@remcp/runtime 0.2.165 → 0.2.167

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.165",
+  "version": "0.2.167",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-endpoint.mjs

@@ -3,9 +3,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { isIP } from 'node:net';
 import { lookup } from 'node:dns/promises';
-import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, mkdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
 import { selectSafeBrowserLaunchProfile } from './browser-session-backup.mjs';
+import { shouldRestoreBrowserSession } from './browser-session-directory.mjs';
 import { shareBrowserDiscovery } from './browser-discovery-flight.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
@@ -64,54 +65,7 @@ export function browserDataDir() {
   return path.join(process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share'), 'remcp', 'browser-cdp');
 }
 
-// Browser sessions belong to the local user, not to the lifetime of the ReMCP
-// agent. The agent can be restarted by an npm update while Chrome is open.
-// If Chrome was interrupted and already persisted tabs, ask Chromium itself to
-// restore the session. Never parse, persist, or relay the sensitive tab URLs.
-// A clean user-initiated quit must not resurrect a deliberately closed session.
-export function shouldRestoreBrowserSession(profile) {
-  let prefsFd;
-  let sessionFd;
-  try {
-    const defaultProfile = path.join(profile, 'Default');
-    // Open first, then validate the file descriptor: checking the path with
-    // lstat before reading it creates a symlink-swap TOCTOU vulnerability.
-    prefsFd = openSync(path.join(defaultProfile, 'Preferences'),
-      fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW || 0));
-    const prefsStat = fstatSync(prefsFd);
-    if (!prefsStat.isFile() || prefsStat.size > 4 * 1024 * 1024) return false;
-    const prefs = JSON.parse(readFileSync(prefsFd, 'utf8'));
-    if (prefs?.profile?.exit_type !== 'Crashed') return false;
-
-    const sessionDir = path.join(defaultProfile, 'Sessions');
-    let readableDir = sessionDir;
-    if (process.platform !== 'win32') {
-      // Use the opened directory even if another process renames the path.
-      // O_NOFOLLOW refuses a linked Sessions directory on Unix platforms.
-      sessionFd = openSync(sessionDir,
-        fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY || 0) | (fsConstants.O_NOFOLLOW || 0));
-      if (!fstatSync(sessionFd).isDirectory()) return false;
-      readableDir = `${process.platform === 'darwin' ? '/dev/fd' : '/proc/self/fd'}/${sessionFd}`;
-    }
-    return readdirSync(readableDir).some(name => {
-      if (!/^Tabs_\d+$/.test(name)) return false;
-      let tabFd;
-      try {
-        tabFd = openSync(path.join(readableDir, name),
-          fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW || 0));
-        const stat = fstatSync(tabFd);
-        return stat.isFile() && stat.size > 0;
-      } catch { return false; }
-      finally { if (tabFd !== undefined) closeSync(tabFd); }
-    });
-  } catch {
-    // A new, malformed or inaccessible profile must start fresh, not fail CDP.
-    return false;
-  } finally {
-    if (sessionFd !== undefined) closeSync(sessionFd);
-    if (prefsFd !== undefined) closeSync(prefsFd);
-  }
-}
+export { shouldRestoreBrowserSession };
 
 export function browserAutoLaunchArgs(profile, {
   platform = process.platform,
@@ -144,8 +98,8 @@ export async function waitForBrowserEndpoint(timeoutMs = 5000) {
 
