@remcp/runtime 0.2.163 → 0.2.165

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.165 — 2026-10-18
+
+**Crash-session recovery without losing browser automation when the local snapshot budget fills.**
+
+- When the dedicated Chromium profile already has 12 interrupted-session backups, preserve its tabs and all evidence and start a single, owner-only isolated browser profile instead of failing to launch.
+- Reuse the isolated profile across subsequent starts; never copy credentials or account state. Emit a local warning that sign-in state is not shared.
+- Still fail closed on unsafe symlinks, oversized evidence, unowned recovery directories or exhausted isolated-profile recovery capacity. No automatic deletion of backups.
+- Keep 83 runtime operations, the ten hosted MCP definitions, URL/DNS/SSRF checks and authorization boundaries unchanged. Add regression tests for full-capacity and unsafe-profile cases.
+
 ## 0.2.154 — 2026-10-17
 
 **ReMCP Gray v2 brand parity release.** The runtime tool contract remains at 83 operations with unchanged permissions and I/O semantics. The coordinated public client and OpenAI submission assets receive the owner-provided gray identity.

package/README.md

@@ -64,7 +64,7 @@ discovery for new clients.
 
 For browser typing, `browser_text` is the visible DOM locator while `text` is the Unicode payload. `browser_action(action="scroll")` accepts page/element deltas or direction/wheel steps and scrolls the page or nearest scrollable ancestor; `scroll_into_view` remains the separate semantic reveal operation.
 
-When ReMCP auto-launches Chrome/Edge for local CDP, it uses a dedicated ReMCP browser profile. If that browser was interrupted (for example during an agent upgrade), and Chromium has saved tabs in that profile, the next launch requests Chromium's own last-session restoration instead of opening a new `about:blank` tab. A clean browser shutdown never triggers automatic reopening. This inspects only local session metadata, never reads or transmits tab URLs to ReMCP's relay. The browser itself controls which tabs can actually be recovered. On an interrupted profile, ReMCP now saves a private, local-only snapshot of `Session_*` and `Tabs_*` files before Chromium can rotate them on startup, even when only tab files remain. Recovery snapshots are adjacent to the dedicated browser profile in a `browser-cdp-recovery/` directory (owner-only on Unix); existing snapshots are never deleted automatically. Copy limits are 16 regular files, 32 MiB per file, 64 MiB per snapshot and 12 distinct snapshots. If evidence cannot be protected safely (for example due to symlinks, storage exhaustion or the snapshot limit), browser auto-launch fails rather than silently overwriting its only recoverable copy. No session URLs are parsed, returned through tools, or uploaded. You can review and manage those local snapshots yourself.
+When ReMCP auto-launches Chrome/Edge for local CDP, it uses a dedicated ReMCP browser profile. If that browser was interrupted (for example during an agent upgrade), and Chromium has saved tabs in that profile, the next launch requests Chromium's own last-session restoration instead of opening a new `about:blank` tab. A clean browser shutdown never triggers automatic reopening. This inspects only local session metadata, never reads or transmits tab URLs to ReMCP's relay. The browser itself controls which tabs can actually be recovered. On an interrupted profile, ReMCP now saves a private, local-only snapshot of `Session_*` and `Tabs_*` files before Chromium can rotate them on startup, even when only tab files remain. Recovery snapshots are adjacent to the dedicated browser profile in a `browser-cdp-recovery/` directory (owner-only on Unix); existing snapshots are never deleted automatically. Copy limits are 16 regular files, 32 MiB per file, 64 MiB per snapshot and 12 distinct snapshots. If the primary profile reaches the 12-snapshot limit, ReMCP switches to one separate owner-only isolated browser profile rather than overwriting prior recovery evidence. The original profile, its tabs and backups remain on disk; credentials and sign-in state are **not** copied into the isolated profile, and a warning is logged. Subsequent launches reuse that isolated profile. If either profile has unsafe evidence (for example symlinks or oversized files) or the isolated profile also reaches its recovery limit, browser auto-launch fails closed. No session URLs are parsed, returned through tools, or uploaded. You can review and manage those local snapshots yourself.
 
 For frontend QA, use semantic data to operate the page and rendered pixels to verify it: `browser_action(action="set_viewport")` sets an exact responsive-test viewport, `browser_wait` waits for the real application state, and `browser_snapshot(include_screenshot=true, selector=...)` recenters the component, returns its bounds, and attaches the real CDP-rendered viewport PNG. This intentionally treats screenshots as the visual oracle without making screenshot-driven coordinate guessing the primary control path.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.163",
+  "version": "0.2.165",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-discovery-flight.mjs

@@ -0,0 +1,17 @@
+// Coalesce *only overlapping* read-only CDP /json/list transport requests.
+// Raw tab metadata is held only until request completion; each caller must
+// re-validate all target URLs/DNS independently before returning any tabs.
+const active = new Map();
+const MAX_ENDPOINTS = 8;
+
+export async function shareBrowserDiscovery(origin, load) {
+  const pending = active.get(origin);
+  if (pending) return pending;
+  if (active.size >= MAX_ENDPOINTS) return load();
+  const work = Promise.resolve().then(load);
+  active.set(origin, work);
+  try { return await work; }
+  finally {
+    if (active.get(origin) === work) active.delete(origin);
+  }
+}

