chrome-relay 0.5.14 → 0.5.15

package/dist/cli.js

@@ -63,6 +63,86 @@ function optNumber(obj, key, tool) {
     rejectWrongType(obj, key, "a finite number", tool);
   return v;
 }
+function optPositiveNumber(obj, key, tool) {
+  const v = optNumber(obj, key, tool);
+  if (v === void 0)
+    return void 0;
+  if (v <= 0) {
+    throw new RelayError({
+      code: "invalid_arguments",
+      message: `${tool ?? "<unknown tool>"}: \`${key}\` must be > 0 (got ${v}).`,
+      tool,
+      phase: "parse_arguments",
+      details: { field: key, expected: "> 0", received: v },
+      retryable: false
+    });
+  }
+  return v;
+}
+function optNonNegativeNumber(obj, key, tool) {
+  const v = optNumber(obj, key, tool);
+  if (v === void 0)
+    return void 0;
+  if (v < 0) {
+    throw new RelayError({
+      code: "invalid_arguments",
+      message: `${tool ?? "<unknown tool>"}: \`${key}\` must be >= 0 (got ${v}).`,
+      tool,
+      phase: "parse_arguments",
+      details: { field: key, expected: ">= 0", received: v },
+      retryable: false
+    });
+  }
+  return v;
+}
+function coerceTabId(raw, tool) {
+  if (typeof raw === "number") {
+    if (!Number.isFinite(raw)) {
+      throw new RelayError({
+        code: "invalid_arguments",
+        message: `${tool}: invalid tabId ${JSON.stringify(raw)}. Expected a finite number.`,
+        tool,
+        phase: "parse_arguments",
+        details: { received: raw },
+        retryable: false
+      });
+    }
+    return raw;
+  }
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+      throw new RelayError({
+        code: "invalid_arguments",
+        message: `${tool}: invalid tabId ${JSON.stringify(raw)}. Expected a number; got a blank string.`,
+        tool,
+        phase: "parse_arguments",
+        details: { received: raw },
+        retryable: false
+      });
+    }
+    const n = Number(trimmed);
+    if (!Number.isFinite(n)) {
+      throw new RelayError({
+        code: "invalid_arguments",
+        message: `${tool}: invalid tabId ${JSON.stringify(raw)}. Expected a numeric string.`,
+        tool,
+        phase: "parse_arguments",
+        details: { received: raw },
+        retryable: false
+      });
+    }
+    return n;
+  }
+  throw new RelayError({
+    code: "invalid_arguments",
+    message: `${tool}: invalid tabId ${JSON.stringify(raw)}. Expected a number or numeric string.`,
+    tool,
+    phase: "parse_arguments",
+    details: { received: raw },
+    retryable: false
+  });
+}
 function optBool(obj, key, tool) {
   const v = obj[key];
   if (v === void 0 || v === null)
@@ -234,7 +314,7 @@ function parseChromeNetworkArgs(input) {
     const full = optBool(obj, "full");
     if (full !== void 0)
       out.full = full;
-    const head = optNumber(obj, "head");
+    const head = optPositiveNumber(obj, "head", TOOL_NAMES.NETWORK);
     if (head !== void 0)
       out.head = head;
     return out;
@@ -273,10 +353,14 @@ var init_network = __esm({
 });
 
