@broberg/lens-daemon 0.1.43 → 0.1.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/lens-daemon",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "The Lens module of the cardmem daemon (flows, critic, coverage, capture sessions, the /lens/* routes and the cardmem-lens MCP) as a package. The daemon mounts createLensRouter(deps) + createLensMcpRouter(deps). Bun runtime.",
   "type": "module",
   "license": "MIT",

package/src/browser.ts

@@ -360,6 +360,16 @@ export interface LoadedExtension {
 export const EXTENSION_CHANNEL = 'chromium';
 const EXTENSION_LAUNCH_TIMEOUT_MS = 30_000;
 const EXTENSION_LAUNCH_ATTEMPTS = 2;
+// Owner 25 Oct (jam, runs 2e72d502 + b64af4b1): a KEPT profile (cookies, cache,
+// history of a real login) took longer than 30 s to start on M1 at load ~175 and
+// the run failed, while a fresh temp profile started in 26 s. A slow start of a
+// kept profile is waited for; the bound stays, so a launch that truly hangs still
+// fails by name.
+const PROFILE_LAUNCH_TIMEOUT_MS = 90_000;
+/** Exported for test: the launch bound for a run, by whether it opens a kept profile. */
+export function launchTimeoutFor(profile: string | undefined): number {
+  return profile ? PROFILE_LAUNCH_TIMEOUT_MS : EXTENSION_LAUNCH_TIMEOUT_MS;
+}
 
 async function launchWithExtension(
   opts: WithPageOptions,
@@ -381,7 +391,7 @@ async function launchWithExtension(
         ...contextOptions(opts),
         headless: true,
         channel: EXTENSION_CHANNEL,
-        timeout: EXTENSION_LAUNCH_TIMEOUT_MS,
+        timeout: launchTimeoutFor(profile),
         args: [
           `--disable-extensions-except=${extPath}`,
           `--load-extension=${extPath}`,
@@ -396,7 +406,7 @@ async function launchWithExtension(
   }
   if (!context) {
     throw new Error(
-      `extension browser did not start (${EXTENSION_LAUNCH_ATTEMPTS} attempts × ${EXTENSION_LAUNCH_TIMEOUT_MS} ms): ${lastLaunchError}`,
+      `extension browser did not start (${EXTENSION_LAUNCH_ATTEMPTS} attempts × ${launchTimeoutFor(profile)} ms): ${lastLaunchError}`,
     );
   }
   // MV3 registers a service worker; MV2 a background page. Wait for whichever
@@ -468,7 +478,7 @@ async function launchRunBrowser(opts: WithPageOptions, b: RunBrowser): Promise<{
     const context = await trackChromeLaunch(b.channel, () => chromium.launchPersistentContext(userDataDir, {
       ...contextOptions({ ...opts, ...(userAgent ? { userAgent } : {}) }),
       ...runBrowserLaunchOptions(b),
-      timeout: EXTENSION_LAUNCH_TIMEOUT_MS,
+      timeout: launchTimeoutFor(b.profile),
     }));
     return { context, userDataDir };
   } catch (err) {

package/src/flow.ts

@@ -36,6 +36,7 @@ import { fillSecret } from './secret-fill.ts';
 import { storagePayload, type StorageSeed } from './seed-storage.ts';
 import { passwordInUrl, type FilledPassword, type PasswordInUrlFinding } from './password-in-url.ts';
 import { assertTestMailbox, cleanupMail, fillFromMail, httpMailSource, type MailFrom, type MailSource } from './mail-fill.ts';
+import { fillFromOwner, OWNER_KINDS, OWNER_WAIT_MAX_MS, type OwnerFrom, type OwnerKind } from './owner-fill.ts';
 import {
   EDIT_EVENTS,
   waitForListening,
@@ -54,7 +55,7 @@ export type ActivateMode = 'auto' | 'click' | 'enter';
  *  env var. The value is read at run time and never echoed. */
 export type SecretFrom = { path: string } | { env: string };
 /** F009.137 — or a code that arrives by mail (the test mailbox only). */
-export type ValueFrom = SecretFrom | { mail: MailFrom };
+export type ValueFrom = SecretFrom | { mail: MailFrom } | { owner: OwnerFrom };
 
