@browserbridge/bbx 1.0.0 → 1.1.0

package/README.md

@@ -1,6 +1,8 @@
-# Browser Bridge
+# Browser Bridge (BBX)
 
-![Browser Bridge: Connect AI Agent and Browsers](https://raw.githubusercontent.com/koltyakov/browser-bridge/main/assets/banner.jpg)
+![Browser Bridge (BBX): Connect AI Agent and Browsers](https://raw.githubusercontent.com/koltyakov/browser-bridge/main/assets/banner.jpg)
+
+> **Chrome Web Store:** Install `Browser Bridge (BBX)` from the [Chrome Web Store](https://chromewebstore.google.com/detail/browser-bridge/jjjkmmcdkpcgamlopogicbnnhdgebhie). For local or custom builds, use the unpacked install flow in [docs/unpacked-extension.md](https://github.com/koltyakov/browser-bridge/blob/main/docs/unpacked-extension.md).
 
 A local bridge between your coding agent and a real Chrome tab. Browser Bridge gives the agent structured access to DOM, styles, layout, console, network, and reversible patches - starting from the actual tab you already have open, with all its real state intact.
 
@@ -103,9 +105,9 @@ Browser Bridge is optimized for the opposite starting point: **inspect the state
 
 ## Setup
 
-1. Install [Browser Bridge from the Chrome Web Store](https://chrome.google.com/webstore/detail/jjjkmmcdkpcgamlopogicbnnhdgebhie) <!-- TODO: replace with final store link after publishing -->
+1. Install [Browser Bridge from the Chrome Web Store](https://chromewebstore.google.com/detail/browser-bridge/jjjkmmcdkpcgamlopogicbnnhdgebhie)
 2. `npm install -g @browserbridge/bbx` - installs the CLI and native host
-3. In the extension side panel, install MCP or CLI (skill) for your agent of choice, or run the `bbx install-mcp` / `bbx install-skill` commands if you prefer terminal setup
+3. In the extension side panel, install MCP or CLI (skill) for your agent of choice
 4. Enable Browser Bridge for the Chrome window you want to inspect/control with the AI agent
 5. Ask your agent to use Browser Bridge via MCP (`BB MCP` or `Browser Bridge MCP`), or invoke the `browser-bridge` / `$bbx` skill in CLI mode
 

package/package.json

@@ -1,86 +1,86 @@
 {
   "name": "@browserbridge/bbx",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "private": false,
-  "type": "module",
+  "keywords": [
+    "agent-tools",
+    "ai-agent",
+    "browser",
+    "browser-automation",
+    "browser-bridge",
+    "chrome",
+    "chrome-extension",
+    "developer-tools",
+    "mcp",
+    "model-context-protocol",
+    "native-messaging",
+    "ui-debugging"
+  ],
+  "homepage": "https://github.com/koltyakov/browser-bridge#readme",
+  "bugs": {
+    "url": "https://github.com/koltyakov/browser-bridge/issues"
+  },
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/koltyakov/browser-bridge.git"
+  },
+  "bin": {
+    "bbx": "packages/agent-client/src/cli.js",
+    "bbx-daemon": "packages/native-host/bin/bridge-daemon.js",
+    "bbx-install": "packages/native-host/bin/install-manifest.js",
+    "bbx-mcp": "packages/mcp-server/src/bin.js"
+  },
   "files": [
-    "assets",
-    "CHANGELOG.md",
     "LICENSE",
     "README.md",
-    "docs",
-    "manifest.json",
     "packages/agent-client/src",
-    "packages/extension/assets",
-    "packages/extension/src",
-    "packages/extension/ui",
     "packages/mcp-server/src",
     "packages/native-host/bin",
     "packages/native-host/src",
     "packages/protocol/src",
-    "skills/browser-bridge"
+    "skills/browser-bridge",
+    "!**/test/**",
+    "!**/*.test.*",
+    "!**/*.spec.*"
   ],
-  "bin": {
-    "bbx": "packages/agent-client/src/cli.js",
-    "bbx-mcp": "packages/mcp-server/src/bin.js",
-    "bbx-daemon": "packages/native-host/bin/bridge-daemon.js",
-    "bbx-install": "packages/native-host/bin/install-manifest.js"
-  },
+  "type": "module",
   "publishConfig": {
     "access": "public"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/koltyakov/browser-bridge.git"
-  },
-  "homepage": "https://github.com/koltyakov/browser-bridge#readme",
-  "bugs": {
-    "url": "https://github.com/koltyakov/browser-bridge/issues"
-  },
-  "keywords": [
-    "browser-bridge",
-    "browser",
-    "chrome",
-    "chrome-extension",
-    "native-messaging",
-    "mcp",
-    "model-context-protocol",
-    "ai-agent",
-    "agent-tools",
-    "developer-tools",
-    "ui-debugging",
-    "browser-automation"
-  ],
   "scripts": {
-    "lint": "eslint .",
-    "test": "c8 node --test packages/protocol/test/*.test.js packages/native-host/test/*.test.js packages/agent-client/test/*.test.js packages/mcp-server/test/*.test.js packages/extension/test/*.test.js",
+    "lint": "oxlint . && oxfmt --check .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
+    "test:runtime": "node --test",
+    "test": "c8 node --test",
     "coverage": "c8 report --reporter=text --reporter=text-summary",
-    "coverage:check": "c8 check-coverage --lines 70",
+    "coverage:review": "c8 report --reporter=json-summary && node scripts/review-coverage.mjs",
+    "coverage:check": "c8 check-coverage --lines 80 --branches 75",
     "typecheck": "tsc --noEmit",
     "postinstall": "node packages/native-host/bin/postinstall.js",
     "package:extension": "node scripts/package-extension.mjs",
     "check:extension-zip": "node scripts/check-extension-zip.mjs",
     "release:check": "npm run lint && npm run typecheck && npm test && npm run coverage:check && npm run package:extension && npm pack --dry-run",
-    "prepublishOnly": "npm run lint && npm run typecheck && npm test",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test && npm run coverage:check",
     "status": "node packages/agent-client/src/cli.js status",
     "daemon": "node packages/native-host/bin/bridge-daemon.js",
     "install-manifest": "node packages/native-host/bin/install-manifest.js"
   },
-  "engines": {
-    "node": ">=18"
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/chrome": "^0.1.38",
-    "@types/node": "^25.4.0",
+    "@types/chrome": "^0.1.40",
+    "@types/node": "^25.5.2",
     "c8": "^11.0.0",
-    "eslint": "^10.1.0",
-    "globals": "^17.4.0",
-    "typescript": "^6.0.2"
+    "linkedom": "^0.18.12",
+    "oxfmt": "^0.47.0",
+    "oxlint": "^1.62.0",
+    "typescript": "^6.0.3"
   },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.28.0",
-    "zod": "^4.3.6"
+  "engines": {
+    "node": ">=18"
   }
 }

