poltertab 1.9.0-beta.2 → 1.10.0-beta.1

package/bin/poltertab.js

@@ -25,6 +25,11 @@ if (arg === "setup") {
     });
 } else if (arg === "--version" || arg === "-v") {
   console.log(require("../package.json").version);
+} else if (arg === "uploads") {
+  require("./uploads.js").run(process.argv.slice(3)).catch((err) => {
+    console.error(`\n  uploads failed: ${err.message}\n`);
+    process.exit(1);
+  });
 } else if (arg === "--help" || arg === "-h") {
   console.log(`
   poltertab — browser control for AI agents
@@ -32,10 +37,16 @@ if (arg === "setup") {
     poltertab           start the MCP server (stdio)
     poltertab setup     install skill, CLAUDE.md section, and MCP registration
     poltertab doctor    versions, update check, and extension/server skew
+    poltertab uploads   manage upload-allowed folders and view the activity log
     poltertab --version
 
   setup flags:   --global | --project  (skips the prompt)
   doctor flags:  --force (ignore the cached update check), --port <n>
+  uploads:
+    poltertab uploads list             show allowed folders, always-blocked, and status
+    poltertab uploads allow <dir>      add a directory to the allowlist
+    poltertab uploads revoke <dir>     remove a directory from the allowlist
+    poltertab uploads log [-n N]       tail the upload activity log (default: 20 lines)
 
   POLTERTAB_HOME             where memory and downloads live
   POLTERTAB_NO_UPDATE_CHECK  set to disable the npm version check

