barebrowse 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.5.7
+
+MCP server crash resilience + process hardening.
+
+### Process hardening (`mcp-server.js`)
+- Added `unhandledRejection` and `uncaughtException` handlers — browser OOM/crash no longer kills the MCP server process
+- Previously: heavy sites like zalando.de crashed the browser via OOM, the CDP WebSocket close rejected pending promises, unhandled rejections crashed Node
+- Now: session resets and next request gets a fresh browser. Server stays alive.
+
+### Validated at scale
+- Scanned 149 sites across NL/US/EU with zero server crashes
+- Only 1 genuine timeout (rtv.nl) — all former crashers (zalando.de, otto.de, bijenkorf.nl, jumbo.com, klm.nl) now return results
+- Full results: `wearehere-scan-results.md`
+
 ## 0.5.6
 
 Assess now works on bot-blocking EU sites. Headed fallback + consent fix.

package/barebrowse.context.md

@@ -1,7 +1,7 @@
 # barebrowse -- Integration Guide
 
 > For AI assistants and developers wiring barebrowse into a project.
-> v0.5.6 | Node.js >= 22 | 0 required deps | MIT
+> v0.5.7 | Node.js >= 22 | 0 required deps | MIT
 
 ## What this is
 
@@ -243,7 +243,7 @@ Action tools return `'ok'` -- the agent calls `snapshot` explicitly to observe.
 
 Session runs in hybrid mode (headless with automatic headed fallback on bot detection). `goto` injects cookies from the user's browser before navigation for authenticated access.
 
-Session tools share a singleton page, lazy-created on first use. Assess tries headless first; if bot-blocked (score ≤5 with all zeros), retries with a separate headed session. Tabs dismissed for consent and closed after every scan. Max 3 concurrent, with CDP crash recovery.
+Session tools share a singleton page, lazy-created on first use. Assess tries headless first; if bot-blocked (score ≤5 with all zeros), retries with a separate headed session. Tabs dismissed for consent and closed after every scan. Max 3 concurrent. Browser OOM/crash auto-recovers (session resets, server stays alive).
 
 ## Architecture
 

package/mcp-server.js

@@ -379,7 +379,7 @@ async function handleMessage(msg) {
     return jsonrpcResponse(id, {
       protocolVersion: '2024-11-05',
       capabilities: { tools: {} },
-      serverInfo: { name: 'barebrowse', version: '0.5.6' },
+      serverInfo: { name: 'barebrowse', version: '0.5.7' },
     });
   }
 
@@ -443,6 +443,15 @@ process.stdin.on('data', (chunk) => {
   }
 });
 
+// Prevent unhandled rejections and uncaught exceptions from crashing the server.
+// Browser OOM/crash rejects all pending CDP promises — some may not be awaited.
+process.on('unhandledRejection', (err) => {
+  _page = null;
+});
+process.on('uncaughtException', (err) => {
+  _page = null;
+});
+
 // Clean up on exit
 process.on('SIGINT', async () => {
   if (_page) await _page.close().catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "type": "module",
   "main": "src/index.js",

