smooth-operator-mcp 2.4.2 → 2.4.3

package/dist/smooth-operator.mjs

@@ -364,6 +364,7 @@ function linuxCandidates() {
     ["google-chrome-beta", "Google Chrome Beta", "beta"],
     ["google-chrome-unstable", "Google Chrome Dev", "dev"],
     ["brave-browser", "Brave", "stable"],
+    ["brave", "Brave", "stable"],
     ["microsoft-edge", "Microsoft Edge", "stable"],
     ["microsoft-edge-stable", "Microsoft Edge", "stable"],
     ["chromium", "Chromium", "stable"],
@@ -1210,7 +1211,7 @@ async function runWizard(harness, opts) {
   });
   const session = tolerantQuestion(rl);
   try {
-    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? "2.4.2");
+    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? "2.4.3");
     ui.note(`Configuring: ${harness}`);
     ui.note("Answer each question, or press Enter to accept the recommended default.");
     ui.note(`You can re-run \`smooth-operator install ${harness}\` at any time to change these.`);
@@ -1620,9 +1621,11 @@ function readConfigFile(configPath) {
     if (uid !== void 0 && stats.uid !== uid) {
       throw new AppError("CONFIG_INSECURE", "Configuration files must be owned by the current user.");
     }
-    const mode = stats.mode & 511;
-    if ((mode & 63) !== 0) {
-      throw new AppError("CONFIG_INSECURE", "Configuration files must use owner-only permissions (for example, chmod 600).");
+    if (process2.platform !== "win32") {
+      const mode = stats.mode & 511;
+      if ((mode & 63) !== 0) {
+        throw new AppError("CONFIG_INSECURE", "Configuration files must use owner-only permissions (for example, chmod 600).");
+      }
     }
     const parsed = JSON.parse(readFileSync(descriptor, "utf8"));
     const result = RawConfigSchema.safeParse(parsed);
@@ -2442,7 +2445,7 @@ init_errors();
 init_logger();
 
 // src/server/version.ts
-var SERVER_VERSION = "2.4.2";
+var SERVER_VERSION = "2.4.3";
 
 // src/server/mcp.ts
 var EmptyInputSchema = z3.object({}).strict();
@@ -8181,6 +8184,9 @@ function isWithinRoot(root, candidate) {
   const relativePath = relative2(root, candidate);
   return relativePath === "" || !relativePath.startsWith(`..${sep2}`) && relativePath !== ".." && !isAbsolute2(relativePath);
 }
+function hasNoSymlinkSegments(path) {
+  return !hasSymlinkSegment(path);
+}
 var SecurityPolicy = class {
   constructor(config) {
     this.config = config;
@@ -8283,7 +8289,13 @@ var SecurityPolicy = class {
     const root = this.config.security.allowedFileRoots.find((candidate) => {
       const lexicalRoot = resolve3(candidate);
       const canonicalRoot = canonicalPath(lexicalRoot) ?? lexicalRoot;
-      return canonicalCandidate !== void 0 ? isWithinRoot(canonicalRoot, canonicalCandidate) : isWithinRoot(lexicalRoot, path);
+      if (canonicalCandidate !== void 0 && isWithinRoot(canonicalRoot, canonicalCandidate)) {
+        return true;
+      }
+      if (canonicalCandidate === void 0 && isWithinRoot(lexicalRoot, path)) {
+        return true;
+      }
+      return canonicalCandidate !== void 0 && hasNoSymlinkSegments(lexicalRoot) && hasNoSymlinkSegments(path) && isWithinRoot(lexicalRoot, path);
     });
     if (!root) {
       throw new AppError("FILE_PATH_BLOCKED", "The file path is outside the configured file roots.");
@@ -8817,19 +8829,21 @@ async function ensurePrivateDirectory(path) {
     }
     await assertPrivateDirectoryComponent(currentPath, path);
   }
-  let info = await lstat2(target);
+  const info = await lstat2(target);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new AppError("CONFIG_INSECURE", `The runtime path '${path}' must be a real directory, not a symbolic link or file.`);
   }
-  let permissions = Number(info.mode) & 511;
-  if ((permissions & 63) !== 0) {
-    await chmod(target, 448);
-    info = await lstat2(target);
-    await assertPrivateDirectoryComponent(target, path);
-    permissions = Number(info.mode) & 511;
-  }
-  if ((permissions & 63) !== 0) {
-    throw new AppError("CONFIG_INSECURE", `The runtime directory '${path}' must not be group/world-readable.`);
+  if (process3.platform !== "win32") {
+    let permissions = Number(info.mode) & 511;
+    if ((permissions & 63) !== 0) {
+      await chmod(target, 448);
+      const tightened = await lstat2(target);
+      await assertPrivateDirectoryComponent(target, path);
+      permissions = Number(tightened.mode) & 511;
+    }
+    if ((permissions & 63) !== 0) {
+      throw new AppError("CONFIG_INSECURE", `The runtime directory '${path}' must not be group/world-readable.`);
+    }
   }
 }
 async function assertPrivateDirectoryComponent(componentPath, originalPath) {