mirror of https://github.com/garrytan/gstack.git
1796 lines
72 KiB
TypeScript
1796 lines
72 KiB
TypeScript
/**
|
||
* Browser lifecycle manager
|
||
*
|
||
* Chromium crash handling:
|
||
* browser.on('disconnected') → log error → process.exit(1)
|
||
* CLI detects dead server → auto-restarts on next command
|
||
* We do NOT try to self-heal — don't hide failure.
|
||
*
|
||
* Dialog handling:
|
||
* page.on('dialog') → auto-accept by default → store in dialog buffer
|
||
* Prevents browser lockup from alert/confirm/prompt
|
||
*
|
||
* Context recreation (useragent):
|
||
* recreateContext() saves cookies/storage/URLs, creates new context,
|
||
* restores state. Falls back to clean slate on any failure.
|
||
*/
|
||
|
||
import { chromium, type Browser, type BrowserContext, type BrowserContextOptions, type Page, type Locator, type Cookie } from 'playwright';
|
||
import { writeSecureFile, mkdirSecure } from './file-permissions';
|
||
import { addConsoleEntry, addNetworkEntry, addDialogEntry, networkBuffer, type DialogEntry } from './buffers';
|
||
import { emitActivity } from './activity';
|
||
import { validateNavigationUrl } from './url-validation';
|
||
import { TabSession, type RefEntry } from './tab-session';
|
||
import { resolveChromiumProfile, cleanSingletonLocks } from './config';
|
||
import { withCdpSession } from './cdp-bridge';
|
||
import type { MemorySnapshot, MemoryStructureStats, MemoryTabSnapshot, MemoryProcess } from './memory-snapshot';
|
||
|
||
/**
|
||
* Detect whether GSTACK_CHROMIUM_PATH points at a custom Chromium build that
|
||
* already bakes the gstack extension in as a component extension (e.g.,
|
||
* GStack Browser.app / GBrowser). Passing --load-extension against such a
|
||
* binary triggers a ServiceWorkerState::SetWorkerId DCHECK because two
|
||
* copies of the same service worker try to register.
|
||
*
|
||
* Resolution:
|
||
* 1. GSTACK_CHROMIUM_KIND === 'custom-extension-baked' (preferred, explicit)
|
||
* 2. GSTACK_CHROMIUM_PATH path substring contains 'GBrowser' or 'gbrowser'
|
||
* (fallback for callers that only set the path)
|
||
*/
|
||
export function isCustomChromium(): boolean {
|
||
if (process.env.GSTACK_CHROMIUM_KIND === 'custom-extension-baked') return true;
|
||
const p = process.env.GSTACK_CHROMIUM_PATH || '';
|
||
return p.includes('GBrowser') || p.includes('gbrowser');
|
||
}
|
||
|
||
/**
|
||
* Decide whether Playwright should request Chromium's sandbox.
|
||
*
|
||
* Returns false on Windows (Bun→Node→Chromium chain breaks the sandbox,
|
||
* GitHub #276) and on Linux under root / CI / container (sandbox needs
|
||
* unprivileged user namespaces, which are missing for root and typically
|
||
* disabled in containers).
|
||
*
|
||
* When false, Playwright auto-adds --no-sandbox to the launch args — the
|
||
* desired behavior in those environments. When true, Playwright does NOT
|
||
* add --no-sandbox, which keeps Chromium's "unsupported command-line flag"
|
||
* yellow infobar from appearing on every headed launch.
|
||
*
|
||
* The headless launch path also pushes an explicit '--no-sandbox' into args
|
||
* when CI/CONTAINER/root is set; that push is now defensively redundant
|
||
* (Playwright will add it anyway when this returns false) and harmless.
|
||
*/
|
||
export function shouldEnableChromiumSandbox(): boolean {
|
||
if (process.platform === 'win32') return false;
|
||
// Explicit user override for Ubuntu/AppArmor and similar environments where
|
||
// unprivileged Chromium sandboxing is blocked even for normal users (the
|
||
// sandbox needs unprivileged user namespaces that the host policy denies,
|
||
// so /qa hangs without --no-sandbox). Setting GSTACK_CHROMIUM_NO_SANDBOX=1
|
||
// forces the sandbox off without changing the default for everyone else.
|
||
// See #1562.
|
||
if (process.env.GSTACK_CHROMIUM_NO_SANDBOX === '1') return false;
|
||
const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
|
||
return !(process.env.CI || process.env.CONTAINER || isRoot);
|
||
}
|
||
|
||
/**
|
||
* Resolve why the underlying Chromium ChildProcess is going away.
|
||
*
|
||
* The 'disconnected' Playwright event fires before the child process emits
|
||
* its own 'exit' in most cases, so .exitCode is null at that moment. Wait
|
||
* briefly (capped at 1s) for the exit then read .exitCode + .signalCode:
|
||
*
|
||
* exitCode === 0 && no signal → 'clean' (user Cmd+Q, normal shutdown)
|
||
* anything else → 'crash' (signal-kill, SIGSEGV, OOM, non-zero exit)
|
||
*
|
||
* Process supervisors (gbrowser's gbd HealthMonitor in cmd/gbd/health.go)
|
||
* read our exit code to decide whether to restart. The two callers in this
|
||
* file ride on top of this: a 'clean' result exits with code 0 (gbd skips
|
||
* restart, treats as user-intent); a 'crash' result keeps the existing
|
||
* per-path exit semantics (launch→1, launchHeaded→2, handoff→1) and gbd
|
||
* restarts on backoff.
|
||
*/
|
||
export async function resolveDisconnectCause(browser: Browser | null): Promise<'clean' | 'crash'> {
|
||
const proc = browser?.process();
|
||
if (proc && proc.exitCode === null && proc.signalCode === null) {
|
||
await new Promise<void>((resolve) => {
|
||
const timer = setTimeout(resolve, 1000);
|
||
proc.once('exit', () => {
|
||
clearTimeout(timer);
|
||
resolve();
|
||
});
|
||
});
|
||
}
|
||
return proc?.exitCode === 0 && proc?.signalCode == null ? 'clean' : 'crash';
|
||
}
|
||
|
||
/**
|
||
* Headless `launch()` disconnect handler. Exits 0 on clean user-quit, 1 on
|
||
* crash. Inlined into the launch() body via a one-line dispatch so
|
||
* browser-manager's flow stays grep-friendly.
|
||
*/
|
||
export async function handleChromiumDisconnect(browser: Browser | null): Promise<void> {
|
||
const cause = await resolveDisconnectCause(browser);
|
||
if (cause === 'clean') {
|
||
console.error('[browse] Chromium closed cleanly (user-initiated quit). Server exiting (0).');
|
||
process.exit(0);
|
||
}
|
||
console.error('[browse] FATAL: Chromium process crashed or was killed. Server exiting (1).');
|
||
console.error('[browse] Console/network logs flushed to .gstack/browse-*.log');
|
||
process.exit(1);
|
||
}
|
||
|
||
export type { RefEntry };
|
||
|
||
// Re-export TabSession for consumers
|
||
export { TabSession };
|
||
|
||
export interface BrowserState {
|
||
cookies: Cookie[];
|
||
pages: Array<{
|
||
url: string;
|
||
isActive: boolean;
|
||
storage: { localStorage: Record<string, string>; sessionStorage: Record<string, string> } | null;
|
||
/**
|
||
* HTML content loaded via load-html (setContent), replayed after context recreation.
|
||
* In-memory only — never persisted to disk (HTML may contain secrets or customer data).
|
||
*/
|
||
loadedHtml?: string;
|
||
loadedHtmlWaitUntil?: 'load' | 'domcontentloaded' | 'networkidle';
|
||
/**
|
||
* Tab owner clientId for multi-agent isolation. Survives context recreation so
|
||
* scoped agents don't get locked out of their own tabs after viewport --scale.
|
||
* In-memory only.
|
||
*/
|
||
owner?: string;
|
||
}>;
|
||
}
|
||
|
||
export class BrowserManager {
|
||
private browser: Browser | null = null;
|
||
private context: BrowserContext | null = null;
|
||
// Proxy config applied to chromium.launch() when set (D8). Set by server.ts
|
||
// at startup based on BROWSE_PROXY_URL. For SOCKS5 with auth, server.ts
|
||
// points this at the local bridge (socks5://127.0.0.1:<bridgePort>); for
|
||
// HTTP/HTTPS or unauth SOCKS5, it's the upstream URL directly.
|
||
private proxyConfig: { server: string; username?: string; password?: string } | null = null;
|
||
private pages: Map<number, Page> = new Map();
|
||
private tabSessions: Map<number, TabSession> = new Map();
|
||
private activeTabId: number = 0;
|
||
private nextTabId: number = 1;
|
||
private extraHeaders: Record<string, string> = {};
|
||
private customUserAgent: string | null = null;
|
||
|
||
// ─── Viewport + deviceScaleFactor (context options) ──────────
|
||
// Tracked at the manager level so recreateContext() preserves them.
|
||
// deviceScaleFactor is a *context* option, not a page-level setter — changes
|
||
// require recreateContext(). Viewport width/height can change on-page, but we
|
||
// track the latest so context recreation restores it instead of hardcoding 1280x720.
|
||
private deviceScaleFactor: number = 1;
|
||
private currentViewport: { width: number; height: number } = { width: 1280, height: 720 };
|
||
|
||
/** Server port — set after server starts, used by cookie-import-browser command */
|
||
public serverPort: number = 0;
|
||
|
||
// ─── Tab Ownership (multi-agent isolation) ──────────────
|
||
// Maps tabId → clientId. Unowned tabs (not in this map) are root-only for writes.
