@remcp/runtime 0.2.106 → 0.2.108

package/src/extended/browser.mjs

@@ -1,12 +1,21 @@
 import process from 'node:process';
 import os from 'node:os';
 import path from 'node:path';
+import { isIP } from 'node:net';
+import { lookup } from 'node:dns/promises';
 import { existsSync, mkdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 const DEFAULT_ENDPOINT = 'http://127.0.0.1:9222';
 const MAX_DISCOVERY_BYTES = 8 * 1024 * 1024;
+const MAX_CDP_MESSAGE_BYTES = 16 * 1024 * 1024;
+const MAX_EVALUATION_BYTES = 256 * 1024;
+const BROWSER_PROTOCOLS = new Set(['http:', 'https:']);
+const BLOCKED_BROWSER_SCHEME = /(?:^|[\s"'`(=])(?:file|chrome|devtools|view-source|filesystem|blob|wss?):/i;
+const BLOCKED_BROWSER_NETWORK_API = /\b(?:fetch|WebSocket|EventSource|XMLHttpRequest|sendBeacon)\b/;
+const PRODUCTION_SESSION_IDLE_MS = 10 * 60 * 1000;
+const productionBrowserSessions = new Map();
 
 let browserLaunchPromise = null;
 
@@ -33,6 +42,16 @@ export function browserAutoLaunchAvailable() {
   return Boolean(browserExecutable());
 }
 
+export function browserRemoteEnabled() {
+  const configured = String(process.env.REMCP_BROWSER_REMOTE_ENABLED || '').trim().toLowerCase();
+  if (configured) return ['1', 'true', 'yes', 'on'].includes(configured);
+  return ['development', 'test'].includes(String(process.env.NODE_ENV || '').trim().toLowerCase());
+}
+
+function assertBrowserRemoteEnabled() {
+  if (!browserRemoteEnabled()) throw new Error('Browser control is disabled for remote runtime; set REMCP_BROWSER_REMOTE_ENABLED=1 only on a trusted local runtime');
+}
+
 function browserDataDir() {
   const configured = optionalString(process.env.REMCP_BROWSER_DATA_DIR);
   if (configured) return configured;
@@ -51,6 +70,7 @@ async function waitForBrowserEndpoint(timeoutMs = 5000) {
 }
 
 async function ensureBrowserEndpoint(endpoint) {
+  assertBrowserRemoteEnabled();
   if (endpoint || process.env.REMCP_CDP_URL) return;
   if (await browserCapabilityAvailable(undefined, 250)) return;
   if (!browserLaunchPromise) {
@@ -76,6 +96,8 @@ async function ensureBrowserEndpoint(endpoint) {
 }
 
 export async function browserControlAvailable(endpoint, timeoutMs = 500) {
+  if (!browserRemoteEnabled()) return false;
+  if (process.env.NODE_ENV === 'production' && !productionBrowserPolicyReady()) return false;
   if (await browserCapabilityAvailable(endpoint, timeoutMs)) return true;
   if (endpoint || process.env.REMCP_CDP_URL) return false;
   return browserAutoLaunchAvailable();
@@ -86,11 +108,68 @@ function boundedText(value, max = 1000) {
   return text.length <= max ? text : `${text.slice(0, max)}…`;
 }
 
+function normalizedHost(hostname) {
+  return String(hostname || '').replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
+}
+
 function isLoopbackHost(hostname) {
-  const host = String(hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+  const host = normalizedHost(hostname);
   return ['localhost', '127.0.0.1', '::1'].includes(host);
 }
 
