@remcp/runtime 0.2.146 → 0.2.148

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.148 — 2026-10-14
+
+- Request Chromium-native `--restore-last-session` only when the dedicated ReMCP browser profile has a crashed exit marker and persisted tab session files.
+- Preserve intentional clean browser shutdown and first-run behavior; avoid following symlinked session directories or files.
+- Use atomic file-descriptor validation for local session metadata to avoid check-then-open file races (CodeQL TOCTOU).
+- Add cross-platform regression coverage for interrupted, clean, missing, malformed, new, and symlinked browser session profiles.
+- No new tools or MCP schema changes.
+
+## 0.2.147 — 2026-10-14
+
+- Accelerated Chrome CDP tab discovery by validating existing page URLs with eight concurrent, bounded DNS/safety workers instead of sequential lookups.
+- Limited enumeration to 1,000 candidate pages and 500 returned tabs while retaining ordering and the existing private-network/unsafe-scheme safety policy.
+- Added regression coverage for concurrent discovery, ordered output, bounded work, and blocked pages; tool schemas and the 83-operation MCP surface remain unchanged.
+
 ## 0.2.146 — 2026-10-04
 
 - No local runtime tool behavior or schema changes. This patch keeps `@remcp/runtime` aligned with the ReMCP 0.2.146 OpenAI submission-metadata release.

package/README.md

@@ -64,6 +64,8 @@ discovery for new clients.
 
 For browser typing, `browser_text` is the visible DOM locator while `text` is the Unicode payload. `browser_action(action="scroll")` accepts page/element deltas or direction/wheel steps and scrolls the page or nearest scrollable ancestor; `scroll_into_view` remains the separate semantic reveal operation.
 
+When ReMCP auto-launches Chrome/Edge for local CDP, it uses a dedicated ReMCP browser profile. If that browser was interrupted (for example during an agent upgrade), and Chromium has saved tabs in that profile, the next launch requests Chromium's own last-session restoration instead of opening a new `about:blank` tab. A clean browser shutdown never triggers automatic reopening. This inspects only local session metadata, never reads or transmits tab URLs to ReMCP's relay. The browser itself controls which tabs can actually be recovered.
+
 For frontend QA, use semantic data to operate the page and rendered pixels to verify it: `browser_action(action="set_viewport")` sets an exact responsive-test viewport, `browser_wait` waits for the real application state, and `browser_snapshot(include_screenshot=true, selector=...)` recenters the component, returns its bounds, and attaches the real CDP-rendered viewport PNG. This intentionally treats screenshots as the visual oracle without making screenshot-driven coordinate guessing the primary control path.
 
 `set_config_value` remains deliberately narrow: it can change only `telemetryEnabled`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.146",
+  "version": "0.2.148",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { isIP } from 'node:net';
 import { lookup } from 'node:dns/promises';
-import { existsSync, mkdirSync } from 'node:fs';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
@@ -60,6 +60,75 @@ function browserDataDir() {
   return path.join(process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share'), 'remcp', 'browser-cdp');
 }
 
