@browserbridge/bbx 1.11.0 → 1.11.2

package/SECURITY.md

@@ -52,8 +52,15 @@ Out of scope:
 
 - By default the daemon listens on a user-owned Unix socket (mode `0700` directory) or,
   on Windows, a named pipe / localhost TCP.
-- Any TCP listener requires a random 256-bit auth token stored with mode `0600`;
-  registration without it is rejected and the comparison is constant-time.
+- Any TCP listener requires random 256-bit credentials stored with mode `0600`.
+  Agents and the Chrome native host use distinct credentials, so a remote agent
+  token cannot register an extension-role socket. Registration without the
+  role-appropriate credential is rejected and comparison is constant-time.
+- Setup mutation is accepted only from the local socket or authenticated native
+  host. A TCP agent remains non-local even when its peer address is loopback,
+  preventing SSH port forwarding from turning remote access into local control.
+- Daemon connections, registration time, malformed input, pending requests, and
+  per-client pending requests are bounded to limit resource exhaustion.
 - Proxy mode (LAN exposure) is opt-in via `bbx proxy enable` and always provisions a
   token; an invalid `bindHost` in the config rejects the config rather than widening
   the bind address.
@@ -62,3 +69,8 @@ Out of scope:
 - Ordinary Web Storage reads return key/presence metadata only. The separate
   `sensitive.read` method requires one exact key, is excluded from batches and
   automatic retries, and returns a value whole or fails atomically.
+- Fetch/XHR and console capture run in the inspected page's main JavaScript
+  world. Results are therefore marked `integrity: "untrusted"`, copied through
+  strict bounded schemas, and never treated as daemon or extension authority.
+- Request interception rules are bounded per tab; patterns, bodies, and headers
+  have protocol-level size limits and URL matchers are compiled once per rule.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserbridge/bbx",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "private": false,
   "keywords": [
     "agent-tools",
@@ -80,7 +80,7 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",
-    "@types/chrome": "^0.2.5",
+    "@types/chrome": "^0.2.6",
     "@types/node": "^26.2.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/packages/agent-client/src/client.js

@@ -104,16 +104,37 @@ function shouldAutoRestartDaemonOnVersionMismatch(env = process.env) {
 /**
  * @param {net.Socket} socket
  * @param {string} line
+ * @param {AbortSignal} signal
  * @returns {Promise<void>}
  */
-async function writeSocketLine(socket, line) {
+async function writeSocketLine(socket, line, signal) {
+  signal.throwIfAborted();
   if (!socket.write(line)) {
-    await Promise.race([
-      once(socket, 'drain'),
-      once(socket, 'close').then(() => {
-        throw new Error('Bridge socket closed while writing.');
-      }),
-    ]);
+    await new Promise((resolve, reject) => {
+      const cleanup = () => {
+        socket.off('drain', onDrain);
+        socket.off('error', onError);
+        socket.off('close', onClose);
+        signal.removeEventListener('abort', onAbort);
+      };
+      const onDrain = () => {
+        cleanup();
+        resolve(undefined);
+      };
+      /** @param {unknown} error */
+      const onError = (error) => {
+        cleanup();
+        reject(error);
+      };
+      const onClose = () => onError(new Error('Bridge socket closed while writing.'));
+      const onAbort = () => onError(signal.reason);
+      socket.once('drain', onDrain);
+      socket.once('error', onError);
+      socket.once('close', onClose);
+      signal.addEventListener('abort', onAbort, { once: true });
+      if (signal.aborted) onAbort();
+      else if (socket.destroyed) onClose();
+    });
   }
 }
 
