRE_CAP_FILL_FORM = "fill-form";
   var WIRE_CAP_PROXY = "proxy";
+  function drawTimeoutMs(points, strokes) {
+    const events = Math.max(0, points) + 2 * Math.max(0, strokes);
+    return Math.min(24e4, Math.max(3e4, 1e4 + events * 60));
+  }
   var WIRE_METHODS = [
     "tabs_list",
     "tab_select",
@@ -73,7 +79,8 @@
     "print_pdf",
     "fill_form",
     "proxy_status",
-    "ping_probe"
+    "ping_probe",
+    "site_check"
   ];
 
   // extension/src/sw/cmd-error.ts
@@ -85,6 +92,11 @@
     code;
   };
 
+  // shared/phone-pairing.ts
+  var PHONE_INVITATION_MS = 2 * 6e4;
+  var PHONE_ACCESS_MS = 30 * 24 * 60 * 6e4;
+  var PHONE_ACTIONS = ["state", "create", "cancel", "approve", "deny", "remove"];
+
   // extension/src/sw/client-approvals.ts
   var MAX_CLIENTS = 64;
   var MAX_NONCES = 4096;
@@ -223,6 +235,33 @@
         }
       });
     }
+    /** A human approved a scanned phone in our own popup. Validate its local helper identity. */
+    approvePairedPhone(phone) {
+      return this.serial(async () => {
+        await this.load();
+        if (phone.state !== "pending" || phone.expiresAt <= this.now() || phone.name !== clientName(phone.name)) {
+          return denied("This phone request expired. Generate a new QR code.");
+        }
+        const der = decode(phone.publicKey);
+        await crypto.subtle.importKey("spki", der, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+        const id = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", der)), (b) => b.toString(16).padStart(2, "0")).join("");
+        if (id !== phone.clientId) return denied("Phone identity is invalid.");
+        const clients = this.clients.filter((c) => c.id !== id && c.expiresAt > this.now());
+        if (clients.length >= MAX_CLIENTS) return denied("Remove an unused app connection before pairing a phone.");
+        await this.save([...clients, {
+          id,
+          publicKey: phone.publicKey,
+          name: phone.name,
+          kind: "phone",
+          phoneId: phone.id,
+          state: "approved",
+          requestedAt: this.now(),
+          expiresAt: this.now() + PHONE_ACCESS_MS
+        }]);
+        this.storageFault = false;
+        this.revoking.delete(id);
+      });
+    }
     /** Called exclusively by messages from the extension's own approval UI. */
     decide(id, allow) {
       if (!allow) this.revoking.add(id);
@@ -253,6 +292,99 @@
     return sender.id === chrome.runtime.id && [chrome.runtime.getURL("options.html"), chrome.runtime.getURL("popup.html")].includes(sender.url ?? "") && (sender.frameId === void 0 || sender.frameId === 0);
   }
 
+  // extension/src/connect.ts
+  var NATIVE_HOST = "com.mehmoodqureshi.mcp_browser_extension";
+  async function fetchPairing() {
+    if (typeof chrome.runtime.sendNativeMessage !== "function") {
+      return { ok: false, error: "restart_needed", message: "Finishing setup. Click Connect again if this stays." };
+    }
+    try {
+      const reply = await chrome.runtime.sendNativeMessage(NATIVE_HOST, { type: "pairing" });
+      return reply ?? { ok: false, message: "The helper gave no answer." };
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      if (/not found|not registered|Specified native messaging host/i.test(why)) {
+        return {
+          ok: false,
+          error: "no_helper",
+          message: "Add the MCP Browser Extension server to your AI client (Claude Code, Cursor\u2026) and start it once; it sets this up. Then click Connect again."
+        };
+      }
+      return { ok: false, message: why };
+    }
+  }
+  async function applyPairing(reply) {
+    await chrome.storage.local.set({
+      wsPort: reply.port,
+      token: reply.token,
+      // The server's own --profile, as a suggestion only: another browser may
+      // already use that name, and taking it over would disconnect that one.
+      suggestedProfile: reply.profile ?? "",
+      pairingSource: "native"
+    });
+  }
+  async function requestPairingFromClick() {
+    let granted = false;
+    try {
+      granted = await chrome.permissions.request({ permissions: ["nativeMessaging"] });
+    } catch (err) {
+      return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+    if (!granted) return { ok: false, message: "Chrome needs that permission to fetch the pairing for you. You can also pair by hand in Settings." };
+    return fetchPairing();
+  }
+
+  // extension/src/sw/phone-pairing.ts
+  async function phonePairingAction(action, id, deps) {
+    if (!PHONE_ACTIONS.includes(action)) return { ok: false, message: "Invalid phone pairing action." };
+    if (["create", "approve"].includes(action) && (deps.stopped() || !deps.connected())) {
+      return { ok: false, message: "Connect this browser and resume access before pairing a phone." };
+    }
+    const { pairedProfile } = await chrome.storage.local.get("pairedProfile");
+    if (typeof pairedProfile !== "string" || !pairedProfile) return { ok: false, message: "Connect this browser first, then pair your phone." };
+    if (typeof chrome.runtime.sendNativeMessage !== "function") return { ok: false, message: "Click Connect in the extension, then reopen Pair phone." };
+    const send = async (action2) => {
+      const reply = await chrome.runtime.sendNativeMessage(NATIVE_HOST, { type: "phone_pairing", profile: pairedProfile, action: action2, id });
+      if (reply?.ok) {
+        const stored = (await chrome.storage.local.get(CLIENT_STORAGE_KEY))[CLIENT_STORAGE_KEY];
+        const clients = Array.isArray(stored) ? stored : [];
+        for (const phone of reply.state.devices) {
+          if (phone.state === "paired") phone.browserApproved = clients.some((c) => c.id === phone.clientId && c.state === "approved" && c.expiresAt > Date.now());
+        }
+      }
+      return reply;
+    };
+    try {
+      if (action === "approve" || action === "remove") {
+        const current = await send("state");
+        if (!current?.ok) return current ?? { ok: false, message: "Phone pairing did not answer." };
+        const phone = current.state.devices.find((d) => d.id === id);
+        if (!phone) return { ok: false, message: "That phone request has expired or was removed." };
+        if (action === "approve") {
+          if (deps.stopped() || !deps.connected()) return { ok: false, message: "Resume browser access before approving this phone." };
+          await deps.approvals.approvePairedPhone(phone);
+          if (deps.stopped() || !deps.connected()) {
+            await deps.approvals.decide(phone.clientId, false);
+            return { ok: false, message: "Browser access stopped. Pair your phone again after resuming." };
+          }
+          try {
+            const result = await send("approve");
+            if (!result?.ok) await deps.approvals.decide(phone.clientId, false);
+            return result ?? { ok: false, message: "Could not approve this phone." };
+          } catch (err) {
+            await deps.approvals.decide(phone.clientId, false).catch(() => void 0);
+            throw err;
+          }
+        }
+        await deps.approvals.decide(phone.clientId, false).catch(() => void 0);
+        return await send("remove");
+      }
+      return await send(action);
+    } catch {
+      return { ok: false, message: "Could not reach phone pairing. Update the local server and try again." };
+    }
+  }
+
   // shared/activity.ts
   var ACCESS_STOPPED_KEY = "accessStopped";
   var ACTIVITY_KEY = "recentActivity";
@@ -375,12 +507,12 @@
     token() {
       return this.generation;
     }
-    record(entry, generation = this.generation) {
+    record(entry, generation2 = this.generation) {
       if (this.pending >= 256) return Promise.reject(new Error("Activity history is busy."));
       this.pending++;
       const safe = activityEntry(entry);
       return this.serial(async () => {
-        if (generation !== this.generation) return;
+        if (generation2 !== this.generation) return;
         await this.load();
         const next = this.entries.filter((e) => e.id !== safe.id);
         next.push(safe);
@@ -453,7 +585,7 @@
           // This build gates fail-closed and reports tab URLs on results, so the
           // server may skip its pre-flight tabs_list. An older build omits this and
           // the server keeps fetching the URL itself.
