smooth-operator-mcp 3.0.1 → 3.0.4

package/dist/smooth-operator.mjs

@@ -397,7 +397,7 @@ var SERVER_VERSION;
 var init_version = __esm({
   "src/server/version.ts"() {
     "use strict";
-    SERVER_VERSION = "3.0.1";
+    SERVER_VERSION = "3.0.4";
   }
 });
 
@@ -639,9 +639,9 @@ function resolveConfigPath(target, homeDirectory = homedir3(), environment = pro
     return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (platform2() === "win32") {
-    return join6(environment.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    return join6(resolveConfigDirectory(environment.APPDATA, join6(home, "AppData", "Roaming")), "Claude", "claude_desktop_config.json");
   }
-  return join6(environment.XDG_CONFIG_HOME ?? join6(home, ".config"), "Claude", "claude_desktop_config.json");
+  return join6(resolveConfigDirectory(environment.XDG_CONFIG_HOME, join6(home, ".config")), "Claude", "claude_desktop_config.json");
 }
 function resolveOpenCodeConfigPath(homeDirectory = homedir3(), environment = process.env, override) {
   if (override) {
@@ -650,9 +650,17 @@ function resolveOpenCodeConfigPath(homeDirectory = homedir3(), environment = pro
   if (environment.OPENCODE_CONFIG) {
     return resolve5(environment.OPENCODE_CONFIG);
   }
-  const configDirectory = environment.OPENCODE_CONFIG_DIR ?? join6(homeDirectory || homedir3(), ".config", "opencode");
+  const configDirectory = resolveConfigDirectory(environment.OPENCODE_CONFIG_DIR, join6(homeDirectory || homedir3(), ".config", "opencode"));
   return join6(configDirectory, "opencode.json");
 }
+function resolveConfigDirectory(value, fallback) {
+  const candidate = value?.trim() || fallback;
+  try {
+    return resolve5(candidate);
+  } catch (error) {
+    throw new AppError("INSTALL_CONFIG_INVALID", "Configuration directory paths must be valid filesystem paths.", { cause: error });
+  }
+}
 async function installJsonConfig(target, plannedPath, options, allowOpenCodeJsoncFallback = false) {
   const path = target === "opencode" && allowOpenCodeJsoncFallback ? await chooseExistingOpenCodePath(plannedPath) : plannedPath;
   await ensureSecureDirectory(dirname4(path));
@@ -898,6 +906,9 @@ function sameOpenCodeEntry(value, desired) {
 }
 async function ensureSecureDirectory(path) {
   const absolute = resolve5(path);
+  if (parse3(absolute).root === absolute) {
+    throw new AppError("INSTALL_CONFIG_FAILED", "Configuration directories must not be filesystem roots.");
+  }
   await assertNoSymlinkComponents2(absolute, "configuration directory");
   await mkdir3(absolute, { recursive: true, mode: 448 });
   await assertNoSymlinkComponents2(absolute, "configuration directory");
@@ -1227,7 +1238,7 @@ __export(installer_wizard_exports, {
   runWizard: () => runWizard
 });
 import { dirname as dirname5, isAbsolute as isAbsolute4, join as join7, parse as parse4, resolve as resolve6, win32 as win323 } from "node:path";
-import { existsSync as existsSync2 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, statSync } from "node:fs";
 import { chmod as chmod3, lstat as lstat4, rename as rename4, unlink as unlink4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { isIP as isIP3 } from "node:net";
@@ -1244,6 +1255,19 @@ function isAbsolutePath(value) {
 function isFilesystemRoot(value) {
   return isAbsolute4(value) && parse4(value).root === value || win323.isAbsolute(value) && win323.parse(value).root === value;
 }
+function isExecutableFile(path) {
+  try {
+    if (!statSync(path).isFile()) {
+      return false;
+    }
+    if (process.platform !== "win32") {
+      accessSync2(path, constants3.X_OK);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isInteractive() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
 }
@@ -1313,8 +1337,8 @@ async function askBrowser(session, ui) {
         return detected[numeric - 1].path;
       }
       if (/^\d+$/.test(answer)) continue;
-      if (isAbsolutePath(answer) && existsSync2(answer)) return answer;