@@ -176,12 +197,31 @@ export class BridgeClient extends EventEmitter {
     this.socket = socket;
     try {
       await new Promise((resolve, reject) => {
-        socket.once('connect', resolve);
-        socket.once('error', reject);
+        const cleanup = () => {
+          socket.off('connect', onConnect);
+          socket.off('error', onError);
+          socket.off('close', onClose);
+        };
+        const onConnect = () => {
+          cleanup();
+          resolve(undefined);
+        };
+        /** @param {Error} error */
+        const onError = (error) => {
+          cleanup();
+          reject(error);
+        };
+        const onClose = () => onError(new Error('Bridge socket closed while connecting.'));
+        socket.once('connect', onConnect);
+        socket.once('error', onError);
+        socket.once('close', onClose);
       });
+      if (this.socket !== socket || socket.destroyed) {
+        throw new Error('Bridge socket closed while connecting.');
+      }
     } catch (error) {
       socket.destroy();
-      this.socket = null;
+      if (this.socket === socket) this.socket = null;
       throw error;
     }
 
@@ -198,6 +238,7 @@ export class BridgeClient extends EventEmitter {
     });
 
     parseJsonLines(socket, (raw) => {
+      if (this.socket !== socket) return;
       const message = /** @type {ClientMessage} */ (raw);
       if (message.type === 'registered') {
         const pending = this.waiting.get('registered');
@@ -231,6 +272,7 @@ export class BridgeClient extends EventEmitter {
     });
 
     socket.on('close', () => {
+      if (this.socket !== socket) return;
       this.connected = false;
       this.socket = null;
       this.rejectAllPending(new Error('Bridge socket closed.'));
@@ -240,35 +282,50 @@ export class BridgeClient extends EventEmitter {
     });
 
     socket.on('error', (error) => {
+      if (this.socket !== socket) return;
       this.rejectAllPending(error);
       // 'close' fires after 'error'; reconnect is triggered there.
     });
 
-    const authToken =
-      this.authToken === undefined
-        ? this.transport.type === 'tcp'
-          ? await readBridgeAuthToken()
-          : null
-        : normalizeBridgeAuthToken(this.authToken);
+    const registrationWrite = new AbortController();
     try {
-      await writeSocketLine(
-        socket,
-        `${JSON.stringify({
-          type: 'register',
-          role: 'agent',
-          clientId: this.clientId,
-          ...(authToken ? { authToken } : {}),
-        })}\n`
-      );
+      const writePromise = (async () => {
+        const authToken =
+          this.authToken === undefined
+            ? this.transport.type === 'tcp'
+              ? await readBridgeAuthToken()
+              : null
+            : normalizeBridgeAuthToken(this.authToken);
+        await writeSocketLine(
+          socket,
+          `${JSON.stringify({
+            type: 'register',
+            role: 'agent',
+            clientId: this.clientId,
+            ...(authToken ? { authToken } : {}),
+          })}\n`,
+          registrationWrite.signal
+        );
+      })();
+      await Promise.race([registrationPromise, writePromise.then(() => registrationPromise)]);
+      if (this.socket !== socket || socket.destroyed) {
+        throw new Error('Bridge socket closed while registering.');
+      }
     } catch (error) {
-      const pending = this.waiting.get('registered');
-      if (pending) {
-        clearTimeout(pending.timeoutId);
-        this.waiting.delete('registered');
+      if (this.socket === socket) {
+        const pending = this.waiting.get('registered');
+        if (pending) {
+          clearTimeout(pending.timeoutId);
+          this.waiting.delete('registered');
+        }
+        this.connected = false;
+        this.socket = null;
       }
+      socket.destroy();
       throw error;
+    } finally {
+      registrationWrite.abort();
     }
-    await registrationPromise;
 
     this.protocolCompatibility = null;
     this.protocolWarning = null;
@@ -553,18 +610,25 @@ export class BridgeClient extends EventEmitter {
       });
     });
 