|
||
private tabOwnership: Map<number, string> = new Map();
|
||
|
||
// ─── Dialog Handling (global, not per-tab) ──────────────────
|
||
private dialogAutoAccept: boolean = true;
|
||
private dialogPromptText: string | null = null;
|
||
|
||
// ─── Cookie Origin Tracking ────────────────────────────────
|
||
private cookieImportedDomains: Set<string> = new Set();
|
||
|
||
// ─── Handoff State ─────────────────────────────────────────
|
||
private isHeaded: boolean = false;
|
||
private consecutiveFailures: number = 0;
|
||
|
||
// ─── Watch Mode ─────────────────────────────────────────
|
||
private watching = false;
|
||
public watchInterval: ReturnType<typeof setInterval> | null = null;
|
||
private watchSnapshots: string[] = [];
|
||
private watchStartTime: number = 0;
|
||
|
||
// ─── Headed State ────────────────────────────────────────
|
||
private connectionMode: 'launched' | 'headed' = 'launched';
|
||
private intentionalDisconnect = false;
|
||
|
||
// ─── Tab Count Guardrail (D5 + Codex single-tab flag) ───────
|
||
// Idempotent threshold trackers: each guardrail fires exactly once per
|
||
// upward crossing of its threshold and re-arms when the tab count drops
|
||
// back below. Pre-guardrail, nothing tracked tab count growth and a
|
||
// user could accumulate hundreds of tabs (each holding 50–300 MB of
|
||
// Chromium-side RSS) without warning until the OS OOM-killer fired.
|
||
// The toast UX lives in the sidebar (extension/sidepanel.js); the
|
||
// server-side responsibility is the audit-trail activity entry that
|
||
// appears in the activity feed even when the sidebar is closed.
|
||
private static readonly TAB_GUARDRAIL_SOFT = 50;
|
||
private static readonly TAB_GUARDRAIL_HARD = 200;
|
||
private tabGuardrailSoftHit = false;
|
||
private tabGuardrailHardHit = false;
|
||
|
||
/**
|
||
* Called from context.on('page') after a new tab is tracked. Emits at
|
||
* most one activity entry per upward crossing of each threshold.
|
||
*/
|
||
private checkTabGuardrails(): void {
|
||
const total = this.pages.size;
|
||
if (!this.tabGuardrailSoftHit && total >= BrowserManager.TAB_GUARDRAIL_SOFT) {
|
||
this.tabGuardrailSoftHit = true;
|
||
const msg = `Tab count crossed ${BrowserManager.TAB_GUARDRAIL_SOFT} (now ${total}). Consider closing unused tabs — each Chromium tab holds 50–300 MB.`;
|
||
console.warn(`[browse] ${msg}`);
|
||
emitActivity({ type: 'error', command: 'tab-guardrail', error: msg, tabs: total });
|
||
}
|
||
if (!this.tabGuardrailHardHit && total >= BrowserManager.TAB_GUARDRAIL_HARD) {
|
||
this.tabGuardrailHardHit = true;
|
||
const msg = `Tab count crossed ${BrowserManager.TAB_GUARDRAIL_HARD} (now ${total}). OOM risk imminent. Open the sidebar to see top RAM consumers.`;
|
||
console.error(`[browse] ${msg}`);
|
||
emitActivity({ type: 'error', command: 'tab-guardrail', error: msg, tabs: total });
|
||
}
|
||
}
|
||
|
||
/** Called from page.on('close') so the guardrails re-arm. */
|
||
private recheckTabGuardrailsOnClose(): void {
|
||
const total = this.pages.size;
|
||
if (this.tabGuardrailSoftHit && total < BrowserManager.TAB_GUARDRAIL_SOFT) {
|
||
this.tabGuardrailSoftHit = false;
|
||
}
|
||
if (this.tabGuardrailHardHit && total < BrowserManager.TAB_GUARDRAIL_HARD) {
|
||
this.tabGuardrailHardHit = false;
|
||
}
|
||
}
|
||
|
||
// Called when the headed browser disconnects without intentional teardown
|
||
// (user closed the window). Wired up by server.ts to run full cleanup
|
||
// (sidebar-agent, state file, profile locks) before exiting with code 2.
|
||
// Returns void or a Promise; rejections are caught and fall back to exit(2).
|
||
// `exitCode` is the resolved process exit code from the disconnect cause:
|
||
// 0 on clean user-initiated quit (e.g., Cmd+Q on headed Chromium), 2 on
|
||
// crash/signal-kill. Callers (server.ts) forward it to their shutdown
|
||
// pipeline so process supervisors (gbrowser's gbd) read the right signal.
|
||
public onDisconnect: ((exitCode?: number) => void | Promise<void>) | null = null;
|
||
|
||
getConnectionMode(): 'launched' | 'headed' { return this.connectionMode; }
|
||
|
||
// ─── Watch Mode Methods ─────────────────────────────────
|
||
isWatching(): boolean { return this.watching; }
|
||
|
||
startWatch(): void {
|
||
this.watching = true;
|
||
this.watchSnapshots = [];
|
||
this.watchStartTime = Date.now();
|
||
}
|
||
|
||
stopWatch(): { snapshots: string[]; duration: number } {
|
||
this.watching = false;
|
||
if (this.watchInterval) {
|
||
clearInterval(this.watchInterval);
|
||
this.watchInterval = null;
|
||
}
|
||
const snapshots = this.watchSnapshots;
|
||
const duration = Date.now() - this.watchStartTime;
|
||
this.watchSnapshots = [];
|
||
this.watchStartTime = 0;
|
||
return { snapshots, duration };
|
||
}
|
||
|
||
addWatchSnapshot(snapshot: string): void {
|
||
this.watchSnapshots.push(snapshot);
|
||
}
|
||
|
||
/**
|
||
* Find the gstack Chrome extension directory.
|
||
* Checks: repo root /extension, global install, dev install.
|
||
*/
|
||
private findExtensionPath(): string | null {
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const candidates = [
|
||
// Explicit override via env var (used by GStack Browser.app bundle)
|
||
process.env.BROWSE_EXTENSIONS_DIR || '',
|
||
// Relative to this source file (dev mode: browse/src/ -> ../../extension)
|
||
path.resolve(__dirname, '..', '..', 'extension'),
|
||
// Global gstack install
|
||
path.join(process.env.HOME || '', '.claude', 'skills', 'gstack', 'extension'),
|
||
// Git repo root (detected via BROWSE_STATE_FILE location)
|
||
(() => {
|
||
const stateFile = process.env.BROWSE_STATE_FILE || '';
|
||
if (stateFile) {
|
||
const repoRoot = path.resolve(path.dirname(stateFile), '..');
|
||
return path.join(repoRoot, '.claude', 'skills', 'gstack', 'extension');
|
||
}
|
||
return '';
|
||
})(),
|
||
].filter(Boolean);
|
||
|
||
for (const candidate of candidates) {
|
||
try {
|
||
if (fs.existsSync(path.join(candidate, 'manifest.json'))) {
|
||
return candidate;
|
||
}
|
||
} catch (err: any) {
|
||
if (err?.code !== 'ENOENT' && err?.code !== 'EACCES') throw err;
|
||
}
|
||
}
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* Set the proxy config applied to chromium.launch() in launch() and
|
||
* launchHeaded(). Called by server.ts at startup once the (optional) SOCKS5
|
||
* bridge is up.
|
||
*/
|
||
setProxyConfig(cfg: { server: string; username?: string; password?: string } | null): void {
|
||
this.proxyConfig = cfg;
|
||
}
|
||
|
||
/**
|
||
* Get the ref map for external consumers (e.g., /refs endpoint).
|
||
*/
|
||
getRefMap(): Array<{ ref: string; role: string; name: string }> {
|
||
try {
|
||
return this.getActiveSession().getRefEntries();
|
||
} catch {
|
||
return [];
|
||
}
|
||
}
|
||
|
||
async launch() {
|
||
// ─── Extension Support ────────────────────────────────────
|
||
// BROWSE_EXTENSIONS_DIR points to an unpacked Chrome extension directory.
|
||
// Extensions only work in headed mode, so we use an off-screen window.
|
||
const extensionsDir = process.env.BROWSE_EXTENSIONS_DIR;
|
||
const { STEALTH_LAUNCH_ARGS } = await import('./stealth');
|
||
const launchArgs: string[] = [...STEALTH_LAUNCH_ARGS];
|
||
let useHeadless = true;
|
||
|
||
// Docker/CI/root: Chromium sandbox requires unprivileged user namespaces which
|
||
// are typically disabled in containers and are never available for the root
|
||
// user on Linux. Detect all three cases and add --no-sandbox automatically.
|
||
const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
|
||
if (process.env.CI || process.env.CONTAINER || isRoot) {
|
||
launchArgs.push('--no-sandbox');
|
||
}
|
||
|
||
if (extensionsDir) {
|
||
// Skip --load-extension when running against a custom Chromium build that
|
||
// already bakes the extension in (e.g., GBrowser / GStack Browser.app).
|
||
// Loading it twice causes a ServiceWorkerState::SetWorkerId DCHECK crash.
|
||
if (!isCustomChromium()) {
|
||
launchArgs.push(
|
||
`--disable-extensions-except=${extensionsDir}`,
|
||
`--load-extension=${extensionsDir}`,
|
||
);
|
||
}
|
||
launchArgs.push('--window-position=-9999,-9999', '--window-size=1,1');
|
||
useHeadless = false; // extensions require headed mode; off-screen window simulates headless
|
||
console.log(`[browse] Extensions loaded from: ${extensionsDir}`);
|
||
}
|
||
|
||
this.browser = await chromium.launch({
|
||
headless: useHeadless,
|
||
// On Windows, Chromium's sandbox fails when the server is spawned through
|
||
// the Bun→Node process chain (GitHub #276). Disable it — local daemon
|
||
// browsing user-specified URLs has marginal sandbox benefit. Also disabled
|
||
// on Linux root/CI/container, where the sandbox requires unprivileged user
|
||
// namespaces that aren't available.
|
||
chromiumSandbox: shouldEnableChromiumSandbox(),
|
||
...(launchArgs.length > 0 ? { args: launchArgs } : {}),
|
||
...(this.proxyConfig ? { proxy: this.proxyConfig } : {}),
|
||
});
|
||
|
||
// Chromium disconnect → distinguish clean user-quit from crash. Both
|
||
// events look identical to Playwright (one 'disconnected' fires), but
|
||
// the underlying ChildProcess exit code separates them:
|
||
// exitCode === 0 → clean quit (user Cmd+Q on macOS, normal shutdown)
|
||
// exitCode !== 0 → crash, signal-kill, or OOM
|
||
// Process supervisors (gbrowser's gbd) consume our exit code: code 0
|
||
// means "user wanted this, don't restart"; non-zero means "crash, please
|
||
// bring me back." Without this distinction every Cmd+Q gets treated as
|
||
// a crash and the user-visible window keeps respawning.
