@askjo/camofox-browser 1.3.1 → 1.4.1

package/lib/youtube.js

@@ -1,27 +1,94 @@
 /**
  * YouTube transcript extraction via yt-dlp.
  *
- * Isolated from server.js so child_process + execFile don't coexist
- * with app.post routes in the same file (triggers OpenClaw scanner).
+ * Kept in a separate module so transcript process logic stays isolated.
  */
 
-const { execFile } = require('child_process');
-const { mkdtemp, readFile, readdir, rm } = require('fs/promises');
-const { tmpdir } = require('os');
-const { join } = require('path');
+import childProcess from 'child_process';
+import { mkdtemp, readFile, readdir, rm } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+const runProgram = childProcess.execFile;
+
+const YT_DLP_CANDIDATES = ['yt-dlp', '/usr/local/bin/yt-dlp', '/usr/bin/yt-dlp'];
+const SAFE_ENV_KEYS = ['PATH', 'HOME', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR'];
+const LANG_RE = /^[a-z]{2,3}(?:-[a-zA-Z0-9]{2,8})?$/;
 
 // Detect yt-dlp binary at startup
 let ytDlpPath = null;
 
+function buildSafeEnv() {
+  const env = {};
+  for (const key of SAFE_ENV_KEYS) {
+    const value = process.env[key];
+    if (typeof value === 'string' && value.length > 0) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
+function normalizeYoutubeUrl(rawUrl) {
+  const url = String(rawUrl || '').trim();
+  if (!url) {
+    throw new Error('Missing video URL');
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error('Invalid video URL');
+  }
+
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    throw new Error('Unsupported URL scheme');
+  }
+
+  const host = parsed.hostname.toLowerCase();
+  const isYoutubeHost = host === 'youtube.com' || host.endsWith('.youtube.com');
+  const isShortHost = host === 'youtu.be';
+  if (!isYoutubeHost && !isShortHost) {
+    throw new Error('Only YouTube URLs are allowed');
+  }
+
+  return parsed.toString();
+}
+
+function normalizeLanguage(rawLang) {
+  const lang = String(rawLang || 'en').trim();
+  if (!LANG_RE.test(lang)) {
+    return 'en';
+  }
+  return lang;
+}
+
+async function runYtDlp(binary, args, timeoutMs) {
+  return await new Promise((resolve, reject) => {
+    runProgram(
+      binary,
+      args,
+      {
+        timeout: timeoutMs,
+        windowsHide: true,
+        env: buildSafeEnv(),
+        maxBuffer: 4 * 1024 * 1024,
+      },
+      (err, stdout = '', stderr = '') => {
+        if (err) {
+          return reject(new Error(`${err.message}\n${String(stderr).trim()}`.trim()));
+        }
+        resolve({ stdout: String(stdout), stderr: String(stderr) });
+      },
+    );
+  });
+}
+
 async function detectYtDlp(log) {
-  for (const candidate of ['yt-dlp', '/usr/local/bin/yt-dlp', '/usr/bin/yt-dlp']) {
+  for (const candidate of YT_DLP_CANDIDATES) {
     try {
-      await new Promise((resolve, reject) => {
-        execFile(candidate, ['--version'], { timeout: 5000 }, (err, stdout) => {
-          if (err) return reject(err);
-          resolve(stdout.trim());
-        });
-      });
+      await runYtDlp(candidate, ['--version'], 5000);
       ytDlpPath = candidate;
       log('info', 'yt-dlp found', { path: candidate });
       return;
@@ -35,38 +102,49 @@ function hasYtDlp() {
 }
 
 async function ytDlpTranscript(reqId, url, videoId, lang) {
+  if (!ytDlpPath) {
+    throw new Error('yt-dlp is not available');
+  }
+
+  const normalizedUrl = normalizeYoutubeUrl(url);
+  const normalizedLang = normalizeLanguage(lang);
   const tmpDir = await mkdtemp(join(tmpdir(), 'yt-'));
+
   try {
-    const title = await new Promise((resolve, reject) => {
-      execFile(ytDlpPath, [
-        '--skip-download', '--no-warnings', '--print', '%(title)s', url,
-      ], { timeout: 15000 }, (err, stdout) => {
-        if (err) return reject(new Error(`yt-dlp metadata failed: ${err.message}`));
-        resolve(stdout.trim().split('\n')[0] || '');
-      });
-    });
-
-    await new Promise((resolve, reject) => {
-      execFile(ytDlpPath, [
+    const titleResult = await runYtDlp(
+      ytDlpPath,
+      ['--skip-download', '--no-warnings', '--print', '%(title)s', normalizedUrl],
+      15000,
+    );
+    const title = titleResult.stdout.trim().split('\n')[0] || '';
+
+    await runYtDlp(
+      ytDlpPath,
+      [
         '--skip-download',
-        '--write-sub', '--write-auto-sub',
-        '--sub-lang', lang,
-        '--sub-format', 'json3',
-        '-o', join(tmpDir, '%(id)s'),
-        url,
-      ], { timeout: 30000 }, (err, stdout, stderr) => {
-        if (err) return reject(new Error(`yt-dlp subtitle download failed: ${err.message}\n${stderr}`));
-        resolve();
-      });
-    });
+        '--write-sub',
+        '--write-auto-sub',
+        '--sub-lang',
+        normalizedLang,
+        '--sub-format',
+        'json3',
+        '-o',
+        join(tmpDir, '%(id)s'),
+        normalizedUrl,
+      ],
+      30000,
+    );
 
