smooth-operator-mcp 2.4.9 → 2.4.11

package/docs/harnesses.md

@@ -1,8 +1,8 @@
 # Harness installation
 
-## Interactive wizard (one-command)
+## Interactive wizard (directly to your harness)
 
-`smooth-operator install <harness>` is interactive by default — it asks 7 curated questions (browser mode, browser executable, headless, allowed domains, blocked domains, page JavaScript, and data directory) with recommended defaults in brackets. Omitting `<harness>` is allowed too: on a TTY the installer prompts for the target first (default `opencode`), while piped or CI environments print usage and exit instead. Use `smooth-operator install opencode --yes` to skip prompts and use recommended defaults. The wizard saves its choices to `~/.smooth-operator/config.json` (0600, symlink-safe) — mode, executable path, headless, domains, and allowEval are written exactly as answered on every run — and then registers the harness. Personal-Chrome mode derives `browserUrl` after launching the helper on port 9222; it is not a separate prompt.
+`smooth-operator install <harness>` is interactive by default — it asks 7 curated questions (browser mode, browser executable, headless, allowed domains, blocked domains, page JavaScript, and data directory) with recommended defaults in brackets. Omitting `<harness>` is allowed too: on a TTY the installer prompts for the target first (default `opencode`), while piped or CI environments print usage and exit instead. Use `smooth-operator install opencode --yes` to skip prompts and use recommended defaults. The wizard normalizes and validates its choices before saving them to `~/.smooth-operator/config.json` (0600, bounded, owner-only, and symlink-safe). Mode, executable path, headless, domains, and allowEval are authoritative on every run while unrelated settings are preserved, and the harness is then registered. Personal-Chrome mode derives `browserUrl` after launching the helper on port 9222; it is not a separate prompt.
 
 ### Personal Chrome (connect) helper
 

package/docs/mcp-server.md

@@ -145,15 +145,15 @@ are answered only after the same Host and Origin checks.
 
 ## Browser lifecycle
 
-The server manages one headed, persistent private agent-Chrome session by
-default. On the first browser tool call it discovers an installed Google Chrome,
+The server manages one headed, persistent private Chromium-based browser session
+by default. On the first browser tool call it discovers an installed browser,
 launches it with `${SMOOTH_OPERATOR_DATA_DIR}/browser` as a non-default profile,
 and records its loopback DevTools endpoint for later reattachment. Sign in once
 in the visible window; its sessions persist in that private profile. The
 `browser_doctor` tool reports executable resolution and endpoint state without
 evaluating page content.
 
-Managed Chrome is headed by default for sign-in and human handoff. On CI or a
+The managed browser is headed by default for sign-in and human handoff. On CI or a
 displayless host, explicitly set `SMOOTH_OPERATOR_BROWSER_HEADLESS=true` or use
 Xvfb. The server never adds fingerprint spoofing, CAPTCHA solving, proxy
 rotation, or other evasion behavior.
@@ -283,7 +283,7 @@ variables include:
 | `SMOOTH_OPERATOR_BROWSER_MODE` | `managed` | `managed`, `disabled`, `connect`, or `launch` |
 | `SMOOTH_OPERATOR_BROWSER_URL` | `http://127.0.0.1:9222` | DevTools HTTP endpoint |
 | `SMOOTH_OPERATOR_BROWSER_EXECUTABLE` | unset | Managed-mode override; required for explicit launch mode |
-| `SMOOTH_OPERATOR_BROWSER_USER_DATA_DIR` | `${SMOOTH_OPERATOR_DATA_DIR}/browser` | Dedicated persistent agent-Chrome profile |
+| `SMOOTH_OPERATOR_BROWSER_USER_DATA_DIR` | `${SMOOTH_OPERATOR_DATA_DIR}/browser` | Dedicated persistent browser profile |
 | `SMOOTH_OPERATOR_BROWSER_HEADLESS` | `false` | Set `true` for CI/displayless managed or launch use |
 | `SMOOTH_OPERATOR_ALLOWED_DOMAINS` | unset | Comma-separated allowlist |
 | `SMOOTH_OPERATOR_BLOCKED_DOMAINS` | unset | Comma-separated denylist |
@@ -398,7 +398,9 @@ schema) is one aggregate budget across the returned title and snippet text,
 not a per-result multiplier. URL fields and fixed untrusted-data wrapper
 markers are outside that text budget. The response body is bounded before
 parsing, redirects are rejected, cancellation and timeout are propagated, and
-credentials/query secret placeholders are removed from result URLs.
+credentials/query secret placeholders are removed from result URLs. Transient
+provider failures use at most three bounded attempts; anti-bot responses are
+reported without attempting a bypass.
 
 ### Resources
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smooth-operator-mcp",
-  "version": "2.4.9",
+  "version": "2.4.11",
   "type": "module",
   "packageManager": "npm@12.0.2",
   "description": "A lightweight, production-grade MCP server for secure browser automation.",