syncme-mcp 1.0.1 → 1.0.2

package/README.md

@@ -2,6 +2,8 @@
 
 copies your logins for a site from your normal chrome into a separate chrome that ai agents and scripts can drive. so jev, browser-use or playwright can use your accounts without touching your real browser.
 
+syncme comes in two parts: the [chrome extension](https://chromewebstore.google.com/detail/dcgmgkdgmbjgnchjdmokimppnhfinpfp) and [syncme-mcp](https://www.npmjs.com/package/syncme-mcp), the npm bridge it talks to. the source for both is on [github](https://github.com/levinkin/syncme).
+
 ## how it works
 
 1. when you're on a site you want, click the syncme icon and it asks if you want to copy it over
@@ -18,14 +20,14 @@ needs chrome and node 20 or newer. works on mac and windows.
 
 there's nothing to install: the extension talks to the bridge over a websocket on 127.0.0.1, and any command starts the bridge itself.
 
-1. install the extension (chrome web store, or load this folder unpacked from `chrome://extensions` with developer mode on)
-2. click the syncme icon and use one of the connect buttons, or run `npx -y syncme-mcp setup` to wire up claude code, codex, cursor, windsurf and claude desktop
+1. install the extension from the [chrome web store](https://chromewebstore.google.com/detail/dcgmgkdgmbjgnchjdmokimppnhfinpfp), or load this folder unpacked from `chrome://extensions` with developer mode on
+2. click the syncme icon, hit the gear, and use one of the connect buttons, or run `npx -y syncme-mcp setup` to wire up claude code, codex, cursor, windsurf and claude desktop
 
 ## commands
 
 ```
 npx -y syncme-mcp open                       # start the ai browser, prints {"cdp": "http://127.0.0.1:<port>"}
-npx -y syncme-mcp sync https://example.com   # copy one site, asks you in chrome first if it's not saved yet
+npx -y syncme-mcp sync https://example.com   # copy one site, asks you in chrome first unless it's saved or yolo is on
 npx -y syncme-mcp stop                       # close the ai browser
 npx -y syncme-mcp shutdown                   # close it and stop the bridge
 npx -y syncme-mcp setup                      # add the mcp server to the ai apps you have installed
@@ -46,7 +48,7 @@ await (await browser.contexts()[0].newPage()).goto('https://example.com');
 
 ## mcp
 
-you can also hook it up as an mcp server so your ai can ask for a site itself. it calls `copy_site` with something like `https://github.com`, you get a popup in chrome asking if it can have that login, and if you say yes it copies it and gets back the cdp url. there's also `open_browser` and `close_browser`.
+you can also hook it up as an mcp server so your ai can ask for a site itself. it calls `copy_site` with something like `https://github.com`, you get a popup in chrome asking if it can have that login, and if you say yes it copies it and gets back the cdp url. turn on yolo mode in the syncme options (the gear in the popup) to skip that popup and let your ai copy any site it asks for. there's also `open_browser` and `close_browser`.
 
 ```
 claude mcp add --scope user syncme -- npx -y syncme-mcp

package/approve.html

@@ -1,17 +1,7 @@
 <!doctype html>
 <html lang="en"><meta charset="utf-8"><title>syncme</title>
-<style>body{font:15px system-ui;width:340px;margin:16px}button{padding:8px 14px}li{margin:6px 0}li button{padding:2px 8px;margin-left:6px}label{display:block;margin:14px 0}#question{font-weight:600}</style>
+<style>:root{color-scheme:light dark}body{font:15px system-ui;width:340px;margin:16px}button{padding:8px 14px}#question{font-weight:600}footer{display:flex;justify-content:space-between;align-items:center;border-top:1px solid #8884;padding-top:10px}#options{background:none;border:none;padding:2px;font-size:20px;line-height:1;cursor:pointer;opacity:.7}#options:hover{opacity:1}</style>
 <p id="question"></p>
-<button id="copy">Copy</button> <button id="deny" hidden>No</button>
 <p id="status" role="status"></p>
-<div id="settings">
-<label><input type="checkbox" id="auto"> Copy all saved sites when the AI browser starts</label>
-<h2>Saved sites</h2>
-<ul id="approved"></ul>
-<h2>Connect your ai</h2>
-<p id="waiting" hidden>connect an ai app first.</p>
-<p id="pairing" hidden><span></span> <button id="repair">Re-pair</button></p>
-<p><a id="cursor" hidden>Add to Cursor</a> <a id="vscode" hidden>Add to VS Code</a></p>
-<button id="claude">Copy Claude Code command</button> <button id="setup">Copy setup command</button>
-</div>
+<footer><span><button id="copy">Copy</button> <button id="deny" hidden>No</button></span><button id="options" title="Options" aria-label="Options">&#9881;&#xFE0E;</button></footer>
 <script src="approve.js"></script></html>

