feat: harden remote serve and reuse connections

- Gate TCP serve commands with safe-by-default policies, per-key allow tokens, per-key rate limiting, and audit labels.
- Reuse authenticated encrypted remote sessions and parallelize/caches multi-browser fanout to reduce repeated handshake roundtrips.
- Increase paged native-host batch size with extension-side byte budgeting to speed large tab listings safely.
- Point install output at public Chrome Web Store / Firefox AMO listings by default, with --dev preserving unpacked workflows.
- Share search-engine metadata between CLI and SDK and bump the package/extension version to 0.16.0.
- Cover the new security, pooling, paging, install, and fanout behavior with expanded Python and extension tests.

browser_cli/commands/raw.py

@@ -4,20 +4,18 @@ import json
 
 import click
 
-from browser_cli.command_security import CommandPolicy, assert_command_allowed
-from browser_cli.commands import client_from_ctx, handle_errors
+from browser_cli.command_security import assert_command_allowed
+from browser_cli.commands import command_policy_from_options, command_policy_options, client_from_ctx, handle_errors
 
 @click.command("command")
 @click.argument("name")
 @click.argument("args_json", required=False, default="{}")
-@click.option("--allow-read-page", is_flag=True, help="Allow page-content read commands such as extract.* and dom.text")
-@click.option("--allow-control", is_flag=True, help="Allow browser-control commands such as nav.*, tabs.close, dom.click")
-@click.option("--allow-dangerous", is_flag=True, help="Allow high-risk commands such as dom.eval, storage.*, screenshots")
+@command_policy_options
 @handle_errors
-def cmd_command(name, args_json, allow_read_page, allow_control, allow_dangerous):
-    """Send a raw browser-cli wire command and print JSON."""
-    policy = CommandPolicy(allow_read_page=allow_read_page, allow_control=allow_control, allow_dangerous=allow_dangerous)
-    assert_command_allowed(name, policy)
-    args = json.loads(args_json) if args_json else {}
-    result = client_from_ctx().command(name, args)
-    click.echo(json.dumps(result, indent=2, default=str))
+def cmd_command(name, args_json, allow_read_page, allow_control, allow_dangerous, allow_keys, allow_all):
+  """Send a raw browser-cli wire command and print JSON."""
+  policy = command_policy_from_options(allow_read_page=allow_read_page, allow_control=allow_control, allow_dangerous=allow_dangerous, allow_keys=allow_keys, allow_all=allow_all)
+  assert_command_allowed(name, policy)
+  args = json.loads(args_json) if args_json else {}
+  result = client_from_ctx().command(name, args)
+  click.echo(json.dumps(result, indent=2, default=str))