mcp-browser-extension 0.9.36 → 0.9.38

package/README.md

@@ -53,12 +53,12 @@ Chrome, so a page the agent opens is the page you would see.
 Other tools drive a signed-in Chrome too (the `hangwin/mcp-chrome` extension,
 for one), so the question is what you get on top of the session:
 
-- **A per-domain allowlist, deny-all by default.** With no flags the agent can
-  read nothing. `--allow-domain mail.google.com --allow-domain github.com`
-  opens exactly those hosts (`*.example.com` covers a domain and its
-  subdomains); every other site is refused before the call reaches the page.
-  Reads are gated, not only clicks, and the extension re-checks the same policy
-  on its side. Mutations, eval, downloads and uploads are separate opt-ins.
+- **Website checks with explicit Chrome permission.** Local suspicious-site
+  checks are on by default. After one Chrome permission grant, ordinary sites
+  work automatically and flagged sites need Allow. Named-site approval remains
+  available; `--no-site-grants` enforces the server's fixed allowlist. Reads and
+  actions are checked in the extension. Mutations, eval, downloads and uploads
+  are separate opt-ins.
 - **Password values are never returned**, and `--redact` scrubs tokens, API
   keys and JWTs out of page reads.
 - **An audit trail**: every call is logged with the URL, the allow/deny
@@ -142,10 +142,11 @@ with `/mcp` inside a session — no restart needed.
 
 </details>
 
-By default everything is **deny-all** (no domains, no eval, no mutations). Grant
-exactly what you need with `--allow-domain <glob>` (repeatable), `--enable-mutations`,
-`--enable-downloads`, `--enable-uploads`, or `--unsafe-enable-eval`. All-site access
-is not supported; approve named websites in the Chrome extension popup.
+Website access requires app approval and Chrome permission. Suspicious-site
+checks are on by default; click **Allow website access** once in the extension.
+For a fixed named-site policy, use `--no-site-grants --allow-domain <glob>`.
+Mutations, downloads, uploads and eval stay off until enabled with
+`--enable-mutations`, `--enable-downloads`, `--enable-uploads` or `--unsafe-enable-eval`.
 
 Email verification is on by default. For a trusted, local unattended setup, you
 can opt out with `--no-email-verification` (or set
@@ -224,7 +225,22 @@ connection creates a new key and needs a new approval. **Remove access** blocks
 commands from that key; an action already running may finish. YOLO, bypass-permission
 mode and `--no-email-verification` cannot skip this extension check.
 
-**6. Allow the websites you need.** The popup shows a Website access request.
+**6. Allow website access once.** Suspicious-site checks are on by default. In the
+popup or Settings, **Allow website access** asks Chrome for HTTP/HTTPS access. After
+you accept, ordinary sites work without an Allow request. Local checks pause
+flagged addresses and risky login forms and show their reasons under **Waiting
+for Allow**. Allow approves only the displayed reasons for that exact origin;
+new reasons ask again. **Blocked websites** lets you block or restore any site.
+Both the extension and connected server must be updated; `--no-site-grants`
+disables this option.
+
+These checks run locally with no external checking service. They can miss scams
+and flag legitimate sites. Form checks run after a page loads, before app reads
+or actions; they do not prevent page scripts from running or detect all malware.
+App approval, Stop access and the configured tool permissions still apply.
+
+Choose **Use per-site approval** or **Turn off** to use named-site access instead.
+With automatic access off, the popup shows a Website access request.
 Click **Allow**, then accept Chrome's website permission prompt if shown. This
 single flow grants that named website in both Chrome and the server's allowlist.
 Allowing a website lets approved apps read and take actions there, including
@@ -707,17 +723,19 @@ status badge, and a stable pairing token (`--persist-token`).
 