-      ui.failure("Enter a listed number or an existing absolute path.");
+      if (isAbsolutePath(answer) && isExecutableFile(answer)) return answer;
+      ui.failure("Enter a listed number or an existing executable file path.");
     }
   }
   while (true) {
@@ -1324,8 +1348,8 @@ async function askBrowser(session, ui) {
       ui.failure("Enter an absolute path.");
       continue;
     }
-    if (!existsSync2(answer)) {
-      ui.failure("That path does not exist.");
+    if (!isExecutableFile(answer)) {
+      ui.failure("That path is not an executable file.");
       continue;
     }
     return answer;
@@ -1560,16 +1584,65 @@ function writeSummary(ui, harness, choices) {
   ]);
 }
 async function defaultProbe(url, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
     const response = await fetch(url, { signal: controller.signal });
-    clearTimeout(timer);
     if (!response.ok) return { state: "no-file" };
-    const version = await response.json().catch(() => ({}));
-    return { state: "live", version };
+    const version = await readProbeJson(response, controller.signal);
+    return isDevToolsVersion(version) ? { state: "live", version } : { state: "no-file" };
   } catch {
     return { state: "no-file" };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function isDevToolsVersion(value) {
+  return isRecord4(value) && typeof value.Browser === "string" && typeof value.webSocketDebuggerUrl === "string" && /^wss?:\/\//i.test(value.webSocketDebuggerUrl);
+}
+async function readProbeJson(response, signal) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_PROBE_RESPONSE_BYTES) {
+    return void 0;
+  }
+  if (!response.body) {
+    return void 0;
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      if (signal.aborted) {
+        return void 0;
+      }
+      const next = await reader.read();
+      if (next.done) {
+        break;
+      }
+      if (!(next.value instanceof Uint8Array)) {
+        return void 0;
+      }
+      total += next.value.byteLength;
+      if (total > MAX_PROBE_RESPONSE_BYTES) {
+        return void 0;
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return void 0;
   }
 }
 async function assertPrivateWizardConfig(handle) {
@@ -1671,16 +1744,21 @@ async function launchPersonalChrome(opts) {
   if (!safeDataDir || !isAbsolutePath(rawDataDir) || isFilesystemRoot(safeDataDir) || /[\u0000-\u001f\u007f]/.test(rawDataDir)) {
     throw new AppError("INSTALL_CONFIG_INVALID", "The personal Chrome data directory must be an absolute non-root path without control characters.");
   }
+  if (opts.probeAttempts !== void 0 && (!Number.isSafeInteger(opts.probeAttempts) || opts.probeAttempts < 1 || opts.probeAttempts > MAX_PROBE_ATTEMPTS)) {
+    throw new AppError("INSTALL_CONFIG_INVALID", `The personal Chrome probe attempt count must be an integer between 1 and ${MAX_PROBE_ATTEMPTS}.`);
+  }
+  await ensureSecureDirectory(safeDataDir);
+  const personalProfileDir = join7(safeDataDir, "personal-chrome");
+  await ensureSecureDirectory(personalProfileDir);
   const { findChromeExecutable: findChromeExecutable2 } = await Promise.resolve().then(() => (init_discovery(), discovery_exports));
   const executable = opts.executablePath ?? findChromeExecutable2()?.path;
-  if (!executable) {
+  if (!executable || !isExecutableFile(executable)) {
     throw new AppError("BROWSER_NOT_CONFIGURED", "Install Chrome or set SMOOTH_OPERATOR_BROWSER_EXECUTABLE");
   }
-  await ensureSecureDirectory(safeDataDir);
   const spawnFn = opts.spawn ?? (await import("node:child_process")).spawn;
   const args = [
     `--remote-debugging-port=${port}`,
-    `--user-data-dir=${join7(safeDataDir, "personal-chrome")}`,
+    `--user-data-dir=${personalProfileDir}`,
     "--no-first-run",
     "--no-default-browser-check",
     ...opts.headless ? ["--headless=new"] : []
@@ -1689,19 +1767,44 @@ async function launchPersonalChrome(opts) {
   child.unref();
   const probe = opts.probe;
   const attempts = opts.probeAttempts ?? DEFAULT_PROBE_ATTEMPTS;