 export async function ensureBrowserEndpoint(endpoint) {
   assertBrowserRemoteEnabled();
-  if (endpoint || process.env.REMCP_CDP_URL) return;
-  if (await browserCapabilityAvailable(undefined, 250)) return;
+  if (endpoint || process.env.REMCP_CDP_URL) return false;
+  if (await browserCapabilityAvailable(undefined, 250)) return false;
   if (!browserLaunchPromise) {
     browserLaunchPromise = (async () => {
       const executable = browserExecutable();
@@ -158,9 +112,10 @@ export async function ensureBrowserEndpoint(endpoint) {
       if (selected.isolated) console.warn('ReMCP browser: using an isolated recovery profile; existing session and backups are preserved, and sign-in state is not copied.');
       spawnDetached(executable, browserAutoLaunchArgs(selected.profile));
       if (!await waitForBrowserEndpoint(5000)) throw new Error('ReMCP launched a browser but its local CDP endpoint did not become ready');
+      return true;
     })().finally(() => { browserLaunchPromise = null; });
   }
-  await browserLaunchPromise;
+  return browserLaunchPromise;
 }
 
 export async function browserControlAvailable(endpoint, timeoutMs = 500) {
@@ -239,11 +194,17 @@ export function isPrivateBrowserHost(hostname) {
 }
 
 export function endpointUrl(value) {
+  if (value != null && typeof value !== 'string' && !(value instanceof URL)) {
+    throw new Error('endpoint must be a valid local http(s) URL');
+  }
   let url;
-  try { url = new URL(optionalString(value) || process.env.REMCP_CDP_URL || DEFAULT_ENDPOINT); }
-  catch { throw new Error('endpoint must be a valid local http(s) URL'); }
+  try {
+    const provided = value instanceof URL ? value.href : optionalString(value);
+    url = new URL(provided || process.env.REMCP_CDP_URL || DEFAULT_ENDPOINT);
+  } catch { throw new Error('endpoint must be a valid local http(s) URL'); }
   if (!['http:', 'https:'].includes(url.protocol)) throw new Error('endpoint must use http or https');
   if (!isLoopbackHost(url.hostname)) throw new Error('Browser CDP endpoint must be loopback-only');
+  if (url.username || url.password) throw new Error('Browser CDP endpoint must not contain credentials');
   return url;
 }
 

