smooth-operator-mcp 2.4.2 → 2.4.4

package/dist/smooth-operator.mjs

@@ -364,6 +364,7 @@ function linuxCandidates() {
     ["google-chrome-beta", "Google Chrome Beta", "beta"],
     ["google-chrome-unstable", "Google Chrome Dev", "dev"],
     ["brave-browser", "Brave", "stable"],
+    ["brave", "Brave", "stable"],
     ["microsoft-edge", "Microsoft Edge", "stable"],
     ["microsoft-edge-stable", "Microsoft Edge", "stable"],
     ["chromium", "Chromium", "stable"],
@@ -1210,7 +1211,7 @@ async function runWizard(harness, opts) {
   });
   const session = tolerantQuestion(rl);
   try {
-    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? "2.4.2");
+    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? "2.4.4");
     ui.note(`Configuring: ${harness}`);
     ui.note("Answer each question, or press Enter to accept the recommended default.");
     ui.note(`You can re-run \`smooth-operator install ${harness}\` at any time to change these.`);
@@ -1620,9 +1621,11 @@ function readConfigFile(configPath) {
     if (uid !== void 0 && stats.uid !== uid) {
       throw new AppError("CONFIG_INSECURE", "Configuration files must be owned by the current user.");
     }
-    const mode = stats.mode & 511;
-    if ((mode & 63) !== 0) {
-      throw new AppError("CONFIG_INSECURE", "Configuration files must use owner-only permissions (for example, chmod 600).");
+    if (process2.platform !== "win32") {
+      const mode = stats.mode & 511;
+      if ((mode & 63) !== 0) {
+        throw new AppError("CONFIG_INSECURE", "Configuration files must use owner-only permissions (for example, chmod 600).");
+      }
     }
     const parsed = JSON.parse(readFileSync(descriptor, "utf8"));
     const result = RawConfigSchema.safeParse(parsed);
@@ -2442,7 +2445,7 @@ init_errors();
 init_logger();
 
 // src/server/version.ts
-var SERVER_VERSION = "2.4.2";
+var SERVER_VERSION = "2.4.4";
 
