sz-chrome-remote-extension.git - pi-chrome, patched to drive a signed-in browser on another host through a broker, with an MCP server

Age	Commit message (Collapse)	Author
12 hours	broker: refuse uploads from outside the staging directory	Igor Soarez
	page.upload and a raw DOM.setFileInputFiles through cdp.call now have to name files whose real path is under /tmp/pi-chrome-uploads (PI_CHROME_UPLOAD_DIR), on the broker's host. Anyone holding the token could otherwise attach any file the user can read to a page.
2026-10-14	broker: a standalone bridge for the browser's host	Igor Soarez
	Upstream's bridge lives inside whichever pi session started first on the machine running the browser, and only serves that machine. The broker takes its place permanently: upstream's HTTP contract to the extension on loopback, and /command and /status on a second, private address for other hosts, behind a bearer token (PI_CHROME_TOKEN, or PI_CHROME_TOKEN_COMMAND).