package/src/extended/browser-read.mjs

@@ -98,18 +98,62 @@ export async function browserNavigate(args = {}) {
   });
 }
 
+// CDP accessibility can include an input's current value even when it is
+// masked on screen. The protected AX property must be checked before the
+// node is mirrored to structuredContent or snapshot diff state.
+export function safeAccessibilityValue(node) {
+  const props = Array.isArray(node?.properties) ? node.properties : [];
+  const protectedControl = props.some(item => item?.name === 'protected'
+    && (item?.value?.value === true || String(item?.value?.value) === 'true'));
+  const role = String(node?.role?.value || '').toLowerCase();
+  if (protectedControl || role === 'password' || role === 'passwordtext') return '';
+  return boundedText(node?.value?.value, 1000);
+}
+
+// Chromium's AX tree can repeat editable input values in descendant
+// StaticText/InlineTextBox names. Blank the complete editable subtree before
+// storing a snapshot diff or sending structured content to the MCP host.
+export function sensitiveAccessibilityDescendants(nodes) {
+  const indexed = new Map(nodes.map(node => [node.nodeId, node]));
+  const secret = new Set();
+  const queue = [];
+  for (const node of nodes) {
+    const role = String(node.role?.value || '').toLowerCase();
+    const properties = Array.isArray(node.properties) ? node.properties : [];
+    const editable = properties.some(item => item?.name === 'editable'
+      && ![false,'false',null].includes(item?.value?.value));
+    const protectedNode = properties.some(item => item?.name === 'protected'
+      && [true,'true'].includes(item?.value?.value));
+    if (['textbox','searchbox','combobox','password','passwordtext','spinbutton'].includes(role)
+      || editable || protectedNode) {
+      secret.add(node.nodeId);
+      for (const id of node.childIds || []) queue.push(id);
+    }
+  }
+  while (queue.length) {
+    const id = queue.pop();
+    if (secret.has(id)) continue;
+    secret.add(id);
+    for (const child of indexed.get(id)?.childIds || []) queue.push(child);
+  }
+  return secret;
+}
+
 export async function browserSnapshot(args) {
   return withTarget(args, async (session, target) => {
     await session.send('Accessibility.enable');
     const { nodes = [] } = await session.send('Accessibility.getFullAXTree');
     const limit = clamp(args.max_nodes, 1500, 1, 10_000);
+    const redacted = sensitiveAccessibilityDescendants(nodes);
     const simplified = nodes.slice(0, limit).map(node => ({
       node_id: boundedText(node.nodeId, 256),
       ignored: Boolean(node.ignored),
       role: boundedText(node.role?.value, 256),
-      name: boundedText(node.name?.value, 1000),
-      value: boundedText(node.value?.value, 1000),
-      description: boundedText(node.description?.value, 1000),
+      name: redacted.has(node.nodeId) && !['textbox','searchbox','combobox','spinbutton'].includes(
+        String(node.role?.value||'').toLowerCase()
+      ) ? '' : boundedText(node.name?.value, 1000),
+      value: redacted.has(node.nodeId) ? '' : safeAccessibilityValue(node),
+      description: redacted.has(node.nodeId) ? '' : boundedText(node.description?.value, 1000),
       child_ids: Array.isArray(node.childIds) ? node.childIds.slice(0, 200).map(id => boundedText(id, 256)) : [],
       backend_dom_node_id: node.backendDOMNodeId || null,
     }));
@@ -285,9 +329,19 @@ export function findExpression(args) {
     } else {
       selected = selected.slice(0, ${limit});
     }
+    // Credentials are never sent back in browser_find; even a normal
+    // text input can carry an OTP or API token via its name/autocomplete.
+    function isSensitiveControl(el) {
+      const tag = el.tagName.toLowerCase();
+      if (tag !== 'input' && tag !== 'textarea') return false;
+      if (tag === 'input' && String(el.type || '').toLowerCase() === 'password') return true;
+      const description = ['id','name','autocomplete'].map(key => el.getAttribute(key) || '').join(' ');
+      return /(?:password|passwd|passcode|one.time.code|otp|secret|api.?key|auth.?token|access.?token|recovery.?code)/i.test(description);
+    }
     return selected.map(({ el }) => {
       const b = el.getBoundingClientRect();
-      return { selector: cssPath(el), tag: el.tagName.toLowerCase(), role: semanticRole(el), name: el.getAttribute('aria-label') || el.getAttribute('name') || '', text: visibleText(el).slice(0, 500), value: 'value' in el ? String(el.value).slice(0, 500) : '', x: b.x, y: b.y, width: b.width, height: b.height, disabled: Boolean(el.disabled) };
+      const sensitive = isSensitiveControl(el);
+      return { selector: cssPath(el), tag: el.tagName.toLowerCase(), role: semanticRole(el), name: el.getAttribute('aria-label') || el.getAttribute('name') || '', text: sensitive ? '' : visibleText(el).slice(0, 500), value: !sensitive && 'value' in el ? String(el.value).slice(0, 500) : '', x: b.x, y: b.y, width: b.width, height: b.height, disabled: Boolean(el.disabled) };
     });
   })()`;
 }

