@browserbridge/bbx 1.7.8 → 1.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/PRIVACY.md +57 -12
  2. package/README.md +19 -8
  3. package/SECURITY.md +12 -0
  4. package/package.json +15 -6
  5. package/packages/agent-client/src/cli-args.js +59 -0
  6. package/packages/agent-client/src/cli-batch.js +121 -58
  7. package/packages/agent-client/src/cli-output.js +8 -1
  8. package/packages/agent-client/src/cli.js +272 -70
  9. package/packages/agent-client/src/client.js +296 -8
  10. package/packages/agent-client/src/command-registry.js +64 -55
  11. package/packages/agent-client/src/config.js +195 -0
  12. package/packages/agent-client/src/content-extract.js +198 -0
  13. package/packages/agent-client/src/npm-self-update.js +305 -0
  14. package/packages/agent-client/src/remotes.js +4 -2
  15. package/packages/agent-client/src/runtime.js +864 -39
  16. package/packages/agent-client/src/types.ts +169 -6
  17. package/packages/mcp-server/src/guidance.js +1 -1
  18. package/packages/mcp-server/src/handlers-capture.js +69 -6
  19. package/packages/mcp-server/src/handlers-dom.js +61 -4
  20. package/packages/mcp-server/src/handlers-navigation.js +2 -1
  21. package/packages/mcp-server/src/handlers-page.js +211 -54
  22. package/packages/mcp-server/src/handlers-utils.js +101 -10
  23. package/packages/mcp-server/src/handlers.js +14 -7
  24. package/packages/mcp-server/src/server.js +176 -11
  25. package/packages/native-host/src/artifact-store.js +353 -0
  26. package/packages/native-host/src/config.js +9 -1
  27. package/packages/native-host/src/daemon-logger.js +3 -1
  28. package/packages/native-host/src/daemon.js +701 -33
  29. package/packages/native-host/src/native-host.js +28 -3
  30. package/packages/protocol/src/capability-values.js +2 -0
  31. package/packages/protocol/src/defaults.js +31 -0
  32. package/packages/protocol/src/errors.js +102 -6
  33. package/packages/protocol/src/incidental-sanitizer.js +197 -0
  34. package/packages/protocol/src/index.js +2 -0
  35. package/packages/protocol/src/protocol.js +612 -6
  36. package/packages/protocol/src/recovery-telemetry.js +302 -0
  37. package/packages/protocol/src/registry.js +206 -38
  38. package/packages/protocol/src/summary.js +203 -30
  39. package/packages/protocol/src/types.ts +721 -2
  40. package/skills/browser-bridge/SKILL.md +54 -19
  41. package/skills/browser-bridge/references/interaction.md +55 -11
  42. package/skills/browser-bridge/references/patch-workflow.md +2 -0
  43. package/skills/browser-bridge/references/protocol.md +265 -86
  44. package/skills/browser-bridge/references/token-efficiency.md +29 -13
@@ -14,7 +14,7 @@ These presets are also available at runtime via `bbx skill`.
14
14
 
15
15
  ## Debugger Policy
16
16
 
17
- Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `dom.get_accessibility_tree`, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance.
17
+ Avoid debugger-backed methods until they are clearly necessary. In Browser Bridge, `page.evaluate`, `page.handle_dialog`, `dom.get_accessibility_tree`, CDP network capture, CDP input execution, `viewport.resize`, `performance.get_metrics`, `screenshot.capture_*`, and `cdp.*` attach `chrome.debugger`, which can make Chrome show its native debugging banner across the running browser instance. `network.export_har` does not attach by itself, but it requires the explicit CDP capture to remain armed.
18
18
 
19
19
  ## Decision Tree
20
20
 
@@ -25,14 +25,16 @@ Avoid debugger-backed methods until they are clearly necessary. In Browser Bridg
25
25
  5. **Need layout metrics?** → `layout.get_box_model` (no budget needed)
26
26
  6. **Need styles?** → `styles.get_computed` with explicit `properties` list
27
27
  7. **Need runtime errors?** → `page.get_console` with `level: 'error'`
28
- 8. **Need full page text?** → `page.get_text` (cheaper than `dom.query` on body)
29
- 9. **Need API call history?** → `page.get_network` (intercepted fetch/XHR log)
30
- 10. **Need framework/app state and no lighter read can expose it?** → `page.evaluate` (debugger-backed)
31
- 11. **Need semantic structure and role/text queries are insufficient?** → `dom.get_accessibility_tree` (debugger-backed)
32
- 12. **Need performance data?** → `performance.get_metrics` (debugger-backed)
33
- 13. **Testing responsive with an exact forced viewport?** → `viewport.resize` (debugger-backed)
34
- 14. **Visual ambiguity after structured reads?** → `screenshot.capture_element` first, or `screenshot.capture_region` with a tight crop when one element is not enough (debugger-backed)
35
- 15. **Content-script blocked?** → `cdp.get_document` or `cdp.get_dom_snapshot` (debugger-backed fallback)
28
+ 8. **Need article or documentation content?** → `page.extract_content` (removes navigation and repeated chrome)
29
+ 9. **Need all visible page UI text?** → `page.get_text` (cheaper than `dom.query` on body)
30
+ 10. **Need API call history?** → default `page.get_network` (intercepted fetch/XHR log)
31
+ 11. **Need portable all-resource evidence?** → explicitly arm CDP, reproduce, `network.export_har`, then stop capture
32
+ 12. **Need framework/app state and no lighter read can expose it?** → `page.evaluate` (debugger-backed)
33
+ 13. **Need semantic structure and role/text queries are insufficient?** → compact or interactive-only `dom.get_accessibility_tree` (debugger-backed)
34
+ 14. **Need a raw Chrome/CDP counter point sample?** → `performance.get_metrics` (debugger-backed; no BBX navigation window or LCP/CLS/INP measurement)
35
+ 15. **Testing responsive with an exact forced viewport?** → `viewport.resize` (debugger-backed)
36
+ 16. **Visual ambiguity after structured reads?** → `screenshot.capture_element` first, or `screenshot.capture_region` with a tight crop when one element is not enough (debugger-backed)
37
+ 17. **Content-script blocked?** → `cdp.get_document` or `cdp.get_dom_snapshot` (debugger-backed fallback)
36
38
 
