@remcp/runtime 0.2.168 → 0.2.170

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.170 — 2026-10-20
+
+- Reapply per-target CDP viewport emulation when opening a new guarded browser session; bound state to 64 targets and expire after 10 minutes.
+- Fix inaccurate mobile browser QA readback after separate `set_viewport` and DOM/snapshot calls without widening browser-origin permissions.
+- Add viewport persistence, target-isolation and expiry tests.
+
+## 0.2.169 — 2026-10-19
+
+- Emit redacted, bounded lifecycle events when ReMCP-owned Chrome exits and distinguish clean exit, nonzero exit, OS signal and spawn error.
+- On a missing default loopback CDP endpoint, include a fresh, explicitly non-causal hint only if the managed browser process recently exited. Never auto-launch browser_tabs/browser_snapshot, and never reveal URLs, tab content, Chrome arguments, credentials or profile paths.
+- Add detached subprocess, privacy, TTL and missing-listener regression tests.
+
 ## 0.2.165 — 2026-10-18
 
 **Crash-session recovery without losing browser automation when the local snapshot budget fills.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.168",
+  "version": "0.2.170",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-actions.mjs

@@ -9,8 +9,9 @@ import { preserveInterruptedBrowserSession } from './browser-session-backup.mjs'
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 
-import { assertBrowserRemoteEnabled, assertSafeEvaluationExpression } from './browser-endpoint.mjs';
-import { callPageFunction, evaluate, withTarget } from './browser-session.mjs';
+import { assertBrowserRemoteEnabled, assertSafeEvaluationExpression, endpointUrl } from './browser-endpoint.mjs';
+import { callPageFunction, evaluate, withTarget, productionSessionKey } from './browser-session.mjs';
+import { rememberBrowserViewport } from './browser-viewport.mjs';
 import { browserNavigate, browserSnapshot, browserTabs, findExpression } from './browser-read.mjs';
 import { executeBrowserWorkflow, validateBrowserWorkflow } from './browser-workflow.mjs';
 
@@ -226,14 +227,9 @@ export async function browserAction(args) {
       const width = clamp(args.width, 1280, 200, 8192);
       const height = clamp(args.height, 720, 200, 8192);
       const deviceScaleFactor = Math.max(0.1, Math.min(8, Number(args.device_scale_factor) || 1));
-      await session.send('Emulation.setDeviceMetricsOverride', {
-        width,
-        height,
-        deviceScaleFactor,
-        mobile: Boolean(args.mobile),
-        screenWidth: width,
-        screenHeight: height,
-      });
+      const metrics = { width, height, deviceScaleFactor, mobile:Boolean(args.mobile), screenWidth:width, screenHeight:height };
+      await session.send('Emulation.setDeviceMetricsOverride', metrics);
+      rememberBrowserViewport(productionSessionKey(endpointUrl(args.endpoint), target), metrics);
       return jsonResult({ target_id:target.id, action, width, height, device_scale_factor:deviceScaleFactor, mobile:Boolean(args.mobile) });
     }
     if (action === 'upload') {

