@xnng/browser-relay 1.6.0

package/hub/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "browser-relay-hub",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Browser Relay public relay — Cloudflare Worker + Durable Object",
+  "scripts": {
+    "deploy": "wrangler deploy"
+  },
+  "devDependencies": {
+    "wrangler": "^4"
+  }
+}

package/hub/src/rpc.js

@@ -0,0 +1,41 @@
+import { isTaskRequest } from '../../extension/protocol.js';
+
+// Shared by the Node hub and the Worker. No browser task may outlive a lost
+// synchronous RPC merely because its HTTP caller did not use our SDK.
+export function sendRpc(socket, pending, request, {signal, timeoutMs=30000}={}) {
+  const path=new URL(request.path,'http://relay.local');
+  const tracked=isTaskRequest(request.method,path.pathname);
+  const taskId=tracked ? (request.method==='GET'?path.searchParams.get('taskId'):request.body?.taskId) || `job_${crypto.randomUUID()}` : undefined;
+  const sessionId=request.method==='GET'?path.searchParams.get('sessionId'):request.body?.sessionId;
+  const body=tracked && request.method!=='GET'?{...request.body,taskId}:request.body;
+  if(tracked && request.method==='GET')path.searchParams.set('taskId',taskId);
+  const id=request.id || `rpc_${crypto.randomUUID()}`;
+  const frame={type:'rpc.request',id,method:request.method,path:path.pathname+path.search,headers:request.headers||{},body:body??null};
+  return new Promise((resolve,reject)=>{
+    let timer, sent=false, settled=false;
+    const cleanup=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);pending.delete(id);};
+    const finish=(fn,value)=>{if(settled)return;settled=true;cleanup();fn(value);};
+    const fail=(code,message,status)=>{
+      if(settled)return;
+      const payload={ok:false,code,message,error:message,status,retryable:!tracked && code!=='request_cancelled'};
+      if(tracked) {
+        Object.assign(payload,{taskId,sessionId,cancellationRequested:false});
+        if(sent) {
+          try {
+            socket.send(JSON.stringify({type:'rpc.request',id:`cancel_${crypto.randomUUID()}`,method:'POST',path:`/api/tasks/${encodeURIComponent(taskId)}/cancel`,headers:{},body:{sessionId}}));
+            payload.cancellationRequested=true;
+          } catch {payload.cancellationError='remote_send_failed';}
+        }
+      }
+      finish(reject,payload);
+    };
+    const abort=()=>fail('request_cancelled','Remote request cancelled; completed actions were not undone',409);
+    if(pending.has(id)) {reject({ok:false,code:'duplicate_rpc',message:'RPC id is already pending',status:409,retryable:false});return;}
+    if(signal?.aborted) {abort();return;}
+    pending.set(id,{resolve:value=>finish(resolve,value),reject:value=>finish(reject,tracked?{...value,taskId,sessionId,retryable:false}:value)});
+    signal?.addEventListener('abort',abort,{once:true});
+    timer=setTimeout(()=>fail('remote_request_timeout','Remote device did not respond before timeout',504),timeoutMs);
+    try {socket.send(JSON.stringify(frame));sent=true;}
+    catch(error) {fail('remote_send_failed',error.message || String(error),502);}
+  });
+}

package/hub/src/worker.js

@@ -0,0 +1,322 @@
+import { sendRpc } from "./rpc.js";
+const MAX_BODY_SIZE = 128 * 1024;
+const RPC_TIMEOUT_MS = 30_000;
+const DEVICE_AUTH_TIMEOUT_MS = 5_000;
+
+function jsonResponse(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store",
+      ...headers,
+    },
+  });
+}
+
+function errorPayload(code, message, { status = 500, retryable = false, details } = {}) {
+  const payload = { ok: false, code, error: message, message, status, retryable };
+  if (details !== undefined) payload.details = details;
+  return payload;
+}
+
+function bearerToken(headers) {
+  const auth = headers.get("Authorization") || "";
+  const match = /^Bearer\s+(.+)$/i.exec(auth);
+  return match ? match[1].trim() : "";
+}
+
+async function readJson(request) {
+  const text = await request.text();
+  if (text.length > MAX_BODY_SIZE) {
+    throw Object.assign(new Error("Request body too large"), { status: 413, code: "request_body_too_large" });
+  }
+  if (!text.trim()) return {};
+  try { return JSON.parse(text); }
