smooth-operator-mcp 3.0.1 → 3.0.4

package/docs/harnesses.md

@@ -3,24 +3,25 @@
 ## Interactive wizard (directly to your harness)
 
 `smooth-operator install <harness>` is interactive by default — it asks exactly 3
-curated questions (browser mode/profile, browser executable, and
-security/data-directory settings) with recommended defaults in brackets.
+curated questions (profile ownership, headed/headless display, and browser
+executable) with recommended defaults in brackets.
 Omitting `<harness>` is allowed too: on a TTY the installer prompts for the
 target first (default `opencode`), while piped or CI environments print usage
 and exit instead. Use `smooth-operator install opencode --yes` to skip prompts
 and use recommended defaults. The wizard normalizes and validates its choices
 before saving them to `~/.smooth-operator/config.json` (0600, bounded,
 owner-only, and symlink-safe). Managed mode owns one private persistent profile;
-connect mode attaches to an operator-owned browser and does not own or close
-its profile/process. Personal-Chrome mode derives `browserUrl` after launching
+connect mode launches a dedicated debugging profile and does not touch an
+operator's daily browser profile. Personal-Chrome mode derives `browserUrl` after launching
 the helper on port 9222; it is not a separate prompt.
 
 ### Personal Chrome (connect) helper
 
 When you pick “connected browser” (mode `connect`), the wizard finds Chromium via
 `discovery.ts`, launches a dedicated debugging profile under
-`~/.smooth-operator/personal-chrome` with port `9222`, and polls the loopback
-endpoint until it is live. On success it writes
+`~/.smooth-operator/personal-chrome` with port `9222`, and probes the loopback
+endpoint until a valid DevTools version response is live (33 attempts within a
+default 10-second deadline). On success it writes
 `SMOOTH_OPERATOR_BROWSER_MODE=connect` and
 `SMOOTH_OPERATOR_BROWSER_URL=http://127.0.0.1:9222` for you. This does not
 attach to or take ownership of an operator's daily browser profile. No manual

package/docs/mcp-server.md

@@ -147,7 +147,9 @@ smooth-operator
 ```
 
 Remote mode is rejected unless the token is at least 32 characters. Do not
-use a token from a shell history, checked-in file, or shared log. A reverse
+use a token from a shell history, checked-in file, or shared log. POST requests
+must declare `Content-Type: application/json`; unsupported media types are
+rejected before their body is read. A reverse
 proxy can add TLS and network access controls, but it does not replace the
 application token, Host/Origin allowlists, or request-size limit. Allowed host
 and origin values are hostnames without a scheme; browser preflight requests
@@ -357,8 +359,9 @@ are always applied, with explicit opt-ins where documented:
   the same policy checks; `about:blank` is allowed, data/blob URLs are limited
   to non-frame subresources, and file, browser-internal, extension, and
   unknown schemes are rejected.
-- Upload and PDF destinations must stay within configured file roots after
-  realpath and symlink checks. Download paths and generated files are bounded.
+- Upload and PDF destinations must stay within configured directory roots after
+  realpath and symlink checks; an existing regular file cannot be configured as
+  a root. Download paths and generated files are bounded.
 - Page JavaScript is available in the native profile by default and can be
   disabled with `SMOOTH_OPERATOR_ALLOW_EVAL=false`; when enabled, page code can
   observe and mutate page state with the browser's privileges.
@@ -409,13 +412,16 @@ disabled explicitly with `SMOOTH_OPERATOR_ALLOW_EVAL=false`.
 `browser_evaluate` is page JavaScript and is available by default (set
 `SMOOTH_OPERATOR_ALLOW_EVAL=false` when it is not wanted). `browser_exec`
 accepts only a JSON array of validated browser actions; it is not a shell,
-Python, or arbitrary code runner. Destructive batch actions require explicit
+Python, or arbitrary code runner. Its explicit `evaluate` action still follows
+the page-evaluation policy. Destructive batch actions require explicit
 confirmation. `browser_wait_for_human` pauses for an operator to complete a
 visible sign-in or challenge. `browser_solve_challenge` is an internal
 connected-AI observe/act/verify loop: it returns bounded evidence and is
 successful only when a fresh final classification explicitly reports the
-challenge absent. `browser_close_session` closes the one native browser session
-by its explicit session identifier.
+challenge absent; present and exhausted cycles report the remaining attempt
+budget and `automation_exhausted` is the final non-success state.
+`browser_close_session`
+closes the one native browser session by its explicit session identifier.
 
 Actions that leave a usable page—navigation, click, input, select, scroll, key,
 back, forward, and reload—accept optional `includeSnapshot: true`. The action
@@ -470,8 +476,9 @@ The server publishes read-only resources:
 Resource output is bounded and follows the same redaction and policy rules as
 tool output. The capabilities resource also reports the native defaults and
 effective feature flags for local browser tools, page evaluation, stealth, and
-behavioral timing, plus whether challenge success requires an explicit absent
-classification.
+behavioral timing. Its challenge metadata includes the default and maximum
+connected-AI attempt budgets and states that success requires an explicit
+absent classification.
 
 ### Prompts
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smooth-operator-mcp",
-  "version": "3.0.1",
+  "version": "3.0.4",
   "type": "module",
   "packageManager": "npm@12.0.2",
   "description": "A lightweight, production-grade MCP server for secure browser automation.",