-          caps: [WIRE_CAP_TAB_URL, WIRE_CAP_FILL_FORM, WIRE_CAP_PROXY, CLIENT_APPROVAL_CAP]
+          caps: [WIRE_CAP_TAB_URL, WIRE_CAP_FILL_FORM, WIRE_CAP_PROXY, CLIENT_APPROVAL_CAP, WIRE_CAP_SITE_CHECKS]
         };
         ws2.send(JSON.stringify(hello));
       };
@@ -467,6 +599,7 @@
         }
         switch (frame.type) {
           case "welcome":
+            this.deps.onSiteChecks?.(frame.siteChecks === true);
             this.deps.onPolicy(frame.policy);
             if (typeof frame.profile === "string") this.deps.onProfile?.(frame.profile);
             this.deps.onGranted?.(Array.isArray(frame.granted) ? frame.granted : null);
@@ -485,7 +618,17 @@
             if (this.state === "connected" && frame.v === PROTOCOL_VERSION) {
               this.deps.onCommand(frame, (result) => {
                 if (this.ws === ws2 && this.state === "connected" && ws2.readyState === WebSocket.OPEN) {
-                  ws2.send(JSON.stringify(result));
+                  const payload = JSON.stringify(result);
+                  if (new TextEncoder().encode(payload).byteLength > MAX_BRIDGE_FRAME_BYTES) {
+                    const error = {
+                      type: "error",
+                      v: PROTOCOL_VERSION,
+                      id: frame.id,
+                      ok: false,
+                      error: { code: "RESULT_TOO_LARGE", message: "[RESULT_TOO_LARGE] The browser result is too large to return. Request a smaller page section or a lower-resolution image." }
+                    };
+                    ws2.send(JSON.stringify(error));
+                  } else ws2.send(payload);
                 }
               });
             }
@@ -610,6 +753,9 @@
   function isDomainAllowed(url, policy) {
     const host = hostOf(url);
     if (!host) return false;
+    if (policy.automaticSites && /^https?:\/\//i.test(url)) {
+      return !(policy.blockedDomains ?? []).some((pat) => globMatches(host, pat));
+    }
     return policy.allowDomains.some((pat) => globMatches(host, pat));
   }
   function evaluatePolicy(url, method, policy) {
@@ -641,6 +787,10 @@
     if (isAboutBlank(url) && NAVIGATION.has(method)) return { ok: true };
     if (!isDomainAllowed(url, policy)) {
       const host = hostOf(url) || url;
+      if (policy.automaticSites && /^https?:\/\//i.test(url)) return {
+        ok: false,
+        reason: `Access to ${host} was removed. Restore it under Blocked websites in extension Settings.`
+      };
       return { ok: false, reason: blockedDomainMessage(host) };
     }
     return { ok: true };
@@ -1533,11 +1683,354 @@
     };
   }
 
+  // shared/site-risk.ts
+  var SITE_CHECKS_KEY = "localSiteChecksV1";
+  var SITE_CHECKS_PENDING_KEY = "localSiteWarnings";
+  var SITE_CHECKS_APPROVALS_KEY = "localSiteWarningApprovals";
+  var SITE_CHECKS_BLOCKED_KEY = "localBlockedSites";
+  var AUTOMATIC_SITE_ORIGINS = ["http://*/*", "https://*/*"];
+  var BRANDS = {
+    google: ["google.com", "google.co.uk", "google.com.pk", "google.de", "google.fr", "google.co.in", "google.com.au", "google.ca", "google.co.jp", "youtube.com"],
+    microsoft: ["microsoft.com", "microsoftonline.com", "live.com", "office.com", "outlook.com"],
+    apple: ["apple.com", "icloud.com"],
+    paypal: ["paypal.com"],
+    amazon: ["amazon.com", "amazon.co.uk", "amazon.de", "amazon.fr", "amazon.in", "amazon.ca", "amazon.com.au", "amazon.co.jp", "amazon.es", "amazon.it"],
+    github: ["github.com", "github.dev"],
+    facebook: ["facebook.com", "meta.com"],
+    instagram: ["instagram.com", "meta.com"],
+    linkedin: ["linkedin.com"],
+    dropbox: ["dropbox.com"],
+    coinbase: ["coinbase.com"]
+  };
+  var AUTH_WORD = /(?:^|[.\-])(login|signin|sign-in|verify|verification|secure|account|password|recover|support)(?:[.\-]|$)/;
+  function hostIn(host, domains) {
+    return domains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+  }
+  function unicodeLabel(label) {
+    if (!label.startsWith("xn--") || label.length > 63) return label;
+    try {
+      const input = label.slice(4);
+      const split = input.lastIndexOf("-");
+      const points = split < 0 ? [] : Array.from(input.slice(0, split), (c) => c.codePointAt(0));
+      let pos = split < 0 ? 0 : split + 1;
+      let n = 128, i = 0, bias = 72;
+      while (pos < input.length) {
+        const old = i;
+        let weight = 1;
+        for (let k2 = 36; ; k2 += 36) {
+          const code = input.charCodeAt(pos++);
+          const digit = code >= 97 && code <= 122 ? code - 97 : code >= 48 && code <= 57 ? code - 22 : 36;
+          if (digit >= 36 || !Number.isSafeInteger(i + digit * weight)) return label;
+          i += digit * weight;
+          const t = k2 <= bias ? 1 : k2 >= bias + 26 ? 26 : k2 - bias;
+          if (digit < t) break;
+          weight *= 36 - t;
+        }
+        const size = points.length + 1;
+        let delta = Math.floor((i - old) / (old === 0 ? 700 : 2));
+        delta += Math.floor(delta / size);
+        let k = 0;
+        while (delta > 455) {
+          delta = Math.floor(delta / 35);
+          k += 36;
+        }
+        bias = k + Math.floor(36 * delta / (delta + 38));
+        n += Math.floor(i / size);
+        i %= size;
+        if (n > 1114111 || n >= 55296 && n <= 57343) return label;
+        points.splice(i++, 0, n);
+      }
+      return String.fromCodePoint(...points);
+    } catch {
+      return label;
+    }
+  }
+  function skeleton(label) {
+    const lookalikes = {
+      "\u0430": "a",
+      "\u0435": "e",
+      "\u043E": "o",
+      "\u0440": "p",
+      "\u0441": "c",
+      "\u0443": "y",
+      "\u0445": "x",
+      "\u0456": "i",
+      "\u0458": "j",
+      "\u04CF": "l",
+      "\u0455": "s",
+      "\u0501": "d",
+      "\u051B": "q",
+      "\u03B1": "a",
+      "\u03BF": "o",
+      "\u03C1": "p",
+      "\u03BD": "v",
+      "\u03B9": "i",
+      "0": "o",
+      "1": "l"
+    };
+    return Array.from(unicodeLabel(label).toLowerCase(), (c) => lookalikes[c] ?? c).join("");
+  }
+  function isLocalDevelopmentHost(host) {
+    return host === "localhost" || host.endsWith(".localhost") || host === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host);
+  }
+  function siteUrlWarnings(input) {
+    let url;
+    try {
+      url = new URL(input);
+    } catch {
+      return [];
+    }
+    if (!/^https?:$/.test(url.protocol)) return [];
+    const host = url.hostname.toLowerCase().replace(/\.$/, "");
+    const warnings = [];
+    if (url.username && /[.]/.test(decodeURIComponentSafe(url.username))) {
+      warnings.push({ id: "hidden-destination", reason: `The address puts a website name before @. The actual destination is ${host}.` });
+    }
+    const labels = host.split(".");
+    for (const [brand, domains] of Object.entries(BRANDS)) {
+      if (hostIn(host, domains)) continue;
+      if (domains.some((domain) => host.includes(`${domain}.`))) {
+        warnings.push({ id: `misleading-domain:${brand}`, reason: `The address includes ${brand}'s domain but actually belongs to ${host}.` });
+        continue;
+      }
+      if (labels.some((label) => label !== brand && skeleton(label) === brand)) {
+        warnings.push({ id: `lookalike:${brand}`, reason: `The address uses lookalike characters to resemble ${brand}.` });
+        continue;
+      }
+      if (labels.some((label) => label.split("-").includes(brand)) && AUTH_WORD.test(host)) {
+        warnings.push({ id: `brand-login:${brand}`, reason: `The address combines ${brand}'s name with login or account wording outside its recognised domains.` });
+      }
+    }
+    return warnings;
+  }
+  function decodeURIComponentSafe(value) {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  }
+  function loginWarnings(signals) {
+    const warnings = siteUrlWarnings(signals.url);
+    if (!signals.passwords) return warnings;
+    let page;
+    try {
+      page = new URL(signals.url);
+    } catch {
+      return warnings;
+    }
+    if (!/^https?:$/.test(page.protocol)) return warnings;
+    const local = isLocalDevelopmentHost(page.hostname);
+    if (page.protocol === "http:" && !local) warnings.push({
+      id: "unencrypted-login",
+      reason: "This page asks for a password over an unencrypted HTTP connection."
