aboutsummaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)Author
2026-05-310.15.29: CSP bypass via CDP Runtime.evaluate for ↵Tianren Dong
evaluate/snapshot/waitFor/initScript - evaluateInTab/executeInTab now run through CDP Runtime.evaluate instead of new Function() in MAIN world, so chrome_evaluate/chrome_snapshot work on pages that block unsafe-eval (github.com, many bank/SaaS apps). Preserves value markers (undefined/function/symbol/bigint/Error), DOMRect expansion, and the expression/statement fallback; keeps {ok,value} error envelope. - page.waitFor polls via service-worker-side CDP evaluation. - chrome_navigate initScript uses Page.addScriptToEvaluateOnNewDocument. - Add npm test (test-suite/unit/csp-eval.test.mjs) and in-browser regression challenge 42 strict-csp-evaluate; update challenge 39 notes + docs/primer.
2026-05-160.15.26: update docs for benchmark gatesTianren Dong
2026-05-16Revert 0.16.x and 0.17.x: restore tree to v0.15.20 stateTianren Dong
Reverts the pairing + signed-envelopes work (0.16.0-0.16.1), the standalone daemon refactor (0.17.0-0.17.3), and assorted patches. These were unpublished from npm; this commit restores the working tree to match the v0.15.20 release so the branch tip and the npm 'latest' dist-tag are consistent again. Tags v0.16.0 through v0.17.3 are preserved as recovery anchors; the work is reachable via 'git checkout v0.17.3' if ever needed. Tree-equivalent to v0.15.20.
2026-05-160.17.0: standalone daemon, no more owner-vs-client topologyTianren Dong
The Chrome bridge is now a separate detached daemon at ~/.cache/pi-chrome/<version>/daemon.cjs. Every Pi session is a uniform client; daemon lifecycle is decoupled from any Pi session. Killing a Pi never breaks Chrome control, and pi update followed by any new Pi session auto-replaces an incompatible daemon. Architecture: - New extensions/chrome-profile-bridge/daemon.cjs: ~700 LOC, zero deps, runs detached. Owns the HTTP listener, BridgeAuth state, command queue, /pair handshake. Idle-shuts-down after 10 min of no activity. - ChromeProfileBridge on Pi side becomes a pure client: start() probes /status, spawns daemon if missing/incompatible, kills+respawns if version mismatch. send() always uses signed /command. No more server-mode branch. - New signed /admin RPC for pair-window/reset/status state mutations the daemon owns. Pi clients sign with broker key (same contract as /command). - New /heartbeat for daemon idle-timer keepalive. - daemon.log at ~/.cache/pi-chrome/<version>/daemon.log. /chrome pair, /chrome unpair, /chrome onboard now go through /admin RPCs instead of mutating in-process bridge state. Removed the foreign-owner takeover dance from /chrome onboard (auto-handled at session_start now). Wire protocol is byte-identical to 0.16.x; existing paired extensions don't need to re-pair. See docs/DESIGN-0.17-daemon.md for the full write-up.
2026-05-14Audit pi-chrome docsTianren Dong
2026-05-14Restore terminal Chrome authorizationTianren Dong
2026-05-13pi-chrome: snapshot pre-migration stateTianren Dong