Update URL Restrictions section to explicitly state that URLs must
include http:// or https:// scheme. Scheme-less URLs are rejected.
Addresses Copilot review comment at line 12.
- Add module reload mechanism for env var changes
- Update test_malformed_url with proper assertion
- Add tests for scheme-less URLs, uppercase schemes, hostname requirement
- Add test for fdn.example.com (IPv6 ULA pattern fix verification)
- Make all env var dependent tests use monkeypatch
Addresses Copilot review comments:
- Line 117: Added assertion to test_malformed_url
- Line 170: Made tests deterministic with monkeypatch
Instead of returning an error dict, raise ValueError so that
the CLI's @handle_error decorator can handle it consistently.
This ensures error messages are properly formatted in both
normal and JSON output modes, and prevents success messages
from being printed for invalid URLs.
Addresses Copilot review comment at line 30.
Document security considerations for AI agents using browser CLI.
Add section covering:
- URL restrictions (blocked schemes, private network blocking)
- DOM content risks (ARIA label manipulation, hidden elements)
- Environment variables for security configuration
- Session isolation recommendations
Agents reading SKILL.md will be aware of security boundaries
and mitigations when interacting with untrusted websites.
Modify open_page() to validate URLs before navigation via DOMShell.
Calls validate_url() from security.py to block dangerous schemes
and optionally restrict private network access. Returns error dict
if validation fails instead of passing dangerous URLs to browser.
This prevents SSRF attacks via file://, javascript://, and other
dangerous URI schemes.
- Build server args at call time so DOMSHELL_TOKEN/DOMSHELL_PORT env
var changes are honored after import; raise clear error if token unset
- Implement cd+grep+cd pattern in grep_elements() so the path parameter
correctly roots the search at the requested subtree
- Update grep_elements_with_path test to verify cd+grep+cd behavior
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Switch from `domshell` to `domshell-proxy` (stdio bridge) to match
how MCP clients like Claude Desktop integrate with DOMShell
- Add DOMSHELL_TOKEN / DOMSHELL_PORT env var support for auth
- Fix MCP tool parameter names: ls (options), cat (name), click (name)
- Remove unsupported path param from grep
- Fix type_text to focus (domshell_focus) then type in single MCP session
- Add --allow-write --no-confirm flags for write commands
Fixes issues reported in PR #118.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The DOMShell error message said "Install with" but npx doesn't actually
install packages, it runs them. Clarified the message. Also added a
known limitation comment about daemon mode using asyncio.run() per call,
which creates new event loops - to be addressed in a future PR.
Tests were patching backend.open_url but the code now calls
backend.back() and backend.forward() directly. Updated mocks
to patch the correct functions.
test_daemon_start_with_json had a silent JSONDecodeError pass that
would hide regressions. test_invalid_path_gives_error ended with
assert True which doesn't verify any actual behavior.
The change_directory function was updating session.working_dir even
when the backend returned an error. This could leave the session in an
invalid directory state and break subsequent relative-path operations.
The act type command was echoing the full text value in non-JSON mode,
which could leak passwords or PII into terminal scrollback and logs.
Now only outputs the target path without the typed text.
Update documentation to clarify that daemon mode works within a single
process (REPL or --daemon flag) and that state does not persist across
separate CLI invocations.
Avoid invoking npx during test collection by requiring DOMSHELL_E2E=1
environment variable. This prevents unwanted side effects when running
pytest in environments without DOMShell.
Store the stdio_client context manager to ensure proper cleanup
when stopping daemon mode. Previously, __aexit__ was called on a new
instance, causing subprocess leaks.
Instead of reconstructing navigation via open_url(), directly use the
DOMShell MCP tools for back/forward navigation. This ensures
proper browser history tracking.
yuhao