smooth-operator-mcp 2.4.11 → 3.0.0

package/.env.example

@@ -11,10 +11,15 @@ SMOOTH_OPERATOR_BROWSER_MODE=managed
 # For an advanced DevTools connection, use mode=connect and set this endpoint.
 # SMOOTH_OPERATOR_BROWSER_MODE=connect
 # SMOOTH_OPERATOR_BROWSER_URL=http://127.0.0.1:9222
+# SMOOTH_OPERATOR_BROWSER_WS_ENDPOINT=ws://127.0.0.1:9222/devtools/browser/<id>
 # For explicit launch mode, set a Chromium/Chrome executable.
 # SMOOTH_OPERATOR_BROWSER_MODE=launch
 # SMOOTH_OPERATOR_BROWSER_EXECUTABLE=/path/to/chrome
 # SMOOTH_OPERATOR_BROWSER_HEADLESS=true
+# Optional explicit viewport (both values must be set together). Stealth uses
+# these same dimensions for its launch argument and guarded page metrics.
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_WIDTH=1280
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_HEIGHT=720
 # SMOOTH_OPERATOR_BROWSER_USER_DATA_DIR=~/.smooth-operator/browser
 # SMOOTH_OPERATOR_BROWSER_AUTO_LAUNCH=false
 # Test-only opt-in live suite override (the CI script discovers Chrome itself).
@@ -30,10 +35,22 @@ SMOOTH_OPERATOR_MAX_HTML_CHARS=200000
 SMOOTH_OPERATOR_ALLOWED_DOMAINS=
 SMOOTH_OPERATOR_BLOCKED_DOMAINS=
 SMOOTH_OPERATOR_ALLOW_PRIVATE_NETWORK=false
-SMOOTH_OPERATOR_ALLOW_EVAL=false
-# File uploads and generated PDFs stay inside these private roots by default.
+SMOOTH_OPERATOR_ALLOW_EVAL=true
+# Set false for a stricter profile. File uploads and generated PDFs stay inside
+# these private roots by default.
 # SMOOTH_OPERATOR_ALLOWED_FILE_ROOTS=~/.smooth-operator/files,~/.smooth-operator/downloads
 
+# Optional automation-control baseline. The native default is enabled; set false
+# to preserve raw browser automation signals.
+# SMOOTH_OPERATOR_STEALTH_ENABLED=true
+# Stealth profile: balanced (default) | max (accepted compatibility names; same supported patch set)
+# SMOOTH_OPERATOR_STEALTH_PROFILE=balanced
+# Add opt-in GPU launch flags (does not make an identity/coherence guarantee)
+# SMOOTH_OPERATOR_STEALTH_GPU=false
+# Behavioral realism defaults on with short bounded timing; set false for the
+# fastest raw interaction path or override to decouple from stealth.
+# SMOOTH_OPERATOR_BEHAVIOR_ENABLED=true
+
 # HTTP is opt-in; use a strong token before enabling remote access
 # SMOOTH_OPERATOR_TRANSPORT=http
 # SMOOTH_OPERATOR_HTTP_HOST=127.0.0.1
@@ -44,5 +61,9 @@ SMOOTH_OPERATOR_ALLOW_EVAL=false
 # SMOOTH_OPERATOR_HTTP_MAX_BODY_BYTES=2000000
 # SMOOTH_OPERATOR_ALLOWED_HOSTS=localhost,127.0.0.1,[::1]
 # SMOOTH_OPERATOR_ALLOWED_ORIGINS=localhost,127.0.0.1,[::1]
+# Hard concurrency caps (constants, not env-configurable): max 32 concurrent
+# requests and max 8 concurrent long-lived SSE/subscription connections.
+# MAX_HTTP_CONCURRENCY=32
+# MAX_HTTP_STREAM_CONCURRENCY=8
 
 SMOOTH_OPERATOR_LOG_LEVEL=info

package/README.md

@@ -27,7 +27,7 @@ Or straight from GitHub:
 npm install -g github:Gitshop77/Smooth-Operator && smooth-operator install opencode
 ~~~
 
-The wizard asks 7 focused questions covering browser mode, executable, headless operation, domain policy, page JavaScript, and the data directory. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically.
+The wizard asks exactly 3 focused questions: browser profile ownership, browser display, and the Chromium executable. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically. Managed mode owns one private persistent profile; connected mode launches and attaches to a dedicated debugging profile and does not claim ownership of an operator's daily browser.
 
 Requires Node 22.23.2+ and an installed Chromium-based browser. Profile at `~/.smooth-operator/browser` — sign in once.
 
@@ -44,12 +44,20 @@ Ask: *“Scrape pricing into a table”*, *“Fill this form with ~/resume.pdf
 
 ## How to use
 
-Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. Logins and CAPTCHA challenges pause for human handoff in the Chrome window.
+Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. For a challenge, `browser_solve_challenge` returns fresh bounded visual/state evidence for the connected AI; the AI uses ordinary browser actions and calls it again to verify the final classification. Human handoff remains available for logins or challenges that require the user.
+
+Stealth and short behavioral timing are enabled in the recommended native profile. Page JavaScript is also available by default; set the explicit environment flags to `false` when a stricter profile is needed. See `docs/STEALTH-GUIDE.md` for details and responsible use.
+
+For the fastest supported operation, keep behavioral timing off with
+`SMOOTH_OPERATOR_BEHAVIOR_ENABLED=false`; the native browser remains bounded and
+cancellable. All local browser tools and page features are available by default;
+remote HTTP, private-network access, and file roots remain explicitly gated.
+Faster calls do not bypass challenges or grant permission to automate a site.
 
 ## Why
 
 - Zero setup — managed, headed, persistent browser by default
-- Secure by default — domain and file policy, bounded outputs, redaction, and JavaScript disabled unless explicitly enabled
+- Secure by default — domain and file policy, bounded outputs, redaction, and explicit safety boundaries
 - Reliable — private profiles, stale-reference recovery, reconnect handling, and structured errors
 - Flexible — stdio by default, Streamable HTTP when you need it, plus connect and disabled modes