package/approve.js

@@ -1,76 +1,37 @@
 const status = document.querySelector('#status');
 const question = document.querySelector('#question');
 const copyButton = document.querySelector('#copy');
-const auto = document.querySelector('#auto');
 let site;
-async function render() {
-  const {approved = []} = await chrome.storage.local.get('approved');
-  const list = document.querySelector('#approved');
-  list.replaceChildren();
-  for (const value of approved) {
-    const li = document.createElement('li');
-    li.append(document.createTextNode(new URL(value).host));
-    const button = document.createElement('button');
-    button.textContent = 'Remove';
-    button.onclick = async () => {
-      const {approved = []} = await chrome.storage.local.get('approved');
-      await chrome.storage.local.set({approved: approved.filter(x => x !== value)});
-      status.textContent = 'Removed. The AI browser keeps cookies it already has.';
-      await render();
-    };
-    li.append(button); list.append(li);
-  }
-}
 const requested = new URLSearchParams(location.search).get('site');
 if (requested) {
-  question.textContent = `Your AI wants your ${new URL(requested).host} login. Copy it?`;
-  document.querySelector('#settings').hidden = true;
+  question.textContent = `Your AI needs your ${new URL(requested).host} login to continue. Copy it?`;
+  document.querySelector('#options').hidden = true;
   const deny = document.querySelector('#deny');
   deny.hidden = false;
   copyButton.onclick = () => chrome.runtime.sendMessage({op: 'allow', answer: true});
   deny.onclick = () => chrome.runtime.sendMessage({op: 'allow', answer: false});
-} else chrome.tabs.query({active: true, currentWindow: true}).then(([tab]) => {
-  const u = tab?.url ? new URL(tab.url) : null;
-  if (u && ['http:', 'https:'].includes(u.protocol)) {
-    site = u.origin;
-    question.textContent = `Copy ${u.host} to your AI browser?`;
-  } else {
-    question.textContent = 'Open a website to copy it.';
-    copyButton.hidden = true;
-  }
-});
-if (!requested) copyButton.onclick = async () => {
-  copyButton.disabled = true;
-  status.textContent = 'Copying...';
-  try {
-    const result = await chrome.runtime.sendMessage({op: 'copy', origin: site});
-    status.textContent = result?.ok ? `Copied ${result.count} cookies.` : result?.error === 'Busy' ? 'Busy, try again in a moment.' : result?.error === 'Not connected' ? 'Connect an ai app first.' : 'Copy failed.';
-  } catch (_) {
-    status.textContent = 'Copy failed.';
-  } finally {
-    copyButton.disabled = false;
-  }
-  await render();
-};
-chrome.storage.local.get('autoSync').then(({autoSync}) => { auto.checked = autoSync === true; });
-auto.onchange = () => chrome.storage.local.set({autoSync: auto.checked});
-const server = {name: 'syncme', command: 'npx', args: ['-y', 'syncme-mcp']};
-const links = {
-  cursor: 'cursor://anysphere.cursor-deeplink/mcp/install?name=syncme&config=' + btoa(JSON.stringify({command: server.command, args: server.args})),
-  vscode: 'vscode:mcp/install?' + encodeURIComponent(JSON.stringify(server)),
-};
-for (const [id, href] of Object.entries(links)) {
-  const link = document.querySelector('#' + id);
-  link.href = href;
-  link.hidden = false;
+} else {
+  chrome.tabs.query({active: true, currentWindow: true}).then(([tab]) => {
+    const u = tab?.url ? new URL(tab.url) : null;
+    if (u && ['http:', 'https:'].includes(u.protocol)) {
+      site = u.origin;
+      question.textContent = `Copy ${u.host} to your AI browser?`;
+    } else {
+      question.textContent = 'Open a website to copy it.';
+      copyButton.hidden = true;
+    }
+  });
+  copyButton.onclick = async () => {
+    copyButton.disabled = true;
+    status.textContent = 'Copying...';
+    try {
+      const result = await chrome.runtime.sendMessage({op: 'copy', origin: site});
+      status.textContent = result?.ok ? `Copied ${result.count} cookies.` : result?.error === 'Busy' ? 'Busy, try again in a moment.' : result?.error === 'Not connected' ? 'Connect an ai app first.' : 'Copy failed.';
+    } catch (_) {
+      status.textContent = 'Copy failed.';
+    } finally {
+      copyButton.disabled = false;
+    }
+  };
+  document.querySelector('#options').onclick = () => chrome.runtime.openOptionsPage();
 }
-document.querySelector('#claude').onclick = () => navigator.clipboard.writeText('claude mcp add syncme -- npx -y syncme-mcp');
-document.querySelector('#setup').onclick = () => navigator.clipboard.writeText('npx -y syncme-mcp setup');
-chrome.storage.session.get(['connected', 'pairing']).then(({connected, pairing}) => {
-  document.querySelector('#waiting').hidden = connected === true || Boolean(pairing);
-  const box = document.querySelector('#pairing');
-  box.hidden = !pairing;
-  box.firstChild.textContent = pairing === 'lost' ? 'syncme lost its pairing with this extension.' : 'syncme is paired with a different extension. Run npx -y syncme-mcp unpair, then hit Re-pair.';
-});
-document.querySelector('#repair').onclick = () => { chrome.runtime.sendMessage({op: 'repair'}); document.querySelector('#pairing').hidden = true; };
-render();