|
||
this.browser.on('disconnected', () => {
|
||
void handleChromiumDisconnect(this.browser);
|
||
});
|
||
|
||
const contextOptions: BrowserContextOptions = {
|
||
viewport: { width: this.currentViewport.width, height: this.currentViewport.height },
|
||
deviceScaleFactor: this.deviceScaleFactor,
|
||
};
|
||
if (this.customUserAgent) {
|
||
contextOptions.userAgent = this.customUserAgent;
|
||
}
|
||
this.context = await this.browser.newContext(contextOptions);
|
||
|
||
if (Object.keys(this.extraHeaders).length > 0) {
|
||
await this.context.setExtraHTTPHeaders(this.extraHeaders);
|
||
}
|
||
|
||
// D7: mask navigator.webdriver only. The other 3 wintermute patches
|
||
// (plugins, languages, chrome.runtime) are intentionally NOT applied —
|
||
// faking them to fixed values can flag more bot-like to modern
|
||
// fingerprinters, not less.
|
||
const { applyStealth } = await import('./stealth');
|
||
await applyStealth(this.context);
|
||
|
||
// Create first tab
|
||
await this.newTab();
|
||
}
|
||
|
||
// ─── Headed Mode ─────────────────────────────────────────────
|
||
/**
|
||
* Launch Playwright's bundled Chromium in headed mode with the gstack
|
||
* Chrome extension auto-loaded. Uses launchPersistentContext() which
|
||
* is required for extension loading (launch() + newContext() can't
|
||
* load extensions).
|
||
*
|
||
* The browser launches headed with a visible window — the user sees
|
||
* every action Claude takes in real time.
|
||
*/
|
||
async launchHeaded(authToken?: string): Promise<void> {
|
||
// Clear old state before repopulating
|
||
this.pages.clear();
|
||
this.tabSessions.clear();
|
||
this.nextTabId = 1;
|
||
|
||
// Find the gstack extension directory for auto-loading
|
||
const extensionPath = this.findExtensionPath();
|
||
const launchArgs = [
|
||
'--hide-crash-restore-bubble',
|
||
// Anti-bot-detection: remove the navigator.webdriver flag that Playwright sets.
|
||
// Sites like Google and NYTimes check this to block automation browsers.
|
||
'--disable-blink-features=AutomationControlled',
|
||
];
|
||
if (extensionPath) {
|
||
// Skip --load-extension when running against a custom Chromium build
|
||
// that already bakes the extension in as a component extension
|
||
// (gbrowser / GStack Browser.app). Loading it twice causes a
|
||
// ServiceWorkerState::SetWorkerId DCHECK crash.
|
||
if (!isCustomChromium()) {
|
||
launchArgs.push(`--disable-extensions-except=${extensionPath}`);
|
||
launchArgs.push(`--load-extension=${extensionPath}`);
|
||
}
|
||
// Write auth token for extension bootstrap (still required even when
|
||
// the extension is component-baked — it reads ~/.gstack/.auth.json at
|
||
// startup to learn how to call the daemon).
|
||
// Write to ~/.gstack/.auth.json (not the extension dir, which may be read-only
|
||
// in .app bundles and breaks codesigning).
|
||
if (authToken) {
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const gstackDir = path.join(process.env.HOME || '/tmp', '.gstack');
|
||
mkdirSecure(gstackDir);
|
||
const authFile = path.join(gstackDir, '.auth.json');
|
||
try {
|
||
writeSecureFile(authFile, JSON.stringify({ token: authToken, port: this.serverPort || 34567 }));
|
||
} catch (err: any) {
|
||
console.warn(`[browse] Could not write .auth.json: ${err.message}`);
|
||
}
|
||
}
|
||
}
|
||
|
||
// Launch headed Chromium via Playwright's persistent context.
|
||
// Extensions REQUIRE launchPersistentContext (not launch + newContext).
|
||
// Real Chrome (executablePath/channel) silently blocks --load-extension,
|
||
// so we use Playwright's bundled Chromium which reliably loads extensions.
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const userDataDir = resolveChromiumProfile();
|
||
fs.mkdirSync(userDataDir, { recursive: true });
|
||
|
||
// Pre-launch cleanup of stale SingletonLock/Socket/Cookie. Chromium's
|
||
// ProcessSingleton refuses to start when these exist from a prior crash
|
||
// (SIGKILL, hard crash) — the lockfiles point at a PID that may no longer
|
||
// exist. Shutdown cleanup doesn't run on hard crashes, so we clean here
|
||
// too. Safe under external coordination: gbd.lock for gbrowser,
|
||
// single-instance CLI check for gstack.
|
||
cleanSingletonLocks(userDataDir);
|
||
|
||
// Support custom Chromium binary via GSTACK_CHROMIUM_PATH env var.
|
||
// Used by GStack Browser.app to point at the bundled Chromium.
|
||
const executablePath = process.env.GSTACK_CHROMIUM_PATH || undefined;
|
||
|
||
// Rebrand Chromium → GStack Browser in macOS menu bar / Dock / Cmd+Tab.
|
||
// Patch the Chromium .app's Info.plist so macOS shows our name.
|
||
// This works for both dev mode (system Playwright cache) and .app bundle.
|
||
const chromePath = executablePath || chromium.executablePath();
|
||
try {
|
||
// Walk up from binary to the .app's Info.plist
|
||
// e.g. .../Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing
|
||
// → .../Google Chrome for Testing.app/Contents/Info.plist
|
||
const chromeContentsDir = path.resolve(path.dirname(chromePath), '..');
|
||
const chromePlist = path.join(chromeContentsDir, 'Info.plist');
|
||
if (fs.existsSync(chromePlist)) {
|
||
const plistContent = fs.readFileSync(chromePlist, 'utf-8');
|
||
if (plistContent.includes('Google Chrome for Testing')) {
|
||
const patched = plistContent
|
||
.replace(/Google Chrome for Testing/g, 'GStack Browser');
|
||
fs.writeFileSync(chromePlist, patched);
|
||
}
|
||
// Replace Chromium's Dock icon with ours (Chromium's process owns the Dock icon)
|
||
const iconCandidates = [
|
||
path.join(__dirname, '..', '..', 'scripts', 'app', 'icon.icns'), // repo dev mode
|
||
path.join(process.env.HOME || '', '.claude', 'skills', 'gstack', 'scripts', 'app', 'icon.icns'), // global install
|
||
];
|
||
const iconSrc = iconCandidates.find(p => fs.existsSync(p));
|
||
if (iconSrc) {
|
||
const chromeResources = path.join(chromeContentsDir, 'Resources');
|
||
// Read original icon name from plist
|
||
const iconMatch = plistContent.match(/<key>CFBundleIconFile<\/key>\s*<string>([^<]+)<\/string>/);
|
||
let origIcon = iconMatch ? iconMatch[1] : 'app';
|
||
if (!origIcon.endsWith('.icns')) origIcon += '.icns';
|
||
const destIcon = path.join(chromeResources, origIcon);
|
||
try {
|
||
fs.copyFileSync(iconSrc, destIcon);
|
||
} catch (err: any) {
|
||
if (err?.code !== 'ENOENT' && err?.code !== 'EACCES') throw err;
|
||
}
|
||
}
|
||
}
|
||
} catch (err: any) {
|
||
// Non-fatal: app name stays as Chrome for Testing (ENOENT/EACCES expected)
|
||
if (err?.code !== 'ENOENT' && err?.code !== 'EACCES') throw err;
|
||
}
|
||
|
||
// Build custom user agent: keep Chrome version for site compatibility,
|
||
// but replace "Chrome for Testing" branding with "GStackBrowser"
|
||
let customUA: string | undefined;
|
||
if (!this.customUserAgent) {
|
||
// Detect Chrome version from the Chromium binary
|
||
const chromePath = executablePath || chromium.executablePath();
|
||
try {
|
||
const versionProc = Bun.spawnSync([chromePath, '--version'], {
|
||
stdout: 'pipe', stderr: 'pipe', timeout: 5000,
|
||
});
|
||
const versionOutput = versionProc.stdout.toString().trim();
|
||
// Output like: "Google Chrome for Testing 145.0.6422.0" or "Chromium 145.0.6422.0"
|
||
const versionMatch = versionOutput.match(/(\d+\.\d+\.\d+\.\d+)/);
|
||
const chromeVersion = versionMatch ? versionMatch[1] : '131.0.0.0';
|
||
customUA = `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeVersion} Safari/537.36 GStackBrowser`;
|
||
} catch {
|
||
// Fallback: generic modern Chrome UA
|
||
customUA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 GStackBrowser';
|
||
}
|
||
}
|
||
|
||
this.context = await chromium.launchPersistentContext(userDataDir, {
|
||
headless: false,
|
||
// Match the sandbox policy used by launch() above. Without this,
|
||
// Playwright auto-adds --no-sandbox on every headed launch and the user
|
||
// sees Chromium's "unsupported command-line flag" yellow infobar.
|
||
chromiumSandbox: shouldEnableChromiumSandbox(),
|
||
args: launchArgs,
|
||
viewport: null, // Use browser's default viewport (real window size)
|
||
userAgent: this.customUserAgent || customUA,
|
||
...(executablePath ? { executablePath } : {}),
|
||
...(this.proxyConfig ? { proxy: this.proxyConfig } : {}),
|
||
// Playwright adds flags that block extension loading
|
||
ignoreDefaultArgs: [
|
||
'--disable-extensions',
|
||
'--disable-component-extensions-with-background-pages',
|
||
],
|
||
});
|
||
this.browser = this.context.browser();
|
||
this.connectionMode = 'headed';
|
||
this.intentionalDisconnect = false;
|
||
|
||
// ─── Anti-bot-detection patches ───────────────────────────────
|
||
// D7 (codex correction): mask navigator.webdriver only. We do NOT fake
|
||
// plugins/languages — modern fingerprinters check consistency between
|
||
// those and userAgent/platform, and synthesizing fixed values can flag
|
||
// MORE bot-like, not less. Let Chromium's natural plugins and languages
|
||
// surface unmodified.