package/bin/uploads.js

@@ -0,0 +1,238 @@
+"use strict";
+
+// poltertab uploads — manage the upload allowlist and view the activity log.
+// Works with no server or extension running; edits config.json directly.
+
+const os = require("os");
+const {
+  getAllowlist,
+  addAllowlistEntry,
+  removeAllowlistEntry,
+  addTrustedExtensionId,
+} = require("../mcp-server/uploads-config.js");
+const { getRecentLog } = require("../mcp-server/uploads-log.js");
+const { validateAllowlistEntry, buildAlwaysBlocked } = require("../mcp-server/upload-paths.js");
+
+async function run(argv) {
+  const sub = argv[0];
+
+  if (!sub || sub === "list") {
+    const homeDir = os.homedir();
+    const allowlist = getAllowlist();
+    const alwaysBlocked = buildAlwaysBlocked(homeDir);
+
+    console.log("\nUpload configuration (~/.poltertab/config.json)");
+    console.log("─".repeat(50));
+
+    if (allowlist.length === 0) {
+      console.log("\n  Allowed folders: (none — uploads disabled)");
+    } else {
+      console.log("\n  Allowed folders:");
+      for (const dir of allowlist) {
+        console.log(`    + ${dir}`);
+      }
+    }
+
+    console.log("\n  Always blocked (cannot be changed):");
+    for (const dir of alwaysBlocked) {
+      console.log(`    ✗ ${dir}`);
+    }
+    console.log(`    ✗ ~/.*  (home dotfiles)`);
+    console.log();
+    return;
+  }
+
+  if (sub === "allow") {
+    const dir = argv[1];
+    if (!dir) {
+      console.error("Usage: poltertab uploads allow <dir>");
+      process.exit(1);
+    }
+    const v = validateAllowlistEntry(dir);
+    if (!v.ok) {
+      console.error(`\n  Error: ${v.errorText}\n`);
+      process.exit(1);
+    }
+    const added = addAllowlistEntry(dir);
+    if (added) {
+      console.log(`\n  Added: ${dir}\n`);
+    } else {
+      console.log(`\n  Already present: ${dir}\n`);
+    }
+    return;
+  }
+
+  if (sub === "revoke") {
+    const dir = argv[1];
+    if (!dir) {
+      console.error("Usage: poltertab uploads revoke <dir>");
+      process.exit(1);
+    }
+    const removed = removeAllowlistEntry(dir);
+    if (removed) {
+      console.log(`\n  Removed: ${dir}\n`);
+    } else {
+      console.log(`\n  Not found in allowlist: ${dir}\n`);
+    }
+    return;
+  }
+
+  if (sub === "log") {
+    let n = 20;
+    const nIdx = argv.indexOf("-n");
+    if (nIdx !== -1 && argv[nIdx + 1]) {
+      n = parseInt(argv[nIdx + 1], 10) || 20;
+    }
+    const entries = getRecentLog(n);
+    if (entries.length === 0) {
+      console.log("\n  No upload activity recorded.\n");
+      return;
+    }
+    console.log(`\nUpload activity log (last ${entries.length} entries)`);
+    console.log("─".repeat(50));
+    for (const e of entries) {
+      const paths = Array.isArray(e.paths) ? e.paths.join(", ") : String(e.paths);
+      console.log(`  ${e.ts}  [${e.outcome}]  method=${e.method}  ${paths}`);
+    }
+    console.log();
+    return;
+  }
+
+  if (sub === "pair") {
+    await runPair(argv.slice(1));
+    return;
+  }
+
+  console.error(`\n  Unknown subcommand: ${sub}`);
+  console.error("  Usage: poltertab uploads list|allow <dir>|revoke <dir>|log [-n N]|pair [--id <id>]\n");
+  process.exit(1);
+}
+
+// Reads the port poltertab is listening on from the default config or falls back.
+function resolveWsPort() {
+  try {
+    const { resolvePort } = require("../mcp-server/config.js");
+    return resolvePort();
+  } catch (_) {
+    return 7822;
+  }
+}
+
+// poltertab uploads pair — link a Chrome extension by its ID so it may send
+// upload config/log WS messages. Interactive by default (requires TTY);
+// --id <id> skips the prompt for scripted human use.
+async function runPair(argv) {
+  const idFlagIdx = argv.indexOf("--id");
+  const flagId = idFlagIdx !== -1 ? argv[idFlagIdx + 1] : null;
+
+  if (!flagId && !process.stdin.isTTY) {
+    console.error("\nError: poltertab uploads pair requires an interactive terminal.\n" +
+      "Use --id <extension-id> to pair non-interactively.\n");
+    process.exit(1);
+  }
+
+  let extensionId = flagId;
+
+  if (!extensionId) {
+    // Ask the running server which extension origins are connected.
+    const port = resolveWsPort();
+    let origins = [];
+    try {
+      origins = await fetchConnectedOrigins(port);
+    } catch (err) {
+      console.error(`\nCould not connect to poltertab server on port ${port}: ${err.message}`);
+      console.error("Make sure poltertab is running, then try again.\n");
+      process.exit(1);
+    }
+
+    const extIds = origins
+      .filter((o) => o.startsWith("chrome-extension://"))
+      .map((o) => o.slice("chrome-extension://".length).replace(/\/$/, ""));
+
+    if (extIds.length === 0) {
+      console.error("\nNo extensions are currently connected to poltertab.");
+      console.error("Make sure the poltertab Chrome extension is installed and active, then try again.\n");
+      process.exit(1);
+    }
+
+    console.log("\nConnected extension IDs:");
+    extIds.forEach((id, i) => console.log(`  ${i + 1}. ${id}`));
+    console.log("\nOpen chrome://extensions to find which ID matches your poltertab extension.");
+
+    const readline = require("readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const choice = await new Promise((resolve) => {
+      rl.question(
+        `\nCompare the ID(s) above with chrome://extensions to find your poltertab extension.\n` +
+        `Enter number (1-${extIds.length}) to pair, or paste the ID directly: `,
+        (ans) => {
+          rl.close();
+          resolve(ans.trim());
+        },
+      );
+    });
+    const num = parseInt(choice, 10);
+    if (!isNaN(num) && num >= 1 && num <= extIds.length) {
+      extensionId = extIds[num - 1];
+    } else if (/^[a-p]{32}$/.test(choice)) {
+      extensionId = choice;
+    } else {
+      console.error("\nInvalid selection.\n");
+      process.exit(1);
+    }
+  }
+
+  if (!/^[a-p]{32}$/.test(extensionId)) {
+    console.error(`\nInvalid extension ID: ${extensionId}`);
+    console.error("Chrome extension IDs are 32 lowercase letters.\n");
+    process.exit(1);
+  }
+
+  const added = addTrustedExtensionId(extensionId);
+  if (added) {
+    console.log(`\n  Paired: ${extensionId}`);
+    console.log("  Upload config access is now enabled for this extension.\n");
+  } else {
+    console.log(`\n  Already paired: ${extensionId}\n`);
+  }
+}
+
+// Ask the WS server for connected extension origins via uploads_get_origins.
+function fetchConnectedOrigins(port) {
+  return new Promise((resolve, reject) => {
+    let WebSocket;
+    try {
+      WebSocket = require("ws");
+    } catch (_) {
+      reject(new Error("ws module not available"));
+      return;
+    }
+    const ws = new WebSocket(`ws://localhost:${port}`);
+    const timer = setTimeout(() => {
+      ws.terminate();
+      reject(new Error("timeout waiting for server response"));
+    }, 5000);
+    ws.on("open", () => {
+      ws.send(JSON.stringify({ type: "uploads_get_origins" }));
+    });
+    ws.on("message", (raw) => {
+      clearTimeout(timer);
+      try {
+        const msg = JSON.parse(raw);
+        if (msg.type === "uploads_origins") {
+          ws.close();
+          resolve(Array.isArray(msg.origins) ? msg.origins : []);
+        }
+      } catch (_) {
+        ws.close();
+        reject(new Error("Invalid response from server"));
+      }
+    });
+    ws.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+
+module.exports = { run };