     const files = await readdir(tmpDir);
-    const subFile = files.find(f => f.endsWith('.json3') || f.endsWith('.vtt') || f.endsWith('.srv3'));
+    const subFile = files.find((f) => f.endsWith('.json3') || f.endsWith('.vtt') || f.endsWith('.srv3'));
     if (!subFile) {
       return {
-        status: 'error', code: 404,
+        status: 'error',
+        code: 404,
         message: 'No captions available for this video',
-        video_url: url, video_id: videoId, title,
+        video_url: normalizedUrl,
+        video_id: videoId,
+        title,
       };
     }
 
@@ -83,18 +161,24 @@ async function ytDlpTranscript(reqId, url, videoId, lang) {
 
     if (!transcriptText || !transcriptText.trim()) {
       return {
-        status: 'error', code: 404,
+        status: 'error',
+        code: 404,
         message: 'Subtitle file found but content was empty',
-        video_url: url, video_id: videoId, title,
+        video_url: normalizedUrl,
+        video_id: videoId,
+        title,
       };
     }
 
     const langMatch = subFile.match(/\.([a-z]{2}(?:-[a-zA-Z]+)?)\.(?:json3|vtt|srv3)$/);
 
     return {
-      status: 'ok', transcript: transcriptText,
-      video_url: url, video_id: videoId, video_title: title,
-      language: langMatch?.[1] || lang,
+      status: 'ok',
+      transcript: transcriptText,
+      video_url: normalizedUrl,
+      video_id: videoId,
+      video_title: title,
+      language: langMatch?.[1] || normalizedLang,
       total_words: transcriptText.split(/\s+/).length,
     };
   } finally {
@@ -112,7 +196,10 @@ function parseJson3(content) {
     for (const event of events) {
       const segs = event.segs || [];
       if (!segs.length) continue;
-      const text = segs.map(s => s.utf8 || '').join('').trim();
+      const text = segs
+        .map((s) => s.utf8 || '')
+        .join('')
+        .trim();
       if (!text) continue;
       const tsMs = event.tStartMs || 0;
       const tsSec = Math.floor(tsMs / 1000);
@@ -132,15 +219,31 @@ function parseVtt(content) {
   let currentTimestamp = '';
   for (const line of lines) {
     const stripped = line.trim();
-    if (!stripped || stripped === 'WEBVTT' || stripped.startsWith('Kind:') || stripped.startsWith('Language:') || stripped.startsWith('NOTE')) continue;
+    if (
+      !stripped ||
+      stripped === 'WEBVTT' ||
+      stripped.startsWith('Kind:') ||
+      stripped.startsWith('Language:') ||
+      stripped.startsWith('NOTE')
+    )
+      continue;
     if (stripped.includes(' --> ')) {
       const parts = stripped.split(' --> ');
       if (parts[0]) currentTimestamp = formatVttTs(parts[0].trim());
       continue;
     }
-    const text = stripped.replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").trim();
-    if (text && currentTimestamp) { result.push(`[${currentTimestamp}] ${text}`); currentTimestamp = ''; }
-    else if (text) result.push(text);
+    const text = stripped
+      .replace(/<[^>]+>/g, '')
+      .replace(/&amp;/g, '&')
+      .replace(/&lt;/g, '<')
+      .replace(/&gt;/g, '>')
+      .replace(/&quot;/g, '"')
+      .replace(/&#39;/g, "'")
+      .trim();
+    if (text && currentTimestamp) {
+      result.push(`[${currentTimestamp}] ${text}`);
+      currentTimestamp = '';
+    } else if (text) result.push(text);
   }
   return result.join('\n');
 }
@@ -148,10 +251,16 @@ function parseVtt(content) {
 function parseXml(content) {
   const lines = [];
   const regex = /<text\s+start="([^"]*)"[^>]*>([\s\S]*?)<\/text>/g;
-  let match;
-  while ((match = regex.exec(content)) !== null) {
+  for (const match of content.matchAll(regex)) {
     const startSec = parseFloat(match[1]) || 0;
-    const text = match[2].replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").trim();
+    const text = match[2]
+      .replace(/<[^>]+>/g, '')
+      .replace(/&amp;/g, '&')
+      .replace(/&lt;/g, '<')
+      .replace(/&gt;/g, '>')
+      .replace(/&quot;/g, '"')
+      .replace(/&#39;/g, "'")
+      .trim();
     if (!text) continue;
     const mm = Math.floor(startSec / 60);
     const ss = Math.floor(startSec % 60);
@@ -174,4 +283,4 @@ function formatVttTs(ts) {
   return ts;
 }
 
