fix: code review findings — URL validation hardening, error sanitization, screenshot parse error

Author: DeliciousBuding

internal/client/browser.go

@@ -92,10 +92,10 @@ func (c *Client) Navigate(tabID, url string) error {
 	return err
 }
 
-var blockedURLSchemes = []string{"file:", "javascript:", "data:", "vbscript:"}
+var blockedURLSchemes = []string{"file:", "javascript:", "data:", "vbscript:", "about:", "chrome:", "edge:"}
 
 func validateURL(rawURL string) error {
-	lower := strings.ToLower(rawURL)
+	lower := strings.ToLower(strings.TrimSpace(rawURL))
 	for _, scheme := range blockedURLSchemes {
 		if strings.HasPrefix(lower, scheme) {
 			return fmt.Errorf("blocked URL scheme %q", scheme)
@@ -333,7 +333,7 @@ func (c *Client) Screenshot(tabID string, fullPage bool) (string, error) {
 		Data string `json:"data"`
 	}
 	if err := json.Unmarshal(raw, &result); err != nil {
-		return string(raw), nil
+		return "", fmt.Errorf("parse screenshot response: %w", err)
 	}
 	return result.Data, nil
 }

internal/client/client.go

@@ -209,7 +209,7 @@ func (c *Client) SendRequest(method string, params map[string]interface{}) (json
 	select {
 	case resp := <-ch:
 		if resp.Error != nil {
-			return nil, fmt.Errorf("rpc error in %s: %s", method, resp.Error.Message)
+			return nil, fmt.Errorf("rpc error in %s: %s", method, resp.Error.Error())
 		}
 		return resp.Result, nil
 	case <-c.ctx.Done():