@angelky7/dsh-browser-control 1.7.7 → 1.7.9

package/lib/types/server.js

@@ -87,7 +87,12 @@ export class BridgeServer {
     connectedAt;
     pending = new Map();
     lastError;
-    continuationRemainder = '';
+    /**
+     * Payloads of the message being reassembled. **Buffers, not strings**: decoding
+     * each fragment with `toString('utf8')` corrupts any multi-byte character that
+     * straddles a fragment boundary. Decode once, at FIN.
+     */
+    continuationChunks = [];
     continuationOpen = false;
     constructor(options) {
         this.options = options;
@@ -202,7 +207,10 @@ export class BridgeServer {
             entry.onAbort = () => {
                 if (!this.pending.delete(id))
                     return;
-                entry.reject(new Error(`browser command cancelled: ${command}`));
+                // 监听器只可能在 socket.write 之后触发（execute 从注册到写出是同步的、中间
+                // 没有 await），所以这里必须说 after send：写命令的结果是未知，而不是
+                // 「取消 = 什么都没发生」。before send 的那条检查在函数开头，措辞不同。
+                entry.reject(new Error(`browser command cancelled after send: ${command}`));
             };
             signal.addEventListener('abort', entry.onAbort, { once: true });
         }
@@ -215,8 +223,9 @@ export class BridgeServer {
         catch (error) {
             // One choke point: everything above this line that can fail is a link or
             // extension failure, and the caller needs to know whether the page may
-            // already have been changed. See src/errors.ts.
-            throw classify(command, error);
+            // already have been changed. See src/errors.ts. `params` matters for wait(fn):
+            // 谓词是任意 JS，超时/取消时按写命令报 unknown。
+            throw classify(command, error, params);
         }
         finally {
             clearTimeout(entry.timer);
@@ -359,19 +368,33 @@ export class BridgeServer {
                 this.respondJson(res, 400, { ok: false, error: `invalid JSON body: ${errorMessage(error)}` });
                 return;
             }
-            if (typeof parsed.command !== 'string' || parsed.command.length === 0) {
+            // `null` parses fine and is NOT an object: without this guard the property
+            // reads below throw a TypeError inside an event callback (uncaught).
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                this.respondJson(res, 400, { ok: false, error: 'body must be {"command": "...", "params": {...}}' });
+                return;
+            }
+            const body = parsed;
+            if (typeof body.command !== 'string' || body.command.length === 0) {
                 this.respondJson(res, 400, { ok: false, error: 'body must be {"command": "...", "params": {...}}' });
                 return;
             }
-            const timeoutMs = typeof parsed.timeoutMs === 'number' ? parsed.timeoutMs : undefined;
-            this.execute(parsed.command, (parsed.params ?? {}), timeoutMs === undefined ? {} : { timeoutMs }).then((result) => this.respondJson(res, 200, { ok: true, result }), (error) => {
+            const timeoutMs = typeof body.timeoutMs === 'number' ? body.timeoutMs : undefined;
+            const options = timeoutMs === undefined ? {} : { timeoutMs };
+            // The plugin's controller carries the read-only / script gates and the audit
+            // trail; the raw execute() below is only the fallback for bare users.
