smooth-operator-mcp 2.4.5 → 2.4.7

package/.env.example

@@ -1,6 +1,9 @@
 # Native MCP transport
 SMOOTH_OPERATOR_TRANSPORT=stdio
 SMOOTH_OPERATOR_DATA_DIR=~/.smooth-operator
+# Optional explicit JSON config path. The installer-created
+# ~/.smooth-operator/config.json is loaded automatically when this is unset.
+# SMOOTH_OPERATOR_CONFIG=~/.smooth-operator/config.json
 
 # Managed agent Chrome is the zero-setup default. It discovers Google Chrome,
 # then creates one private persistent profile under SMOOTH_OPERATOR_DATA_DIR.

package/README.md

@@ -54,3 +54,5 @@ Talk to your harness normally. It will call `browser_navigate` → `browser_snap
 - Works — stdio default, HTTP optional
 
 Details: [AGENTS.md](AGENTS.md) · [MCP guide](docs/mcp-server.md) · [harnesses](docs/harnesses.md)
+
+ChatGPT developer-mode connections use the private [Secure MCP Tunnel](docs/mcp-server.md#chatgpt-and-openai-connections) route or a separately secured HTTPS deployment.

package/dist/smooth-operator.mjs

@@ -283,6 +283,15 @@ var init_errors = __esm({
   }
 });
 
+// src/server/version.ts
+var SERVER_VERSION;
+var init_version = __esm({
+  "src/server/version.ts"() {
+    "use strict";
+    SERVER_VERSION = "2.4.7";
+  }
+});
+
 // src/server/browser/discovery.ts
 var discovery_exports = {};
 __export(discovery_exports, {
@@ -608,11 +617,11 @@ async function readConfigFile2(path) {
     if (isMissingFile2(error)) {
       return void 0;
     }
-    if (noFollow && (isErrorCode(error, "EINVAL") || isErrorCode(error, "ENOTSUP") || isErrorCode(error, "EOPNOTSUPP"))) {
+    if (noFollow && (isErrorCode2(error, "EINVAL") || isErrorCode2(error, "ENOTSUP") || isErrorCode2(error, "EOPNOTSUPP"))) {
       await rejectSymlink2(path, "configuration file");
       handle = await open3(path, constants2.O_RDONLY);
     } else {
-      if (isErrorCode(error, "ELOOP") || isErrorCode(error, "EFTYPE")) {
+      if (isErrorCode2(error, "ELOOP") || isErrorCode2(error, "EFTYPE")) {
         throw new AppError("INSTALL_CONFIG_FAILED", `The configuration file '${path}' must not be a symbolic link.`);
       }
       throw error;
@@ -804,7 +813,7 @@ async function createUniqueBackup(path, reviewedBytes) {
       await handle.sync();
     } catch (error) {
       await handle?.close().catch(() => void 0);
-      if (isErrorCode(error, "EEXIST")) {
+      if (isErrorCode2(error, "EEXIST")) {
         continue;
       }
       throw new AppError("INSTALL_BACKUP_FAILED", `Could not create a backup before updating ${path}.`, { cause: error });
@@ -930,9 +939,9 @@ function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isMissingFile2(error) {
-  return isErrorCode(error, "ENOENT");
+  return isErrorCode2(error, "ENOENT");
 }
-function isErrorCode(error, code) {
+function isErrorCode2(error, code) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
 }
 function truncate(value, maxBytes) {
@@ -1211,7 +1220,7 @@ async function runWizard(harness, opts) {
   });
   const session = tolerantQuestion(rl);
   try {
-    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? "2.4.5");
+    ui.banner("SmoothOperator Setup", `Give ${harness} a real Chrome it can drive`, opts.version ?? SERVER_VERSION);
     ui.note(`Configuring: ${harness}`);
     ui.note("Answer each question, or press Enter to accept the recommended default.");
     ui.note(`You can re-run \`smooth-operator install ${harness}\` at any time to change these.`);
@@ -1476,6 +1485,7 @@ var init_installer_wizard = __esm({
   "src/server/installer-wizard.ts"() {
     "use strict";
     init_ui();
+    init_version();
     PROBE_INTERVAL_MS = 300;
     DEFAULT_PROBE_ATTEMPTS = 33;
     HARNESS_MENU = [
@@ -1600,7 +1610,10 @@ function trimOptional(value) {
 function expandOptionalPath(value) {
   return value === void 0 ? void 0 : expandPath(value);
 }
-function readConfigFile(configPath) {
+function isErrorCode(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function readConfigFile(configPath, options = {}) {
   let descriptor;
   try {
     const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
@@ -1628,7 +1641,8 @@ function readConfigFile(configPath) {
       }
     }
     const parsed = JSON.parse(readFileSync(descriptor, "utf8"));
-    const result = RawConfigSchema.safeParse(parsed);
+    const schema = options.allowUnknownRootKeys ? RawConfigSchema.strip() : RawConfigSchema;
+    const result = schema.safeParse(parsed);
     if (!result.success) {
       throw new AppError("CONFIG_INVALID", "Configuration file failed schema validation.", {
         details: { issues: result.error.issues.map((issue) => issue.message) }
@@ -1639,6 +1653,9 @@ function readConfigFile(configPath) {
     if (error instanceof AppError) {
       throw error;
     }
+    if (options.allowMissing && isErrorCode(error, "ENOENT")) {
+      return {};
+    }
     if (error && typeof error === "object" && "code" in error && error.code === "ELOOP") {
       throw new AppError("CONFIG_INSECURE", "Configuration files must not be symbolic links.", { cause: error });
     }
@@ -1692,7 +1709,7 @@ function validateConfig(config) {
   }
   return config;
 }
-function loadServerConfig(args = [], environment = env) {
+function loadServerConfig(args = [], environment = env, homeDirectory = homedir()) {
   if (environment.SMOOTH_OPERATOR_BROWSER_PROFILE !== void 0 || environment.SMOOTH_OPERATOR_BROWSER_STEALTH !== void 0) {
     throw new AppError("CONFIG_INVALID", "Browser profile switches were removed. The native server uses one fixed native profile.");
   }
@@ -1705,11 +1722,12 @@ function loadServerConfig(args = [], environment = env) {
   const argumentValues = parseArguments(args);
   const argValue = (name) => argumentValues.get(name);
   const configPath = argValue("--config") ?? environment.SMOOTH_OPERATOR_CONFIG;
-  const fileConfig = configPath ? readConfigFile(expandPath(configPath)) : {};
+  const defaultConfigPath = join(homeDirectory, ".smooth-operator", "config.json");
+  const fileConfig = configPath ? readConfigFile(expandPath(configPath)) : readConfigFile(defaultConfigPath, { allowMissing: true, allowUnknownRootKeys: true });
   const nestedHttp = fileConfig.http ?? {};
   const nestedBrowser = fileConfig.browser ?? {};
   const nestedSecurity = fileConfig.security ?? {};
-  const dataDir = expandPath(environment.SMOOTH_OPERATOR_DATA_DIR ?? fileConfig.dataDir ?? join(homedir(), ".smooth-operator"));
+  const dataDir = expandPath(environment.SMOOTH_OPERATOR_DATA_DIR ?? fileConfig.dataDir ?? join(homeDirectory, ".smooth-operator"));
   const defaultBrowserDataDir = join(dataDir, "browser");
   const configuredRoots = parseList(environment.SMOOTH_OPERATOR_ALLOWED_FILE_ROOTS, nestedSecurity.allowedFileRoots ?? []);
   const allowedFileRoots = (configuredRoots.length > 0 ? configuredRoots : [join(dataDir, "files"), join(dataDir, "downloads")]).map(expandPath);
@@ -2443,11 +2461,7 @@ function isDestructiveBatchAction(action) {
 // src/server/mcp.ts
 init_errors();
 init_logger();
-
-// src/server/version.ts
-var SERVER_VERSION = "2.4.5";
-
-// src/server/mcp.ts
+init_version();
 var EmptyInputSchema = z3.object({}).strict();
 var ActionEmptyInputSchema = z3.object({ includeSnapshot: z3.boolean().optional() }).strict();
 var MCP_OUTPUT_MAX_BYTES = 28e3;
@@ -8512,6 +8526,7 @@ async function readBoundedResponseText(response, maxBytes) {
 }
 
