@remcp/runtime 0.2.190 → 0.2.192

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.192 — 2026-10-28
+
+- Accelerate `browser_find` role/text candidate filtering without omitting ARIA fallback semantics.
+- Reduce redundant `browser_wait` Chrome reads and coalesce focus/clear for `browser_action` native text input.
+- Reject CDP event waits and pending writes promptly when the debugging WebSocket disconnects.
+- Preserve browser authorization, origin/DNS/SSRF checks, secure input events, credential redaction and the 84-tool contract.
+
+## 0.2.191 — 2026-10-28
+
+- Correct the catastrophic-command heuristic for shell wrappers that consume option values, including sudo, nice, ionice, and env split-string.
+- Add no-side-effect guardrail regression cases; no new MCP tool or expanded device permission.
+- Make the short-process terminal assertion wait for the real exit event after buffered output without changing runtime I/O behavior.
+- This matcher is not a shell sandbox and cannot protect computers running with unrestricted God Mode; deployment still requires OS least-privilege mitigation.
+
 ## 0.2.190 — 2026-10-27
 
 - Publish the runtime alongside the compatible ReMCP agent; the device HTTPS network probe is agent-owned and does not add runtime MCP tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.190",
+  "version": "0.2.192",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser-actions.mjs

@@ -74,15 +74,15 @@ export const PAGE_ELEMENT_ACTION = `function(selector, needle, action, value) {
     ) || null;
   }
   if (!el) throw new Error('Element not found');
-  if (action === 'click' || action === 'type' || action === 'scroll_into_view') {
+  if (action === 'click' || action === 'type' || action === 'type_clear' || action === 'scroll_into_view') {
     el.scrollIntoView({block:'center', inline:'center'});
   }
-  if (action === 'focus' || action === 'type') el.focus();
+  if (action === 'focus' || action === 'type' || action === 'type_clear') el.focus();
   if (action === 'select') {
     el.value = value;
     el.dispatchEvent(new Event('input', {bubbles:true}));
     el.dispatchEvent(new Event('change', {bubbles:true}));
-  } else if (action === 'set_value') {
+  } else if (action === 'set_value' || action === 'type_clear') {
     const proto = Object.getPrototypeOf(el);
     const own = Object.getOwnPropertyDescriptor(proto, 'value');
     const parent = Object.getPrototypeOf(proto);
@@ -307,8 +307,11 @@ export async function browserAction(args) {
     }
 
     if (action === 'type') {
-      const focused = await callPageFunction(session, PAGE_ELEMENT_ACTION, [selector, needle, 'type', '']);
-      if (args.clear === true) await callPageFunction(session, PAGE_ELEMENT_ACTION, [selector, needle, 'set_value', '']);
+      // Focus and clear must happen in that order, but they can share one
+      // guarded page evaluation. Keep native insertText and read-back CDP
+      // calls sequential so real keyboard input and verification are preserved.
+      const preparatoryAction = args.clear === true ? 'type_clear' : 'type';
+      const focused = await callPageFunction(session, PAGE_ELEMENT_ACTION, [selector, needle, preparatoryAction, '']);
       await session.send('Input.insertText', { text:value });
       const current = await callPageFunction(session, PAGE_ELEMENT_ACTION, [selector, needle, 'read_value', '']);
       return jsonResult({ target_id:target.id, action, result:{ ...focused, value:current.value } });
@@ -333,7 +336,10 @@ export async function browserWait(args = {}) {
   if (condition === 'expression') await assertSafeEvaluationExpression(wanted);
   return withTarget(args, async (session, target) => {
     const started = Date.now();
-    const initialUrl = await evaluate(session, 'location.href').catch(() => target.url || '');
+    // withTarget has already verified this live URL before calling us.
+    // Avoid reading it again just to establish the navigation baseline.
+    const initialUrl = target.url || '';
+    let observedUrl = initialUrl || null;
     const inflight = new Set();
     let lastResourceCount = -1;
     let stableSince = Date.now();
@@ -358,8 +364,9 @@ export async function browserWait(args = {}) {
       while (Date.now() - started < timeoutMs) {
         let matched = false;
         if (condition === 'network_idle') {
-          const state = await evaluate(session, `({ready:document.readyState,resources:performance.getEntriesByType('resource').length})`).catch(() => null);
+          const state = await evaluate(session, `({url:location.href,ready:document.readyState,resources:performance.getEntriesByType('resource').length})`).catch(() => null);
           if (state) {
+            if (typeof state.url === 'string') observedUrl = state.url;
             if (state.resources !== lastResourceCount) {
               lastResourceCount = state.resources;
               stableSince = Date.now();
@@ -373,7 +380,11 @@ export async function browserWait(args = {}) {
             : condition === 'load' ? `document.readyState === 'complete'`
             : condition === 'navigation' ? `location.href !== ${JSON.stringify(initialUrl)}`
             : `Boolean(${wanted})`;
-          matched = Boolean(await evaluate(session, expression));
+          // Capture the condition and its URL atomically in one CDP read.
+          // withTarget independently validates the final live URL afterward.
+          const state = await evaluate(session, `({url:location.href,matched:Boolean(${expression})})`);
+          if (typeof state?.url === 'string') observedUrl = state.url;
+          matched = Boolean(state?.matched);
         }
         if (matched) return jsonResult({
           target_id: target.id,
@@ -381,7 +392,7 @@ export async function browserWait(args = {}) {
           matched: true,
           elapsed_ms: Date.now() - started,
           ...(condition === 'network_idle' ? { inflight: inflight.size, idle_ms: idleMs } : {}),
-          url: await evaluate(session, 'location.href').catch(() => target.url || null),
+          url: observedUrl,
         });
         await new Promise(resolve => setTimeout(resolve, pollMs));
       }
@@ -391,7 +402,7 @@ export async function browserWait(args = {}) {
         matched: false,
         elapsed_ms: Date.now() - started,
         ...(condition === 'network_idle' ? { inflight: inflight.size, idle_ms: idleMs } : {}),
-        url: await evaluate(session, 'location.href').catch(() => target.url || null),
+        url: observedUrl,
       });
     } finally {
       for (const unsubscribe of unsubscribers) unsubscribe();