+  const deadline = opts.probeAttempts === void 0 ? Date.now() + DEFAULT_PROBE_DEADLINE_MS : void 0;
+  let attemptsMade = 0;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
+    if (deadline !== void 0 && Date.now() >= deadline) {
+      break;
+    }
     if (attempt > 0) {
-      await new Promise((resolveTimeout) => setTimeout(resolveTimeout, PROBE_INTERVAL_MS));
+      const remaining2 = deadline === void 0 ? PROBE_INTERVAL_MS : deadline - Date.now();
+      if (remaining2 <= 0) break;
+      await new Promise((resolveTimeout) => setTimeout(resolveTimeout, Math.min(PROBE_INTERVAL_MS, remaining2)));
     }
+    const remaining = deadline === void 0 ? PROBE_TIMEOUT_MS : Math.min(PROBE_TIMEOUT_MS, deadline - Date.now());
+    if (remaining <= 0) break;
+    attemptsMade += 1;
     try {
-      const res = await probe(`http://127.0.0.1:${port}/json/version`, 1e3);
+      const res = await boundedProbe(probe, `http://127.0.0.1:${port}/json/version`, remaining);
       if (res.state === "live") return { url: `http://127.0.0.1:${port}` };
     } catch {
     }
   }
-  throw new AppError("BROWSER_CONNECT_TIMEOUT", `Chrome DevTools endpoint on port ${port} did not become ready after ${attempts} probes. Close Chrome or choose another port.`);
+  throw new AppError("BROWSER_CONNECT_TIMEOUT", `Chrome DevTools endpoint on port ${port} did not become ready after ${attemptsMade} probes. Close Chrome or choose another port.`);
+}
+async function boundedProbe(probe, url, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      Promise.resolve().then(() => probe(url, timeoutMs)),
+      new Promise((resolveProbe) => {
+        timer = setTimeout(() => resolveProbe({ state: "timeout" }), timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
 }
-var PROBE_INTERVAL_MS, DEFAULT_PROBE_ATTEMPTS, MAX_WIZARD_CONFIG_BYTES, HARNESS_MENU, WIZARD_STEP_TOTAL;
+var PROBE_INTERVAL_MS, PROBE_TIMEOUT_MS, DEFAULT_PROBE_ATTEMPTS, DEFAULT_PROBE_DEADLINE_MS, MAX_PROBE_ATTEMPTS, MAX_PROBE_RESPONSE_BYTES, MAX_WIZARD_CONFIG_BYTES, HARNESS_MENU, WIZARD_STEP_TOTAL;
 var init_installer_wizard = __esm({
   "src/server/installer-wizard.ts"() {
     "use strict";
@@ -1710,7 +1813,11 @@ var init_installer_wizard = __esm({
     init_ui();
     init_version();
     PROBE_INTERVAL_MS = 300;
+    PROBE_TIMEOUT_MS = 1e3;
     DEFAULT_PROBE_ATTEMPTS = 33;
+    DEFAULT_PROBE_DEADLINE_MS = 1e4;
+    MAX_PROBE_ATTEMPTS = 100;
+    MAX_PROBE_RESPONSE_BYTES = 64 * 1024;
     MAX_WIZARD_CONFIG_BYTES = 2e6;
     HARNESS_MENU = [
       { id: "opencode", label: "OpenCode", description: "Configures ~/.config/opencode/opencode.json" },
@@ -1734,7 +1841,7 @@ import { realpathSync as realpathSync2 } from "node:fs";
 import process4 from "node:process";
 import { Readable } from "node:stream";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { createMcpHandler } from "@modelcontextprotocol/server";
+import { createMcpHandler, isJsonContentType as sdkIsJsonContentType } from "@modelcontextprotocol/server";
 import { toNodeHandler } from "@modelcontextprotocol/node";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 
@@ -1907,7 +2014,7 @@ function isValidDomainPattern(pattern) {
     }
     const bracketless = base.replace(/^\[|\]$/g, "");
     if (isIP(bracketless) !== 0) {
-      return true;
+      return !wildcard;
     }
     const ascii = domainToASCII(base);
     return Boolean(ascii) && ascii.split(".").every((label) => label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label));
@@ -1999,6 +2106,18 @@ function canonicalizeAllowedFileRoots(rawRoots) {
     if (parse(canonicalRoot).root === canonicalRoot) {
       throw new AppError("CONFIG_INVALID", "Configured file roots must not be filesystem roots.");
     }
+    try {
+      if (!lstatSync(canonicalRoot).isDirectory()) {
+        throw new AppError("CONFIG_INVALID", "Configured file roots must be directories.");
+      }
+    } catch (error) {
+      if (error instanceof AppError) {
