@broberg/lens-daemon 0.1.18 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/lens-daemon",
-  "version": "0.1.18",
+  "version": "0.1.22",
   "description": "The Lens module of the cardmem daemon (flows, critic, coverage, capture sessions, the /lens/* routes and the cardmem-lens MCP) as a package. The daemon mounts createLensRouter(deps) + createLensMcpRouter(deps). Bun runtime.",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,8 @@
     "sharp": "^0.33.5",
     "turndown": "^7.2.4",
     "zod": "^3.23.8",
-    "@broberg/lens-engine": "0.13.1",
-    "@broberg/lens-svg": "0.1.0"
+    "@broberg/lens-svg": "0.1.0",
+    "@broberg/lens-engine": "0.13.1"
   },
   "devDependencies": {
     "@happy-dom/global-registrator": "^20.10.6",

package/src/auth/index.ts

@@ -196,6 +196,26 @@ async function applyMintEndpoint(
   cfg: MintEndpointAuth,
   env: AuthEnv,
 ): Promise<void> {
+  const json = (await fetchMintJson(cfg, env, 'mintEndpoint auth')) as StorageStateShape;
+  if (!json.cookies?.length && !json.origins?.length) {
+    throw new Error(`mintEndpoint auth: ${cfg.url} returned a storageState with no cookies/origins`);
+  }
+  await applyStorageStateJson(context, json);
+}
+
+/** The narrow mint call shared by auth.mintEndpoint and F009.129's
+ *  extension.storage_local_mint: resolve the secret (secretPath wins over
+ *  secretEnv), POST/GET with `Authorization: Bearer`, require 2xx + JSON. Error
+ *  messages name the url and status only — never the secret, never the body. */
+export interface MintCall {
+  url: string;
+  method?: 'POST' | 'GET';
+  secretEnv?: string;
+  secretPath?: string;
+  body?: unknown;
+  headers?: Record<string, string>;
+}
+export async function fetchMintJson(cfg: MintCall, env: AuthEnv, label: string): Promise<unknown> {
   // Resolve the narrow mint secret — secretPath (gitignored file, no restart)
   // wins over secretEnv. The secret is NOT in the manifest/call, only its source.
   let secret: string | undefined;
@@ -204,18 +224,18 @@ async function applyMintEndpoint(
     // some other repo's secret, which would then be sent to the caller's url.
     // Callers resolve against their project root first (resolveAuthPaths).
     if (!isAbsolute(cfg.secretPath)) {
-      throw new Error(`mintEndpoint auth: secretPath must be absolute by the time it is read (got "${cfg.secretPath}") — register the project or pass an absolute path`);
+      throw new Error(`${label}: secretPath must be absolute by the time it is read (got "${cfg.secretPath}") — register the project or pass an absolute path`);
     }
     try {
       secret = readFileSync(cfg.secretPath, 'utf-8').trim();
     } catch (err) {
-      throw new Error(`mintEndpoint auth: could not read secretPath ${cfg.secretPath}: ${err instanceof Error ? err.message : err}`);
+      throw new Error(`${label}: could not read secretPath ${cfg.secretPath}: ${err instanceof Error ? err.message : err}`);
     }
   } else if (cfg.secretEnv) {
     secret = env[cfg.secretEnv];
-    if (!secret) throw new Error(`mintEndpoint auth: env ${cfg.secretEnv} is not set`);
+    if (!secret) throw new Error(`${label}: env ${cfg.secretEnv} is not set`);
   } else {
-    throw new Error('mintEndpoint auth: set auth.secretPath or auth.secretEnv');
+    throw new Error(`${label}: set secretPath or secretEnv`);
   }
 
   // Optional JSON body (POST only) — lets the endpoint mint a session for a
@@ -235,21 +255,16 @@ async function applyMintEndpoint(
       ...(sendBody ? { body: JSON.stringify(cfg.body) } : {}),
     });
   } catch (err) {
-    throw new Error(`mintEndpoint auth: request to ${cfg.url} failed: ${err instanceof Error ? err.message : err}`);
+    throw new Error(`${label}: request to ${cfg.url} failed: ${err instanceof Error ? err.message : err}`);
   }
   if (!res.ok) {
-    throw new Error(`mintEndpoint auth: ${cfg.url} returned ${res.status} ${res.statusText}`);
+    throw new Error(`${label}: ${cfg.url} returned ${res.status} ${res.statusText}`);
   }
-  let json: StorageStateShape;
   try {
-    json = (await res.json()) as StorageStateShape;
+    return await res.json();
   } catch (err) {
-    throw new Error(`mintEndpoint auth: ${cfg.url} did not return JSON storageState: ${err instanceof Error ? err.message : err}`);
+    throw new Error(`${label}: ${cfg.url} did not return JSON: ${err instanceof Error ? err.message : err}`);
   }
-  if (!json.cookies?.length && !json.origins?.length) {
-    throw new Error(`mintEndpoint auth: ${cfg.url} returned a storageState with no cookies/origins`);
-  }
-  await applyStorageStateJson(context, json);
 }
 