 // ../protocol/dist/args/simple.js
-function parseGetWindowsAndTabsArgs(_input) {
+function parseGetWindowsAndTabsArgs(input) {
+  if (input !== void 0 && input !== null)
+    asObject(input, TOOL_NAMES.GET_WINDOWS_AND_TABS);
   return {};
 }
-function parseChromeSelfReloadArgs(_input) {
+function parseChromeSelfReloadArgs(input) {
+  if (input !== void 0 && input !== null)
+    asObject(input, TOOL_NAMES.SELF_RELOAD);
   return {};
 }
 function parseChromeReadPageArgs(input) {
@@ -334,27 +418,25 @@ function parseChromeEvaluateArgs(input) {
   const obj = asObject(input, TOOL_NAMES.EVALUATE);
   const out = {
     code: requireString(obj, "code", TOOL_NAMES.EVALUATE),
-    ...parseTargetArgs(obj)
+    ...parseTargetArgs(obj, TOOL_NAMES.EVALUATE)
   };
-  const t = optNumber(obj, "timeoutMs");
+  const t = optPositiveNumber(obj, "timeoutMs", TOOL_NAMES.EVALUATE);
   if (t !== void 0)
     out.timeoutMs = t;
   return out;
 }
 function parseChromeSwitchTabArgs(input) {
   const obj = asObject(input, TOOL_NAMES.SWITCH_TAB);
-  const tabId = Number(obj.tabId);
-  if (!Number.isFinite(tabId)) {
+  if (obj.tabId === void 0 || obj.tabId === null) {
     throw new RelayError({
       code: "invalid_arguments",
       message: `${TOOL_NAMES.SWITCH_TAB} requires a numeric tabId.`,
       tool: TOOL_NAMES.SWITCH_TAB,
       phase: "parse_arguments",
-      details: { received: obj.tabId },
       retryable: false
     });
   }
-  return { tabId };
+  return { tabId: coerceTabId(obj.tabId, TOOL_NAMES.SWITCH_TAB) };
 }
 function parseChromeCloseTabsArgs(input) {
   const obj = asObject(input, TOOL_NAMES.CLOSE_TABS);
@@ -368,18 +450,17 @@ function parseChromeCloseTabsArgs(input) {
       retryable: false
     });
   }
-  const tabIds = obj.tabIds.map((v) => Number(v));
-  if (tabIds.length === 0 || tabIds.some((n) => !Number.isFinite(n))) {
+  if (obj.tabIds.length === 0) {
     throw new RelayError({
       code: "invalid_arguments",
-      message: `${TOOL_NAMES.CLOSE_TABS} requires a non-empty array of numeric tab IDs.`,
+      message: `${TOOL_NAMES.CLOSE_TABS} requires a non-empty array of tab IDs.`,
       tool: TOOL_NAMES.CLOSE_TABS,
       phase: "parse_arguments",
       details: { received: obj.tabIds },
       retryable: false
     });
   }
-  return { tabIds };
+  return { tabIds: obj.tabIds.map((v) => coerceTabId(v, TOOL_NAMES.CLOSE_TABS)) };
 }
 function parseChromeAxArgs(input) {
   const obj = asObject(input, TOOL_NAMES.AX);
@@ -412,21 +493,21 @@ function parseChromeClickAxArgs(input) {
 }
 function parseChromeScreenshotArgs(input) {
   const obj = asObject(input, TOOL_NAMES.SCREENSHOT);
-  const out = { ...parseTargetArgs(obj) };
-  const fp = optBool(obj, "fullPage");
+  const out = { ...parseTargetArgs(obj, TOOL_NAMES.SCREENSHOT) };
+  const fp = optBool(obj, "fullPage", TOOL_NAMES.SCREENSHOT);
   if (fp !== void 0)
     out.fullPage = fp;