package/background.js

@@ -59,19 +59,19 @@ function connect() {
       return;
     }
     if (message.op === 'copied') { pending.get(message.id)?.(message); pending.delete(message.id); return; }
-    const {approved = [], autoSync = false} = await chrome.storage.local.get(['approved', 'autoSync']);
+    const {approved = [], autoSync = false, yolo = false} = await chrome.storage.local.get(['approved', 'autoSync', 'yolo']);
     if (message.op === 'list') { send({id: message.id, origins: autoSync ? approved : []}); return; }
     let stage = 'request';
     try {
       if (message.op !== 'sync' || typeof message.id !== 'string') throw Error('Invalid request');
       const u = origin(message.origin);
       if (!approved.includes(u.origin)) {
-        if (!await allow(u.origin)) throw Error('Origin not approved');
+        if (!yolo && !await allow(u.origin)) throw Error('Origin not approved');
         const {approved: now = []} = await chrome.storage.local.get('approved');
         await chrome.storage.local.set({approved: [...new Set([...now, u.origin])]});
       }
       stage = 'cookies';
-      const cookies = (await chrome.cookies.getAll({domain: u.hostname})).filter(c => c.domain.replace(/^\./, '') === u.hostname && !c.partitionKey && (!c.secure || u.protocol === 'https:'));
+      const cookies = (await chrome.cookies.getAll({})).filter(c => (c.hostOnly ? c.domain === u.hostname : ('.' + u.hostname).endsWith(c.domain)) && !c.partitionKey && (!c.secure || u.protocol === 'https:'));
       send({id: message.id, origin: u.origin, cookies});
     } catch (_) { try { send({id: message.id, error: stage === 'cookies' ? 'Cookie API refused' : 'Origin unavailable or not approved'}); } catch (_) {} }
   };

package/manifest.json

@@ -9,7 +9,7 @@
     "48": "icons/48.png",
     "128": "icons/128.png"
   },
-  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyDi/Cstz6nR487vgWA2QTykf48Svj3DFUeSMva5uZdxoYIJSxKW1S9d+YGFFM0osrctIUWL6YbeGQYxWcnakI4oItc9x0oKO9w5lLYm1Azzn3zy/Pj/8dN647SyBjeyjW5EDAs2eNwWj15qjOy+y1u3Oqep/8kx0eVHwoHWwojH2trvOIBUwa1zd9eJ8fV4lcrEUr9okjlaZEB3s+qYR/D/ezvOlP3VMHztCL1dptv/Y8DtVVFqC+AkfaOqLEGYfaXufF+cdG/V6DBu6YZ1mww1VET/rjcGKCl+OsEFIwIOU0usOWbLB1JnspVupeq8CDe+baHBU24qQZc3U7UpaUQIDAQAB",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv7Ya2I48aElXGpM5ww2OWgBOa/qtRPz8dFJ80ny2yVo8QbNt2hFwfl9KpHOC93Ik/rgzDRQStH7X37kFV9TedCv+vIq5oYe9GOCzLtYRZZzQI1P8zF1znXzuWsTusWaXpvkKAo0stzRBSlEFI166kUeEHhPw3TreKQl2kFy0IT9ht9pHBkwKS77Yy4NbNogkdZPPBuAjB1OdL/Rl9epUtagtCHuBYemMLhdaa8UJxDynGLxuqeIsxK8kXtb4WTWeFjA13mlNSiGNXb8bIcu0HOYV1d9m/bVaosENQEuAJHw8NRmhbSjQKp7/2Dflphb50ZoE9yiazAhIZ4DGcCQt/QIDAQAB",
   "permissions": [
     "alarms",
     "cookies",
@@ -29,5 +29,8 @@
       "32": "icons/32.png"
     }
   },
-  "options_page": "approve.html"
+  "options_ui": {
+    "page": "options.html",
+    "open_in_tab": false
+  }
 }

