@angelky7/dsh-browser-control 1.7.7 → 1.7.9

package/lib/index.js

@@ -136,7 +136,7 @@ const HINTS = {
 	extension_offline: "浏览器扩展没连上：让用户打开装了 DSH Browser Control 的那个浏览器（扩展图标应为绿色），确认端口与 Token 两边一致后再试。",
 	command_timeout: "扩展超时未回应：先别重试。用 browser_find / browser_snapshot 看页面当前状态，判断动作是否其实已经生效。",
 	link_lost: "命令在途时链路断了：动作可能已经落到页面上。先用只读工具确认页面状态，再决定是否重做。",
-	cancelled: "调用被取消：按需重新发起，不必当作错误处理。",
+	cancelled: "调用被取消：effectState=not_started 时命令确定没发出去，可以按需重新发起；unknown 时动作可能已经执行，先确认页面状态再决定，不要直接重做。",
 	not_configured: "插件还没读到配置：确认 dsh 已加载本插件（dsh plugin list）后再试。",
 	held_by_user: "这是用户在页面上的接管浮层里按下的「中止操作」，不是故障：命令一条都没有发出。先与用户确认；他同意继续之后调用 browser_hold action=off 解除，然后再继续原来的步骤。不要重试，也不要换成别的工具绕过它。",
 	blocked_by_policy: "这是本机策略拦下的，不是故障：命令没有发给浏览器（零副作用）。要放开改 profile 的 cordis.patch.yml（browser-bridge 的 readOnly / allowScript）并重启 dsh，或换成本机允许的只读工具；不要原地重试。",
@@ -190,14 +190,17 @@ var BridgeError = class extends Error {
 /**
 * 把任意底层抛出的错误归类成 BridgeError。已经分类过的原样返回，
 * 保证多次包裹不会把 code 洗掉。
+* @param params - 这次调用的参数。只有 `wait` 需要它：`fn` 是在页面里执行任意 JS，
+*   超时/掉线时与写命令同档报 `unknown`（谓词跑过就不能断言页面没被动过）；
+*   不带 `fn` 的 wait 仍是只读。
 */
-function classify(command, error) {
+function classify(command, error, params) {
 	if (error instanceof BridgeError) return error;
 	const raw = error instanceof Error ? error.message : String(error);
 	const locked = raw.startsWith("browser-locked-by-user:") ? "locked_by_user" : raw.startsWith("browser-lock-unreadable:") ? "lock_unreadable" : raw.startsWith("browser-hold-aborted:") ? "held_by_user" : void 0;
 	const markerLength = locked === "locked_by_user" ? 23 : locked === "lock_unreadable" ? 24 : locked === "held_by_user" ? 21 : 0;
 	const message = locked ? raw.slice(markerLength).trim() : raw;
-	const unknownIsPossible = isWriteCommand(command);
+	const unknownIsPossible = isWriteCommand(command) || command === "wait" && typeof params?.fn === "string" && params.fn.trim().length > 0;
 	let code;
 	if (locked !== void 0) code = locked;
 	else if (/no browser extension connected/.test(message)) code = "extension_offline";
@@ -207,7 +210,8 @@ function classify(command, error) {
 	else if (/尚未加载配置|not configured yet/.test(message)) code = "not_configured";
 	else if (/未启用|not enabled|桥接启动失败|listen EADDR|settings integration/.test(message)) code = "bridge_disabled";
 	else code = "command_failed";
-	return new BridgeError(command, code, code === "command_timeout" || code === "link_lost" ? unknownIsPossible ? "unknown" : "not_started" : code === "command_failed" ? unknownIsPossible ? "unknown" : "not_started" : "not_started", message);
+	const effectState = code === "command_timeout" || code === "link_lost" ? unknownIsPossible ? "unknown" : "not_started" : code === "command_failed" ? unknownIsPossible ? "unknown" : "not_started" : code === "cancelled" ? /cancelled before send/.test(message) ? "not_started" : unknownIsPossible ? "unknown" : "not_started" : "not_started";
+	return new BridgeError(command, code, effectState, message);
 }
 //#endregion
 //#region lib/types/server.js
@@ -286,7 +290,12 @@ var BridgeServer = class {
 	connectedAt;
 	pending = /* @__PURE__ */ new Map();
 	lastError;
-	continuationRemainder = "";
+	/**
+	* Payloads of the message being reassembled. **Buffers, not strings**: decoding
+	* each fragment with `toString('utf8')` corrupts any multi-byte character that
+	* straddles a fragment boundary. Decode once, at FIN.