+    });
+    for (const form of signals.forms.slice(0, 32)) {
+      let action;
+      try {
+        action = new URL(form.action || signals.url, signals.url);
+      } catch {
+        continue;
+      }
+      if (action.protocol === "http:" && !(local && isLocalDevelopmentHost(action.hostname))) warnings.push({
+        id: `unencrypted-password-destination:${action.origin}`,
+        reason: `A password form sends to an unencrypted address at ${action.hostname}.`
+      });
+      if (form.method === "get") warnings.push({
+        id: "password-in-address",
+        reason: "A password form is configured to put its fields in the website address."
+      });
+    }
+    const title = signals.title.slice(0, 300).toLowerCase();
+    if (/\b(sign[ -]?in|log[ -]?in|verify|account|password)\b/.test(title)) {
+      for (const [brand, domains] of Object.entries(BRANDS)) {
+        if (new RegExp(`\\b${brand}\\b`).test(title) && !hostIn(page.hostname, domains)) {
+          warnings.push({ id: `login-brand:${brand}`, reason: `This password page presents itself as ${brand}, but its address is ${page.hostname}.` });
+        }
+      }
+    }
+    return uniqueWarnings(warnings);
+  }
+  function uniqueWarnings(warnings) {
+    return [...new Map(warnings.map((warning) => [warning.id, warning])).values()];
+  }
+  function collectLoginSignals() {
+    const inputs = Array.from(document.querySelectorAll('input[type="password"]')).filter((input) => !input.disabled && input.getClientRects().length > 0).slice(0, 32);
+    const forms = [...new Set(inputs.map((input) => input.form).filter((form) => !!form))];
+    return {
+      url: location.href,
+      title: document.title.slice(0, 300),
+      passwords: inputs.length,
+      forms: forms.map((form) => ({ action: form.action, method: form.getAttribute("method")?.toLowerCase() ?? "" }))
+    };
+  }
+
+  // extension/src/sw/site-protection.ts
+  var enabled = false;
+  var configured = false;
+  var supported = true;
+  var requesting = false;
+  var blocked = [];
+  var generation = 0;
+  var queue = Promise.resolve();
+  var changed = () => {
+  };
+  function onSiteWarnings(callback) {
+    changed = callback;
+  }
+  function setSiteChecksSupported(value) {
+    supported = value;
+  }
+  function siteChecksEnabled() {
+    return supported && enabled;
+  }
+  function siteChecksConfigured() {
+    return supported && configured;
+  }
+  function requireSiteChecksReady() {
+    if (siteChecksConfigured() && !enabled) throw new CmdError("POLICY_DENIED", "Automatic website access needs Chrome permission. Open MCP Browser Extension and click Allow website access.");
+  }
+  async function keepAutomaticPermissions() {
+    return requesting || (await chrome.storage.local.get(SITE_CHECKS_KEY))[SITE_CHECKS_KEY] === true;
+  }
+  async function refreshSiteChecks() {
+    const mine = ++generation;
+    const saved = await chrome.storage.local.get([SITE_CHECKS_KEY, SITE_CHECKS_BLOCKED_KEY, SITE_CHECKS_PENDING_KEY]);
+    const wantsChecks = saved[SITE_CHECKS_KEY] !== false;
+    const permitted = wantsChecks && await chrome.permissions.contains({ origins: AUTOMATIC_SITE_ORIGINS });
+    if (mine !== generation) return;
+    configured = wantsChecks;
+    enabled = permitted;
+    blocked = Array.isArray(saved[SITE_CHECKS_BLOCKED_KEY]) ? saved[SITE_CHECKS_BLOCKED_KEY].filter((s) => typeof s === "string") : [];
+    changed(siteChecksEnabled() && Array.isArray(saved[SITE_CHECKS_PENDING_KEY]) ? saved[SITE_CHECKS_PENDING_KEY].length : 0, false);
+  }
+  async function changeSiteChecks(allow) {
+    if (requesting) throw new Error("A website permission request is already open.");
+    requesting = allow;
+    try {
+      const permission = allow ? chrome.permissions.request({ origins: AUTOMATIC_SITE_ORIGINS }) : Promise.resolve(true);
+      if (!await permission) throw new Error("Automatic website access was not enabled. Accept Chrome\u2019s permission request to turn it on.");
+      await chrome.storage.local.set({ [SITE_CHECKS_KEY]: allow });
+      if (!allow) {
+        enabled = false;
+        await chrome.permissions.remove({ origins: AUTOMATIC_SITE_ORIGINS });
+      }
+      await refreshSiteChecks();
+    } finally {
+      requesting = false;
+    }
+  }
+  function localSitePolicy(policy) {
+    const active = siteChecksEnabled();
+    return policy ? { ...policy, automaticSites: active, blockedDomains: active ? blocked : [] } : null;
+  }
+  function serialized(operation) {
+    const next = queue.then(operation);
+    queue = next.catch(() => {
+    });
+    return next;
+  }
+  async function warn(url, warnings) {
+    return serialized(async () => {
+      const saved = await chrome.storage.local.get([SITE_CHECKS_PENDING_KEY, SITE_CHECKS_APPROVALS_KEY]);
+      const approved = saved[SITE_CHECKS_APPROVALS_KEY]?.[url.origin];
+      warnings = warnings.filter((warning) => !Array.isArray(approved) || !approved.includes(warning.id));
+      if (!warnings.length) return [];
+      const prior = Array.isArray(saved[SITE_CHECKS_PENDING_KEY]) ? saved[SITE_CHECKS_PENDING_KEY] : [];
+      const old = prior.find((entry) => entry.origin === url.origin);
+      const fresh = !old || warnings.some((warning) => !old.warnings.some((w) => w.id === warning.id));
+      const request = { origin: url.origin, host: url.hostname, warnings, at: Date.now() };
+      const next = [request, ...prior.filter((entry) => entry.origin !== url.origin)].slice(0, 100);
+      await chrome.storage.local.set({ [SITE_CHECKS_PENDING_KEY]: next });
+      changed(next.length, fresh);
+      return warnings;
+    });
+  }
+  async function requireWarningApproval(url, warnings) {
+    if (!warnings.length) return;
+    const missing = await warn(url, warnings);
+    if (!missing.length) return;
+    throw new CmdError("POLICY_DENIED", `Suspicious website ${url.hostname}: ${missing.map((w) => w.reason).join(" ")} Review the warning in the MCP Browser Extension popup or Settings, then click Allow if you want to continue.`);
+  }
+  async function checkLocalSite(input, tabId, frameId = 0) {
+    requireSiteChecksReady();
+    if (!siteChecksEnabled() || input === "about:blank") return;