package/src/extended/browser-endpoint.mjs

@@ -8,6 +8,7 @@ import { resolveSafePath } from '../util.mjs';
 import { selectSafeBrowserLaunchProfile } from './browser-session-backup.mjs';
 import { shouldRestoreBrowserSession } from './browser-session-directory.mjs';
 import { shareBrowserDiscovery } from './browser-discovery-flight.mjs';
+import { observeBrowserLaunchExit, browserLaunchExitHint } from './browser-launch-lifecycle.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 
@@ -110,7 +111,13 @@ export async function ensureBrowserEndpoint(endpoint) {
       // evidence before a restart, including profiles with only Tabs_* left.
       const selected = selectSafeBrowserLaunchProfile(profile);
       if (selected.isolated) console.warn('ReMCP browser: using an isolated recovery profile; existing session and backups are preserved, and sign-in state is not copied.');
-      spawnDetached(executable, browserAutoLaunchArgs(selected.profile));
+      const restore = shouldRestoreBrowserSession(selected.profile);
+      const startedAt = Date.now();
+      spawnDetached(executable, browserAutoLaunchArgs(selected.profile), {
+        onExit:value => observeBrowserLaunchExit(value, { startedAt, restore, isolated:selected.isolated }),
+        onError:({ code }) => observeBrowserLaunchExit({ error:code || 'UNKNOWN' },
+          { startedAt, restore, isolated:selected.isolated }),
+      });
       if (!await waitForBrowserEndpoint(5000)) throw new Error('ReMCP launched a browser but its local CDP endpoint did not become ready');
       return true;
     })().finally(() => { browserLaunchPromise = null; });
@@ -415,7 +422,7 @@ export async function listBrowserTargets(endpoint, { targetId = null, readOnlySi
     if (!/fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|abort|timed out|network error/i.test(message)) throw error;
     const configured = Boolean(endpoint || process.env.REMCP_CDP_URL);
     const label = configured ? 'The configured CDP endpoint' : 'Browser CDP endpoint';
-    throw new Error(`${label} is unavailable at ${base.origin}. Read-only browser_tabs and browser_snapshot do not launch a browser. Use ui_snapshot and ui_find for the existing browser window; do not retry this CDP endpoint unchanged. Only browser_navigate(action=new_tab), when explicitly requested, may start a local isolated browser.`);
+    throw new Error(`${label} is unavailable at ${base.origin}. Read-only browser_tabs and browser_snapshot do not launch a browser. Use ui_snapshot and ui_find for the existing browser window; do not retry this CDP endpoint unchanged. Only browser_navigate(action=new_tab), when explicitly requested, may start a local isolated browser.${browserLaunchExitHint({ configured })}`);
   }
   // Retain the current bounded concurrent DNS/security checks for up to 1000 tabs.
   return filterBrowserTargets(list, { targetId, validate });

package/src/extended/browser-launch-lifecycle.mjs

@@ -0,0 +1,36 @@
+// Bounded, content-free telemetry for ReMCP-owned Chrome child lifecycles.
+let recentExit = null;
+const HINT_WINDOW_MS = 60_000;
+
+export function classifyBrowserLaunchExit({ code = null, signal = null, error = null } = {}) {
+  if (error) return 'spawn_error';
+  if (typeof signal === 'string' && /^SIG[A-Z0-9]+$/.test(signal)) return 'signaled';
+  if (code === 0) return 'clean_exit';
+  if (Number.isInteger(code)) return 'nonzero_exit';
+  return 'unknown_exit';
+}
+
+export function observeBrowserLaunchExit({ code = null, signal = null, error = null } = {}, {
+  startedAt = Date.now(), now = Date.now(), restore = false, isolated = false,
+  log = console.warn,
+} = {}) {
+  const event = {
+    event:'dedicated_browser_exit',
+    reason:classifyBrowserLaunchExit({ code, signal, error }),
+    exit_code:Number.isInteger(code) ? code : null,
+    signal:typeof signal === 'string' && /^SIG[A-Z0-9]+$/.test(signal) ? signal : null,
+    elapsed_ms:Math.min(86_400_000, Math.max(0, now - startedAt)),
+    restore_requested:Boolean(restore),
+    recovery_profile:Boolean(isolated),
+  };
+  recentExit = { at:now, reason:event.reason };
+  log(`ReMCP browser lifecycle: ${JSON.stringify(event)}`);
+  return event;
+}
+
+// Advisory only: a Chrome launcher can exit without bringing CDP down. Never
+// claim this event caused a later endpoint failure or authorize a relaunch.
+export function browserLaunchExitHint({ now = Date.now(), configured = false } = {}) {
+  if (configured || !recentExit || now < recentExit.at || now - recentExit.at > HINT_WINDOW_MS) return '';
+  return ` A recently launched ReMCP browser process exited (${recentExit.reason}); the event may be unrelated to CDP availability.`;
+}