+function localBrowserNavigationAllowed() {
+  if (process.env.NODE_ENV === 'production') return false;
+  return ['REMCP_BROWSER_ALLOW_LOCAL_NAVIGATION', 'REMCP_BROWSER_ALLOW_LOCAL', 'REMCP_ALLOW_LOCAL_BROWSER_NAVIGATION']
+    .some(name => ['1', 'true', 'yes', 'on'].includes(String(process.env[name] || '').trim().toLowerCase()));
+}
+
+function isPrivateIpv4(host) {
+  if (isIP(host) !== 4) return false;
+  const parts = host.split('.').map(Number);
+  const [a, b, c] = parts;
+  return a === 0
+    || a === 10
+    || a === 127
+    || (a === 100 && b >= 64 && b <= 127)
+    || (a === 169 && b === 254)
+    || (a === 172 && b >= 16 && b <= 31)
+    || (a === 192 && b === 0 && c === 0)
+    || (a === 192 && b === 0 && c === 2)
+    || (a === 192 && b === 168)
+    || (a === 198 && (b === 18 || b === 19))
+    || (a === 198 && b === 51 && c === 100)
+    || (a === 203 && b === 0 && c === 113)
+    || a >= 224;
+}
+
+function isPrivateIpv6(host) {
+  if (isIP(host) !== 6) return false;
+  if (host === '::' || host === '::1') return true;
+  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host) || host.startsWith('ff')) return true;
+  const mapped = host.match(/^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mapped) {
+    const high = Number.parseInt(mapped[1], 16);
+    const low = Number.parseInt(mapped[2], 16);
+    return isPrivateIpv4([high >> 8, high & 255, low >> 8, low & 255].join('.'));
+  }
+  return false;
+}
+
+function isPrivateBrowserHost(hostname) {
+  const host = normalizedHost(hostname);
+  if (!host) return true;
+  if (isPrivateIpv4(host) || isPrivateIpv6(host)) return true;
+  return host === 'localhost'
+    || host.endsWith('.localhost')
+    || host.endsWith('.local')
+    || host.endsWith('.internal')
+    || host.endsWith('.home.arpa')
+    || host.endsWith('.lan')
+    || host === 'localhost.localdomain'
+    || host === 'ip6-localhost'
+    || host === 'ip6-loopback';
+}
+
 function endpointUrl(value) {
   let url;
   try { url = new URL(optionalString(value) || process.env.REMCP_CDP_URL || DEFAULT_ENDPOINT); }
@@ -100,13 +179,110 @@ function endpointUrl(value) {
   return url;
 }
 