+    let url;
+    try {
+      url = new URL(input);
+    } catch {
+      throw new CmdError("POLICY_DENIED", "This website address cannot be checked.");
+    }
+    if (!/^https?:$/.test(url.protocol)) throw new CmdError("POLICY_DENIED", "Automatic website access only covers HTTP and HTTPS pages.");
+    if (blocked.some((host) => url.hostname === host || host.startsWith("*.") && (url.hostname === host.slice(2) || url.hostname.endsWith(`.${host.slice(2)}`)))) {
+      throw new CmdError("POLICY_DENIED", `Access to ${url.hostname} was removed. Restore it under Blocked websites in extension Settings.`);
+    }
+    await requireWarningApproval(url, siteUrlWarnings(input));
+    if (tabId !== void 0) {
+      let warnings;
+      try {
+        const results = await chrome.scripting.executeScript({ target: { tabId, frameIds: [frameId] }, func: collectLoginSignals });
+        const signals = results[0]?.result;
+        if (!signals || signals.url !== input) throw new Error("The page changed during the check.");
+        warnings = loginWarnings(signals);
+      } catch {
+        throw new CmdError("CDP_ERROR", "Could not finish the local website check. The page may have changed; retry the request.");
+      }
+      await requireWarningApproval(url, warnings);
+    }
+  }
+  function allowSiteWarning(origin, expected) {
+    return serialized(async () => {
+      const saved = await chrome.storage.local.get([SITE_CHECKS_PENDING_KEY, SITE_CHECKS_APPROVALS_KEY]);
+      const pending = Array.isArray(saved[SITE_CHECKS_PENDING_KEY]) ? saved[SITE_CHECKS_PENDING_KEY] : [];
+      const request = pending.find((entry) => entry.origin === origin);
+      if (!request || request.warnings.some((w) => !expected.includes(w.id)) || expected.some((id) => !request.warnings.some((w) => w.id === id))) {
+        throw new Error("The warning changed. Review the current reasons and try again.");
+      }
+      const approvals2 = saved[SITE_CHECKS_APPROVALS_KEY] ?? {};
+      const previous = Array.isArray(approvals2[origin]) ? approvals2[origin] : [];
+      const next = pending.filter((entry) => entry.origin !== origin);
+      await chrome.storage.local.set({
+        [SITE_CHECKS_APPROVALS_KEY]: { ...approvals2, [origin]: [.../* @__PURE__ */ new Set([...previous, ...expected])] },
+        [SITE_CHECKS_PENDING_KEY]: next
+      });
+      changed(next.length, false);
+    });
+  }
+  function blockLocalSite(host, block) {
+    return serialized(async () => {
+      const saved = await chrome.storage.local.get([SITE_CHECKS_BLOCKED_KEY, SITE_CHECKS_APPROVALS_KEY, SITE_CHECKS_PENDING_KEY]);
+      const list = Array.isArray(saved[SITE_CHECKS_BLOCKED_KEY]) ? saved[SITE_CHECKS_BLOCKED_KEY] : [];
+      const next = list.filter((entry) => entry !== host);
+      if (block) next.push(host);
+      const approvals2 = { ...saved[SITE_CHECKS_APPROVALS_KEY] ?? {} };
+      for (const origin of Object.keys(approvals2)) {
+        if (new URL(origin).hostname === host) delete approvals2[origin];
+      }
+      const pending = Array.isArray(saved[SITE_CHECKS_PENDING_KEY]) ? saved[SITE_CHECKS_PENDING_KEY] : [];
+      await chrome.storage.local.set({
+        [SITE_CHECKS_BLOCKED_KEY]: next,
+        [SITE_CHECKS_APPROVALS_KEY]: approvals2,
+        [SITE_CHECKS_PENDING_KEY]: pending.filter((entry) => entry.host !== host)
+      });
+      await refreshSiteChecks();
+    });
+  }
+  function revokeSiteWarning(origin) {
+    return serialized(async () => {
+      const saved = await chrome.storage.local.get(SITE_CHECKS_APPROVALS_KEY);
+      const approvals2 = { ...saved[SITE_CHECKS_APPROVALS_KEY] ?? {} };
+      delete approvals2[origin];
+      await chrome.storage.local.set({ [SITE_CHECKS_APPROVALS_KEY]: approvals2 });
+    });
+  }
+
   // extension/src/sw/browser-permissions.ts
   var initialization;
   function initializeBrowserPermissions() {
     return initialization ??= (async () => {
       await removeGlobalOrigins();
+      await refreshSiteChecks();
       const saved = await chrome.storage.local.get([PERMISSIONS_MIGRATION_KEY, PROXY_STORAGE_KEY]);
       if (!saved[PERMISSIONS_MIGRATION_KEY]) {
         const permissions = ["cookies", "downloads"];
@@ -1548,17 +2041,22 @@
     })();
   }
   async function removeGlobalOrigins() {
+    if (await keepAutomaticPermissions()) return;
     const all = await chrome.permissions.getAll();
     const origins = (all.origins ?? []).filter(isGlobalOrigin);
     if (origins.length) await chrome.permissions.remove({ origins });
     const remaining = await chrome.permissions.getAll();
     if (remaining.origins?.some(isGlobalOrigin)) throw new Error("Please remove all-site access in Chrome before continuing.");
   }
-  async function requireSitePermission(url) {
+  async function requireSitePermission(url, tabId, frameId = 0) {
     await initializeBrowserPermissions();
     if (url === "about:blank") return;
+    requireSiteChecksReady();
     const origin = originForUrl(url);
-    if (origin && await chrome.permissions.contains({ origins: [origin] })) return;
+    if (origin && await chrome.permissions.contains({ origins: [origin] })) {
+      await checkLocalSite(url, tabId, frameId);
+      return;
+    }
     throw new CmdError("POLICY_DENIED", blockedDomainMessage(hostOf(url) || url));
   }
   var requestWrite = Promise.resolve();
@@ -1648,7 +2146,7 @@
   async function targetTab(cmd) {
     return cmd.tabId ? parseTabId(cmd.tabId) : currentTabId();
   }
-  var TABLESS = /* @__PURE__ */ new Set(["tabs_list", "tab_new", "ping_probe", "download_file", "proxy_status"]);
+  var TABLESS = /* @__PURE__ */ new Set(["tabs_list", "tab_new", "ping_probe", "site_check", "download_file", "proxy_status"]);
   async function resolveTab(cmd) {
     if (cmd.method === "download_file" && typeof cmd.params.url !== "string") return targetTab(cmd);
     if (TABLESS.has(cmd.method)) return null;
@@ -1867,11 +2365,11 @@
       chrome.debugger.detach({ tabId }).catch(() => void 0);
     });
   }
-  async function withDebugger(tabId, fn, timeoutMs = DEBUGGER_OP_MS) {
+  async function withDebugger(tabId, fn, timeoutMs = DEBUGGER_OP_MS, retryDetached = true) {
     return locks.run(`dbg:${tabId}`, async () => {