package/src/extended/browser-session.mjs

@@ -10,6 +10,7 @@ import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDet
 
 
 import { MAX_CDP_MESSAGE_BYTES, PRODUCTION_SESSION_IDLE_MS, assertResolvedBrowserUrl, assertResolvedPageUrl, chooseTarget, endpointUrl, ensureBrowserEndpoint, productionBrowserSessions, requestJson, validatedTargetWebSocketUrl } from './browser-endpoint.mjs';
+import { getBrowserViewport } from './browser-viewport.mjs';
 
 export class CdpSession {
   constructor(url, timeoutMs) {
@@ -384,17 +385,20 @@ export async function withTarget(args = {}, callback) {
   const cached = findGuardedCachedTarget(args, endpoint);
   const target = cached?.target || await chooseTarget(args);
   const production = process.env.NODE_ENV === 'production';
-  const key = production ? productionSessionKey(endpoint, target) : '';
+  const viewportKey = productionSessionKey(endpoint, target);
+  const key = production ? viewportKey : '';
   let record = cached?.record || (production ? productionBrowserSessions.get(key) : null);
   if (record?.session?.closed || (record?.session?.socket && record.session.socket.readyState !== 1)) {
     closeProductionSession(key, record);
     record = null;
   }
   let session = record?.session;
+  let openedSession = false;
   let removeGuard = record?.removeGuard || (() => {});
   if (!session) {
     try {
       session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+      openedSession = true;
       removeGuard = await installBrowserRequestGuard(session);
       if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint, false, target);
     } catch (error) {
@@ -408,6 +412,10 @@ export async function withTarget(args = {}, callback) {
   }
   let operationFailed = false;
   try {
+    if (openedSession) {
+      const viewport = getBrowserViewport(viewportKey);
+      if (viewport) await session.send('Emulation.setDeviceMetricsOverride', viewport);
+    }
     const currentUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(currentUrl);
     // A reused target's discovery metadata can be old after navigation.

package/src/extended/browser-viewport.mjs

@@ -0,0 +1,22 @@
+// CDP Emulation settings belong to a protocol session. Cache only bounded,
+// non-sensitive viewport parameters so a newly opened session can reapply them.
+const MAX_TARGETS = 64;
+const IDLE_MS = 10 * 60_000;
+const overrides = new Map();
+
+export function rememberBrowserViewport(key, metrics, at = Date.now()) {
+  if (!key) return;
+  overrides.delete(key);
+  overrides.set(key, { metrics: { ...metrics }, expiresAt: at + IDLE_MS });
+  for (const [target, entry] of overrides) {
+    if (entry.expiresAt <= at) overrides.delete(target);
+  }
+  while (overrides.size > MAX_TARGETS) overrides.delete(overrides.keys().next().value);
+}
+
+export function getBrowserViewport(key, at = Date.now()) {
+  const entry = overrides.get(key);
+  if (!entry) return null;
+  if (entry.expiresAt <= at) { overrides.delete(key); return null; }
+  return { ...entry.metrics };
+}

package/src/extended/common.mjs

@@ -238,6 +238,18 @@ export function spawnDetached(file, args = [], options = {}) {
     stdio: 'ignore',
     windowsHide: true,
   });
+  // Opt-in process lifecycle callbacks for long-lived detached services.
+  // Do not forward command arguments or OS error messages into telemetry.
+  if (typeof options.onExit === 'function') {
+    child.once('exit', (code, signal) => {
+      try { options.onExit({ pid: child.pid ?? null, code, signal }); } catch {}
+    });
+  }
+  if (typeof options.onError === 'function') {
+    child.once('error', error => {
+      try { options.onError({ pid: child.pid ?? null, code: String(error?.code || 'UNKNOWN') }); } catch {}
+    });
+  }
   child.unref();
   return child.pid;
 }