+    const requestWrite = new AbortController();
     try {
-      await writeSocketLine(this.socket, `${JSON.stringify({ type: 'agent.request', request })}\n`);
-    } catch (error) {
+      const writePromise = writeSocketLine(
+        this.socket,
+        `${JSON.stringify({ type: 'agent.request', request })}\n`,
+        requestWrite.signal
+      );
+      const response = /** @type {BridgeResponse} */ (
+        await Promise.race([responsePromise, writePromise.then(() => responsePromise)])
+      );
+      return this.attachProtocolWarning(response);
+    } finally {
+      requestWrite.abort();
       const pending = this.waiting.get(request.id);
       if (pending) {
         clearTimeout(pending.timeoutId);
         this.waiting.delete(request.id);
       }
-      throw error;
     }
-    const response = /** @type {BridgeResponse} */ (await responsePromise);
-    return this.attachProtocolWarning(response);
   }
 
   /**
@@ -611,11 +675,19 @@ export class BridgeClient extends EventEmitter {
    */
   async close() {
     this.autoReconnect = false; // prevent reconnect on intentional close
-    if (!this.socket) {
+    const socket = this.socket;
+    if (!socket) {
+      return;
+    }
+    if (socket.connecting || !this.connected || socket.destroyed || socket.writableNeedDrain) {
+      this.socket = null;
+      this.connected = false;
+      this.rejectAllPending(new Error('Bridge socket closed.'));
+      socket.destroy();
       return;
     }
     await new Promise((resolve) => {
-      this.socket?.end(() => resolve(undefined));
+      socket.end(() => resolve(undefined));
     });
   }
 
@@ -697,6 +769,7 @@ export class BridgeClient extends EventEmitter {
     const previousAutoReconnect = this.autoReconnect;
     this.autoReconnect = false;
     this.connected = false;
+    this.rejectAllPending(new Error('Bridge socket closed.'));
     this.socket = null;
 
     if (!socket.destroyed) {

package/packages/agent-client/src/runtime.js

@@ -204,8 +204,8 @@ function withRequestMeta(source, mcpEra, tokenBudget, automaticRetry) {
  */
 export async function withBridgeClient(callback, options) {
   const client = new BridgeClient(await applyConfiguredAutoUpdate(options));
-  await ensureClientConnected(client);
   try {
+    await ensureClientConnected(client);
     return await callback(client);
   } finally {
     await client.close();

package/packages/mcp-server/src/handlers-capture.js

@@ -153,7 +153,7 @@ export function createScreenshotResult(response, method) {
       return summarizeToolError(new Error(`${method} returned invalid artifact metadata.`));
     }
     return createToolResult(
-      `Captured screenshot artifact (${artifact.byteLength} bytes, expires ${artifact.expiresAt ?? 'soon'}). Read it in chunks with the browser_artifact tool (action "read", paging offset until nextOffset is null), then delete it with browser_artifact action "delete" when done.`,
+      `Captured screenshot artifact (${artifact.byteLength} bytes, expires ${artifact.expiresAt ?? 'soon'}). Read it in chunks with browser_call method "artifact.read", paging offset until nextOffset is null, then delete it with browser_call method "artifact.delete" when done.`,
       {
         ok: true,
         method,

package/packages/mcp-server/src/handlers-navigation.js

@@ -1,6 +1,5 @@
 // @ts-check
 
-import { createBridgeClientForDestination } from '../../agent-client/src/remotes.js';
 import {
   callBridgeTool,
   createToolResult,
@@ -8,6 +7,7 @@ import {
   getToolTokenBudget,
   requestBridgeWithRetry,
   summarizeToolError,
+  withMcpRequestClient,
 } from './handlers-utils.js';
 