       const target = { tabId };
       const once = async () => {
-        await requireSitePermission((await chrome.tabs.get(tabId)).url ?? "");
+        await requireSitePermission((await chrome.tabs.get(tabId)).url ?? "", tabId);
         await ensureAttached(tabId);
         return fn(target);
       };
@@ -1879,7 +2377,7 @@
         return await withDeadline(tabId, once(), timeoutMs);
       } catch (err) {
         if (err instanceof CmdError && err.code === "TIMEOUT") throw err;
-        if (!DETACHED_RE.test(String(err?.message ?? err))) throw err;
+        if (!retryDetached || !DETACHED_RE.test(String(err?.message ?? err))) throw err;
         forgetDebugger(tabId);
         return await withDeadline(tabId, once(), timeoutMs);
       } finally {
@@ -2092,6 +2590,7 @@
     "download_file",
     "upload_file",
     "ping_probe",
+    "site_check",
     "frames_list",
     "observers",
     "print_pdf",
@@ -2194,8 +2693,15 @@
       const allowed = [];
       const denied2 = [];
       for (const f of seen) {
-        if (evaluatePolicy(f.url, cmd.method, policy).ok) allowed.push(f.frameId);
-        else denied2.push(f.url || `frame ${f.frameId}`);
+        if (evaluatePolicy(f.url, cmd.method, policy).ok) {
+          try {
+            await requireSitePermission(f.url, tabId, f.frameId);
+            allowed.push(f.frameId);
+          } catch (err) {
+            if (err instanceof CmdError && err.code === "POLICY_DENIED") denied2.push(f.url);
+            else throw err;
+          }
+        } else denied2.push(f.url || `frame ${f.frameId}`);
       }
       if (allowed.length === 0) {
         throw new CmdError(
@@ -2224,7 +2730,9 @@
         case "tab_select": {
           const id = parseTabId(String(cmd.tabId));
           const t = await chrome.tabs.update(id, { active: true });
-          return tabInfo(t ?? await chrome.tabs.get(id));
+          const selected = t ?? await chrome.tabs.get(id);
+          await chrome.windows.update(selected.windowId, { focused: true });
+          return tabInfo(selected);
         }
         case "tab_new": {
           const url = typeof cmd.params.url === "string" ? cmd.params.url : void 0;
@@ -2438,43 +2946,57 @@
           });
           const pointCount = strokes.reduce((sum, stroke) => sum + stroke.length, 0);
           if (pointCount > 5e3) throw new CmdError("BAD_ARGS", "draw is limited to 5000 total points per call");
-          await withDebugger(id, async (t) => {
-            for (const stroke of strokes) {
-              const first = stroke[0];
-              await chrome.debugger.sendCommand(t, "Input.dispatchMouseEvent", {
-                type: "mouseMoved",
-                x: first.x,
-                y: first.y,
-                buttons: 0
-              });
-              await chrome.debugger.sendCommand(t, "Input.dispatchMouseEvent", {
-                type: "mousePressed",
-                x: first.x,
-                y: first.y,
-                button: "left",
-                buttons: 1,
-                clickCount: 1
-              });
-              for (const point of stroke.slice(1)) {
-                await chrome.debugger.sendCommand(t, "Input.dispatchMouseEvent", {
+          const budget = Math.max(1, Math.min(drawTimeoutMs(pointCount, strokes.length), cmd.timeoutMs) - 1e3);
+          const deadline = Date.now() + budget;
+          let completed = 0;
+          try {
+            await withDebugger(id, async (t) => {
+              const sendMouse = async (params) => {
+                const remaining = deadline - Date.now();
+                if (remaining <= 0) throw new CmdError("TIMEOUT", "Drawing ran out of time");
+                await withDeadline(id, chrome.debugger.sendCommand(t, "Input.dispatchMouseEvent", params), Math.min(DEBUGGER_OP_MS, remaining));
+              };
+              for (const stroke of strokes) {
+                const first = stroke[0];
+                await sendMouse({
                   type: "mouseMoved",
-                  x: point.x,
-                  y: point.y,
+                  x: first.x,
+                  y: first.y,
+                  buttons: 0
+                });
+                await sendMouse({
+                  type: "mousePressed",
+                  x: first.x,
+                  y: first.y,
+                  button: "left",
+                  buttons: 1,
+                  clickCount: 1
+                });
+                for (const point of stroke.slice(1)) {
+                  await sendMouse({
+                    type: "mouseMoved",
+                    x: point.x,
+                    y: point.y,
+                    button: "left",
+                    buttons: 1
+                  });
+                }
+                const last = stroke[stroke.length - 1];
+                await sendMouse({
+                  type: "mouseReleased",
+                  x: last.x,
+                  y: last.y,
                   button: "left",
-                  buttons: 1
+                  buttons: 0,
+                  clickCount: 1
                 });
+                completed++;
               }
-              const last = stroke[stroke.length - 1];
-              await chrome.debugger.sendCommand(t, "Input.dispatchMouseEvent", {
-                type: "mouseReleased",
-                x: last.x,
-                y: last.y,
-                button: "left",
-                buttons: 0,
-                clickCount: 1
-              });
-            }
-          });
+            }, budget, false);
+          } catch (err) {
+            const code = err instanceof CmdError ? err.code : "CDP_ERROR";
+            throw new CmdError(code, `Drawing interrupted after ${completed} of ${strokes.length} complete strokes. Some marks may already be visible; inspect the canvas before continuing. ${err instanceof Error ? err.message : "Browser input failed."}`);
+          }
           return { ok: true, strokes: strokes.length, points: pointCount };
         }
         case "type": {
@@ -2512,6 +3034,7 @@
             // Frame ids are re-probed per field too: an iframe that navigates
             // mid-batch must not keep a grant the policy would no longer give it.
