@remcp/runtime 0.2.169 → 0.2.171

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.171 — 2026-10-21
+
+- Require MCP Server SDK 2.3.0 or later; update the published dependency lock to the patched 2.3.x line.
+- Preserve the existing local tool surface (83 tools), OS-specific safeguards, pairing and browser-origin restrictions. No additional permissions are introduced.
+
+## 0.2.170 — 2026-10-20
+
+- Reapply per-target CDP viewport emulation when opening a new guarded browser session; bound state to 64 targets and expire after 10 minutes.
+- Fix inaccurate mobile browser QA readback after separate `set_viewport` and DOM/snapshot calls without widening browser-origin permissions.
+- Add viewport persistence, target-isolation and expiry tests.
+
 ## 0.2.169 — 2026-10-19
 
 - Emit redacted, bounded lifecycle events when ReMCP-owned Chrome exits and distinguish clean exit, nonzero exit, OS signal and spawn error.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.169",
+  "version": "0.2.171",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@jellybrick/dbus-next": "^0.11.3",
-    "@modelcontextprotocol/server": "^2.0.0"
+    "@modelcontextprotocol/server": "^2.3.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0"

package/src/extended/browser-actions.mjs

@@ -9,8 +9,9 @@ import { preserveInterruptedBrowserSession } from './browser-session-backup.mjs'
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 
-import { assertBrowserRemoteEnabled, assertSafeEvaluationExpression } from './browser-endpoint.mjs';
-import { callPageFunction, evaluate, withTarget } from './browser-session.mjs';
+import { assertBrowserRemoteEnabled, assertSafeEvaluationExpression, endpointUrl } from './browser-endpoint.mjs';
+import { callPageFunction, evaluate, withTarget, productionSessionKey } from './browser-session.mjs';
+import { rememberBrowserViewport } from './browser-viewport.mjs';
 import { browserNavigate, browserSnapshot, browserTabs, findExpression } from './browser-read.mjs';
 import { executeBrowserWorkflow, validateBrowserWorkflow } from './browser-workflow.mjs';
 
@@ -226,14 +227,9 @@ export async function browserAction(args) {
       const width = clamp(args.width, 1280, 200, 8192);
       const height = clamp(args.height, 720, 200, 8192);
       const deviceScaleFactor = Math.max(0.1, Math.min(8, Number(args.device_scale_factor) || 1));
-      await session.send('Emulation.setDeviceMetricsOverride', {
-        width,
-        height,
-        deviceScaleFactor,
-        mobile: Boolean(args.mobile),
-        screenWidth: width,
-        screenHeight: height,
-      });
+      const metrics = { width, height, deviceScaleFactor, mobile:Boolean(args.mobile), screenWidth:width, screenHeight:height };
+      await session.send('Emulation.setDeviceMetricsOverride', metrics);
+      rememberBrowserViewport(productionSessionKey(endpointUrl(args.endpoint), target), metrics);
       return jsonResult({ target_id:target.id, action, width, height, device_scale_factor:deviceScaleFactor, mobile:Boolean(args.mobile) });
     }
     if (action === 'upload') {

package/src/extended/browser-session.mjs

@@ -10,6 +10,7 @@ import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDet
 
 
 import { MAX_CDP_MESSAGE_BYTES, PRODUCTION_SESSION_IDLE_MS, assertResolvedBrowserUrl, assertResolvedPageUrl, chooseTarget, endpointUrl, ensureBrowserEndpoint, productionBrowserSessions, requestJson, validatedTargetWebSocketUrl } from './browser-endpoint.mjs';
+import { getBrowserViewport } from './browser-viewport.mjs';
 
 export class CdpSession {
   constructor(url, timeoutMs) {
@@ -384,17 +385,20 @@ export async function withTarget(args = {}, callback) {
   const cached = findGuardedCachedTarget(args, endpoint);
   const target = cached?.target || await chooseTarget(args);
   const production = process.env.NODE_ENV === 'production';
-  const key = production ? productionSessionKey(endpoint, target) : '';
+  const viewportKey = productionSessionKey(endpoint, target);
+  const key = production ? viewportKey : '';
   let record = cached?.record || (production ? productionBrowserSessions.get(key) : null);
   if (record?.session?.closed || (record?.session?.socket && record.session.socket.readyState !== 1)) {
     closeProductionSession(key, record);
     record = null;
   }
   let session = record?.session;
+  let openedSession = false;
   let removeGuard = record?.removeGuard || (() => {});
   if (!session) {
     try {
       session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+      openedSession = true;
       removeGuard = await installBrowserRequestGuard(session);
       if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint, false, target);
     } catch (error) {
@@ -408,6 +412,10 @@ export async function withTarget(args = {}, callback) {
   }
   let operationFailed = false;
   try {
+    if (openedSession) {
+      const viewport = getBrowserViewport(viewportKey);
+      if (viewport) await session.send('Emulation.setDeviceMetricsOverride', viewport);
+    }
     const currentUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(currentUrl);
     // A reused target's discovery metadata can be old after navigation.

package/src/extended/browser-viewport.mjs

@@ -0,0 +1,22 @@
+// CDP Emulation settings belong to a protocol session. Cache only bounded,
+// non-sensitive viewport parameters so a newly opened session can reapply them.
+const MAX_TARGETS = 64;
+const IDLE_MS = 10 * 60_000;
+const overrides = new Map();
+
+export function rememberBrowserViewport(key, metrics, at = Date.now()) {
+  if (!key) return;
+  overrides.delete(key);
+  overrides.set(key, { metrics: { ...metrics }, expiresAt: at + IDLE_MS });
+  for (const [target, entry] of overrides) {
+    if (entry.expiresAt <= at) overrides.delete(target);
+  }
+  while (overrides.size > MAX_TARGETS) overrides.delete(overrides.keys().next().value);
+}
+
+export function getBrowserViewport(key, at = Date.now()) {
+  const entry = overrides.get(key);
+  if (!entry) return null;
+  if (entry.expiresAt <= at) { overrides.delete(key); return null; }
+  return { ...entry.metrics };
+}