Merge branch 'main' into feat/webperf-core-web-vitals-skill

Author: nucliweb

package.json

@@ -16,7 +16,7 @@
     "typecheck": "tsc --noEmit",
     "format": "eslint --cache --fix . && prettier --write --cache .",
     "check-format": "eslint --cache . && prettier --check --cache .;",
-    "gen": "npm run build && npm run docs:generate && npm run cli:generate && npm run update-tool-call-metrics && npm run update-flag-usage-metrics && npm run format",
+    "gen": "npm run build && npm run docs:generate && npm run cli:generate && npm run update-metrics && npm run format",
     "docs:generate": "node --experimental-strip-types scripts/generate-docs.ts",
     "start": "npm run build && node build/src/index.js",
     "start-debug": "DEBUG=mcp:* DEBUG_COLORS=false npm run build && node build/src/index.js",
@@ -27,8 +27,7 @@
     "prepare": "node --experimental-strip-types scripts/prepare.ts",
     "verify-server-json-version": "node --experimental-strip-types scripts/verify-server-json-version.ts",
     "update-lighthouse": "node --experimental-strip-types scripts/update-lighthouse.ts",
-    "update-tool-call-metrics": "node --experimental-strip-types scripts/update_tool_call_metrics.ts",
-    "update-flag-usage-metrics": "node --experimental-strip-types scripts/update_flag_usage_metrics.ts",
+    "update-metrics": "node --experimental-strip-types scripts/update_metrics.ts",
     "verify-npm-package": "node scripts/verify-npm-package.mjs",
     "eval": "npm run build && node --experimental-strip-types scripts/eval_gemini.ts",
     "count-tokens": "node --experimental-strip-types scripts/count_tokens.ts"

scripts/eval_scenarios/fill_select_and_checkboxes_test.ts

@@ -0,0 +1,67 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.ts';
+
+export const scenario: TestScenario = {
+  prompt:
+    'Go to <TEST_URL>, fill the form with size = 2 CPUs and components = [docker, nginx].',
+  maxTurns: 3,
+  htmlRoute: {
+    path: '/input_test.html',
+    htmlContent: `
+      <form action="/post" method="POST">
+        <div>
+          <label for="size">CPU/Memory size:</label>
+          <select id="size" name="size" required>
+            <option value="small">1 vCPU, 2GB RAM</option>
+            <option value="medium">2 vCPU, 4GB RAM</option>
+            <option value="large">4 vCPU, 8GB RAM</option>
+          </select>
+        </div>
+        <br>
+        <div>
+          <p>Pre-installed components:</p>
+          <input type="checkbox" id="docker" name="components" value="docker">
+          <label for="docker">Docker</label><br>
+          <input type="checkbox" id="nodejs" name="components" value="nodejs">
+          <label for="nodejs">Node.js</label><br>
+          <input type="checkbox" id="python" name="components" value="python">
+          <label for="python">Python</label><br>
+          <input type="checkbox" id="nginx" name="components" value="nginx">
+          <label for="nginx">Nginx</label>
+        </div>
+        <button type="submit">Spawn Server</button>
+      </form>
+    `,
+  },
+  expectations: calls => {
+    assert.strictEqual(calls.length, 3);
+    assert.ok(
+      calls[0].name === 'navigate_page' || calls[0].name === 'new_page',
+    );
+    assert.strictEqual(calls[1].name, 'take_snapshot');
+    assert.strictEqual(calls[2].name, 'fill_form');
+
+    const elements = calls[2].args.elements as Array<{
+      uid: string;
+      value: string;
+    }>;
+    assert.strictEqual(elements.length, 3);
+
+    const uids = new Set(elements.map(e => e.uid));
+    assert.strictEqual(
+      uids.size,
+      3,
+      'fill_form should target three distinct elements',
+    );
+
+    const values = elements.map(e => e.value).sort();
+    assert.deepStrictEqual(values, ['2 vCPU, 4GB RAM', 'true', 'true']);
+  },
+};

scripts/generate-cli.ts

@@ -16,7 +16,7 @@ import {createTools} from '../build/src/tools/tools.js';
 
