@addai/node 0.29.1 → 0.30.1

package/dist/desktop/learn/browser.d.ts

@@ -4,6 +4,28 @@ export declare const DEBUG_PORT = 9222;
  *  it would point the wrapper at itself and exec forever. */
 export declare const REAL_BROWSERS: string[];
 export declare const WRAPPER_PATH = "/usr/local/bin/browser";
+/**
+ * A line of the wrapper distinctive enough to recognise it by.
+ *
+ * ⚠️ This exists because the wrapper used to destroy the browser it wraps.
+ *
+ * In the image WRAPPER_PATH is a SYMLINK — `ln -sf /usr/bin/chromium
+ * /usr/local/bin/browser`. `cp` follows a symlink destination and writes
+ * THROUGH it, so `cp wrapper /usr/local/bin/browser` overwrote /usr/bin/
+ * chromium — the real browser — with a script whose last line is
+ *
+ *     exec /usr/bin/chromium --remote-debugging-port=9222 ... "$@"
+ *
+ * which is now itself. Each hop re-appended the flags and passed the lot on
+ * as "$@", so a single launch exec'd itself until the argument list blew up.
+ * From the outside: the browser simply never opened, and the flags appeared
+ * hundreds of times over in ps.
+ *
+ * The write is fixed below. This marker is the second line of defence: a
+ * candidate that is really this wrapper is never treated as a real browser,
+ * so the loop cannot be rebuilt even if something else recreates the shape.
+ */
+export declare const WRAPPER_MARKER = "Written by @addai/node";
 /** The in-container script that signs the browser in. Beside the extension,
  *  under the same bind mount, so it arrives by the same route. */
 export declare const SEED_SCRIPT = "/conf/vault/vault-seed.mjs";

package/dist/desktop/learn/browser.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SEED_SCRIPT = exports.WRAPPER_PATH = exports.REAL_BROWSERS = exports.DEBUG_PORT = void 0;
+exports.SEED_SCRIPT = exports.WRAPPER_MARKER = exports.WRAPPER_PATH = exports.REAL_BROWSERS = exports.DEBUG_PORT = void 0;
 exports.wrapperScript = wrapperScript;
 exports.wrapperIsCurrent = wrapperIsCurrent;
 exports.ensureBrowserWrapper = ensureBrowserWrapper;
@@ -65,6 +65,28 @@ exports.REAL_BROWSERS = [
     '/usr/bin/chromium-browser',
 ];
 exports.WRAPPER_PATH = '/usr/local/bin/browser';
+/**
+ * A line of the wrapper distinctive enough to recognise it by.
+ *
+ * ⚠️ This exists because the wrapper used to destroy the browser it wraps.
+ *
+ * In the image WRAPPER_PATH is a SYMLINK — `ln -sf /usr/bin/chromium
+ * /usr/local/bin/browser`. `cp` follows a symlink destination and writes
+ * THROUGH it, so `cp wrapper /usr/local/bin/browser` overwrote /usr/bin/
+ * chromium — the real browser — with a script whose last line is
+ *
+ *     exec /usr/bin/chromium --remote-debugging-port=9222 ... "$@"
+ *
+ * which is now itself. Each hop re-appended the flags and passed the lot on
+ * as "$@", so a single launch exec'd itself until the argument list blew up.
+ * From the outside: the browser simply never opened, and the flags appeared
+ * hundreds of times over in ps.
+ *
+ * The write is fixed below. This marker is the second line of defence: a
+ * candidate that is really this wrapper is never treated as a real browser,
+ * so the loop cannot be rebuilt even if something else recreates the shape.
+ */
+exports.WRAPPER_MARKER = 'Written by @addai/node';
 /** The in-container script that signs the browser in. Beside the extension,
  *  under the same bind mount, so it arrives by the same route. */
 exports.SEED_SCRIPT = '/conf/vault/vault-seed.mjs';
@@ -92,10 +114,10 @@ function wrapperScript(realBrowser, extensionDir) {
     const seed = extensionDir
         ? `[ -f ${exports.SEED_SCRIPT} ] && (node ${exports.SEED_SCRIPT} >/dev/null 2>&1 &)\n`
         : '';
-    return `#!/bin/sh
-# Written by @addai/node so +Ai Learn can watch this browser${extensionDir ? ' and the +Ai Vault can fill logins in it' : ''}.
-# Removing it costs you the page detail in a lesson${extensionDir ? ' and vault autofill' : ''} and nothing else.