|
||
//
|
||
// What we DO clean up are automation-specific runtime artifacts that
|
||
// shouldn't exist in a real browser at all (Permissions API quirks,
|
||
// ChromeDriver-injected window globals). Those aren't fingerprint
|
||
// synthesis — they're removing leaked automation tells.
|
||
const { applyStealth } = await import('./stealth');
|
||
await applyStealth(this.context);
|
||
await this.context.addInitScript(() => {
|
||
// Remove CDP runtime artifacts that automation detectors look for
|
||
// cdc_ prefixed vars are injected by ChromeDriver/CDP
|
||
const cleanup = () => {
|
||
for (const key of Object.keys(window)) {
|
||
if (key.startsWith('cdc_') || key.startsWith('__webdriver')) {
|
||
try {
|
||
delete (window as any)[key];
|
||
} catch (e: any) {
|
||
if (!(e instanceof TypeError)) throw e;
|
||
}
|
||
}
|
||
}
|
||
};
|
||
cleanup();
|
||
// Re-clean after a tick in case they're injected late
|
||
setTimeout(cleanup, 0);
|
||
|
||
// Override Permissions API to return 'prompt' for notifications
|
||
// (automation browsers return 'denied' which is a fingerprint)
|
||
const originalQuery = window.navigator.permissions?.query;
|
||
if (originalQuery) {
|
||
(window.navigator.permissions as any).query = (params: any) => {
|
||
if (params.name === 'notifications') {
|
||
return Promise.resolve({ state: 'prompt', onchange: null } as PermissionStatus);
|
||
}
|
||
return originalQuery.call(window.navigator.permissions, params);
|
||
};
|
||
}
|
||
});
|
||
|
||
// Inject visual indicator — subtle top-edge amber gradient
|
||
// Extension's content script handles the floating pill
|
||
const indicatorScript = () => {
|
||
const injectIndicator = () => {
|
||
if (document.getElementById('gstack-ctrl')) return;
|
||
|
||
const topLine = document.createElement('div');
|
||
topLine.id = 'gstack-ctrl';
|
||
topLine.style.cssText = `
|
||
position: fixed; top: 0; left: 0; right: 0; height: 2px;
|
||
background: linear-gradient(90deg, #F59E0B, #FBBF24, #F59E0B);
|
||
background-size: 200% 100%;
|
||
animation: gstack-shimmer 3s linear infinite;
|
||
pointer-events: none; z-index: 2147483647;
|
||
opacity: 0.8;
|
||
`;
|
||
|
||
const style = document.createElement('style');
|
||
style.textContent = `
|
||
@keyframes gstack-shimmer {
|
||
0% { background-position: 200% 0; }
|
||
100% { background-position: -200% 0; }
|
||
}
|
||
@media (prefers-reduced-motion: reduce) {
|
||
#gstack-ctrl { animation: none !important; }
|
||
}
|
||
`;
|
||
|
||
document.documentElement.appendChild(style);
|
||
document.documentElement.appendChild(topLine);
|
||
};
|
||
if (document.readyState === 'loading') {
|
||
document.addEventListener('DOMContentLoaded', injectIndicator);
|
||
} else {
|
||
injectIndicator();
|
||
}
|
||
};
|
||
await this.context.addInitScript(indicatorScript);
|
||
|
||
// Track user-created tabs automatically (Cmd+T, link opens in new tab, etc.)
|
||
this.context.on('page', (page) => {
|
||
const id = this.nextTabId++;
|
||
this.pages.set(id, page);
|
||
this.tabSessions.set(id, new TabSession(page));
|
||
this.activeTabId = id;
|
||
this.wirePageEvents(page);
|
||
// Inject indicator on the new tab
|
||
page.evaluate(indicatorScript).catch(() => {});
|
||
console.log(`[browse] New tab detected (id=${id}, total=${this.pages.size})`);
|
||
this.checkTabGuardrails();
|
||
});
|
||
|
||
// Persistent context opens a default page — adopt it instead of creating a new one
|
||
const existingPages = this.context.pages();
|
||
if (existingPages.length > 0) {
|
||
const page = existingPages[0];
|
||
const id = this.nextTabId++;
|
||
this.pages.set(id, page);
|
||
this.tabSessions.set(id, new TabSession(page));
|
||
this.activeTabId = id;
|
||
this.wirePageEvents(page);
|
||
// Inject indicator on restored page (addInitScript only fires on new navigations)
|
||
try {
|
||
await page.evaluate(indicatorScript);
|
||
} catch {}
|
||
} else {
|
||
await this.newTab();
|
||
}
|
||
|
||
// Browser disconnect handler — distinguish user Cmd+Q from real crash.
|
||
// Clean exit (Chromium exit code 0) → process.exit(0) so process
|
||
// supervisors (gbrowser's gbd) treat it as user intent and skip the
|
||
// restart loop. Crash → process.exit(2) preserves the legacy headed
|
||
// semantics that's distinct from launch()'s code 1.
|
||
// Always calls onDisconnect() first to trigger full shutdown (kill
|
||
// sidebar-agent, save session, clean profile locks + state file) so
|
||
// crashes don't strand resources either.
|
||
if (this.browser) {
|
||
this.browser.on('disconnected', () => {
|
||
if (this.intentionalDisconnect) return;
|
||
const browserRef = this.browser;
|
||
void (async () => {
|
||
const cause = await resolveDisconnectCause(browserRef);
|
||
const exitCode = cause === 'clean' ? 0 : 2;
|
||
if (cause === 'clean') {
|
||
console.error('[browse] Real browser closed cleanly (user-initiated quit). Server exiting (0).');
|
||
} else {
|
||
console.error('[browse] Real browser disconnected (crash or kill). Server exiting (2).');
|
||
console.error('[browse] Run `$B connect` to reconnect.');
|
||
}
|
||
if (!this.onDisconnect) {
|
||
process.exit(exitCode);
|
||
return;
|
||
}
|
||
try {
|
||
const result = this.onDisconnect(exitCode);
|
||
if (result && typeof (result as Promise<void>).catch === 'function') {
|
||
(result as Promise<void>).catch((err) => {
|
||
console.error('[browse] onDisconnect rejected:', err);
|
||
process.exit(exitCode);
|
||
});
|
||
}
|
||
// onDisconnect is responsible for exit on the success path.
|
||
} catch (err) {
|
||
console.error('[browse] onDisconnect threw:', err);
|
||
process.exit(exitCode);
|
||
}
|
||
})();
|
||
});
|
||
}
|
||
|
||
// Headed mode defaults
|
||
this.dialogAutoAccept = false; // Don't dismiss user's real dialogs
|
||
this.isHeaded = true;
|
||
this.consecutiveFailures = 0;
|
||
}
|
||
|
||
async close() {
|
||
if (this.browser || (this.connectionMode === 'headed' && this.context)) {
|
||
if (this.connectionMode === 'headed') {
|
||
// Headed/persistent context mode: close the context (which closes the browser)
|
||
this.intentionalDisconnect = true;
|
||
if (this.browser) this.browser.removeAllListeners('disconnected');
|
||
await Promise.race([
|
||
this.context ? this.context.close() : Promise.resolve(),
|
||
new Promise(resolve => setTimeout(resolve, 5000)),
|
||
]).catch(() => {});
|
||
} else {
|
||
// Launched mode: close the browser we spawned
|
||
this.browser.removeAllListeners('disconnected');
|
||
await Promise.race([
|
||
this.browser.close(),
|
||
new Promise(resolve => setTimeout(resolve, 5000)),
|
||
]).catch(() => {});
|
||
}
|
||
this.browser = null;
|
||
}
|
||
}
|
||
|
||
/** Health check — verifies Chromium is connected AND responsive */
|
||
async isHealthy(): Promise<boolean> {
|
||
if (!this.browser || !this.browser.isConnected()) return false;
|
||
try {
|
||
const page = this.pages.get(this.activeTabId);
|
||
if (!page) return true; // connected but no pages — still healthy
|
||
await Promise.race([
|
||
page.evaluate('1'),
|
||
new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 2000)),
|
||
]);
|
||
return true;
|
||
} catch {
|
||
return false;
|
||
}
|
||
}
|
||
|
||
// ─── Tab Management ────────────────────────────────────────
|
||
async newTab(url?: string, clientId?: string): Promise<number> {
|
||
if (!this.context) throw new Error('Browser not launched');
|
||
|
||
// Validate URL before allocating page to avoid zombie tabs on rejection.
|
||
// Use the normalized return value for navigation — it handles file://./x and
|
||
// file://<segment> cwd-relative forms that the standard URL parser doesn't.
|
||
let normalizedUrl: string | undefined;
|
||
if (url) {
|
||
normalizedUrl = await validateNavigationUrl(url);
|
||
}
|
||
|
||
const page = await this.context.newPage();
|
||
const id = this.nextTabId++;
|
||
this.pages.set(id, page);
|
||
this.tabSessions.set(id, new TabSession(page));
|
||
this.activeTabId = id;
|
||
|
||
// Record tab ownership for multi-agent isolation
|
||
if (clientId) {
|
||
this.tabOwnership.set(id, clientId);
|
||
}
|
||
|
||
// Wire up console/network/dialog capture
|
||
this.wirePageEvents(page);
|
||
|
||
if (normalizedUrl) {
|
||
await page.goto(normalizedUrl, { waitUntil: 'domcontentloaded', timeout: 15000 });
|
||
}
|
||
|
||
return id;
|
||
}
|
||
|
||
async closeTab(id?: number): Promise<void> {
|
||
const tabId = id ?? this.activeTabId;
|
||
const page = this.pages.get(tabId);
|
||
if (!page) throw new Error(`Tab ${tabId} not found`);
|
||
|
||
await page.close();
|
||
this.pages.delete(tabId);
|
||
this.tabSessions.delete(tabId);
|
||
this.tabOwnership.delete(tabId);
|
||
|
||
// Switch to another tab if we closed the active one
|
||
if (tabId === this.activeTabId) {
|
||
const remaining = [...this.pages.keys()];
|
||
if (remaining.length > 0) {
|
||
this.activeTabId = remaining[remaining.length - 1];
|
||
} else {
|
||
// No tabs left — create a new blank one
|
||
await this.newTab();
|
||
}
|
||
}
|
||
}
|
||
|
||
switchTab(id: number, opts?: { bringToFront?: boolean }): void {
|
||
if (!this.tabSessions.has(id)) throw new Error(`Tab ${id} not found`);
|
||
this.activeTabId = id;
|
||
// Only bring to front when explicitly requested (user-initiated tab switch).
