From b475038e257c62b31922b6e96ec1a5ae23742ce7 Mon Sep 17 00:00:00 2001
From: leeguooooo <guoli@zhihu.com>
Date: Fri, 12 Jun 2026 16:09:55 +0900
Subject: [PATCH] fix(upload): actionable error when file upload hits the
 extension-relay limit (#13)

DOM.setFileInputFiles is forbidden by Chrome's chrome.debugger API, so upload
always fails over the extension relay with an opaque -32000 "Not allowed". Map
it to a clear message: file upload needs a --launch/direct-CDP session, and
point at the cookies export|set --curl workaround. Note the limit in the core
skill upload line too.
---
 cli/src/native/browser.rs | 20 +++++++++++++++++++-
 skill-data/core/SKILL.md  |  6 +++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/cli/src/native/browser.rs b/cli/src/native/browser.rs
index e2663c4..b5f5c2a 100644
--- a/cli/src/native/browser.rs
+++ b/cli/src/native/browser.rs
@@ -1593,7 +1593,25 @@ impl BrowserManager {
                 })),
                 Some(&effective_session_id),
             )
-            .await?;
+            .await
+            .map_err(|e| {
+                // Chrome's chrome.debugger API (the extension-relay transport)
+                // forbids DOM.setFileInputFiles for security, surfacing as an
+                // opaque `-32000 "Not allowed"`. Translate it into an actionable
+                // message rather than leaking the raw CDP error (issue #13).
+                if e.contains("Not allowed") || e.contains("-32000") {
+                    "file upload isn't supported over the extension relay — \
+                     Chrome's chrome.debugger API forbids DOM.setFileInputFiles. \
+                     Use a direct-CDP session instead: \
+                     `chrome-use --session up --launch open <url>` (carry your \
+                     login over with `cookies export` | `cookies set --curl`), \
+                     then run `upload` in that session. \
+                     See https://github.com/leeguooooo/chrome-use/issues/13"
+                        .to_string()
+                } else {
+                    e
+                }
+            })?;
 
         Ok(())
     }
diff --git a/skill-data/core/SKILL.md b/skill-data/core/SKILL.md
index 9532c55..69a4444 100644
--- a/skill-data/core/SKILL.md
+++ b/skill-data/core/SKILL.md
@@ -240,7 +240,11 @@ chrome-use pick @e4 --option "Europe"  # ANY combobox (react-select / ARIA /
                                           # (no silent no-op). Use this for custom
                                           # dropdowns where `select` returns ✓ but
                                           # changes nothing.
-chrome-use upload @e5 file1.pdf        # upload file(s)
+chrome-use upload @e5 file1.pdf        # upload file(s) — NOTE: needs a --launch/direct-CDP
+                                          # session. Over the extension relay it CANNOT work
+                                          # (Chrome's chrome.debugger forbids it); chrome-use
+                                          # errors with a hint. Carry your login into a launched
+                                          # session via `cookies export` | `cookies set --curl`.
 chrome-use scroll down 500             # scroll page (up/down/left/right)
 chrome-use scrollintoview @e1          # scroll element into view
 chrome-use drag @e1 @e2                # drag and drop