barebrowse 0.5.4 → 0.5.5

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.5.5
+
+Fix assess tab leak and Linux shared memory crash.
+
+### Assess tab leak (`mcp-server.js`)
+- Fixed: successful assess calls never closed the tab — tabs accumulated, eating RAM until Chromium crashed
+- `tab.close()` now called in the success path (was only in error/timeout paths)
+- This was the root cause of crashes on heavy EU cookie consent sites (zalando.de, otto.de, etc.) — not the CMPs themselves
+
+### Chromium launch (`src/chromium.js`)
+- Added `--disable-dev-shm-usage` flag — prevents shared memory crashes on Linux systems with limited `/dev/shm`
+
+### Tests
+- New: `createTab()` suite in browse.test.js (2 tests)
+  - Creates 5 tabs, navigates each, closes all, verifies no zombie tabs remain
+  - Tab close is idempotent (double-close doesn't throw)
+- 71/71 passing (was 69)
+
 ## 0.5.4
 
 Assess tool hardened: session reuse, concurrency, self-healing.

package/README.md

@@ -139,7 +139,7 @@ Everything the agent can do through barebrowse:
 | **Upload** | Set files on a file input element |
 | **Screenshot** | Page capture as base64 PNG/JPEG/WebP |
 | **PDF** | Export page as PDF |
-| **Assess** | Privacy scan: score (0-100), risk level, 10-category breakdown. Reuses session browser via tabs (max 3 concurrent), auto-retries on CDP crash, 30s timeout per scan. Requires `npm install wearehere`. |
+| **Assess** | Privacy scan: score (0-100), risk level, 10-category breakdown. Reuses session browser via tabs (max 3 concurrent, properly closed after each scan), auto-retries on CDP crash, 30s timeout per scan. Requires `npm install wearehere`. |
 | **Tabs** | List open tabs, switch between them |
 | **Wait for content** | Poll for text or CSS selector to appear on page |
 | **Wait for navigation** | SPA-aware: works for full page loads and pushState |

package/barebrowse.context.md

@@ -1,7 +1,7 @@
 # barebrowse -- Integration Guide
 
 > For AI assistants and developers wiring barebrowse into a project.
-> v0.5.4 | Node.js >= 22 | 0 required deps | MIT
+> v0.5.5 | Node.js >= 22 | 0 required deps | MIT
 
 ## What this is
 
@@ -157,6 +157,7 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 | Bot detection | Hybrid fallback: detects challenge pages, error pages, and near-empty responses, then switches to headed | Hybrid |
 | `navigator.webdriver` | Stealth patches in headless (webdriver, plugins, chrome obj) | Headless |
 | Profile locking | Unique temp dir per headless instance | Headless |
+| Shared memory crash (Linux) | `--disable-dev-shm-usage` flag prevents `/dev/shm` exhaustion | Headless |
 | ARIA noise | 9-step pruning: wrapper collapse, noise removal, landmark promotion | Both |
 
 ## bareagent wiring
@@ -242,7 +243,7 @@ Action tools return `'ok'` -- the agent calls `snapshot` explicitly to observe.
 
 Session runs in hybrid mode (headless with automatic headed fallback on bot detection). `goto` injects cookies from the user's browser before navigation for authenticated access.
 
-Session tools share a singleton page, lazy-created on first use. Assess runs in isolated tabs within the session (max 3 concurrent, with retry and CDP crash recovery).
+Session tools share a singleton page, lazy-created on first use. Assess runs in isolated tabs within the session (max 3 concurrent, with retry and CDP crash recovery). Tabs are closed after every assess (success, error, and timeout paths).
 
 ## Architecture
 

package/mcp-server.js

@@ -312,6 +312,7 @@ async function handleToolCall(name, args) {
               }),
             ]);
             clearTimeout(timer);
+            await tab.close().catch(() => {});
             return JSON.stringify(result, null, 2);
           } catch (err) {
             clearTimeout(timer);
@@ -355,7 +356,7 @@ async function handleMessage(msg) {
     return jsonrpcResponse(id, {
       protocolVersion: '2024-11-05',
       capabilities: { tools: {} },
-      serverInfo: { name: 'barebrowse', version: '0.5.4' },
+      serverInfo: { name: 'barebrowse', version: '0.5.5' },
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "type": "module",
   "main": "src/index.js",

package/src/chromium.js

@@ -82,6 +82,7 @@ export async function launch(opts = {}) {
     '--use-fake-device-for-media-stream',
     '--use-fake-ui-for-media-stream',
     '--disable-features=MediaRouter',
+    '--disable-dev-shm-usage',
   ];
 
   if (opts.proxy) {