+	*/
+	continuationChunks = [];
 	continuationOpen = false;
 	constructor(options) {
 		this.options = options;
@@ -391,7 +400,7 @@ var BridgeServer = class {
 		if (signal !== void 0) {
 			entry.onAbort = () => {
 				if (!this.pending.delete(id)) return;
-				entry.reject(/* @__PURE__ */ new Error(`browser command cancelled: ${command}`));
+				entry.reject(/* @__PURE__ */ new Error(`browser command cancelled after send: ${command}`));
 			};
 			signal.addEventListener("abort", entry.onAbort, { once: true });
 		}
@@ -406,7 +415,7 @@ var BridgeServer = class {
 		try {
 			return await result;
 		} catch (error) {
-			throw classify(command, error);
+			throw classify(command, error, params);
 		} finally {
 			clearTimeout(entry.timer);
 			if (entry.onAbort !== void 0 && signal !== void 0) signal.removeEventListener("abort", entry.onAbort);
@@ -544,20 +553,29 @@ var BridgeServer = class {
 				});
 				return;
 			}
-			if (typeof parsed.command !== "string" || parsed.command.length === 0) {
+			if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+				this.respondJson(res, 400, {
+					ok: false,
+					error: "body must be {\"command\": \"...\", \"params\": {...}}"
+				});
+				return;
+			}
+			const body = parsed;
+			if (typeof body.command !== "string" || body.command.length === 0) {
 				this.respondJson(res, 400, {
 					ok: false,
 					error: "body must be {\"command\": \"...\", \"params\": {...}}"
 				});
 				return;
 			}
-			const timeoutMs = typeof parsed.timeoutMs === "number" ? parsed.timeoutMs : void 0;
-			this.execute(parsed.command, parsed.params ?? {}, timeoutMs === void 0 ? {} : { timeoutMs }).then((result) => this.respondJson(res, 200, {
+			const timeoutMs = typeof body.timeoutMs === "number" ? body.timeoutMs : void 0;
+			const options = timeoutMs === void 0 ? {} : { timeoutMs };
+			(this.options.httpCommand ?? ((command, params, opts) => this.execute(command, params, opts)))(body.command, body.params ?? {}, options).then((result) => this.respondJson(res, 200, {
 				ok: true,
 				result
 			}), (error) => {
 				if (error instanceof BridgeError) {
-					const status = error.code === "extension_offline" || error.code === "bridge_disabled" || error.code === "not_configured" ? 503 : error.code === "command_timeout" || error.code === "link_lost" ? 504 : 502;
+					const status = error.code === "extension_offline" || error.code === "bridge_disabled" || error.code === "not_configured" ? 503 : error.code === "command_timeout" || error.code === "link_lost" ? 504 : error.code === "blocked_by_policy" ? 403 : 502;
 					this.respondJson(res, status, error.toJSON());
 					return;
 				}
@@ -610,11 +628,15 @@ Sec-WebSocket-Accept: ${accept}\r\n\r
 		this.clientSocket = socket;
 		this.hello = void 0;
 		this.connectedAt = /* @__PURE__ */ new Date();
-		this.continuationRemainder = "";
+		this.continuationChunks = [];
 		this.continuationOpen = false;
 		this.log(`extension connected from ${socket.remoteAddress}:${socket.remotePort}`);
 		const reader = new FrameReader();
 		socket.on("data", (chunk) => {
+			if (this.clientSocket !== socket) {
+				socket.destroy();
+				return;
+			}
 			reader.push(chunk);
 			try {
 				reader.drain((frame) => this.handleFrame(frame));
@@ -637,7 +659,7 @@ Sec-WebSocket-Accept: ${accept}\r\n\r
 		switch (frame.opcode) {
 			case 1:
 			case 0:
-				this.handleText(frame.payload.toString("utf8"), frame.fin, frame.opcode);
+				this.handleText(frame.payload, frame.fin, frame.opcode);
 				return;
 			case 8:
 				this.closeClientSocket(1e3, "");
@@ -648,14 +670,14 @@ Sec-WebSocket-Accept: ${accept}\r\n\r
 			default: return;