+  catch { throw Object.assign(new Error("Invalid JSON in request body"), { status: 400, code: "invalid_json" }); }
+}
+
+async function sha256Hex(value) {
+  const data = new TextEncoder().encode(String(value));
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return [...new Uint8Array(hash)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+async function deriveRouteId(secret) {
+  const data = new TextEncoder().encode(String(secret));
+  const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+  let binary = "";
+  for (const byte of hash) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "").slice(0, 16);
+}
+
+function safeEqualString(a, b) {
+  const left = String(a || "");
+  const right = String(b || "");
+  let diff = left.length ^ right.length;
+  const max = Math.max(left.length, right.length);
+  for (let i = 0; i < max; i++) {
+    diff |= (left.charCodeAt(i) || 0) ^ (right.charCodeAt(i) || 0);
+  }
+  return diff === 0;
+}
+
+function isRouteId(value) {
+  return /^[A-Za-z0-9_-]{10,}$/.test(String(value || ""));
+}
+
+function isSecret(value) {
+  return /^[A-Za-z0-9_-]{16,}$/.test(String(value || ""));
+}
+
+function websocketPair() {
+  const pair = new WebSocketPair();
+  const values = Object.values(pair);
+  return { client: values[0], server: values[1] };
+}
+
+export class BrowserRelayDevice {
+  constructor(state, env) {
+    this.state = state;
+    this.env = env;
+    this.deviceSocket = null;
+    this.connectedAt = null;
+    this.lastSeen = null;
+    this.hello = null;
+    this.pending = new Map();
+    // In-memory only — nothing is persisted. A route exists only while its device
+    // is connected (the DO stays resident on the open WS); once it drops and the DO
+    // evicts, all state is gone. No storage writes → no zombie routes to clean up.
+    this.secretHash = null;
+  }
+
+  async fetch(request) {
+    const url = new URL(request.url);
+    try {
+      if (url.pathname === "/v1/device/connect") return this.handleDeviceConnect(request, url);
+      if (url.pathname === "/v1/rpc") return this.handleRpc(request);
+      if (url.pathname === "/v1/status") return this.handleStatus(request);
+      return jsonResponse(errorPayload("endpoint_not_found", `Unknown device endpoint: ${url.pathname}`, { status: 404 }), 404);
+    } catch (err) {
+      const status = err.status || 500;
+      const code = err.code || "internal_error";
+      return jsonResponse(errorPayload(code, err instanceof Error ? err.message : String(err), { status }), status);
+    }
+  }
+
+  // secretHash lives only in memory. The device's connect claims it (claim: true);
+  // CLI rpc/status must match a live claim — no device connected means no claim,
+  // which reads as "offline" rather than silently registering a credential.
+  async authorize(secret, { claim = false, routeId = "" } = {}) {
+    if (!isSecret(secret)) {
+      return { ok: false, status: 401, code: "invalid_remote_device", message: "Invalid or missing remote device credentials" };
+    }
+    if (!isRouteId(routeId) || !safeEqualString(routeId, await deriveRouteId(secret))) {
+      return { ok: false, status: 401, code: "invalid_remote_device", message: "Invalid or revoked remote device id" };
+    }
+    const incomingHash = await sha256Hex(secret);
+    if (!this.secretHash) {
+      if (claim) { this.secretHash = incomingHash; return { ok: true, claimed: true }; }
+      return { ok: false, status: 409, code: "remote_device_offline", message: "Remote Browser Relay device is offline", retryable: true };
+    }
+    if (!safeEqualString(this.secretHash, incomingHash)) {
+      return { ok: false, status: 401, code: "invalid_remote_device", message: "Invalid or revoked remote device id" };
+    }
+    return { ok: true, claimed: false };
+  }
+
+  async handleDeviceConnect(request, url) {
+    if (request.headers.get("Upgrade") !== "websocket") {
+      return jsonResponse(errorPayload("upgrade_required", "WebSocket upgrade required", { status: 426 }), 426);
+    }
+    const { client, server } = websocketPair();
+    server.accept();
+    let authenticated = false;
+    const authTimer = setTimeout(() => {
+      if (!authenticated) server.close(4008, "authentication timeout");
+    }, DEVICE_AUTH_TIMEOUT_MS);