|
||
// Internal tab pinning (BROWSE_TAB) should NOT steal focus.
|
||
if (opts?.bringToFront !== false) {
|
||
const page = this.pages.get(id);
|
||
if (page) page.bringToFront().catch(() => {});
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Sync activeTabId to match the tab whose URL matches the Chrome extension's
|
||
* active tab. Called on every /sidebar-tabs poll so manual tab switches in
|
||
* the browser are detected within ~2s.
|
||
*/
|
||
syncActiveTabByUrl(activeUrl: string): void {
|
||
if (!activeUrl || this.pages.size <= 1) return;
|
||
// Try exact match first, then fuzzy match (origin+pathname, ignoring query/fragment)
|
||
let fuzzyId: number | null = null;
|
||
let activeOriginPath = '';
|
||
try {
|
||
const u = new URL(activeUrl);
|
||
activeOriginPath = u.origin + u.pathname;
|
||
} catch (err: any) {
|
||
if (!(err instanceof TypeError)) throw err;
|
||
}
|
||
|
||
for (const [id, page] of this.pages) {
|
||
try {
|
||
const pageUrl = page.url();
|
||
// Exact match — best case
|
||
if (pageUrl === activeUrl && id !== this.activeTabId) {
|
||
this.activeTabId = id;
|
||
return;
|
||
}
|
||
// Fuzzy match — origin+pathname (handles query param / fragment differences)
|
||
if (activeOriginPath && fuzzyId === null && id !== this.activeTabId) {
|
||
try {
|
||
const pu = new URL(pageUrl);
|
||
if (pu.origin + pu.pathname === activeOriginPath) {
|
||
fuzzyId = id;
|
||
}
|
||
} catch (err: any) {
|
||
if (!(err instanceof TypeError)) throw err;
|
||
}
|
||
}
|
||
} catch {}
|
||
}
|
||
// Fall back to fuzzy match
|
||
if (fuzzyId !== null) {
|
||
this.activeTabId = fuzzyId;
|
||
}
|
||
}
|
||
|
||
getActiveTabId(): number {
|
||
return this.activeTabId;
|
||
}
|
||
|
||
getTabCount(): number {
|
||
return this.pages.size;
|
||
}
|
||
|
||
// ─── Tab Ownership (multi-agent isolation) ──────────────
|
||
|
||
/** Get the owner of a tab, or null if unowned (root-only for writes). */
|
||
getTabOwner(tabId: number): string | null {
|
||
return this.tabOwnership.get(tabId) || null;
|
||
}
|
||
|
||
/**
|
||
* Check if a client can access a tab.
|
||
*
|
||
* Two policies, distinguished by `options.ownOnly`:
|
||
*
|
||
* - **own-only (pair-agent over tunnel):** the strict mode. Token must own
|
||
* the target tab for any access (reads or writes). Unowned user tabs
|
||
* and tabs owned by other clients are off-limits. Remote agents must
|
||
* `newtab` first to get a tab they can drive.
|
||
*
|
||
* - **shared (local skill spawns, default scoped tokens):** permissive on
|
||
* tab access. The token can read/write any tab — capability is gated
|
||
* elsewhere (scope checks at /command, rate limits, the dual-listener
|
||
* allowlist for tunnel-bound traffic). Tab ownership is not a security
|
||
* boundary for shared tokens; it only matters for pair-agent isolation.
|
||
* This matches the contract documented in `skill-token.ts:79`
|
||
* ("skill scripts may switch tabs as needed").
|
||
*
|
||
* Root is unconstrained.
|
||
*
|
||
* `isWrite` is preserved in the signature for callers that want to log or
|
||
* branch on it elsewhere, but the access decision itself only depends on
|
||
* `ownOnly` + ownership map state.
|
||
*/
|
||
checkTabAccess(tabId: number, clientId: string, options: { isWrite?: boolean; ownOnly?: boolean } = {}): boolean {
|
||
if (clientId === 'root') return true;
|
||
if (options.ownOnly) {
|
||
const owner = this.tabOwnership.get(tabId);
|
||
return owner === clientId;
|
||
}
|
||
return true;
|
||
}
|
||
|
||
/** Transfer tab ownership to a different client. */
|
||
transferTab(tabId: number, toClientId: string): void {
|
||
if (!this.pages.has(tabId)) throw new Error(`Tab ${tabId} not found`);
|
||
this.tabOwnership.set(tabId, toClientId);
|
||
}
|
||
|
||
async getTabListWithTitles(): Promise<Array<{ id: number; url: string; title: string; active: boolean }>> {
|
||
const tabs: Array<{ id: number; url: string; title: string; active: boolean }> = [];
|
||
for (const [id, page] of this.pages) {
|
||
tabs.push({
|
||
id,
|
||
url: page.url(),
|
||
title: await page.title().catch(() => ''),
|
||
active: id === this.activeTabId,
|
||
});
|
||
}
|
||
return tabs;
|
||
}
|
||
|
||
// ─── Session Access ────────────────────────────────────────
|
||
/** Get the TabSession for the active tab. */
|
||
getActiveSession(): TabSession {
|
||
const session = this.tabSessions.get(this.activeTabId);
|
||
if (!session) throw new Error('No active page. Use "browse goto <url>" first.');
|
||
return session;
|
||
}
|
||
|
||
/** Get a TabSession by tab ID. Used by /batch for parallel tab execution. */
|
||
getSession(tabId: number): TabSession {
|
||
const session = this.tabSessions.get(tabId);
|
||
if (!session) throw new Error(`Tab ${tabId} not found`);
|
||
return session;
|
||
}
|
||
|
||
/** Get the underlying Page for a tab id. Returns null if the tab doesn't exist.
|
||
* Used by the CDP bridge (cdp-bridge.ts) to mint per-tab CDPSessions. */
|
||
getPageForTab(tabId: number): Page | null {
|
||
return this.pages.get(tabId) ?? null;
|
||
}
|
||
|
||
// ─── Two-tier mutex (Codex T7) ─────────────────────────────
|
||
// Per-tab and global locks for the CDP bridge. tab-scoped methods take the
|
||
// per-tab mutex; browser-scoped methods take the global lock that blocks all
|
||
// tab mutexes. Hard timeout on acquire so silent deadlock can't happen.
|
||
// Every caller MUST use try { ... } finally { release() }.
|
||
|
||
private tabLocks: Map<number, Promise<void>> = new Map();
|
||
private globalCdpLockTail: Promise<void> = Promise.resolve();
|
||
|
||
/**
|
||
* Acquire the per-tab CDP lock with a timeout. Returns a release fn.
|
||
* Locks chain: each acquire waits on the prior tail's resolution.
|
||
* Browser-scoped global lock takes precedence: while the global lock is
|
||
* held, no tab lock can be acquired (and vice versa).
|
||
*/
|
||
async acquireTabLock(tabId: number, timeoutMs: number): Promise<() => void> {
|
||
const existing = this.tabLocks.get(tabId) ?? Promise.resolve();
|
||
// Wait for any held global lock first (cross-tier serialization).
|
||
const tail = Promise.all([existing, this.globalCdpLockTail]).then(() => undefined);
|
||
let release!: () => void;
|
||
const next = new Promise<void>((resolve) => { release = resolve; });
|
||
this.tabLocks.set(tabId, tail.then(() => next));
|
||
|
||
const timeoutPromise = new Promise<never>((_, reject) =>
|
||
setTimeout(() => reject(new Error(
|
||
`CDPMutexAcquireTimeout: tab ${tabId} lock not acquired within ${timeoutMs}ms.\n` +
|
||
'Cause: a prior CDP or browser-scoped operation has held the lock too long.\n' +
|
||
'Action: retry; if this repeats, the prior operation may be hung — file a bug.'
|
||
)), timeoutMs),
|
||
);
|
||
try {
|
||
await Promise.race([tail, timeoutPromise]);
|
||
} catch (e) {
|
||
// Acquisition failed; release the slot we reserved so we don't deadlock the queue.
|
||
release();
|
||
throw e;
|
||
}
|
||
return release;
|
||
}
|
||
|
||
/**
|
||
* Acquire the global CDP lock. Blocks until all tab locks are released, and
|
||
* blocks new tab-lock acquisitions until released.
|
||
*/
|
||
async acquireGlobalCdpLock(timeoutMs: number): Promise<() => void> {
|
||
const allTabTails = Array.from(this.tabLocks.values());
|
||
const priorGlobal = this.globalCdpLockTail;
|
||
const allPrior = Promise.all([priorGlobal, ...allTabTails]).then(() => undefined);
|
||
let release!: () => void;
|
||
const next = new Promise<void>((resolve) => { release = resolve; });
|
||
this.globalCdpLockTail = allPrior.then(() => next);
|
||
|
||
const timeoutPromise = new Promise<never>((_, reject) =>
|
||
setTimeout(() => reject(new Error(
|
||
`CDPMutexAcquireTimeout: global CDP lock not acquired within ${timeoutMs}ms.\n` +
|
||
'Cause: in-flight tab operations have not completed.\n' +
|
||
'Action: retry; if this repeats, file a bug — a tab op may be hung.'
|
||
)), timeoutMs),
|
||
);
|
||
try {
|
||
await Promise.race([allPrior, timeoutPromise]);
|
||
} catch (e) {
|
||
release();
|
||
throw e;
|
||
}
|
||
return release;
|
||
}
|
||
|
||
// ─── Page Access (delegates to active session) ─────────────
|
||
getPage(): Page {
|
||
return this.getActiveSession().page;
|
||
}
|
||
|
||
getCurrentUrl(): string {
|
||
try {
|
||
return this.getPage().url();
|
||
} catch {
|
||
return 'about:blank';
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Diagnostic for `$B memory` and the /memory endpoint.