             write: async (op) => {
+              await requireSitePermission(await observedTabUrl(cmd, id), id);
               const out = await execOp(
                 id,
                 withWait(
@@ -2897,7 +3420,7 @@
     deps;
     async dispatch(cmd, send = this.deps.send) {
       const record = this.deps.activity?.();
-      const entry = cmd.method === "ping_probe" ? null : {
+      const entry = cmd.method === "ping_probe" || cmd.method === "site_check" ? null : {
         id: crypto.randomUUID(),
         at: Date.now(),
         method: cmd.method,
@@ -2914,6 +3437,7 @@
           send({ type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data: { ok: true } });
           return;
         }
+        await initializeBrowserPermissions();
         const policy = this.deps.getPolicy();
         if (!policy && cmd.method !== "ping_probe") {
           throw new CmdError(
@@ -2932,6 +3456,24 @@
           checkStopped?.();
           checkApproval();
         };
+        if (cmd.method === "site_check" || isUrlGated(cmd.method) || cmd.method === "tab_new") requireSiteChecksReady();
+        if (cmd.method === "site_check") {
+          const url = typeof cmd.params.url === "string" ? cmd.params.url : "";
+          const verdict = evaluatePolicy(url, "get_text", policy);
+          if (!verdict.ok) {
+            if (hostOf(url)) this.deps.onBlocked?.(hostOf(url), "get_text");
+            throw new CmdError("POLICY_DENIED", verdict.reason);
+          }
+          try {
+            await requireSitePermission(url);
+          } catch (err) {
+            if (hostOf(url)) this.deps.onBlocked?.(hostOf(url), "get_text");
+            throw err;
+          }
+          checkAccess();
+          send({ type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data: { checked: true } });
+          return;
+        }
         if (cmd.method === "ping_probe") {
           checkAccess();
           send({ type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data: {} });
@@ -2977,7 +3519,7 @@
           }
           if (isUrlGated(cmd.method) && url !== "about:blank") {
             try {
-              await requireSitePermission(url);
+              await requireSitePermission(url, tab !== null && url === targetUrl ? tab : void 0);
             } catch (err) {
               const host = hostOf(url);
               if (host) this.deps.onBlocked?.(host, cmd.method);
@@ -3001,6 +3543,13 @@
           if (Number.isSafeInteger(id) && id >= 0) entry.tabId = id;
           if (opened?.url) entry.host = activityHost(opened.url) || entry.host;
         }
+        if (siteChecksEnabled() && ["tab_new", "navigate", "back", "forward", "reload"].includes(cmd.method)) {
+          const landedTab = cmd.method === "tab_new" ? entry?.tabId : tab;
+          if (landedTab !== void 0 && landedTab !== null) {
+            const landedUrl = (await chrome.tabs.get(landedTab)).url ?? "";
+            if (/^https?:\/\//i.test(landedUrl)) await requireSitePermission(landedUrl, landedTab);
+          }
+        }
         if (border2) void this.markBorder(border2, cmd, tab, data);
         const frame = { type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data };
         const tabUrl = await observedTabUrl(cmd, tab);
@@ -3014,7 +3563,10 @@
         send(frame);
       } catch (err) {
         const code = err instanceof CmdError ? err.code : "CDP_ERROR";
-        const message = err instanceof Error ? err.message : String(err);
+        let message = err instanceof Error ? err.message : String(err);
+        if (ran && message.startsWith("Suspicious website ")) {
+          message = `Website access paused after the command started: ${message} The page may already be open; use tabs_list after approval.`;
+        }
         if (entry) entry.outcome = ran && code === "POLICY_DENIED" ? "interrupted" : code === "POLICY_DENIED" ? "blocked" : "failed";
         this.deps.log(`command "${cmd.method}" failed: ${message}`);
         const frame = {
@@ -3044,6 +3596,21 @@
     }
   };
 
+  // extension/src/sw/install-identity.ts
+  var identity;
+  function ensureInstallId() {
+    return identity ??= (async () => {
+      const { installId } = await chrome.storage.local.get("installId");
+      if (typeof installId === "string" && installId.length > 0) return installId;
+      const fresh = crypto.randomUUID();
+      await chrome.storage.local.set({ installId: fresh });
+      return fresh;
+    })().catch((err) => {
+      identity = void 0;
+      throw err;
+    });
+  }
+
   // extension/src/sw/observers.ts
   var SCRIPT_ID = "chrome-mcp-observers";
   var updates = Promise.resolve();
@@ -3055,7 +3622,7 @@
     try {
       await initializeBrowserPermissions();
       const existing = await chrome.scripting.getRegisteredContentScripts({ ids: [SCRIPT_ID] }).catch(() => []);
-      const candidates = (policy ? observerMatches(policy) : []).flatMap((pattern) => pattern.startsWith("*://") ? [`http${pattern.slice(1)}`, `https${pattern.slice(1)}`] : [pattern]);
+      const candidates = (policy && !policy.automaticSites ? observerMatches(policy) : []).flatMap((pattern) => pattern.startsWith("*://") ? [`http${pattern.slice(1)}`, `https${pattern.slice(1)}`] : [pattern]);
       const checks = await Promise.all(candidates.map(async (pattern) => await chrome.permissions.contains({ origins: [pattern] }) ? pattern : null));
       const wanted = checks.filter((pattern) => pattern !== null);
       if (wanted.length === 0) {
@@ -3143,7 +3710,7 @@
     return v && typeof v === "object" ? { ...v } : {};
   }
   var saveMarked = (m) => chrome.storage.session.set({ [KEY]: m }).catch(() => void 0);
-  async function enabled() {
+  async function enabled2() {
     const { tabBorder } = await chrome.storage.local.get("tabBorder");
     return tabBorder !== false;
   }
@@ -3219,7 +3786,7 @@
     /** A command just ran in `tabId`: border it if it isn't already. */
     async used(tabId) {
       return this.locked(async () => {
-        if (!await enabled() || !await tabAllowed(tabId, this.getPolicy())) return;
+        if (!await enabled2() || !await tabAllowed(tabId, this.getPolicy())) return;
         const marked = await loadMarked();
         if (marked[tabId]) return;
         marked[tabId] = await paint(tabId);
@@ -3229,7 +3796,7 @@
     /** A tab opened by tab_new: remember it, and paint once it loads. */
     async opened(tabId) {
       return this.locked(async () => {
-        if (!await enabled()) return;
+        if (!await enabled2()) return;
         const marked = await loadMarked();
         marked[tabId] = marked[tabId] ?? "";
         await saveMarked(marked);
@@ -3242,7 +3809,7 @@
       return this.locked(async () => {
         const marked = await loadMarked();
         if (!(tabId in marked)) return;
-        if (!await enabled() || !await tabAllowed(tabId, this.getPolicy())) {
+        if (!await enabled2() || !await tabAllowed(tabId, this.getPolicy())) {
           await unpaint(tabId, marked[tabId]);
           delete marked[tabId];
         } else {
@@ -3300,55 +3867,13 @@
     return checks.filter((site) => site !== null);
   }
 
-  // extension/src/connect.ts
-  var NATIVE_HOST = "com.mehmoodqureshi.mcp_browser_extension";
-  async function fetchPairing() {
-    if (typeof chrome.runtime.sendNativeMessage !== "function") {
-      return { ok: false, error: "restart_needed", message: "Finishing setup. Click Connect again if this stays." };
-    }
-    try {
-      const reply = await chrome.runtime.sendNativeMessage(NATIVE_HOST, { type: "pairing" });
-      return reply ?? { ok: false, message: "The helper gave no answer." };
-    } catch (err) {
-      const why = err instanceof Error ? err.message : String(err);
-      if (/not found|not registered|Specified native messaging host/i.test(why)) {
-        return {
-          ok: false,
-          error: "no_helper",
-          message: "Add the MCP Browser Extension server to your AI client (Claude Code, Cursor\u2026) and start it once; it sets this up. Then click Connect again."
-        };
-      }
-      return { ok: false, message: why };
-    }
-  }
-  async function applyPairing(reply) {
-    await chrome.storage.local.set({
-      wsPort: reply.port,
-      token: reply.token,
-      // The server's own --profile, as a suggestion only: another browser may
-      // already use that name, and taking it over would disconnect that one.
