yoke-mcp 0.1.6 → 0.1.7

package/README.md

@@ -47,7 +47,7 @@ URL fields are reduced to origin and path by default, and `list_tabs` can opt ou
 ### Small and auditable
 
 The package declares zero runtime dependencies and uses Node builtins only. The
-published 0.1.6 tarball is 47 files, all first-party.
+published 0.1.7 tarball is 47 files, all first-party.
 
 TypeScript throughout with `strict` and `noUncheckedIndexedAccess` on. The wire
 shapes are declared once in `src/protocol.ts` and imported by both halves, so a
@@ -64,7 +64,7 @@ judge rather than yours to discover.
 
 The cells describe the verified versions and their defaults. Flags that change an answer are named in the cell or the numbered notes.
 
-| Capability | Yoke (npm 0.1.6) | @playwright/mcp 0.0.79 (2026-08) | chrome-devtools-mcp 1.7.0 (pub. 2026-08-10) | BrowserMCP: server 0.1.3 (2025-04-11), extension 1.3.4 (2025-05-07), unmaintained |
+| Capability | Yoke (npm 0.1.7) | @playwright/mcp 0.0.79 (2026-08) | chrome-devtools-mcp 1.7.0 (pub. 2026-08-10) | BrowserMCP: server 0.1.3 (2025-04-11), extension 1.3.4 (2025-05-07), unmaintained |
 | --- | --- | --- | --- | --- |
 | Runs in the Chrome profile you are already signed in to | Yes. Chrome spawns the host via `connectNative`; there is no browser-launch code | No by default: its own persistent profile keyed to the client's cwd [1]. Yes with `--extension` | No by default: its own profile at `~/.cache/chrome-devtools-mcp/chrome-profile`. Yes with `--autoConnect` [2] | Yes. A Web Store extension in the running browser |
 | Reaches tabs that were already open | Yes, every tab in every window of every Chrome profile the extension is loaded in [3] | No by default (fresh browser, so those tabs do not exist in it). Yes with `--extension` [4] | No by default. With `--autoConnect`, all windows of one profile [2] | One tab at a time, picked by the human in the popup. No tab listing and no tab creation tool [5] |
@@ -74,7 +74,7 @@ The cells describe the verified versions and their defaults. Flags that change a
 | Runs with your existing cookies and logged-in session | Yes | No by default. Yes with `--extension` [12] | Only with `--autoConnect` [13] | Yes |
 | Marks the tabs it touches | Yes. Any tab it drives or reads joins a visible tab group named "yoke" [14] | No in-tab marker. A separate headed window on its own profile, with automation signals actively suppressed [15] | Nothing added by the server. Chrome's own affordances only, and on `--autoConnect` that is a one-time consent dialog rather than an ongoing marker [16] | Chrome's own debugger infobar, incidental rather than designed, and suppressible [17] |
 | URL redaction on by default | Yes. URL fields are cut to origin plus path; opt out with `full_urls` on `list_tabs` [18] | No. The only mechanism is opt-in substitution of known secret values (`--secrets`) | No, at no setting. Header redaction exists, covers headers only, and is off by default | No. The full page URL is in every snapshot header |
-| Declared runtime dependencies, and install footprint | 0 declared, Node builtins only. The published 0.1.6 tarball is 47 files, all first-party | 2 declared, both pinned to a 1.63.0 alpha. 19 MB installed. No browser download on the default `chrome` channel | 0 declared, and roughly 14 MB of vendored bundle (puppeteer 25.5.0, lighthouse 13.4.0) [19] | 5 declared, 97 transitive as resolved on 2026-08-24, and rising with no new release [20] |
+| Declared runtime dependencies, and install footprint | 0 declared, Node builtins only. The published 0.1.7 tarball is 47 files, all first-party | 2 declared, both pinned to a 1.63.0 alpha. 19 MB installed. No browser download on the default `chrome` channel | 0 declared, and roughly 14 MB of vendored bundle (puppeteer 25.5.0, lighthouse 13.4.0) [19] | 5 declared, 97 transitive as resolved on 2026-08-24, and rising with no new release [20] |
 
 #### Notes, including every place a flag or a version changes the answer
 
@@ -295,7 +295,7 @@ From a checkout that has not been linked, replace `yoke` with `node dist/cli.js`
 5. Element references expire after navigation or a page render. Console and network history starts when yoke first attaches to that tab, not before.
 6. Screenshots capture the page viewport, not browser chrome such as the address bar or tab strip.
 7. Two different browsers that both run the extension, such as Chrome and Brave, number their tabs independently. A tab id both report is refused rather than routed, because it cannot be sent to both. Two profiles of the same Chrome never collide.
-8. Chrome's internal pages cannot be read or driven. Neither can the Chrome Web Store or the extensions gallery: Chrome refuses both `chrome.scripting` and `chrome.debugger` there, so no extension can automate them, including this one. Publishing an extension is therefore a manual job by design.
+8. Chrome's internal pages cannot be read or driven. Neither can the Chrome Web Store or the extensions gallery: Chrome refuses both `chrome.scripting` and `chrome.debugger` there, so no extension can automate them, including this one. Editing the store listing is therefore manual. Releases reach the store through its API from CI, as described in `docs/store-listing.md`.
 
