Merge origin/main into screencast fps branch

Author: mturac

README.md

@@ -759,6 +759,11 @@ The Chrome DevTools MCP server supports the following configuration option:
   - **Type:** boolean
   - **Default:** `false`
 
+- **`--allowUnrestrictedPaths`/ `--allow-unrestricted-paths`**
+  If set, disables the default path restriction that applies when the MCP client does not negotiate the roots capability. By default, file-writing tools are restricted to the OS temp directory when no roots are configured. Use this only when connecting a trusted local client that does not implement MCP roots and requires access to paths outside the temp directory.
+  - **Type:** boolean
+  - **Default:** `false`
+
 <!-- END AUTO GENERATED OPTIONS -->
 
 Pass them via the `args` property in the JSON configuration. For example:

package-lock.json

@@ -44,10 +44,9 @@ export class HeapSnapshotManager {
     {
       snapshot: DevTools.HeapSnapshotModel.HeapSnapshotProxy.HeapSnapshotProxy;
       worker: DevTools.HeapSnapshotModel.HeapSnapshotProxy.HeapSnapshotWorkerProxy;
-      // TODO: use a multimap
-      idToClassKey: Map<number, string>;
+      // 1-indexed array where index is the class ID.
+      idToClassKey: string[];
       classKeyToId: Map<string, number>;
-      idGenerator: () => number;
     }
   >();
 
@@ -65,9 +64,8 @@ export class HeapSnapshotManager {
     this.#snapshots.set(absolutePath, {
       snapshot,
       worker,
-      idToClassKey: new Map<number, string>(),
+      idToClassKey: [''],
       classKeyToId: new Map<string, number>(),
-      idGenerator: createIdGenerator(),
     });
 
     return snapshot;
@@ -114,9 +112,9 @@ export class HeapSnapshotManager {
     const cached = this.#getCachedSnapshot(filePath);
     let id = cached.classKeyToId.get(classKey);
     if (!id) {
-      id = cached.idGenerator();
+      id = cached.idToClassKey.length;
       cached.classKeyToId.set(classKey, id);
-      cached.idToClassKey.set(id, classKey);
+      cached.idToClassKey.push(classKey);
     }
     return id;
   }
@@ -287,7 +285,7 @@ export class HeapSnapshotManager {
     id: number,
   ): Promise<string | undefined> {
     const cached = this.#getCachedSnapshot(filePath);
-    return cached.idToClassKey.get(id);
+    return cached.idToClassKey[id];
   }
 
   async #loadSnapshot(

src/HeapSnapshotManager.ts

@@ -69,6 +69,10 @@ interface McpContextOptions {
   allowList?: string[];
   // The block list of URL patterns to block loading resources.
   blocklist?: string[];
+  // Whether to skip path validation when the client did not negotiate the roots
+  // capability. When false (default), file-writing tools are restricted to the
+  // OS temp directory. When true, the previous permissive behavior is restored.
+  allowUnrestrictedPaths?: boolean;
 }
 
 const DEFAULT_TIMEOUT = 5_000;
@@ -110,6 +114,7 @@ export class McpContext implements Context {
   #options: McpContextOptions;
   #heapSnapshotManager = new HeapSnapshotManager();
   #roots: Root[] | undefined = undefined;
+  #allowUnrestrictedPaths: boolean;
 
   private constructor(
     browser: Browser,
@@ -127,6 +132,7 @@ export class McpContext implements Context {
     this.logger = logger;
     this.#locatorClass = locatorClass;
     this.#options = options;
+    this.#allowUnrestrictedPaths = options.allowUnrestrictedPaths ?? false;
 
     this.#networkCollector = new NetworkCollector(this.browser);
 
@@ -185,12 +191,9 @@ export class McpContext implements Context {
     return context;
   }
 
-  roots(): Root[] | undefined {
-    if (this.#roots === undefined) {
-      return undefined;
-    }
+  roots(): Root[] {
     return [
-      ...this.#roots,
+      ...(this.#roots ?? []),
       {
         uri: pathToFileURL(os.tmpdir()).href,
         name: 'temp',
@@ -206,10 +209,17 @@ export class McpContext implements Context {
     if (filePath === undefined) {
       return;
     }
-    const roots = this.roots();
-    if (roots === undefined) {
+    // If the client never negotiated roots and the operator has explicitly
+    // opted into unrestricted access via --allow-unrestricted-paths, restore
+    // the previous permissive behavior and skip validation.
+    if (this.#roots === undefined && this.#allowUnrestrictedPaths) {
       return;
     }
+    // roots() always returns at least the temp directory, even if the
+    // connecting client never negotiated the optional `roots` capability.
+    // Path validation must not be skipped just because no workspace roots
+    // were configured.
+    const roots = this.roots();
 
     let canonicalPath: string;
 

src/McpContext.ts

@@ -378,6 +378,15 @@ export const cliOptions = {
       'If true, redacts some of the network headers considered sensitive before returning to the client.',
     default: false,
   },
+  allowUnrestrictedPaths: {
+    type: 'boolean',
+    default: false,
+    describe:
+      'If set, disables the default path restriction that applies when the MCP client does not negotiate ' +
+      'the roots capability. By default, file-writing tools are restricted to the OS temp directory when ' +
+      'no roots are configured. Use this only when connecting a trusted local client that does not implement ' +
+      'MCP roots and requires access to paths outside the temp directory.',
+  },
 } satisfies Record<string, YargsOptions>;
 