+function endpointAuthority(url) {
+  const port = url.port || ((url.protocol === 'https:' || url.protocol === 'wss:') ? '443' : '80');
+  return `${normalizedHost(url.hostname)}:${port}`;
+}
+
+function safeBrowserUrl(value, field = 'url') {
+  let url;
+  try { url = new URL(String(value || '')); }
+  catch { throw new Error(`${field} must be a valid absolute URL`); }
+  if (!BROWSER_PROTOCOLS.has(url.protocol)) throw new Error(`${field} must use http or https`);
+  if (url.username || url.password) throw new Error(`${field} must not embed credentials`);
+  if (!localBrowserNavigationAllowed() && isPrivateBrowserHost(url.hostname)) {
+    throw new Error(`${field} must not target loopback, private, or link-local addresses`);
+  }
+  return url.href;
+}
+
+function safePageUrl(value, field = 'browser page URL') {
+  if (String(value || '') === 'about:blank') return value;
+  return safeBrowserUrl(value, field);
+}
+
+function configuredBrowserHosts() {
+  return String(process.env.REMCP_BROWSER_ALLOWED_HOSTS || '')
+    .split(/[,\s]+/)
+    .map(normalizedHost)
+    .filter(Boolean);
+}
+
+function browserHostAllowlisted(host) {
+  return configuredBrowserHosts().some(pattern => pattern === host
+    || (pattern.startsWith('*.') && host.endsWith(pattern.slice(1)) && host.length > pattern.length - 1));
+}
+
+function browserDnsRebindingExplicitlyAllowed() {
+  return ['1', 'true', 'yes', 'on'].includes(String(process.env.REMCP_BROWSER_ALLOW_DNS_REBIND || '').trim().toLowerCase());
+}
+
+function productionBrowserPolicyReady() {
+  const hosts = configuredBrowserHosts();
+  return (hosts.length > 0 && hosts.some(isIP))
+    || (browserDnsRebindingExplicitlyAllowed() && hosts.length > 0);
+}
+
+async function assertResolvedBrowserUrl(value, field = 'browser URL') {
+  const safe = safeBrowserUrl(value, field);
+  if (localBrowserNavigationAllowed() && process.env.NODE_ENV !== 'production') return safe;
+  const host = normalizedHost(new URL(safe).hostname);
+  if (process.env.NODE_ENV === 'production' && !browserHostAllowlisted(host)) {
+    throw new Error(`${field} host is not in REMCP_BROWSER_ALLOWED_HOSTS`);
+  }
+  if (isIP(host) || (host.endsWith('.test') && process.env.NODE_ENV !== 'production')) return safe;
+  if (process.env.NODE_ENV === 'production' && !isIP(host) && !browserDnsRebindingExplicitlyAllowed()) {
+    throw new Error(`${field} requires an IP-literal allowlist in production; set REMCP_BROWSER_ALLOW_DNS_REBIND=1 only with a DNS/egress boundary`);
+  }
+  let addresses;
+  try { addresses = await lookup(host, { all:true, verbatim:true }); }
+  catch (error) { throw new Error(`${field} host could not be resolved safely: ${error instanceof Error ? error.message : String(error)}`); }
+  if (addresses.some(address => isPrivateBrowserHost(address.address))) {
+    throw new Error(`${field} must not resolve to loopback, private, or link-local addresses`);
+  }
+  return safe;
+}
+
+async function assertResolvedPageUrl(value, field = 'browser page URL') {
+  if (String(value || '') === 'about:blank') return value;
+  return assertResolvedBrowserUrl(value, field);
+}
+
+function expressionHasPrivateDestination(expression) {
+  const urls = expression.match(/(?:https?|wss?):\/\/[^\s"'`<>]+/gi) || [];
+  return urls.some(value => {
+    try { return isPrivateBrowserHost(new URL(value).hostname); }
+    catch { return false; }
+  });
+}
+
+function safeEvaluationExpression(value) {
+  const expression = String(value || '');
+  if (!expression.trim()) throw new Error('expression is required');
+  if (expression.includes('\0') || Buffer.byteLength(expression, 'utf8') > MAX_EVALUATION_BYTES) {
+    throw new Error(`expression must be at most ${MAX_EVALUATION_BYTES} bytes`);
+  }
+  if (BLOCKED_BROWSER_SCHEME.test(expression)) throw new Error('expression contains a blocked local browser scheme');
+  if (!localBrowserNavigationAllowed() && (expressionHasPrivateDestination(expression) || BLOCKED_BROWSER_NETWORK_API.test(expression))) {
+    throw new Error('expression contains a blocked private browser destination or network API');
+  }
+  return expression;
+}
+
+async function assertSafeEvaluationExpression(value) {
+  const expression = safeEvaluationExpression(value);
+  const urls = expression.match(/(?:https?|wss?):\/\/[^\s"'`<>]+/gi) || [];
+  await Promise.all(urls.map(url => assertResolvedBrowserUrl(url, 'expression destination')));
+  return expression;
+}
+
 async function requestJson(pathname, endpoint, options = {}) {
   const base = endpointUrl(endpoint);
   const url = new URL(pathname, base);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), clamp(options.timeout_ms, 5000, 100, 30_000));
   try {
-    const response = await fetch(url, { method: options.method || 'GET', signal: controller.signal });
+    const response = await fetch(url, { method: options.method || 'GET', signal: controller.signal, redirect: 'error' });
     if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
     const declared = Number(response.headers.get('content-length') || 0);
     if (declared > MAX_DISCOVERY_BYTES) throw new Error(`CDP discovery response is too large (${declared} bytes)`);
@@ -142,9 +318,33 @@ export async function browserCapabilityAvailable(endpoint, timeoutMs = 500) {
 }
 
 export async function listBrowserTargets(endpoint) {
+  assertBrowserRemoteEnabled();
   await ensureBrowserEndpoint(endpoint);
   const list = await requestJson('/json/list', endpoint);
-  return Array.isArray(list) ? list : [];
+  if (!Array.isArray(list)) return [];
+  const targets = [];
+  for (const item of list) {
+    if (!item || item.type !== 'page' || !item.webSocketDebuggerUrl) continue;
+    try {
+      await assertResolvedPageUrl(item.url);
+      targets.push(item);
+    } catch {}
+  }
+  return targets;
+}
+
+function validatedTargetWebSocketUrl(target, endpoint) {
+  let socketUrl;
+  try { socketUrl = new URL(String(target?.webSocketDebuggerUrl)); }
+  catch { throw new Error('Browser returned an invalid CDP WebSocket URL'); }
+  if (!['ws:', 'wss:'].includes(socketUrl.protocol) || !isLoopbackHost(socketUrl.hostname)) {
+    throw new Error('Browser CDP WebSocket target must be loopback-only');
+  }
+  if (endpointAuthority(socketUrl) !== endpointAuthority(endpoint)
+    || socketUrl.pathname !== `/devtools/page/${encodeURIComponent(String(target.id))}`) {
+    throw new Error('Browser CDP WebSocket target must match the configured loopback page endpoint');
+  }
+  return socketUrl.href;
 }
 