 ## Uninstall
 

package/ROADMAP.md

@@ -40,6 +40,7 @@ Theme: prove the thesis. Built, working end to end, not yet tagged or published.
 - An icon, at 16, 32, 48 and 128, drawn on an 8 unit grid so every line lands on a pixel boundary at 16.
 - Offline tests for the MCP surface and the redaction, driven without a browser. CI green on Node 22 and 24 across Linux, macOS and Windows.
 - 0.1.4: one endpoint per Chrome profile, named after an id the extension mints and keeps. `list_browsers` names each connected profile, `list_tabs` covers all of them, tab tools route by tab id, and `open_tab` takes `browser` when there is a choice. Closes the wrong-profile case in #6 and #8, where a single per-user endpoint was won by whichever profile connected first.
+- 0.1.7: store releases come from CI. Every `v*` tag uploads the zip CI built to the Chrome Web Store and submits it for review once a person approves the `chrome-web-store` environment, through [publish-to-chrome-web-store](https://github.com/hamzahamidi/publish-to-chrome-web-store) with a 30 minute Workload Identity token, so the repository still holds no long-lived secret. Nothing in the extension or the host changed.
 - 0.1.6: an endpoint is held only by a host that can serve it. Chrome can leave a host holding a pipe whose service worker is gone, and 0.1.5 let that host claim a socket which then accepted every caller and answered each one with a timeout, counted as a browser with no tabs, and kept the endpoint from the profile that could have served it (#19). A host now claims nothing unless the extension answers, gives the endpoint up when the extension stops answering, and waits for an incumbent to let go rather than unlinking a name a live server still holds.
 - 0.1.5: a profile that loses the host comes back. Chrome stops an idle service worker, which takes the scheduled retry with it, so 0.1.4 could sit disconnected until somebody clicked the icon (#12). Browsing now wakes it, the backoff doubles as it always claimed to rather than staying at two seconds, and the message says to click the icon before it says to reinstall. Recovery on a browser nobody is touching is still open, in #15.
 
@@ -89,7 +90,7 @@ Theme: installable by someone who is not us. Done, inside the 0.1.x line rather
 - On the Chrome Web Store as [Yoke](https://chromewebstore.google.com/detail/yoke/mebojgahcmmffbaonhnmmjhmbdbfbamm), with the privacy policy and the permission justifications `debugger` and host access had to defend. Review keeps its own clock, so the listing sits behind a release until it clears.
 - The store does not honour the pinned `key`, which was the bullet that said verify, and the answer was no. A packaged upload may not carry one, so the store mints an id of its own: a store install is `mebojgahcmmffbaonhnmmjhmbdbfbamm` and an unpacked load stays `oceljemfocgfidhhdlbojkbkmlbfclna`. `yoke install` allowlists both, which is the only reason native messaging works either way.
 - `yoke-mcp` is on npm. 0.1.0 went out by hand, because npm will not configure a trusted publisher for a package that does not exist yet. Every version since publishes from a `v*` tag over OIDC with provenance, and a person approves the `npm` environment before anything reaches the registry.
-- The store package is built by CI from the tag and attached to the release with its SHA-256, so the zip a human uploads is the one CI built and checked. Contents are reproducible: rebuilding 0.1.5 locally gives files byte identical to the release zip. The archive is not, because zip metadata differs, so an audit compares files rather than digests.
+- The store package is built by CI from the tag and attached to the release with its SHA-256, so the zip that reaches the store is the one CI built and checked. Contents are reproducible: rebuilding 0.1.5 locally gives files byte identical to the release zip. The archive is not, because zip metadata differs, so an audit compares files rather than digests.
 
 ## v0.5.x: stabilisation
 

package/dist/mcp-server.d.ts

@@ -1,5 +1,5 @@
 export declare const SERVER_NAME = "yoke";
-export declare const SERVER_VERSION = "0.1.6";
+export declare const SERVER_VERSION = "0.1.7";
 export declare const PROTOCOL_VERSION = "2024-11-05";
 /**
  * The label on the group holding tabs yoke opened.

package/dist/mcp-server.js

@@ -14,7 +14,7 @@ import { createInterface } from 'node:readline';
 import { allTabs, askTab, chooseBrowser, displayName, endpointForTabs, unplace, NoSuchBrowser, NoSuchTab, } from './browsers.js';
 import { ask, ExtensionUnavailable, NOT_CONNECTED } from './socket-client.js';
 export const SERVER_NAME = 'yoke';
-export const SERVER_VERSION = '0.1.6';
+export const SERVER_VERSION = '0.1.7';
 export const PROTOCOL_VERSION = '2024-11-05';
 /**
  * The label on the group holding tabs yoke opened.

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Yoke",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Let MCP clients drive your signed in Chrome by tab id: tabs, page text, trusted input, screenshots, console, network.",
   "icons": {
     "16": "icons/16.png",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yoke-mcp",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "MCP server for the Chrome you are already signed in to. Every tab in every window, addressed by tab id, with no second profile and no browser-wide debugging port.",
   "bin": {
     "yoke": "dist/cli.js"