@browserbridge/bbx 1.7.8 → 1.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/PRIVACY.md +57 -12
- package/README.md +19 -8
- package/SECURITY.md +12 -0
- package/package.json +15 -6
- package/packages/agent-client/src/cli-args.js +59 -0
- package/packages/agent-client/src/cli-batch.js +121 -58
- package/packages/agent-client/src/cli-output.js +8 -1
- package/packages/agent-client/src/cli.js +272 -70
- package/packages/agent-client/src/client.js +296 -8
- package/packages/agent-client/src/command-registry.js +64 -55
- package/packages/agent-client/src/config.js +195 -0
- package/packages/agent-client/src/content-extract.js +198 -0
- package/packages/agent-client/src/npm-self-update.js +305 -0
- package/packages/agent-client/src/remotes.js +4 -2
- package/packages/agent-client/src/runtime.js +864 -39
- package/packages/agent-client/src/types.ts +169 -6
- package/packages/mcp-server/src/guidance.js +1 -1
- package/packages/mcp-server/src/handlers-capture.js +69 -6
- package/packages/mcp-server/src/handlers-dom.js +61 -4
- package/packages/mcp-server/src/handlers-navigation.js +2 -1
- package/packages/mcp-server/src/handlers-page.js +211 -54
- package/packages/mcp-server/src/handlers-utils.js +101 -10
- package/packages/mcp-server/src/handlers.js +14 -7
- package/packages/mcp-server/src/server.js +176 -11
- package/packages/native-host/src/artifact-store.js +353 -0
- package/packages/native-host/src/config.js +9 -1
- package/packages/native-host/src/daemon-logger.js +3 -1
- package/packages/native-host/src/daemon.js +701 -33
- package/packages/native-host/src/native-host.js +28 -3
- package/packages/protocol/src/capability-values.js +2 -0
- package/packages/protocol/src/defaults.js +31 -0
- package/packages/protocol/src/errors.js +102 -6
- package/packages/protocol/src/incidental-sanitizer.js +197 -0
- package/packages/protocol/src/index.js +2 -0
- package/packages/protocol/src/protocol.js +612 -6
- package/packages/protocol/src/recovery-telemetry.js +302 -0
- package/packages/protocol/src/registry.js +206 -38
- package/packages/protocol/src/summary.js +203 -30
- package/packages/protocol/src/types.ts +721 -2
- package/skills/browser-bridge/SKILL.md +54 -19
- package/skills/browser-bridge/references/interaction.md +55 -11
- package/skills/browser-bridge/references/patch-workflow.md +2 -0
- package/skills/browser-bridge/references/protocol.md +265 -86
- package/skills/browser-bridge/references/token-efficiency.md +29 -13
|
@@ -14,7 +14,7 @@ These presets are also available at runtime via `bbx skill`.
|
|
|
14
14
|
|
|
15
15
|
## Debugger Policy
|
|
16
16
|
|
|
17
|
-
Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `dom.get_accessibility_tree`, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance.
|
|
17
|
+
Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `page.handle_dialog`, `dom.get_accessibility_tree`, CDP network capture, CDP input execution, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance. `network.export_har` does not attach by itself, but it requires the explicit CDP capture to remain armed.
|
|
18
18
|
|
|
19
19
|
## Decision Tree
|
|
20
20
|
|
|
@@ -25,14 +25,16 @@ Avoid debugger-backed methods until they are clearly necessary. In Browser Bridg
|
|
|
25
25
|
5. **Need layout metrics?** → `layout.get_box_model` (no budget needed)
|
|
26
26
|
6. **Need styles?** → `styles.get_computed` with explicit `properties` list
|
|
27
27
|
7. **Need runtime errors?** → `page.get_console` with `level: 'error'`
|
|
28
|
-
8. **Need
|
|
29
|
-
9. **Need
|
|
30
|
-
10. **Need
|
|
31
|
-
11. **Need
|
|
32
|
-
12. **Need
|
|
33
|
-
13. **
|
|
34
|
-
14. **
|
|
35
|
-
15. **
|
|
28
|
+
8. **Need article or documentation content?** → `page.extract_content` (removes navigation and repeated chrome)
|
|
29
|
+
9. **Need all visible page UI text?** → `page.get_text` (cheaper than `dom.query` on body)
|
|
30
|
+
10. **Need API call history?** → default `page.get_network` (intercepted fetch/XHR log)
|
|
31
|
+
11. **Need portable all-resource evidence?** → explicitly arm CDP, reproduce, `network.export_har`, then stop capture
|
|
32
|
+
12. **Need framework/app state and no lighter read can expose it?** → `page.evaluate` (debugger-backed)
|
|
33
|
+
13. **Need semantic structure and role/text queries are insufficient?** → compact or interactive-only `dom.get_accessibility_tree` (debugger-backed)
|
|
34
|
+
14. **Need a raw Chrome/CDP counter point sample?** → `performance.get_metrics` (debugger-backed; no BBX navigation window or LCP/CLS/INP measurement)
|
|
35
|
+
15. **Testing responsive with an exact forced viewport?** → `viewport.resize` (debugger-backed)
|
|
36
|
+
16. **Visual ambiguity after structured reads?** → `screenshot.capture_element` first, or `screenshot.capture_region` with a tight crop when one element is not enough (debugger-backed)
|
|
37
|
+
17. **Content-script blocked?** → `cdp.get_document` or `cdp.get_dom_snapshot` (debugger-backed fallback)