package/mcp-server/bridge.js

@@ -35,6 +35,37 @@ const {
 } = require("./config.js");
 const updates = require("./update-check.js");
 const OWN_VERSION = require("./../package.json").version;
+const { getAllowlist, addAllowlistEntry, removeAllowlistEntry, getTrustedExtensionIds } = require("./uploads-config.js");
+const { logUpload, getRecentLog } = require("./uploads-log.js");
+const { buildAlwaysBlocked, validateAllowlistEntry } = require("./upload-paths.js");
+const fs = require("fs");
+const path = require("path");
+
+// ── Trusted extension IDs ─────────────────────────────────────────────────
+// Upload config/log WS messages are restricted to origins paired via
+// `poltertab uploads pair`. The CWS-assigned ID will go here once the Store
+// publishes the extension; until then it is an empty string (unused).
+//
+// Caveat (design §4): a non-browser local process can forge any Origin header;
+// this gate stops other Chrome extensions, not a hostile process with raw socket
+// access. The always-blocked list and allowlist are the server-side guards.
+const CWS_EXTENSION_ID = ""; // filled when the Chrome Web Store assigns it
+
+// isUploadsAuthorized and isPaired may throw on malformed config.json —
+// callers must catch and send uploads_error.
+function isUploadsAuthorized(origin) {
+  if (!origin || !origin.startsWith("chrome-extension://")) return false;
+  const id = origin.slice("chrome-extension://".length).replace(/\/$/, "");
+  const ids = new Set(getTrustedExtensionIds());
+  if (CWS_EXTENSION_ID) ids.add(CWS_EXTENSION_ID);
+  return ids.has(id);
+}
+
+function isPaired() {
+  const ids = new Set(getTrustedExtensionIds());
+  if (CWS_EXTENSION_ID) ids.add(CWS_EXTENSION_ID);
+  return ids.size > 0;
+}
 
 let WS_PORT = resolvePort();
 
@@ -841,8 +872,9 @@ function _dispatchProxyNow(callerWs, id, action, params) {
 }
 
 function setupPrimaryWss(wss) {
-  wss.on("connection", (ws) => {
+  wss.on("connection", (ws, req) => {
     ws.isAlive = true;
+    ws.handshakeOrigin = (req && req.headers && req.headers.origin) || null;
     ws.supportsNewCloseCodes = false;
     ws.on("pong", () => {
       ws.isAlive = true;
@@ -954,6 +986,28 @@ function setupPrimaryWss(wss) {
             broadcastSessionState();
           }
 