package/src/extended/browser-session-backup.mjs

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import process from 'node:process';
+import { scanSessionDirectory, verifySessionDirectory } from './browser-session-directory.mjs';
 import { closeSync, fchmodSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 
 const MAX_FILE_BYTES = 32 * 1024 * 1024;
@@ -95,12 +96,14 @@ export function preserveInterruptedBrowserSession(profile) {
       catch (error) { if (error?.code === 'ENOENT') return { saved: false, reason: 'no-sessions' }; throw error; }
       if (!fstatSync(dirFd).isDirectory()) throw new Error('Session directory is unsafe');
     }
-    const readableDir = dirFd === undefined ? sessionDir : `${process.platform === 'darwin' ? '/dev/fd' : '/proc/self/fd'}/${dirFd}`;
+    const { readable: readableDir, names } = scanSessionDirectory(sessionDir, dirFd);
     const files = [];
     let total = 0;
-    for (const name of readdirSync(readableDir).sort()) {
+    for (const name of names.sort()) {
+      verifySessionDirectory(sessionDir, dirFd);
       if (!/^(?:Session|Tabs)_\d+$/.test(name)) continue;
       const details = ownedRegularFile(path.join(readableDir, name), MAX_FILE_BYTES);
+      verifySessionDirectory(sessionDir, dirFd);
       if (!details) throw new Error('Session file is unsafe, empty or oversized');
       total += details.size;
       files.push({ name, ...details });
@@ -125,7 +128,11 @@ export function preserveInterruptedBrowserSession(profile) {
     if (snapshots.length >= MAX_SNAPSHOTS) throw new Error('Session recovery snapshot limit reached');
     const snapshotDir = mkdtempSync(path.join(recoveryDir, 'snapshot-'));
     try {
-      for (const file of files) rawCopy(path.join(readableDir, file.name), path.join(snapshotDir, file.name), file);
+      for (const file of files) {
+        verifySessionDirectory(sessionDir, dirFd);
+        rawCopy(path.join(readableDir, file.name), path.join(snapshotDir, file.name), file);
+        verifySessionDirectory(sessionDir, dirFd);
+      }
       writeFileSync(path.join(snapshotDir, 'manifest.json'), JSON.stringify({ fingerprint, count: files.length, hasWindowSession: files.some(f => f.name.startsWith('Session_')) }), { flag: 'wx', mode: 0o600 });
       return { saved: true, reason: 'saved', count: files.length, bytes: total };
     } catch (error) {

package/src/extended/browser-session-directory.mjs

@@ -0,0 +1,71 @@
+// Keep Chrome recovery's directory-file-descriptor safety on Unix, while
+// accommodating macOS: its /dev/fd/N aliases cannot be scanned as directories.
+// This profile belongs to ReMCP, not to the user's normal Chrome profile.
+import process from 'node:process';
+import path from 'node:path';
+import {
+  closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readdirSync,
+} from 'node:fs';
+
+const NOFOLLOW = constants.O_NOFOLLOW || 0;
+const DIRECTORY = constants.O_DIRECTORY || 0;
+
+export function verifySessionDirectory(directory, fd, platform = process.platform) {
+  if (platform !== 'darwin') return;
+  const opened = fstatSync(fd);
+  const current = lstatSync(directory);
+  if (!opened.isDirectory() || !current.isDirectory() ||
+      opened.dev !== current.dev || opened.ino !== current.ino ||
+      (typeof process.getuid === 'function' && current.uid !== process.getuid())) {
+    throw new Error('Browser session directory changed or is unsafe');
+  }
+}
+
+export function scanSessionDirectory(directory, fd, platform = process.platform) {
+  const readable = platform === 'win32' ? directory
+    : platform === 'darwin' ? directory : `/proc/self/fd/${fd}`;
+  verifySessionDirectory(directory, fd, platform);
+  const names = readdirSync(readable);
+  verifySessionDirectory(directory, fd, platform);
+  return { readable, names };
+}
+
+export function shouldRestoreBrowserSession(profile) {
+  let prefsFd;
+  let sessionFd;
+  try {
+    const defaultProfile = path.join(profile, 'Default');
+    prefsFd = openSync(path.join(defaultProfile, 'Preferences'), constants.O_RDONLY | NOFOLLOW);
+    const prefsStat = fstatSync(prefsFd);
+    if (!prefsStat.isFile() || prefsStat.size > 4 * 1024 * 1024) return false;
+    const prefs = JSON.parse(readFileSync(prefsFd, 'utf8'));
+    if (prefs?.profile?.exit_type !== 'Crashed') return false;
+
+    const sessionDir = path.join(defaultProfile, 'Sessions');
+    if (process.platform !== 'win32') {
+      sessionFd = openSync(sessionDir, constants.O_RDONLY | DIRECTORY | NOFOLLOW);
+      if (!fstatSync(sessionFd).isDirectory()) return false;
+    }
+    const { readable, names } = scanSessionDirectory(sessionDir, sessionFd);
+    const found = names.some(name => {
+      if (!/^Tabs_\d+$/.test(name)) return false;
+      let tabFd;
+      try {
+        verifySessionDirectory(sessionDir, sessionFd);
+        tabFd = openSync(path.join(readable, name), constants.O_RDONLY | NOFOLLOW);
+        const stat = fstatSync(tabFd);
+        verifySessionDirectory(sessionDir, sessionFd);
+        return stat.isFile() && stat.size > 0;
+      } catch { return false; }
+      finally { if (tabFd !== undefined) closeSync(tabFd); }
+    });
+    verifySessionDirectory(sessionDir, sessionFd);
+    return found;
+  } catch {
+    // Never restore from missing, malformed, symlinked or inaccessible evidence.
+    return false;
+  } finally {
+    if (sessionFd !== undefined) closeSync(sessionFd);
+    if (prefsFd !== undefined) closeSync(prefsFd);
+  }
+}