package/src/extended/browser-read.mjs

@@ -284,7 +284,22 @@ export function findExpression(args) {
     const selector = ${JSON.stringify(selector)};
     const needle = ${JSON.stringify(needle)};
     const role = ${JSON.stringify(role)};
-    const source = selector ? Array.from(document.querySelectorAll(selector)) : Array.from(document.querySelectorAll('*'));
+    const wanted = needle ? needle.toLowerCase() : '';
+    const compactWanted = wanted.replace(/\\s+/g, '');
+    const wantedRole = role ? role.toLowerCase() : '';
+    // Native roles have a bounded set of possible tags. Include all explicit
+    // ARIA roles too, so role='button' on a custom element remains discoverable.
+    // Unknown roles deliberately retain the full-document fallback.
+    const nativeRoleSelectors = {
+      button:'button,summary,input', link:'a[href]',
+      heading:'h1,h2,h3,h4,h5,h6', textbox:'textarea,input',
+      searchbox:'input', combobox:'select,input', listbox:'select',
+      checkbox:'input', radio:'input', slider:'input', spinbutton:'input',
+      option:'option', img:'img', progressbar:'progress', meter:'meter',
+    };
+    const sourceSelector = selector || (Object.hasOwn(nativeRoleSelectors,wantedRole)
+      ? nativeRoleSelectors[wantedRole] + ',[role]' : '*');
+    const source = document.querySelectorAll(sourceSelector);
     function cssPath(el) {
       if (el.id) return '#' + CSS.escape(el.id);
       const parts = [];
@@ -328,9 +343,8 @@ export function findExpression(args) {
       return (el.innerText || el.textContent || el.getAttribute('aria-label') || '').trim();
     }
     function textQuality(value) {
-      if (!needle) return 0;
+      if (!wanted) return 0;
       const hay = value.toLowerCase();
-      const wanted = needle.toLowerCase();
       if (hay === wanted) return 0;
       if (hay.startsWith(wanted)) return 1;
       return 2;
@@ -340,19 +354,32 @@ export function findExpression(args) {
       for (let current = el.parentElement; current; current = current.parentElement) depth += 1;
       return depth;
     }
-    const candidates = source.filter(el => {
-      const style = getComputedStyle(el);
-      const visible = style.visibility !== 'hidden' && style.display !== 'none' && el.getClientRects().length > 0;
-      const hay = visibleText(el);
+    const rankAll = Boolean(wanted && !selector);
+    const candidates = [];
+    for (const el of source) {
       const r = semanticRole(el);
-      return visible && (!needle || hay.toLowerCase().includes(needle.toLowerCase())) && (!role || r === role.toLowerCase());
-    }).map((el, index) => ({
-      el,
-      index,
-      text: visibleText(el),
-      role: semanticRole(el),
-      depth: depthOf(el),
-    }));
+      if (wantedRole && r !== wantedRole) continue;
+      // Cheap raw text/label check before forcing layout via innerText,
+      // computed styles or bounding boxes. The final visibleText match is
+      // still required so hidden descendants do not become false positives.
+      if (wanted) {
+        const raw = String(el.textContent || '').toLowerCase();
+        const aria = String(el.getAttribute('aria-label') || '').toLowerCase();
+        // CSS layout can insert line breaks absent from textContent. Compare
+        // whitespace-free forms as a fallback to avoid missing those matches.
+        if (!raw.includes(wanted) && !aria.includes(wanted)
+            && !raw.replace(/\\s+/g, '').includes(compactWanted)
+            && !aria.replace(/\\s+/g, '').includes(compactWanted)) continue;
+      }
+      const style = getComputedStyle(el);
+      if (style.visibility === 'hidden' || style.display === 'none' || !el.getClientRects().length) continue;
+      const text = wanted ? visibleText(el) : '';
+      if (wanted && !text.toLowerCase().includes(wanted)) continue;
+      candidates.push({el,index:candidates.length,text,role:r,depth:rankAll ? depthOf(el) : 0});
+      // Text-only searches rank all matches to prefer exact interactive
+      // targets. Every other search uses DOM order and can stop at limit.
+      if (!rankAll && candidates.length >= ${limit}) break;
+    }
     let selected = candidates;
     if (needle && !selector) {
       selected = [...candidates].sort((a, b) =>