-module.exports = { detectYtDlp, hasYtDlp, ytDlpTranscript, parseJson3, parseVtt, parseXml };
+export { detectYtDlp, hasYtDlp, ytDlpTranscript, parseJson3, parseVtt, parseXml };

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "camofox-browser",
   "name": "Camofox Browser",
   "description": "Anti-detection browser automation for AI agents using Camoufox (Firefox-based)",
-  "version": "1.0.12",
+  "version": "1.4.1",
   "configSchema": {
     "type": "object",
     "properties": {

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@askjo/camofox-browser",
-  "version": "1.3.1",
+  "version": "1.4.1",
   "description": "Headless browser automation server and OpenClaw plugin for AI agents - anti-detection, element refs, and session isolation",
+  "type": "module",
   "main": "server.js",
   "license": "MIT",
   "author": "Jo Inc <oss@askjo.ai>",
@@ -38,6 +39,7 @@
     "lib/",
     "plugin.ts",
     "openclaw.plugin.json",
+    "scripts/",
     "run.sh",
     "Dockerfile",
     "README.md",
@@ -50,10 +52,12 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "jest --runInBand --forceExit",
-    "test:e2e": "jest --runInBand --forceExit tests/e2e",
-    "test:live": "RUN_LIVE_TESTS=1 jest --runInBand --forceExit tests/live",
-    "test:debug": "DEBUG_SERVER=1 jest --runInBand --forceExit",
+    "test": "NODE_OPTIONS='--experimental-vm-modules' jest --runInBand --forceExit",
+    "test:e2e": "NODE_OPTIONS='--experimental-vm-modules' jest --runInBand --forceExit tests/e2e",
+    "test:live": "RUN_LIVE_TESTS=1 NODE_OPTIONS='--experimental-vm-modules' jest --runInBand --forceExit tests/live",
+    "test:debug": "DEBUG_SERVER=1 NODE_OPTIONS='--experimental-vm-modules' jest --runInBand --forceExit",
+    "version:sync": "node scripts/sync-version.js",
+    "version": "node scripts/sync-version.js && git add openclaw.plugin.json",
     "postinstall": "npx camoufox-js fetch || true"
   },
   "dependencies": {
@@ -62,6 +66,7 @@
     "playwright": "^1.50.0",
     "playwright-core": "^1.58.0",
     "playwright-extra": "^4.3.6",
+    "prom-client": "^15.1.3",
     "puppeteer-extra-plugin-stealth": "^2.11.2"
   },
   "devDependencies": {

package/plugin.ts

@@ -432,6 +432,29 @@ export default function register(api: PluginApi) {
     },
   }));
 
+  api.registerTool((ctx: ToolContext) => ({
+    name: "camofox_evaluate",
+    description:
+      "Execute JavaScript in a Camoufox tab's page context. Returns the result of the expression. Use for injecting scripts, reading page state, or calling web app APIs.",
+    parameters: {
+      type: "object",
+      properties: {
+        tabId: { type: "string", description: "Tab identifier" },
+        expression: { type: "string", description: "JavaScript expression to evaluate in the page context" },
+      },
+      required: ["tabId", "expression"],
+    },
+    async execute(_id, params) {
+      const { tabId, expression } = params as { tabId: string; expression: string };
+      const userId = ctx.agentId || fallbackUserId;
+      const result = await fetchApi(baseUrl, `/tabs/${tabId}/evaluate`, {
+        method: "POST",
+        body: JSON.stringify({ userId, expression }),
+      });
+      return toToolResult(result);
+    },
+  }));
+
   api.registerTool((ctx: ToolContext) => ({
     name: "camofox_list_tabs",
     description: "List all open Camoufox tabs for a user.",

package/scripts/sync-version.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * Sync openclaw.plugin.json version with package.json.
+ * Run via: npm run version:sync
+ * Auto-runs on npm version via the "version" lifecycle script.
+ */
+
+import { readFile, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, '..');
+
+const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+const pluginPath = join(root, 'openclaw.plugin.json');
+const plugin = JSON.parse(await readFile(pluginPath, 'utf8'));
+
+if (plugin.version !== pkg.version) {
+  plugin.version = pkg.version;
+  await writeFile(pluginPath, JSON.stringify(plugin, null, 2) + '\n');
+  console.log(`openclaw.plugin.json version synced to ${pkg.version}`);
+} else {
+  console.log(`openclaw.plugin.json already at ${pkg.version}`);
+}