 export type ParsedArguments = ReturnType<typeof parseArguments>;

src/bin/chrome-devtools-mcp-cli-options.ts

@@ -86,6 +86,13 @@ export async function createMcpServer(
           void updateRoots();
         },
       );
+    } else if (!serverArgs.allowUnrestrictedPaths) {
+      console.warn(
+        '[chrome-devtools-mcp] The connecting client did not negotiate the MCP roots ' +
+          'capability. File-writing tools will be restricted to the OS temp directory. ' +
+          'To restore the previous unrestricted behavior, start the server with ' +
+          '--allow-unrestricted-paths.',
+      );
     }
   };
 
@@ -146,6 +153,7 @@ export async function createMcpServer(
         performanceCrux: serverArgs.performanceCrux,
         allowList: allowlist,
         blocklist: blocklist,
+        allowUnrestrictedPaths: serverArgs.allowUnrestrictedPaths,
       });
       await updateRoots();
     }

src/index.ts

@@ -362,6 +362,16 @@
       "EXPERIMENTAL_DATA_FORMAT_GCF"
     ]
   },
+  {
+    "name": "allow_unrestricted_paths_present",
+    "flagType": "boolean",
+    "isDeprecated": true
+  },
+  {
+    "name": "allow_unrestricted_paths",
+    "flagType": "boolean",
+    "isDeprecated": true
+  },
   {
     "name": "experimental_screencast_fps_present",
     "flagType": "boolean"

src/telemetry/flag_usage_metrics.json

@@ -248,17 +248,20 @@ describe('McpContext', () => {
       sinon.stub(context, 'getNetworkRequestById').returns(mockRequest);
       sinon.stub(context, 'getNetworkRequestStableId').returns(789);
 
+      // Use os.tmpdir() so validatePath passes on all platforms (macOS tmpdir
+      // is /var/folders/..., not /tmp, so hardcoded /tmp paths are rejected).
+      const reqFilePath = path.join(os.tmpdir(), 'req.txt');
+      const resFilePath = path.join(os.tmpdir(), 'res.txt');
+
       // We stub NetworkFormatter.from to avoid actual file system writes and verify arguments
       const fromStub = sinon
         .stub(NetworkFormatter, 'from')
         .callsFake(async (_req, opts) => {
-          // Verify we received the file paths
-          assert.strictEqual(opts?.requestFilePath, '/tmp/req.txt');
-          assert.strictEqual(opts?.responseFilePath, '/tmp/res.txt');
-          // Return a dummy formatter that behaves as if it saved files
-          // We need to create a real instance or mock one.
-          // Since constructor is private, we can't easily new it up.
-          // But we can return a mock object.
+          // Verify we received the platform-correct file paths
+          assert.strictEqual(opts?.requestFilePath, reqFilePath);
+          assert.strictEqual(opts?.responseFilePath, resFilePath);
+          // Return fixed strings in toJSONDetailed so the snapshot is stable
+          // across platforms (os.tmpdir() differs on macOS vs Linux/Windows).
           return {
             toStringDetailed: () => 'Detailed string',
             toJSONDetailed: () => ({
@@ -269,8 +272,8 @@ describe('McpContext', () => {
         });
 
       response.attachNetworkRequest(789, {
-        requestFilePath: '/tmp/req.txt',
-        responseFilePath: '/tmp/res.txt',
+        requestFilePath: reqFilePath,
+        responseFilePath: resFilePath,
       });
       const result = await response.handle('test', context);
 
@@ -340,10 +343,23 @@ describe('McpContext', () => {
     });
   });
 
-  it('validatePath allows all paths if roots are undefined (legacy)', async () => {
+  it('validatePath allows all paths if roots are undefined and allowUnrestrictedPaths is set', async () => {
+    await withMcpContext(
+      async (_response, context) => {
+        context.setRoots(undefined);
+        await context.validatePath(path.resolve(os.homedir(), 'anywhere.txt'));
+      },
+      {allowUnrestrictedPaths: true},
+    );
+  });
+
+  it('validatePath denies paths outside tmpdir if roots are undefined and allowUnrestrictedPaths is not set', async () => {
     await withMcpContext(async (_response, context) => {
-      context.setRoots(undefined);
-      await context.validatePath(path.resolve(os.homedir(), 'anywhere.txt'));
+      // setRoots() never called — simulates a client that skips roots capability.
+      const outsidePath = path.resolve(os.homedir(), 'anywhere.txt');
+      await assert.rejects(context.validatePath(outsidePath), /Access denied/);
+      // Temp dir must still be reachable.
+      await context.validatePath(path.join(os.tmpdir(), 'test.txt'));
     });
   });
 

tests/McpContext.test.ts

@@ -32,6 +32,8 @@ describe('cli args parsing', () => {
     usageStatistics: true,
     'redact-network-headers': false,
     redactNetworkHeaders: false,
+    'allow-unrestricted-paths': false,
+    allowUnrestrictedPaths: false,
   };
 
   it('parses with default args', async () => {