 		}
 	}
-	handleText(text, fin, opcode) {
+	handleText(payload, fin, opcode) {
 		if (opcode === 0 && !this.continuationOpen) return;
-		if (opcode === 1) this.continuationRemainder = "";
+		if (opcode === 1) this.continuationChunks = [];
 		this.continuationOpen = opcode === 0 || !fin;
-		this.continuationRemainder += text;
+		this.continuationChunks.push(payload);
 		if (!fin) return;
-		const full = this.continuationRemainder;
-		this.continuationRemainder = "";
+		const full = Buffer.concat(this.continuationChunks).toString("utf8");
+		this.continuationChunks = [];
 		this.continuationOpen = false;
 		let msg;
 		try {
@@ -889,9 +911,22 @@ const READ_ONLY_ALLOWED = /* @__PURE__ */ new Set([
 /**
 * 会执行**任意页面脚本**的扩展命令。这条与只读档分开管，因为用户可能想「可以读、
 * 也可以点，但别在我页面里跑任意 JS」——`browser_evaluate` 能绕开其他所有工具做的事。
+*
+* **按命令名判不够**：`wait` 的 `fn` 参数同样是在页面里执行任意 JS（扩展侧用
+* `(${fn})()` 求出谓词），只按名字看它会从只读白名单和脚本开关两道门缝里同时漏过去。
+* 所以真正判「是不是脚本」的是下面 `isScriptCall()`：命令名 + 参数一起看，
+* `wait(selector)` / `wait(text)` 仍按只读处理，`wait({fn})` 与 `eval` 同档。
 */
 const SCRIPT_COMMANDS = /* @__PURE__ */ new Set(["eval"]);
 /**
+* 这次调用会不会在页面里执行任意 JS。判据是「这次实际要做的动作」，不是命令名：
+* `wait` 只有带 `fn` 时才升级为脚本调用（`selector` / `text` 是纯查询）。
+*/
+function isScriptCall(command, params) {
+	if (SCRIPT_COMMANDS.has(command)) return true;
+	return command === "wait" && typeof params?.fn === "string" && params.fn.trim().length > 0;
+}
+/**
 * 不经过扩展、直接在插件进程里改动本机文件的命令名。
 *
 * `browser_cleanup` 走 `BridgeController.cleanup()`，**不经过 `execute()`**，所以它天然
@@ -922,7 +957,9 @@ const CONFIG_HINT = "开关在 profile 的 cordis.patch.yml 里（browser-bridge
 * @returns 拒绝时写给 agent 的整句理由；放行时 `undefined`。
 */
 function policyRefusal(command, flags, params) {
-	if (!flags.allowScript && SCRIPT_COMMANDS.has(command)) return `在页面里执行任意脚本已被关闭（allowScript: false）：命令 ${command} 被拒绝，没有向浏览器发出任何操作。要读页面内容请改用 browser_read / browser_snapshot / browser_find；确实需要执行脚本时，${CONFIG_HINT}之后再说。`;
+	const scriptCall = isScriptCall(command, params);
+	if (!flags.allowScript && scriptCall) return `在页面里执行任意脚本已被关闭（allowScript: false）：${command === "wait" ? "命令 wait 的 fn 参数（会在页面里执行任意 JS）被拒绝" : `命令 ${command} 被拒绝`}，没有向浏览器发出任何操作。要等页面就绪请改用 wait 的 selector / text（只读），读页面内容用 browser_read / browser_snapshot / browser_find；确实需要执行脚本时，${CONFIG_HINT}之后再说。`;
+	if (flags.readOnly && command === "wait" && scriptCall) return `只读模式已开启（readOnly: true）：命令 wait 的 fn 参数会在页面里执行任意 JS（可能改变页面状态），已被拒绝，没有向浏览器发出任何操作。要等页面就绪请改用 wait 的 selector / text（只读）；要放开请由用户关掉 readOnly，${CONFIG_HINT}不要原地重试本命令。`;
 	if (flags.readOnly && LOCAL_DESTRUCTIVE_COMMANDS.has(command)) return `只读模式已开启（readOnly: true）：命令 ${command} 会删除本机保存的截图与临时文件，删除不可逆，所以已被拒绝，没有任何文件被删除。只读档的含义是「什么都不要改」，清理属于改动；要释放磁盘请由用户自己关掉 readOnly，${CONFIG_HINT}。不要原地重试本命令。`;
 	const isReadOnlyAction = command === "hold" && params?.action === "status";
 	if (flags.readOnly && PAGE_MUTATING_COMMANDS.has(command) && !isReadOnlyAction) return `只读模式已开启（readOnly: true）：命令 ${command} 会往页面里插入一层接管浮层（改页面 DOM），已被拒绝，没有向浏览器发出任何操作。浮层是给用户看的提示层，不是安全边界；只读档里连这种「只是提示」的改动也一并拒绝。要开浮层请由用户关掉 readOnly，${CONFIG_HINT}不要原地重试本命令。`;
@@ -937,6 +974,46 @@ const AUDIT_EXPRESSION_MAX_CHARS = 120;
 /** 参数里这些键的值一律打码（大小写不敏感）。 */
 const SECRET_KEY = /^(token|authorization|password|passwd|secret|apikey|api_key|cookie)$/i;
 /**
+* URL 里的秘密不能靠「截断」处理：`?token=…&code=…` 截到 120 字符照样是明文。
+* 审计的用途是「做了什么」，所以保留 scheme/host/path 与查询键名，**查询值一律打码**；
+* 片段（#）只在看起来像参数（含 `=` 或 token/secret 字样）时整体打码——SPA 路由
+* （`#/inbox`）要留住，OAuth 隐式流的 `#access_token=…` 不能留。
+*/
+const URL_PATTERN = /https?:\/\/[^\s"'<>]+/g;
+function redactUrlMatch(match) {
+	const trailing = match.match(/[).,;:!?]+$/);
+	const core = trailing === null ? match : match.slice(0, -trailing[0].length);
