7f70779f1c
Home page splits into two self-contained panels so the left-column links no longer scale with the Silent Mode cards. The slot grid is narrower, the icons default closer to Windows desktop-shortcut size, and each section carries its own subtle panel background and heading. Claude connector hardening (the opt-in MCP add-on from 0.3.106): - Pin the approved origin to the TabDriver on every Controller.use() and re-check the tab's current URL before each CDP read / input (isolated, snapshot, screenshot, clickAt, insertText, press, setFiles, evaluate). A meta-refresh or soft-nav to an unapproved origin between approval and the call now throws instead of leaking content or steering input to the new site. - Rotate the bearer token on every stop() so toggling the connector off (toolbar chip, panel switch, deactivate) invalidates existing credentials. Re-enabling issues a fresh token; the panel's install strings update on the next start. Matches the mental model where "off" means "the keys change" instead of "the server stops". - click without a ref now resolves the element at (x, y) through DOM.getNodeForLocation and refuses if it's a password / one-time- code field. Previously only ref-based click ran isSecretField; raw coordinates let focus land on a password field before FOCUS_GUARD kicked in to block typing. |
||
|---|---|---|
| .. | ||
| lib | ||
| addon.json | ||
| index.js | ||
| panel.html | ||
| README.md | ||
| stdio-shim.cjs | ||
Claude connector
Built-in Theseus extension: a local MCP server through which Claude Code or Claude Desktop works in the user's tabs. Setup and safety model are in the Theseus README ("Claude connector (MCP)") and DESIGN-claude-connector.md.
| file | role |
|---|---|
index.js |
activation, settings (add-on store), server start/stop, panel messages |
lib/mcp-server.cjs |
Streamable HTTP + JSON-RPC, token, Host/Origin guards, sessions, SSE presence |
lib/tools.cjs |
tool definitions and handlers; resolves tabs through api.tabControl |
lib/tab-driver.cjs |
one tab over its own webContents.debugger (CDP 1.3) |
lib/policy.cjs |
site approvals, upload-folder checks, password-field detection |
lib/clipboard.cjs |
put / save / restore the system clipboard around a paste |
lib/action-log.cjs |
timestamped action log (panel + actions.log) |
panel.html |
the sidebar panel |
stdio-shim.cjs |
stdio ⇄ HTTP relay for Claude Desktop, run by Theseus in Node mode |
Stored in <userData>/extensions-data/claude-connector.json (token, port,
switches, approved origins, upload folders) and
<userData>/extensions-data/claude-connector/ (endpoint.json while
listening, actions.log).
Needs the host's tab-control capability, which only built-in add-ons get.
Turning any extension on or off restarts every add-on, this one included,
which ends the connected clients' sessions. A client that does not start a
new session by itself reconnects from its MCP menu (/mcp in Claude Code).