 async function applyCookieJwt(

package/src/browser.ts

@@ -320,23 +320,44 @@ export interface LoadedExtension {
  *  reason this can run on a headless host (and therefore on Cloud Lens) instead
  *  of needing a screen. */
 const EXTENSION_CHANNEL = 'chromium';
+const EXTENSION_LAUNCH_TIMEOUT_MS = 30_000;
+const EXTENSION_LAUNCH_ATTEMPTS = 2;
 
 async function launchWithExtension(
   opts: WithPageOptions,
   extPath: string,
 ): Promise<{ context: BrowserContext; extension: LoadedExtension; userDataDir: string }> {
-  const userDataDir = await mkdtemp(join(tmpdir(), 'lens-ext-'));
-  const context = await chromium.launchPersistentContext(userDataDir, {
-    ...contextOptions(opts),
-    headless: true,
-    channel: EXTENSION_CHANNEL,
-    args: [
-      `--disable-extensions-except=${extPath}`,
-      `--load-extension=${extPath}`,
-      '--disable-dev-shm-usage',
-      '--no-sandbox',
-    ],
-  });
+  // Bounded and retried once: Playwright's default launch timeout is 180 s, so a
+  // launch that stalls (seen on loaded Linux CI) used to hang the whole run past
+  // any test or caller deadline with no word on WHERE. Now it names the stage.
+  let userDataDir = '';
+  let context: BrowserContext | null = null;
+  let lastLaunchError = '';
+  for (let attempt = 1; attempt <= EXTENSION_LAUNCH_ATTEMPTS && !context; attempt++) {
+    userDataDir = await mkdtemp(join(tmpdir(), 'lens-ext-'));
+    try {
+      context = await chromium.launchPersistentContext(userDataDir, {
+        ...contextOptions(opts),
+        headless: true,
+        channel: EXTENSION_CHANNEL,
+        timeout: EXTENSION_LAUNCH_TIMEOUT_MS,
+        args: [
+          `--disable-extensions-except=${extPath}`,
+          `--load-extension=${extPath}`,
+          '--disable-dev-shm-usage',
+          '--no-sandbox',
+        ],
+      });
+    } catch (err) {
+      lastLaunchError = err instanceof Error ? err.message.split('\n')[0]! : String(err);
+      await rm(userDataDir, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+  if (!context) {
+    throw new Error(
+      `extension browser did not start (${EXTENSION_LAUNCH_ATTEMPTS} attempts × ${EXTENSION_LAUNCH_TIMEOUT_MS} ms): ${lastLaunchError}`,
+    );
+  }
   // MV3 registers a service worker; MV2 a background page. Wait for whichever
   // appears — the id lives in its URL host either way.
   let worker = context.serviceWorkers()[0];

package/src/flow.ts

@@ -25,7 +25,7 @@ import {
 } from '@broberg/lens-engine';
 import { withPage, type LensEngine } from './browser.ts';
 import { deadline, defaultPopupOf, prepareExtension, seedExtensionStorage, SIMULATED_ACCESS_NOTE } from './extension-flow.ts';
-import { authPrepare, type AuthConfig, type AuthEnv } from './auth/index.ts';
+import { authPrepare, fetchMintJson, type AuthConfig, type AuthEnv } from './auth/index.ts';
 import { takeShot, settleForShot } from './capture.ts';
 import { runCritic, topFindingMessage, type CriticMode, type CriticReport } from './critic.ts';
 import { waitForBuild, observeBuild } from './build-marker.ts';
@@ -194,6 +194,19 @@ export interface FlowExtension {
   /** F009.126 — written to the extension's chrome.storage.local before step 0, so a
    *  popup that keeps its login there starts signed in (OAuth cannot run headless). */
   storage_local?: Record<string, unknown>;
+  /** F009.129 — the daemon MINTS the value itself (Bearer secret from secretPath /
+   *  secretEnv) and writes the JSON answer to chrome.storage.local[key], so a real
+   *  token never passes through the calling agent. Wins over storage_local on the
+   *  same key. */
+  storage_local_mint?: StorageLocalMint;
+}
+export interface StorageLocalMint {
+  key: string;
+  url: string;
+  method?: 'POST' | 'GET';
+  secretPath?: string;
+  secretEnv?: string;
+  body?: Record<string, unknown>;
 }
 