+	const tail = trailing === null ? "" : trailing[0];
+	const queryAt = core.indexOf("?");
+	const hashAt = core.indexOf("#");
+	const base = queryAt >= 0 ? core.slice(0, queryAt) : hashAt >= 0 ? core.slice(0, hashAt) : core;
+	const query = queryAt >= 0 ? core.slice(queryAt + 1, hashAt >= 0 ? hashAt : void 0) : "";
+	const hash = hashAt >= 0 ? core.slice(hashAt) : "";
+	let changed = false;
+	const redactedQuery = query.length === 0 ? "" : query.split("&").map((pair) => {
+		const eq = pair.indexOf("=");
+		if (eq < 0) return pair;
+		const key = pair.slice(0, eq);
+		let value = pair.slice(eq + 1);
+		try {
+			value = decodeURIComponent(value);
+		} catch {}
+		changed = true;
+		return `${key}=[redacted:${[...value].length} chars]`;
+	}).join("&");
+	let redactedHash = hash;
+	if (hash.length > 1 && (/=/.test(hash) || /token|secret|access_token/i.test(hash))) {
+		redactedHash = "#[redacted]";
+		changed = true;
+	}
+	if (!changed) return core + tail;
+	return `${base}${redactedQuery.length > 0 ? `?${redactedQuery}` : ""}${redactedHash}${tail}`;
+}
+/** 把一段文本里所有 URL 的查询值/敏感片段打码（用于参数摘要与错误文本）。 */
+function redactAuditText(text) {
+	return text.replace(URL_PATTERN, redactUrlMatch);
+}
+/**
 * 哪个命令的 `value` 字段是敏感内容：`input` 是往页面里打的字（可能是密码），
 * `cookies.set` 直接写凭据。其余命令的 value 字段（如果有）不动。
 */
@@ -954,7 +1031,11 @@ function summarizeAuditParams(command, params) {
 		text = JSON.stringify(params, (key, value) => {
 			if (SECRET_KEY.test(key)) return "[redacted]";
 			if (key === "value" && VALUE_REDACTED_COMMANDS.has(command)) return redactValue(value);
-			if (key === "expression" && typeof value === "string" && [...value].length > AUDIT_EXPRESSION_MAX_CHARS) return `${[...value].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join("")}…[+${[...value].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+			if (typeof value === "string") {
+				const redacted = redactAuditText(value);
+				if (key === "expression" && [...redacted].length > AUDIT_EXPRESSION_MAX_CHARS) return `${[...redacted].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join("")}…[+${[...redacted].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+				return redacted;
+			}
 			return value;
 		}) ?? "{}";
 	} catch {
@@ -986,7 +1067,10 @@ var AuditLog = class {
 		if (input.tabId !== void 0) entry.tabId = input.tabId;
 		if (input.code !== void 0) entry.code = input.code;
 		if (input.effectState !== void 0) entry.effectState = input.effectState;
-		if (input.error !== void 0) entry.error = [...input.error].length > AUDIT_ERROR_MAX_CHARS ? `${[...input.error].slice(0, AUDIT_ERROR_MAX_CHARS).join("")}…` : input.error;
+		if (input.error !== void 0) {
+			const redacted = redactAuditText(input.error);
+			entry.error = [...redacted].length > AUDIT_ERROR_MAX_CHARS ? `${[...redacted].slice(0, AUDIT_ERROR_MAX_CHARS).join("")}…` : redacted;
+		}
 		this.entries.push(entry);
 		if (this.entries.length > 200) this.entries.splice(0, this.entries.length - 200);
 		return entry;
@@ -1373,6 +1457,7 @@ var BridgeController = class {
 	current;
 	journal;
 	journalKey = "";
+	journalError;
 	/** 操作审计账本（内存环形缓冲，200 条；命令层记录，见 audit.ts 顶部注释）。 */
 	audit = new AuditLog();
 	/** 多 session 隔离：每个 dsh 会话的工作标签页（见 sessions.ts）。 */
@@ -1389,11 +1474,24 @@ var BridgeController = class {
 		return this.current === void 0 ? void 0 : path.resolve(this.current.stateDir);
 	}
 	/**
+	* Whether THIS run is persisting the journal, and why not. `browser_audit` /
+	* `browser_journal` surface this: a memory-only run used to be visible only in
+	* one log line, so a missing journal looked like "nothing happened".