 // src/server/runtime.ts
+init_version();
 var ServerRuntime = class _ServerRuntime {
   constructor(config, browserProfileLease) {
     this.config = config;
@@ -8920,6 +8935,7 @@ async function runShutdownPhase(label, operation, timeoutMs, logger) {
 
 // src/server/main.ts
 init_installer();
+init_version();
 import { homedir as homedir5 } from "node:os";
 var INSTALL_USAGE = `Usage: smooth-operator install [harness]   (interactive when no harness is given)
        harness: <${supportedHarnessTargets().join("|")}>
@@ -9097,11 +9113,22 @@ async function serveHttp(runtime, shutdown) {
     if (!validateHost(request, response) || !validateOrigin(request, response)) {
       return;
     }
+    setCorsHeaders(request, response);
     if (!requestPathMatches(request, config.http.path)) {
       response.writeHead(404, { "content-type": "application/json" });
       response.end(JSON.stringify({ error: "not_found" }));
       return;
     }
+    if (request.method === "OPTIONS") {
+      response.writeHead(204, {
+        "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
+        "access-control-allow-headers": request.headers["access-control-request-headers"] ?? "authorization, content-type, accept, mcp-protocol-version, mcp-session-id, last-event-id",
+        "access-control-expose-headers": "Mcp-Session-Id, WWW-Authenticate",
+        "access-control-max-age": "600"
+      });
+      response.end();
+      return;
+    }
     if (!authorized(request, config.http.token)) {
       response.writeHead(401, { "content-type": "application/json", "www-authenticate": "Bearer" });
       response.end(JSON.stringify({ error: "unauthorized" }));
@@ -9212,6 +9239,14 @@ function requestPathMatches(request, expectedPath) {
     return false;
   }
 }
+function setCorsHeaders(request, response) {
+  const origin = request.headers.origin;
+  if (!origin || Array.isArray(origin)) {
+    return;
+  }
+  response.setHeader("access-control-allow-origin", origin);
+  response.setHeader("vary", "Origin");
+}
 async function dispatchHttpRequest(request, response, nodeHandler, maxBodyBytes, promoteToStream) {
   if (request.aborted) {
     throw new AppError("HTTP_REQUEST_ABORTED", "The HTTP client disconnected before the request completed.", { status: 499, retryable: true });
@@ -9317,10 +9352,11 @@ function authorized(request, token) {
     return true;
   }
   const header = request.headers.authorization;
-  if (!header?.startsWith("Bearer ")) {
+  const match = header?.match(/^Bearer[ \t]+(.+)$/i);
+  if (!match) {
     return false;
   }
-  const presented = Buffer.from(header.slice("Bearer ".length));
+  const presented = Buffer.from(match[1]);
   const expected = createHash("sha256").update(token).digest();
   const presentedDigest = createHash("sha256").update(presented).digest();
   return presentedDigest.length === expected.length && timingSafeEqual(presentedDigest, expected);