|
|
36
38
|
|
|
37
39
|
## Allowlist Strategy
|
|
38
40
|
|
|
@@ -57,7 +59,7 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
|
|
|
57
59
|
| Screenshot before structured read | ~1500 tok wasted | Always `dom.query` or `styles.get_computed` first |
|
|
58
60
|
| Re-querying DOM for same element | ~500 tok/call | Reuse `elementRef` from prior result |
|
|
59
61
|
| Full-page screenshot | ~3000 tok | Use `screenshot.capture_element`, or `screenshot.capture_region` with a tight rect |
|
|
60
|
-
| Requesting
|
|
62
|
+
| Requesting broad computed styles via CDP | ~800 tok | Use `styles.get_computed`; omission returns five core props, or pass 3-8 explicit props |
|
|
61
63
|
| Multiple CLI calls for independent reads | overhead/call | Use `batch` command |
|
|
62
64
|
| Guessing selectors for known labels | ~300 tok wasted/try | Use `dom.find_by_text` or `dom.find_by_role` |
|
|
63
65
|
| Polling page state with repeated queries | ~500 tok/poll | Use `dom.wait_for` (single call, waits async) |
|
|
@@ -68,6 +70,9 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
|
|
|
68
70
|
| Guessing interactive elements from DOM | ~600 tok/try | Use `dom.get_accessibility_tree` for semantic roles |
|
|
69
71
|
| Fetching network via evaluate hacks | ~400 tok | Use `page.get_network` (auto-interceptor) |
|
|
70
72
|
| Full a11y tree with no limits | ~3000 tok | Set `maxNodes` ≤ 50, `maxDepth` ≤ 4 |
|
|
73
|
+
| CDP network capture for API-only traffic | debugger lifecycle | Use default fetch/XHR capture; reserve CDP for all-resource failures |
|
|
74
|
+
| Broad inline HAR export | token/byte pressure | Narrow `urlPattern`/`limit`, or use `delivery: "artifact"`; bounds remove whole entries |
|
|
75
|
+
| Repeated page-state polling for a route | ~500 tok/poll | Use one event-aware `page.wait_for_load_state` URL condition |
|
|
71
76
|
|
|
72
77
|
## Efficient Loop
|
|
73
78
|
|
|
@@ -107,11 +112,12 @@ Install early - the buffer auto-activates on first call. Captured levels: log, w
|
|
|
107
112
|
|
|
108
113
|
## Page Text Instead of DOM Scan
|
|
109
114
|
|
|
110
|
-
When you need
|
|
115
|
+
When you need every visible UI label, use `page.get_text` instead of `dom.query` on `body`. For articles, documentation, or long issues, prefer `page.extract_content` so navigation and repeated chrome are removed first:
|
|
111
116
|
|
|
112
117
|
```bash
|
|
113
118
|
bbx page-text # default 8000 char budget
|
|
114
119
|
bbx page-text 8000 # larger budget for long pages
|
|
120
|
+
bbx call page.extract_content '{"format":"markdown","textBudget":8000}'
|
|
115
121
|
```
|
|
116
122
|
|
|
117
123
|
This is 3–5× cheaper than querying the body's subtree with `dom.query`.
|
|
@@ -127,15 +133,25 @@ bbx network 50 # last 50 entries
|
|
|
127
133
|
|
|
128
134
|
The interceptor auto-installs on first call. Before reproducing an event, call `page.get_network` once with `clear: true` to install capture and remove old entries. Trigger the action, then read again without `clear`. Each entry shows `method`, `url`, `status`, `duration`.
|
|
129
135
|
|
|
136
|
+
Only escalate to `source: "cdp"` when fetch/XHR misses the relevant document, asset, socket, cache, redirect, or failed-resource metadata. CDP must be started before reproduction and explicitly stopped afterward; it holds debugger ownership, tracks in-flight state, and returns a larger entry shape. Its URLs redact credentials, fragments, and query values, and it never returns bodies, cookies, authorization values, or complete headers.
|
|
137
|
+
|
|
138
|
+
For a HAR, export while that capture is still armed, then stop it. Use a narrow
|
|
139
|
+
sanitized-URL `urlPattern` and small `limit` first. Inline delivery removes whole
|
|
140
|
+
oldest entries to meet byte/token bounds rather than truncating fields; inspect
|
|
141
|
+
`truncation`, `dropped`, `abandoned`, and `inflight`. Use `delivery: "artifact"`
|
|
142
|
+
for larger evidence. The five-minute opaque handle is owner-scoped and has no
|
|
143
|
+
browser-host path; `bbx har` downloads, verifies, deletes, and atomically writes
|
|
144
|
+
it on the CLI host through the same client.
|
|
145
|
+
|
|
130
146
|
## Accessibility Tree for Semantic Discovery
|
|
131
147
|
|
|
132
148
|
When you need to understand the page's interactive structure without guessing selectors:
|
|
133
149
|
|
|
134
150
|
```bash
|
|
135
|
-
bbx
|
|
151
|
+
bbx call dom.get_accessibility_tree '{"maxNodes":30,"maxDepth":4,"interactiveOnly":true}'
|
|
136
152
|
```
|
|
137
153
|
|
|
138
|
-
|
|
154
|
+
Filtering before `maxNodes` makes compact/interactive-only output much cheaper than screenshot + OCR. AX depth is always partial and `interactive` is semantic metadata, not current actionability; use role/name to find a DOM ref before input.
|
|
139
155
|
|
|
140
156
|
## Semantic finding Saves Selector Guessing
|
|
141
157
|
|