 async function chooseTarget(args = {}) {
@@ -152,19 +352,19 @@ async function chooseTarget(args = {}) {
   const id = optionalString(args.target_id || args.targetId);
   const title = optionalString(args.title);
   const urlContains = optionalString(args.url_contains || args.urlContains);
-  const target = targets.find(item =>
+  const matched = targets.find(item =>
     (!id || item.id === id) &&
     (!title || String(item.title || '').toLowerCase().includes(title.toLowerCase())) &&
     (!urlContains || String(item.url || '').toLowerCase().includes(urlContains.toLowerCase()))
-  ) || targets[0];
-  if (!target) unavailable('Browser control', 'no debuggable page target is available');
-  let socketUrl;
-  try { socketUrl = new URL(String(target.webSocketDebuggerUrl)); }
-  catch { throw new Error('Browser returned an invalid CDP WebSocket URL'); }
-  if (!['ws:', 'wss:'].includes(socketUrl.protocol) || !isLoopbackHost(socketUrl.hostname)) {
-    throw new Error('Browser CDP WebSocket target must be loopback-only');
+  );
+  const hasSelector = Boolean(id || title || urlContains);
+  const target = matched || (hasSelector ? null : targets[0]);
+  if (!target) {
+    if (hasSelector) throw new Error('No browser page target matched the requested selector');
+    unavailable('Browser control', 'no debuggable page target is available');
   }
-  return { ...target, webSocketDebuggerUrl: socketUrl.href };
+  const endpoint = endpointUrl(args.endpoint);
+  return { ...target, webSocketDebuggerUrl: validatedTargetWebSocketUrl(target, endpoint) };
 }
 
 class CdpSession {
@@ -176,15 +376,19 @@ class CdpSession {
     this.pending = new Map();
     this.waiters = new Map();
     this.observers = new Map();
+    this.closed = true;
   }
 
   async open() {
     if (typeof WebSocket !== 'function') throw new Error('This Node.js runtime does not provide WebSocket support');
     await new Promise((resolve, reject) => {
       const socket = new WebSocket(this.url);
-      const timer = setTimeout(() => reject(new Error('CDP websocket connection timed out')), this.timeoutMs);
-      socket.addEventListener('open', () => { clearTimeout(timer); this.socket = socket; resolve(); }, { once: true });
-      socket.addEventListener('error', event => { clearTimeout(timer); reject(new Error(event?.message || 'CDP websocket error')); }, { once: true });
+      const timer = setTimeout(() => {
+        try { socket.close(); } catch {}
+        reject(new Error('CDP websocket connection timed out'));
+      }, this.timeoutMs);
+      socket.addEventListener('open', () => { clearTimeout(timer); this.socket = socket; this.closed = false; resolve(); }, { once: true });
+      socket.addEventListener('error', event => { clearTimeout(timer); try { socket.close(); } catch {}; reject(new Error(event?.message || 'CDP websocket error')); }, { once: true });
       socket.addEventListener('message', event => this.onMessage(event));
       socket.addEventListener('close', () => this.onClose());
     });
@@ -192,11 +396,18 @@ class CdpSession {
   }
 
   onMessage(event) {
+    const raw = String(event.data);
+    if (Buffer.byteLength(raw, 'utf8') > MAX_CDP_MESSAGE_BYTES) {
+      this.close();
+      return;
+    }
     let message;
-    try { message = JSON.parse(String(event.data)); } catch { return; }
-    if (message.id && this.pending.has(message.id)) {
-      const pending = this.pending.get(message.id);
-      this.pending.delete(message.id);
+    try { message = JSON.parse(raw); } catch { return; }
+    const sessionId = String(message.sessionId || '');
+    const pendingKey = message.id ? `${sessionId}:${message.id}` : '';
+    if (message.id && this.pending.has(pendingKey)) {
+      const pending = this.pending.get(pendingKey);
+      this.pending.delete(pendingKey);
       clearTimeout(pending.timer);
       if (message.error) pending.reject(new Error(message.error.message || JSON.stringify(message.error)));
       else pending.resolve(message.result || {});
@@ -205,7 +416,7 @@ class CdpSession {
     const observers = this.observers.get(message.method);
     if (observers) {
       for (const observer of [...observers]) {
-        try { observer(message.params || {}); } catch {}
+        try { observer(message.params || {}, sessionId); } catch {}
       }
     }
     const listeners = this.waiters.get(message.method);
@@ -218,6 +429,7 @@ class CdpSession {
   }
 