-      suggestedProfile: reply.profile ?? "",
-      pairingSource: "native"
-    });
-  }
-  async function requestPairingFromClick() {
-    let granted = false;
-    try {
-      granted = await chrome.permissions.request({ permissions: ["nativeMessaging"] });
-    } catch (err) {
-      return { ok: false, message: err instanceof Error ? err.message : String(err) };
-    }
-    if (!granted) return { ok: false, message: "Chrome needs that permission to fetch the pairing for you. You can also pair by hand in Settings." };
-    return fetchPairing();
-  }
-
   // extension/src/sw/background.ts
   var PAIR_AFTER_RESTART_KEY = "pairAfterRestart";
   var commandsRunning = 0;
   var updateReady = false;
   var updateCheckedFor = "";
   function runningVersion() {
-    return true ? "0.9.35" : chrome.runtime.getManifest().version;
+    return true ? "0.9.38" : chrome.runtime.getManifest().version;
   }
   function isNewer(a, b) {
     const parse = (v) => (/^(\d+)\.(\d+)\.(\d+)/.exec(v) ?? []).slice(1).map(Number);
@@ -3383,11 +3908,13 @@
   var KEEPALIVE_ALARM = "chrome-mcp-keepalive";
   var MAX_BLOCKED = 10;
   var currentPolicy = null;
+  var serverSiteChecks = false;
+  var effectiveSitePolicy = () => serverSiteChecks ? localSitePolicy(currentPolicy) : currentPolicy;
   var reportBlocked = (host, method) => {
     void rememberBlocked(host, method).catch(() => void 0);
   };
-  var executor = new ChromeExecutor(() => currentPolicy, reportBlocked);
-  var border = new TabBorder(() => currentPolicy);
+  var executor = new ChromeExecutor(effectiveSitePolicy, reportBlocked);
+  var border = new TabBorder(effectiveSitePolicy);
   var RECONNECT_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
   var reconnectAttempt = 0;
   var reconnectTimer = null;
@@ -3406,6 +3933,11 @@
     reconnectAttempt = 0;
   }
   var ws = new WsClient({
+    onSiteChecks: (supported2) => {
+      serverSiteChecks = supported2;
+      setSiteChecksSupported(supported2);
+      void chrome.storage.local.set({ siteChecksSupported: supported2 });
+    },
     onCommand: (cmd, reply) => {
       commandsRunning++;
       void router.dispatch(cmd, reply).finally(() => {
@@ -3428,9 +3960,9 @@
         void chrome.storage.local.set({ allowedSites: [] });
         return;
       }
-      policy = { ...policy, allowDomains: policy.allowDomains.map(normalizeDomainPattern).filter(Boolean) };
+      policy = { ...policy, automaticSites: false, blockedDomains: [], allowDomains: policy.allowDomains.map(normalizeDomainPattern).filter(Boolean) };
       currentPolicy = policy;
-      void syncObserverScript(policy, (m) => console.debug("[mcp-browser-extension]", m));
+      void syncObserverScript(localSitePolicy(policy), (m) => console.debug("[mcp-browser-extension]", m));
       void onAllowlist(policy);
     },
     // Shown on the Options page, so you can tell which name this browser got.
@@ -3490,14 +4022,14 @@
     authorize: (cmd, verified) => approvals.authorize(cmd, verified),
     access: () => access.check(),
     activity: () => {
-      const generation = activity.token();
+      const generation2 = activity.token();
       return (entry) => {
-        void activity.record(entry, generation).catch(historyFailed);
+        void activity.record(entry, generation2).catch(historyFailed);
       };
     },
     exec: executor,
     send: (frame) => ws.send(frame),
-    getPolicy: () => currentPolicy,
+    getPolicy: effectiveSitePolicy,
     onBlocked: reportBlocked,
     log: (m) => console.debug("[mcp-browser-extension]", m),
     border
@@ -3528,7 +4060,7 @@
       const res = await fetch(chrome.runtime.getURL("manifest.json"), { cache: "no-store" });
       if (!res.ok) return;
       const onDisk = await res.json();
-      const loaded = true ? "0.9.35" : chrome.runtime.getManifest().version;
+      const loaded = true ? "0.9.38" : chrome.runtime.getManifest().version;
       if (typeof onDisk.version !== "string" || onDisk.version === loaded) return;
       const { reloadedFor } = await chrome.storage.local.get("reloadedFor");
       if (reloadedFor === onDisk.version) return;
@@ -3538,20 +4070,13 @@
     } catch {
     }
   }
-  async function ensureInstallId(installId) {
-    if (typeof installId === "string" && installId.length > 0) return installId;
-    const fresh = crypto.randomUUID();
-    await chrome.storage.local.set({ installId: fresh });
-    return fresh;
-  }
   async function getConfig() {
-    const { wsPort, token, profile, suggestedProfile, pairingSource, installId } = await chrome.storage.local.get([
+    const { wsPort, token, profile, suggestedProfile, pairingSource } = await chrome.storage.local.get([
       "wsPort",
       "token",
       "profile",
       "suggestedProfile",
-      "pairingSource",
-      "installId"
+      "pairingSource"
     ]);
     if (typeof wsPort === "number" && wsPort > 0 && typeof token === "string" && token.length > 0) {
       const label = typeof profile === "string" ? profile.trim() : "";
@@ -3562,23 +4087,30 @@
         token,
         profile: fromHelper ? "" : label,
         suggestedProfile: suggested || (fromHelper ? label : ""),
-        installId: await ensureInstallId(installId)
+        installId: await ensureInstallId()
       };
     }
     return null;
   }
   async function onAllowlist(policy) {
     await initializeBrowserPermissions();
-    const effective = { ...policy, allowDomains: await permittedSites(policy.allowDomains) };
+    const effective = { ...localSitePolicy(policy), allowDomains: await permittedSites(policy.allowDomains) };
     const { blockedSites } = await chrome.storage.local.get("blockedSites");
     const still = (Array.isArray(blockedSites) ? blockedSites : []).filter(
-      (b) => !isDomainAllowed(`https://${b.host}/`, effective)
+      (b) => !siteChecksEnabled() && !isDomainAllowed(`https://${b.host}/`, effective)
     );
     await chrome.storage.local.set({ allowedSites: policy.allowDomains, blockedSites: still });
     pendingBlocked = still.length;
     reflectBadge(ws.state);
   }
-  async function rememberBlocked(host, method) {
+  var blockedQueue = Promise.resolve();
+  function rememberBlocked(host, method) {
+    const next = blockedQueue.then(() => recordBlocked(host, method));
+    blockedQueue = next.catch(() => void 0);
+    return next;
+  }
+  async function recordBlocked(host, method) {
+    if (siteChecksConfigured()) return;
     const { blockedSites, dismissedSites } = await chrome.storage.local.get(["blockedSites", "dismissedSites"]);
     const listed = Array.isArray(blockedSites) ? blockedSites : [];
     const prior = listed.filter((b) => b.host !== host);
@@ -3614,6 +4146,12 @@
     })().catch(() => void 0);
   });
   var pendingBlocked = 0;
+  var pendingSiteWarnings = 0;
+  onSiteWarnings((count, fresh) => {
+    pendingSiteWarnings = count;
+    reflectBadge(ws.state);
+    if (fresh) void showPopup();
+  });
   void chrome.storage.local.get("blockedSites").then(({ blockedSites }) => {
     pendingBlocked = Array.isArray(blockedSites) ? blockedSites.length : 0;
   });
@@ -3634,7 +4172,7 @@
     }
   };
   function reflectBadge(state) {
-    const b = access.stopped ? { text: "OFF", color: "#b91c1c", title: "MCP Browser Extension \u2014 access stopped" } : pendingClients > 0 ? { text: "?", color: "#b45309", title: "App connection awaiting approval. Open Settings to review." } : state === "connected" && pendingBlocked > 0 ? BLOCKED_BADGE : pendingFeatures > 0 ? { text: "?", color: "#b45309", title: "Permission needed. Open the extension popup \u2192 Extra permissions." } : BADGE[state] ?? BADGE.idle;