package/options.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en"><meta charset="utf-8"><title>syncme options</title>
+<style>:root{color-scheme:light dark}body{font:14px system-ui;min-width:420px;margin:16px}h2{font-size:15px;margin:20px 0 8px}label{display:flex;justify-content:space-between;align-items:center;gap:16px;margin:14px 0 2px;font-weight:500}.note{opacity:.7;font-size:12px;margin:0 0 10px}ul{padding:0;list-style:none}li{display:flex;justify-content:space-between;align-items:center;margin:6px 0}li button{padding:2px 8px}</style>
+<h2>Options</h2>
+<label for="auto">Copy saved sites on start <input type="checkbox" id="auto"></label>
+<p class="note">Copies every saved site when the AI browser starts.</p>
+<label for="yolo">Yolo mode <input type="checkbox" id="yolo"></label>
+<p class="note">Copies any site your AI asks for without a popup. Installing syncme already means you're ok with that.</p>
+<h2>Saved sites</h2>
+<ul id="approved"></ul>
+<p id="status" class="note" role="status"></p>
+<h2>Connect your AI</h2>
+<p id="waiting" class="note" hidden>Connect an AI app first.</p>
+<p id="pairing" class="note" hidden><span></span> <button id="repair">Re-pair</button></p>
+<button id="claude">Copy Claude Code command</button> <button id="setup">Copy setup command</button>
+<script src="options.js"></script></html>

package/options.js

@@ -0,0 +1,35 @@
+const status = document.querySelector('#status');
+async function render() {
+  const {approved = []} = await chrome.storage.local.get('approved');
+  const list = document.querySelector('#approved');
+  list.replaceChildren();
+  for (const value of approved) {
+    const li = document.createElement('li');
+    li.append(document.createTextNode(new URL(value).host));
+    const button = document.createElement('button');
+    button.textContent = 'Remove';
+    button.onclick = async () => {
+      const {approved = []} = await chrome.storage.local.get('approved');
+      await chrome.storage.local.set({approved: approved.filter(x => x !== value)});
+      status.textContent = 'Removed. The AI browser keeps cookies it already has.';
+      await render();
+    };
+    li.append(button); list.append(li);
+  }
+}
+for (const [id, key] of [['auto', 'autoSync'], ['yolo', 'yolo']]) {
+  const box = document.querySelector('#' + id);
+  chrome.storage.local.get(key).then(stored => { box.checked = stored[key] === true; });
+  box.onchange = () => chrome.storage.local.set({[key]: box.checked});
+}
+document.querySelector('#claude').onclick = () => navigator.clipboard.writeText('claude mcp add syncme -- npx -y syncme-mcp');
+document.querySelector('#setup').onclick = () => navigator.clipboard.writeText('npx -y syncme-mcp setup');
+chrome.storage.session.get(['connected', 'pairing']).then(({connected, pairing}) => {
+  document.querySelector('#waiting').hidden = connected === true || Boolean(pairing);
+  const box = document.querySelector('#pairing');
+  box.hidden = !pairing;
+  box.firstChild.textContent = pairing === 'lost' ? 'syncme lost its pairing with this extension.' : 'syncme is paired with a different extension. Run npx -y syncme-mcp unpair, then hit Re-pair.';
+});
+document.querySelector('#repair').onclick = () => { chrome.runtime.sendMessage({op: 'repair'}); document.querySelector('#pairing').hidden = true; };
+chrome.storage.onChanged.addListener(changes => { if (changes.approved) render(); });
+render();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "syncme-mcp",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "copy your logins for a site into a separate chrome that your ai agents and scripts can use",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "playwright-core": "^1.49.0",
+    "tldts": "^7.4.19",
     "ws": "^8.18.0"
   },
   "license": "PolyForm-Noncommercial-1.0.0",