 /** F009.123 — a drag by an offset, in css pixels from the source's centre. */
 export type DragOffset = { x: number; y: number };
@@ -879,7 +880,19 @@ function validateAndNormalizeSteps(steps: unknown[], depth = 0, inParallel = fal
       const hasValue = typeof (s as { value?: unknown }).value === 'string';
       const vf = (s as { valueFrom?: unknown }).valueFrom;
       if (hasValue && vf !== undefined) throw new Error('fill step takes value OR valueFrom, not both');
-      if (!hasValue && vf === undefined) throw new Error('fill step requires a string value or valueFrom {path} | {env} | {mail}');
+      if (!hasValue && vf === undefined) throw new Error('fill step requires a string value or valueFrom {path} | {env} | {mail} | {owner}');
+      // F010.6 — a value the owner types in ARS.
+      if (vf && typeof vf === 'object' && 'owner' in (vf as object)) {
+        const o = (vf as { owner?: unknown }).owner as Record<string, unknown> | null;
+        if (!o || typeof o !== 'object' || typeof o.question !== 'string' || !o.question.trim() || Object.keys(o).some((k) => !['question', 'kind', 'timeout'].includes(k))) {
+          throw new Error('fill valueFrom.owner must be {question: "<what the owner is asked>", kind?, timeout?}');
+        }
+        if (Object.keys(vf as object).length !== 1) throw new Error('fill valueFrom.owner cannot be combined with another source');
+        if (o.kind !== undefined && !OWNER_KINDS.includes(o.kind as OwnerKind)) throw new Error(`fill from owner: kind must be one of ${OWNER_KINDS.join(', ')}`);
+        if (o.timeout !== undefined && !(typeof o.timeout === 'number' && o.timeout > 0 && o.timeout <= OWNER_WAIT_MAX_MS)) {
+          throw new Error(`fill from owner: timeout must be 1..${OWNER_WAIT_MAX_MS} ms`);
+        }
+      } else
       // F009.137 — a code from mail: only the test mailbox, checked here at parse time.
       if (vf && typeof vf === 'object' && 'mail' in (vf as object)) {
         const m = (vf as { mail?: unknown }).mail as Record<string, unknown> | null;
@@ -1282,6 +1295,11 @@ function parseManuscriptStep(s: string): FlowStep {
       // F009.121 — "fill [pw] from file <path>" / "from env <NAME>": the secret
       // is read at run time, so the manuscript (and its label) never holds it.
       // F009.137 — "fill [code] from mail to <addr> [subject ~ <text>] [match /<re>/]".
+      // F010.6 — "fill [x] from owner "<question>"" (+ optional "as password|text").
+      const owner = s.match(/\]\s+from\s+owner\s+"([^"]+)"(?:\s+as\s+(code|password|text))?\s*$/i);
+      if (owner) {
+        return { type: 'fill', testid: testid(), valueFrom: { owner: { question: owner[1]!, ...(owner[2] ? { kind: owner[2].toLowerCase() as OwnerKind } : {}) } } };
+      }
       const mail = s.match(/\]\s+from\s+mail\s+to\s+(\S+)(.*)$/i);
       if (mail) {
         const rest = mail[2]!;
@@ -2144,6 +2162,10 @@ async function execStep(page: Page, step: FlowStep, base: string, vars: Record<s
       // F213.7 — fill proves its own write; a silent no-op or a prepended value
       // used to pass as success, which is the half of the fleet save-rule this
       // instrument could not perform.
+      if (step.valueFrom && 'owner' in step.valueFrom) {
+        await fillFromOwner(loc, step.valueFrom.owner, remaining);
+        return via ? { __via: via } : null;
+      }
       if (step.valueFrom && 'mail' in step.valueFrom) {
         if (!mailCtx) throw new Error('fill from mail: this run has no mail source');
         await fillFromMail(loc, step.valueFrom.mail, stepStart, mailCtx.source, mailCtx.consumed, remaining);

