refactor: modularize auth transport and markdown

- Split auth into focused package modules for agent keys, file keys,
  signing, and post-quantum transport helpers while keeping the public
  browser_cli.auth import surface intact.
- Move transport encoding internals into a package with separate codec and
  binary-hoisting helpers, preserving browser_cli.transport compatibility.
- Extract remote TCP auth/socket helpers and serve challenge setup out of the
  runtime paths to make connection handling easier to reason about.
- Move the extension markdown extractor into a dedicated content/markdown
  folder with separate root selection, code normalization, renderer, and utils.
- Centralize CLI Rich rendering helpers for tab/window tree and table output,
  and add rendering tests for the shared builders.
- Remove local typing ignores in SDK/decorator/script plumbing and bump the
  package and extension version to 0.15.3.

browser_cli/transport/__init__.py

@@ -0,0 +1,72 @@
+"""Response payload encoding for the TCP serve <-> client leg.
+
+The wire frame stays ``4-byte LE length + payload``. Payloads are plain JSON
+for legacy peers, or a 1-byte codec tag followed by serialized/compressed data
+when the peer advertised support for it.
+"""
+from __future__ import annotations
+
+import json
+
+from browser_cli.constants import COMP_GZIP, COMP_NONE, COMP_ZLIB, COMP_ZSTD, DEFAULT_TRANSPORT_THRESHOLD, SER_JSON, SER_MSGPACK
+from browser_cli.transport.binary import hoist_screenshot as _hoist_screenshot, unhoist_binary as _unhoist_binary
+from browser_cli.transport.codecs import (
+  JSON_FIRST_BYTES as _JSON_FIRST_BYTES,
+  _msgpack,
+  choose_codec as _choose,
+  client_accept_encoding,
+  compress_payload as _compress,
+  decompress_payload as _decompress,
+  msgpack_available,
+  supported_compression,
+  supported_serialization,
+  zstd_available,
+)
+
+def encode_response(
+  obj,
+  accept: dict | None = None,
+  command: str | None = None,
+  threshold: int = DEFAULT_TRANSPORT_THRESHOLD,
+) -> bytes:
+  """Encode a response object for the chosen/accepted codec.
+
+  Returns bare JSON bytes when no encoding is negotiated, which is byte-for-byte
+  what an old server would have sent.
+  """
+  ser, comp = _choose(accept)
+
+  if ser == SER_MSGPACK:
+    body = _msgpack.packb(_hoist_screenshot(obj, command), use_bin_type=True)
+  else:
+    body = json.dumps(obj).encode("utf-8")
+
+  if comp != COMP_NONE and len(body) >= threshold:
+    body = _compress(comp, body)
+  else:
+    comp = COMP_NONE
+
+  if ser == SER_JSON and comp == COMP_NONE:
+    return body  # plain JSON — historical wire format, no tag byte
+
+  return bytes([(ser << 4) | comp]) + body
+
+def decode_response(raw: bytes | None):
+  """Decode a payload produced by :func:`encode_response` (or plain JSON)."""
+  if raw is None:
+    return None
+  if not raw:
+    raise ValueError("empty response payload")
+  if raw[0] in _JSON_FIRST_BYTES:
+    return json.loads(raw)
+
+  tag = raw[0]
+  ser, comp = tag >> 4, tag & 0x0F
+  body = _decompress(comp, raw[1:])
+  if ser == SER_MSGPACK:
+    if _msgpack is None:
+      raise ValueError("msgpack payload received but msgpack is not installed")
+    return _unhoist_binary(_msgpack.unpackb(body, raw=False))
+  if ser == SER_JSON:
+    return json.loads(body)
+  raise ValueError(f"unknown serialization id {ser}")

browser_cli/transport/binary.py

@@ -0,0 +1,44 @@
+"""Raw-binary hoisting helpers for encoded response payloads."""
+from __future__ import annotations
+
+import base64
+import re
+
+DATA_URL_RE = re.compile(r"^data:([^;,]+);base64,(.+)$", re.S)
+B64_MARKER = "__b64__"
+
+def hoist_screenshot(obj, command: str | None):
+  """Replace a screenshot data URL with raw bytes so msgpack ships it unencoded.
+
+  Gated to ``tabs.screenshot`` so arbitrary page-derived data is never touched.
+  """
+  if command != "tabs.screenshot" or not isinstance(obj, dict):
+    return obj
+  data = obj.get("data")
+  if not isinstance(data, dict):
+    return obj
+  url = data.get("dataUrl")
+  if not isinstance(url, str):
+    return obj
+  match = DATA_URL_RE.match(url)
+  if not match:
+    return obj
+  try:
+    raw = base64.b64decode(match.group(2))
+  except Exception:
+    return obj
+  new_data = dict(data)
+  new_data["dataUrl"] = {B64_MARKER: True, "mime": match.group(1), "raw": raw}
+  return {**obj, "data": new_data}
+
+def unhoist_binary(obj):
+  """Rebuild any hoisted data URL so callers see the original string again."""
+  if isinstance(obj, dict):
+    raw = obj.get("raw")
+    if obj.get(B64_MARKER) and isinstance(raw, (bytes, bytearray)):
+      mime = obj.get("mime") or "application/octet-stream"
+      return f"data:{mime};base64," + base64.b64encode(bytes(raw)).decode("ascii")
+    return {key: unhoist_binary(value) for key, value in obj.items()}
+  if isinstance(obj, list):
+    return [unhoist_binary(value) for value in obj]
+  return obj