+          // Self-navigation guard: refuse commands targeting extension pages.
+          const EXTENSION_SENSITIVE_ACTIONS = new Set([
+            "navigate", "tab_new", "click", "fill", "snapshot", "scrape", "extract",
+          ]);
+          if (EXTENSION_SENSITIVE_ACTIONS.has(action)) {
+            const urlParam = params.url || params.target || "";
+            let isSelfNav = false;
+            if (typeof urlParam === "string" && urlParam) {
+              try { isSelfNav = new URL(urlParam).protocol.toLowerCase() === "chrome-extension:"; } catch (_) {}
+            }
+            if (isSelfNav) {
+              if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({
+                  id,
+                  success: false,
+                  error: "[self_navigation_refused] Agent commands cannot target extension pages.",
+                }));
+              }
+              return;
+            }
+          }
+
           if (action === "get_network_state") {
             (async () => {
               try {
@@ -1101,6 +1155,132 @@ function setupPrimaryWss(wss) {
           return;
         }
 
+        // uploads_get_origins — return list of connected extension origins.
+        // Used by `poltertab uploads pair` to discover which extension to trust.
+        // Only originless (CLI/local) sockets may request this; chrome-extension://
+        // origins must not be able to enumerate other connected extensions.
+        if (msg.type === "uploads_get_origins") {
+          if (ws.handshakeOrigin) {
+            // Extension socket — refuse; only CLI callers (no origin) may enumerate.
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: "uploads_error", error: "uploads_get_origins is restricted to local CLI callers" }));
+            }
+            return;
+          }
+          const origins = [];
+          if (wss) {
+            for (const client of wss.clients) {
+              if (client.handshakeOrigin && client.handshakeOrigin.startsWith("chrome-extension://")) {
+                origins.push(client.handshakeOrigin);
+              }
+            }
+          }
+          if (ws.readyState === WebSocket.OPEN) {
+            ws.send(JSON.stringify({ type: "uploads_origins", origins }));
+          }
+          return;
+        }
+
+        // Upload config/log messages — paired extension origin only.
+        // Requires the origin to be in trusted_extension_ids (via `poltertab uploads pair`).
+        // Until an ID is paired, returns uploads_not_paired.
+        if (
+          msg.type === "uploads_get_config" ||
+          msg.type === "uploads_set_config" ||
+          msg.type === "uploads_get_log"
+        ) {
+          let pairedOk, authorizedOk;
+          try {
+            pairedOk = isPaired();
+            authorizedOk = isUploadsAuthorized(ws.handshakeOrigin);
+          } catch (cfgErr) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_error",
+                _replyId: msg._replyId || null,
+                error: "config read error: " + cfgErr.message,
+              }));
+            }
+            return;
+          }
+          if (!pairedOk) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_not_paired",
+                _replyId: msg._replyId || null,
+                error: "Run poltertab uploads pair to link your extension",
+              }));
+            }
+            return;
+          }
+          if (!authorizedOk) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_not_paired",
+                _replyId: msg._replyId || null,
+                error: "Run poltertab uploads pair to link your extension",
+              }));
+            }
+            return;
+          }
+          const os = require("os");
+          const homeDir = os.homedir();
+
+          if (msg.type === "uploads_get_config") {
+            const allowlist = getAllowlist();
+            const alwaysBlocked = buildAlwaysBlocked(homeDir);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_config",
+                _replyId: msg._replyId || null,
+                allowlist,
+                alwaysBlocked,
+              }));
+            }
+            return;
+          }
+
+          if (msg.type === "uploads_set_config") {
+            const { action: cfgAction, dir } = msg;
+            let result;
+            if (cfgAction === "add") {
+              const v = validateAllowlistEntry(dir, homeDir);
+              if (!v.ok) {
+                result = { ok: false, error: v.errorText };
+              } else {
+                addAllowlistEntry(dir);
+                result = { ok: true };
+              }
+            } else if (cfgAction === "remove") {
+              removeAllowlistEntry(dir);
+              result = { ok: true };
+            } else {
+              result = { ok: false, error: `Unknown action: ${cfgAction}` };
+            }
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_config_result",
+                _replyId: msg._replyId || null,
+                ...result,
+              }));
+            }
+            return;
+          }
+
+          if (msg.type === "uploads_get_log") {
+            const n = Math.min(typeof msg.n === "number" ? msg.n : 20, 500);
+            const entries = getRecentLog(n);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: "uploads_log",
+                _replyId: msg._replyId || null,
+                entries,
+              }));
+            }
+            return;
+          }
+        }
+
         // Handle captured network data
         if (msg.type === "network_data") {
           const { tabId, url, body } = msg;
@@ -1271,6 +1451,23 @@ function _buildEnvelope(action, params, activeNodeId) {
 // Helper to send command to the extension
 async function sendCommand(action, params) {
   if (incompatible) throw new Error(incompatibleError());
+
+  // Self-navigation guard: refuse commands targeting extension pages.
+  // Mirrors the proxy_command guard; covers the Primary's own tool calls.
+  const SENDCMD_SENSITIVE = new Set([
+    "navigate", "tab_new", "click", "fill", "snapshot", "scrape", "extract",
+  ]);
+  if (SENDCMD_SENSITIVE.has(action) && params) {
+    const urlParam = params.url || params.target || "";
+    if (typeof urlParam === "string" && urlParam) {
+      let isSelfNav = false;
+      try { isSelfNav = new URL(urlParam).protocol.toLowerCase() === "chrome-extension:"; } catch (_) {}
+      if (isSelfNav) {
+        throw new Error("[self_navigation_refused] Agent commands cannot target extension pages.");
+      }
+    }
+  }
+
   // Evicted, or a caller ahead of this one is already reconnecting: wait for
   // that one dial rather than racing it.
   if (isEvicted || reconnect) await lazyReconnect();