+	*/
+	get journalStatus() {
+		if (this.journal !== void 0) return { enabled: true };
+		return this.journalError === void 0 ? { enabled: false } : {
+			enabled: false,
+			error: this.journalError
+		};
+	}
+	/**
 	* Record one audit entry in memory and, when the journal is open, on disk.
 	* Journal appends are queued and never block the command path.
 	*/
 	recordAudit(input) {
-		this.journal?.append(this.audit.record(input));
+		const entry = this.audit.record(input);
+		this.journal?.append(entry);
 	}
 	/**
 	* Current policy flags. Tools that compose several commands (browser_drag
@@ -1470,8 +1568,10 @@ var BridgeController = class {
 			await previousJournal?.close();
 			try {
 				this.journal = await Journal.open(stateDir, this.log);
+				this.journalError = void 0;
 			} catch (error) {
-				this.log(`journal: disabled — ${errorMessage(error)}`);
+				this.journalError = errorMessage(error);
+				this.log(`journal: disabled — ${this.journalError}`);
 			}
 		}
 		const key = config.enabled ? `${config.port}|${config.token}|${shotsDir}` : "";
@@ -1488,7 +1588,8 @@ var BridgeController = class {
 			port: config.port,
 			token: config.token,
 			shotsDir,
-			log: this.log
+			log: this.log,
+			httpCommand: (command, params, options) => this.execute(command, params, new AbortController().signal, options.timeoutMs)
 		});
 		try {
 			await server.start();
@@ -1560,18 +1661,35 @@ var BridgeController = class {
 	* to work; when it is gone we forget it and let the browser's active tab
 	* answer, exactly like before this feature existed.
 	*/
-	async isolateParams(command, params, sessionId, signal) {
-		if (typeof params.tabId === "number" || NO_TAB_DEFAULT_COMMANDS.has(command)) return params;
+	/**
+	* The calling session's working tab, after the same liveness probe isolateParams
+	* uses. Tools that compose several commands (browser_drag) need the id *before*
+	* issuing anything, so they must not fall back to the browser's active tab on
+	* their own — that would silently bypass session isolation.
+	*/
+	async sessionTab(signal) {
+		const sessionId = TOOL_SESSION.getStore();
+		if (sessionId === void 0) return void 0;
+		return await this.liveRecordedTab(sessionId, signal);
+	}
+	/** Recorded working tab if it is still open; a gone tab is forgotten here. */
+	async liveRecordedTab(sessionId, signal) {
 		const recorded = this.sessions.workingTab(sessionId);
-		if (recorded === void 0) return params;
+		if (recorded === void 0) return void 0;
 		const server = this.server;
 		if (server !== void 0) try {
 			const listing = await server.execute("tabs.list", {}, { signal });
 			if (!(Array.isArray(listing?.tabs) && listing.tabs.some((tab) => tab?.id === recorded))) {
 				this.sessions.release(sessionId);
-				return params;
+				return;
 			}
 		} catch {}
+		return recorded;
+	}
+	async isolateParams(command, params, sessionId, signal) {
+		if (typeof params.tabId === "number" || NO_TAB_DEFAULT_COMMANDS.has(command)) return params;
+		const recorded = await this.liveRecordedTab(sessionId, signal);
+		if (recorded === void 0) return params;
 		return {
 			...params,
 			tabId: recorded
@@ -3667,16 +3785,26 @@ async function resolveDragPoint(ctrl, tabId, target, signal) {
 	}, signal))?.nodeId ?? 0;
 	if (nodeId === 0) throw new Error(`no element matches selector ${JSON.stringify(selector)} (top document only)`);
 	await cdpCall(ctrl, tabId, "DOM.scrollIntoViewIfNeeded", { nodeId }, signal);
+	return await measureDragNode(ctrl, tabId, nodeId, selector, signal);
+}
+/**
+* Read a node's **current** viewport geometry without scrolling. Needed after the
+* *other* endpoint's scrollIntoViewIfNeeded: that scroll can move the first
+* endpoint (and this one), so coordinates measured before it are stale. DOM
+* geometry is viewport-relative; dispatching the old numbers would drag from
+* wherever the element used to be.
