@remcp/runtime 0.2.149 → 0.2.150

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.150 — 2026-10-15
+
+- Read-only browser tab discovery and semantic snapshots no longer auto-launch a separate Chromium browser when CDP is unavailable.
+- Give a clear Accessibility fallback (`ui_snapshot` / `ui_find`) without changing existing typed `structuredContent` for empty and non-empty lists.
+- Keep explicit navigation as the sole browser auto-launch entry point, with existing CDP loopback and target safety controls.
+- Add five regression tests. No new MCP tools or schemas; the 83-operation runtime catalog is preserved.
+
+
 ## 0.2.149 — 2026-10-14
 
 - Automatically snapshot raw, local-only Chromium session files on crashed ReMCP CDP profiles before browser auto-launch; preserve orphaned tabs and prior snapshots without leaking URLs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.149",
+  "version": "0.2.150",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser.mjs

@@ -414,8 +414,22 @@ export async function filterBrowserTargets(list, { validate = assertResolvedPage
 
 export async function listBrowserTargets(endpoint) {
   assertBrowserRemoteEnabled();
-  await ensureBrowserEndpoint(endpoint);
-  return filterBrowserTargets(await requestJson('/json/list', endpoint));
+  // Reading tabs and page semantics must not launch a separate Chromium/profile.
+  // Only an explicit browser_navigate(action=new_tab) can bootstrap an isolated browser.
+  const base = endpointUrl(endpoint); // keeps the CDP address loopback-only
+  let list;
+  try {
+    list = await requestJson('/json/list', endpoint, { timeout_ms: 1500 });
+  } catch (error) {
+    const message = String(error?.message || '');
+    // Keep HTTP/policy/oversize/malformed-response errors distinct from an unavailable CDP.
+    if (!/fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|abort|timed out|network error/i.test(message)) throw error;
+    const configured = Boolean(endpoint || process.env.REMCP_CDP_URL);
+    const label = configured ? 'The configured CDP endpoint' : 'Browser CDP endpoint';
+    throw new Error(`${label} is unavailable at ${base.origin}. Read-only browser_tabs and browser_snapshot do not launch a browser. Use ui_snapshot and ui_find for the existing browser window; do not retry this CDP endpoint unchanged. Only browser_navigate(action=new_tab), when explicitly requested, may start a local isolated browser.`);
+  }
+  // Retain the current bounded concurrent DNS/security checks for up to 1000 tabs.
+  return filterBrowserTargets(list);
 }
 
 function validatedTargetWebSocketUrl(target, endpoint) {
@@ -855,12 +869,18 @@ async function callPageFunction(session, functionDeclaration, args = [], awaitPr
 
 export async function browserTabs(args = {}) {
   const targets = await listBrowserTargets(args.endpoint);
-  return jsonResult(targets.filter(item => item.type === 'page').slice(0, 500).map(item => ({
+  const pages = targets.filter(item => item.type === 'page').slice(0, 500).map(item => ({
     id: boundedText(item.id, 256),
     title: boundedText(item.title, 1000),
     url: boundedText(item.url, 4096),
     description: boundedText(item.description, 1000),
-  })));
+  }));
+  const result = jsonResult(pages);
+  // Keep the typed empty-array contract while providing a native fallback hint.
+  if (!pages.length) {
+    result.content = [{ type: 'text', text: 'CDP is connected, but no debuggable Chromium tabs are available. Use ui_snapshot and ui_find to inspect existing browser windows without CDP; only open a new tab when explicitly requested.' }];
+  }
+  return result;
 }
 
 async function waitForHistoryReady(session, expectedUrl, timeoutMs) {