package/mcp-server/index.js

@@ -36,6 +36,7 @@ const {
 const { extractAll } = require("./extract-all.js");
 const bridge = require("./bridge.js");
 const { validateUploadPaths, MAX_BYTES } = require("./upload-paths.js");
+const { logUpload } = require("./uploads-log.js");
 const OWN_VERSION = require("./../package.json").version;
 const fs = require("fs");
 const path = require("path");
@@ -222,6 +223,7 @@ const handleToolCall = async (request) => {
         checkSize: method === "drop",
       });
       if (!validation.ok) {
+        try { logUpload({ paths: filePaths, method, outcome: `denied:${validation.errorText}`, origin: null, session: opts.session || null }); } catch (_) {}
         return {
           content: [{ type: "text", text: validation.errorText }],
           isError: true,
@@ -261,7 +263,14 @@ const handleToolCall = async (request) => {
         `[poltertab] upload_file method=${method} files=${filePaths.join(", ")}\n`,
       );
 
-      const result = await bridge.sendCommand("upload_file", bridgeParams);
+      let result;
+      try {
+        result = await bridge.sendCommand("upload_file", bridgeParams);
+      } catch (uploadErr) {
+        try { logUpload({ paths: filePaths, method, outcome: "error", origin: null, session: opts.session || null }); } catch (_) {}
+        throw uploadErr;
+      }
+      try { logUpload({ paths: filePaths, method, outcome: "ok", origin: null, session: opts.session || null }); } catch (_) {}
       bridge.noteActiveTab(result && result.tabId);
       return {
         content: [{ type: "text", text: JSON.stringify(result, null, 2) }],

package/mcp-server/upload-paths.js

@@ -70,9 +70,9 @@ function validateUploadPaths(filePaths, config) {
     return {
       ok: false,
       errorText:
-        "File uploads are disabled. To enable them, add an upload_allowed_paths array " +
-        "to ~/.poltertab/config.json listing the directories Claude may read files from.\n\n" +
-        "Example:\n{\n  \"upload_allowed_paths\": [\"/Users/you/Documents\", \"/Users/you/Downloads\"]\n}",
+        "File uploads are disabled. The user can run `poltertab uploads allow <dir>` to permit a " +
+        "directory, or open the extension options page to manage allowed folders.\n\n" +
+        "Example:\n  poltertab uploads allow ~/Documents",
     };
   }
 