package/src/mcp.ts

@@ -405,7 +405,7 @@ export const TOOLS = [
   {
     name: 'lens_run_manuscript',
     description:
-      `Compile a human-readable markdown manuscript (fmc-automation style: "# flow: name", "base: <url>", then one "- <verb> …" per line) into a flow and run it E2E. VERBS (${MANUSCRIPT_VERBS.length}, this is the complete list): ${MANUSCRIPT_VERBS.join(' / ')}. Shapes: "- goto /x" · "- fill [testid] = value" · a PASSWORD without plaintext: "- fill [testid] from file <path>" (absolute, or relative to local_path) or "- fill [testid] from env <NAME>" (F009.121 — password inputs only; the value never appears in the run, the report or a screenshot) · "- click [testid]" · "- press Enter" (global) or "- press Enter [testid]" (on a focused element) · "- expectText [testid] ~ text" · "- drag [source] -> [target]" or "- drag [node] by 120,-40" (a canvas offset; both move in 10 mousemoves so React Flow / d3-drag nodes really move — "steps N" to change, F009.123) · "- upload [input-testid] = <fixture>" · an input with NO testid, also inside an open shadow root: "- uploadSelector <css> = <fixture>[, <fixture>]" (F009.136; fixtures repo-relative to local_path or data:) · a CODE FROM MAIL: "- fill [testid] from mail to jam@jams.party subject ~ Jam match /\\b\\d{6}\\b/" (F009.137 — waits ≤60 s for a mail received after the step started, read through mail-mcp; only the test mailbox webhouse.developer@gmail.com / jam@jams.party; the mail is deleted after the run, report carries mail {consumed, cleaned}; the code never appears in the report) · the BUILT SCREEN'S HTML after the click path: "- inspect html [testid]" (or "- inspect html" for the whole body) — the step detail is that outerHTML, for cardmem_check_mockup_fidelity's built_html (F009.138) · a WINDOW THE PAGE OPENS (window.open / target=_blank — an OAuth dialog like «Continue with Facebook/Google»): "- waitForPopup" takes it over (also one opened by the click just before), "- in opened: <step>" acts in it, "- waitForPopupClose" waits for it to close; steps without the prefix stay in the opener (F009.139) · "- assert: <js>" · "- screenshot label" · frame-aware "- fillSelector <css> = <value> @frame <iframe>" and "- clickSelector <css> @frame <iframe>" · "- waitForUrl <substring>". TWO BROWSERS AT ONCE (F009.122): prefix a step with "in <name>:" — "- in b: goto /" · "- in b: expectText [note] == Hej" — and it runs in its own browser (own cookies + storage), open alongside the default one for the rest of the run; steps without the prefix run in the default browser. Click modifiers: "- click [testid] via enter" (F255.1, for Angular/MDC buttons a mouse click does not activate) and "- click [testid] @ 50%,28%" (F255.4, aim at a point inside a canvas/3D surface). A field that already HOLDS a value may no longer render an input — a combobox typically swaps to its selected state, so "fill" times out there while "press ArrowDown" / "press Enter" still drive it (fd-sundhed, 2026-08-21). The authoring shortcut — write prose, not JSON.`,