   onClose() {
+    this.closed = true;
     for (const pending of this.pending.values()) {
       clearTimeout(pending.timer);
       pending.reject(new Error('CDP websocket closed'));
@@ -245,15 +457,19 @@ class CdpSession {
     };
   }
 
-  send(method, params = {}) {
+  send(method, params = {}, sessionId = '', timeoutMs = this.timeoutMs) {
+    if (this.closed || !this.socket || this.socket.readyState !== 1) {
+      return Promise.reject(new Error('CDP websocket is not open'));
+    }
     const id = this.nextId++;
+    const key = `${sessionId}:${id}`;
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
-        this.pending.delete(id);
+        this.pending.delete(key);
         reject(new Error(`${method} timed out`));
-      }, this.timeoutMs);
-      this.pending.set(id, { resolve, reject, timer });
-      this.socket.send(JSON.stringify({ id, method, params }));
+      }, timeoutMs);
+      this.pending.set(key, { resolve, reject, timer });
+      this.socket.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) }));
     });
   }
 
@@ -272,13 +488,181 @@ class CdpSession {
     });
   }
 
-  close() { try { this.socket?.close(); } catch {} }
+  close() {
+    if (this.closed) return;
+    try { this.socket?.close(); } catch {}
+    this.onClose();
+  }
+}
+
+async function installBrowserRequestGuard(session) {
+  const guardedSessions = new Set();
+  const childSetup = new Map();
+  const enableSession = async sessionId => {
+    if (guardedSessions.has(sessionId)) return;
+    try {
+      await session.send('Network.enable', {}, sessionId, 2000);
+      await session.send('Network.setBlockedURLs', { urls:['ws://*', 'wss://*'] }, sessionId, 2000);
+      await session.send('Fetch.enable', { patterns:[{ urlPattern:'*' }] }, sessionId, 2000);
+      guardedSessions.add(sessionId);
+    } catch (error) {
+      await session.send('Fetch.disable', {}, sessionId, 1000).catch(() => {});
+      throw error;
+    }
+  };
+  const guardChild = params => {
+    const childSessionId = String(params?.sessionId || '');
+    if (!childSessionId) return Promise.resolve();
+    if (childSetup.has(childSessionId)) return childSetup.get(childSessionId);
+    const setup = (async () => {
+      try {
+        await enableSession(childSessionId);
+        await session.send('Runtime.runIfWaitingForDebugger', {}, childSessionId, 2000);
+      } catch {
+        const targetId = params?.targetInfo?.targetId;
+        if (targetId) await session.send('Target.closeTarget', { targetId }, '', 2000).catch(() => {});
+      }
+    })();
+    childSetup.set(childSessionId, setup);
+    return setup;
+  };
+  const removePaused = session.observe('Fetch.requestPaused', (params, eventSessionId) => {
+    const requestId = params?.requestId;
+    const requestUrl = params?.request?.url || '';
+    void (async () => {
+      let allowed = requestUrl === 'about:blank';
+      if (!allowed) {
+        try { await assertResolvedBrowserUrl(requestUrl, 'browser request'); allowed = true; }
+        catch {}
+      }
+      if (!requestId) return;
+      try {
+        if (allowed) await session.send('Fetch.continueRequest', { requestId }, eventSessionId);
+        else await session.send('Fetch.failRequest', { requestId, errorReason:'BlockedByClient' }, eventSessionId);
+      } catch {}
+    })();
+  });
+  const removeAttached = session.observe('Target.attachedToTarget', params => {
+    void guardChild(params);
+  });
+  await enableSession('');
+  if (process.env.NODE_ENV === 'production') {
+    await session.send('Target.setAutoAttach', { autoAttach:true, waitForDebuggerOnStart:true, flatten:true }, '', 2000);
+    const existing = await session.send('Target.getTargets').catch(() => ({ targetInfos:[] }));
+    for (const targetInfo of existing.targetInfos || []) {
+      if (!['worker', 'service_worker', 'shared_worker', 'iframe', 'webview'].includes(targetInfo.type)) continue;
+      const attached = await session.send('Target.attachToTarget', { targetId:targetInfo.targetId, flatten:true }, '', 2000).catch(() => null);
+      if (attached?.sessionId) await guardChild({ sessionId:attached.sessionId, targetInfo });
+    }
+  }
+  return () => {
+    childSetup.clear();
+    removePaused();
+    removeAttached();
+  };
+}
+
+function productionSessionKey(endpoint, target) {