|
||
*
|
||
* Collects:
|
||
* - Bun process memory (cross-platform, accurate, no shelling).
|
||
* - Per-tab JS heap via CDP Performance.getMetrics — the most portable
|
||
* per-tab signal CDP exposes. Misses native/GPU/Skia/cache memory
|
||
* (Codex flag on the eng-review; see follow-up TODO "native/GPU
|
||
* memory breakdown").
|
||
* - Chromium process tree via SystemInfo.getProcessInfo — PID + type
|
||
* + CPU time. Per-process RSS is NOT exposed via CDP and the eng
|
||
* review (D2 USE_CDP) explicitly chose CDP over shelling to `ps`,
|
||
* so RSS columns are absent and `notes[]` says why.
|
||
*
|
||
* `structures` is passed in by the caller (read-commands / server) so
|
||
* browser-manager doesn't take a hard dep on every buffer-owning module.
|
||
*/
|
||
async getMemorySnapshot(structures: MemoryStructureStats): Promise<MemorySnapshot> {
|
||
const bunMem = process.memoryUsage();
|
||
const notes: string[] = [];
|
||
|
||
// Per-tab JS heap. Lazy: only the pages we already track. A target
|
||
// that died mid-snapshot is omitted, never throws.
|
||
const tabs: MemoryTabSnapshot[] = [];
|
||
for (const [id, page] of this.pages) {
|
||
try {
|
||
const url = (() => { try { return page.url(); } catch { return ''; } })();
|
||
const title = await page.title().catch(() => '');
|
||
const metrics = await withCdpSession(page, async (session) => {
|
||
await session.send('Performance.enable').catch(() => undefined);
|
||
const result = await session.send('Performance.getMetrics');
|
||
return ((result as { metrics?: Array<{ name: string; value: number }> }).metrics) ?? [];
|
||
});
|
||
const mm: Record<string, number> = {};
|
||
for (const m of metrics) mm[m.name] = m.value;
|
||
tabs.push({
|
||
id,
|
||
url,
|
||
title,
|
||
jsHeapUsed: mm.JSHeapUsedSize ?? 0,
|
||
jsHeapTotal: mm.JSHeapTotalSize ?? 0,
|
||
documents: mm.Documents ?? 0,
|
||
nodes: mm.Nodes ?? 0,
|
||
listeners: mm.JSEventListeners ?? 0,
|
||
});
|
||
} catch {
|
||
// Target died or CDP unavailable mid-snapshot — skip this tab.
|
||
}
|
||
}
|
||
|
||
// Chromium process tree. Browser handle may be on the `browser` field
|
||
// (launched mode) or accessible via `context.browser()` (persistent
|
||
// context / headed mode); try both.
|
||
let processes: MemoryProcess[] | null = null;
|
||
const browser: Browser | null = this.browser ?? (this.context ? this.context.browser() : null);
|
||
if (browser) {
|
||
try {
|
||
// `newBrowserCDPSession` is browser-wide. Not exposed on every
|
||
// Playwright TypeScript surface, but present at runtime on the
|
||
// Browser instance — use a typed cast to avoid the @ts-expect-error.
|
||
type BrowserWithCDP = Browser & {
|
||
newBrowserCDPSession?: () => Promise<{
|
||
send: (method: string, params?: unknown) => Promise<unknown>;
|
||
detach: () => Promise<void>;
|
||
}>;
|
||
};
|
||
const maybeFactory = (browser as BrowserWithCDP).newBrowserCDPSession;
|
||
if (typeof maybeFactory === 'function') {
|
||
const browserSession = await maybeFactory.call(browser);
|
||
try {
|
||
const info = (await browserSession.send('SystemInfo.getProcessInfo')) as {
|
||
processInfo?: Array<{ id: number; type: string; cpuTime: number }>;
|
||
};
|
||
processes = (info.processInfo ?? []).map((p) => ({
|
||
id: p.id,
|
||
type: p.type,
|
||
cpuTime: p.cpuTime,
|
||
}));
|
||
notes.push(
|
||
'Per-Chromium-process RSS not collected — SystemInfo.getProcessInfo exposes PID+type+CPU only. ' +
|
||
'See follow-up TODO "native/GPU memory breakdown" for the deferred fix.',
|
||
);
|
||
} finally {
|
||
await browserSession.detach().catch(() => undefined);
|
||
}
|
||
} else {
|
||
notes.push('Playwright build does not expose newBrowserCDPSession; per-process info skipped.');
|
||
}
|
||
} catch (err: any) {
|
||
notes.push(`CDP browser session unavailable: ${err?.message ?? String(err)}`);
|
||
}
|
||
} else {
|
||
notes.push('Browser handle unavailable (server connection mode); per-process info skipped.');
|
||
}
|
||
|
||
return {
|
||
bunServer: {
|
||
rss: bunMem.rss,
|
||
heapUsed: bunMem.heapUsed,
|
||
heapTotal: bunMem.heapTotal,
|
||
external: bunMem.external,
|
||
},
|
||
tabs,
|
||
processes,
|
||
structures,
|
||
capturedAt: Date.now(),
|
||
notes,
|
||
};
|
||
}
|
||
|
||
// ─── Ref Map (delegates to active session) ──────────────────
|
||
setRefMap(refs: Map<string, RefEntry>) {
|
||
this.getActiveSession().setRefMap(refs);
|
||
}
|
||
|
||
clearRefs() {
|
||
this.getActiveSession().clearRefs();
|
||
}
|
||
|
||
async resolveRef(selector: string): Promise<{ locator: Locator } | { selector: string }> {
|
||
return this.getActiveSession().resolveRef(selector);
|
||
}
|
||
|
||
getRefRole(selector: string): string | null {
|
||
return this.getActiveSession().getRefRole(selector);
|
||
}
|
||
|
||
getRefCount(): number {
|
||
return this.getActiveSession().getRefCount();
|
||
}
|
||
|
||
// ─── Snapshot Diffing (delegates to active session) ─────────
|
||
setLastSnapshot(text: string | null) {
|
||
this.getActiveSession().setLastSnapshot(text);
|
||
}
|
||
|
||
getLastSnapshot(): string | null {
|
||
return this.getActiveSession().getLastSnapshot();
|
||
}
|
||
|
||
// ─── Dialog Control ───────────────────────────────────────
|
||
setDialogAutoAccept(accept: boolean) {
|
||
this.dialogAutoAccept = accept;
|
||
}
|
||
|
||
getDialogAutoAccept(): boolean {
|
||
return this.dialogAutoAccept;
|
||
}
|
||
|
||
setDialogPromptText(text: string | null) {
|
||
this.dialogPromptText = text;
|
||
}
|
||
|
||
getDialogPromptText(): string | null {
|
||
return this.dialogPromptText;
|
||
}
|
||
|
||
// ─── Cookie Origin Tracking ────────────────────────────────
|
||
trackCookieImportDomains(domains: string[]): void {
|
||
for (const d of domains) this.cookieImportedDomains.add(d);
|
||
}
|
||
|
||
getCookieImportedDomains(): ReadonlySet<string> {
|
||
return this.cookieImportedDomains;
|
||
}
|
||
|
||
hasCookieImports(): boolean {
|
||
return this.cookieImportedDomains.size > 0;
|
||
}
|
||
|
||
// ─── Viewport ──────────────────────────────────────────────
|
||
async setViewport(width: number, height: number) {
|
||
this.currentViewport = { width, height };
|
||
await this.getPage().setViewportSize({ width, height });
|
||
}
|
||
|
||
// ─── Extra Headers ─────────────────────────────────────────
|
||
async setExtraHeader(name: string, value: string) {
|
||
this.extraHeaders[name] = value;
|
||
if (this.context) {
|
||
await this.context.setExtraHTTPHeaders(this.extraHeaders);
|
||
}
|
||
}
|
||
|
||
// ─── User Agent ────────────────────────────────────────────
|
||
setUserAgent(ua: string) {
|
||
this.customUserAgent = ua;
|
||
}
|
||
|
||
getUserAgent(): string | null {
|
||
return this.customUserAgent;
|
||
}
|
||
|
||
// ─── Lifecycle helpers ───────────────────────────────
|
||
/**
|
||
* Close all open pages and clear the pages map.
|
||
* Used by state load to replace the current session.
|
||
*/
|
||
async closeAllPages(): Promise<void> {
|
||
for (const page of this.pages.values()) {
|
||
await page.close().catch(() => {});
|
||
}
|
||
this.pages.clear();
|
||
this.tabSessions.clear();
|
||
}
|
||
|
||
// ─── Frame context (delegates to active session) ────────────
|
||
setFrame(frame: import('playwright').Frame | null): void {
|
||
this.getActiveSession().setFrame(frame);
|
||
}
|
||
|
||
getFrame(): import('playwright').Frame | null {
|
||
return this.getActiveSession().getFrame();
|
||
}
|
||
|
||
getActiveFrameOrPage(): import('playwright').Page | import('playwright').Frame {
|
||
return this.getActiveSession().getActiveFrameOrPage();
|
||
}
|
||
|
||
// ─── State Save/Restore (shared by recreateContext + handoff) ─
|
||
/**
|
||
* Capture browser state: cookies, localStorage, sessionStorage, URLs, active tab.
|
||
* Skips pages that fail storage reads (e.g., already closed).
|
||
*/
|
||
async saveState(): Promise<BrowserState> {
|
||
if (!this.context) throw new Error('Browser not launched');
|
||
|
||
const cookies = await this.context.cookies();
|
||
const pages: BrowserState['pages'] = [];
|
||
|
||
for (const [id, page] of this.pages) {
|
||
const url = page.url();
|
||
let storage = null;
|
||
try {
|
||
storage = await page.evaluate(() => ({
|
||
localStorage: { ...localStorage },
|
||
sessionStorage: { ...sessionStorage },
|
||
}));
|
||
} catch {}
|
||
|
||
// Capture load-html content so a later context recreation (viewport --scale)
|
||
// can replay it via setTabContent. Never persisted to disk.
|
||
const session = this.tabSessions.get(id);
|
||
const loaded = session?.getLoadedHtml();
|
||
// Preserve tab ownership through recreation so scoped agents aren't locked out.
