sz-chrome-remote-cdp.git/package.json, branch master

castle-search: pi-castle-cdp-search joins the fork as sz-chrome-remote-cdp

2026-10-15T22:08:24+00:00

chore(release): 0.11.1 (#24)

2026-08-13T08:33:46+00:00

fix: accept Windows script paths and start the daemon from a real install (#23)

2026-08-05T19:17:15+00:00

Two independent Windows/production defects reported in #22. browser_run_script rejected every absolute path on Windows. The allowed-root check compared with a hardcoded `${root}/`, but path.resolve returns backslash-separated paths there, so a file inside os.tmpdir() was refused even though the rejection message listed tmpdir as allowed. Decide containment with path.relative instead: it is separator-agnostic and carries each platform's own case rules, so it also accepts a differing drive-letter case that a path.sep patch would still reject. Escapes via `..` and sibling directories sharing the root's name prefix stay rejected, as before. The daemon could not start under `npm omit=dev`: it is spawned through tsx, which was declared only as a dev dependency. Moving tsx to dependencies is not enough on its own — pi installs extensions into one flat hoisted tree, so tsx lands beside the package and the fixed /node_modules/.bin/tsx lookup still misses, falling through to an `npx tsx` that resolves against the wrong cwd and dies against stdio: "ignore". Resolve the CLI entry with Node's own resolver, which walks up to the hoisted copy. That removes the shell entirely, and with it the Windows .cmd shim, windowsVerbatimArguments, and the manual quoting that paths containing spaces needed. Both fixes live in platform-branching code, so their tests are registered in the three-OS CI matrix that already exists for that purpose — a Linux-only run cannot exercise either one.

chore(release): 0.11.0

2026-08-02T13:42:46+00:00

Breaking: the deep-research skill, command, and subagent are gone. Also carries the 0.10.3 fixes, which were tagged but never published. Co-Authored-By: Claude Opus 5 (1M context)

refactor: daemon internals, and fix a leak the merge exposed

2026-08-02T13:42:46+00:00

IdMultiplexer and EventRouter were the only classes in src/; they are now createIdMultiplexer/createEventRouter closures like every other factory here. The multiplexer kept {clientId, localId} per daemon id while the bridge kept {send, clientId, localId, timer, isAttach} under the same key — two maps of overlapping data, and mux.resolve()'s return value was discarded at three of four call sites. One map now holds the union. That merge fixes a real leak: removeClient cleared the multiplexer but never the callbacks map, so a disconnected client's timers stayed armed and later fired a response at a socket that was gone. clearClient now cancels them, and a test pins it. handleRequest polled every 250ms for up to 15s per request when Chrome was down; N queued requests now await one connect signal. server.ts uses its own protocol's serialize/deserialize instead of hand-rolled JSON, and broadcast no longer routes through `this` — the only `this` in the codebase, and the one thing that breaks when the server object is destructured. cdp/event-queue.ts held two unrelated concerns; the request/timeout half moves to cdp/pending-requests.ts. cdp/daemon-transport.ts is the client half of the daemon protocol, so it moves to daemon/transport.ts. test/daemon/ needs adding to the test glob to run at all — there was no daemon test directory before because none of this was reachable without live Chrome. Co-Authored-By: Claude Opus 5 (1M context)

feat!: remove the deep-research feature

2026-08-02T13:42:46+00:00

The harness ships browser tools; orchestrating a multi-agent research workflow on top of them is the agent's job, not this extension's. Drops the skill, the /deep-research command, and the web-search-researcher subagent config. browser_web_search and browser_read_page are untouched — the two tests that covered their pure parsers move to test/domains/, where the test glob still picks them up. Co-Authored-By: Claude Opus 5 (1M context)

chore: fail the build on unguarded type assertions

2026-08-02T13:42:46+00:00

A clean tsc does not prove the absence of casts. This scans src/ for as any, ts-ignore, non-null assertions, inline object casts, and double casts, wired into a new npm run check that CI runs as a single step. The escape hatch is an external allowlist module rather than an inline comment marker: comments are not used in this codebase, and an entry carries a count, so adding a new cast to an already-exempted file still fails until someone raises a number that shows up in the diff. Exactly one exemption is needed today, for the dynamic sharp import. scripts/ was gitignored wholesale, so the two new files are un-ignored individually and everything else dropped there stays ignored. Co-Authored-By: Claude Opus 5 (1M context)

refactor(tools): declare concurrency in the tool definition

2026-08-02T13:42:46+00:00

serialized: true was applied in registry.ts, away from the tools it describes. Now a required concurrency field on each definition, with a test pinning the serialized set so the classes cannot drift. The lock check defaults to taking the mutex for any class that is not explicitly "parallel", so a definition that bypasses defineBrowserTool at runtime fails safe rather than racing on shared CDP state. The test script gains --conditions=import: pi-coding-agent publishes no "require" condition, so importing any tool definition from a CJS-loaded test could not resolve it. Co-Authored-By: Claude Opus 5 (1M context)

chore(build): split tsconfig, typecheck tests, add node:test runner

2026-08-02T13:42:46+00:00

test/ was never type-checked and had no runner. Adds tsconfig.base.json shared by a src project and a test project, an npm test script scoped to non-manual suites, and a CI step. Ports the profile store suite as proof. Co-Authored-By: Claude Opus 5 (1M context)

chore: release 0.10.3

2026-07-26T15:21:43+00:00

Co-Authored-By: Claude Opus 5 (1M context)