+
+    const authenticate = async (secret) => {
+      if (authenticated) return true;
+      const auth = await this.authorize(secret, { claim: true, routeId: url.searchParams.get("routeId") || "" });
+      if (!auth.ok) {
+        clearTimeout(authTimer);
+        server.close(4003, "authentication failed");
+        return false;
+      }
+      if (this.deviceSocket && this.deviceSocket.readyState === WebSocket.OPEN && this.deviceSocket !== server) {
+        try { this.deviceSocket.close(4001, "superseded"); } catch {}
+      }
+      this.deviceSocket = server;
+      this.connectedAt = new Date().toISOString();
+      this.lastSeen = this.connectedAt;
+      authenticated = true;
+      clearTimeout(authTimer);
+      server.send(JSON.stringify({ type: "device.authenticated" }));
+      return true;
+    };
+
+    const legacySecret = url.searchParams.get("token") || bearerToken(request.headers);
+    if (legacySecret && !(await authenticate(legacySecret))) {
+      return new Response(null, { status: 101, webSocket: client });
+    }
+
+    server.addEventListener("message", (event) => {
+      void (async () => {
+        let msg;
+        try { msg = JSON.parse(String(event.data)); } catch { return; }
+        if (!authenticated) {
+          if (msg.type === "device.auth" && typeof msg.secret === "string") await authenticate(msg.secret);
+          else {
+            clearTimeout(authTimer);
+            server.close(4003, "authenticate first");
+          }
+          return;
+        }
+        if (msg.type === "device.auth") return;
+        this.handleDeviceMessage(server, event.data);
+      })();
+    });
+    server.addEventListener("close", () => {
+      clearTimeout(authTimer);
+      if (authenticated) this.handleDeviceClose(server);
+    });
+    server.addEventListener("error", () => {
+      clearTimeout(authTimer);
+      if (authenticated) this.handleDeviceClose(server);
+    });
+
+    return new Response(null, { status: 101, webSocket: client });
+  }
+
+  handleDeviceMessage(socket, raw) {
+    let msg;
+    try { msg = JSON.parse(String(raw)); }
+    catch { return; }
+    if (this.deviceSocket !== socket) return;
+    this.lastSeen = new Date().toISOString();
+
+    if (msg.type === "device.hello") {
+      this.hello = msg;
+      return;
+    }
+
+    if (msg.type === "rpc.response" && msg.id) {
+      const pending = this.pending.get(msg.id);
+      if (!pending) return;
+      clearTimeout(pending.timer);
+      this.pending.delete(msg.id);
+      pending.resolve(msg);
+    }
+  }
+
+  handleDeviceClose(socket) {
+    if (this.deviceSocket !== socket) return;
+    this.deviceSocket = null;
+    this.lastSeen = new Date().toISOString();
+    for (const [id, pending] of this.pending) {
+      clearTimeout(pending.timer);
+      pending.reject(errorPayload("remote_device_offline", "Remote Browser Relay device disconnected", { status: 409, retryable: true }));
+      this.pending.delete(id);
+    }
+  }
+
+  async handleRpc(request) {
+    const body = await readJson(request);
+    const secret = bearerToken(request.headers);
+    const auth = await this.authorize(secret, { routeId: String(body.routeId || "") });
+    if (!auth.ok) return jsonResponse(errorPayload(auth.code, auth.message, { status: auth.status }), auth.status);
+    if (!body.method || !body.path) {
+      return jsonResponse(errorPayload("invalid_request", "method and path are required", { status: 400 }), 400);
+    }
+
+    try {
+      const response = await this.sendRpcToDevice(body, request.signal);
+      const status = Number(response.status) || 200;
+      if (typeof response.body === "string") {
+        return new Response(response.body, {
+          status,
+          headers: {
+            "Content-Type": response.headers?.["content-type"] || response.headers?.["Content-Type"] || "text/plain",
+            "Cache-Control": "no-store",
+          },
+        });
+      }
+      return jsonResponse(response.body ?? null, status);
+    } catch (err) {
+      const payload = err && typeof err === "object" && "code" in err
+        ? err
+        : errorPayload("remote_rpc_failed", err instanceof Error ? err.message : String(err), { status: 502, retryable: true });