package/src/extended/browser-endpoint.mjs

@@ -5,7 +5,8 @@ import { isIP } from 'node:net';
 import { lookup } from 'node:dns/promises';
 import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
-import { preserveInterruptedBrowserSession } from './browser-session-backup.mjs';
+import { selectSafeBrowserLaunchProfile } from './browser-session-backup.mjs';
+import { shareBrowserDiscovery } from './browser-discovery-flight.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 
@@ -153,8 +154,9 @@ export async function ensureBrowserEndpoint(endpoint) {
       mkdirSync(profile, { recursive:true, mode:0o700 });
       // Chrome rotates its Sessions/ files on startup. Protect existing local
       // evidence before a restart, including profiles with only Tabs_* left.
-      preserveInterruptedBrowserSession(profile);
-      spawnDetached(executable, browserAutoLaunchArgs(profile));
+      const selected = selectSafeBrowserLaunchProfile(profile);
+      if (selected.isolated) console.warn('ReMCP browser: using an isolated recovery profile; existing session and backups are preserved, and sign-in state is not copied.');
+      spawnDetached(executable, browserAutoLaunchArgs(selected.profile));
       if (!await waitForBrowserEndpoint(5000)) throw new Error('ReMCP launched a browser but its local CDP endpoint did not become ready');
     })().finally(() => { browserLaunchPromise = null; });
   }
@@ -436,14 +438,16 @@ export async function filterBrowserTargets(list, { validate = assertResolvedPage
   return targets;
 }
 
-export async function listBrowserTargets(endpoint, { targetId = null } = {}) {
+export async function listBrowserTargets(endpoint, { targetId = null, readOnlySingleFlight = false, validate = assertResolvedPageUrl } = {}) {
   assertBrowserRemoteEnabled();
   // Reading tabs and page semantics must not launch a separate Chromium/profile.
   // Only an explicit browser_navigate(action=new_tab) can bootstrap an isolated browser.
   const base = endpointUrl(endpoint); // keeps the CDP address loopback-only
   let list;
   try {
-    list = await requestJson('/json/list', endpoint, { timeout_ms: 1500 });
+    const load = () => requestJson('/json/list', endpoint, { timeout_ms: 1500 });
+    list = readOnlySingleFlight && !base.username && !base.password
+      ? await shareBrowserDiscovery(base.origin, load) : await load();
   } catch (error) {
     const message = String(error?.message || '');
     // Keep HTTP/policy/oversize/malformed-response errors distinct from an unavailable CDP.
@@ -453,7 +457,7 @@ export async function listBrowserTargets(endpoint, { targetId = null } = {}) {
     throw new Error(`${label} is unavailable at ${base.origin}. Read-only browser_tabs and browser_snapshot do not launch a browser. Use ui_snapshot and ui_find for the existing browser window; do not retry this CDP endpoint unchanged. Only browser_navigate(action=new_tab), when explicitly requested, may start a local isolated browser.`);
   }
   // Retain the current bounded concurrent DNS/security checks for up to 1000 tabs.
-  return filterBrowserTargets(list, { targetId });
+  return filterBrowserTargets(list, { targetId, validate });
 }
 
 export function validatedTargetWebSocketUrl(target, endpoint) {

package/src/extended/browser-read.mjs

@@ -14,7 +14,7 @@ import { assertResolvedBrowserUrl, assertResolvedPageUrl, boundedText, endpointU
 import { createGuardedNewTab, evaluate, withTarget } from './browser-session.mjs';
 
 export async function browserTabs(args = {}) {
-  const targets = await listBrowserTargets(args.endpoint);
+  const targets = await listBrowserTargets(args.endpoint, { readOnlySingleFlight:true });
   const pages = targets.filter(item => item.type === 'page').slice(0, 500).map(item => ({
     id: boundedText(item.id, 256),
     title: boundedText(item.title, 1000),

package/src/extended/browser-session-backup.mjs

@@ -42,7 +42,8 @@ function safeDirectory(dir) {
   if (process.platform === 'win32' && lstatSync(dir).isSymbolicLink()) throw new Error('Unsafe recovery directory');
   const fd = openSync(dir, constants.O_RDONLY | DIRECTORY | NOFOLLOW);
   try {
-    if (!fstatSync(fd).isDirectory()) throw new Error('Unsafe recovery directory');
+    const stat = fstatSync(fd);
+    if (!stat.isDirectory() || (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())) throw new Error('Unsafe recovery directory');
     if (process.platform !== 'win32') fchmodSync(fd, 0o700);
   } finally { closeSync(fd); }
 }
@@ -133,3 +134,28 @@ export function preserveInterruptedBrowserSession(profile) {
     }
   } finally { if (dirFd !== undefined) closeSync(dirFd); }
 }
+
+// Never overwrite an interrupted Chromium profile when its recovery evidence
+// is at capacity. One sibling profile keeps automation available while
+// retaining the original profile and all snapshot files untouched.
+export function selectSafeBrowserLaunchProfile(profile) {
+  const isolated = profile + '-isolated';
+  let prior = false;
+  try { lstatSync(isolated); prior = true; }
+  catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  if (prior) {
+    safeDirectory(isolated);
+    preserveInterruptedBrowserSession(isolated);
+    return { profile: isolated, isolated: true };
+  }
+  try {
+    preserveInterruptedBrowserSession(profile);
+    return { profile, isolated: false };
+  } catch (error) {
+    if (error?.message !== 'Session recovery snapshot limit reached') throw error;
+    // Never prune user-owned session recovery evidence.
+    safeDirectory(isolated);
+    preserveInterruptedBrowserSession(isolated);
+    return { profile: isolated, isolated: true };
+  }
+}