+*/
+async function measureDragNode(ctrl, tabId, nodeId, label, signal) {
 	let box;
 	try {
 		box = await cdpCall(ctrl, tabId, "DOM.getBoxModel", { nodeId }, signal);
 	} catch (error) {
-		throw new Error(`cannot measure ${JSON.stringify(selector)} — hidden, zero-size or detached? (${error instanceof Error ? error.message : String(error)})`);
+		throw new Error(`cannot measure ${JSON.stringify(label)} — hidden, zero-size or detached? (${error instanceof Error ? error.message : String(error)})`);
 	}
 	const q = box?.model?.content;
-	if (!Array.isArray(q) || q.length < 8) throw new Error(`DOM.getBoxModel returned no quad for ${JSON.stringify(selector)}`);
+	if (!Array.isArray(q) || q.length < 8) throw new Error(`DOM.getBoxModel returned no quad for ${JSON.stringify(label)}`);
 	return {
-		selector,
+		selector: label,
 		x: (q[0] + q[2] + q[4] + q[6]) / 4,
 		y: (q[1] + q[3] + q[5] + q[7]) / 4,
 		width: typeof box?.model?.width === "number" ? box.model.width : Math.hypot(q[2] - q[0], q[3] - q[1]),
@@ -3684,6 +3812,19 @@ async function resolveDragPoint(ctrl, tabId, target, signal) {
 		nodeId
 	};
 }
+/** CSS viewport size via Page.getLayoutMetrics (no page JS, works with allowScript off). */
+async function viewportSize(ctrl, tabId, signal) {
+	try {
+		const metrics = await cdpCall(ctrl, tabId, "Page.getLayoutMetrics", {}, signal);
+		const viewport = metrics?.cssVisualViewport ?? metrics?.cssLayoutViewport;
+		const width = Number(viewport?.clientWidth);
+		const height = Number(viewport?.clientHeight);
+		if (Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0) return {
+			width,
+			height
+		};
+	} catch {}
+}
 /** Whether the source declares the native HTML5 `draggable` attribute. */
 async function sourceIsDraggable(ctrl, tabId, nodeId, signal) {
 	const attrs = await cdpCall(ctrl, tabId, "DOM.getAttributes", { nodeId }, signal);
@@ -3859,6 +4000,7 @@ function registerDragTool(ctx, controller) {
 			controller.requireExtensionCommand("cdp", "1.7.2");
 			if (controller.policy.readOnly) throw new Error("browser_drag changes page state and read-only mode is on — turn readOnly off in the browser-bridge config to drag");
 			let tabId = args.tabId;
+			if (tabId === void 0) tabId = await controller.sessionTab(exec.signal);
 			if (tabId === void 0) {
 				const listing = await controller.execute("tabs.list", {}, exec.signal);
 				if (typeof listing?.activeTabId !== "number") throw new Error("could not resolve the active tab — pass tabId explicitly");
@@ -3871,56 +4013,92 @@ function registerDragTool(ctx, controller) {
 			if (mode === "auto" && source?.nodeId !== void 0 && await sourceIsDraggable(controller, tabId, source.nodeId, exec.signal)) resolvedMode = "html5";
 			if (resolvedMode === "mouse") {
 				const target = await resolveDragPoint(controller, tabId, to, exec.signal);
+				let sourcePoint = source;
+				let targetPoint = target;
+				if (source?.nodeId !== void 0 && target.nodeId !== void 0) {
+					sourcePoint = await measureDragNode(controller, tabId, source.nodeId, String(from.selector), exec.signal);
+					targetPoint = await measureDragNode(controller, tabId, target.nodeId, String(to.selector), exec.signal);
+				}
+				const viewport = await viewportSize(controller, tabId, exec.signal);
+				if (viewport !== void 0) {
+					const describe = (p) => `${p.selector !== void 0 ? JSON.stringify(p.selector) : "point"} at (${Math.round(p.x)},${Math.round(p.y)})`;
+					const outside = (p) => p.x < 0 || p.y < 0 || p.x > viewport.width || p.y > viewport.height;
+					if (outside(sourcePoint) || outside(targetPoint)) throw new Error(`drag endpoints are not both visible in the viewport (${describe(sourcePoint)} → ${describe(targetPoint)}, viewport ${Math.round(viewport.width)}×${Math.round(viewport.height)}) — scroll so both fit, then retry; mode:"html5" takes selectors and needs no viewport coordinates`);
+				}
