You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix incorrect MCP tool name prefix, replace misused wait_for with
evaluate_script setTimeout, correct list_network_requests filtering to
use resourceTypes, resolve path derivation contradiction with consistent
/js-assets/{prefix}/{stem}.js formula, pin slug separator and base62
charset, add URL Processing section with normalization rules and
first-party boundary definition, tighten wildcard regex to require mixed
character classes, and move skill location to .claude/commands/.
2. Open Chrome via `mcp__chrome-devtools__new_page`, navigate to target URL via `mcp__chrome-devtools__navigate_page`
34
-
3. Wait for full page load + ~6s settle window for async script loads (`mcp__chrome-devtools__wait_for`)
34
+
2. Open Chrome via `mcp__plugin_chrome-devtools-mcp_chrome-devtools__new_page`, navigate to target URL via `mcp__plugin_chrome-devtools-mcp_chrome-devtools__navigate_page`
35
+
3. Wait for page load settle: `mcp__plugin_chrome-devtools-mcp_chrome-devtools__evaluate_script` with `await new Promise(r => setTimeout(r, SETTLE_MS))` where `SETTLE_MS` defaults to 6000 (configurable via `--settle <ms>`)
35
36
4. In parallel:
36
-
-`mcp__chrome-devtools__list_network_requests`→ filter for requests where URL ends in `.js` or `Content-Type: application/javascript`, and origin ≠ `publisher.domain`
5. Apply URL normalization (see below), then heuristic filter (see below)
39
40
6. For each surviving asset, generate a `[[js_assets]]` entry (see below)
40
41
7. Write output (init or diff mode)
41
42
8. Print terminal summary
42
-
9. Close page via `mcp__chrome-devtools__close_page`
43
+
9. Close page via `mcp__plugin_chrome-devtools-mcp_chrome-devtools__close_page`
44
+
45
+
**`inject_in_head` semantics:** The DOM snapshot in step 4 captures the final state of `<head>` after the settle window. Scripts that were briefly inserted and then removed by a loader will not appear. This is intentional — `inject_in_head = true` means "the script is present in `<head>` at page-stable state." If a loader removes it before the snapshot, the proxy should not re-inject it.
46
+
47
+
---
48
+
49
+
## URL Processing
50
+
51
+
### First-party boundary
52
+
53
+
A network request is **first-party** if the request URL's host, after stripping a leading `www.`, matches `publisher.domain` (from `trusted-server.toml`) after the same stripping. Matching is exact on the resulting strings.
54
+
55
+
Publisher-owned CDN subdomains (e.g., `cdn.publisher.com`, `static.publisher.com`) are treated as third-party by default. If the publisher wants to exclude them, they can be added to a `first_party_hosts` list in the command invocation (e.g., `--first-party cdn.publisher.com`).
56
+
57
+
### URL normalization
58
+
59
+
Applied to every captured script URL before slug generation and before persisting `origin_url`:
60
+
61
+
1. Strip fragment (`#...`)
62
+
2. Strip all query parameters — cache-busters (`?v=123`, `?cb=timestamp`), consent params, and session tokens all live in query strings. JS asset versioning uses path segments, not query params.
63
+
3. Strip trailing slash from the path
64
+
65
+
The normalized URL is what gets stored in `origin_url` and fed into the slug hash.
43
66
44
67
---
45
68
46
69
## Heuristic Filter
47
70
48
71
The following origin categories are excluded silently. The terminal summary reports what was filtered and why so operators can manually add entries if needed.
49
72
50
-
| Category | Excluded origins |
51
-
|---|---|
73
+
**Matching:** Filter entries match if the request URL's host ends with the filter entry, with a dot-boundary check. For example, `googletagmanager.com` in the filter matches `www.googletagmanager.com` but not `evil-googletagmanager.com`.
The pipe (`|`) separator is required — it cannot appear in domain names or at the start of a URL, so the hash input is unambiguous. The `origin_url` fed into the hash must be the normalized URL (see URL Processing).
108
+
109
+
**base62 charset:**`0-9A-Za-z` (digits first, then uppercase, then lowercase). This matches the `base62` crate convention.
110
+
81
111
**Rationale:** Fully opaque and hash-derived — no human naming required, no ambiguity for cryptic vendor filenames. The KV metadata (`origin_url`, `content_type`, `asset_slug`) serves as the lookup table. Operators can query `js-asset:{slug}` in the KV store to retrieve full provenance. The terminal summary also prints slug → origin_url at generation time.
82
112
83
113
**Important:** This algorithm must produce identical output to the Proxy's KV key derivation. Engineering should implement this as a shared utility (e.g., a small JS/TS helper in the skill, or a standalone `scripts/` utility) rather than duplicating the logic.
84
114
85
115
### Wildcard detection
86
116
87
-
Path segments matching either pattern are replaced with `*`:
117
+
Path segments matching any of these patterns are replaced with `*`:
- Mixed alphanumeric hash: `[A-Za-z0-9]{8,}` between path separators, **must contain at least one digit and at least one letter** — this excludes pure-alpha dictionary words like `analytics` or `bootstrap`
90
122
91
123
The original URL is preserved as a comment above the generated entry so operators can verify the wildcard substitution is correct.
92
124
@@ -104,14 +136,14 @@ The original URL is preserved as a comment above the generated entry so operator
-`mcp__plugin_chrome-devtools-mcp_chrome-devtools__evaluate_script` — settle window + detect head-loaded scripts via DOM query
222
+
-`mcp__plugin_chrome-devtools-mcp_chrome-devtools__close_page` — clean up tab
223
+
224
+
**Permission grants required:**`navigate_page`, `list_network_requests`, and `close_page` are not currently approved in `.claude/settings.json`. Add them to `permissions.allow` before running the skill, or expect interactive permission prompts on first run.
@@ -199,7 +234,7 @@ The Auditor is a Claude Code skill file. No compiled code.
199
234
200
235
The Auditor should be delivered **after Proxy Phase 1** (so `js-assets.toml` schema is defined) and **before Proxy Phase 2** (so engineering has real populated entries to test the cache pipeline against actual vendor origins).
201
236
202
-
See [delivery order in the Proxy spec](2026-04-01-js-asset-proxy-design.md).
237
+
See [delivery order in the Proxy spec](2026-04-01-js-asset-proxy-design.md)_(on `js-asset-proxy-spec` branch until merged)_.
0 commit comments