+        throw error;
+      }
+      if (!isMissingPathError(error)) {
+        throw new AppError("CONFIG_INSECURE", "Configured file roots could not be inspected safely.", { cause: error });
+      }
+    }
     if (!roots.includes(canonicalRoot)) {
       roots.push(canonicalRoot);
     }
@@ -2312,11 +2431,21 @@ function normalizeHostPattern(value) {
     throw new AppError("CONFIG_INVALID", "Configuration failed validation: configured HTTP host allowlists must contain hostnames or bracketed IPv6 addresses without ports.");
   }
   try {
-    return new URL(`http://${trimmed}`).hostname.toLowerCase();
+    const hostname = new URL(`http://${trimmed}`).hostname.toLowerCase();
+    return hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
   } catch (error) {
     throw new AppError("CONFIG_INVALID", "Configuration failed validation: configured HTTP host allowlists contain an invalid hostname.", { cause: error });
   }
 }
+function normalizeListenHost(value) {
+  const trimmed = value.trim();
+  try {
+    const hostname = new URL(`http://${trimmed}`).hostname.toLowerCase();
+    return hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+  } catch {
+    return trimmed;
+  }
+}
 function normalizeHostList(values) {
   return normalizeList(values).map(normalizeHostPattern);
 }
@@ -2329,7 +2458,7 @@ function isValidDomainPattern2(value) {
   }
   const bracketless = base.replace(/^\[|\]$/g, "");
   if (isIP2(bracketless) !== 0) {
-    return true;
+    return !wildcard;
   }
   let ascii;
   try {
@@ -2575,7 +2704,7 @@ function loadServerConfig(args = [], environment = env, homeDirectory = homedir(
   const config = {
     transport: argValue("--transport") ?? environment.SMOOTH_OPERATOR_TRANSPORT ?? fileConfig.transport ?? "stdio",
     http: {
-      host: (argValue("--host") ?? environment.SMOOTH_OPERATOR_HTTP_HOST ?? nestedHttp.host ?? "127.0.0.1").trim(),
+      host: normalizeListenHost(argValue("--host") ?? environment.SMOOTH_OPERATOR_HTTP_HOST ?? nestedHttp.host ?? "127.0.0.1"),
       port: parseInteger(argValue("--port") ?? environment.SMOOTH_OPERATOR_HTTP_PORT, nestedHttp.port ?? 3344),
       path: (environment.SMOOTH_OPERATOR_HTTP_PATH ?? nestedHttp.path ?? "/mcp").trim(),
       token: environment.SMOOTH_OPERATOR_HTTP_TOKEN ?? nestedHttp.token,
@@ -3421,6 +3550,23 @@ var MCP_OUTPUT_TRUNCATION_MARKER_BYTES = UTF8_ENCODER2.encode(MCP_OUTPUT_TRUNCAT
 var MCP_ERROR_CODE_MAX_BYTES = 200;
 var MCP_ERROR_MESSAGE_MAX_BYTES = 4e3;
 var MCP_JSON_TEXT_CACHE = /* @__PURE__ */ new WeakMap();
+var MCP_OUTPUT_CONTRACT_ARRAY_KEYS = /* @__PURE__ */ new Set([
+  "links",
+  "results",
+  "entries",
+  "interactive",
+  "nodes",
+  "matches",
+  "frames"
+]);
+var MCP_OUTPUT_ARRAY_BOUNDS = [
+  ["links", "linksTruncated"],
+  ["entries", "entriesTruncated"],
+  ["interactive", "interactiveTruncated"],
+  ["nodes", "nodesTruncated"],
+  ["matches", "matchesTruncated"],
+  ["frames", "framesTruncated"]
+];
 var NetworkIdleSchema = z3.object({
   timeoutMs: z3.number().int().min(100).max(12e4).optional(),
   pageId: z3.string().trim().min(1).max(200).optional()
@@ -3554,28 +3700,14 @@ var BrowserExecCodeSchema = z3.string().trim().min(1).max(8e4).superRefine((code
     context.addIssue({ code: "custom", message: "code must be a JSON array of validated browser actions." });
     return;
   }
-  if (!BrowserActionPlanSchema.safeParse(parsed).success) {
-    context.addIssue({ code: "custom", message: "code must be a non-empty JSON array of validated browser actions without nested scripts or screenshots." });
+  if (!Array.isArray(parsed) || parsed.length === 0 || parsed.length > 100) {
+    context.addIssue({ code: "custom", message: "code must be a non-empty JSON array of at most 100 browser actions." });
   }
 });
 var BrowserExecRequestSchema = z3.object({
   code: BrowserExecCodeSchema,
   confirmDestructive: z3.boolean().optional()
-}).strict().superRefine((input, context) => {
-  if (input.confirmDestructive) {