 ## Security posture (default)
 
-**Deny-all safe mode.** With no policy configured: empty domain allowlist,
-`eval` off, downloads off, mutating tools off. Opt in explicitly:
+**Access requires consent.** The server starts with an empty named-site allowlist;
+the extension's default suspicious-site mode requires an explicit Chrome host
+grant before ordinary sites work automatically. Eval, downloads and mutations
+stay off until enabled. Named-site policy remains available:
 
 ```
-mcp-browser-extension --allow-domain example.com --enable-mutations
+mcp-browser-extension --no-site-grants --allow-domain example.com --enable-mutations
 mcp-browser-extension --policy ./policy.json          # see policy.example.json
 mcp-browser-extension --enable-observers              # console/network/dialog capture (patches page globals)
 mcp-browser-extension --redact                        # scrub secret-shaped strings out of page reads
 ```
 
-**Allowing a site without a restart.** When a call is refused because its site
+**Named-site mode: allowing a site without a restart.** When a call is refused because its site
 is not allowed, the extension's toolbar icon shows a `?`. Click it: the popup
 lists the blocked site with an **Allow** button, shows whether the site you are on
 is allowed (with its own Allow), and lists the allowed sites. The Options page

package/dist/shared/client-auth.d.ts

@@ -14,6 +14,8 @@ export interface ClientProof {
     signature: string;
 }
 export interface ClientConnection {
+    kind?: 'phone';
+    phoneId?: string;
     id: string;
     publicKey: string;
     name: string;

package/dist/shared/phone-pairing.d.ts

@@ -0,0 +1,35 @@
+/** Versioned contract shared by the extension and the future phone client. */
+export declare const PHONE_PAIRING_VERSION = 1;
+export declare const PHONE_INVITATION_MS: number;
+export declare const PHONE_ACCESS_MS: number;
+export declare const PHONE_MAX_DEVICES = 10;
+export interface PhoneDevice {
+    id: string;
+    name: string;
+    clientId: string;
+    publicKey: string;
+    requestedAt: number;
+    expiresAt: number;
+    state: 'pending' | 'paired';
+    confirmation: string;
+    /** Added by Chrome when presenting a saved pairing to the person. */
+    browserApproved?: boolean;
+}
+export interface PhonePairingState {
+    online: boolean;
+    profile: string;
+    invitation?: {
+        payload: string;
+        expiresAt: number;
+    };
+    devices: PhoneDevice[];
+}
+export type PhoneAction = 'state' | 'create' | 'cancel' | 'approve' | 'deny' | 'remove';
+export declare const PHONE_ACTIONS: readonly PhoneAction[];
+export type PhoneReply = {
+    ok: true;
+    state: PhonePairingState;
+} | {
+    ok: false;
+    message: string;
+};

package/dist/shared/phone-pairing.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PHONE_ACTIONS = exports.PHONE_MAX_DEVICES = exports.PHONE_ACCESS_MS = exports.PHONE_INVITATION_MS = exports.PHONE_PAIRING_VERSION = void 0;
+/** Versioned contract shared by the extension and the future phone client. */
+exports.PHONE_PAIRING_VERSION = 1;
+exports.PHONE_INVITATION_MS = 2 * 60_000;
+exports.PHONE_ACCESS_MS = 30 * 24 * 60 * 60_000;
+exports.PHONE_MAX_DEVICES = 10;
+exports.PHONE_ACTIONS = ['state', 'create', 'cancel', 'approve', 'deny', 'remove'];
+//# sourceMappingURL=phone-pairing.js.map

package/dist/shared/policy.js

@@ -133,6 +133,9 @@ function isDomainAllowed(url, policy) {
     const host = hostOf(url);
     if (!host)
         return false;
+    if (policy.automaticSites && /^https?:\/\//i.test(url)) {
+        return !(policy.blockedDomains ?? []).some((pat) => globMatches(host, pat));
+    }
     return policy.allowDomains.some((pat) => globMatches(host, pat));
 }
 /**
@@ -177,6 +180,10 @@ function evaluatePolicy(url, method, policy) {
         return { ok: true };
     if (!isDomainAllowed(url, policy)) {
         const host = hostOf(url) || url;
+        if (policy.automaticSites && /^https?:\/\//i.test(url))
+            return {
+                ok: false, reason: `Access to ${host} was removed. Restore it under Blocked websites in extension Settings.`,
+            };
         return { ok: false, reason: blockedDomainMessage(host) };
     }
     return { ok: true };

