smooth-operator-mcp 3.0.5 → 3.1.0

package/.env.example

@@ -30,6 +30,9 @@ SMOOTH_OPERATOR_BROWSER_CONNECT_TIMEOUT_MS=30000
 SMOOTH_OPERATOR_BROWSER_CDP_TIMEOUT_MS=30000
 SMOOTH_OPERATOR_MAX_SCREENSHOT_BYTES=8000000
 SMOOTH_OPERATOR_MAX_HTML_CHARS=200000
+# Optional idle cleanup for the connected browser; 0 disables idle cleanup.
+# The maximum accepted value is 86400000 ms (24 hours).
+# SMOOTH_OPERATOR_BROWSER_IDLE_TIMEOUT_MS=0
 
 # Network and page-operation safety invariants
 SMOOTH_OPERATOR_ALLOWED_DOMAINS=

package/README.md

@@ -31,7 +31,10 @@ The wizard asks exactly 3 focused questions: browser profile ownership, browser
 
 Requires Node 22.23.2+ and an installed Chromium-based browser. Profile at `~/.smooth-operator/browser` — sign in once.
 
-Verify: `smooth-operator --help` and `server_health` / `browser_doctor` appear after restart.
+Verify: `smooth-operator --help` and `server_health` / `browser_doctor` appear after restart. `server_health` reports `ok` when the runtime is ready, `degraded` when browser recovery is required or its managed profile lease is not held, and `shutting_down` during teardown; an idle lazy browser is healthy.
+
+For a local release check, run `npm run verify`; it covers lint, type safety,
+tests, dead-code analysis, and the package smoke test.
 
 ## What it does
 
@@ -39,6 +42,15 @@ Verify: `smooth-operator --help` and `server_health` / `browser_doctor` appear a
 - Inspect pages with snapshots, accessibility trees, HTML, styles, text search, and bounded extraction
 - Work across tabs, frames, popups, shadow DOM, dialogs, cookies, storage, downloads, screenshots, and PDFs
 - Search the web through bounded DuckDuckGo retrieval
+- Search a bounded metadata-only network journal by request ID, URL, method, status, and resource type
+- Block page-scoped image, stylesheet, font, media, and script subresources; document and navigation requests are never selectable
+- Inspect a selected element's safe attributes, styles, animations, and shallow children without returning scripts, event source, form values, or arbitrary data attributes
+- Upload one file or up to 20 files from allowed roots; each file is capped at 50 MiB and the aggregate at 100 MiB
+- Read, set, and delete URL-scoped cookies with validated SameSite settings; cookie values are omitted from reads
+
+The MCP registry exposes 64 public tools. The surface includes bounded network
+search, safe element inspection, page-scoped resource blocking, and file and
+cookie controls alongside the navigation, extraction, and lifecycle tools.
 
 Ask: *“Scrape pricing into a table”*, *“Fill this form with ~/resume.pdf”*, or *“Download the monthly report as a PDF.”*
 
@@ -48,7 +60,7 @@ Talk to your harness normally. It can call `browser_navigate` → `browser_snaps
 
 Browser identity remains native, page JavaScript is available by default, and
 behavioral timing is off for fast deterministic input. Set the explicit
-environment flags to change those choices. See `docs/STEALTH-GUIDE.md` for
+environment flags to change those choices. See the [browser compatibility guide](docs/STEALTH-GUIDE.md) for
 details and responsible use.
 
 For the fastest supported operation, keep behavioral timing off with
@@ -57,6 +69,13 @@ cancellable. All local browser tools and page features are available by default;
 remote HTTP, private-network access, and file roots remain explicitly gated.
 Faster calls do not bypass challenges or grant permission to automate a site.
 
+Managed mode preflights a regular executable when it needs to launch, and
+launch mode does so before invoking Chromium. Both wait for browser launch
+readiness and a target-guard acknowledgement before returning a usable
+connection. The loopback DevTools `/json/version` probe is bounded to 64 KiB
+before JSON parsing. There is no arbitrary CDP or host-code tool; page
+evaluation remains an explicit page capability.
+
 ## Why
 
 - Zero setup — managed, headed, persistent browser by default
@@ -64,6 +83,10 @@ Faster calls do not bypass challenges or grant permission to automate a site.
 - Reliable — private profiles, stale-reference recovery, reconnect handling, and structured errors
 - Flexible — stdio by default, Streamable HTTP when you need it, plus connect and disabled modes
 
+For HTTP deployments, the configured MCP path also has a bounded readiness
+endpoint at `<path>/healthz` (normally `/mcp/healthz`), subject to the same
+HTTP authentication policy as the MCP endpoint.
+
 ## Benchmarks
 
 Compared with [Browser Use MCP](https://github.com/browser-use/browser-use) · [![Browser Use GitHub stars](https://img.shields.io/github/stars/browser-use/browser-use?style=social)](https://github.com/browser-use/browser-use)