-${seed}exec ${realBrowser} --remote-debugging-port=${exports.DEBUG_PORT} --remote-debugging-address=127.0.0.1${ext} "$@"
+    return `#!/bin/sh
+# Written by @addai/node so +Ai Learn can watch this browser${extensionDir ? ' and the +Ai Vault can fill logins in it' : ''}.
+# Removing it costs you the page detail in a lesson${extensionDir ? ' and vault autofill' : ''} and nothing else.
+${seed}exec ${realBrowser} --remote-debugging-port=${exports.DEBUG_PORT} --remote-debugging-address=127.0.0.1${ext} "$@"
 `;
 }
 /** Is what is on disk already what we would write? Exact match, so a change to
@@ -112,10 +134,28 @@ function wrapperIsCurrent(content, realBrowser, extensionDir) {
  * cheap execs and no change.
  */
 async function ensureBrowserWrapper(run, confDir, extensionDir) {
+    // Each candidate is classified, not just found: one that is really this
+    // wrapper (see WRAPPER_MARKER) is a browser an older build overwrote, and
+    // pointing a new wrapper at it would rebuild the exec loop.
     const found = await run(['sh', '-c',
-        exports.REAL_BROWSERS.map(b => `[ -x ${b} ] && echo ${b}`).join(' || ') + ' || true']);
-    const real = found.out.trim().split('\n')[0]?.trim();
+        `for b in ${exports.REAL_BROWSERS.join(' ')}; do [ -x "$b" ] || continue; ` +
+            `if head -c 512 "$b" 2>/dev/null | grep -qF '${exports.WRAPPER_MARKER}'; ` +
+            `then echo "wrapped $b"; else echo "real $b"; fi; done`]);
+    const lines = found.out.trim().split('\n').map(l => l.trim()).filter(Boolean);
+    const real = lines.find(l => l.startsWith('real '))?.slice(5);
     if (!real) {
+        const wrapped = lines.find(l => l.startsWith('wrapped '))?.slice(8);
+        if (wrapped) {
+            // Deliberately not repaired from here. Putting the browser back means
+            // reinstalling its package — a network install, on every start, on a
+            // machine that is somebody's desktop — and this path is meant to be two
+            // cheap execs. Rebuilding the desktop restores it from the image.
+            return {
+                changed: false, browser: null,
+                note: `${wrapped} was overwritten by an older version of this wrapper `
+                    + 'and no longer starts a browser. Rebuild this desktop to restore it.',
+            };
+        }
         return { changed: false, browser: null, note: 'this desktop has no browser installed' };
     }
     const current = await run(['sh', '-c', `cat ${exports.WRAPPER_PATH} 2>/dev/null || true`]);
@@ -127,8 +167,15 @@ async function ensureBrowserWrapper(run, confDir, extensionDir) {
     // sudo, not `docker exec -u root`: the image gives the entity passwordless
     // sudo inside its own container, and going through the same exec path as
     // everything else keeps one way of talking to a desktop rather than two.
+    // ⚠️ rm FIRST, and it is the whole fix. In the image WRAPPER_PATH is a
+    // symlink to the real browser, and `cp` follows a symlink destination —
+    // writing through it, over the browser, rather than replacing the link.
+    // Unlinking first makes the wrapper a file of its own and leaves whatever
+    // it pointed at alone. (`cp --remove-destination` does the same in one
+    // call; this shape says why out loud and needs no GNU-only flag.)
     const put = await run(['sh', '-c',
-        `sudo cp /conf/learn/browser ${exports.WRAPPER_PATH} && sudo chmod +x ${exports.WRAPPER_PATH}`]);
+        `sudo rm -f ${exports.WRAPPER_PATH} && sudo cp /conf/learn/browser ${exports.WRAPPER_PATH} `
+            + `&& sudo chmod +x ${exports.WRAPPER_PATH}`]);
     if (!put.ok) {
         return { changed: false, browser: real, note: `could not install the browser wrapper: ${put.out.trim().slice(0, 200)}` };
     }

package/dist/desktop/learn/injected.mjs

@@ -1,173 +1,173 @@
-// The recorder that runs INSIDE every page of a desktop's browser.
-//
-// Injected through CDP (Page.addScriptToEvaluateOnNewDocument), so its source
-// is stringified and shipped as text. That has one hard consequence: nothing
-// here may reference module scope. The helpers are therefore passed into
-// pageRecorder as arguments and stitched together by injectedSource() below,
-// which keeps the functions the tests exercise and the functions the page runs
-// literally the same code.
-//
-// The rule this file exists to enforce: describe the CONTROL, never its VALUE.
-// The viewer already records what was typed, and that half gets redacted
-// server-side against the secret windows this file reports. If a value ever
-// leaked out of here it would bypass that entirely — it would be in the "safe"
-// track, the one stored raw.
