smooth-operator-mcp 2.4.11 → 3.0.1

package/.env.example

@@ -11,10 +11,15 @@ SMOOTH_OPERATOR_BROWSER_MODE=managed
 # For an advanced DevTools connection, use mode=connect and set this endpoint.
 # SMOOTH_OPERATOR_BROWSER_MODE=connect
 # SMOOTH_OPERATOR_BROWSER_URL=http://127.0.0.1:9222
+# SMOOTH_OPERATOR_BROWSER_WS_ENDPOINT=ws://127.0.0.1:9222/devtools/browser/<id>
 # For explicit launch mode, set a Chromium/Chrome executable.
 # SMOOTH_OPERATOR_BROWSER_MODE=launch
 # SMOOTH_OPERATOR_BROWSER_EXECUTABLE=/path/to/chrome
 # SMOOTH_OPERATOR_BROWSER_HEADLESS=true
+# Optional explicit viewport (both values must be set together). Stealth uses
+# these same dimensions for its launch argument and guarded page metrics.
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_WIDTH=1280
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_HEIGHT=720
 # SMOOTH_OPERATOR_BROWSER_USER_DATA_DIR=~/.smooth-operator/browser
 # SMOOTH_OPERATOR_BROWSER_AUTO_LAUNCH=false
 # Test-only opt-in live suite override (the CI script discovers Chrome itself).
@@ -30,10 +35,22 @@ SMOOTH_OPERATOR_MAX_HTML_CHARS=200000
 SMOOTH_OPERATOR_ALLOWED_DOMAINS=
 SMOOTH_OPERATOR_BLOCKED_DOMAINS=
 SMOOTH_OPERATOR_ALLOW_PRIVATE_NETWORK=false
-SMOOTH_OPERATOR_ALLOW_EVAL=false
-# File uploads and generated PDFs stay inside these private roots by default.
+SMOOTH_OPERATOR_ALLOW_EVAL=true
+# Set false for a stricter profile. File uploads and generated PDFs stay inside
+# these private roots by default.
 # SMOOTH_OPERATOR_ALLOWED_FILE_ROOTS=~/.smooth-operator/files,~/.smooth-operator/downloads
 
+# Compatibility baseline. Browser identity and automation signals remain native;
+# set false to skip the explicit-viewport compatibility script.
+# SMOOTH_OPERATOR_STEALTH_ENABLED=true
+# Stealth profile: balanced (default) | max (accepted compatibility names; same supported patch set)
+# SMOOTH_OPERATOR_STEALTH_PROFILE=balanced
+# Add opt-in GPU launch flags (does not make an identity/coherence guarantee)
+# SMOOTH_OPERATOR_STEALTH_GPU=false
+# Behavioral timing is off for the fastest deterministic path; set true only
+# when a site or workflow explicitly needs it.
+# SMOOTH_OPERATOR_BEHAVIOR_ENABLED=false
+
 # HTTP is opt-in; use a strong token before enabling remote access
 # SMOOTH_OPERATOR_TRANSPORT=http
 # SMOOTH_OPERATOR_HTTP_HOST=127.0.0.1
@@ -44,5 +61,9 @@ SMOOTH_OPERATOR_ALLOW_EVAL=false
 # SMOOTH_OPERATOR_HTTP_MAX_BODY_BYTES=2000000
 # SMOOTH_OPERATOR_ALLOWED_HOSTS=localhost,127.0.0.1,[::1]
 # SMOOTH_OPERATOR_ALLOWED_ORIGINS=localhost,127.0.0.1,[::1]
+# Hard concurrency caps (constants, not env-configurable): max 32 concurrent
+# requests and max 8 concurrent long-lived SSE/subscription connections.
+# MAX_HTTP_CONCURRENCY=32
+# MAX_HTTP_STREAM_CONCURRENCY=8
 
 SMOOTH_OPERATOR_LOG_LEVEL=info

package/README.md

@@ -27,7 +27,7 @@ Or straight from GitHub:
 npm install -g github:Gitshop77/Smooth-Operator && smooth-operator install opencode
 ~~~
 
-The wizard asks 7 focused questions covering browser mode, executable, headless operation, domain policy, page JavaScript, and the data directory. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically.
+The wizard asks exactly 3 focused questions: browser profile ownership, browser display, and the Chromium executable. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically. Managed mode owns one private persistent profile; connected mode launches and attaches to a dedicated debugging profile and does not claim ownership of an operator's daily browser.
 
 Requires Node 22.23.2+ and an installed Chromium-based browser. Profile at `~/.smooth-operator/browser` — sign in once.
 
@@ -44,12 +44,23 @@ Ask: *“Scrape pricing into a table”*, *“Fill this form with ~/resume.pdf
 
 ## How to use
 
-Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. Logins and CAPTCHA challenges pause for human handoff in the Chrome window.
+Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. For a challenge, `browser_solve_challenge` returns fresh bounded visual/state evidence and an attempt budget; the connected AI keeps using ordinary browser actions and calls it again until the final classification is clear or the budget is exhausted. Human handoff remains available only as an explicit final option.
+
+Browser identity remains native, page JavaScript is available by default, and
+behavioral timing is off for fast deterministic input. Set the explicit
+environment flags to change those choices. See `docs/STEALTH-GUIDE.md` for
+details and responsible use.
+
+For the fastest supported operation, keep behavioral timing off with
+`SMOOTH_OPERATOR_BEHAVIOR_ENABLED=false`; the native browser remains bounded and
+cancellable. All local browser tools and page features are available by default;
+remote HTTP, private-network access, and file roots remain explicitly gated.
+Faster calls do not bypass challenges or grant permission to automate a site.
 
 ## Why
 
 - Zero setup — managed, headed, persistent browser by default
-- Secure by default — domain and file policy, bounded outputs, redaction, and JavaScript disabled unless explicitly enabled
+- Secure by default — domain and file policy, bounded outputs, redaction, and explicit safety boundaries
 - Reliable — private profiles, stale-reference recovery, reconnect handling, and structured errors
 - Flexible — stdio by default, Streamable HTTP when you need it, plus connect and disabled modes