package/syncme.js

@@ -7,6 +7,7 @@ import {dirname, join} from 'node:path';
 import {createInterface} from 'node:readline';
 import {fileURLToPath} from 'node:url';
 import {chromium} from 'playwright-core';
+import {getDomain} from 'tldts';
 import {WebSocket, WebSocketServer} from 'ws';
 
 const ROOT = dirname(fileURLToPath(import.meta.url));
@@ -115,13 +116,15 @@ function origin(value) {
 
 function cookiesFor(site, cookies) {
   if (!Array.isArray(cookies) || cookies.length > 3000) throw rejected('cookies');
+  const registrable = getDomain(site.hostname, {allowPrivateDomains: true});
   const result = [];
   for (const c of cookies) {
-    if (!c || typeof c !== 'object' || typeof c.domain !== 'string' || c.domain.replace(/^\./, '') !== site.hostname || c.partitionKey) throw rejected('cookies');
+    if (!c || typeof c !== 'object' || typeof c.domain !== 'string' || c.partitionKey) throw rejected('cookies');
     for (const field of ['name', 'value', 'domain', 'path']) {
       if (typeof c[field] !== 'string' || c[field].length > 16384) throw rejected('cookies');
     }
     if (!c.path.startsWith('/') || ['secure', 'httpOnly', 'hostOnly', 'session'].some(field => typeof c[field] !== 'boolean')) throw rejected('cookies');
+    if (c.hostOnly ? c.domain !== site.hostname : !registrable || !c.domain.startsWith('.') || c.domain.length <= registrable.length || !('.' + site.hostname).endsWith(c.domain)) throw rejected('cookies');
     if (c.secure && site.protocol !== 'https:') throw rejected('cookies');
     const item = {name: c.name, value: c.value, path: c.path, secure: c.secure, httpOnly: c.httpOnly};
     item.domain = c.hostOnly ? site.hostname : c.domain;
@@ -260,7 +263,7 @@ async function serve() {
       if (response.origin !== value || response.error) throw rejected('bridge');
       const cookies = cookiesFor(site, response.cookies);
       for (const cookie of await context.cookies()) {
-        if (cookie.domain.replace(/^\./, '') === site.hostname && (site.protocol === 'https:' || !cookie.secure)) await context.clearCookies({name: cookie.name, domain: cookie.domain, path: cookie.path});
+        if ((cookie.domain === site.hostname || cookie.domain.startsWith('.') && ('.' + site.hostname).endsWith(cookie.domain)) && (site.protocol === 'https:' || !cookie.secure)) await context.clearCookies({name: cookie.name, domain: cookie.domain, path: cookie.path});
       }
       await context.addCookies(cookies);
       count += cookies.length;
@@ -386,12 +389,12 @@ function pack() {
   try {
     const {key, ...store} = MANIFEST;
     writeFileSync(join(stage, 'manifest.json'), JSON.stringify(store, null, 2));
-    for (const name of ['background.js', 'approve.html', 'approve.js']) copyFileSync(join(ROOT, name), join(stage, name));
+    for (const name of ['background.js', 'approve.html', 'approve.js', 'options.html', 'options.js']) copyFileSync(join(ROOT, name), join(stage, name));
     cpSync(join(ROOT, 'icons'), join(stage, 'icons'), {recursive: true});
     rmSync(zip, {force: true});
     const result = process.platform === 'win32'
       ? spawnSync('powershell', ['-NoProfile', '-Command', `Compress-Archive -Path '${join(stage, '*')}' -DestinationPath '${zip}' -Force`], {stdio: 'ignore'})
-      : spawnSync('zip', ['-r', '-X', '-q', zip, 'manifest.json', 'background.js', 'approve.html', 'approve.js', 'icons'], {cwd: stage, stdio: 'ignore'});
+      : spawnSync('zip', ['-r', '-X', '-q', zip, 'manifest.json', 'background.js', 'approve.html', 'approve.js', 'options.html', 'options.js', 'icons'], {cwd: stage, stdio: 'ignore'});
     if (result.status !== 0) throw Error('Pack failed');
   } finally {
     rmSync(stage, {recursive: true, force: true});