package/rescan.mjs

@@ -0,0 +1,107 @@
+import { connect } from '/home/hamr/PycharmProjects/barebrowse/src/index.js';
+import { assess } from 'wearehere';
+
+const SITES = [
+  // NL timeouts
+  'rtv.nl', 'bijenkorf.nl', 'jumbo.com', 'klm.nl',
+  // EU timeouts  
+  'zalando.de', 'otto.de', 'allegro.pl',
+  // Suspected bot-blocked zeros (NL)
+  'coolblue.nl', 'rabobank.nl', 'telegraaf.nl', 'wehkamp.nl',
+  'ing.nl', 'kvk.nl', 'thuisbezorgd.nl', 'transavia.com', 'schiphol.nl',
+  // Suspected bot-blocked zeros (EU)
+  'lufthansa.com', 'fnac.com', 'svt.se', 'revolut.com',
+  'leboncoin.fr', 'subito.it', 'idealista.com',
+  // Suspected bot-blocked zeros (US)
+  'washingtonpost.com', 'usatoday.com', 'etsy.com', 'costco.com',
+  'homedepot.com', 'chatgpt.com', 'doordash.com', 'yelp.com', 'reuters.com',
+  'snapchat.com', 'cnn.com'
+];
+
+async function scanSite(url) {
+  const full = 'https://www.' + url;
+  
+  // Try headless first
+  let page;
+  try {
+    page = await connect({ mode: 'hybrid' });
+    const tab = await page.createTab();
+    try {
+      await tab.injectCookies(full).catch(() => {});
+      const r = await Promise.race([
+        assess(tab, full, { timeout: 30000, settle: 3000 }),
+        new Promise((_, rej) => setTimeout(() => rej(new Error('timeout')), 35000))
+      ]);
+      await tab.close().catch(() => {});
+      
+      // Check if bot-blocked
+      const { network, trackers, profiling } = r.categories;
+      const allZero = (network?.score||0) === 0 && (trackers?.score||0) === 0 && (profiling?.score||0) === 0;
+      if (allZero && r.score <= 5) {
+        await page.close().catch(() => {});
+        // Retry headed
+        const hp = await connect({ mode: 'headed' });
+        try {
+          await hp.injectCookies(full).catch(() => {});
+          const r2 = await Promise.race([
+            assess(hp, full, { timeout: 30000, settle: 3000 }),
+            new Promise((_, rej) => setTimeout(() => rej(new Error('timeout')), 35000))
+          ]);
+          console.log(url + '|' + r2.score + '|' + r2.risk + '|HEADED|' + summarize(r2));
+          return;
+        } finally {
+          await hp.close().catch(() => {});
+        }
+      }
+      console.log(url + '|' + r.score + '|' + r.risk + '|HEADLESS|' + summarize(r));
+    } catch (e) {
+      await tab.close().catch(() => {});
+      if (e.message === 'timeout') {
+        // Try headed on timeout too
+        await page.close().catch(() => {});
+        try {
+          const hp = await connect({ mode: 'headed' });
+          try {
+            await hp.injectCookies(full).catch(() => {});
+            const r2 = await Promise.race([
+              assess(hp, full, { timeout: 30000, settle: 3000 }),
+              new Promise((_, rej) => setTimeout(() => rej(new Error('timeout')), 35000))
+            ]);
+            console.log(url + '|' + r2.score + '|' + r2.risk + '|HEADED|' + summarize(r2));
+            return;
+          } finally {
+            await hp.close().catch(() => {});
+          }
+        } catch {
+          console.log(url + '|—|timeout|BOTH|Failed both modes');
+          return;
+        }
+      }
+      console.log(url + '|—|error|—|' + e.message);
+    } finally {
+      await page?.close().catch(() => {});
+    }
+  } catch (e) {
+    console.log(url + '|—|error|—|' + e.message);
+  }
+}
+
+function summarize(r) {
+  const parts = [];
+  const c = r.categories;
+  if (c.cookies?.score > 0) parts.push(c.cookies.summary);
+  if (c.network?.score > 0) parts.push(c.network.summary);
+  if (c.trackers?.score > 0) parts.push(c.trackers.summary);
+  if (c.profiling?.score > 0) parts.push(c.profiling.summary);
+  if (c.selling_data?.score > 0) parts.push(c.selling_data.summary);
+  if (c.pressure?.score > 0) parts.push('pressure:' + c.pressure.score);
+  if (c.watching?.score > 0) parts.push(c.watching.summary);
+  if (c.stored_data?.score > 0) parts.push(c.stored_data.summary);
+  if (c.terms?.score > 0) parts.push('terms:' + c.terms.summary);
+  if (parts.length === 0) parts.push('Clean');
+  return parts.join('; ');
+}
+
+for (const site of SITES) {
+  await scanSite(site);
+}