@remcp/runtime 0.2.160 → 0.2.162

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.160",
+  "version": "0.2.162",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-session.mjs

@@ -244,6 +244,24 @@ export function productionSessionKey(endpoint, target) {
   return `${endpoint.origin}|${String(target.id)}`;
 }
 
+// A target returned by browser_tabs is already bound to a validated CDP
+// WebSocket. Reuse its guarded live session for subsequent exact-ID actions
+// instead of rediscovering every unrelated Chrome tab on each keypress/click.
+export function findGuardedCachedTarget(args, endpoint) {
+  if (process.env.NODE_ENV !== 'production') return null;
+  const id = optionalString(args?.target_id || args?.targetId);
+  if (!id || args?.title || args?.url_contains || args?.urlContains) return null;
+  const key = endpoint.origin + '|' + id;
+  const record = productionBrowserSessions.get(key);
+  if (!record?.guardInstalled || !record.target || record.targetId !== id
+      || record.target.id !== id || record.session?.closed
+      || record.session?.socket?.readyState !== 1) return null;
+  try {
+    if (validatedTargetWebSocketUrl(record.target, endpoint) !== record.session.url) return null;
+  } catch { return null; }
+  return { key, record, target:record.target };
+}
+
 export function closeProductionSession(key, record) {
   if (!record) return;
   if (record.timer) clearTimeout(record.timer);
@@ -257,10 +275,10 @@ export function closeProductionSession(key, record) {
   if (productionBrowserSessions.get(key) === record) productionBrowserSessions.delete(key);
 }
 
-export function retainProductionSession(key, session, removeGuard, targetId, endpoint, ownedTarget = false) {
+export function retainProductionSession(key, session, removeGuard, targetId, endpoint, ownedTarget = false, target = null) {
   const existing = productionBrowserSessions.get(key);
   if (existing) closeProductionSession(key, existing);
-  const record = { session, removeGuard, targetId, endpoint, ownedTarget, timer:null };
+  const record = { session, removeGuard, targetId, endpoint, ownedTarget, target, guardInstalled:true, timer:null };
   productionBrowserSessions.set(key, record);
   const schedule = () => {
     if (record.timer) clearTimeout(record.timer);
@@ -299,7 +317,7 @@ export async function createGuardedNewTab(url, args) {
     removeGuard = await installBrowserRequestGuard(session, { closeRootTarget:() => closeBrowserTarget(endpoint, target.id) });
     if (process.env.NODE_ENV === 'production') {
       productionKey = productionSessionKey(endpoint, target);
-      productionRecord = retainProductionSession(productionKey, session, removeGuard, target.id, endpoint, true);
+      productionRecord = retainProductionSession(productionKey, session, removeGuard, target.id, endpoint, true, target);
     }
     await session.send('Page.enable');
     const loaded = session.waitFor('Page.loadEventFired', clamp(args.timeout_ms, 15_000, 500, 120_000)).catch(() => null);
@@ -325,15 +343,16 @@ export async function createGuardedNewTab(url, args) {
   }
 }
 
-export async function withTarget(args, callback) {
+export async function withTarget(args = {}, callback) {
   // chooseTarget already validated this exact discovered URL during this call.
   // The actual page URL is independently checked before and after the action.
   // Avoid a redundant DNS check for the same target metadata.
-  const target = await chooseTarget(args);
   const endpoint = endpointUrl(args.endpoint);
+  const cached = findGuardedCachedTarget(args, endpoint);
+  const target = cached?.target || await chooseTarget(args);
   const production = process.env.NODE_ENV === 'production';
   const key = production ? productionSessionKey(endpoint, target) : '';
-  let record = production ? productionBrowserSessions.get(key) : null;
+  let record = cached?.record || (production ? productionBrowserSessions.get(key) : null);
   if (record?.session?.closed || (record?.session?.socket && record.session.socket.readyState !== 1)) {
     closeProductionSession(key, record);
     record = null;
@@ -344,7 +363,7 @@ export async function withTarget(args, callback) {
     try {
       session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
       removeGuard = await installBrowserRequestGuard(session);
-      if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint);
+      if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint, false, target);
     } catch (error) {
       removeGuard();
       if (session) {
@@ -358,7 +377,9 @@ export async function withTarget(args, callback) {
   try {
     const currentUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(currentUrl);
-    const result = await callback(session, target);
+    // A reused target's discovery metadata can be old after navigation.
+    // Pass the just-verified live URL without an extra CDP round-trip.
+    const result = await callback(session, { ...target, url:currentUrl });
     const finalUrl = await evaluate(session, 'location.href').catch(() => { throw new Error('Browser page URL could not be verified after the operation'); });
     await assertResolvedPageUrl(finalUrl);
     return result;