package/dist/shared/protocol.d.ts

@@ -24,6 +24,8 @@ export type ProtocolVersion = typeof PROTOCOL_VERSION;
  * supported because the extension re-reads the handshake on every failed dial.
  */
 export declare const DEFAULT_WS_PORT: 38017;
+/** Maximum encoded JSON frame, shared by the receiver and result sender. */
+export declare const MAX_BRIDGE_FRAME_BYTES: number;
 /**
  * The Chrome Web Store copy of the extension. Chrome updates that copy on its
  * own; any other id is an unpacked (or self-packed) copy, which only changes
@@ -48,6 +50,8 @@ export declare const CLOSE_SUPERSEDED: 4000;
  * every call. Without it, the server falls back to fetching the URL itself.
  */
 export declare const WIRE_CAP_TAB_URL: "tab-url";
+/** Signed local website checks, including the browser's automatic-access setting. */
+export declare const WIRE_CAP_SITE_CHECKS: "site-checks-v1";
 /**
  * `fill-form`: this extension handles the `fill_form` wire method — every field
  * of a form written in ONE round-trip. Without it the server fills field by
@@ -100,6 +104,9 @@ export declare const FILL_FORM_MAX_TIMEOUT_MS = 600000;
  * grows with the field count (10 s base + 6 s per field), clamped to 60 s..10 min.
  */
 export declare function fillFormTimeoutMs(fields: number): number;
+/** Drawing sends one mouse event per point plus press/release events per stroke.
+ * Budget the whole drawing separately from the deadline for one stalled event. */
+export declare function drawTimeoutMs(points: number, strokes: number): number;
 /**
  * `fill_form` result. Ops run in order and stop at the first failure, so
  * `filled` counts the fields that landed and `error` names the one that did not.
@@ -124,10 +131,10 @@ export interface DrawStroke {
  * `download_file` (privileged, executor-owned) and `ping_probe` (a short-deadline
  * responsiveness check used to detect a dead-but-not-yet-reconnected worker).
  */
-export type WireMethod = 'tabs_list' | 'tab_select' | 'tab_new' | 'tab_close' | 'navigate' | 'back' | 'forward' | 'reload' | 'click' | 'draw' | 'type' | 'press' | 'hover' | 'scroll' | 'screenshot' | 'get_text' | 'get_html' | 'snapshot' | 'select_option' | 'get_cookies' | 'storage' | 'eval' | 'wait_for' | 'download_file' | 'upload_file' | 'frames_list' | 'observers' | 'print_pdf' | 'fill_form' | 'proxy_status' | 'ping_probe';
+export type WireMethod = 'tabs_list' | 'tab_select' | 'tab_new' | 'tab_close' | 'navigate' | 'back' | 'forward' | 'reload' | 'click' | 'draw' | 'type' | 'press' | 'hover' | 'scroll' | 'screenshot' | 'get_text' | 'get_html' | 'snapshot' | 'select_option' | 'get_cookies' | 'storage' | 'eval' | 'wait_for' | 'download_file' | 'upload_file' | 'frames_list' | 'observers' | 'print_pdf' | 'fill_form' | 'proxy_status' | 'ping_probe' | 'site_check';
 /** Runtime list of every WireMethod, for boot-time drift assertions on both ends. */
 export declare const WIRE_METHODS: readonly WireMethod[];
-export type ExecutorErrorCode = 'NO_TARGET' | 'TARGET_GONE' | 'DETACHED' | 'DEVTOOLS_OPEN' | 'SELECTOR_NOT_FOUND' | 'REF_EXPIRED' | 'EVAL_THREW' | 'TIMEOUT' | 'BAD_ARGS' | 'CDP_ERROR' | 'POLICY_DENIED' | 'DOWNLOAD_FAILED' | 'UPLOAD_FAILED' | 'FRAME_NOT_FOUND' | 'OBSERVERS_DISABLED' | 'UNKNOWN_METHOD';
+export type ExecutorErrorCode = 'RESULT_TOO_LARGE' | 'NO_TARGET' | 'TARGET_GONE' | 'DETACHED' | 'DEVTOOLS_OPEN' | 'SELECTOR_NOT_FOUND' | 'REF_EXPIRED' | 'EVAL_THREW' | 'TIMEOUT' | 'BAD_ARGS' | 'CDP_ERROR' | 'POLICY_DENIED' | 'DOWNLOAD_FAILED' | 'UPLOAD_FAILED' | 'FRAME_NOT_FOUND' | 'OBSERVERS_DISABLED' | 'UNKNOWN_METHOD';
 export interface BaseFrame {
     type: string;
     v: ProtocolVersion;
@@ -168,6 +175,9 @@ export interface HelloFrame extends BaseFrame {
  */
 export interface WirePolicy {
     allowDomains: string[];
+    /** Extension-local overlay only; server configuration cannot opt a browser in. */
+    automaticSites?: boolean;
+    blockedDomains?: string[];
     allowEval: boolean;
     allowDownloads: boolean;
     allowUploads: boolean;
@@ -185,6 +195,7 @@ export interface WirePolicy {
 }
 export interface WelcomeFrame extends BaseFrame {
     type: 'welcome';
+    siteChecks?: boolean;
     serverVersion: string;
     sessionId: string;
     heartbeatMs: number;