package/src/extended/browser-session.mjs

@@ -290,8 +290,35 @@ export function retainProductionSession(key, session, removeGuard, targetId, end
   return record;
 }
 
+// New Chromium windows may report CDP readiness before their session restore
+// finishes. Only cold-start navigation pays this bounded settling cost; all
+// warm clicks, existing tabs and browser reads keep their current fast path.
+export const COLD_BROWSER_SETTLE_MS = 1200;
+export const COLD_TARGET_VERIFY_MS = 700;
+
+export class BrowserTargetDisappearedError extends Error {
+  constructor() {
+    super('Browser CDP target disappeared during startup; the requested tab was not retained. Retry once after checking browser readiness.');
+    this.name = 'BrowserTargetDisappearedError';
+    this.code = 'BROWSER_TARGET_DISAPPEARED';
+    this.retryable = true;
+  }
+}
+
+export async function assertCreatedTargetAvailable(targetId, endpoint, {
+  request = requestJson, pause = ms => new Promise(resolve => setTimeout(resolve, ms)),
+  verifyAfterMs = 0,
+} = {}) {
+  if (verifyAfterMs > 0) await pause(verifyAfterMs);
+  const targets = await request('/json/list', endpoint, { timeout_ms:2000 });
+  if (!Array.isArray(targets) || !targets.some(item => item?.id === targetId && item?.type === 'page')) {
+    throw new BrowserTargetDisappearedError();
+  }
+}
+
 export async function createGuardedNewTab(url, args) {
-  await ensureBrowserEndpoint(args.endpoint);
+  const autoLaunched = await ensureBrowserEndpoint(args.endpoint);
+  if (autoLaunched) await new Promise(resolve => setTimeout(resolve, COLD_BROWSER_SETTLE_MS));
   const created = await requestJson('/json/new', args.endpoint, { method:'PUT', timeout_ms:args.timeout_ms });
   if (!created?.id) throw new Error('Browser did not return a new page target');
   const endpoint = endpointUrl(args.endpoint);
@@ -325,6 +352,12 @@ export async function createGuardedNewTab(url, args) {
     if (loaded) await loaded;
     const finalUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(finalUrl);
+    // A successful Page.navigate is not enough: Chrome's cold-start session
+    // restoration can asynchronously close its targets. Fail rather than
+    // returning a stale ID the next MCP tool call cannot use.
+    await assertCreatedTargetAvailable(target.id, endpoint, {
+      verifyAfterMs:autoLaunched ? COLD_TARGET_VERIFY_MS : 0,
+    });
     return { target, navigation, finalUrl };
   } catch (error) {
     operationFailed = true;