WorkatoMCP v1.12.0

Chrome extension 1.12.0, built by GitHub Actions from this tag. Pairs with workatomcp-bridge 1.12.0 on npm.

Install

1. Unzip workatomcp-extension-1.12.0.zip into a folder you will keep, for example %LOCALAPPDATA%\WorkatoMCP\extension. Chrome loads the extension from there on every start.
2. Open chrome://extensions, turn on Developer mode, click Load unpacked and pick that folder.
3. Check the ID reads bpjpdgkeelhkijkllcmogemkmndgeana.
4. Install the bridge and connect your MCP client: quick start, step 3 on.

To update, replace the folder's contents with the new zip and press reload on the extension card.

Verify

gh attestation verify workatomcp-extension-1.12.0.zip --repo Eithery-rc/WorkatoMCP confirms the zip was built by this repository's release workflow.

SHA-256: 18e6ea32646b63627780d438279e0a9d5b42bab0f598d1b3c74f1beddf2a6e46

Changes

Files that reach the disk intact, page scripts that outlive the call, and redaction that no longer swallows templates.

Added

• Extension releases: pushing a vX.Y.Z tag (the extension version) publishes a GitHub release with workatomcp-extension-X.Y.Z.zip, built by GitHub Actions from that tag and attested (gh attestation verify). Installing the extension no longer needs a clone and a pnpm build.
• chrome_fetch_to_file: fetches a URL in the tab's page with the session cookies and writes the body straight to a local file (up to 40 MB). The bytes never enter the reply or the output redaction, so PDFs from print URLs, CSV exports and template sources arrive intact. The reply is a summary: path, size, sha256, status, content type, filename and the first bytes (%PDF-1.4). It replaces Blob plus anchor.click() downloads.
• Async jobs in chrome_javascript: async_job:true starts the code and returns a job_id at once; job_id with wait_ms polls it. A page whose main thread is blocked (a sync XHR) reports busy instead of timing the call out, and a job whose page navigated away reports lost.
• chrome_upload_file by uid: a file input from chrome_snapshot is reached by its uid, including inputs inside same-process iframes.

Changed

• chrome_javascript with an explicit out_file writes the returned value itself to the file, unredacted, and returns its size and sha256. Inline results and automatic spills are still redacted.
• A full-page or element screenshot of a hidden tab in the shared agents window moves that tab into its own unfocused window first and reports moved_to_window. Leasing with own_window up front is no longer needed for screenshots. Tabs outside the agents window are never moved.
• chrome_handle_download says why it timed out: no download started (and that Chrome's "multiple automatic downloads" permission holds script-started ones silently), or which download started and how far it got. An interrupted download fails at once with its reason.

Fixed

• The output redaction replaced any text with two &- or ;-separated pieces containing = with [BLOCKED: Cookie/query string data], which swallowed whole HTML templates and full URLs. Only a string that is itself a cookie, Set-Cookie or query string is blocked now, and URL paths are no longer taken for base64.
• chrome_navigate to a slow page (a PDF still being generated) reported the previous page with navigated:false, which read as "nothing happened". The reply now carries pending_url and a note not to navigate again.