|
||
const owner = this.tabOwnership.get(id);
|
||
|
||
pages.push({
|
||
url: url === 'about:blank' ? '' : url,
|
||
isActive: id === this.activeTabId,
|
||
storage,
|
||
loadedHtml: loaded?.html,
|
||
loadedHtmlWaitUntil: loaded?.waitUntil,
|
||
owner,
|
||
});
|
||
}
|
||
|
||
return { cookies, pages };
|
||
}
|
||
|
||
/**
|
||
* Restore browser state into the current context: cookies, pages, storage.
|
||
* Navigates to saved URLs, restores storage, wires page events.
|
||
* Failures on individual pages are swallowed — partial restore is better than none.
|
||
*/
|
||
async restoreState(state: BrowserState): Promise<void> {
|
||
if (!this.context) throw new Error('Browser not launched');
|
||
|
||
// Restore cookies
|
||
if (state.cookies.length > 0) {
|
||
await this.context.addCookies(state.cookies);
|
||
}
|
||
|
||
// Clear stale ownership — the old tab IDs are gone. We'll re-add per-tab
|
||
// owners below as each saved tab gets a fresh ID. Without this reset, old
|
||
// tabId → clientId entries would linger and match new tabs with the same
|
||
// sequential IDs, silently granting ownership to the wrong clients.
|
||
this.tabOwnership.clear();
|
||
|
||
// Re-create pages
|
||
let activeId: number | null = null;
|
||
for (const saved of state.pages) {
|
||
const page = await this.context.newPage();
|
||
const id = this.nextTabId++;
|
||
this.pages.set(id, page);
|
||
const newSession = new TabSession(page);
|
||
this.tabSessions.set(id, newSession);
|
||
this.wirePageEvents(page);
|
||
|
||
// Restore tab ownership for the new ID — preserves scoped-agent isolation
|
||
// across context recreation (viewport --scale, user-agent change, handoff).
|
||
if (saved.owner) {
|
||
this.tabOwnership.set(id, saved.owner);
|
||
}
|
||
|
||
if (saved.loadedHtml) {
|
||
// Replay load-html content via setTabContent — this rehydrates
|
||
// TabSession.loadedHtml so the next saveState sees it. page.setContent()
|
||
// alone would restore the DOM but lose the replay metadata.
|
||
try {
|
||
await newSession.setTabContent(saved.loadedHtml, { waitUntil: saved.loadedHtmlWaitUntil });
|
||
} catch (err: any) {
|
||
console.warn(`[browse] Failed to replay loadedHtml for tab ${id}: ${err.message}`);
|
||
}
|
||
} else if (saved.url) {
|
||
// Validate the saved URL before navigating — the state file is user-writable and
|
||
// a tampered URL could navigate to cloud metadata endpoints. Use the normalized
|
||
// return value so file:// forms get consistent treatment with live goto.
|
||
let normalizedUrl: string;
|
||
try {
|
||
normalizedUrl = await validateNavigationUrl(saved.url);
|
||
} catch (err: any) {
|
||
console.warn(`[browse] Skipping invalid URL in state file: ${saved.url} — ${err.message}`);
|
||
continue;
|
||
}
|
||
await page.goto(normalizedUrl, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {});
|
||
}
|
||
|
||
if (saved.storage) {
|
||
try {
|
||
await page.evaluate((s: { localStorage: Record<string, string>; sessionStorage: Record<string, string> }) => {
|
||
if (s.localStorage) {
|
||
for (const [k, v] of Object.entries(s.localStorage)) {
|
||
localStorage.setItem(k, v);
|
||
}
|
||
}
|
||
if (s.sessionStorage) {
|
||
for (const [k, v] of Object.entries(s.sessionStorage)) {
|
||
sessionStorage.setItem(k, v);
|
||
}
|
||
}
|
||
}, saved.storage);
|
||
} catch {}
|
||
}
|
||
|
||
if (saved.isActive) activeId = id;
|
||
}
|
||
|
||
// If no pages were saved, create a blank one
|
||
if (this.pages.size === 0) {
|
||
await this.newTab();
|
||
} else {
|
||
this.activeTabId = activeId ?? [...this.pages.keys()][0];
|
||
}
|
||
|
||
// Clear refs — pages are new, locators are stale
|
||
this.clearRefs();
|
||
}
|
||
|
||
/**
|
||
* Recreate the browser context to apply user agent changes.
|
||
* Saves and restores cookies, localStorage, sessionStorage, and open pages.
|
||
* Falls back to a clean slate on any failure.
|
||
*/
|
||
async recreateContext(): Promise<string | null> {
|
||
if (this.connectionMode === 'headed') {
|
||
throw new Error('Cannot recreate context in headed mode. Use disconnect first.');
|
||
}
|
||
if (!this.browser || !this.context) {
|
||
throw new Error('Browser not launched');
|
||
}
|
||
|
||
try {
|
||
// 1. Save state
|
||
const state = await this.saveState();
|
||
|
||
// 2. Close old pages and context
|
||
for (const page of this.pages.values()) {
|
||
await page.close().catch(() => {});
|
||
}
|
||
this.pages.clear();
|
||
this.tabSessions.clear();
|
||
await this.context.close().catch(() => {});
|
||
|
||
// 3. Create new context with updated settings
|
||
const contextOptions: BrowserContextOptions = {
|
||
viewport: { width: this.currentViewport.width, height: this.currentViewport.height },
|
||
deviceScaleFactor: this.deviceScaleFactor,
|
||
};
|
||
if (this.customUserAgent) {
|
||
contextOptions.userAgent = this.customUserAgent;
|
||
}
|
||
this.context = await this.browser.newContext(contextOptions);
|
||
|
||
if (Object.keys(this.extraHeaders).length > 0) {
|
||
await this.context.setExtraHTTPHeaders(this.extraHeaders);
|
||
}
|
||
|
||
// 4. Restore state
|
||
await this.restoreState(state);
|
||
|
||
return null; // success
|
||
} catch (err: unknown) {
|
||
// Fallback: create a clean context + blank tab
|
||
try {
|
||
this.pages.clear();
|
||
this.tabSessions.clear();
|
||
if (this.context) await this.context.close().catch(() => {});
|
||
|
||
const contextOptions: BrowserContextOptions = {
|
||
viewport: { width: this.currentViewport.width, height: this.currentViewport.height },
|
||
deviceScaleFactor: this.deviceScaleFactor,
|
||
};
|
||
if (this.customUserAgent) {
|
||
contextOptions.userAgent = this.customUserAgent;
|
||
}
|
||
this.context = await this.browser!.newContext(contextOptions);
|
||
await this.newTab();
|
||
this.clearRefs();
|
||
} catch {
|
||
// If even the fallback fails, we're in trouble — but browser is still alive
|
||
}
|
||
return `Context recreation failed: ${err instanceof Error ? err.message : String(err)}. Browser reset to blank tab.`;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Change deviceScaleFactor + viewport size atomically.
|
||
*
|
||
* deviceScaleFactor is a context-level option, so Playwright requires a full context
|
||
* recreation. This method validates the input, stores the new values, calls
|
||
* recreateContext(), and rolls back the fields on failure so a bad call doesn't
|
||
* leave the manager in an inconsistent state.
|
||
*
|
||
* Returns null on success, or an error string if the new context couldn't be built
|
||
* (state may have been lost, per recreateContext's fallback behavior).
|
||
*/
|
||
async setDeviceScaleFactor(scale: number, width: number, height: number): Promise<string | null> {
|
||
if (!Number.isFinite(scale)) {
|
||
throw new Error(`viewport --scale: value must be a finite number, got ${scale}`);
|
||
}
|
||
if (scale < 1 || scale > 3) {
|
||
throw new Error(`viewport --scale: value must be between 1 and 3 (gstack policy cap), got ${scale}`);
|
||
}
|
||
if (this.connectionMode === 'headed') {
|
||
throw new Error('viewport --scale is not supported in headed mode — scale is controlled by the real browser window.');
|
||
}
|
||
|
||
const prevScale = this.deviceScaleFactor;
|
||
const prevViewport = { ...this.currentViewport };
|
||
this.deviceScaleFactor = scale;
|
||
this.currentViewport = { width, height };
|
||
|
||
const err = await this.recreateContext();
|
||
if (err !== null) {
|
||
// recreateContext's fallback path built a blank context using the NEW scale +
|
||
// viewport (the fields we just set). Rolling the fields back without a second
|
||
// recreate would leave the live context at new-scale while state says old-scale.
|
||
// Roll back fields FIRST, then force a second recreate against the old values
|
||
// so live state matches tracked state.
|
||
this.deviceScaleFactor = prevScale;
|
||
this.currentViewport = prevViewport;
|
||
const rollbackErr = await this.recreateContext();
|
||
if (rollbackErr !== null) {
|
||
// Second recreate also failed — we're in a clean blank slate via fallback, but
|
||
// with old scale. Return the original error so the caller sees the primary failure.
|
||
return `${err} (rollback also encountered: ${rollbackErr})`;
|
||
}
|
||
return err;
|
||
}
|
||
return null;
|
||
}
|
||
|
||
/** Read current deviceScaleFactor (for tests + debug). */
|
||
getDeviceScaleFactor(): number {
|
||
return this.deviceScaleFactor;
|
||
}
|
||
|
||
/** Read current tracked viewport (for tests + `viewport --scale` size fallback). */
|
||
getCurrentViewport(): { width: number; height: number } {
|
||
return { ...this.currentViewport };
|
||
}
|
||
|
||
// ─── Handoff: Headless → Headed ─────────────────────────────
|
||
/**
|
||
* Hand off browser control to the user by relaunching in headed mode.
|
||
*
|
||
* Flow (launch-first-close-second for safe rollback):
|
||
* 1. Save state from current headless browser
|
||
* 2. Launch NEW headed browser
|
||
* 3. Restore state into new browser
|
||
* 4. Close OLD headless browser
|
||
* If step 2 fails → return error, headless browser untouched
|
||
*/
|
||
async handoff(message: string): Promise<string> {
|
||
if (this.connectionMode === 'headed' || this.isHeaded) {
|
||
return `HANDOFF: Already in headed mode at ${this.getCurrentUrl()}`;
|
||
}
|
||
if (!this.browser || !this.context) {
|
||
throw new Error('Browser not launched');
|
||
}
|
||
|
||
// 1. Save state from current browser
|
||
const state = await this.saveState();
|
||
const currentUrl = this.getCurrentUrl();
|
||
|
||
// 2. Launch new headed browser with extension (same as launchHeaded)
|
||
// Uses launchPersistentContext so the extension auto-loads.