package/dist/shared/protocol.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
+exports.WIRE_METHODS = exports.FILL_FORM_MAX_TIMEOUT_MS = exports.FILL_FORM_PER_FIELD_MS = exports.FILL_FORM_MIN_TIMEOUT_MS = exports.WIRE_CAP_PROXY = exports.WIRE_CAP_FILL_FORM = exports.WIRE_CAP_SITE_CHECKS = exports.WIRE_CAP_TAB_URL = exports.CLOSE_SUPERSEDED = exports.CLOSE_UNAUTHORIZED = exports.BRIDGE_HOST = exports.STORE_EXTENSION_URL = exports.STORE_EXTENSION_ID = exports.MAX_BRIDGE_FRAME_BYTES = exports.DEFAULT_WS_PORT = exports.PROTOCOL_VERSION = void 0;
 exports.fillFormTimeoutMs = fillFormTimeoutMs;
+exports.drawTimeoutMs = drawTimeoutMs;
 /**
  * shared/protocol.ts — THE SINGLE SOURCE OF TRUTH for the wire contract.
  *
@@ -26,6 +27,8 @@ exports.PROTOCOL_VERSION = 1;
  * supported because the extension re-reads the handshake on every failed dial.
  */
 exports.DEFAULT_WS_PORT = 38017;
+/** Maximum encoded JSON frame, shared by the receiver and result sender. */
+exports.MAX_BRIDGE_FRAME_BYTES = 4 * 1024 * 1024;
 /**
  * The Chrome Web Store copy of the extension. Chrome updates that copy on its
  * own; any other id is an unpacked (or self-packed) copy, which only changes
@@ -50,6 +53,8 @@ exports.CLOSE_SUPERSEDED = 4000;
  * every call. Without it, the server falls back to fetching the URL itself.
  */
 exports.WIRE_CAP_TAB_URL = 'tab-url';
+/** Signed local website checks, including the browser's automatic-access setting. */
+exports.WIRE_CAP_SITE_CHECKS = 'site-checks-v1';
 /**
  * `fill-form`: this extension handles the `fill_form` wire method — every field
  * of a form written in ONE round-trip. Without it the server fills field by
@@ -79,6 +84,12 @@ function fillFormTimeoutMs(fields) {
     const n = Number.isFinite(fields) && fields > 0 ? Math.floor(fields) : 0;
     return Math.min(exports.FILL_FORM_MAX_TIMEOUT_MS, Math.max(exports.FILL_FORM_MIN_TIMEOUT_MS, 10_000 + n * exports.FILL_FORM_PER_FIELD_MS));
 }
+/** Drawing sends one mouse event per point plus press/release events per stroke.
+ * Budget the whole drawing separately from the deadline for one stalled event. */
+function drawTimeoutMs(points, strokes) {
+    const events = Math.max(0, points) + 2 * Math.max(0, strokes);
+    return Math.min(240_000, Math.max(30_000, 10_000 + events * 60));
+}
 /** Runtime list of every WireMethod, for boot-time drift assertions on both ends. */
 exports.WIRE_METHODS = [
     'tabs_list',
@@ -112,5 +123,6 @@ exports.WIRE_METHODS = [
     'fill_form',
     'proxy_status',
     'ping_probe',
+    'site_check',
 ];
 //# sourceMappingURL=protocol.js.map

