smooth-operator-mcp 2.4.6 → 2.4.8

package/docs/harnesses.md

@@ -12,6 +12,20 @@ SmoothOperator speaks MCP over stdio. The `smooth-operator install <target>`
 command registers that stdio server with a supported client. It uses
 structured argument arrays and never invokes a shell.
 
+The server also supports Streamable HTTP at `/mcp` for harnesses that cannot
+launch local stdio processes. Its HTTP adapter accepts current MCP sessions and
+the SDK's legacy 2025-compatible handshake, while retaining host, origin,
+authentication, and request-size checks. For a local harness that needs an
+explicit path, use a structured command such as:
+
+```text
+smooth-operator --config /absolute/path/to/config.json
+```
+
+The installer-created `~/.smooth-operator/config.json` is discovered
+automatically, so an explicit `--config` argument is only needed for a separate
+profile or an unusual home/config location.
+
 Build or install the package first:
 
 ```sh

package/docs/mcp-server.md

@@ -132,14 +132,16 @@ SMOOTH_OPERATOR_HTTP_HOST=0.0.0.0 \
 SMOOTH_OPERATOR_ALLOW_REMOTE_HTTP=true \
 SMOOTH_OPERATOR_HTTP_TOKEN="$(openssl rand -hex 32)" \
 SMOOTH_OPERATOR_ALLOWED_HOSTS=example.internal \
-SMOOTH_OPERATOR_ALLOWED_ORIGINS=https://example.internal \
+SMOOTH_OPERATOR_ALLOWED_ORIGINS=example.internal \
 smooth-operator
 ```
 
 Remote mode is rejected unless the token is at least 32 characters. Do not
 use a token from a shell history, checked-in file, or shared log. A reverse
 proxy can add TLS and network access controls, but it does not replace the
-application token, Host/Origin allowlists, or request-size limit.
+application token, Host/Origin allowlists, or request-size limit. Allowed host
+and origin values are hostnames without a scheme; browser preflight requests
+are answered only after the same Host and Origin checks.
 
 ## Browser lifecycle
 
@@ -167,8 +169,10 @@ SmoothOperator process using the same private profile is rejected by the profile
 `SMOOTH_OPERATOR_BROWSER_AUTO_LAUNCH` is retained for backward compatibility but is
 ignored in managed mode.
 
-Browser actions share a bounded operation queue and deadline. Browser startup
-uses one in-flight connection promise, so concurrent callers wait for the same
+Browser actions share a bounded operation queue and deadline. Independent
+read-only observations may run concurrently; navigation, mutation, snapshot,
+and session-control operations remain exclusive. Browser startup uses one
+in-flight connection promise, so concurrent callers wait for the same
 reattach/launch attempt instead of starting duplicate processes. Newly
 auto-attached top-level targets are held at the CDP boundary until the
 navigation policy guard is installed; targets whose attachment ownership
@@ -230,9 +234,12 @@ browser mode.
 
 ## Configuration and precedence
 
-Configuration can come from a JSON file selected by `--config` or
-`SMOOTH_OPERATOR_CONFIG`, environment variables, and a small set of command-line
-flags. The effective precedence is:
+Configuration can come from the installer-created
+`~/.smooth-operator/config.json`, an explicitly selected JSON file via `--config`
+or `SMOOTH_OPERATOR_CONFIG`, environment variables, and a small set of
+command-line flags. When no explicit config path is supplied, the installer
+file is loaded automatically so its browser, security, and data-directory
+choices apply consistently to every harness. The effective precedence is:
 
 1. command-line values (`--config`, `--transport`, `--host`, `--port`);
 2. environment variables;
@@ -240,9 +247,11 @@ flags. The effective precedence is:
 4. documented defaults.
 
 The file is an object with nested `http`, `browser`, and `security` sections.
-Unknown keys fail validation. Keep the file owner-readable only (`chmod 600`);
-the loader rejects group/world-readable configuration files and rejects
-symlinked data directories.
+Explicit `--config`/`SMOOTH_OPERATOR_CONFIG` files reject unknown root keys;
+the automatically discovered installer file ignores unrelated root sections so
+it can coexist with harness settings. Keep the file owner-readable only
+(`chmod 600`); the loader rejects group/world-readable configuration files and
+rejects symlinked data directories.
 
 Example:
 
@@ -269,6 +278,7 @@ variables include:
 | Setting | Default | Notes |
 | --- | --- | --- |
 | `SMOOTH_OPERATOR_TRANSPORT` | `stdio` | `stdio` or `http` |
+| `SMOOTH_OPERATOR_CONFIG` | auto-discovered | Explicit JSON config path; overrides the installer default |
 | `SMOOTH_OPERATOR_DATA_DIR` | `~/.smooth-operator` | Private data, file, and download roots |
 | `SMOOTH_OPERATOR_BROWSER_MODE` | `managed` | `managed`, `disabled`, `connect`, or `launch` |
 | `SMOOTH_OPERATOR_BROWSER_URL` | `http://127.0.0.1:9222` | DevTools HTTP endpoint |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smooth-operator-mcp",
-  "version": "2.4.6",
+  "version": "2.4.8",
   "type": "module",
   "packageManager": "npm@12.0.2",
   "description": "A lightweight, production-grade MCP server for secure browser automation.",
@@ -23,7 +23,7 @@
   "scripts": {
     "start": "tsx src/server/main.ts",
     "dev": "tsx watch src/server/main.ts",
-    "build": "esbuild src/server/main.ts --bundle --platform=node --format=esm --packages=external --banner:js=\"#!/usr/bin/env node\" --outfile=dist/smooth-operator.mjs --sourcemap --sources-content=false",
+    "build": "node scripts/build.mjs",
     "postbuild": "node scripts/set-executable.mjs dist/smooth-operator.mjs",
     "lint": "eslint .",
     "typecheck": "tsc --noEmit",
@@ -34,19 +34,16 @@
     "dead-code": "knip --include files,exports,dependencies,unlisted --no-progress",
     "mcp:stdio": "npm run start -- --transport stdio",
     "mcp:http": "npm run start -- --transport http",
-    "benchmark:mcp": "node scripts/benchmark-mcp.mjs",
-    "benchmark:mcp:live": "node scripts/benchmark-mcp.mjs --live",
-    "benchmark:mcp:dist": "node scripts/benchmark-mcp.mjs --dist",
     "package:smoke": "npm run build && node scripts/verify-package.mjs",
     "package:smoke:install": "npm run build && node scripts/verify-package.mjs --install",
-    "release:smoke": "npm run package:smoke:install && npm run benchmark:mcp:dist",
+    "release:smoke": "npm run package:smoke:install",
     "prepack": "npm run build",
     "prepare": "npm run build"
   },
   "dependencies": {
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    "puppeteer-core": "^25.8.0",
+    "puppeteer-core": "^25.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {