cdp-toolkit 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to cdp-toolkit are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.2] - 2026-10-03
+
+### Fixed
+
+- CLI: `get_network_request --requestId <id>` failed with "no network request matched" for every Fetch/XHR request. CDP mints those ids as `<pid>.<n>` (e.g. `91775.34`), and the CLI coerced any numeric-looking flag value to a number, so the lookup compared a number against the stored string, and `91775.10` was mangled to `91775.1`. Flag coercion now follows the tool's schema: a key typed as a string keeps its raw text, and every other key is coerced as before. Verified live on headless Chrome 154: all 6 captured requests resolve by `--requestId` from both the source and the built CLI; on 3.0.1 the 5 Fetch requests failed and only the hex-id Document request resolved. MCP callers were not affected, since their arguments arrive already typed. (`src/cli.ts`, `test/cli-coerce.test.ts`)
+
+## [3.0.1] - 2026-09-29
+
+### Fixed
+
+- `bench:wedge` now drives the headless Chrome it spawns (free port, HeadlessChrome check); it previously drove CDP_BASE/9222, so the 2026-09-16 README numbers were not from an isolated instance. Re-measured.
+
 ## [3.0.0] - 2026-09-29
 
 **The default MCP tool listing went from 49 tools to 7 (37,346 bytes to 5,072, -86.4%; about 9,336 tokens to about 1,268).** With `CDP_TOOL_PROFILE` unset, `tools/list` now advertises `search_tools`, `call_tool` and five core tools (`navigate_page`, `evaluate_script`, `take_snapshot`, `click`, `fill`); every other tool is found with `search_tools` and run with `call_tool`. `CDP_TOOL_PROFILE=full` restores the 2.x listing (plus the two meta-tools). The 48 underlying tools and the `cdp` CLI are unchanged, and the listing is still static: computed once at startup, `listChanged:false`, same cache hints.

package/README.md

@@ -44,12 +44,12 @@ If [`chrome-devtools-mcp`](https://github.com/ChromeDevTools/chrome-devtools-mcp
 
 Every number above is runnable. `bun run bench:wedge` spawns an isolated headless Chrome, points a throwaway page at an endpoint that accepts the connection and never responds, and measures the full stuck-page lifecycle (re-run with `CDP_TIMEOUT_MS=3000` for a ~60s sample; defaults below use the 15s bound):
 
-| Phase | Measured (2026-09-16, Chrome 153, isolated headless, 8 wedges) |
+| Phase | Measured (2026-09-29, HeadlessChrome 154.0.8037.59, isolated headless, 8 wedges) |
 |---|---|
-| Healthy `evaluate_script` (50×) | p50 **1ms**, p95 **2ms** |
-| Wedged `navigate` → dead endpoint (8×) | **rejected at p50 15.03s, max 15.03s** — the configured bound, never a hang |
+| Healthy `evaluate_script` (50×) | p50 **1ms**, p95 **3ms** |
+| Wedged `navigate` → dead endpoint (8×) | **rejected at p50 15.01s, max 15.02s** — the configured bound, never a hang |
 | Witness tab evaluated mid-brick (8×) | p95 **3ms** — other tabs never stall |
-| Recovery: close bricked tab + reopen + evaluate (8×) | p95 **89ms** |
+| Recovery: close bricked tab + reopen + evaluate (8×) | p95 **33ms** |
 | `/mcp` restarts · server restarts | **0** · **0** |
 
 One honest caveat the benchmark also reports: while a navigation to a dead endpoint is pending, *that page* stays unresponsive to new sessions — the blast radius is the tab, not the server. Closing it is a browser-level command (2ms) and a fresh page answers at healthy latency; your other tabs, and the MCP server, never noticed. Exit code is nonzero unless every wedge rejected in-bound and every recovery landed under 1s, so the benchmark is CI-able.
@@ -218,7 +218,7 @@ cdp take_screenshot --target url:example --renderWidth 1920 --renderHeight 1080
 cdp lighthouse_audit --url https://example.com --json '{"categories":["performance"]}'
 ```
 
-**Argument parsing:** the first positional token is the tool name. `--json '<obj>'` merges a JSON object into the args (applied first). `--target <sel>` sets `args.target`. Repeated `--key value` pairs become `args.key`, coerced (`true`/`false` → boolean, numeric strings → number, else string); a bare `--flag` is `true`. Explicit flags override keys from `--json`. Output is `JSON.stringify(result, null, 2)` on stdout (exit 0); on any throw, `{"error":"<message>"}` goes to stderr and the process exits 1.
+**Argument parsing:** the first positional token is the tool name. `--json '<obj>'` merges a JSON object into the args (applied first). `--target <sel>` sets `args.target`. Repeated `--key value` pairs become `args.key`. A key the tool's schema types as a string keeps its raw text (so `--requestId 91775.10` stays `"91775.10"`); any other key is coerced (`true`/`false` → boolean, numeric strings → number, else string). A bare `--flag` is `true`. Explicit flags override keys from `--json`. Output is `JSON.stringify(result, null, 2)` on stdout (exit 0); on any throw, `{"error":"<message>"}` goes to stderr and the process exits 1.
 
 **`--help`/`-h`** are recognized anywhere in argv, ahead of every other flag, and are never treated as a tool argument or a tool name — as of 1.9.3, `<tool> --help` used to run the tool instead. With no tool named, `cdp --help` prints the usage above. With a tool named, `cdp <tool> --help` prints that tool's arguments (name, type, required/optional, description) read from its schema, and exits 0 having made no CDP connection, taken no lease, and written no file.
 

package/dist/cli.js

@@ -11370,6 +11370,13 @@ function coerce(raw) {
   }
   return raw;
 }
+function coerceForTool(tool, key, raw) {
+  const spec = tool === undefined ? undefined : MANIFEST.find((t) => t.name === tool);
+  const prop = spec?.inputSchema.properties?.[key];
+  if (prop?.type === "string")
+    return raw;
+  return coerce(raw);
+}
 function parseArgv(argv) {
   const out = { list: false, capabilities: false, help: false, args: {} };
   let jsonObj;
@@ -11407,7 +11414,7 @@ function parseArgv(argv) {
         flagPairs.push(["target", rawValue]);
         continue;
       }
-      flagPairs.push([key, hasValue ? coerce(rawValue) : true]);
+      flagPairs.push([key, hasValue ? rawValue : true]);
       continue;
     }
     if (out.tool === undefined)
@@ -11415,8 +11422,9 @@ function parseArgv(argv) {
   }
   if (jsonObj)
     Object.assign(out.args, jsonObj);
-  for (const [k, v] of flagPairs)
-    out.args[k] = v;
+  for (const [k, v] of flagPairs) {
+    out.args[k] = v === true || k === "target" ? v : coerceForTool(out.tool, k, v);
+  }
   return out;
 }
 function isToolName(name) {
@@ -11559,3 +11567,6 @@ if (isDirectRun()) {
     process.exit(1);
   });
 }
+export {
+  parseArgv
+};

package/dist/mcp.js

@@ -11369,7 +11369,7 @@ var TOOL_DOCS = {
 };
 
 // src/version.ts
-var VERSION = "3.0.0";
+var VERSION = "3.0.2";
 
 // src/mcp.ts
 function isDirectRun() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdp-toolkit",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "A lightweight chrome-devtools-mcp alternative: an MCP server + CLI that drives the tabs you name, one target per call over one direct WebSocket, with a bounded timeout on every call, so a stuck page can't wedge your agent or force a /mcp restart. Chrome over CDP and Firefox over WebDriver BiDi, with tools a backend can't run absent from tools/list rather than throwing mid-task. 48 tools (only 5 core tools listed by default, plus search_tools/call_tool to reach the rest) including built-in network mocking, a cookie group, tab leases with human-activity detection, real HTML5 drag-and-drop, raw mouse/scroll dispatch, downloads, permission grants, and tab-to-video screen recording so several agents can drive one browser without stealing each other's tabs or a human's. No Puppeteer, no all-target fan-out.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -9,9 +9,11 @@
  *   - First positional token is the tool name (a key of TOOLS).
  *   - `--json '<obj>'` parses a JSON object and merges it into the args object.
  *   - `--target <sel>` sets `args.target` (a TargetSelector string).
- *   - Any other `--key value` pair becomes `args.key`, with the value coerced:
- *       "true"/"false" -> boolean, a numeric string -> number, else the raw
- *       string. A bare `--flag` with no following value (or followed by another
+ *   - Any other `--key value` pair becomes `args.key`. When the tool's MANIFEST
+ *       inputSchema declares the key `type: "string"`, the raw string is kept
+ *       as-is (so a CDP requestId like "91775.10" is not turned into the number
+ *       91775.1). Otherwise the value is coerced: "true"/"false" -> boolean, a
+ *       numeric string -> number, else the raw string. A bare `--flag` with no following value (or followed by another
  *       --flag) is treated as boolean true.
  *   - Explicit `--key` pairs OVERRIDE keys merged from `--json` (last writer
  *     wins; --json is applied first, then the individual flags).
@@ -108,6 +110,20 @@ function coerce(raw: string): boolean | number | string {
   return raw;
 }
 
+/**
+ * Coerce one `--key value` using the tool's declared schema type. A key the
+ * schema types as "string" keeps its raw text verbatim; coercing it would turn
+ * an id that merely LOOKS numeric ("91775.10", "007") into a number that no
+ * longer matches, or into a different string entirely. Every other key (or a
+ * tool/key the manifest doesn't know) falls back to coerce().
+ */
+function coerceForTool(tool: string | undefined, key: string, raw: string): boolean | number | string {
+  const spec = tool === undefined ? undefined : MANIFEST.find((t) => t.name === tool);
+  const prop = spec?.inputSchema.properties?.[key] as { type?: unknown } | undefined;
+  if (prop?.type === "string") return raw;
+  return coerce(raw);
+}
+
 interface ParsedArgs {
   tool?: string;
   list: boolean;
@@ -117,12 +133,14 @@ interface ParsedArgs {
 }
 
 /** Parse process argv (already sliced to drop the runtime + script, and with --browser already stripped). */
-function parseArgv(argv: string[]): ParsedArgs {
+export function parseArgv(argv: string[]): ParsedArgs {
   const out: ParsedArgs = { list: false, capabilities: false, help: false, args: {} };
   // Collect flag pairs separately so --json can be merged BEFORE individual
   // flags override it, regardless of token order.
   let jsonObj: Record<string, unknown> | undefined;
-  const flagPairs: Array<[string, unknown]> = [];
+  // Raw values are kept until the tool name is known (it may follow the flags),
+  // so coercion can consult that tool's schema.
+  const flagPairs: Array<[string, string | true]> = [];
 
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i]!;
@@ -164,7 +182,7 @@ function parseArgv(argv: string[]): ParsedArgs {
         flagPairs.push(["target", rawValue]);
         continue;
       }
-      flagPairs.push([key, hasValue ? coerce(rawValue) : true]);
+      flagPairs.push([key, hasValue ? rawValue : true]);
       continue;
     }
     // First non-flag positional is the tool name; ignore any extras.
@@ -173,7 +191,9 @@ function parseArgv(argv: string[]): ParsedArgs {
 
   // --json first, then explicit flags win.
   if (jsonObj) Object.assign(out.args, jsonObj);
-  for (const [k, v] of flagPairs) out.args[k] = v;
+  for (const [k, v] of flagPairs) {
+    out.args[k] = v === true || k === "target" ? v : coerceForTool(out.tool, k, v);
+  }
   return out;
 }
 

package/src/version.ts

@@ -6,4 +6,4 @@
  * ready line; keeping it in its own module means a release bump touches one
  * line here plus package.json, not a const buried in the server.
  */
-export const VERSION = "3.0.0";
+export const VERSION = "3.0.2";