@@ -139,4 +139,74 @@ function validateUploadPaths(filePaths, config) {
   return { ok: true, resolvedPaths };
 }
 
-module.exports = { validateUploadPaths, MAX_BYTES };
+/**
+ * Validate a single path for addition to the allowlist.
+ * Accepts absolute paths and ~/relative paths. Rejects relative paths and
+ * paths inside the always-blocked set. Accepts nonexistent directories.
+ *
+ * @param {string} dir      - The path the user wants to allow.
+ * @param {string} [homeDir] - Override os.homedir() (tests only).
+ * @returns {{ ok: true } | { ok: false, errorText: string }}
+ */
+function validateAllowlistEntry(dir, homeDir = os.homedir()) {
+  if (!dir || typeof dir !== "string") {
+    return { ok: false, errorText: "Path must be a non-empty string." };
+  }
+
+  if (!path.isAbsolute(dir) && !dir.startsWith("~/")) {
+    return {
+      ok: false,
+      errorText: `"${dir}" is a relative path. Use an absolute path or ~/relative form.`,
+    };
+  }
+
+  const expanded = dir.startsWith("~/")
+    ? path.join(homeDir, dir.slice(2))
+    : dir;
+  let resolved = path.resolve(expanded);
+
+  // For existing paths: realpath so symlinks (e.g. ~/link-to-ssh) are caught
+  // by the always-blocked check below; also verify it is a directory.
+  try {
+    const real = fs.realpathSync(resolved);
+    const stat = fs.statSync(real);
+    if (!stat.isDirectory()) {
+      return {
+        ok: false,
+        errorText: `"${dir}" is a file, not a directory. Only directories can be added to the allowlist.`,
+      };
+    }
+    resolved = real;
+  } catch (_) {
+    // Path does not yet exist — accepted so future-created dirs can be pre-allowed.
+  }
+
+  const alwaysBlocked = buildAlwaysBlocked(homeDir);
+  for (const blocked of alwaysBlocked) {
+    if (resolved === blocked || resolved.startsWith(blocked + path.sep)) {
+      return {
+        ok: false,
+        errorText: `"${dir}" is inside a protected directory (${blocked}) and cannot be added.`,
+      };
+    }
+  }
+
+  // Deny home dotfiles
+  const rel = path.relative(homeDir, resolved);
+  if (!rel.startsWith("..") && rel.startsWith(".") && !rel.includes(path.sep)) {
+    return {
+      ok: false,
+      errorText: `"${dir}" is a home directory dotfile and cannot be added.`,
+    };
+  }
+
+  return { ok: true };
+}
+
+module.exports = {
+  validateUploadPaths,
+  validateAllowlistEntry,
+  buildAlwaysBlocked,
+  expandAllowlistEntry,
+  MAX_BYTES,
+};