package/dist/shared/site-risk.d.ts

@@ -0,0 +1,31 @@
+/** Local warning rules. An empty result means no rule matched, never a safety guarantee. */
+export declare const SITE_CHECKS_KEY = "localSiteChecksV1";
+export declare const SITE_CHECKS_PENDING_KEY = "localSiteWarnings";
+export declare const SITE_CHECKS_APPROVALS_KEY = "localSiteWarningApprovals";
+export declare const SITE_CHECKS_BLOCKED_KEY = "localBlockedSites";
+export declare const AUTOMATIC_SITE_ORIGINS: string[];
+export interface SiteWarning {
+    id: string;
+    reason: string;
+}
+export interface SiteWarningRequest {
+    origin: string;
+    host: string;
+    warnings: SiteWarning[];
+    at: number;
+}
+export interface LoginSignals {
+    url: string;
+    title: string;
+    passwords: number;
+    forms: Array<{
+        action: string;
+        method: string;
+    }>;
+}
+export declare function isLocalDevelopmentHost(host: string): boolean;
+export declare function siteUrlWarnings(input: string): SiteWarning[];
+export declare function loginWarnings(signals: LoginSignals): SiteWarning[];
+export declare function uniqueWarnings(warnings: SiteWarning[]): SiteWarning[];
+/** Self-contained isolated-world reader. Never reads field values or page text. */
+export declare function collectLoginSignals(): LoginSignals;