+      `Compile a human-readable markdown manuscript (fmc-automation style: "# flow: name", "base: <url>", then one "- <verb> …" per line) into a flow and run it E2E. VERBS (${MANUSCRIPT_VERBS.length}, this is the complete list): ${MANUSCRIPT_VERBS.join(' / ')}. Shapes: "- goto /x" · "- fill [testid] = value" · a PASSWORD without plaintext: "- fill [testid] from file <path>" (absolute, or relative to local_path) or "- fill [testid] from env <NAME>" (F009.121 — password inputs only; the value never appears in the run, the report or a screenshot) · "- click [testid]" · "- press Enter" (global) or "- press Enter [testid]" (on a focused element) · "- expectText [testid] ~ text" · "- drag [source] -> [target]" or "- drag [node] by 120,-40" (a canvas offset; both move in 10 mousemoves so React Flow / d3-drag nodes really move — "steps N" to change, F009.123) · "- upload [input-testid] = <fixture>" · an input with NO testid, also inside an open shadow root: "- uploadSelector <css> = <fixture>[, <fixture>]" (F009.136; fixtures repo-relative to local_path or data:) · a CODE FROM MAIL: "- fill [testid] from mail to jam@jams.party subject ~ Jam match /\\b\\d{6}\\b/" (F009.137 — waits ≤60 s for a mail received after the step started, read through mail-mcp; only the test mailbox webhouse.developer@gmail.com / jam@jams.party; the mail is deleted after the run, report carries mail {consumed, cleaned}; the code never appears in the report) · a VALUE ONLY THE OWNER HAS (an npm/authenticator code, a password): "- fill [testid] from owner \"<question>\"" (add "as password" or "as text"; default code) — asked in ARS through buddy's «ars ask», the owner types it there and nowhere else; declined / expired fail the step by that word; the value never appears in the report (F010.6) · the BUILT SCREEN'S HTML after the click path: "- inspect html [testid]" (or "- inspect html" for the whole body) — the step detail is that outerHTML, for cardmem_check_mockup_fidelity's built_html (F009.138) · a WINDOW THE PAGE OPENS (window.open / target=_blank — an OAuth dialog like «Continue with Facebook/Google»): "- waitForPopup" takes it over (also one opened by the click just before), "- in opened: <step>" acts in it, "- waitForPopupClose" waits for it to close; steps without the prefix stay in the opener (F009.139) · "- assert: <js>" · "- screenshot label" · frame-aware "- fillSelector <css> = <value> @frame <iframe>" and "- clickSelector <css> @frame <iframe>" · "- waitForUrl <substring>". TWO BROWSERS AT ONCE (F009.122): prefix a step with "in <name>:" — "- in b: goto /" · "- in b: expectText [note] == Hej" — and it runs in its own browser (own cookies + storage), open alongside the default one for the rest of the run; steps without the prefix run in the default browser. Click modifiers: "- click [testid] via enter" (F255.1, for Angular/MDC buttons a mouse click does not activate) and "- click [testid] @ 50%,28%" (F255.4, aim at a point inside a canvas/3D surface). A field that already HOLDS a value may no longer render an input — a combobox typically swaps to its selected state, so "fill" times out there while "press ArrowDown" / "press Enter" still drive it (fd-sundhed, 2026-08-21). The authoring shortcut — write prose, not JSON.`,
     inputSchema: {
       type: 'object',
       required: ['project', 'manuscript'],