-  const bbox = optString(obj, "bbox");
+  const bbox = optString(obj, "bbox", TOOL_NAMES.SCREENSHOT);
   if (bbox)
     out.bbox = bbox;
-  const sel = optString(obj, "selector");
+  const sel = optString(obj, "selector", TOOL_NAMES.SCREENSHOT);
   if (sel)
     out.selector = sel;
-  const pad = optNumber(obj, "padding");
+  const pad = optNonNegativeNumber(obj, "padding", TOOL_NAMES.SCREENSHOT);
   if (pad !== void 0)
     out.padding = pad;
-  const me = optNumber(obj, "maxEdge");
-  if (me !== void 0 && me > 0)
+  const me = optPositiveNumber(obj, "maxEdge", TOOL_NAMES.SCREENSHOT);
+  if (me !== void 0)
     out.maxEdge = me;
   return out;
 }
@@ -569,28 +650,12 @@ function parseChromeWorkspaceArgs(input) {
   return out;
 }
 function parseTabIds(raw) {
-  const reject = (bad) => {
-    throw new RelayError({
-      code: "invalid_arguments",
-      message: `${TOOL_NAMES.GROUP}: invalid tabId ${JSON.stringify(bad)}. Expected a number or a comma-separated list of numbers.`,
-      tool: TOOL_NAMES.GROUP,
-      phase: "parse_tab_ids",
-      details: { received: bad },
-      retryable: false
-    });
-  };
-  const coerce = (v) => {
-    const n = Number(typeof v === "string" ? v.trim() : v);
-    if (!Number.isFinite(n))
-      reject(v);
-    return n;
-  };
   if (Array.isArray(raw))
-    return raw.map(coerce);
+    return raw.map((v) => coerceTabId(v, TOOL_NAMES.GROUP));
   if (typeof raw === "string")
-    return raw.split(",").map(coerce);
+    return raw.split(",").map((s) => coerceTabId(s, TOOL_NAMES.GROUP));
   if (typeof raw === "number")
-    return [raw];
+    return [coerceTabId(raw, TOOL_NAMES.GROUP)];
   return [];
 }
 function parseColor(raw) {
@@ -710,16 +775,27 @@ function parseChromeScreencastArgs(input) {
     }
     out.format = obj.format;
   }
-  const q = optNumber(obj, "quality");
-  if (q !== void 0)
+  const q = optNonNegativeNumber(obj, "quality", TOOL_NAMES.SCREENCAST);
+  if (q !== void 0) {
+    if (q > 100) {
+      throw new RelayError({
+        code: "invalid_arguments",
+        message: `${TOOL_NAMES.SCREENCAST}: quality must be 0-100 (got ${q}).`,
+        tool: TOOL_NAMES.SCREENCAST,
+        phase: "parse_arguments",
+        details: { field: "quality", received: q, range: [0, 100] },
+        retryable: false
+      });
+    }
     out.quality = q;
-  const mw = optNumber(obj, "maxWidth");
+  }
+  const mw = optPositiveNumber(obj, "maxWidth", TOOL_NAMES.SCREENCAST);
   if (mw !== void 0)
     out.maxWidth = mw;
-  const mh = optNumber(obj, "maxHeight");
+  const mh = optPositiveNumber(obj, "maxHeight", TOOL_NAMES.SCREENCAST);
   if (mh !== void 0)
     out.maxHeight = mh;
-  const en = optNumber(obj, "everyNthFrame");
+  const en = optPositiveNumber(obj, "everyNthFrame", TOOL_NAMES.SCREENCAST);
   if (en !== void 0)
     out.everyNthFrame = en;
   return out;
@@ -754,21 +830,50 @@ var init_args = __esm({
   }
 });
 
