@remcp/runtime 0.2.163 → 0.2.164

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.163",
+  "version": "0.2.164",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-discovery-flight.mjs

@@ -0,0 +1,17 @@
+// Coalesce *only overlapping* read-only CDP /json/list transport requests.
+// Raw tab metadata is held only until request completion; each caller must
+// re-validate all target URLs/DNS independently before returning any tabs.
+const active = new Map();
+const MAX_ENDPOINTS = 8;
+
+export async function shareBrowserDiscovery(origin, load) {
+  const pending = active.get(origin);
+  if (pending) return pending;
+  if (active.size >= MAX_ENDPOINTS) return load();
+  const work = Promise.resolve().then(load);
+  active.set(origin, work);
+  try { return await work; }
+  finally {
+    if (active.get(origin) === work) active.delete(origin);
+  }
+}

package/src/extended/browser-endpoint.mjs

@@ -6,6 +6,7 @@ import { lookup } from 'node:dns/promises';
 import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
 import { preserveInterruptedBrowserSession } from './browser-session-backup.mjs';
+import { shareBrowserDiscovery } from './browser-discovery-flight.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 
@@ -436,14 +437,16 @@ export async function filterBrowserTargets(list, { validate = assertResolvedPage
   return targets;
 }
 
-export async function listBrowserTargets(endpoint, { targetId = null } = {}) {
+export async function listBrowserTargets(endpoint, { targetId = null, readOnlySingleFlight = false, validate = assertResolvedPageUrl } = {}) {
   assertBrowserRemoteEnabled();
   // Reading tabs and page semantics must not launch a separate Chromium/profile.
   // Only an explicit browser_navigate(action=new_tab) can bootstrap an isolated browser.
   const base = endpointUrl(endpoint); // keeps the CDP address loopback-only
   let list;
   try {
-    list = await requestJson('/json/list', endpoint, { timeout_ms: 1500 });
+    const load = () => requestJson('/json/list', endpoint, { timeout_ms: 1500 });
+    list = readOnlySingleFlight && !base.username && !base.password
+      ? await shareBrowserDiscovery(base.origin, load) : await load();
   } catch (error) {
     const message = String(error?.message || '');
     // Keep HTTP/policy/oversize/malformed-response errors distinct from an unavailable CDP.
@@ -453,7 +456,7 @@ export async function listBrowserTargets(endpoint, { targetId = null } = {}) {
     throw new Error(`${label} is unavailable at ${base.origin}. Read-only browser_tabs and browser_snapshot do not launch a browser. Use ui_snapshot and ui_find for the existing browser window; do not retry this CDP endpoint unchanged. Only browser_navigate(action=new_tab), when explicitly requested, may start a local isolated browser.`);
   }
   // Retain the current bounded concurrent DNS/security checks for up to 1000 tabs.
-  return filterBrowserTargets(list, { targetId });
+  return filterBrowserTargets(list, { targetId, validate });
 }
 
 export function validatedTargetWebSocketUrl(target, endpoint) {

package/src/extended/browser-read.mjs

@@ -14,7 +14,7 @@ import { assertResolvedBrowserUrl, assertResolvedPageUrl, boundedText, endpointU
 import { createGuardedNewTab, evaluate, withTarget } from './browser-session.mjs';
 
 export async function browserTabs(args = {}) {
-  const targets = await listBrowserTargets(args.endpoint);
+  const targets = await listBrowserTargets(args.endpoint, { readOnlySingleFlight:true });
   const pages = targets.filter(item => item.type === 'page').slice(0, 500).map(item => ({
     id: boundedText(item.id, 256),
     title: boundedText(item.title, 1000),