package/src/owner-fill.ts

@@ -0,0 +1,95 @@
+// F010.6 — fill a field with a value the OWNER types in ARS (Auth Relay Service):
+// an npm one-time code, an authenticator-app code, a password.
+//
+// Owner, 25 Oct 2026: «Jeg skal KUN taste noget ind i ars ikke andre steder», and
+// «ars ask skal bygges ind i buddy». So Lens asks through buddy's `ars ask`, which
+// fetches its own BID ticket, finds the owner's active edge and hands the answer
+// out once on stdout. Exit codes: 0 answer · 2 declined · 3 expired · 1 error.
+//
+// The value never reaches a report, a step detail, an error or a log: it goes from
+// the child's stdout into the field and nowhere else.
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import type { Locator } from 'playwright';
+import { fillAndVerify } from './fill.ts';
+
+export type OwnerKind = 'code' | 'password' | 'text';
+
+export interface OwnerFrom {
+  /** What the owner sees in ARS, e.g. «npm-kode til @broberg/local-guard». */
+  question: string;
+  /** How ARS renders the field. Default 'code'. */
+  kind?: OwnerKind;
+  /** How long to wait for the owner, ms. Default {@link OWNER_WAIT_MS}. */
+  timeout?: number;
+}
+
+export const OWNER_KINDS: readonly OwnerKind[] = ['code', 'password', 'text'];
+export const OWNER_WAIT_MS = 300_000;
+export const OWNER_WAIT_MAX_MS = 600_000; // ARS expires an ask after 10 min at most
+
+export type OwnerAnswer =
+  | { status: 'answered'; answer: string }
+  | { status: 'declined' }
+  | { status: 'expired' }
+  | { status: 'error'; reason: string };
+
+export type OwnerAsker = (q: { kind: OwnerKind; question: string; timeout: number }) => Promise<OwnerAnswer>;
+
+// One config value: buddy installs `ars` per edge and has been asked to give it
+// one fixed path (auth-relay #44192). launchd's PATH is NOT searched — it is narrow
+// and differs per edge.
+export function arsBinary(): string {
+  return process.env.LENS_ARS_BIN || join(homedir(), '.local', 'bin', 'ars');
+}
+
+const spawnAsker: OwnerAsker = ({ kind, question, timeout }) =>
+  new Promise((resolve) => {
+    const bin = arsBinary();
+    const child = spawn(bin, ['ask', '--kind', kind, '--question', question, '--requester', 'lens'], {
+      // The BID ticket names the asker from this, so the owner sees «session lens».
+      env: { ...process.env, BUDDY_SESSION_NAME: 'lens' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (b: Buffer) => { out += b.toString('utf8'); });
+    child.stderr.on('data', (b: Buffer) => { err += b.toString('utf8'); });
+    const timer = setTimeout(() => {
+      child.kill('SIGTERM');
+      resolve({ status: 'expired' });
+    }, timeout);
+    child.on('error', (e) => {
+      clearTimeout(timer);
+      resolve({ status: 'error', reason: `could not run ${bin}: ${e.message}` });
+    });
+    child.on('exit', (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve({ status: 'answered', answer: out.replace(/\r?\n$/, '') });
+      else if (code === 2) resolve({ status: 'declined' });
+      else if (code === 3) resolve({ status: 'expired' });
+      else resolve({ status: 'error', reason: (err.split('\n')[0] || `ars exited ${code}`).slice(0, 300) });
+    });
+  });
+
+let asker: OwnerAsker = spawnAsker;
+/** Test seam: replace how the owner is asked (null restores `ars ask`). */
+export function setOwnerAsker(fn: OwnerAsker | null): void {
+  asker = fn ?? spawnAsker;
+}
+
+/** Ask the owner through ARS and type the answer into the field. */
+export async function fillFromOwner(loc: Locator, of: OwnerFrom, fillTimeout: number): Promise<void> {
+  const kind = of.kind ?? 'code';
+  const res = await asker({ kind, question: of.question, timeout: of.timeout ?? OWNER_WAIT_MS });
+  if (res.status === 'declined') throw new Error(`fill from owner: declined — the owner said no to «${of.question}»`);
+  if (res.status === 'expired') throw new Error(`fill from owner: expired — no answer to «${of.question}» in time`);
+  if (res.status === 'error') throw new Error(`fill from owner: ARS failed — ${res.reason}`);
+  if (!res.answer) throw new Error('fill from owner: ARS answered with an empty value');
+  try {
+    await fillAndVerify(loc, res.answer, fillTimeout);
+  } catch {
+    throw new Error(`fill from owner did not land: expected a ${res.answer.length}-character ${kind} in the field (value withheld)`);
+  }
+}