+// ../protocol/dist/limits.js
+var DEFAULT_TOOL_CALL_TIMEOUT_MS, DEFAULT_PING_TIMEOUT_MS, DEFAULT_READY_TIMEOUT_MS, DEFAULT_EVAL_TIMEOUT_MS, DEFAULT_BODY_PREVIEW_BYTES, NETWORK_BUFFER_MAX_ENTRIES, NETWORK_BUFFER_MAX_BYTES, CONSOLE_BUFFER_MAX_ENTRIES, CONSOLE_BUFFER_MAX_BYTES;
+var init_limits = __esm({
+  "../protocol/dist/limits.js"() {
+    "use strict";
+    DEFAULT_TOOL_CALL_TIMEOUT_MS = 3e4;
+    DEFAULT_PING_TIMEOUT_MS = 2e3;
+    DEFAULT_READY_TIMEOUT_MS = 15e3;
+    DEFAULT_EVAL_TIMEOUT_MS = 15e3;
+    DEFAULT_BODY_PREVIEW_BYTES = 8 * 1024;
+    NETWORK_BUFFER_MAX_ENTRIES = 200;
+    NETWORK_BUFFER_MAX_BYTES = 512 * 1024;
+    CONSOLE_BUFFER_MAX_ENTRIES = 200;
+    CONSOLE_BUFFER_MAX_BYTES = 256 * 1024;
+  }
+});
+
 // ../protocol/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
   CHROME_WEB_STORE_EXTENSION_ID: () => CHROME_WEB_STORE_EXTENSION_ID,
+  CONSOLE_BUFFER_MAX_BYTES: () => CONSOLE_BUFFER_MAX_BYTES,
+  CONSOLE_BUFFER_MAX_ENTRIES: () => CONSOLE_BUFFER_MAX_ENTRIES,
+  DEFAULT_BODY_PREVIEW_BYTES: () => DEFAULT_BODY_PREVIEW_BYTES,
+  DEFAULT_EVAL_TIMEOUT_MS: () => DEFAULT_EVAL_TIMEOUT_MS,
   DEFAULT_EXTENSION_ID: () => DEFAULT_EXTENSION_ID,
   DEFAULT_EXTENSION_IDS: () => DEFAULT_EXTENSION_IDS,
   DEFAULT_HTTP_PORT: () => DEFAULT_HTTP_PORT,
+  DEFAULT_PING_TIMEOUT_MS: () => DEFAULT_PING_TIMEOUT_MS,
+  DEFAULT_READY_TIMEOUT_MS: () => DEFAULT_READY_TIMEOUT_MS,
+  DEFAULT_TOOL_CALL_TIMEOUT_MS: () => DEFAULT_TOOL_CALL_TIMEOUT_MS,
   LEGACY_DEV_EXTENSION_ID: () => LEGACY_DEV_EXTENSION_ID,
   LOCAL_UNPACKED_EXTENSION_ID: () => LOCAL_UNPACKED_EXTENSION_ID,
   NATIVE_HOST_NAME: () => NATIVE_HOST_NAME,
+  NETWORK_BUFFER_MAX_BYTES: () => NETWORK_BUFFER_MAX_BYTES,
+  NETWORK_BUFFER_MAX_ENTRIES: () => NETWORK_BUFFER_MAX_ENTRIES,
   RelayError: () => RelayError,
   TOOL_NAMES: () => TOOL_NAMES,
   asObject: () => asObject,
+  coerceTabId: () => coerceTabId,
   optBool: () => optBool,
+  optNonNegativeNumber: () => optNonNegativeNumber,
   optNumber: () => optNumber,
+  optPositiveNumber: () => optPositiveNumber,
   optString: () => optString,
   parseChromeAxArgs: () => parseChromeAxArgs,
   parseChromeClickArgs: () => parseChromeClickArgs,
@@ -812,6 +917,7 @@ var init_dist = __esm({
   "../protocol/dist/index.js"() {
     "use strict";
     init_args();
+    init_limits();
     NATIVE_HOST_NAME = "dev.chrome_relay.native_host";
     DEFAULT_HTTP_PORT = 12122;
     CHROME_WEB_STORE_EXTENSION_ID = "cpdiapbifblhlcpnmlmfpgfjlacebokb";
@@ -903,7 +1009,7 @@ var init_dist = __esm({
 import { Command } from "commander";
 
