@browserbridge/bbx 1.7.7 → 1.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/PRIVACY.md +111 -0
  2. package/README.md +13 -5
  3. package/RESPONSIBLE_USE.md +16 -0
  4. package/SECURITY.md +52 -0
  5. package/package.json +12 -6
  6. package/packages/agent-client/src/cli-args.js +24 -0
  7. package/packages/agent-client/src/cli.js +46 -52
  8. package/packages/agent-client/src/client.js +140 -5
  9. package/packages/agent-client/src/command-registry.js +56 -53
  10. package/packages/agent-client/src/content-extract.js +198 -0
  11. package/packages/agent-client/src/remotes.js +1 -1
  12. package/packages/agent-client/src/runtime.js +768 -35
  13. package/packages/agent-client/src/types.ts +131 -6
  14. package/packages/mcp-server/src/guidance.js +1 -1
  15. package/packages/mcp-server/src/handlers-capture.js +41 -5
  16. package/packages/mcp-server/src/handlers-dom.js +8 -2
  17. package/packages/mcp-server/src/handlers-navigation.js +2 -1
  18. package/packages/mcp-server/src/handlers-page.js +41 -4
  19. package/packages/mcp-server/src/handlers-utils.js +67 -7
  20. package/packages/mcp-server/src/handlers.js +4 -4
  21. package/packages/mcp-server/src/server.js +102 -6
  22. package/packages/native-host/src/daemon.js +158 -6
  23. package/packages/native-host/src/native-host.js +3 -1
  24. package/packages/protocol/src/defaults.js +3 -0
  25. package/packages/protocol/src/errors.js +54 -1
  26. package/packages/protocol/src/protocol.js +297 -1
  27. package/packages/protocol/src/registry.js +66 -35
  28. package/packages/protocol/src/summary.js +87 -5
  29. package/packages/protocol/src/types.ts +234 -0
  30. package/skills/browser-bridge/SKILL.md +34 -13
  31. package/skills/browser-bridge/references/interaction.md +55 -11
  32. package/skills/browser-bridge/references/patch-workflow.md +2 -0
  33. package/skills/browser-bridge/references/protocol.md +157 -82
  34. package/skills/browser-bridge/references/token-efficiency.md +19 -13
@@ -14,7 +14,7 @@ These presets are also available at runtime via `bbx skill`.
14
14
 
15
15
  ## Debugger Policy
16
16
 
17
- Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `dom.get_accessibility_tree`, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance.
17
+ Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `page.handle_dialog`, `dom.get_accessibility_tree`, CDP network capture, CDP input execution, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance.
18
18
 
19
19
  ## Decision Tree
20
20
 
@@ -25,14 +25,15 @@ Avoid debugger-backed methods until they are clearly necessary. In Browser Bridg
25
25
  5. **Need layout metrics?** → `layout.get_box_model` (no budget needed)
26
26
  6. **Need styles?** → `styles.get_computed` with explicit `properties` list
27
27
  7. **Need runtime errors?** → `page.get_console` with `level: 'error'`
28
- 8. **Need full page text?** → `page.get_text` (cheaper than `dom.query` on body)
29
- 9. **Need API call history?** → `page.get_network` (intercepted fetch/XHR log)
30
- 10. **Need framework/app state and no lighter read can expose it?** → `page.evaluate` (debugger-backed)
31
- 11. **Need semantic structure and role/text queries are insufficient?** → `dom.get_accessibility_tree` (debugger-backed)
32
- 12. **Need performance data?** → `performance.get_metrics` (debugger-backed)
33
- 13. **Testing responsive with an exact forced viewport?** → `viewport.resize` (debugger-backed)
34
- 14. **Visual ambiguity after structured reads?** → `screenshot.capture_element` first, or `screenshot.capture_region` with a tight crop when one element is not enough (debugger-backed)
35
- 15. **Content-script blocked?** → `cdp.get_document` or `cdp.get_dom_snapshot` (debugger-backed fallback)
28
+ 8. **Need article or documentation content?** → `page.extract_content` (removes navigation and repeated chrome)
29
+ 9. **Need all visible page UI text?** → `page.get_text` (cheaper than `dom.query` on body)
30
+ 10. **Need API call history?** → default `page.get_network` (intercepted fetch/XHR log)
31
+ 11. **Need framework/app state and no lighter read can expose it?** → `page.evaluate` (debugger-backed)
32
+ 12. **Need semantic structure and role/text queries are insufficient?** → compact or interactive-only `dom.get_accessibility_tree` (debugger-backed)
33
+ 13. **Need performance data?** → `performance.get_metrics` (debugger-backed)
34
+ 14. **Testing responsive with an exact forced viewport?** → `viewport.resize` (debugger-backed)
35
+ 15. **Visual ambiguity after structured reads?** → `screenshot.capture_element` first, or `screenshot.capture_region` with a tight crop when one element is not enough (debugger-backed)
36
+ 16. **Content-script blocked?** → `cdp.get_document` or `cdp.get_dom_snapshot` (debugger-backed fallback)
36
37
 