-
-/** A control, as a person would point at it. No values, ever. */
-export function describeTarget(el) {
-  if (!el || !el.tagName) return { tag: 'unknown' };
-  const attr = (n) => {
-    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
-  };
-  const clean = (s) => {
-    const t = String(s == null ? '' : s).replace(/\s+/g, ' ').trim();
-    return t ? t.slice(0, 60) : null;
-  };
-  let labelText = null;
-  try {
-    if (el.labels && el.labels.length) labelText = clean(el.labels[0].innerText);
-  } catch { labelText = null; }
-
-  let css = null;
-  try {
-    const bits = [];
-    let node = el;
-    for (let depth = 0; node && node.tagName && depth < 4; depth++) {
-      let bit = node.tagName.toLowerCase();
-      if (node.id) { bits.unshift(bit + '#' + node.id); break; }
-      const cls = String(node.className || '').split(/\s+/).filter(Boolean).slice(0, 2);
-      if (cls.length) bit += '.' + cls.join('.');
-      bits.unshift(bit);
-      node = node.parentElement;
-    }
-    css = bits.join('>') || null;
-  } catch { css = null; }
-
-  return {
-    tag: el.tagName.toLowerCase(),
-    role: attr('role') || null,
-    // innerText, not value: a button says what it does, a field does not.
-    text: el.tagName.toLowerCase() === 'input' ? null : clean(el.innerText),
-    label: labelText || clean(attr('aria-label')),
-    name: clean(el.name) || clean(attr('name')),
-    id: clean(el.id) || null,
-    placeholder: clean(el.placeholder) || clean(attr('placeholder')),
-    css,
-  };
-}
-
-/**
- * Is focus in something we must go blind for?
- *
- * Deliberately wider than input[type=password]: plenty of one-time-code and
- * "access code" fields are plain text inputs, and a lesson that teaches a
- * login will walk straight through one. Word-bounded so that "shipping" is not
- * a PIN and "cardigan" is not a card number.
- */
-export function isSecretField(el) {
-  if (!el || !el.tagName) return false;
-  const attr = (n) => {
-    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
-  };
-  const type = String(el.type || attr('type') || '').toLowerCase();
-  if (type === 'password') return true;
-
-  const auto = String(attr('autocomplete') || '').toLowerCase();
-  if (auto.includes('password') || auto.includes('one-time-code') || auto.includes('cc-number')) {
-    return true;
-  }
-
-  let labelText = '';
-  try {
-    if (el.labels && el.labels.length) labelText = String(el.labels[0].innerText || '');
-  } catch { labelText = ''; }
-
-  const hay = [el.name, attr('name'), el.id, el.placeholder, attr('placeholder'),
-    attr('aria-label'), labelText]
-    .map((v) => String(v == null ? '' : v))
-    .join(' ')
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, ' ');
-
-  const SECRET = new RegExp('(^| )(password|passwd|pass|passcode|secret|token|otp|' +
-    'cvv|cvc|pin|card number|cardnumber|security code|access code|auth code)( |$)');
-  return SECRET.test(' ' + hay + ' ');
-}
-
-/**
- * Watch one document. Returns nothing; reports through window.__addaiLearn,
- * the CDP binding the recorder installs.
- *
- * Capture phase throughout, so a page that stops propagation on its own
- * handlers (most single-page apps do) cannot make a lesson go blank.
- */
-export function pageRecorder(describe, isSecret) {
-  if (window.__addaiLearnInstalled) return;
-  window.__addaiLearnInstalled = true;
-
-  const send = (ev) => {
-    try {
-      if (typeof window.__addaiLearn === 'function') window.__addaiLearn(JSON.stringify(ev));
-    } catch { /* a lesson must never break the page it is watching */ }
-  };
-
-  // Secret tracking has TWO independent triggers on purpose.
-  //
-  // focusin is the obvious one and it is not reliable: a browser window that
-  // does not itself have focus changes activeElement without firing any focus
-  // event at all (headless Chrome does exactly this, and so does a desktop
-  // whose window manager has put another window on top). Relying on it alone
-  // gives a silent failure whose consequence is a password in the timeline.
-  //
-  // So `input` opens a window too. Whatever else is true, a keystroke reaching
-  // a secret field is proof we should already be blind.