-    return;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(input.code);
-  } catch {
-    return;
-  }
-  const actions = BrowserActionPlanSchema.safeParse(parsed);
-  if (actions.success && actions.data.some((action) => isDestructiveBatchAction(action.action))) {
-    context.addIssue({ code: "custom", path: ["confirmDestructive"], message: "This action plan contains destructive actions. Set confirmDestructive=true to execute them." });
-  }
-});
+}).strict();
 var BrowserUseStateSchema = z3.object({
   include_screenshot: z3.boolean().optional(),
   fullPage: z3.boolean().optional(),
@@ -3615,7 +3747,7 @@ var BROWSER_MUTATING = { ...MUTATING, openWorldHint: true };
 var BROWSER_DESTRUCTIVE = { ...DESTRUCTIVE, openWorldHint: true };
 var MCP_INSTRUCTIONS = [
   "Use browser_snapshot or browser_get_state before interacting so element refs/indexes and viewport coordinates are current.",
-  "Serialize dependent browser calls as observe -> one navigation or mutation -> observe. Parallel calls are appropriate only for independent read-only observations; a parallel snapshot and action do not form a transaction.",
+  "Use an observe -> act -> verify loop: serialize dependent browser calls as one navigation or mutation between observations. Parallel calls are appropriate only for independent read-only observations; a parallel snapshot and action do not form a transaction.",
   "Give each request a bounded timeout or cancellation signal. After a timeout or cancellation, inspect current state before retrying a mutation; cancellation is not proof that a mutation did not happen.",
   "After navigation, tab switching, scrolling that changes lazy content, or any DOM-changing action, discard old refs and indexes and capture a fresh snapshot instead of silently falling back to coordinates, text, or a different selector.",
   "Only report titles, URLs, snippets, and metadata that are explicitly present in the returned MCP fields. Absence of a field is evidence of absence: never invent titles, summaries, counts, or other metadata that the tools did not return.",
@@ -3625,8 +3757,7 @@ var MCP_INSTRUCTIONS = [
   "Prefer stable refs, indexes, and selectors over coordinates; use coordinates only when the page cannot expose a reliable target.",
   "For open shadow roots, Puppeteer pierce/ selectors may be used explicitly; closed shadow roots remain unavailable.",
   "Use browser_batch for short validated sequences, but keep destructive actions separate when user confirmation is needed.",
-  "Use an efficient observe -> act -> verify loop: observe with browser_snapshot or browser_get_state, perform one bounded browser action, then observe again to verify the resulting state. Keep refs and indexes fresh after navigation, scrolling, or DOM changes; parallelize only independent read-only observations.",
-  "browser_solve_challenge is an internal connected-AI loop. Each call is one bounded verification cycle and returns fresh visual/state evidence plus attemptsRemaining; the connected AI should keep using normal browser actions and call it again until the final classification explicitly reports the challenge absent or automation_exhausted. Never claim a challenge is solved from a present, unknown, or failed classification. Human handoff is only an explicit final option after exhaustion.",
+  "browser_solve_challenge is an internal connected-AI loop. Each call is one bounded verification cycle; present and exhausted classifications include fresh visual/state evidence and attemptsRemaining. The connected AI should keep using normal browser actions and call it again until the final classification explicitly reports the challenge absent or automation_exhausted. Never claim a challenge is solved from a present, unknown, or failed classification. Human handoff is only an explicit final option after exhaustion.",
   "The server contains no LLM or agent planner; the MCP client is responsible for reasoning, retries, and task completion."