+      return jsonResponse(payload, payload.status || 502);
+    }
+  }
+
+  sendRpcToDevice(requestBody, signal) {
+    if (!this.deviceSocket || this.deviceSocket.readyState !== WebSocket.OPEN) {
+      throw errorPayload("remote_device_offline", "Remote Browser Relay device is offline", { status: 409, retryable: true });
+    }
+    return sendRpc(this.deviceSocket,this.pending,requestBody,{signal,timeoutMs:RPC_TIMEOUT_MS});
+  }
+
+  async handleStatus(request) {
+    const routeId = new URL(request.url).searchParams.get("routeId") || "";
+    const secret = bearerToken(request.headers);
+    const auth = await this.authorize(secret, { routeId });
+    if (!auth.ok) return jsonResponse(errorPayload(auth.code, auth.message, { status: auth.status }), auth.status);
+    return jsonResponse({
+      ok: true,
+      routeId,
+      connected: !!this.deviceSocket && this.deviceSocket.readyState === WebSocket.OPEN,
+      connectedAt: this.connectedAt,
+      lastSeen: this.lastSeen,
+      hello: this.hello,
+    });
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    try {
+      if (request.method === "GET" && (url.pathname === "/" || url.pathname === "/v1/health")) {
+        return jsonResponse({ ok: true, service: "browser-relay-hub", host: url.host });
+      }
+
+      if (request.method === "GET" && url.pathname === "/v1/device/connect") {
+        const routeId = url.searchParams.get("routeId") || "";
+        if (!isRouteId(routeId)) return jsonResponse(errorPayload("invalid_remote_device", "Invalid route id", { status: 401 }), 401);
+        const id = env.DEVICES.idFromName(routeId);
+        return env.DEVICES.get(id).fetch(request);
+      }
+
+      if (request.method === "POST" && url.pathname === "/v1/rpc") {
+        const body = await readJson(request.clone());
+        const routeId = String(body.routeId || "");
+        if (!isRouteId(routeId)) return jsonResponse(errorPayload("invalid_remote_device", "Invalid route id", { status: 401 }), 401);
+        const id = env.DEVICES.idFromName(routeId);
+        return env.DEVICES.get(id).fetch(new Request("https://device.local/v1/rpc", {
+          method: "POST",
+          headers: request.headers,
+          body: JSON.stringify(body),
+          signal: request.signal,
+        }));
+      }
+
+      if (request.method === "GET" && url.pathname.startsWith("/v1/status/")) {
+        const routeId = decodeURIComponent(url.pathname.slice("/v1/status/".length));
+        if (!isRouteId(routeId)) return jsonResponse(errorPayload("invalid_remote_device", "Invalid route id", { status: 401 }), 401);
+        const id = env.DEVICES.idFromName(routeId);
+        return env.DEVICES.get(id).fetch(new Request(`https://device.local/v1/status?routeId=${encodeURIComponent(routeId)}`, {
+          method: "GET",
+          headers: request.headers,
+        }));
+      }
+
+      return jsonResponse(errorPayload("endpoint_not_found", `Unknown hub endpoint: ${url.pathname}`, { status: 404 }), 404);
+    } catch (err) {
+      const status = err.status || 500;
+      const code = err.code || "internal_error";
+      return jsonResponse(errorPayload(code, err instanceof Error ? err.message : String(err), { status }), status);
+    }
+  },
+};

package/hub/wrangler.example.toml

@@ -0,0 +1,19 @@
+name = "browser-relay-hub"
+main = "src/worker.js"
+compatibility_date = "2025-12-01"
+compatibility_flags = ["enable_request_signal"]
+workers_dev = true
+
+# Self-hosters: `wrangler deploy` publishes this to
+# https://browser-relay-hub.<your-subdomain>.workers.dev — use that URL as the
+# extension's "Public relay". To put it on your own domain, add a route, e.g.:
+#   routes = [{ pattern = "relay.example.com", custom_domain = true }]
+
+[durable_objects]
+bindings = [
+  { name = "DEVICES", class_name = "BrowserRelayDevice" }
+]
+
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["BrowserRelayDevice"]

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@xnng/browser-relay",
+  "version": "1.6.0",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "description": "Agent-native browser control through a Skill + CLI: share your existing, logged-in Chrome locally or across multiple machines.",