-  let secretOpen = false;
-  const openSecret = () => {
-    if (!secretOpen) { secretOpen = true; send({ kind: 'secret_focus' }); }
-  };
-  const closeSecret = () => {
-    if (secretOpen) { secretOpen = false; send({ kind: 'secret_blur' }); }
-  };
-
-  const editable = (t) => {
-    const tag = t && t.tagName ? t.tagName.toLowerCase() : '';
-    return tag === 'input' || tag === 'textarea' || tag === 'select' ||
-      !!(t && t.isContentEditable);
-  };
-
-  document.addEventListener('click', (e) => {
-    send({ kind: 'page_click', target: describe(e.target) });
-    // Deliberately does NOT close a secret window. Pressing "show password" or
-    // "Sign in" mid-entry is a click on something harmless, and closing there
-    // would leave a hole between it and the next keystroke — one that a
-    // coalesced `type` event could land in unredacted. Over-inclusive is the
-    // right direction for redaction; a window closes when focus really moves.
-  }, true);
-
-  const arrivedAt = (t) => {
-    if (isSecret(t)) { openSecret(); return; }
-    if (editable(t)) { closeSecret(); send({ kind: 'page_focus', target: describe(t) }); }
-  };
-
-  document.addEventListener('focusin', (e) => arrivedAt(e.target), true);
-  // The backstop. Never carries what was typed — only that typing happened.
-  document.addEventListener('input', (e) => arrivedAt(e.target), true);
-
-  // A page can be torn down mid-password. Closing the window on unload means
-  // an unclosed one really does mean "we never saw it end".
-  window.addEventListener('pagehide', closeSecret, true);
-
-  document.addEventListener('submit', (e) => {
-    send({ kind: 'submit', target: describe(e.target) });
-  }, true);
-}
-
-/** The exact text handed to Page.addScriptToEvaluateOnNewDocument. */
-export function injectedSource() {
-  return '(function(){\n' +
-    'var describeTarget = ' + describeTarget.toString() + ';\n' +
-    'var isSecretField = ' + isSecretField.toString() + ';\n' +
-    'var pageRecorder = ' + pageRecorder.toString() + ';\n' +
-    'try { pageRecorder(describeTarget, isSecretField); } catch (e) {}\n' +
-    '})();';
-}
+// The recorder that runs INSIDE every page of a desktop's browser.
+//
+// Injected through CDP (Page.addScriptToEvaluateOnNewDocument), so its source
+// is stringified and shipped as text. That has one hard consequence: nothing
+// here may reference module scope. The helpers are therefore passed into
+// pageRecorder as arguments and stitched together by injectedSource() below,
+// which keeps the functions the tests exercise and the functions the page runs
+// literally the same code.
+//
+// The rule this file exists to enforce: describe the CONTROL, never its VALUE.
+// The viewer already records what was typed, and that half gets redacted
+// server-side against the secret windows this file reports. If a value ever
+// leaked out of here it would bypass that entirely — it would be in the "safe"
+// track, the one stored raw.
+
+/** A control, as a person would point at it. No values, ever. */
+export function describeTarget(el) {
+  if (!el || !el.tagName) return { tag: 'unknown' };
+  const attr = (n) => {
+    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
+  };
+  const clean = (s) => {
+    const t = String(s == null ? '' : s).replace(/\s+/g, ' ').trim();
+    return t ? t.slice(0, 60) : null;
+  };
+  let labelText = null;
+  try {
+    if (el.labels && el.labels.length) labelText = clean(el.labels[0].innerText);
+  } catch { labelText = null; }
+
+  let css = null;
+  try {
+    const bits = [];
+    let node = el;
+    for (let depth = 0; node && node.tagName && depth < 4; depth++) {
+      let bit = node.tagName.toLowerCase();
+      if (node.id) { bits.unshift(bit + '#' + node.id); break; }
+      const cls = String(node.className || '').split(/\s+/).filter(Boolean).slice(0, 2);
+      if (cls.length) bit += '.' + cls.join('.');
+      bits.unshift(bit);
+      node = node.parentElement;
+    }
+    css = bits.join('>') || null;
+  } catch { css = null; }
+
+  return {
+    tag: el.tagName.toLowerCase(),
+    role: attr('role') || null,
+    // innerText, not value: a button says what it does, a field does not.
+    text: el.tagName.toLowerCase() === 'input' ? null : clean(el.innerText),
+    label: labelText || clean(attr('aria-label')),
+    name: clean(el.name) || clean(attr('name')),
+    id: clean(el.id) || null,
+    placeholder: clean(el.placeholder) || clean(attr('placeholder')),
+    css,
+  };
+}
+
+/**
+ * Is focus in something we must go blind for?
+ *
+ * Deliberately wider than input[type=password]: plenty of one-time-code and
+ * "access code" fields are plain text inputs, and a lesson that teaches a
+ * login will walk straight through one. Word-bounded so that "shipping" is not
+ * a PIN and "cardigan" is not a card number.