 const OUTPUT_PATH = path.join(
   import.meta.dirname,
-  '../src/bin/cliDefinitions.ts',
+  '../src/bin/chrome-devtools-cli-options.ts',
 );
 
 async function fetchTools() {

scripts/update_flag_usage_metrics.ts

@@ -7,16 +7,23 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import type {ParsedArguments} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
 import {
+  cliOptions,
+  parseArguments,
+} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
+import {
+  getPossibleFlagMetrics,
+  type FlagMetric,
+} from '../build/src/telemetry/flagUtils.js';
+import {
+  applyToExisting,
   applyToExistingMetrics,
   generateToolMetrics,
   type ToolMetric,
 } from '../build/src/telemetry/toolMetricsUtils.js';
-import type {ToolDefinition} from '../build/src/tools/ToolDefinition.js';
 import {createTools} from '../build/src/tools/tools.js';
 
-export function HaveUniqueNames(tools: ToolDefinition[]): boolean {
+export function HaveUniqueNames(tools: Array<{name: string}>): boolean {
   const toolNames = tools.map(tool => tool.name);
   const toolNamesSet = new Set(toolNames);
   return toolNamesSet.size === toolNames.length;
@@ -30,8 +37,9 @@ function writeToolCallMetricsConfig() {
     throw new Error(`Error: Directory ${dir} does not exist.`);
   }
 
-  const fullTools = createTools({slim: false} as ParsedArguments);
-  const slimTools = createTools({slim: true} as ParsedArguments);
+  // Avoid 'as ParsedArguments' by using parseArguments
+  const fullTools = createTools(parseArguments('0.0.0', ['', '']));
+  const slimTools = createTools(parseArguments('0.0.0', ['', '', '--slim']));
 
   const allTools = [...fullTools, ...slimTools];
 
@@ -62,4 +70,43 @@ function writeToolCallMetricsConfig() {
   );
 }
 
-writeToolCallMetricsConfig();
+function writeFlagUsageMetrics() {
+  const outputPath = path.resolve('src/telemetry/flag_usage_metrics.json');
+
+  const dir = path.dirname(outputPath);
+  if (!fs.existsSync(dir)) {
+    throw new Error(`Error: Directory ${dir} does not exist.`);
+  }
+
+  let existingMetrics: FlagMetric[] = [];
+  if (fs.existsSync(outputPath)) {
+    try {
+      existingMetrics = JSON.parse(
+        fs.readFileSync(outputPath, 'utf8'),
+      ) as FlagMetric[];
+    } catch {
+      console.warn(
+        `Warning: Failed to parse existing metrics from ${outputPath}. Starting fresh.`,
+      );
+    }
+  }
+
+  const newMetrics = getPossibleFlagMetrics(cliOptions);
+  const mergedMetrics = applyToExisting<FlagMetric>(
+    existingMetrics,
+    newMetrics,
+  );
+
+  fs.writeFileSync(outputPath, JSON.stringify(mergedMetrics, null, 2) + '\n');
+
+  console.log(
+    `Successfully wrote ${mergedMetrics.length} flag usage metrics to ${outputPath}`,
+  );
+}
+
+function main() {
+  writeToolCallMetricsConfig();
+  writeFlagUsageMetrics();
+}
+
+main();

scripts/update_tool_call_metrics.ts scripts/update_metrics.tsscripts/update_tool_call_metrics.ts renamed to scripts/update_metrics.ts

@@ -6,6 +6,7 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import {fileURLToPath} from 'node:url';
 