 /**
@@ -391,7 +404,13 @@ export interface FlowResult {
   downloads?: FlowDownload[];
   /** F009.125 — the extension this run loaded: its id (read at load time), the
    *  build path the caller named, and whether host access was SIMULATED on a copy. */
-  extension?: { id: string; path: string; host_access: 'as-built' | 'simulated'; note?: string } | null;
+  extension?: {
+    id: string; path: string; host_access: 'as-built' | 'simulated'; note?: string;
+    /** F009.129 — the chrome.storage.local KEYS seeded before step 0 (names only, never
+     *  values), and which one Lens minted itself. A failed mint never gets here — it
+     *  ends the run before step 0 naming url + status. */
+    storage_local?: { keys: string[]; minted: string | null };
+  } | null;
   name: string;
   status: 'pass' | 'fail' | 'error';
   steps: FlowStepResult[];
@@ -496,8 +515,8 @@ export function parseFlow(input: unknown): Flow {
   if (f.extension !== undefined) {
     const e = f.extension as unknown as Record<string, unknown>;
     const keys = e && typeof e === 'object' && !Array.isArray(e) ? Object.keys(e) : null;
-    if (!keys || typeof e.path !== 'string' || !e.path || keys.some((k) => k !== 'path' && k !== 'grant_host_access' && k !== 'storage_local')) {
-      throw new Error('flow.extension must be {path: "<unpacked build dir>", grant_host_access?: boolean, storage_local?: {…}}');
+    if (!keys || typeof e.path !== 'string' || !e.path || keys.some((k) => !['path', 'grant_host_access', 'storage_local', 'storage_local_mint'].includes(k))) {
+      throw new Error('flow.extension must be {path: "<unpacked build dir>", grant_host_access?: boolean, storage_local?: {…}, storage_local_mint?: {…}}');
     }
     if (e.grant_host_access !== undefined && typeof e.grant_host_access !== 'boolean') {
       throw new Error('flow.extension.grant_host_access must be a boolean');
@@ -506,10 +525,12 @@ export function parseFlow(input: unknown): Flow {
     if (sl !== undefined && (sl === null || typeof sl !== 'object' || Array.isArray(sl))) {
       throw new Error('flow.extension.storage_local must be an object of {key: JSON value} — it is passed to chrome.storage.local.set as-is');
     }
+    const mint = e.storage_local_mint === undefined ? undefined : parseStorageLocalMint(e.storage_local_mint);
     extension = {
       path: e.path,
       ...(e.grant_host_access === true ? { grant_host_access: true } : {}),
       ...(sl !== undefined ? { storage_local: sl as Record<string, unknown> } : {}),
+      ...(mint ? { storage_local_mint: mint } : {}),
     };
   }
   validateAndNormalizeSteps(f.steps);
@@ -562,6 +583,30 @@ function redactQuery(u: string): string {
   return q === -1 ? u : `${u.slice(0, q)}?…`;
 }
 