package/mcp-server/uploads-config.js

@@ -0,0 +1,80 @@
+"use strict";
+
+// Atomic read-modify-write for the upload_allowed_paths key in config.json.
+// Preserves all other keys in config.json. Atomic write = temp file + rename.
+//
+// Used by bridge.js (WS messages) and bin/uploads.js (CLI).
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { POLTERTAB_HOME } = require("./config.js");
+
+const CONFIG_PATH = path.join(POLTERTAB_HOME, "config.json");
+
+function _readConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new Error("config.json is not valid JSON — fix it before editing the allowlist");
+  }
+}
+
+function _writeConfig(data) {
+  fs.mkdirSync(POLTERTAB_HOME, { recursive: true });
+  const tmp = CONFIG_PATH + ".tmp." + process.pid;
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
+  fs.renameSync(tmp, CONFIG_PATH);
+}
+
+function getAllowlist() {
+  const cfg = _readConfig();
+  const v = cfg.upload_allowed_paths;
+  return Array.isArray(v) ? v : [];
+}
+
+// Adds dir to the allowlist if not already present. Returns true if added,
+// false if already present. Throws if validation fails (call
+// validateAllowlistEntry first to surface user-facing messages).
+function addAllowlistEntry(dir) {
+  const cfg = _readConfig();
+  const list = Array.isArray(cfg.upload_allowed_paths) ? cfg.upload_allowed_paths : [];
+  if (list.includes(dir)) return false;
+  _writeConfig({ ...cfg, upload_allowed_paths: [...list, dir] });
+  return true;
+}
+
+// Removes dir from the allowlist. Returns true if removed, false if absent.
+function removeAllowlistEntry(dir) {
+  const cfg = _readConfig();
+  const list = Array.isArray(cfg.upload_allowed_paths) ? cfg.upload_allowed_paths : [];
+  const next = list.filter((e) => e !== dir);
+  if (next.length === list.length) return false;
+  _writeConfig({ ...cfg, upload_allowed_paths: next });
+  return true;
+}
+
+// Adds id to trusted_extension_ids if not already present. Returns true if added.
+function addTrustedExtensionId(id) {
+  const cfg = _readConfig();
+  const list = Array.isArray(cfg.trusted_extension_ids) ? cfg.trusted_extension_ids : [];
+  if (list.includes(id)) return false;
+  _writeConfig({ ...cfg, trusted_extension_ids: [...list, id] });
+  return true;
+}
+
+function getTrustedExtensionIds() {
+  const cfg = _readConfig();
+  const v = cfg.trusted_extension_ids;
+  return Array.isArray(v) ? v : [];
+}
+
+module.exports = {
+  getAllowlist,
+  addAllowlistEntry,
+  removeAllowlistEntry,
+  addTrustedExtensionId,
+  getTrustedExtensionIds,
+  CONFIG_PATH,
+};

package/mcp-server/uploads-log.js

@@ -0,0 +1,59 @@
+"use strict";
+
+// Append + rotate upload activity log at ~/.poltertab/uploads.log.jsonl.
+// Each entry: { ts, paths, method, outcome, origin, session }.
+// Rotation: drop oldest lines until the file is ≤ LOG_MAX_BYTES.
+
+const fs = require("fs");
+const path = require("path");
+const { POLTERTAB_HOME } = require("./config.js");
+
+const LOG_PATH = path.join(POLTERTAB_HOME, "uploads.log.jsonl");
+const LOG_MAX_BYTES = 1 * 1024 * 1024; // 1 MB
+
+function logUpload({ paths, method, outcome, origin, session }) {
+  const line =
+    JSON.stringify({
+      ts: new Date().toISOString(),
+      paths,
+      method,
+      outcome,
+      origin: origin || null,
+      session: session || null,
+    }) + "\n";
+
+  fs.mkdirSync(POLTERTAB_HOME, { recursive: true });
+  fs.appendFileSync(LOG_PATH, line, "utf8");
+
+  // Rotate if file exceeds limit
+  try {
+    const stat = fs.statSync(LOG_PATH);
+    if (stat.size > LOG_MAX_BYTES) {
+      let content = fs.readFileSync(LOG_PATH, "utf8");
+      const lines = content.split("\n").filter(Boolean);
+      while (lines.length > 1 && Buffer.byteLength(lines.join("\n") + "\n") > LOG_MAX_BYTES) {
+        lines.shift();
+      }
+      fs.writeFileSync(LOG_PATH, lines.join("\n") + "\n", "utf8");
+    }
+  } catch (_) {
+    // Rotation failure is non-fatal
+  }
+}
+
+function getRecentLog(n = 20) {
+  try {
+    const content = fs.readFileSync(LOG_PATH, "utf8");
+    const lines = content.split("\n").filter(Boolean);
+    return lines
+      .slice(-n)
+      .map((l) => {
+        try { return JSON.parse(l); } catch (_) { return null; }
+      })
+      .filter(Boolean);
+  } catch (_) {
+    return [];
+  }
+}
+
+module.exports = { logUpload, getRecentLog, LOG_PATH, LOG_MAX_BYTES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poltertab",
-  "version": "1.9.0-beta.2",
+  "version": "1.10.0-beta.1",
   "description": "Let any AI assistant drive and scrape your existing Chrome profile — no headless browser, no complex setup.",
   "bin": {
     "poltertab": "./bin/poltertab.js"