package/dist/shared/site-risk.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTOMATIC_SITE_ORIGINS = exports.SITE_CHECKS_BLOCKED_KEY = exports.SITE_CHECKS_APPROVALS_KEY = exports.SITE_CHECKS_PENDING_KEY = exports.SITE_CHECKS_KEY = void 0;
+exports.isLocalDevelopmentHost = isLocalDevelopmentHost;
+exports.siteUrlWarnings = siteUrlWarnings;
+exports.loginWarnings = loginWarnings;
+exports.uniqueWarnings = uniqueWarnings;
+exports.collectLoginSignals = collectLoginSignals;
+/** Local warning rules. An empty result means no rule matched, never a safety guarantee. */
+exports.SITE_CHECKS_KEY = 'localSiteChecksV1';
+exports.SITE_CHECKS_PENDING_KEY = 'localSiteWarnings';
+exports.SITE_CHECKS_APPROVALS_KEY = 'localSiteWarningApprovals';
+exports.SITE_CHECKS_BLOCKED_KEY = 'localBlockedSites';
+exports.AUTOMATIC_SITE_ORIGINS = ['http://*/*', 'https://*/*'];
+const BRANDS = {
+    google: ['google.com', 'google.co.uk', 'google.com.pk', 'google.de', 'google.fr', 'google.co.in', 'google.com.au', 'google.ca', 'google.co.jp', 'youtube.com'],
+    microsoft: ['microsoft.com', 'microsoftonline.com', 'live.com', 'office.com', 'outlook.com'],
+    apple: ['apple.com', 'icloud.com'],
+    paypal: ['paypal.com'],
+    amazon: ['amazon.com', 'amazon.co.uk', 'amazon.de', 'amazon.fr', 'amazon.in', 'amazon.ca', 'amazon.com.au', 'amazon.co.jp', 'amazon.es', 'amazon.it'],
+    github: ['github.com', 'github.dev'],
+    facebook: ['facebook.com', 'meta.com'],
+    instagram: ['instagram.com', 'meta.com'],
+    linkedin: ['linkedin.com'],
+    dropbox: ['dropbox.com'],
+    coinbase: ['coinbase.com'],
+};
+const AUTH_WORD = /(?:^|[.\-])(login|signin|sign-in|verify|verification|secure|account|password|recover|support)(?:[.\-]|$)/;
+function hostIn(host, domains) {
+    return domains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+}
+/** RFC 3492 decoding, bounded by DNS label length. Invalid labels remain unchanged. */
+function unicodeLabel(label) {
+    if (!label.startsWith('xn--') || label.length > 63)
+        return label;
+    try {
+        const input = label.slice(4);
+        const split = input.lastIndexOf('-');
+        const points = split < 0 ? [] : Array.from(input.slice(0, split), (c) => c.codePointAt(0));
+        let pos = split < 0 ? 0 : split + 1;
+        let n = 128, i = 0, bias = 72;
+        while (pos < input.length) {
+            const old = i;
+            let weight = 1;
+            for (let k = 36;; k += 36) {
+                const code = input.charCodeAt(pos++);
+                const digit = code >= 97 && code <= 122 ? code - 97 : code >= 48 && code <= 57 ? code - 22 : 36;
+                if (digit >= 36 || !Number.isSafeInteger(i + digit * weight))
+                    return label;
+                i += digit * weight;
+                const t = k <= bias ? 1 : k >= bias + 26 ? 26 : k - bias;
+                if (digit < t)
+                    break;
+                weight *= 36 - t;
+            }
+            const size = points.length + 1;
+            let delta = Math.floor((i - old) / (old === 0 ? 700 : 2));
+            delta += Math.floor(delta / size);
+            let k = 0;
+            while (delta > 455) {
+                delta = Math.floor(delta / 35);
+                k += 36;
+            }
+            bias = k + Math.floor(36 * delta / (delta + 38));
+            n += Math.floor(i / size);
+            i %= size;
+            if (n > 0x10ffff || (n >= 0xd800 && n <= 0xdfff))
+                return label;
+            points.splice(i++, 0, n);
+        }
+        return String.fromCodePoint(...points);
+    }
+    catch {
+        return label;
+    }
+}
+/** A deliberately small confusable set for these rules, not a full Unicode classifier. */
+function skeleton(label) {
+    const lookalikes = {
+        'а': 'a', 'е': 'e', 'о': 'o', 'р': 'p', 'с': 'c', 'у': 'y', 'х': 'x',
+        'і': 'i', 'ј': 'j', 'ӏ': 'l', 'ѕ': 's', 'ԁ': 'd', 'ԛ': 'q',
+        'α': 'a', 'ο': 'o', 'ρ': 'p', 'ν': 'v', 'ι': 'i', '0': 'o', '1': 'l',
+    };
+    return Array.from(unicodeLabel(label).toLowerCase(), (c) => lookalikes[c] ?? c).join('');
+}
+function isLocalDevelopmentHost(host) {
+    return host === 'localhost' || host.endsWith('.localhost') || host === '[::1]' || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+function siteUrlWarnings(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        return [];
+    }
+    if (!/^https?:$/.test(url.protocol))
+        return [];
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    const warnings = [];
+    if (url.username && /[.]/.test(decodeURIComponentSafe(url.username))) {
+        warnings.push({ id: 'hidden-destination', reason: `The address puts a website name before @. The actual destination is ${host}.` });
+    }
+    const labels = host.split('.');
+    for (const [brand, domains] of Object.entries(BRANDS)) {
+        if (hostIn(host, domains))
+            continue;
+        if (domains.some((domain) => host.includes(`${domain}.`))) {
+            warnings.push({ id: `misleading-domain:${brand}`, reason: `The address includes ${brand}'s domain but actually belongs to ${host}.` });
+            continue;
+        }
+        if (labels.some((label) => label !== brand && skeleton(label) === brand)) {
+            warnings.push({ id: `lookalike:${brand}`, reason: `The address uses lookalike characters to resemble ${brand}.` });
+            continue;
+        }
+        // A brand in an article path or an ordinary unrelated domain is not enough.
+        if (labels.some((label) => label.split('-').includes(brand)) && AUTH_WORD.test(host)) {
+            warnings.push({ id: `brand-login:${brand}`, reason: `The address combines ${brand}'s name with login or account wording outside its recognised domains.` });
+        }
+    }
+    return warnings;
+}
+function decodeURIComponentSafe(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function loginWarnings(signals) {
+    const warnings = siteUrlWarnings(signals.url);
+    if (!signals.passwords)
+        return warnings;
+    let page;
+    try {
+        page = new URL(signals.url);
+    }
+    catch {
+        return warnings;
+    }
+    if (!/^https?:$/.test(page.protocol))
+        return warnings;
+    const local = isLocalDevelopmentHost(page.hostname);
+    if (page.protocol === 'http:' && !local)
+        warnings.push({
+            id: 'unencrypted-login', reason: 'This page asks for a password over an unencrypted HTTP connection.',
+        });
+    for (const form of signals.forms.slice(0, 32)) {
+        let action;
+        try {
+            action = new URL(form.action || signals.url, signals.url);
+        }
+        catch {
+            continue;
+        }
+        if (action.protocol === 'http:' && !(local && isLocalDevelopmentHost(action.hostname)))
+            warnings.push({
+                id: `unencrypted-password-destination:${action.origin}`, reason: `A password form sends to an unencrypted address at ${action.hostname}.`,
+            });
+        if (form.method === 'get')
+            warnings.push({
+                id: 'password-in-address', reason: 'A password form is configured to put its fields in the website address.',
+            });
+    }
+    const title = signals.title.slice(0, 300).toLowerCase();
+    if (/\b(sign[ -]?in|log[ -]?in|verify|account|password)\b/.test(title)) {
+        for (const [brand, domains] of Object.entries(BRANDS)) {
+            if (new RegExp(`\\b${brand}\\b`).test(title) && !hostIn(page.hostname, domains)) {
+                // Mere "Sign in with X" buttons without password fields are never enough.
+                warnings.push({ id: `login-brand:${brand}`, reason: `This password page presents itself as ${brand}, but its address is ${page.hostname}.` });
+            }
+        }
+    }
+    return uniqueWarnings(warnings);
+}
+function uniqueWarnings(warnings) {
+    return [...new Map(warnings.map((warning) => [warning.id, warning])).values()];
+}
+/** Self-contained isolated-world reader. Never reads field values or page text. */
+function collectLoginSignals() {
+    const inputs = Array.from(document.querySelectorAll('input[type="password"]'))
+        .filter((input) => !input.disabled && input.getClientRects().length > 0).slice(0, 32);
+    const forms = [...new Set(inputs.map((input) => input.form).filter((form) => !!form))];
+    return {
+        url: location.href, title: document.title.slice(0, 300), passwords: inputs.length,
+        forms: forms.map((form) => ({ action: form.action, method: form.getAttribute('method')?.toLowerCase() ?? '' })),
+    };
+}
+//# sourceMappingURL=site-risk.js.map