 				const steps = Math.min(50, Math.max(1, Math.trunc(typeof args.steps === "number" ? args.steps : 12)));
-				const sx = source.x, sy = source.y, tx = target.x, ty = target.y;
+				const sx = sourcePoint.x, sy = sourcePoint.y, tx = targetPoint.x, ty = targetPoint.y;
 				const dispatch = async (params) => {
 					await cdpCall(controller, tabId, "Input.dispatchMouseEvent", params, exec.signal);
 				};
-				await dispatch({
-					type: "mouseMoved",
-					x: sx,
-					y: sy,
-					button: "none",
-					buttons: 0
-				});
-				await dispatch({
-					type: "mousePressed",
-					x: sx,
-					y: sy,
-					button: "left",
-					buttons: 1,
-					clickCount: 1
-				});
-				for (let i = 1; i <= steps; i++) {
-					const f = i / steps;
+				let pressedAt;
+				try {
 					await dispatch({
 						type: "mouseMoved",
-						x: sx + (tx - sx) * f,
-						y: sy + (ty - sy) * f,
+						x: sx,
+						y: sy,
+						button: "none",
+						buttons: 0
+					});
+					await dispatch({
+						type: "mousePressed",
+						x: sx,
+						y: sy,
 						button: "left",
-						buttons: 1
+						buttons: 1,
+						clickCount: 1
+					});
+					pressedAt = {
+						x: sx,
+						y: sy
+					};
+					for (let i = 1; i <= steps; i++) {
+						const f = i / steps;
+						await dispatch({
+							type: "mouseMoved",
+							x: sx + (tx - sx) * f,
+							y: sy + (ty - sy) * f,
+							button: "left",
+							buttons: 1
+						});
+						pressedAt = {
+							x: sx + (tx - sx) * f,
+							y: sy + (ty - sy) * f
+						};
+					}
+					await dispatch({
+						type: "mouseReleased",
+						x: tx,
+						y: ty,
+						button: "left",
+						buttons: 0,
+						clickCount: 1
+					});
+					pressedAt = void 0;
+					await dispatch({
+						type: "mouseMoved",
+						x: tx,
+						y: ty,
+						button: "none",
+						buttons: 0
 					});
+				} catch (error) {
+					if (pressedAt !== void 0) try {
+						await cdpCall(controller, tabId, "Input.dispatchMouseEvent", {
+							type: "mouseReleased",
+							x: pressedAt.x,
+							y: pressedAt.y,
+							button: "left",
+							buttons: 0,
+							clickCount: 1
+						}, new AbortController().signal);
+					} catch {}
+					throw error;
 				}
-				await dispatch({
-					type: "mouseReleased",
-					x: tx,
-					y: ty,
-					button: "left",
-					buttons: 0,
-					clickCount: 1
-				});
-				await dispatch({
-					type: "mouseMoved",
-					x: tx,
-					y: ty,
-					button: "none",
-					buttons: 0
-				});
 				return {
 					tabId,
 					mode: "mouse",
-					from: roundDragPoint(source),
-					to: roundDragPoint(target),
+					from: roundDragPoint(sourcePoint),
+					to: roundDragPoint(targetPoint),
 					steps,
 					dispatched: steps + 4,
 					elapsedMs: Date.now() - started
@@ -3954,10 +4132,13 @@ function registerDragTool(ctx, controller) {
 		}
 	}));
 }
+function journalWarning(status) {
+	return status.enabled ? "" : `\nJournal write: disabled${status.error === void 0 ? "" : ` — ${status.error}`} — this run is memory-only; entries are not being written to disk.`;
+}
 function registerAuditTool(ctx, controller) {
 	ctx.tools.register(defineTool$1({
 		name: "browser_audit",
-		description: "Read this plugin session's in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; eval expressions are truncated. Plugin-local read — works in read-only mode.",
+		description: "Read this plugin session's in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; URL query values and URLs inside error text are redacted; eval expressions are truncated. The `journal` field says whether this run is also being written to disk (enabled:false + error = memory-only). Plugin-local read — works in read-only mode.",
 		parameters: {
 			command: {
 				type: "string",
@@ -3989,6 +4170,17 @@ function registerAuditTool(ctx, controller) {
 						type: "number",
 						required: true
 					},
+					journal: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							enabled: {