|
||
let newContext: BrowserContext;
|
||
try {
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const extensionPath = this.findExtensionPath();
|
||
const launchArgs = ['--hide-crash-restore-bubble'];
|
||
if (extensionPath) {
|
||
launchArgs.push(`--disable-extensions-except=${extensionPath}`);
|
||
launchArgs.push(`--load-extension=${extensionPath}`);
|
||
// Auth token is served via /health endpoint now (no file write needed).
|
||
// Extension reads token from /health on connect.
|
||
console.log(`[browse] Handoff: loading extension from ${extensionPath}`);
|
||
} else {
|
||
console.log('[browse] Handoff: extension not found — headed mode without side panel');
|
||
}
|
||
|
||
const userDataDir = path.join(process.env.HOME || '/tmp', '.gstack', 'chromium-profile');
|
||
fs.mkdirSync(userDataDir, { recursive: true });
|
||
|
||
newContext = await chromium.launchPersistentContext(userDataDir, {
|
||
headless: false,
|
||
// Match the sandbox policy used by launchHeaded() / launch(). The
|
||
// handoff path is the headless→headed re-launch and shares the same
|
||
// anti-detection posture, including no spurious --no-sandbox infobar.
|
||
chromiumSandbox: shouldEnableChromiumSandbox(),
|
||
args: launchArgs,
|
||
viewport: null,
|
||
...(this.proxyConfig ? { proxy: this.proxyConfig } : {}),
|
||
ignoreDefaultArgs: [
|
||
'--disable-extensions',
|
||
'--disable-component-extensions-with-background-pages',
|
||
],
|
||
timeout: 15000,
|
||
});
|
||
} catch (err: unknown) {
|
||
const msg = err instanceof Error ? err.message : String(err);
|
||
return `ERROR: Cannot open headed browser — ${msg}. Headless browser still running.`;
|
||
}
|
||
|
||
// 3. Restore state into new headed browser
|
||
try {
|
||
// Swap to new browser/context before restoreState (it uses this.context)
|
||
const oldBrowser = this.browser;
|
||
|
||
this.context = newContext;
|
||
this.browser = newContext.browser();
|
||
this.pages.clear();
|
||
this.tabSessions.clear();
|
||
this.connectionMode = 'headed';
|
||
|
||
if (Object.keys(this.extraHeaders).length > 0) {
|
||
await newContext.setExtraHTTPHeaders(this.extraHeaders);
|
||
}
|
||
|
||
// Register disconnect handler on new browser. Same clean-vs-crash
|
||
// discrimination as launch() / launchHeaded() above so a user-initiated
|
||
// Cmd+Q after a handoff doesn't trigger gbd's restart loop.
|
||
if (this.browser) {
|
||
const browserRef = this.browser;
|
||
this.browser.on('disconnected', () => {
|
||
if (this.intentionalDisconnect) return;
|
||
void handleChromiumDisconnect(browserRef);
|
||
});
|
||
}
|
||
|
||
await this.restoreState(state);
|
||
this.isHeaded = true;
|
||
this.dialogAutoAccept = false; // User controls dialogs in headed mode
|
||
|
||
// 4. Close old headless browser (fire-and-forget)
|
||
oldBrowser.removeAllListeners('disconnected');
|
||
oldBrowser.close().catch(() => {});
|
||
|
||
return [
|
||
`HANDOFF: Browser opened at ${currentUrl}`,
|
||
`MESSAGE: ${message}`,
|
||
`STATUS: Waiting for user. Run 'resume' when done.`,
|
||
].join('\n');
|
||
} catch (err: unknown) {
|
||
// Restore failed — close the new context, keep old state
|
||
await newContext.close().catch(() => {});
|
||
const msg = err instanceof Error ? err.message : String(err);
|
||
return `ERROR: Handoff failed during state restore — ${msg}. Headless browser still running.`;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Resume AI control after user handoff.
|
||
* Clears stale refs and resets failure counter.
|
||
* The meta-command handler calls handleSnapshot() after this.
|
||
*/
|
||
resume(): void {
|
||
// Clear refs and frame on the active session
|
||
try {
|
||
const session = this.getActiveSession();
|
||
session.clearRefs();
|
||
session.setFrame(null);
|
||
} catch {}
|
||
this.resetFailures();
|
||
}
|
||
|
||
getIsHeaded(): boolean {
|
||
return this.isHeaded;
|
||
}
|
||
|
||
// ─── Auto-handoff Hint (consecutive failure tracking) ───────
|
||
incrementFailures(): void {
|
||
this.consecutiveFailures++;
|
||
}
|
||
|
||
resetFailures(): void {
|
||
this.consecutiveFailures = 0;
|
||
}
|
||
|
||
getFailureHint(): string | null {
|
||
if (this.consecutiveFailures >= 3 && !this.isHeaded) {
|
||
return `HINT: ${this.consecutiveFailures} consecutive failures. Consider using 'handoff' to let the user help.`;
|
||
}
|
||
return null;
|
||
}
|
||
|
||
// ─── Console/Network/Dialog/Ref Wiring ────────────────────
|
||
private wirePageEvents(page: Page) {
|
||
// Track tab close — remove from pages and sessions maps, switch to another tab
|
||
page.on('close', () => {
|
||
for (const [id, p] of this.pages) {
|
||
if (p === page) {
|
||
this.pages.delete(id);
|
||
this.tabSessions.delete(id);
|
||
console.log(`[browse] Tab closed (id=${id}, remaining=${this.pages.size})`);
|
||
// If the closed tab was active, switch to another
|
||
if (this.activeTabId === id) {
|
||
const remaining = [...this.pages.keys()];
|
||
this.activeTabId = remaining.length > 0 ? remaining[remaining.length - 1] : 0;
|
||
}
|
||
break;
|
||
}
|
||
}
|
||
this.recheckTabGuardrailsOnClose();
|
||
});
|
||
|
||
// Clear ref map on navigation — refs point to stale elements after page change
|
||
// (lastSnapshot is NOT cleared — it's a text baseline for diffing)
|
||
page.on('framenavigated', (frame) => {
|
||
if (frame === page.mainFrame()) {
|
||
// Find the TabSession for this page and clear its per-tab state
|
||
for (const session of this.tabSessions.values()) {
|
||
if (session.page === page) {
|
||
session.onMainFrameNavigated();
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
});
|
||
|
||
// ─── Dialog auto-handling (prevents browser lockup) ─────
|
||
page.on('dialog', async (dialog) => {
|
||
const entry: DialogEntry = {
|
||
timestamp: Date.now(),
|
||
type: dialog.type(),
|
||
message: dialog.message(),
|
||
defaultValue: dialog.defaultValue() || undefined,
|
||
action: this.dialogAutoAccept ? 'accepted' : 'dismissed',
|
||
response: this.dialogAutoAccept ? (this.dialogPromptText ?? undefined) : undefined,
|
||
};
|
||
addDialogEntry(entry);
|
||
|
||
try {
|
||
if (this.dialogAutoAccept) {
|
||
await dialog.accept(this.dialogPromptText ?? undefined);
|
||
} else {
|
||
await dialog.dismiss();
|
||
}
|
||
} catch {
|
||
// Dialog may have been dismissed by navigation
|
||
}
|
||
});
|
||
|
||
page.on('console', (msg) => {
|
||
addConsoleEntry({
|
||
timestamp: Date.now(),
|
||
level: msg.type(),
|
||
text: msg.text(),
|
||
});
|
||
});
|
||
|
||
page.on('request', (req) => {
|
||
addNetworkEntry({
|
||
timestamp: Date.now(),
|
||
method: req.method(),
|
||
url: req.url(),
|
||
});
|
||
});
|
||
|
||
page.on('response', (res) => {
|
||
// Find matching request entry and update it (backward scan)
|
||
const url = res.url();
|
||
const status = res.status();
|
||
for (let i = networkBuffer.length - 1; i >= 0; i--) {
|
||
const entry = networkBuffer.get(i);
|
||
if (entry && entry.url === url && !entry.status) {
|
||
networkBuffer.set(i, { ...entry, status, duration: Date.now() - entry.timestamp });
|
||
break;
|
||
}
|
||
}
|
||
});
|
||
|
||
// Capture response sizes via requestfinished — but DO NOT call
|
||
// response.body() here. Pre-fix, this listener materialized every
|
||
// response body across CDP just to read .length: multi-GB/hour of
|
||
// Buffer churn on long-lived headed Chromium with media-heavy
|
||
// pages, the primary Bun-side accelerant on the gbrowser-OOM
|
||
// investigation. req.sizes() pulls from the Network.loadingFinished
|
||
// event Chromium already emits — accurate for chunked transfer,
|
||
// gzip-compressed responses, and streaming media, all the cases
|
||
// where the previous Content-Length-header approach would have
|
||
// missed the size.
|
||
//
|
||
// The "single context-level CDP listener" architecture (D10's
|
||
// stretch goal — would reduce per-page listener count from N to 1
|
||
// via Target.setAutoAttach) is deferred. TODOS.md tracks it.
|
||
page.on('requestfinished', async (req) => {
|
||
try {
|
||
const sizes = await req.sizes().catch(() => null);
|
||
if (!sizes) return;
|
||
const url = req.url();
|
||
const size = sizes.responseBodySize ?? 0;
|
||
for (let i = networkBuffer.length - 1; i >= 0; i--) {
|
||
const entry = networkBuffer.get(i);
|
||
if (entry && entry.url === url && !entry.size) {
|
||
networkBuffer.set(i, { ...entry, size });
|
||
break;
|
||
}
|
||
}
|
||
} catch {
|
||
// Best-effort: requestfinished fires for aborted/cached requests too,
|
||
// where sizes() is unavailable. Missing size is acceptable; an
|
||
// unbounded throw would noise the console for every cache hit.
|
||
}
|
||
});
|
||
}
|
||
}
|