 ].join(" ");
 function createMcpServer(runtime) {
@@ -3721,7 +3852,10 @@ function registerBrowserTools(server, runtime) {
       inputSchema: BrowserUseExtractSchema,
       annotations: BROWSER_READ_ONLY
     },
-    async (input, ctx) => callTool(() => runtime.run({ action: "extract", query: input.query, includeLinks: input.extract_links, pageId: input.pageId, frameId: input.frameId, maxChars: MCP_PAGE_TEXT_MAX_CHARS }, ctx.mcpReq.signal), runtime)
+    async (input, ctx) => {
+      const { extract_links, ...fields } = input;
+      return callTool(() => runtime.run({ action: "extract", ...fields, includeLinks: extract_links, maxChars: MCP_PAGE_TEXT_MAX_CHARS }, ctx.mcpReq.signal), runtime);
+    }
   );
   registerAction(server, runtime, "browser_navigate", "Navigate the browser", "Open an HTTP(S) URL after domain and private-network policy validation. DNS is checked before navigation but the browser resolver is not pinned. Set includeSnapshot=true for one trailing snapshot.", NavigateRequestSchema, "navigate", (input) => {
     const { new_tab, ...fields } = input;
@@ -3759,7 +3893,10 @@ function registerBrowserTools(server, runtime) {
     { title: "Read browser console log", description: "Enable, disable, read, clear, or read-and-clear the bounded console log.", inputSchema: NetworkLogRequestSchema, annotations: BROWSER_DESTRUCTIVE },
     async (input, ctx) => callTool(() => runtime.run({ action: consoleAction(input.operation), pageId: input.pageId }, ctx.mcpReq.signal), runtime)
   );
-  registerAction(server, runtime, "browser_find_text", "Find text", "Find and center the first matching text on the page.", PageQuerySchema, "find_text", (input) => ({ ...input, text: input.query }));
+  registerAction(server, runtime, "browser_find_text", "Find text", "Find and center the first matching text on the page.", PageQuerySchema, "find_text", (input) => {
+    const { query, ...fields } = input;
+    return { ...fields, text: query };
+  });
   registerAction(server, runtime, "browser_extract", "Extract page text", "Extract at most 8,000 page-text characters from the page or a CSS selector. Check truncated, offset, nextOffset, hasMore, and revision; use browser_page_next for later slices.", ExtractRequestSchema, "extract", (input) => ({ ...input, maxChars: input.maxChars ?? MCP_PAGE_TEXT_MAX_CHARS }));
   registerAction(server, runtime, "browser_upload", "Upload a file", "Upload a file from an allowed server file root into a file input.", UploadRequestSchema, "upload_file");
   registerAction(server, runtime, "browser_screenshot", "Capture a screenshot", "Capture a bounded PNG or JPEG screenshot of the current page.", ScreenshotRequestSchema, "screenshot", (input) => {
@@ -3778,7 +3915,10 @@ function registerBrowserTools(server, runtime) {
   registerAction(server, runtime, "browser_computed_style", "Read computed style", "Read a small safe subset of computed style for an element.", SelectorRequestSchema, "get_computed_style");
   registerAction(server, runtime, "browser_page_info", "Read page information", "Read URL, title, viewport, and document dimensions.", EmptyInputSchema, "get_page_info");
   registerAction(server, runtime, "browser_hover", "Hover an element", "Move the pointer over a CSS selector or snapshot ref.", TargetRequestSchema, "hover");
-  registerAction(server, runtime, "browser_move", "Move the pointer", "Move the pointer to bounded top-level viewport coordinates without clicking. Use this to inspect hover-driven UI before choosing a click point.", MoveRequestSchema, "move", (input) => ({ ...input, coordinateX: input.coordinateX ?? input.coordinate_x, coordinateY: input.coordinateY ?? input.coordinate_y }));