37
38
  ## Allowlist Strategy
38
39
 
@@ -57,7 +58,7 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
57
58
  | Screenshot before structured read | ~1500 tok wasted | Always `dom.query` or `styles.get_computed` first |
58
59
  | Re-querying DOM for same element | ~500 tok/call | Reuse `elementRef` from prior result |
59
60
  | Full-page screenshot | ~3000 tok | Use `screenshot.capture_element`, or `screenshot.capture_region` with a tight rect |
60
- | Requesting all computed styles | ~800 tok | Set `properties` list (usually 3–8 props) |
61
+ | Requesting broad computed styles via CDP | ~800 tok | Use `styles.get_computed`; omission returns five core props, or pass 3-8 explicit props |
61
62
  | Multiple CLI calls for independent reads | overhead/call | Use `batch` command |
62
63
  | Guessing selectors for known labels | ~300 tok wasted/try | Use `dom.find_by_text` or `dom.find_by_role` |
63
64
  | Polling page state with repeated queries | ~500 tok/poll | Use `dom.wait_for` (single call, waits async) |
@@ -68,6 +69,8 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
68
69
  | Guessing interactive elements from DOM | ~600 tok/try | Use `dom.get_accessibility_tree` for semantic roles |
69
70
  | Fetching network via evaluate hacks | ~400 tok | Use `page.get_network` (auto-interceptor) |
70
71
  | Full a11y tree with no limits | ~3000 tok | Set `maxNodes` ≤ 50, `maxDepth` ≤ 4 |
72
+ | CDP network capture for API-only traffic | debugger lifecycle | Use default fetch/XHR capture; reserve CDP for all-resource failures |
73
+ | Repeated page-state polling for a route | ~500 tok/poll | Use one event-aware `page.wait_for_load_state` URL condition |
71
74
 
72
75
  ## Efficient Loop
73
76
 
@@ -107,11 +110,12 @@ Install early - the buffer auto-activates on first call. Captured levels: log, w
107
110
 
108
111
  ## Page Text Instead of DOM Scan
109
112
 
110
- When you need the page's visible text - for summarization, search, or content extraction - use `page.get_text` instead of `dom.query` on `body`:
113
+ When you need every visible UI label, use `page.get_text` instead of `dom.query` on `body`. For articles, documentation, or long issues, prefer `page.extract_content` so navigation and repeated chrome are removed first:
111
114
 
112
115
  ```bash
113
116
  bbx page-text # default 8000 char budget
114
117
  bbx page-text 8000 # larger budget for long pages
118
+ bbx call page.extract_content '{"format":"markdown","textBudget":8000}'
115
119
  ```
116
120
 
117
121
  This is 3–5× cheaper than querying the body's subtree with `dom.query`.
@@ -127,15 +131,17 @@ bbx network 50 # last 50 entries
127
131
 
128
132
  The interceptor auto-installs on first call. Before reproducing an event, call `page.get_network` once with `clear: true` to install capture and remove old entries. Trigger the action, then read again without `clear`. Each entry shows `method`, `url`, `status`, `duration`.
129
133
 
134
+ Only escalate to `source: "cdp"` when fetch/XHR misses the relevant document, asset, socket, cache, redirect, or failed-resource metadata. CDP must be started before reproduction and explicitly stopped afterward; it holds debugger ownership, tracks in-flight state, and returns a larger entry shape. Its URLs redact credentials, fragments, and query values, and it never returns bodies, cookies, authorization values, or complete headers.
135
+
130
136
  ## Accessibility Tree for Semantic Discovery
131
137
 
132
138
  When you need to understand the page's interactive structure without guessing selectors:
133
139
 
134
140
  ```bash
135
- bbx a11y-tree 30 3 # 30 nodes, depth 3
141
+ bbx call dom.get_accessibility_tree '{"maxNodes":30,"maxDepth":4,"interactiveOnly":true}'
136
142
  ```
137
143
 
138
- Returns role/name/interactive flag per node. Much cheaper than screenshot + OCR, and more accurate than `dom.query` on generic selectors.
144
+ Filtering before `maxNodes` makes compact/interactive-only output much cheaper than screenshot + OCR. AX depth is always partial and `interactive` is semantic metadata, not current actionability; use role/name to find a DOM ref before input.
139
145
 
140
146
  ## Semantic finding Saves Selector Guessing
141
147