sz-chrome-remote-extension.git/test-suite/challenges/42-strict-csp-evaluate.html, branch masterpi-chrome, patched to drive a signed-in browser on another host through a broker, with an MCP server
https://git.soarez.net/sz/sz-chrome-remote-extension.git/atom?h=master2026-05-31T18:19:04+00:000.15.29: CSP bypass via CDP Runtime.evaluate for evaluate/snapshot/waitFor/initScript2026-05-31T18:19:04+00:00Tianren Dongtianrendong.dtr@gmail.com2026-05-31T18:19:04+00:00urn:sha1:d21ebf7b96c90943ab48ffcd6d5b02c6f7438c04
- evaluateInTab/executeInTab now run through CDP Runtime.evaluate instead of
new Function() in MAIN world, so chrome_evaluate/chrome_snapshot work on pages
that block unsafe-eval (github.com, many bank/SaaS apps). Preserves value
markers (undefined/function/symbol/bigint/Error), DOMRect expansion, and the
expression/statement fallback; keeps {ok,value} error envelope.
- page.waitFor polls via service-worker-side CDP evaluation.
- chrome_navigate initScript uses Page.addScriptToEvaluateOnNewDocument.
- Add npm test (test-suite/unit/csp-eval.test.mjs) and in-browser regression
challenge 42 strict-csp-evaluate; update challenge 39 notes + docs/primer.