+  "homepage": "https://www.npmjs.com/package/@xnng/browser-relay",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xnng/makemoney.git",
+    "directory": "tools/browser-relay"
+  },
+  "main": "server/relay-server.js",
+  "bin": {
+    "browser-relay": "server/cli.js",
+    "browser-relay-mcp": "server/mcp-server.js",
+    "browser-relay-hub": "server/hub-server.js"
+  },
+  "files": [
+    "server/",
+    "extension/",
+    "hub/",
+    "docs/remote-control-hub.md",
+    "docs/demo/intranet.html",
+    "skills/",
+    "README.md",
+    "docs/README.zh-CN.md",
+    "docs/browser-use-comparison.md",
+    "docs/browser-use-gap-audit.md",
+    "docs/browser-use-parity.md",
+    "docs/benchmarks/",
+    "docs/releases/"
+  ],
+  "scripts": {
+    "start": "node server/relay-server.js",
+    "hub": "node server/hub-server.js",
+    "hub:dry-run": "wrangler deploy --config hub/wrangler.toml --dry-run",
+    "hub:deploy": "wrangler deploy --config hub/wrangler.toml",
+    "mcp": "node server/mcp-server.js",
+    "test": "node --test",
+    "pack:dry-run": "npm pack --dry-run",
+    "sync-version": "node scripts/sync-version.mjs",
+    "prepublishOnly": "node scripts/check-publish.mjs && node scripts/sync-version.mjs",
+    "postinstall": "node server/install.js",
+    "postuninstall": "node server/uninstall.js",
+    "test:browser": "node scripts/run-browser-tests.mjs",
+    "bench:browser": "node scripts/benchmark-browser.mjs",
+    "bench:serve": "node scripts/serve-browser-benchmark.mjs"
+  },
+  "keywords": [
+    "agent-skill",
+    "agent-browser",
+    "browser-agent",
+    "browser-control",
+    "browser-cli",
+    "browser-skill",
+    "browser",
+    "automation",
+    "cli",
+    "cdp",
+    "ai-agent",
+    "chrome",
+    "logged-in-browser",
+    "remote-browser"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "dependencies": {
+    "ws": "^8.21.1"
+  },
+  "devDependencies": {
+    "playwright": "^1.63.0"
+  },
+  "exports": {
+    ".": "./server/relay-server.js",
+    "./sdk": "./server/sdk.js"
+  }
+}

package/server/cdp-bridge.js

@@ -0,0 +1,200 @@
+import { randomUUID } from "node:crypto";
+
+// Chrome owns the real debugger attachments. CDP clients get independent virtual
+// sessions; disconnecting Playwright must never close Chrome or detach a user tab.
+export function createCdpBridge({ targets, send, ensure }) {
+  const peers = new Set();
+  const targetInfo = (target) => ({
+    ...target.targetInfo,
+    attached: true,
+    browserContextId:
+      target.targetInfo.browserContextId || "browser-relay-default",
+  });
+  function emit(peer, method, params, sessionId) {
+    if (peer.ws.readyState === 1)
+      peer.ws.send(
+        JSON.stringify({ method, params, ...(sessionId ? { sessionId } : {}) }),
+      );
+  }
+  function attach(peer, target, parent) {
+    let entry = [...peer.sessions.values()].find(
+      (s) => s.real === target.sessionId,
+    );
+    if (entry) return entry.id;
+    const id = `relay_${randomUUID()}`;
+    entry = { id, real: target.sessionId, targetId: target.targetId };
+    peer.sessions.set(id, entry);
+    emit(
+      peer,
+      "Target.attachedToTarget",
+      {
+        sessionId: id,
+        targetInfo: targetInfo(target),
+        waitingForDebugger: false,
+      },
+      parent,
+    );
+    return id;
+  }
+  async function command(peer, msg) {
+    const { method, params = {}, sessionId } = msg;
+    await ensure();
+    const session = sessionId ? peer.sessions.get(sessionId) : undefined;
+    if (sessionId && !session) throw new Error("Unknown CDP session");
+    if (session && method !== "Target.detachFromTarget")
+      // Shared Chrome must not leave future iframe targets paused after the
+      // client disconnects. Playwright accepts already-running targets.
+      return send(method, method === 'Target.setAutoAttach' ? {...params,waitForDebuggerOnStart:false} : params, session.real);
+    if (method === "Browser.getVersion") {
+      return send("Browser.getVersion", {});
+    }
+    if (method === "Browser.close") return {};
+    if (method === "Browser.setDownloadBehavior") return {}; // Downloads use the user's Chrome manager.
