@xbrowser/cli 1.22.0 → 1.23.0

package/dist/daemon-main.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JKVUFP3G.js";
 import {
   getPluginLoader
-} from "./chunk-PIWNMC36.js";
+} from "./chunk-A3MORKYR.js";
 import {
   version
 } from "./chunk-43TEMG4U.js";
@@ -7985,7 +7985,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
     const errorMessage = errMsg(err);
     if (session?.page && process.env.XBROWSER_RECOVERY && !extraOpts?._recoveryAttempted) {
       try {
-        const { attemptRecovery } = await import("./recovery-MDWAVXE4.js");
+        const { attemptRecovery } = await import("./recovery-LGY25LIM.js");
         const recovery = await attemptRecovery(
           session.page,
           sessionName,
@@ -9025,7 +9025,7 @@ function createRPCHandler() {
       return result;
     } catch (err) {
       const errorMessage = errMsg(err);
-      const { attemptRecovery } = await import("./recovery-MDWAVXE4.js");
+      const { attemptRecovery } = await import("./recovery-LGY25LIM.js");
       const recovery = await attemptRecovery(
         session?.page,
         sessionName,
@@ -9192,9 +9192,9 @@ function createRPCHandler() {
     return result;
   }
   async function handlePluginsReload() {
-    const { resetPluginLoader } = await import("./plugin-singleton-FCNDN3FX.js");
+    const { resetPluginLoader } = await import("./plugin-singleton-GJO7EZXB.js");
     resetPluginLoader();
-    const loader = await import("./plugin-singleton-FCNDN3FX.js").then((m) => m.getPluginLoader());
+    const loader = await import("./plugin-singleton-GJO7EZXB.js").then((m) => m.getPluginLoader());
     const sites = loader.getCore().loader.getSites();
     return { ok: true, plugins: sites.length };
   }
@@ -9590,7 +9590,7 @@ function createRPCHandler() {
     if (isNewFormat) {
       try {
         const replayErrors = [];
-        const { SessionReplayer } = await import("./session-replayer-XM5L7LFD.js");
+        const { SessionReplayer } = await import("./session-replayer-N665T3G5.js");
         const replayer = new SessionReplayer({
           page: session.page,
           stepDelay: slowMo * 500,

package/dist/{human-interaction-Y5IDH6LD.js → human-interaction-57VYIR56.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-NKW4A74J.js";
+} from "./chunk-XTUAUFL3.js";
 import "./chunk-KFQGP6VL.js";
 export {
   HumanInteractionManager

package/dist/{human-interaction-ZUTR5AC2.js → human-interaction-67K43B4O.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-TEXCXIBW.js";
+} from "./chunk-LPW6QS4M.js";
 import "./chunk-ZTHE5RBZ.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/{human-interaction-4YR2N6R6.js → human-interaction-MXST5ZQM.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-OMU63E6J.js";
+} from "./chunk-FBQZ3PVD.js";
 import "./chunk-HBMEFSTB.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/index.d.ts

@@ -1148,7 +1148,7 @@ interface DetectionConfig {
  * along with optional `waitForHuman` (CAPTCHA handling) and
  * `detectAntiBot` (anti-bot detection) capabilities.
  */
-interface BrowserCommandContext extends CommandContext {
+interface BrowserCommandContext extends Omit<CommandContext, 'waitForHuman' | 'detectAntiBot' | 'page'> {
     page: XBPage;
     browser: XBBrowser;
     browserContext: XBContext;
@@ -2944,26 +2944,38 @@ interface HTTPServerConfig {
     port?: number;
     host?: string;
     tokens?: string[];
+    /**
+     * Explicit CORS origin allowlist for remote web clients (e.g.
+     * `['https://app.example']`, or `['*']` to opt back into wildcard).
+     * When omitted, only loopback browser origins are granted CORS.
+     */
+    corsOrigins?: string[];
 }
 
 /**
  * HTTP server exposing the xbrowser REST API for remote command execution.
  *
  * Provides endpoints for health checks, session management, single command
- * execution, and command chain execution. Supports optional Bearer token
+ * execution, and command chain execution. Supports Bearer token
  * authentication via config or environment variable.
+ *
+ * Secure defaults: binds loopback (127.0.0.1) only, and grants CORS only
+ * to loopback browser origins. Binding a non-loopback host requires a
+ * token — `start()` refuses otherwise.
  */
 declare class HTTPServer {
     private port;
     private host;
     private server;
     private validTokens;
+    private corsOrigins;
     constructor(config?: HTTPServerConfig);
     /**
      * Start the HTTP server and begin listening for requests.
      *
      * @returns The actual port and host the server bound to.
-     * @throws If the server is already running or fails to start.
+     * @throws If the server is already running, if binding a non-loopback
+     *   host without an auth token, or if the port cannot be bound.
      */
     start(): Promise<{
         port: number;