@remcp/runtime 0.2.145 → 0.2.147

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.147 — 2026-10-14
+
+- Accelerated Chrome CDP tab discovery by validating existing page URLs with eight concurrent, bounded DNS/safety workers instead of sequential lookups.
+- Limited enumeration to 1,000 candidate pages and 500 returned tabs while retaining ordering and the existing private-network/unsafe-scheme safety policy.
+- Added regression coverage for concurrent discovery, ordered output, bounded work, and blocked pages; tool schemas and the 83-operation MCP surface remain unchanged.
+
+## 0.2.146 — 2026-10-04
+
+- No local runtime tool behavior or schema changes. This patch keeps `@remcp/runtime` aligned with the ReMCP 0.2.146 OpenAI submission-metadata release.
+- The 83-operation runtime surface and MCP annotations remain unchanged; the release only synchronizes reviewer-facing metadata required by the OpenAI Apps submission form.
+
 ## 0.2.145 — 2026-10-04
 
 - No local runtime tool behavior or schema changes. This patch keeps @remcp/runtime aligned with the ReMCP 0.2.145 Plugin Directory metadata release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.145",
+  "version": "0.2.147",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser.mjs

@@ -317,22 +317,43 @@ export async function browserCapabilityAvailable(endpoint, timeoutMs = 500) {
   }
 }
 
-export async function listBrowserTargets(endpoint) {
-  assertBrowserRemoteEnabled();
-  await ensureBrowserEndpoint(endpoint);
-  const list = await requestJson('/json/list', endpoint);
+// Validating every tab sequentially can require hundreds of serial DNS lookups,
+// making browser_tabs exceed the relay's deadline on machines with many tabs.
+// Keep DNS and security validation, but bound both the work and its concurrency.
+export async function filterBrowserTargets(list, { validate = assertResolvedPageUrl } = {}) {
   if (!Array.isArray(list)) return [];
-  const targets = [];
+  const candidates = [];
   for (const item of list) {
     if (!item || item.type !== 'page' || !item.webSocketDebuggerUrl) continue;
-    try {
-      await assertResolvedPageUrl(item.url);
-      targets.push(item);
-    } catch {}
+    candidates.push(item);
+    if (candidates.length >= 1000) break;
+  }
+  const safe = new Array(candidates.length).fill(false);
+  let cursor = 0;
+  await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, async () => {
+    while (cursor < candidates.length) {
+      const index = cursor++;
+      try {
+        await validate(candidates[index].url);
+        safe[index] = true;
+      } catch {
+        // Exclude unsafe/unresolvable pages without exposing them to the caller.
+      }
+    }
+  }));
+  const targets = [];
+  for (let i = 0; i < candidates.length && targets.length < 500; i++) {
+    if (safe[i]) targets.push(candidates[i]);
   }
   return targets;
 }
 
+export async function listBrowserTargets(endpoint) {
+  assertBrowserRemoteEnabled();
+  await ensureBrowserEndpoint(endpoint);
+  return filterBrowserTargets(await requestJson('/json/list', endpoint));
+}
+
 function validatedTargetWebSocketUrl(target, endpoint) {
   let socketUrl;
   try { socketUrl = new URL(String(target?.webSocketDebuggerUrl)); }