 /** @typedef {import('../../protocol/src/types.js').BridgeMethod} BridgeMethod */
@@ -28,23 +28,20 @@ export async function handleTabsTool(args) {
     }
     const results = await Promise.all(
       destinations.map(async (destination) => {
-        /** @type {import('../../agent-client/src/client.js').BridgeClient | null} */
-        let client = null;
         try {
-          client = await createBridgeClientForDestination(
-            destination.local ? null : destination.id,
-            { checkProtocolOnConnect: false }
-          );
-          await client.connect();
-          const response = await requestBridgeWithRetry(
-            client,
-            'tabs.list',
-            {},
-            {
-              tabId: null,
-              source: 'mcp',
-              tokenBudget: null,
-            }
+          const response = await withMcpRequestClient(
+            (client) =>
+              requestBridgeWithRetry(
+                client,
+                'tabs.list',
+                {},
+                {
+                  tabId: null,
+                  source: 'mcp',
+                  tokenBudget: null,
+                }
+              ),
+            { destinationId: destination.local ? null : destination.id }
           );
           if (!response.ok) {
             return {
@@ -67,10 +64,6 @@ export async function handleTabsTool(args) {
             error: { message: error instanceof Error ? error.message : String(error) },
             tabs: [],
           };
-        } finally {
-          if (client) {
-            await client.close().catch(() => {});
-          }
         }
       })
     );

package/packages/mcp-server/src/handlers-page.js

@@ -13,7 +13,6 @@ import {
   MAX_BATCH_CONCURRENCY,
   METHOD_SET,
 } from '../../protocol/src/index.js';
-import { createBridgeClientForDestination } from '../../agent-client/src/remotes.js';
 import {
   annotateBridgeSummary,
   applyLimitBudgetPreset,
@@ -31,6 +30,8 @@ import {
   summarizeToolError,
   summarizeToolResponse,
   withToolClient,
+  withMcpRequestClient,
+  throwIfMcpRequestCancelled,
   REQUEST_SOURCE,
 } from './handlers-utils.js';
 import { createScreenshotResult } from './handlers-capture.js';
@@ -383,33 +384,23 @@ export async function handleBatchTool(args) {
     const tokenBudget = getToolTokenBudget(call);
     const destinationId = typeof call.destinationId === 'string' ? call.destinationId : null;
     const startTime = Date.now();
-    /** @type {BridgeClient | null} */
-    let callClient = null;
     /** @type {import('../../protocol/src/types.js').BridgeResponse | null} */
     let response = null;
     /** @type {unknown} */
     let callError = null;
     try {
-      callClient = await createBridgeClientForDestination(destinationId, {
-        checkProtocolOnConnect: false,
-      });
-      await callClient.connect();
       const params = applyMethodBudgetPreset(method, call.params || {}, call.budgetPreset);
-      response = await requestBridgeWithRetry(callClient, method, params, {
-        tabId,
-        source: REQUEST_SOURCE,
-        tokenBudget,
-      });
+      response = await withMcpRequestClient(
+        (client) =>
+          requestBridgeWithRetry(client, method, params, {
+            tabId,
+            source: REQUEST_SOURCE,
+            tokenBudget,
+          }),
+        { destinationId }
+      );
     } catch (error) {
       callError = error;
-    } finally {
-      if (callClient) {
-        try {
-          await callClient.close();
-        } catch (error) {
-          callError ??= error;
-        }
-      }
     }
     if (callError || !response) {
       return {
@@ -489,6 +480,7 @@ async function mapWithConcurrency(values, concurrency, callback) {
   let nextIndex = 0;
   const worker = async () => {
     while (nextIndex < values.length) {
+      throwIfMcpRequestCancelled();
       const index = nextIndex;
       nextIndex += 1;
       results[index] = await callback(values[index], index);
@@ -537,6 +529,9 @@ export async function handleRawCallTool(args) {
       if (method === 'sensitive.read') {
         return createSensitiveReadResult(response);
       }
+      if (method === 'artifact.read') {
+        return createArtifactReadResult(response);
+      }
       return summarizeToolResponse(response, method, params);
     },
     { destinationId: args.destinationId ?? null }
@@ -729,6 +724,7 @@ export async function handleInvestigateTool(args) {
       const stepResults = [];
 
       for (const step of scope.steps) {
+        throwIfMcpRequestCancelled();
         const startTime = Date.now();
         try {
           const response = await requestBridgeWithRetry(client, step.method, step.params(args), {