sz-chrome-remote-extension.git/package.json, branch masterpi-chrome, patched to drive a signed-in browser on another host through a broker, with an MCP server
https://git.soarez.net/sz/sz-chrome-remote-extension.git/atom?h=master2026-11-06T11:49:39+00:00extension: end a /chrome authorize grant with its session2026-11-06T11:49:39+00:00Igor Soarezigor@soarez.org2026-11-06T11:49:39+00:00urn:sha1:ff99a4432a3feedfac10d9514ce661a9cb95004c
The grant lives on globalThis so /reload keeps it, but nothing cleared it
when pi replaced the session in the same process. After /new, /resume or
/fork the next session started authorized and announced it in the footer.
Drop the saved grant on session_shutdown for new, resume and fork. Reload
keeps it. Quit leaves it alone, so a subagent quitting in the same process
does not take its parent's grant with it.
grant-scope.test.mjs loads the shipped module once per runtime in one
shared context, the way pi keeps globalThis across reloads and switches,
and checks the tools and the footer after each. It fails on 85b4988, and
its /chrome authorize cases fail with only the PI_CHROME_AUTHORIZE fix.
broker: refuse uploads from outside the staging directory2026-11-06T09:20:16+00:00Igor Soarezigor@soarez.org2026-11-06T09:20:16+00:00urn:sha1:85b49885256464b735923eaa771044706383718f
page.upload and a raw DOM.setFileInputFiles through cdp.call now have to name
files whose real path is under /tmp/pi-chrome-uploads (PI_CHROME_UPLOAD_DIR),
on the broker's host. Anyone holding the token could otherwise attach any file
the user can read to a page.
Release 0.15.57 (#28)2026-09-29T00:24:49+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-29T00:24:49+00:00urn:sha1:1d7c4704e3b6cd2bd018de9d963e60eb23508f50Release 0.15.562026-09-28T23:38:27+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-28T23:38:27+00:00urn:sha1:9e4514f020ecab9af0a8b8d36f01fc802ff5123eRelease 0.15.552026-09-27T03:32:49+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-27T03:32:49+00:00urn:sha1:6c5d31eddd145697f4c6f9d4964000c6e2068cb1Make Chrome primer and authorization log prompt-cache friendly2026-09-27T03:28:51+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-27T02:20:21+00:00urn:sha1:c5c048b3b2b978d99f6b4f941be842429744c946
- Contribute the primer as a structured prompt section instead of forcing systemPrompt.
- Log pi-chrome-tool-change as a rendered custom entry that is not sent to the model.
Stop console capture from tripping DevTools detection; scope early capture to Pi tabs2026-09-27T02:41:47+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-27T02:41:47+00:00urn:sha1:f034b8517d0903455e1b9729e876420cbfd002fb
Fixes #9. Sites like BOSS Zhipin log an object with a getter/toString trap and
close the tab if it is read. Store captured console args raw and serialize them
on read without running page code (data properties only, accessors as [getter],
built-ins via native getters). Inject document-start capture only into Pi's
automation tab and session-tracked tabs.
Report hidden-tab input, append targeted typing, smarter uploads, prune screenshots; release 0.15.542026-09-26T23:07:56+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-26T23:07:56+00:00urn:sha1:238f347a03b2cefb21198bb78a90699e931d8504
- Check page visibility before trusted input: Chrome drops input to hidden pages (inactive tabs,
covered/minimized windows, macOS window tabs behind full screen). Type/key/hover/scroll/tap/drag
fail fast with the reason; click/fill use their DOM fallback immediately (or reject with
domFallback:false).
- Use an inactive tab instead of a new window for the automation target while the user's window is
full screen.
- chrome_type with uid/selector moves the caret to the end (moveToEndOfDocument) after its focus click.
- chrome_upload_file: labels/wrappers resolve to their file input, same-origin iframe search, and
intercepted file chooser for upload buttons (trusted click when visible, user-gesture click when
hidden); reject multiple paths for single-file inputs; no duplicate change event.
- Prune default-folder chrome_screenshot captures (7 days, newest 20 kept, retentionDays override).
- input.debug without a target no longer calls tabs.get(-1).
- New hidden-input unit suite.
Absorb fork fixes and features; release 0.15.532026-09-26T20:37:25+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-26T20:37:25+00:00urn:sha1:c49dc15fa5c33d5b1d210b0185677ce29640e2d5
Adapted from community forks (ardhiqii, kkunkunya, nihar-oracle, steimerbyte):
- Abort stalled /next long polls after 45s; time out, retry, and single-post results.
- Fall back to CDP Runtime.evaluate when chrome.scripting is refused (about:blank automation tabs).
- Load pi-chrome in same-process subagent sessions as a bridge client; client chrome_launch reports owner status.
- Add chrome_cdp (validated raw CDP passthrough, background-guarded, payload summarization) and chrome_cdp_targets.
- chrome_type reports before/after values, insertedAt, splice/unchanged warnings; add replace=true.
- includeSnapshot waits for navigations started by the action; tab.new reports the settled tab.
- CDP timeouts surface as timeouts and are not re-sent after the cleanup detach.
- Activate/deactivate chrome_find and chrome_inspect with the rest of the chrome_* tools.
- New unit suites: bridge-resilience, cdp-passthrough, type-evidence.
Simplify Chrome status commands and release 0.15.512026-09-10T17:33:17+00:00Tianren Dongtianrendong.dtr@gmail.com2026-09-10T17:33:17+00:00urn:sha1:04e7b89f3525f770ee8eaefb983632f27afaf2f0