+/** F009.129 — refused when malformed, the same way the rest of flow.extension is. */
+function parseStorageLocalMint(raw: unknown): StorageLocalMint {
+  const m = raw as Record<string, unknown>;
+  const shape = 'flow.extension.storage_local_mint must be {key, url, method?, secretPath | secretEnv, body?}';
+  if (!m || typeof m !== 'object' || Array.isArray(m)) throw new Error(shape);
+  const allowed = ['key', 'url', 'method', 'secretPath', 'secretEnv', 'body'];
+  const unknownKey = Object.keys(m).find((k) => !allowed.includes(k));
+  if (unknownKey) throw new Error(`${shape} — unknown key "${unknownKey}"`);
+  if (typeof m.key !== 'string' || !m.key) throw new Error(`${shape} — key is required`);
+  if (typeof m.url !== 'string' || !/^https?:\/\//.test(m.url)) throw new Error(`${shape} — url must be http(s)`);
+  if (m.method !== undefined && m.method !== 'POST' && m.method !== 'GET') throw new Error(`${shape} — method must be POST or GET`);
+  const hasPath = typeof m.secretPath === 'string' && m.secretPath !== '';
+  const hasEnv = typeof m.secretEnv === 'string' && m.secretEnv !== '';
+  if (hasPath === hasEnv) throw new Error(`${shape} — give exactly one of secretPath or secretEnv`);
+  if (m.body !== undefined && (m.body === null || typeof m.body !== 'object' || Array.isArray(m.body))) throw new Error(`${shape} — body must be an object`);
+  return {
+    key: m.key,
+    url: m.url,
+    ...(m.method ? { method: m.method as 'POST' | 'GET' } : {}),
+    ...(hasPath ? { secretPath: m.secretPath as string } : { secretEnv: m.secretEnv as string }),
+    ...(m.body ? { body: m.body as Record<string, unknown> } : {}),
+  };
+}
+
 function usesPopup(steps: FlowStep[]): boolean {
   return steps.some(
     (st) =>
@@ -3107,12 +3152,18 @@ export async function runFlow(flow: Flow, env: AuthEnv, opts: RunFlowOptions = {
         watchDownloads(context);
         if (ext && flow.extension && prepared) {
           extCtx = { context, id: ext.id, main: page, popup: null };
-          if (flow.extension.storage_local) await seedExtensionStorage(context, flow.extension.storage_local);
+          const mint = flow.extension.storage_local_mint;
+          const seed = {
+            ...(flow.extension.storage_local ?? {}),
+            ...(mint ? { [mint.key]: await fetchMintJson(mint, env, 'storage_local_mint') } : {}),
+          };
+          if (Object.keys(seed).length) await seedExtensionStorage(context, seed);
           extensionInfo = {
             id: ext.id,
             path: flow.extension.path,
             host_access: prepared.simulated ? 'simulated' : 'as-built',
             ...(prepared.simulated ? { note: SIMULATED_ACCESS_NOTE } : {}),
+            ...(Object.keys(seed).length ? { storage_local: { keys: Object.keys(seed), minted: mint?.key ?? null } } : {}),
           };
         }
         // F074.36 — measure the credential BEFORE driving, so a run that cannot

package/src/mcp.ts

@@ -369,6 +369,7 @@ export const TOOLS = [
                 path: { type: 'string' },
                 grant_host_access: { type: 'boolean' },
                 storage_local: { type: 'object', description: 'F009.126 — {key: JSON value} for chrome.storage.local, set before step 0.' },
+                storage_local_mint: { type: 'object', description: 'F009.129 — {key, url, method?, secretPath | secretEnv, body?}: the DAEMON calls the mint url (Bearer secret; secretPath relative to local_path, sandboxed) and writes the JSON answer to chrome.storage.local[key] before step 0, so a real token never passes through you. Wins over storage_local on the same key. Value and secret never appear in the report; it carries extension.storage_local {keys, minted} — key NAMES only — so you can see the login was seeded. Steps after openPopup still run on the page under test: add in:"popup" to drive the popup.' },
               },
             },
             steps: {

package/src/service.ts

@@ -943,6 +943,15 @@ export async function lensRunFlow(deps: LensDeps, input: RunFlowInput) {
     const abs = raw.startsWith('/') ? raw : input.local_path ? `${input.local_path.replace(/\/$/, '')}/${raw}` : null;
     if (!abs) throw new Error('flow.extension.path is relative — pass local_path, or give an absolute path');
     flow.extension = { ...flow.extension, path: resolveSandboxedPath(abs, deps.sandboxRoots) };
+    // F009.129 — the mint secret file follows auth.mintEndpoint's rule: relative to
+    // the project, and inside the sandbox, so a flow can never point the daemon at
+    // another repo's secret and send it to its own url.
+    const mint = flow.extension.storage_local_mint;
+    if (mint?.secretPath) {
+      const sp = mint.secretPath.startsWith('/') ? mint.secretPath : input.local_path ? `${input.local_path.replace(/\/$/, '')}/${mint.secretPath}` : null;
+      if (!sp) throw new Error('flow.extension.storage_local_mint.secretPath is relative — pass local_path, or give an absolute path');
+      flow.extension = { ...flow.extension, storage_local_mint: { ...mint, secretPath: resolveSandboxedPath(sp, deps.sandboxRoots) } };
+    }
   }
   // F082.6 — auth reaches flows: own auth (relative paths resolved) or inherit
   // the manifest's. Fixes the blocker where authed routes redirected to login.