 // src/server/mcp.ts
 var EmptyInputSchema = z3.object({}).strict();
@@ -5733,17 +5736,14 @@ var BrowserService = class {
     }
   }
   targetGuardForPage(page) {
-    let sessionId;
-    try {
-      const target = page.target();
-      sessionId = target._session?.()?.id();
-    } catch {
-      sessionId = void 0;
+    const identity = pageTargetIdentity(page);
+    if (identity.sessionId) {
+      return this.targetGuardSessions.get(identity.sessionId);
     }
-    if (!sessionId) {
-      return void 0;
+    if (identity.targetId) {
+      return [...this.targetGuardSessions.values()].find((guard) => guard.targetId === identity.targetId);
     }
-    return this.targetGuardSessions.get(sessionId);
+    return void 0;
   }
   async waitForTargetGuardDrain(page, signal) {
     const guard = this.targetGuardForPage(page);
@@ -5752,18 +5752,12 @@ var BrowserService = class {
     }
   }
   async releaseTargetGuardForPage(page) {
-    let sessionId;
-    try {
-      const target = page.target();
-      sessionId = target._session?.()?.id();
-    } catch {
-      sessionId = void 0;
-    }
-    if (!sessionId) {
-      return;
+    const identity = pageTargetIdentity(page);
+    const guard = this.targetGuardForPage(page);
+    if (!identity.sessionId && !guard) return;
+    if (identity.sessionId) {
+      this.unguardedTargetSessions.delete(identity.sessionId);
     }
-    this.unguardedTargetSessions.delete(sessionId);
-    const guard = this.targetGuardSessions.get(sessionId);
     if (!guard) {
       return;
     }
@@ -5774,7 +5768,7 @@ var BrowserService = class {
     removeCdpListener(guard.session, "Fetch.requestPaused", guard.requestPausedListener);
     removeCdpListener(guard.session, "disconnected", guard.disconnectedListener);
     restoreGuardSend(guard);
-    this.targetGuardSessions.delete(sessionId);
+    this.targetGuardSessions.delete(guard.session.id());
   }
   async prepareTarget(target) {
     const generation = this.lifecycleGeneration;
@@ -5804,13 +5798,8 @@ var BrowserService = class {
     }
   }
   isUnguardedTargetPage(page) {
-    try {
-      const target = page.target();
-      const sessionId = target._session?.()?.id();
-      return Boolean(sessionId && this.unguardedTargetSessions.has(sessionId));
-    } catch {
-      return false;
-    }
+    const identity = pageTargetIdentity(page);
+    return Boolean(identity.sessionId && this.unguardedTargetSessions.has(identity.sessionId));
   }
   async newPageState(signal) {
     const generation = this.lifecycleGeneration;
@@ -7537,6 +7526,21 @@ function isPageClosed(page) {
     return true;
   }
 }
+function pageTargetIdentity(page) {
+  try {
+    const target = page.target();
+    let sessionId;
+    try {
+      sessionId = target._session?.()?.id();
+    } catch {
+      sessionId = void 0;
+    }
+    const targetId = typeof target._targetId === "string" ? target._targetId : void 0;
+    return { ...sessionId ? { sessionId } : {}, ...targetId ? { targetId } : {} };
+  } catch {
+    return {};
+  }
+}
 async function rejectSymlink(path) {
   try {
     const file = await lstat(path);
@@ -8135,7 +8139,7 @@ function canonicalPath(path) {
   let current = path;
   while (true) {
     try {
-      const canonical = realpathSync(current);
+      const canonical = realpathSync.native(current);
       return missingSegments.reduceRight((parent, segment) => join4(parent, segment), canonical);
     } catch {
       try {
@@ -8181,6 +8185,9 @@ function isWithinRoot(root, candidate) {
   const relativePath = relative2(root, candidate);
   return relativePath === "" || !relativePath.startsWith(`..${sep2}`) && relativePath !== ".." && !isAbsolute2(relativePath);
 }
+function hasNoSymlinkSegments(path) {
+  return !hasSymlinkSegment(path);
+}
 var SecurityPolicy = class {
   constructor(config) {
     this.config = config;
@@ -8283,7 +8290,13 @@ var SecurityPolicy = class {
     const root = this.config.security.allowedFileRoots.find((candidate) => {
       const lexicalRoot = resolve3(candidate);
       const canonicalRoot = canonicalPath(lexicalRoot) ?? lexicalRoot;
-      return canonicalCandidate !== void 0 ? isWithinRoot(canonicalRoot, canonicalCandidate) : isWithinRoot(lexicalRoot, path);
+      if (canonicalCandidate !== void 0 && isWithinRoot(canonicalRoot, canonicalCandidate)) {
+        return true;
+      }
+      if (canonicalCandidate === void 0 && isWithinRoot(lexicalRoot, path)) {
+        return true;
+      }
+      return canonicalCandidate !== void 0 && hasNoSymlinkSegments(lexicalRoot) && hasNoSymlinkSegments(path) && isWithinRoot(lexicalRoot, path);
     });
     if (!root) {
       throw new AppError("FILE_PATH_BLOCKED", "The file path is outside the configured file roots.");
@@ -8817,19 +8830,21 @@ async function ensurePrivateDirectory(path) {
     }
     await assertPrivateDirectoryComponent(currentPath, path);
   }
-  let info = await lstat2(target);
+  const info = await lstat2(target);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new AppError("CONFIG_INSECURE", `The runtime path '${path}' must be a real directory, not a symbolic link or file.`);
   }
-  let permissions = Number(info.mode) & 511;
-  if ((permissions & 63) !== 0) {
-    await chmod(target, 448);
-    info = await lstat2(target);
-    await assertPrivateDirectoryComponent(target, path);
-    permissions = Number(info.mode) & 511;
-  }
-  if ((permissions & 63) !== 0) {
-    throw new AppError("CONFIG_INSECURE", `The runtime directory '${path}' must not be group/world-readable.`);
+  if (process3.platform !== "win32") {
+    let permissions = Number(info.mode) & 511;
+    if ((permissions & 63) !== 0) {
+      await chmod(target, 448);
+      const tightened = await lstat2(target);
+      await assertPrivateDirectoryComponent(target, path);
+      permissions = Number(tightened.mode) & 511;
+    }
+    if ((permissions & 63) !== 0) {
+      throw new AppError("CONFIG_INSECURE", `The runtime directory '${path}' must not be group/world-readable.`);
+    }
   }
 }
 async function assertPrivateDirectoryComponent(componentPath, originalPath) {