package/packages/agent-client/src/cli-helpers.js

@@ -3,6 +3,39 @@
 import readline from 'node:readline';
 import { bridgeMethodNeedsTab } from '../../protocol/src/index.js';
 
+/**
+ * Strip ANSI escape sequences from a string to prevent terminal injection
+ * from malicious page content (e.g. DOM text, console output, eval results).
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+export function stripAnsi(str) {
+  // oxlint-disable-next-line no-control-regex
+  return str.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').replace(/\x1b[^[]/g, '');
+}
+
+/**
+ * Recursively sanitize all string values in a value tree by stripping ANSI
+ * escape sequences. Only strings are touched; structure is preserved.
+ *
+ * @param {unknown} value
+ * @returns {unknown}
+ */
+export function sanitizeOutput(value) {
+  if (typeof value === 'string') return stripAnsi(value);
+  if (Array.isArray(value)) return value.map(sanitizeOutput);
+  if (value !== null && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(/** @type {Record<string, unknown>} */ (value)).map(([k, v]) => [
+        k,
+        sanitizeOutput(v),
+      ])
+    );
+  }
+  return value;
+}
+
 /**
  * @param {string[]} values
  * @returns {Record<string, string>}
@@ -30,7 +63,10 @@ export function parseCommaList(value) {
   if (!value) {
     return [];
   }
-  return value.split(',').map((item) => item.trim()).filter(Boolean);
+  return value
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
 }
 
 /**
@@ -50,7 +86,9 @@ export function parseJsonObject(value) {
   }
 
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error(`Expected a JSON object but got ${Array.isArray(parsed) ? 'array' : typeof parsed}. Wrap your input in {}.`);
+    throw new Error(
+      `Expected a JSON object but got ${Array.isArray(parsed) ? 'array' : typeof parsed}. Wrap your input in {}.`
+    );
   }
 
   return /** @type {Record<string, unknown>} */ (parsed);
@@ -131,7 +169,7 @@ export async function interactiveCheckbox(title, items) {
   }
 
   process.stdout.write('\x1b[?25l'); // hide cursor
-  if (typeof /** @type {any} */ (process.stdin).setRawMode === 'function') {
+  if (typeof (/** @type {any} */ (process.stdin).setRawMode) === 'function') {
     /** @type {any} */ (process.stdin).setRawMode(true);
   }
   process.stdin.resume();
@@ -143,7 +181,7 @@ export async function interactiveCheckbox(title, items) {
      */
     function cleanup(result) {
       process.stdin.removeListener('keypress', onKeypress);
-      if (typeof /** @type {any} */ (process.stdin).setRawMode === 'function') {
+      if (typeof (/** @type {any} */ (process.stdin).setRawMode) === 'function') {
         /** @type {any} */ (process.stdin).setRawMode(false);
       }
       process.stdin.pause();
@@ -204,7 +242,7 @@ export async function interactiveConfirm(prompt, options = {}) {
   const suffix = defaultValue ? ' [Y/n] ' : ' [y/N] ';
   const rl = readline.createInterface({
     input: process.stdin,
-    output: process.stdout
+    output: process.stdout,
   });
 
   try {