package/src/extended/browser-session.mjs

@@ -115,11 +115,25 @@ export class CdpSession {
         reject(new Error(`${method} timed out`));
       }, timeoutMs);
       this.pending.set(key, { resolve, reject, timer });
-      this.socket.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) }));
+      try {
+        this.socket.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) }));
+      } catch (error) {
+        // A failed synchronous WebSocket write must not retain a pending
+        // request (and its timer) for the rest of the CDP deadline.
+        this.pending.delete(key);
+        clearTimeout(timer);
+        reject(error);
+      }
     });
   }
 
   waitFor(method, timeoutMs = this.timeoutMs, signal = null) {
+    if (signal?.aborted) return Promise.reject(new Error(`${method} aborted`));
+    // Chrome may disconnect between the preceding command and subscription.
+    // Do not turn an already-dead socket into a full navigation timeout.
+    if (this.closed || !this.socket || this.socket.readyState !== 1) {
+      return Promise.reject(new Error('CDP websocket is not open'));
+    }
     return new Promise((resolve, reject) => {
       if (signal?.aborted) { reject(new Error(`${method} aborted`)); return; }
       const listeners = this.waiters.get(method) || [];

package/src/policy.mjs

@@ -60,19 +60,49 @@ function segments(command) {
     .filter(Boolean);
 }
 
+// A wrapper option may consume the following token. Dropping the option but
+// not its value makes the guardrail examine "root"/"10" instead of "rm".
+const WRAPPER_VALUE_FLAGS = Object.freeze({
+  sudo: new Set(['-u', '--user', '-g', '--group', '-h', '--host', '-p', '--prompt', '-C', '--close-from', '-D', '--chdir', '-R', '--chroot', '-T', '--command-timeout']),
+  doas: new Set(['-u']),
+  env: new Set(['-u', '--unset', '-C', '--chdir', '-S', '--split-string']),
+  nice: new Set(['-n', '--adjustment']),
+  ionice: new Set(['-c', '--class', '-n', '--classdata', '-p', '--pid', '-P', '--pgid', '-u', '--uid']),
+  stdbuf: new Set(['-i', '--input', '-o', '--output', '-e', '--error']),
+  timeout: new Set(['-s', '--signal', '-k', '--kill-after']),
+});
+
 function commandWord(segment) {
   const tokens = matchingText(segment).split(' ').filter(Boolean);
   while (tokens.length) {
     const token = tokens[0];
     if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { tokens.shift(); continue; }
     const tokenName = path.basename(token).replace(/\.(exe|cmd|bat)$/i, '').toLowerCase();
-    if (WRAPPERS.has(tokenName)) {
+    if (!WRAPPERS.has(tokenName)) break;
+    tokens.shift();
+    const valueFlags = WRAPPER_VALUE_FLAGS[tokenName];
+    while (tokens.length) {
+      const option = tokens[0];
+      if (option === '--') { tokens.shift(); break; }
+      if (tokenName === 'env' && /^[A-Za-z_][A-Za-z0-9_]*=/.test(option)) {
+        tokens.shift();
+        continue;
+      }
+      // env -S/--split-string executes its argument as command words; never
+      // discard that argument as an ordinary wrapper option value.
+      if (tokenName === 'env' && (option === '-S' || option === '--split-string')) {
+        tokens.shift();
+        break;
+      }
+      if (tokenName === 'env' && (option.startsWith('--split-string=') || /^-S.+/.test(option))) {
+        tokens[0] = option.startsWith('--split-string=') ? option.slice('--split-string='.length) : option.slice(2);
+        break;
+      }
+      if (!option.startsWith('-') || option === '-') break;
       tokens.shift();
-      while (tokens.length && tokens[0].startsWith('-')) tokens.shift();
-      if (tokenName === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
-      continue;
+      if (valueFlags?.has(option) && tokens.length) tokens.shift();
     }
-    break;
+    if (tokenName === 'timeout' && tokens.length && /^\d+(?:\.\d+)?[smhd]?$/.test(tokens[0])) tokens.shift();
   }
   const word = tokens[0] || '';
   return word.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/i, '');