+// Browser sessions belong to the local user, not to the lifetime of the ReMCP
+// agent. The agent can be restarted by an npm update while Chrome is open.
+// If Chrome was interrupted and already persisted tabs, ask Chromium itself to
+// restore the session. Never parse, persist, or relay the sensitive tab URLs.
+// A clean user-initiated quit must not resurrect a deliberately closed session.
+export function shouldRestoreBrowserSession(profile) {
+  let prefsFd;
+  let sessionFd;
+  try {
+    const defaultProfile = path.join(profile, 'Default');
+    // Open first, then validate the file descriptor: checking the path with
+    // lstat before reading it creates a symlink-swap TOCTOU vulnerability.
+    prefsFd = openSync(path.join(defaultProfile, 'Preferences'),
+      fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW || 0));
+    const prefsStat = fstatSync(prefsFd);
+    if (!prefsStat.isFile() || prefsStat.size > 4 * 1024 * 1024) return false;
+    const prefs = JSON.parse(readFileSync(prefsFd, 'utf8'));
+    if (prefs?.profile?.exit_type !== 'Crashed') return false;
+
+    const sessionDir = path.join(defaultProfile, 'Sessions');
+    let readableDir = sessionDir;
+    if (process.platform !== 'win32') {
+      // Use the opened directory even if another process renames the path.
+      // O_NOFOLLOW refuses a linked Sessions directory on Unix platforms.
+      sessionFd = openSync(sessionDir,
+        fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY || 0) | (fsConstants.O_NOFOLLOW || 0));
+      if (!fstatSync(sessionFd).isDirectory()) return false;
+      readableDir = `${process.platform === 'darwin' ? '/dev/fd' : '/proc/self/fd'}/${sessionFd}`;
+    }
+    return readdirSync(readableDir).some(name => {
+      if (!/^Tabs_\d+$/.test(name)) return false;
+      let tabFd;
+      try {
+        tabFd = openSync(path.join(readableDir, name),
+          fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW || 0));
+        const stat = fstatSync(tabFd);
+        return stat.isFile() && stat.size > 0;
+      } catch { return false; }
+      finally { if (tabFd !== undefined) closeSync(tabFd); }
+    });
+  } catch {
+    // A new, malformed or inaccessible profile must start fresh, not fail CDP.
+    return false;
+  } finally {
+    if (sessionFd !== undefined) closeSync(sessionFd);
+    if (prefsFd !== undefined) closeSync(prefsFd);
+  }
+}
+
+export function browserAutoLaunchArgs(profile, {
+  platform = process.platform,
+  display = process.env.DISPLAY,
+  waylandDisplay = process.env.WAYLAND_DISPLAY,
+} = {}) {
+  const restore = shouldRestoreBrowserSession(profile);
+  const args = [
+    '--remote-debugging-address=127.0.0.1',
+    '--remote-debugging-port=9222',
+    `--user-data-dir=${profile}`,
+    '--no-first-run',
+    '--no-default-browser-check',
+    // --restore-last-session only for an interrupted, persisted local profile.
+    // An explicit about:blank startup URL would suppress the normal restore.
+    ...(restore ? ['--restore-last-session'] : ['about:blank']),
+  ];
+  if (platform === 'linux' && !display && !waylandDisplay) args.unshift('--headless=new');
+  return args;
+}
+
 async function waitForBrowserEndpoint(timeoutMs = 5000) {
   const deadline = Date.now() + timeoutMs;
   do {
@@ -79,16 +148,7 @@ async function ensureBrowserEndpoint(endpoint) {
       if (!executable) throw new Error('Browser control is unavailable: no supported Chrome, Edge, or Chromium executable was found');
       const profile = browserDataDir();
       mkdirSync(profile, { recursive:true, mode:0o700 });
-      const args = [
-        '--remote-debugging-address=127.0.0.1',
-        '--remote-debugging-port=9222',
-        `--user-data-dir=${profile}`,
-        '--no-first-run',
-        '--no-default-browser-check',
-        'about:blank',
-      ];
-      if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) args.unshift('--headless=new');
-      spawnDetached(executable, args);
+      spawnDetached(executable, browserAutoLaunchArgs(profile));
       if (!await waitForBrowserEndpoint(5000)) throw new Error('ReMCP launched a browser but its local CDP endpoint did not become ready');
     })().finally(() => { browserLaunchPromise = null; });
   }
@@ -317,22 +377,43 @@ export async function browserCapabilityAvailable(endpoint, timeoutMs = 500) {
   }
 }
 
-export async function listBrowserTargets(endpoint) {
-  assertBrowserRemoteEnabled();
-  await ensureBrowserEndpoint(endpoint);
-  const list = await requestJson('/json/list', endpoint);
+// Validating every tab sequentially can require hundreds of serial DNS lookups,
+// making browser_tabs exceed the relay's deadline on machines with many tabs.
+// Keep DNS and security validation, but bound both the work and its concurrency.
+export async function filterBrowserTargets(list, { validate = assertResolvedPageUrl } = {}) {
   if (!Array.isArray(list)) return [];
-  const targets = [];
+  const candidates = [];
   for (const item of list) {
     if (!item || item.type !== 'page' || !item.webSocketDebuggerUrl) continue;
-    try {
-      await assertResolvedPageUrl(item.url);
-      targets.push(item);
-    } catch {}
+    candidates.push(item);
+    if (candidates.length >= 1000) break;
+  }
+  const safe = new Array(candidates.length).fill(false);
+  let cursor = 0;
+  await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, async () => {
+    while (cursor < candidates.length) {
+      const index = cursor++;
+      try {
+        await validate(candidates[index].url);
+        safe[index] = true;
+      } catch {
+        // Exclude unsafe/unresolvable pages without exposing them to the caller.
+      }
+    }
+  }));
+  const targets = [];
+  for (let i = 0; i < candidates.length && targets.length < 500; i++) {
+    if (safe[i]) targets.push(candidates[i]);
   }
   return targets;
 }
 
+export async function listBrowserTargets(endpoint) {
+  assertBrowserRemoteEnabled();
+  await ensureBrowserEndpoint(endpoint);
+  return filterBrowserTargets(await requestJson('/json/list', endpoint));
+}
+
 function validatedTargetWebSocketUrl(target, endpoint) {
   let socketUrl;
   try { socketUrl = new URL(String(target?.webSocketDebuggerUrl)); }