+  registerAction(server, runtime, "browser_move", "Move the pointer", "Move the pointer to bounded top-level viewport coordinates without clicking. Use this to inspect hover-driven UI before choosing a click point.", MoveRequestSchema, "move", (input) => {
+    const { coordinate_x, coordinate_y, ...fields } = input;
+    return { ...fields, coordinateX: fields.coordinateX ?? coordinate_x, coordinateY: fields.coordinateY ?? coordinate_y };
+  });
   registerAction(server, runtime, "browser_press_and_hold", "Press and hold or drag", "Press a mouse button on an element for a bounded duration. Optional startCoordinateX/startCoordinateY and endCoordinateX/endCoordinateY drag with interpolated mouse events; path supplies a bounded explicit pointer path for drawing or selection gestures.", HoldRequestSchema, "press_and_hold");
   registerAction(server, runtime, "browser_challenge", "Detect a web challenge", "Detect bounded challenge markers and return a fresh classification for the current page. A detected challenge is not evidence that it has been solved.", EmptyInputSchema, "detect_challenge");
   registerAction(server, runtime, "browser_wait_for_human", "Wait for human takeover", "Optionally wait for a user to complete a visible challenge or sign-in step in the browser. The result includes a fresh final classification.", WaitForHumanRequestSchema, "wait_for_human");
@@ -3813,11 +3953,24 @@ function registerBrowserTools(server, runtime) {
     "browser_exec",
     {
       title: "Execute a browser action program",
-      description: "Browser-use CLI compatibility entry point. The code must be a JSON array of validated browser actions; arbitrary Python or JavaScript is not executed.",
+      description: "Browser-use CLI compatibility entry point. The code must be a JSON array of validated browser actions; it is not a shell or arbitrary Python runner. Page JavaScript is limited to the explicit evaluate action and server policy.",
       inputSchema: BrowserExecRequestSchema,
       annotations: BROWSER_DESTRUCTIVE
     },
-    async (input, ctx) => callBatchTool(() => runtime.runBatch(parseBrowserExecCode(input.code), { confirmDestructive: input.confirmDestructive }, ctx.mcpReq.signal), runtime)
+    async (input, ctx) => callBatchTool(() => {
+      const actions = parseBrowserExecCode(input.code);
+      if (!input.confirmDestructive) {
+        const destructiveIndex = actions.findIndex((action) => isDestructiveBatchAction(action.action));
+        if (destructiveIndex >= 0) {
+          const action = actions[destructiveIndex];
+          throw new AppError("DESTRUCTIVE_CONFIRMATION_REQUIRED", `Action '${action.action}' must be executed separately or with confirmDestructive=true.`, {
+            retryable: true,
+            details: { failedIndex: destructiveIndex, failedAction: action.action, hint: "Set confirmDestructive=true or run the action separately." }
+          });
+        }
+      }
+      return runtime.runBatch(actions, { confirmDestructive: input.confirmDestructive }, ctx.mcpReq.signal);
+    }, runtime)
   );
   server.registerTool(
     "browser_batch",
@@ -4140,7 +4293,7 @@ function truncateUtf82(value, maxBytes) {
   while (low < high) {
     const midpoint = Math.ceil((low + high) / 2);
     const candidate = decoder.decode(bytes.slice(0, midpoint));
-    if (UTF8_ENCODER2.encode(candidate).byteLength <= maxBytes) {
+    if (UTF8_ENCODER2.encode(candidate).byteLength <= boundedMaxBytes) {
       low = midpoint;
     } else {
       high = midpoint - 1;
@@ -4261,9 +4414,8 @@ function boundMcpOutput(value, options = {}) {
   capArray("nodes", MCP_OUTPUT_NODE_LIMIT, "nodesTruncated");