+            const run = this.options.httpCommand ?? ((command, params, opts) => this.execute(command, params, opts));
+            run(body.command, (body.params ?? {}), options).then((result) => this.respondJson(res, 200, { ok: true, result }), (error) => {
                 if (error instanceof BridgeError) {
-                    // 503 = 现在根本没法工作；504 = 超时且结果未知；502 = 扩展报了具体失败
+                    // 503 = 现在根本没法工作；504 = 超时且结果未知；403 = 本机策略拦下（零副作用）；
+                    // 502 = 扩展报了具体失败
                     const status = error.code === 'extension_offline' || error.code === 'bridge_disabled' || error.code === 'not_configured'
                         ? 503
                         : error.code === 'command_timeout' || error.code === 'link_lost'
                             ? 504
-                            : 502;
+                            : error.code === 'blocked_by_policy'
+                                ? 403
+                                : 502;
                     this.respondJson(res, status, error.toJSON());
                     return;
                 }
@@ -425,11 +448,19 @@ export class BridgeServer {
         this.clientSocket = socket;
         this.hello = undefined;
         this.connectedAt = new Date();
-        this.continuationRemainder = '';
+        this.continuationChunks = [];
         this.continuationOpen = false;
         this.log(`extension connected from ${socket.remoteAddress}:${socket.remotePort}`);
         const reader = new FrameReader();
         socket.on('data', (chunk) => {
+            // A replaced connection can still deliver buffered frames. Without this
+            // guard its pong/frames would be applied to the NEW link, and its close
+            // event could tear the new socket down (the close handler already checks,
+            // the data handler did not).
+            if (this.clientSocket !== socket) {
+                socket.destroy();
+                return;
+            }
             reader.push(chunk);
             try {
                 reader.drain((frame) => this.handleFrame(frame));
@@ -454,7 +485,7 @@ export class BridgeServer {
         switch (frame.opcode) {
             case 0x1:
             case 0x0:
-                this.handleText(frame.payload.toString('utf8'), frame.fin, frame.opcode);
+                this.handleText(frame.payload, frame.fin, frame.opcode);
                 return;
             case 0x8:
                 this.closeClientSocket(1000, '');
@@ -466,17 +497,19 @@ export class BridgeServer {
                 return; // pong or binary: nothing to do
         }
     }
-    handleText(text, fin, opcode) {
+    handleText(payload, fin, opcode) {
         if (opcode === 0x0 && !this.continuationOpen)
             return; // stray continuation
         if (opcode === 0x1)
-            this.continuationRemainder = '';
+            this.continuationChunks = [];
         this.continuationOpen = opcode === 0x0 || !fin;
-        this.continuationRemainder += text;
+        this.continuationChunks.push(payload);
         if (!fin)
             return;
-        const full = this.continuationRemainder;
-        this.continuationRemainder = '';
+        // Decode only the complete message: per-fragment toString('utf8') splits
+        // multi-byte characters at fragment boundaries and corrupts the JSON.
+        const full = Buffer.concat(this.continuationChunks).toString('utf8');
+        this.continuationChunks = [];
         this.continuationOpen = false;
         let msg;
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@angelky7/dsh-browser-control",
   "description": "Local WebSocket bridge between dsh and the DSH Browser Control browser extension, with model-facing browser_* tools and a Settings-managed on/off switch",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -37,7 +37,7 @@
     "build": "tsc -p tsconfig.json && tsdown",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "check": "npm run typecheck && npm run build && publint",
-    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_cookies.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs && node verify/verify_nav_timeout.mjs && node verify/verify_nav_waituntil.mjs && node verify/verify_archive.mjs && node verify/verify_windows.mjs && node verify/verify_history_nav.mjs && node verify/verify_metrics_throttle.mjs && node verify/verify_drag.mjs && node verify/verify_audit.mjs && node verify/verify_journal.mjs && node verify/verify_sessions.mjs && node verify/verify_snapshot_page.mjs && node verify/verify_compat_matrix.mjs"
+    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_cookies.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_server_hardening.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs && node verify/verify_nav_timeout.mjs && node verify/verify_nav_waituntil.mjs && node verify/verify_archive.mjs && node verify/verify_windows.mjs && node verify/verify_history_nav.mjs && node verify/verify_metrics_throttle.mjs && node verify/verify_drag.mjs && node verify/verify_audit.mjs && node verify/verify_journal.mjs && node verify/verify_sessions.mjs && node verify/verify_snapshot_page.mjs && node verify/verify_compat_matrix.mjs"
   },
   "publishConfig": {
     "access": "public",