37
39
  ## Allowlist Strategy
38
40
 
@@ -57,7 +59,7 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
57
59
  | Screenshot before structured read | ~1500 tok wasted | Always `dom.query` or `styles.get_computed` first |
58
60
  | Re-querying DOM for same element | ~500 tok/call | Reuse `elementRef` from prior result |
59
61
  | Full-page screenshot | ~3000 tok | Use `screenshot.capture_element`, or `screenshot.capture_region` with a tight rect |
60
- | Requesting all computed styles | ~800 tok | Set `properties` list (usually 3–8 props) |
62
+ | Requesting broad computed styles via CDP | ~800 tok | Use `styles.get_computed`; omission returns five core props, or pass 3-8 explicit props |
61
63
  | Multiple CLI calls for independent reads | overhead/call | Use `batch` command |
62
64
  | Guessing selectors for known labels | ~300 tok wasted/try | Use `dom.find_by_text` or `dom.find_by_role` |
63
65
  | Polling page state with repeated queries | ~500 tok/poll | Use `dom.wait_for` (single call, waits async) |
@@ -68,6 +70,9 @@ Omitting allowlists or leaving the text budget wide open often returns 3–5× t
68
70
  | Guessing interactive elements from DOM | ~600 tok/try | Use `dom.get_accessibility_tree` for semantic roles |
69
71
  | Fetching network via evaluate hacks | ~400 tok | Use `page.get_network` (auto-interceptor) |
70
72
  | Full a11y tree with no limits | ~3000 tok | Set `maxNodes` ≤ 50, `maxDepth` ≤ 4 |
73
+ | CDP network capture for API-only traffic | debugger lifecycle | Use default fetch/XHR capture; reserve CDP for all-resource failures |
74
+ | Broad inline HAR export | token/byte pressure | Narrow `urlPattern`/`limit`, or use `delivery: "artifact"`; bounds remove whole entries |
75
+ | Repeated page-state polling for a route | ~500 tok/poll | Use one event-aware `page.wait_for_load_state` URL condition |
71
76
 
72
77
  ## Efficient Loop
73
78
 
@@ -107,11 +112,12 @@ Install early - the buffer auto-activates on first call. Captured levels: log, w
107
112
 
108
113
  ## Page Text Instead of DOM Scan
109
114
 
110
- When you need the page's visible text - for summarization, search, or content extraction - use `page.get_text` instead of `dom.query` on `body`:
115
+ When you need every visible UI label, use `page.get_text` instead of `dom.query` on `body`. For articles, documentation, or long issues, prefer `page.extract_content` so navigation and repeated chrome are removed first:
111
116
 
112
117
  ```bash
113
118
  bbx page-text # default 8000 char budget
114
119
  bbx page-text 8000 # larger budget for long pages
120
+ bbx call page.extract_content '{"format":"markdown","textBudget":8000}'
115
121
  ```
116
122
 
117
123
  This is 3–5× cheaper than querying the body's subtree with `dom.query`.
@@ -127,15 +133,25 @@ bbx network 50 # last 50 entries
127
133
 
128
134
  The interceptor auto-installs on first call. Before reproducing an event, call `page.get_network` once with `clear: true` to install capture and remove old entries. Trigger the action, then read again without `clear`. Each entry shows `method`, `url`, `status`, `duration`.
129
135
 
136
+ Only escalate to `source: "cdp"` when fetch/XHR misses the relevant document, asset, socket, cache, redirect, or failed-resource metadata. CDP must be started before reproduction and explicitly stopped afterward; it holds debugger ownership, tracks in-flight state, and returns a larger entry shape. Its URLs redact credentials, fragments, and query values, and it never returns bodies, cookies, authorization values, or complete headers.
137
+
138
+ For a HAR, export while that capture is still armed, then stop it. Use a narrow
139
+ sanitized-URL `urlPattern` and small `limit` first. Inline delivery removes whole
140
+ oldest entries to meet byte/token bounds rather than truncating fields; inspect
141
+ `truncation`, `dropped`, `abandoned`, and `inflight`. Use `delivery: "artifact"`
142
+ for larger evidence. The five-minute opaque handle is owner-scoped and has no
143
+ browser-host path; `bbx har` downloads, verifies, deletes, and atomically writes
144
+ it on the CLI host through the same client.
145
+
130
146
  ## Accessibility Tree for Semantic Discovery
131
147
 
132
148
  When you need to understand the page's interactive structure without guessing selectors:
133
149
 
134
150
  ```bash
135
- bbx a11y-tree 30 3 # 30 nodes, depth 3
151
+ bbx call dom.get_accessibility_tree '{"maxNodes":30,"maxDepth":4,"interactiveOnly":true}'
136
152
  ```
137
153
 
138
- Returns role/name/interactive flag per node. Much cheaper than screenshot + OCR, and more accurate than `dom.query` on generic selectors.
154
+ Filtering before `maxNodes` makes compact/interactive-only output much cheaper than screenshot + OCR. AX depth is always partial and `interactive` is semantic metadata, not current actionability; use role/name to find a DOM ref before input.
139
155
 
140
156
  ## Semantic finding Saves Selector Guessing
141
157