   capArray("matches", MCP_OUTPUT_MATCH_LIMIT, "matchesTruncated");
   capArray("frames", 20, "framesTruncated");
-  const contractArrayKeys = /* @__PURE__ */ new Set(["links", "results", "entries", "interactive", "nodes", "matches", "frames"]);
   for (const [key, item] of Object.entries(output)) {
-    if (!contractArrayKeys.has(key) && Array.isArray(item)) {
+    if (!MCP_OUTPUT_CONTRACT_ARRAY_KEYS.has(key) && Array.isArray(item)) {
       capArray(key, MCP_OUTPUT_ARRAY_ITEM_LIMIT, `${key}Truncated`);
     }
   }
@@ -4326,10 +4478,7 @@ function boundMcpOutput(value, options = {}) {
       markOutputTruncated();
     }
   }
-  const arrayBounds = [["links", "linksTruncated"], ["entries", "entriesTruncated"], ["interactive", "interactiveTruncated"], ["nodes", "nodesTruncated"], ["matches", "matchesTruncated"], ["frames", "framesTruncated"]];
-  if (!options.preserveBatchResults) {
-    arrayBounds.push(["results", "resultsTruncated"]);
-  }
+  const arrayBounds = options.preserveBatchResults ? MCP_OUTPUT_ARRAY_BOUNDS : [...MCP_OUTPUT_ARRAY_BOUNDS, ["results", "resultsTruncated"]];
   for (const [key, flag] of arrayBounds) {
     while (jsonByteLength2(output) > MCP_OUTPUT_MAX_BYTES && Array.isArray(output[key]) && output[key].length > 1) {
       const items = output[key];
@@ -12099,7 +12248,9 @@ var ServerRuntime = class _ServerRuntime {
         classification: "bounded-evidence",
         connectedAiLoop: true,
         humanHandoff: true,
-        successRequiresAbsentClassification: true
+        successRequiresAbsentClassification: true,
+        defaultMaxAttempts: 32,
+        maxAttempts: 100
       },
       persistence: {
         fileRootsConfigured: this.config.security.allowedFileRoots.length > 0,
@@ -12212,7 +12363,9 @@ async function reclaimStaleLock(lockPath) {
     if (after.ino !== before.ino || after.dev !== before.dev) {
       return false;
     }
-    await rename2(lockPath, `${lockPath}.stale-${randomUUID2()}`);
+    const stalePath = `${lockPath}.stale-${randomUUID2()}`;
+    await rename2(lockPath, stalePath);
+    await unlink2(stalePath).catch(() => void 0);
     return true;
   } catch {
     return false;
@@ -12423,6 +12576,10 @@ var HTTP_NOT_FOUND_BODY = JSON.stringify({ error: "not_found" });
 var HTTP_SHUTTING_DOWN_BODY = JSON.stringify({ error: "server_shutting_down" });
 var HTTP_BUSY_BODY = JSON.stringify({ error: "server_busy" });
 var HTTP_UNAUTHORIZED_BODY = JSON.stringify({ error: "unauthorized" });
+var HTTP_UNSUPPORTED_MEDIA_BODY = JSON.stringify({
+  jsonrpc: "2.0",
+  error: { code: -32e3, message: "Unsupported Media Type: Content-Type must be application/json" }
+});
 async function main(args = process4.argv.slice(2)) {
   if (args[0] === "install") {
     const yes = args.includes("--yes") || args.includes("--no-interactive");
@@ -12770,6 +12927,14 @@ async function dispatchHttpRequest(request, response, nodeHandler, maxBodyBytes,
   if (request.aborted) {
     throw new AppError("HTTP_REQUEST_ABORTED", "The HTTP client disconnected before the request completed.", { status: 499, retryable: true });
   }
+  const contentType = request.headers["content-type"];
+  if (request.method?.toUpperCase() === "POST" && (typeof contentType !== "string" || !sdkIsJsonContentType(contentType))) {
+    response.setHeader("connection", "close");
+    closeIncompleteRequestAfterResponse(request, response);
+    response.writeHead(415, { "content-type": "application/json" });
+    response.end(HTTP_UNSUPPORTED_MEDIA_BODY);
+    return;
+  }
   const contentLength = Number(request.headers["content-length"] ?? 0);
   if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
     closeIncompleteRequestAfterResponse(request, response);