 // src/index.ts
-var CHROME_RELAY_VERSION = true ? "0.5.14" : "0.0.0-dev";
+var CHROME_RELAY_VERSION = true ? "0.5.15" : "0.0.0-dev";
 
 // src/commands/shared.ts
 init_dist();
@@ -1142,6 +1248,14 @@ async function runDoctor() {
 
 // src/release-notes.ts
 var RELEASE_NOTES = {
+  "0.5.15": [
+    "Tab-id coercion is now strict against blank strings. `--tabs '1,,3'` (or `[\"\"]`, or `[' ']`) used to silently become `[1, 0, 3]` because Number('') === 0 \u2014 and tab 0 is a real Chrome target. Now throws RelayError(invalid_arguments). Affects chrome_group create/add/remove, chrome_switch_tab, chrome_close_tabs.",
+    "Numeric range validation added across the parsers. `optPositiveNumber` (> 0) and `optNonNegativeNumber` (>= 0) helpers reject out-of-range values at the parser boundary instead of letting nonsense through to CDP / handler logic. Affects: chrome_evaluate timeoutMs, chrome_screenshot maxEdge + padding, chrome_screencast quality/maxWidth/maxHeight/everyNthFrame, chrome_network body head.",
+    "chrome_screenshot maxEdge <= 0 now throws instead of being silently ignored (was the one remaining `if (x > 0)` silent-drop in the parsers).",
+    "No-args parser comment + behavior aligned. parseGetWindowsAndTabsArgs / parseChromeSelfReloadArgs validate the input is at least an object (rejects strings/arrays) but accept any extra fields. Both handlers now call their parser at the top for consistency with every other tool.",
+    "New @chrome-relay/protocol exports: shared numeric limits in `packages/protocol/src/limits.ts`. Constants (DEFAULT_TOOL_CALL_TIMEOUT_MS, DEFAULT_EVAL_TIMEOUT_MS, DEFAULT_BODY_PREVIEW_BYTES, NETWORK_BUFFER_MAX_ENTRIES/BYTES, CONSOLE_BUFFER_MAX_ENTRIES/BYTES, etc.) now flow from one source \u2014 bridge.ts, console-buffer.ts, network-buffer.ts, and the network/evaluate handlers all import. Future doc/help drift is structurally prevented.",
+    "Tests: +9 in args-all.test.ts covering blank-string rejection, range validation across screenshot/evaluate/screencast/network. Total 416 (was 407)."
+  ],
   "0.5.14": [
     "Optional parser fields are now strict \u2014 passing a present-but-wrong-type value (e.g. `{newTab: 'yes'}` instead of `true`) throws RelayError(invalid_arguments) instead of silently being dropped. undefined/null still means 'caller omitted the field' and the handler uses its default.",
     "parseTargetArgs is strict too: `{tabId: '5'}` rejects (numeric tabId required). Navigate is the one exception \u2014 it coerces string tabId for back-compat since it's used as a 'reference window' rather than a strict target.",

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-var CHROME_RELAY_VERSION = true ? "0.5.14" : "0.0.0-dev";
+var CHROME_RELAY_VERSION = true ? "0.5.15" : "0.0.0-dev";
 export {
   CHROME_RELAY_VERSION
 };

package/dist/native-host.js

@@ -6,6 +6,14 @@ import process from "process";
 // src/http/server.ts
 import Fastify from "fastify";
 
+// ../protocol/dist/limits.js
+var DEFAULT_TOOL_CALL_TIMEOUT_MS = 3e4;
+var DEFAULT_PING_TIMEOUT_MS = 2e3;
+var DEFAULT_READY_TIMEOUT_MS = 15e3;
+var DEFAULT_BODY_PREVIEW_BYTES = 8 * 1024;
+var NETWORK_BUFFER_MAX_BYTES = 512 * 1024;
+var CONSOLE_BUFFER_MAX_BYTES = 256 * 1024;
+
 // ../protocol/dist/index.js
 var DEFAULT_HTTP_PORT = 12122;
 var RelayError = class extends Error {
@@ -48,7 +56,7 @@ function toBridgeError(unknownErr, fallbackTool) {
 }
 
 // src/index.ts
-var CHROME_RELAY_VERSION = true ? "0.5.14" : "0.0.0-dev";
+var CHROME_RELAY_VERSION = true ? "0.5.15" : "0.0.0-dev";
 
 // src/release-notes.ts
 function compareSemver(a, b) {
@@ -197,7 +205,7 @@ var ExtensionBridge = class {
       pending.reject(new Error(message.payload.error));
     }
   }
-  async waitUntilReady(timeoutMs = 15e3) {
+  async waitUntilReady(timeoutMs = DEFAULT_READY_TIMEOUT_MS) {
     if (this.ready) {
       return;
     }
@@ -213,7 +221,7 @@ var ExtensionBridge = class {
       this.readyWaiters.add(onReady);
     });
   }
-  async ping(timeoutMs = 2e3) {
+  async ping(timeoutMs = DEFAULT_PING_TIMEOUT_MS) {
     const id = randomUUID();
     const message = { type: "bridge.ping", id };
     return new Promise((resolve) => {
@@ -229,7 +237,7 @@ var ExtensionBridge = class {
       this.send(message);
     });
   }
-  async callTool(name, args, timeoutMs = 3e4) {
+  async callTool(name, args, timeoutMs = DEFAULT_TOOL_CALL_TIMEOUT_MS) {
     await this.waitUntilReady();
     const id = randomUUID();
     return new Promise((resolve, reject) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-relay",
-  "version": "0.5.14",
+  "version": "0.5.15",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",