+  return `${endpoint.origin}|${String(target.id)}`;
+}
+
+function closeProductionSession(key, record) {
+  if (!record) return;
+  if (record.timer) clearTimeout(record.timer);
+  record.removeGuard();
+  record.session.send('Fetch.disable').catch(() => {});
+  record.session.close();
+  if (productionBrowserSessions.get(key) === record) productionBrowserSessions.delete(key);
+}
+
+function retainProductionSession(key, session, removeGuard) {
+  const existing = productionBrowserSessions.get(key);
+  if (existing) closeProductionSession(key, existing);
+  const record = { session, removeGuard, timer:null };
+  productionBrowserSessions.set(key, record);
+  const schedule = () => {
+    if (record.timer) clearTimeout(record.timer);
+    record.timer = setTimeout(() => closeProductionSession(key, record), PRODUCTION_SESSION_IDLE_MS);
+    record.timer.unref?.();
+  };
+  record.schedule = schedule;
+  schedule();
+  return record;
+}
+
+async function createGuardedNewTab(url, args) {
+  await ensureBrowserEndpoint(args.endpoint);
+  const created = await requestJson('/json/new', args.endpoint, { method:'PUT', timeout_ms:args.timeout_ms });
+  if (!created?.id) throw new Error('Browser did not return a new page target');
+  const endpoint = endpointUrl(args.endpoint);
+  const target = { ...created, webSocketDebuggerUrl: validatedTargetWebSocketUrl(created, endpoint) };
+  const session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+  let removeGuard = () => {};
+  let productionRecord = null;
+  let productionKey = '';
+  try {
+    removeGuard = await installBrowserRequestGuard(session);
+    if (process.env.NODE_ENV === 'production') {
+      productionKey = productionSessionKey(endpoint, target);
+      productionRecord = retainProductionSession(productionKey, session, removeGuard);
+    }
+    await session.send('Page.enable');
+    const loaded = session.waitFor('Page.loadEventFired', clamp(args.timeout_ms, 15_000, 500, 120_000)).catch(() => null);
+    const navigation = await session.send('Page.navigate', { url });
+    if (loaded) await loaded;
+    const finalUrl = await evaluate(session, 'location.href').catch(() => url);
+    await assertResolvedPageUrl(finalUrl);
+    return { target, navigation, finalUrl };
+  } finally {
+    if (productionRecord) productionRecord.schedule();
+    else {
+      removeGuard();
+      await session.send('Fetch.disable').catch(() => {});
+      session.close();
+    }
+  }
 }
 
 async function withTarget(args, callback) {
   const target = await chooseTarget(args);
-  const session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
-  try { return await callback(session, target); } finally { session.close(); }
+  await assertResolvedPageUrl(target.url);
+  const endpoint = endpointUrl(args.endpoint);
+  const production = process.env.NODE_ENV === 'production';
+  const key = production ? productionSessionKey(endpoint, target) : '';
+  let record = production ? productionBrowserSessions.get(key) : null;
+  if (record?.session?.closed || (record?.session?.socket && record.session.socket.readyState !== 1)) {
+    closeProductionSession(key, record);
+    record = null;
+  }
+  let session = record?.session;
+  let removeGuard = record?.removeGuard || (() => {});
+  if (!session) {
+    session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+    try {
+      removeGuard = await installBrowserRequestGuard(session);
+      if (production) record = retainProductionSession(key, session, removeGuard);
+    } catch (error) {
+      removeGuard();
+      await session.send('Fetch.disable').catch(() => {});
+      session.close();
+      throw error;
+    }
+  }
+  try {
+    const currentUrl = await evaluate(session, 'location.href').catch(() => target.url);
+    await assertResolvedPageUrl(currentUrl);
+    const result = await callback(session, target);
+    const finalUrl = await evaluate(session, 'location.href').catch(() => { throw new Error('Browser page URL could not be verified after the operation'); });
+    await assertResolvedPageUrl(finalUrl);
+    return result;
+  } finally {
+    if (production && record) record.schedule();
+    else {
+      removeGuard();
+      await session.send('Fetch.disable').catch(() => {});
+      session.close();
+    }
+  }
 }
 