+    if (method === "Target.getBrowserContexts")
+      return { browserContextIds: [] };
+    if (method === "Target.getTargets")
+      return { targetInfos: [...targets().values()].map(targetInfo) };
+    if (method === "Target.setDiscoverTargets") {
+      peer.discover = !!params.discover;
+      if (peer.discover)
+        for (const target of targets().values())
+          emit(peer, "Target.targetCreated", {
+            targetInfo: targetInfo(target),
+          });
+      return {};
+    }
+    if (method === "Target.setAutoAttach") {
+      peer.autoAttach = !!params.autoAttach;
+      if (peer.autoAttach)
+        for (const target of targets().values()) attach(peer, target);
+      return {};
+    }
+    if (method === "Target.attachToTarget") {
+      const target = [...targets().values()].find(
+        (t) => t.targetId === params.targetId,
+      );
+      if (!target) throw new Error("Target not found");
+      return { sessionId: attach(peer, target) };
+    }
+    if (method === "Target.detachFromTarget") {
+      peer.sessions.delete(params.sessionId);
+      return {};
+    }
+    if (method === "Target.getTargetInfo") {
+      if (!params.targetId)
+        return {
+          targetInfo: {
+            targetId: "browser-relay-browser",
+            type: "browser",
+            title: "Browser Relay",
+            url: "",
+            attached: true,
+            browserContextId: "browser-relay-default",
+          },
+        };
+      const target = [...targets().values()].find(
+        (t) => t.targetId === params.targetId,
+      );
+      if (!target) throw new Error("Target not found");
+      return { targetInfo: targetInfo(target) };
+    }
+    if (method === "Browser.getWindowForTarget")
+      return {
+        windowId: 1,
+        bounds: {
+          left: 0,
+          top: 0,
+          width: 1280,
+          height: 720,
+          windowState: "normal",
+        },
+      };
+    if (method === "Browser.setWindowBounds")
+      throw new Error("Window resizing is not supported on shared Chrome");
+    if (
+      method === "Target.createBrowserContext" ||
+      method === "Target.disposeBrowserContext"
+    )
+      throw new Error(
+        "Browser contexts are owned by the user; reuse the default context",
+      );
+    return send(method, params);
+  }
+  function connect(ws) {
+    const peer = {
+      ws,
+      sessions: new Map(),
+      autoAttach: false,
+      discover: false,
+    };
+    peers.add(peer);
+    ws.on("close", () => peers.delete(peer));
+    ws.on("error", () => {});
+    ws.on("message", async (raw) => {
+      let msg;
+      try {
+        msg = JSON.parse(raw.toString());
+      } catch {
+        return;
+      }
+      if (!Number.isInteger(msg.id) || typeof msg.method !== "string") return;
+      try {
+        const result = await command(peer, msg);
+        if (ws.readyState === 1)
+          ws.send(
+            JSON.stringify({
+              id: msg.id,
+              result,
+              ...(msg.sessionId ? { sessionId: msg.sessionId } : {}),
+            }),
+          );
+      } catch (error) {
+        if (ws.readyState === 1)
+          ws.send(
+            JSON.stringify({
+              id: msg.id,
+              error: { code: -32000, message: error.message },
+              ...(msg.sessionId ? { sessionId: msg.sessionId } : {}),
+            }),
+          );
+      }
+    });
+  }
+  function event(method, params = {}, realSession) {
+    for (const peer of peers) {
+      const owner = [...peer.sessions.values()].find(
+        (s) => s.real === realSession,
+      );
+      if (method === "Target.attachedToTarget") {
+        const target = {
+          sessionId: params.sessionId,
+          targetId: params.targetInfo.targetId,
+          targetInfo: params.targetInfo,
+        };
+        if (owner) attach(peer, target, owner.id);
+        else if (params.targetInfo.type === "page") {
+          if (peer.discover)
+            emit(peer, "Target.targetCreated", {
+              targetInfo: targetInfo(target),
+            });
+          if (peer.autoAttach) attach(peer, target);
+        }
+      } else if (method === "Target.detachedFromTarget") {
+        const child = [...peer.sessions.values()].find(
+          (s) => s.real === params.sessionId,
+        );
+        if (child) {
+          emit(peer, method, { ...params, sessionId: child.id }, owner?.id);
+          peer.sessions.delete(child.id);
+        }
+      } else if (owner) emit(peer, method, params, owner.id);
+      else if (method.startsWith("Target.") && peer.discover)
+        emit(peer, method, params);
+    }
+  }
+  function disconnect() {
+    for (const peer of peers) peer.ws.close(1012, "Extension disconnected");
+    peers.clear();
+  }
+  return { connect, event, disconnect };
+}