+ */
+export function isSecretField(el) {
+  if (!el || !el.tagName) return false;
+  const attr = (n) => {
+    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
+  };
+  const type = String(el.type || attr('type') || '').toLowerCase();
+  if (type === 'password') return true;
+
+  const auto = String(attr('autocomplete') || '').toLowerCase();
+  if (auto.includes('password') || auto.includes('one-time-code') || auto.includes('cc-number')) {
+    return true;
+  }
+
+  let labelText = '';
+  try {
+    if (el.labels && el.labels.length) labelText = String(el.labels[0].innerText || '');
+  } catch { labelText = ''; }
+
+  const hay = [el.name, attr('name'), el.id, el.placeholder, attr('placeholder'),
+    attr('aria-label'), labelText]
+    .map((v) => String(v == null ? '' : v))
+    .join(' ')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, ' ');
+
+  const SECRET = new RegExp('(^| )(password|passwd|pass|passcode|secret|token|otp|' +
+    'cvv|cvc|pin|card number|cardnumber|security code|access code|auth code)( |$)');
+  return SECRET.test(' ' + hay + ' ');
+}
+
+/**
+ * Watch one document. Returns nothing; reports through window.__addaiLearn,
+ * the CDP binding the recorder installs.
+ *
+ * Capture phase throughout, so a page that stops propagation on its own
+ * handlers (most single-page apps do) cannot make a lesson go blank.
+ */
+export function pageRecorder(describe, isSecret) {
+  if (window.__addaiLearnInstalled) return;
+  window.__addaiLearnInstalled = true;
+
+  const send = (ev) => {
+    try {
+      if (typeof window.__addaiLearn === 'function') window.__addaiLearn(JSON.stringify(ev));
+    } catch { /* a lesson must never break the page it is watching */ }
+  };
+
+  // Secret tracking has TWO independent triggers on purpose.
+  //
+  // focusin is the obvious one and it is not reliable: a browser window that
+  // does not itself have focus changes activeElement without firing any focus
+  // event at all (headless Chrome does exactly this, and so does a desktop
+  // whose window manager has put another window on top). Relying on it alone
+  // gives a silent failure whose consequence is a password in the timeline.
+  //
+  // So `input` opens a window too. Whatever else is true, a keystroke reaching
+  // a secret field is proof we should already be blind.
+  let secretOpen = false;
+  const openSecret = () => {
+    if (!secretOpen) { secretOpen = true; send({ kind: 'secret_focus' }); }
+  };
+  const closeSecret = () => {
+    if (secretOpen) { secretOpen = false; send({ kind: 'secret_blur' }); }
+  };
+
+  const editable = (t) => {
+    const tag = t && t.tagName ? t.tagName.toLowerCase() : '';
+    return tag === 'input' || tag === 'textarea' || tag === 'select' ||
+      !!(t && t.isContentEditable);
+  };
+
+  document.addEventListener('click', (e) => {
+    send({ kind: 'page_click', target: describe(e.target) });
+    // Deliberately does NOT close a secret window. Pressing "show password" or
+    // "Sign in" mid-entry is a click on something harmless, and closing there
+    // would leave a hole between it and the next keystroke — one that a
+    // coalesced `type` event could land in unredacted. Over-inclusive is the
+    // right direction for redaction; a window closes when focus really moves.
+  }, true);
+
+  const arrivedAt = (t) => {
+    if (isSecret(t)) { openSecret(); return; }
+    if (editable(t)) { closeSecret(); send({ kind: 'page_focus', target: describe(t) }); }
+  };
+
+  document.addEventListener('focusin', (e) => arrivedAt(e.target), true);
+  // The backstop. Never carries what was typed — only that typing happened.
+  document.addEventListener('input', (e) => arrivedAt(e.target), true);
+
+  // A page can be torn down mid-password. Closing the window on unload means
+  // an unclosed one really does mean "we never saw it end".
+  window.addEventListener('pagehide', closeSecret, true);
+
+  document.addEventListener('submit', (e) => {
+    send({ kind: 'submit', target: describe(e.target) });
+  }, true);
+}
+
+/** The exact text handed to Page.addScriptToEvaluateOnNewDocument. */
+export function injectedSource() {
+  return '(function(){\n' +
+    'var describeTarget = ' + describeTarget.toString() + ';\n' +
+    'var isSecretField = ' + isSecretField.toString() + ';\n' +
+    'var pageRecorder = ' + pageRecorder.toString() + ';\n' +
+    'try { pageRecorder(describeTarget, isSecretField); } catch (e) {}\n' +
+    '})();';
+}