 async function evaluate(session, expression, awaitPromise = true) {
@@ -338,16 +722,27 @@ async function waitForHistoryReady(session, expectedUrl, timeoutMs) {
 }
 
 export async function browserNavigate(args = {}) {
-  const url = optionalString(args.url);
-  const action = requireEnum(args.action || (url ? 'url' : 'reload'), 'action', ['url','new_tab','back','forward','reload']);
+  const requestedUrl = optionalString(args.url);
+  const action = requireEnum(args.action || (requestedUrl ? 'url' : 'reload'), 'action', ['url','new_tab','back','forward','reload']);
+  const url = ['url','new_tab'].includes(action) ? await assertResolvedBrowserUrl(requestedUrl, 'url') : null;
   if (['url','new_tab'].includes(action) && !url) throw new Error('url is required when action=url or new_tab');
   if (action === 'new_tab') {
+    if (process.env.NODE_ENV === 'production') {
+      const opened = await createGuardedNewTab(url, args);
+      return jsonResult({
+        target_id: opened.target.id,
+        action,
+        url: opened.finalUrl,
+        title: opened.target.title || '',
+        error_text: opened.navigation?.errorText || null,
+      });
+    }
     await ensureBrowserEndpoint(args.endpoint);
     const created = await requestJson(`/json/new?${encodeURIComponent(url)}`, args.endpoint, { method:'PUT', timeout_ms:args.timeout_ms });
     return jsonResult({
       target_id:created?.id || null,
       action,
-      url:created?.url || url,
+      url:created?.url ? await assertResolvedPageUrl(created.url) : url,
       title:created?.title || '',
     });
   }
@@ -372,7 +767,7 @@ export async function browserNavigate(args = {}) {
       const nextIndex = action === 'back' ? current - 1 : current + 1;
       const entry = Array.isArray(history.entries) ? history.entries[nextIndex] : null;
       if (!entry) throw new Error(`Cannot navigate ${action}: no history entry is available`);
-      historyUrl = entry.url || null;
+      historyUrl = entry.url ? await assertResolvedPageUrl(entry.url, 'history URL') : null;
       await session.send('Page.navigateToHistoryEntry', { entryId: entry.id });
     }
     if (loaded) await loaded;
@@ -380,6 +775,7 @@ export async function browserNavigate(args = {}) {
       await waitForHistoryReady(session, historyUrl, timeoutMs);
     }
     const currentUrl = await evaluate(session, 'location.href').catch(() => url || target.url || null);
+    if (currentUrl) await assertResolvedPageUrl(currentUrl);
     return jsonResult({ target_id: target.id, action, url: currentUrl, frame_id: frameId, error_text: errorText });
   });
 }
@@ -701,6 +1097,7 @@ export async function browserWait(args = {}) {
   const idleMs = clamp(args.idle_ms, 500, 100, 10_000);
   const wanted = optionalString(args.selector || args.text || args.value || args.expression);
   if (['selector','text','url_contains','expression'].includes(condition) && !wanted) throw new Error('selector/text/value/expression is required for this condition');
+  if (condition === 'expression') await assertSafeEvaluationExpression(wanted);
   return withTarget(args, async (session, target) => {
     const started = Date.now();
     const initialUrl = await evaluate(session, 'location.href').catch(() => target.url || '');
@@ -770,8 +1167,8 @@ export async function browserWait(args = {}) {
 }
 
 export async function browserEvaluate(args) {
-  const expression = optionalString(args.expression);
-  if (!expression) throw new Error('expression is required');
+  assertBrowserRemoteEnabled();
+  const expression = await assertSafeEvaluationExpression(args.expression);
   return withTarget(args, async (session, target) => jsonResult({ target_id: target.id, value: await evaluate(session, expression, args.await_promise !== false) }));
 }