browser_cli/transport/codecs.py

@@ -0,0 +1,84 @@
+"""Serialization/compression primitives for TCP response payloads."""
+from __future__ import annotations
+
+import gzip
+import zlib
+
+from browser_cli.constants import COMP_GZIP, COMP_NONE, COMP_ZLIB, COMP_ZSTD, SER_JSON, SER_MSGPACK
+
+try:  # optional: better ratio + speed than zlib/gzip
+  import zstandard as _zstd
+except Exception:  # pragma: no cover - depends on optional extra
+  _zstd = None
+
+try:  # optional: alternate serialization + raw binary for screenshots
+  import msgpack as _msgpack
+except Exception:  # pragma: no cover - depends on optional extra
+  _msgpack = None
+
+SERIALIZATION_NAME = {SER_JSON: "json", SER_MSGPACK: "msgpack"}
+SERIALIZATION_ID = {value: key for key, value in SERIALIZATION_NAME.items()}
+COMPRESSION_NAME = {COMP_NONE: "none", COMP_ZLIB: "zlib", COMP_GZIP: "gzip", COMP_ZSTD: "zstd"}
+COMPRESSION_ID = {value: key for key, value in COMPRESSION_NAME.items()}
+JSON_FIRST_BYTES = frozenset(b"{[")
+
+def msgpack_available() -> bool:
+  return _msgpack is not None
+
+def zstd_available() -> bool:
+  return _zstd is not None
+
+def supported_serialization() -> list[str]:
+  """Serializations this build can produce/consume, best first."""
+  return (["msgpack"] if _msgpack is not None else []) + ["json"]
+
+def supported_compression() -> list[str]:
+  """Compression codecs this build can produce/consume, best first."""
+  return (["zstd"] if _zstd is not None else []) + ["gzip", "zlib"]
+
+def client_accept_encoding() -> dict:
+  """What the local client advertises it can decode (sent with each request)."""
+  return {"ser": supported_serialization(), "comp": supported_compression()}
+
+def compress_payload(comp_id: int, data: bytes) -> bytes:
+  if comp_id == COMP_NONE:
+    return data
+  if comp_id == COMP_ZLIB:
+    return zlib.compress(data, 6)
+  if comp_id == COMP_GZIP:
+    return gzip.compress(data, compresslevel=6)
+  if comp_id == COMP_ZSTD:
+    if _zstd is None:
+      raise ValueError("zstd compression requested but zstandard is not installed")
+    return _zstd.ZstdCompressor(level=10).compress(data)
+  raise ValueError(f"unknown compression id {comp_id}")
+
+def decompress_payload(comp_id: int, data: bytes) -> bytes:
+  if comp_id == COMP_NONE:
+    return data
+  if comp_id == COMP_ZLIB:
+    return zlib.decompress(data)
+  if comp_id == COMP_GZIP:
+    return gzip.decompress(data)
+  if comp_id == COMP_ZSTD:
+    if _zstd is None:
+      raise ValueError("zstd payload received but zstandard is not installed")
+    return _zstd.ZstdDecompressor().decompress(data)
+  raise ValueError(f"unknown compression id {comp_id}")
+
+def choose_codec(accept: dict | None) -> tuple[int, int]:
+  """Pick (serialization_id, compression_id) the peer accepts, server preference first."""
+  accept = accept if isinstance(accept, dict) else {}
+  accept_ser = accept.get("ser") or ["json"]
+  accept_comp = accept.get("comp") or []
+
+  serialization = SER_JSON
+  if _msgpack is not None and "msgpack" in accept_ser:
+    serialization = SER_MSGPACK
+
+  compression = COMP_NONE
+  for name in supported_compression():  # server preference: zstd > gzip > zlib
+    if name in accept_comp:
+      compression = COMPRESSION_ID[name]
+      break
+  return serialization, compression