 import type {TargetUniverse} from './DevtoolsUtils.js';
 import {UniverseManager} from './DevtoolsUtils.js';
@@ -18,21 +19,22 @@ import {
   type ListenerMap,
   type UncaughtError,
 } from './PageCollector.js';
-import type {
-  Browser,
-  BrowserContext,
-  ConsoleMessage,
-  Debugger,
-  HTTPRequest,
-  Page,
-  ScreenRecorder,
-  Viewport,
-  Target,
-  Extension,
+import {
+  Locator,
+  PredefinedNetworkConditions,
+  type Browser,
+  type BrowserContext,
+  type ConsoleMessage,
+  type Debugger,
+  type HTTPRequest,
+  type Page,
+  type ScreenRecorder,
+  type Viewport,
+  type Target,
+  type Extension,
+  type Root,
+  type DevTools,
 } from './third_party/index.js';
-import type {DevTools} from './third_party/index.js';
-import {Locator} from './third_party/index.js';
-import {PredefinedNetworkConditions} from './third_party/index.js';
 import {listPages} from './tools/pages.js';
 import {CLOSE_PAGE_ERROR} from './tools/ToolDefinition.js';
 import type {Context, SupportedExtensions} from './tools/ToolDefinition.js';
@@ -42,7 +44,7 @@ import type {
   GeolocationOptions,
   ExtensionServiceWorker,
 } from './types.js';
-import {ensureExtension, saveTemporaryFile} from './utils/files.js';
+import {ensureExtension, getTempFilePath} from './utils/files.js';
 import {getNetworkMultiplierFromString} from './WaitForHelper.js';
 
 interface McpContextOptions {
@@ -90,6 +92,7 @@ export class McpContext implements Context {
   #locatorClass: typeof Locator;
   #options: McpContextOptions;
   #heapSnapshotManager = new HeapSnapshotManager();
+  #roots: Root[] | undefined = undefined;
 
   private constructor(
     browser: Browser,
@@ -154,6 +157,37 @@ export class McpContext implements Context {
     return context;
   }
 
+  roots(): Root[] | undefined {
+    return this.#roots;
+  }
+
+  setRoots(roots: Root[] | undefined): void {
+    this.#roots = roots;
+  }
+
+  validatePath(filePath?: string): void {
+    if (filePath === undefined) {
+      return;
+    }
+    const roots = this.roots();
+    if (roots === undefined) {
+      return;
+    }
+    const absolutePath = path.resolve(filePath);
+    for (const root of roots) {
+      const rootPath = path.resolve(fileURLToPath(root.uri));
+      if (
+        absolutePath === rootPath ||
+        absolutePath.startsWith(rootPath + path.sep)
+      ) {
+        return;
+      }
+    }
+    throw new Error(
+      `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`,
+    );
+  }
+
   resolveCdpRequestId(page: McpPage, cdpRequestId: string): number | undefined {
     if (!cdpRequestId) {
       this.logger('no network request');
@@ -643,13 +677,22 @@ export class McpContext implements Context {
     data: Uint8Array<ArrayBufferLike>,
     filename: string,
   ): Promise<{filepath: string}> {
-    return await saveTemporaryFile(data, filename);
+    const filepath = await getTempFilePath(filename);
+    this.validatePath(filepath);
+    try {
+      await fs.writeFile(filepath, data);
+    } catch (err) {
+      throw new Error('Could not save a file', {cause: err});
+    }
+    return {filepath};
   }
+
   async saveFile(
     data: Uint8Array<ArrayBufferLike>,
     clientProvidedFilePath: string,
     extension: SupportedExtensions,
   ): Promise<{filename: string}> {
+    this.validatePath(clientProvidedFilePath);
     try {
       const filePath = ensureExtension(
         path.resolve(clientProvidedFilePath),
@@ -721,6 +764,7 @@ export class McpContext implements Context {
   }
 
   async installExtension(extensionPath: string): Promise<string> {
+    this.validatePath(extensionPath);
     const id = await this.browser.installExtension(extensionPath);
     return id;
   }
@@ -751,25 +795,29 @@ export class McpContext implements Context {
   async getHeapSnapshotAggregates(
     filePath: string,
   ): Promise<Record<string, AggregatedInfoWithUid>> {
+    this.validatePath(filePath);
     return await this.#heapSnapshotManager.getAggregates(filePath);
   }
 
   async getHeapSnapshotStats(
     filePath: string,
   ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.Statistics> {
+    this.validatePath(filePath);
     return await this.#heapSnapshotManager.getStats(filePath);
   }
 
   async getHeapSnapshotStaticData(
     filePath: string,
   ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.StaticData | null> {
+    this.validatePath(filePath);
     return await this.#heapSnapshotManager.getStaticData(filePath);
   }
 
   async getHeapSnapshotNodesByUid(
     filePath: string,
     uid: number,
   ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.ItemsRange> {
+    this.validatePath(filePath);
     return await this.#heapSnapshotManager.getNodesByUid(filePath, uid);
   }
 }