package/src/extended/browser-workflow.mjs

@@ -2,7 +2,7 @@
 // A workflow is explicitly requested by the caller after inspecting the page.
 // No arbitrary JavaScript, cross-target access, file uploads or implicit submits.
 import { assertResolvedPageUrl } from './browser-endpoint.mjs';
-import { callPageFunction, evaluate } from './browser-session.mjs';
+import { evaluate } from './browser-session.mjs';
 
 const ACTIONS = new Set(['fill_form','set_value','select','focus','click','wait_for']);
 const CONDITIONS = new Set(['selector','text','url_contains','load']);
@@ -45,7 +45,28 @@ export function validateBrowserWorkflow(steps, { validateFormFields }) {
   });
 }
 
-async function waitForStep(session, step, started) {
+// A workflow is a single-page plan. Redirects across origins require a new
+// snapshot and a separate deliberate action, even if both URLs are public.
+export function assertWorkflowOrigin(expectedOrigin, currentUrl) {
+  let currentOrigin;
+  try { currentOrigin = new URL(currentUrl).origin; }
+  catch { throw new Error('Browser workflow page origin could not be verified'); }
+  if (expectedOrigin !== null && currentOrigin !== expectedOrigin) {
+    throw new Error('Browser workflow origin changed');
+  }
+  return currentOrigin;
+}
+
+// Enforce the origin in the exact same page JS evaluation that writes a field.
+// Caller-supplied selectors/values stay JSON data, not arbitrary JavaScript.
+async function guardedPageFunction(session, trustedFunction, args, origin) {
+  const expression = '(() => { if (location.origin !== ' + JSON.stringify(origin) +
+    ') throw new Error("workflow_origin_changed"); return (' + trustedFunction +
+    ')(...' + JSON.stringify(args) + '); })()';
+  return evaluate(session, expression);
+}
+
+async function waitForStep(session, step, started, expectedOrigin) {
   const deadline = Math.min(started + 12000, Date.now() + step.timeout_ms);
   const expression = step.condition === 'selector' ?
     'Boolean(document.querySelector('+JSON.stringify(step.criterion)+'))'
@@ -67,7 +88,8 @@ async function waitForStep(session, step, started) {
       await new Promise(resolve=>setTimeout(resolve, 75));
       continue;
     }
-    // Never accept a match on a private or unsafe page.
+    // Never accept a match on an unsafe page or an unexpected origin.
+    assertWorkflowOrigin(expectedOrigin, state?.url);
     await assertResolvedPageUrl(state?.url);
     if (state?.matched) return;
     await new Promise(resolve=>setTimeout(resolve, 75));
@@ -80,25 +102,28 @@ export async function executeBrowserWorkflow(session, steps, {
 }) {
   const started = Date.now();
   const completed = [];
+  let boundOrigin = null;
   for (let index = 0; index < steps.length; index++) {
     const step = steps[index];
     if (Date.now() - started > 12000) throw new Error('Workflow exceeded 12 second budget after '+completed.length+' steps');
     try {
       const currentUrl = await evaluate(session, 'location.href');
+      const currentOrigin = assertWorkflowOrigin(boundOrigin, currentUrl);
       await assertResolvedPageUrl(currentUrl);
+      if (boundOrigin === null) boundOrigin = currentOrigin;
       if (step.action === 'fill_form') {
-        await callPageFunction(session,pageFillForm,[step.fields]);
+        await guardedPageFunction(session,pageFillForm,[step.fields],boundOrigin);
       } else if (step.action === 'wait_for') {
-        await waitForStep(session,step,started);
+        await waitForStep(session,step,started,boundOrigin);
       } else if (step.action === 'click') {
-        const bounds=await callPageFunction(session,pageElementAction,[step.selector,null,'click','']);
+        const bounds=await guardedPageFunction(session,pageElementAction,[step.selector,null,'click',''],boundOrigin);
         const x=Number(bounds.x)+Number(bounds.width)/2;
         const y=Number(bounds.y)+Number(bounds.height)/2;
         await session.send('Input.dispatchMouseEvent',{type:'mouseMoved',x,y,button:'none'});
         await session.send('Input.dispatchMouseEvent',{type:'mousePressed',x,y,button:'left',clickCount:1});
         await session.send('Input.dispatchMouseEvent',{type:'mouseReleased',x,y,button:'left',clickCount:1});
       } else {
-        await callPageFunction(session,pageElementAction,[step.selector,null,step.action,step.value??'']);
+        await guardedPageFunction(session,pageElementAction,[step.selector,null,step.action,step.value??''],boundOrigin);
       }
       completed.push({index:index+1,action:step.action,ok:true});
     } catch (error) {