package/dist/src/bridge/client-identity.d.ts

@@ -1,10 +1,16 @@
+import { type KeyObject } from 'node:crypto';
 import { type ClientProof } from '../../shared/client-auth';
 import type { CommandFrame } from '../../shared/protocol';
-/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
-export declare function createClientIdentity(name: () => string): {
+import type { Workspace } from './datadir';
+export interface ClientIdentity {
     id: string;
-    sign(cmd: Pick<CommandFrame, "v" | "method" | "params" | "tabId" | "timeoutMs">, challenge: string): ClientProof;
-};
-export type ClientIdentity = ReturnType<typeof createClientIdentity>;
+    publicKey: string;
+    profile?: string;
+    workspace?: Workspace;
+    assertAccess?: () => void;
+    sign(cmd: Pick<CommandFrame, 'v' | 'method' | 'params' | 'tabId' | 'timeoutMs'>, challenge: string): ClientProof;
+}
+/** Ordinary app keys are ephemeral; paired phones supply their privately stored key. */
+export declare function createClientIdentity(name: () => string, savedKey?: KeyObject): ClientIdentity;
 export declare const withClientIdentity: <T>(identity: ClientIdentity, fn: () => T) => T;
 export declare const currentClientIdentity: () => ClientIdentity | undefined;

package/dist/src/bridge/client-identity.js

@@ -5,13 +5,16 @@ exports.createClientIdentity = createClientIdentity;
 const node_async_hooks_1 = require("node:async_hooks");
 const node_crypto_1 = require("node:crypto");
 const client_auth_1 = require("../../shared/client-auth");
-/** Private keys stay in this MCP session's memory. They never enter pairing files or the hub. */
-function createClientIdentity(name) {
-    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ec', { namedCurve: 'prime256v1' });
+const workspace_1 = require("./workspace");
+/** Ordinary app keys are ephemeral; paired phones supply their privately stored key. */
+function createClientIdentity(name, savedKey) {
+    const privateKey = savedKey ?? (0, node_crypto_1.generateKeyPairSync)('ec', { namedCurve: 'prime256v1' }).privateKey;
+    const publicKey = (0, node_crypto_1.createPublicKey)(privateKey);
     const der = publicKey.export({ type: 'spki', format: 'der' });
     const encoded = der.toString('base64');
     return {
         id: (0, node_crypto_1.createHash)('sha256').update(der).digest('hex'),
+        publicKey: encoded,
         sign(cmd, challenge) {
             const proof = { publicKey: encoded, name: (0, client_auth_1.clientName)(name()), challenge, issuedAt: Date.now(), nonce: (0, node_crypto_1.randomUUID)() };
             return { ...proof, signature: (0, node_crypto_1.sign)('sha256', Buffer.from((0, client_auth_1.clientSigningPayload)(cmd, proof)), {
@@ -21,7 +24,7 @@ function createClientIdentity(name) {
     };
 }
 const current = new node_async_hooks_1.AsyncLocalStorage();
-const withClientIdentity = (identity, fn) => current.run(identity, fn);
+const withClientIdentity = (identity, fn) => current.run(identity, () => identity.workspace ? (0, workspace_1.withWorkspace)(identity.workspace, fn) : fn());
 exports.withClientIdentity = withClientIdentity;
 const currentClientIdentity = () => current.getStore();
 exports.currentClientIdentity = currentClientIdentity;

package/dist/src/bridge/connection.js

@@ -14,6 +14,7 @@ function defaultTimeoutFor(method) {
  *  near-superset; unknown codes degrade to CDP_ERROR while keeping the message). */
 function mapWireErrorCode(code) {
     const known = {
+        RESULT_TOO_LARGE: 'RESULT_TOO_LARGE',
         TIMEOUT: 'TIMEOUT',
         POLICY_DENIED: 'POLICY_DENIED',
         DETACHED: 'DETACHED',

package/dist/src/bridge/server.d.ts

@@ -14,6 +14,7 @@ export type PairState = 'ok' | 'profile_mismatch' | 'token_mismatch' | 'version_
 export type ProfileNaming = 'options' | 'auto' | 'legacy';
 /** One paired browser, as reported by chrome_status. */
 export interface PairedProfile {
+    siteChecks?: boolean;
     /** Public, extension-generated replay scope; not a credential. */
     approvalChallenge?: string;
     name: string;