@remcp/runtime 0.2.234 → 0.2.236

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.236 — 2026-11-05
+
+- Report CDP readiness only for eligible page targets and classify configured unavailable CDP connections with bounded diagnostics.
+- Retain browser authorization, loopback restrictions, runtime tool contracts and opt-in WebRTC boundaries.
+- Coordinate with client macOS CLI alias corrections, without rewriting the already published fleet-safe 0.2.235 runtime.
+
+## 0.2.235 — 2026-11-05
+
+- Publish the unchanged local runtime in lockstep with the fleet-aware 0.2.235 ReMCP agent update.
+- No additional runtime tools, permissions or protocol privileges; the update scheduling changes are client/backend coordination only.
+
 ## 0.2.234 — 2026-11-05
 
 - Publish the unchanged local runtime with the compatible 0.2.234 ReMCP agent update.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.234",
+  "version": "0.2.236",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/error-classes.mjs

@@ -20,7 +20,7 @@ export function classifyRuntimeToolError(error, toolName = '') {
   if (browserTool && code === 'BROWSER_TARGET_DISAPPEARED') return 'browser_target_stale';
   if (/\bcancelled\b|\bcanceled\b|\baborted by the client\b/.test(message)) return 'cancelled';
   if (/blocked (?:by|local|private)|outside the directories this device allows|private browser destination|blocked local browser scheme/.test(message)) return 'blocked';
-  if (browserTool && /browser cdp endpoint is unavailable|browser control is unavailable|cdp websocket (?:error|connection timed out)|local cdp endpoint did not become ready/.test(message)) {
+  if (browserTool && /(?:browser|the configured) cdp endpoint is unavailable|browser control is unavailable|cdp websocket (?:error|connection timed out)|local cdp endpoint did not become ready/.test(message)) {
     return 'browser_unavailable';
   }
   if (browserTool) {

package/src/extended/browser-readiness.mjs

@@ -1,7 +1,7 @@
 // Optional bounded local CDP readiness probe. This reports availability only;
 // it never exposes tab titles/URLs, starts Chrome, changes CDP flags or grants
 // permission to access targets. Actual actions always re-check browser policy.
-import { browserRemoteEnabled, endpointUrl, requestJson, validatedTargetWebSocketUrl } from './browser-endpoint.mjs';
+import { browserRemoteEnabled, endpointUrl, requestJson, safePageUrl, validatedTargetWebSocketUrl } from './browser-endpoint.mjs';
 
 const records = new Map();
 // Avoid duplicate /json/version + /json/list reads when several agent calls
@@ -19,6 +19,10 @@ export function classifyBrowserReadiness(version, targets, endpoint) {
   for (const target of targets.slice(0, 1000)) {
     if (target?.type !== 'page' || !target?.id || !target?.webSocketDebuggerUrl) continue;
     try {
+      // A CDP socket alone does not make a page eligible for browser_tabs.
+      // Validate its URL with the same synchronous scheme/host policy; full
+      // DNS/allowlist checks still happen at use time in browser_tabs.
+      safePageUrl(target.url);
       validatedTargetWebSocketUrl(target, endpointUrl(endpoint));
       pages += 1;
     } catch {