+								type: "boolean",
+								required: true
+							},
+							error: { type: "string" }
+						}
+					},
 					entries: {
 						type: "array",
 						required: true,
@@ -4031,9 +4223,10 @@ function registerAuditTool(ctx, controller) {
 			},
 			render: (_args, value) => {
 				const v = value;
+				const warn = v.journal === void 0 ? "" : journalWarning(v.journal);
 				if (v.entries.length === 0) return [{
 					type: "text",
-					text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.`
+					text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.${warn}`
 				}];
 				const lines = v.entries.map((e) => {
 					const tab = e.tabId === void 0 ? "" : ` tab ${e.tabId}`;
@@ -4043,7 +4236,7 @@ function registerAuditTool(ctx, controller) {
 				});
 				return [{
 					type: "text",
-					text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join("\n")}`)
+					text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join("\n")}${warn}`)
 				}];
 			}
 		},
@@ -4062,7 +4255,8 @@ function registerAuditTool(ctx, controller) {
 			return {
 				total: controller.audit.size(),
 				shown: entries.length,
-				entries
+				entries,
+				journal: controller.journalStatus
 			};
 		}
 	}));
@@ -4070,7 +4264,7 @@ function registerAuditTool(ctx, controller) {
 function registerJournalTool(ctx, controller) {
 	ctx.tools.register(defineTool$1({
 		name: "browser_journal",
-		description: "Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover \"what was I doing\" after a restart.",
+		description: "Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. The `journal` field says whether the CURRENT run is writing (enabled:false + error = this run is memory-only; what you see is from earlier runs). Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover \"what was I doing\" after a restart.",
 		parameters: {
 			command: {
 				type: "string",
@@ -4102,6 +4296,17 @@ function registerJournalTool(ctx, controller) {
 						type: "number",
 						required: true
 					},
+					journal: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							enabled: {
+								type: "boolean",
+								required: true
+							},
+							error: { type: "string" }
+						}
+					},
 					entries: {
 						type: "array",
 						required: true,
@@ -4148,9 +4353,10 @@ function registerJournalTool(ctx, controller) {
 			},
 			render: (_args, value) => {
 				const v = value;
+				const warn = v.journal === void 0 ? "" : journalWarning(v.journal);
 				if (v.entries.length === 0) return [{
 					type: "text",
-					text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.`
+					text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.${warn}`
 				}];
 				const lines = [];
 				let run = "";
@@ -4165,7 +4371,7 @@ function registerJournalTool(ctx, controller) {
 				}
 				return [{
 					type: "text",
-					text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join("\n")}`)
+					text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join("\n")}${warn}`)
 				}];
 			}
 		},
@@ -4186,7 +4392,8 @@ function registerJournalTool(ctx, controller) {
 				total,
 				shown: entries.length,
 				runs: new Set(entries.map((e) => e.run)).size,
-				entries
+				entries,
+				journal: controller.journalStatus
 			};
 		}
 	}));

package/lib/types/audit.d.ts

@@ -9,6 +9,7 @@
  *   - **只存内存**（环形缓冲，200 条）：跨 dsh 重启的持久化是「会话恢复」那一版的事；
  *     这一版先把账记对，别把磁盘格式写死。
  *   - **参数摘要是脱敏后的**：输入框的值、cookie 的值、令牌类字段一律打码；
+ *     URL 的查询值与敏感片段打码，错误文本里的 URL 同样打码（截断不是脱敏）；
  *     表达式截断。审计的用途是「做了什么」，不是「内容是什么」。
  */
 export interface AuditEntry {
@@ -37,6 +38,8 @@ export interface AuditFilter {
 }
 /** 环形缓冲上限。200 条足够覆盖一次排障现场，又不至于让内存跟着会话长度涨。 */
 export declare const AUDIT_MAX_ENTRIES = 200;
+/** 把一段文本里所有 URL 的查询值/敏感片段打码（用于参数摘要与错误文本）。 */
+export declare function redactAuditText(text: string): string;
 /**
  * 把一次调用的参数压成可审计的摘要：敏感键打码、特定命令的 value 打码、
  * 长表达式截断、整体限长。返回 JSON 文本——审计工具原样把它交给模型。