From c49dc15fa5c33d5b1d210b0185677ce29640e2d5 Mon Sep 17 00:00:00 2001 From: Tianren Dong Date: Sat, 26 Sep 2026 16:37:25 -0400 Subject: Absorb fork fixes and features; release 0.15.53 Adapted from community forks (ardhiqii, kkunkunya, nihar-oracle, steimerbyte): - Abort stalled /next long polls after 45s; time out, retry, and single-post results. - Fall back to CDP Runtime.evaluate when chrome.scripting is refused (about:blank automation tabs). - Load pi-chrome in same-process subagent sessions as a bridge client; client chrome_launch reports owner status. - Add chrome_cdp (validated raw CDP passthrough, background-guarded, payload summarization) and chrome_cdp_targets. - chrome_type reports before/after values, insertedAt, splice/unchanged warnings; add replace=true. - includeSnapshot waits for navigations started by the action; tab.new reports the settled tab. - CDP timeouts surface as timeouts and are not re-sent after the cleanup detach. - Activate/deactivate chrome_find and chrome_inspect with the rest of the chrome_* tools. - New unit suites: bridge-resilience, cdp-passthrough, type-evidence. --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) (limited to 'SECURITY.md') diff --git a/SECURITY.md b/SECURITY.md index 3d07518..0121a1c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,6 +27,7 @@ The Chrome extension under `extensions/chrome-profile-bridge/browser-extension/` - Loopback bridge only. No remote port. No telemetry. - Chrome real input layer for interactive controls. - Chrome control locked by default; `/chrome authorize` unlocks current Pi session after terminal confirmation, `/chrome revoke` locks it again. +- `chrome_cdp` sends raw Chrome DevTools Protocol commands to a tab. It is locked behind `/chrome authorize` like every other tool, but it is not filtered against a safe list. Background mode blocks only its explicit focus methods (`Page.bringToFront`, `Target.activateTarget`). - Hard background mode is on by default: tools cannot override it to explicitly focus windows or activate tabs. `/chrome background off` allows foreground/watch mode. This is not a security sandbox: trusted input, page scripts, native prompts, and Chrome/OS behavior can still affect focus. ## Custom ports -- cgit v1.2.3