+    const b = access.stopped ? { text: "OFF", color: "#b91c1c", title: "MCP Browser Extension \u2014 access stopped" } : pendingClients > 0 ? { text: "?", color: "#b45309", title: "App connection awaiting approval. Open Settings to review." } : state === "connected" && (pendingBlocked > 0 || pendingSiteWarnings > 0) ? BLOCKED_BADGE : pendingFeatures > 0 ? { text: "?", color: "#b45309", title: "Permission needed. Open the extension popup \u2192 Extra permissions." } : BADGE[state] ?? BADGE.idle;
     try {
       void chrome.action.setBadgeText({ text: b.text });
       void chrome.action.setBadgeBackgroundColor({ color: b.color });
@@ -3698,21 +4236,22 @@
   }
   syncProxyAuthListener();
   async function permissionsChanged() {
+    await refreshSiteChecks();
     syncProxyAuthListener();
     await refreshFeatureBadge();
     if (currentPolicy) {
       await onAllowlist(currentPolicy);
-      await syncObserverScript(currentPolicy, (m) => console.debug("[mcp-browser-extension]", m));
+      await syncObserverScript(localSitePolicy(currentPolicy), (m) => console.debug("[mcp-browser-extension]", m));
     }
     await border.clearAll();
   }
   var featureBadgeGeneration = 0;
   async function refreshFeatureBadge() {
-    const generation = ++featureBadgeGeneration;
+    const generation2 = ++featureBadgeGeneration;
     const saved = (await chrome.storage.local.get(FEATURE_REQUESTS_KEY))[FEATURE_REQUESTS_KEY];
     const requested = Array.isArray(saved) ? saved.filter((p) => typeof p === "string" && p in OPTIONAL_FEATURES) : [];
     const missing = await Promise.all(requested.map(async (permission) => !await chrome.permissions.contains({ permissions: [permission] })));
-    if (generation !== featureBadgeGeneration) return;
+    if (generation2 !== featureBadgeGeneration) return;
     const stillMissing = requested.filter((_, i) => missing[i]);
     pendingFeatures = stillMissing.length;
     reflectBadge(ws.state);
@@ -3728,6 +4267,9 @@
     void permissionsChanged().catch((err) => console.warn("[mcp-browser-extension] permission change failed", err));
   });
   chrome.storage.onChanged.addListener((changes, area) => {
+    if (area === "local" && (changes[SITE_CHECKS_KEY] || changes[SITE_CHECKS_BLOCKED_KEY] || changes[SITE_CHECKS_PENDING_KEY])) {
+      void permissionsChanged();
+    }
     if (area === "local" && changes[FEATURE_REQUESTS_KEY]) void refreshFeatureBadge();
     if (area === "local" && changes.tabBorder?.newValue === false) void border.clearAll();
     if (area === "local" && changes[PROXY_STORAGE_KEY]) void syncProxy();
@@ -3739,6 +4281,61 @@
     }
   });
   chrome.runtime.onMessage.addListener((msg, sender, reply) => {
+    if (["site_checks_mode", "site_warning_allow", "site_warning_revoke", "site_block"].includes(msg?.type)) {
+      if (!isApprovalPage(sender) || access.stopped || !ws.isConnected()) {
+        reply({ ok: false, error: "Use the connected extension popup or Settings to change website access." });
+        return;
+      }
+      let operation;
+      if (msg.type === "site_checks_mode" && typeof msg.allow === "boolean") {
+        if (msg.allow && !serverSiteChecks) {
+          reply({ ok: false, error: "Update and restart the connected MCP server first." });
+          return;
+        }
+        operation = changeSiteChecks(msg.allow);
+      } else if (msg.type === "site_warning_allow" && typeof msg.origin === "string" && Array.isArray(msg.reasons) && msg.reasons.length <= 32 && msg.reasons.every((id) => typeof id === "string")) {
+        operation = allowSiteWarning(msg.origin, msg.reasons);
+      } else if (msg.type === "site_warning_revoke" && typeof msg.origin === "string") {
+        operation = revokeSiteWarning(msg.origin);
+      } else if (msg.type === "site_block" && typeof msg.host === "string" && typeof msg.block === "boolean" && siteOrigins(msg.host).length) {
+        operation = blockLocalSite(normalizeDomainPattern(msg.host), msg.block);
+      } else {
+        reply({ ok: false, error: "Invalid website access request." });
+        return;
+      }
+      void operation.then(async () => {
+        if (currentPolicy) await onAllowlist(currentPolicy);
+        ws.send({ type: "approval_changed", v: PROTOCOL_VERSION });
+        reply({ ok: true });
+      }, (err) => reply({ ok: false, error: err instanceof Error ? err.message : "Could not save website access." })).finally(() => {
+        if (msg.type === "site_checks_mode" && msg.allow) void reopenPopup(sender);
+      });
+      return true;
+    }
+    if (msg?.type === "phone_pairing") {
+      if (!isApprovalPage(sender) || !PHONE_ACTIONS.includes(msg.action)) {
+        reply({ ok: false, message: "Use Pair phone in the extension popup." });
+        return;
+      }
+      const permission = msg.action === "create" ? chrome.permissions.request({ permissions: ["nativeMessaging"] }) : chrome.permissions.contains({ permissions: ["nativeMessaging"] });
+      void permission.then(async (granted) => {
+        if (!granted) {
+          reply({ ok: false, message: "Click Generate QR code to allow phone pairing." });
+          return;
+        }
+        if (typeof chrome.runtime.sendNativeMessage !== "function" && msg.action === "create") {
+          reply({ ok: false, message: "Permission saved. Reopen the extension and click Pair phone." });
+          setTimeout(() => chrome.runtime.reload(), 200);
+          return;
+        }
+        reply(await phonePairingAction(msg.action, msg.id, {
+          approvals,
+          stopped: () => access.stopped,
+          connected: () => ws.isConnected()
+        }));
+      }).catch(() => reply({ ok: false, message: "Could not open phone pairing. Try again." }));
+      return true;
+    }
     if (msg?.type === "connect_with_click") {
       if (!isApprovalPage(sender) || access.stopped) {
         reply({ ok: false, message: "Use Resume connection in the extension popup or Settings first." });
@@ -3774,9 +4371,9 @@
         return;
       }
       const operation = msg.allow ? chrome.permissions.request({ permissions: [msg.feature] }) : chrome.permissions.remove({ permissions: [msg.feature] });
-      void operation.then((changed) => reply({
-        ok: changed || !msg.allow,
-        ...!changed && msg.allow ? { error: "No access was added. You can allow it whenever you are ready." } : {}
+      void operation.then((changed2) => reply({
+        ok: changed2 || !msg.allow,
+        ...!changed2 && msg.allow ? { error: "No access was added. You can allow it whenever you are ready." } : {}
       }), () => reply({ ok: false, error: "Could not change this permission. Please try again." })).finally(() => {
         if (msg.allow) void reopenPopup(sender);
       });
@@ -3848,7 +4445,8 @@
           reply({ ok: false, error: "Please click Allow for this website and accept Chrome\u2019s permission request." });
           return;
         }
-        if (!msg.allow) await chrome.permissions.remove({ origins });
+        if (siteChecksEnabled()) await blockLocalSite(normalizeDomainPattern(msg.host), !msg.allow);
+        else if (!msg.allow) await chrome.permissions.remove({ origins });
         if (!ws.isConnected() || msg.allow && access.stopped) {
           reply({ ok: false, error: "Access is stopped or disconnected. Reconnect before allowing this website." });
           return;