@effect-agent/platform-cloudflare 0.1.0-beta.52 → 0.1.0-beta.53

package/src/protected-browser/inspect-frame.ts

@@ -5,41 +5,66 @@ export const maxAttributeLength = 2048;
 export const inspectFrame = `(() => {
   const doc = document;
   const forms = [];
-  const elements = [...doc.querySelectorAll('input,select,button,a[href]')].slice(0, 65);
+  const isChoice = el => el instanceof HTMLInputElement && ['radio','checkbox'].includes(el.type);
+  const presented = el => {
+    if (el.closest('[hidden],[aria-hidden="true"],[inert]') ||
+      ['hidden','collapse'].includes(getComputedStyle(el).visibility)) return false;
+    for (let parent = el; parent; parent = parent.parentElement) {
+      if (getComputedStyle(parent).opacity === '0') return false;
+    }
+    return true;
+  };
+  const hasLayout = el => presented(el) &&
+    [...el.getClientRects()].some(rect => rect.width > 0 && rect.height > 0);
+  const available = el => el.type !== 'hidden' && !el.closest('[hidden],[aria-hidden="true"],[inert]') &&
+    (hasLayout(el) || (isChoice(el) && [...(el.labels ?? [])].some(hasLayout)));
+  const elements = [...doc.querySelectorAll('input,textarea,select,button,a[href]')].filter(available).slice(0, 65);
+  const labelText = el => {
+    const label = el.labels?.[0]?.cloneNode(true);
+    label?.querySelectorAll('input,textarea,select,script,style,noscript').forEach(child => child.remove());
+    return label?.textContent ?? el.getAttribute('aria-label');
+  };
   const describe = (el) => {
-    if (doc !== document || !el.isConnected || el.ownerDocument !== doc) return null;
+    if (doc !== document || !el.isConnected || el.ownerDocument !== doc || !available(el)) return null;
     const form = el.form ?? null;
     let formIndex = forms.indexOf(form);
     if (formIndex < 0) { formIndex = forms.length; forms.push(form); }
-    const action = form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
+    // Resolved href (including path/query/fragment and base-URL changes) is part of the fingerprint.
+    const action = el instanceof HTMLAnchorElement ? el.href : form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
     const method = form ? (el.hasAttribute('formmethod') ? el.formMethod : form.method) : '';
     const enctype = form?.enctype ?? '';
     const name = el.name ?? '';
     const completion = el.getAttribute('autocomplete') ?? '';
     const inputType = el.type ?? '';
+    const choiceValue = isChoice(el) ? el.value : '';
     // Reject before parsing, fingerprinting or CDP transfer. Truncation could hide a target change.
-    if ([action, method, enctype, name, completion, inputType].some(value => value.length > ${maxAttributeLength})) return null;
+    if ([action, method, enctype, name, completion, inputType, choiceValue].some(value => value.length > ${maxAttributeLength})) return null;
     const type = inputType.toLowerCase();
     const autocomplete = completion.trim().toLowerCase().split(/\\s+/).at(-1);
     const cardRoles = { 'cc-name':'card-name', 'cc-number':'card-number', 'cc-exp':'card-expiry',
       'cc-exp-month':'card-expiry-month', 'cc-exp-year':'card-expiry-year', 'cc-csc':'card-security-code' };
     let role = 'unsupported';
-    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement;
-    if (nativeField && form && !['submit','button'].includes(type) && !el.disabled && !el.readOnly && el.getClientRects().length > 0) {
-      if (el instanceof HTMLInputElement && type === 'password') role = 'password';
-      else if (['text','email','tel','number','month',''].includes(type) || el instanceof HTMLSelectElement) {
-        if (cardRoles[autocomplete]) role = cardRoles[autocomplete];
-        else if (autocomplete === 'username' || autocomplete === 'email') role = 'username';
+    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement || el instanceof HTMLTextAreaElement;
+    if (nativeField && !['submit','button'].includes(type) && !el.matches(':disabled') && !el.readOnly && !(el instanceof HTMLSelectElement && el.multiple)) {
+      if (isChoice(el)) role = type;
+      else if (type === 'password' || ['current-password','new-password','one-time-code'].includes(autocomplete)) {
+        if (type === 'password' && form) role = 'password';
+      } else if (['text','email','tel','number','month','search','url','date','time','week','datetime-local','textarea',''].includes(type) || el instanceof HTMLSelectElement) {
+        if (cardRoles[autocomplete]) { if (form) role = cardRoles[autocomplete]; }
+        else if (autocomplete === 'username' || autocomplete === 'email') { if (form) role = 'username'; }
         else if (['text','email'].includes(type) && form && form.querySelector('input[type="password"]')) role = 'username';
+        else if (el instanceof HTMLSelectElement) { if (!el.multiple) role = 'select'; }
+        else role = 'text';
       }
     } else if (el instanceof HTMLButtonElement || (el instanceof HTMLInputElement && ['submit','button'].includes(type))) {
-      if (!el.disabled) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
+      if (!el.matches(':disabled')) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
     } else if (el instanceof HTMLAnchorElement) role = 'link';
-    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type]);
-    return { role, formIndex, action, fingerprint,
-      label: (el.labels?.[0]?.textContent ?? el.getAttribute('aria-label') ?? el.textContent ?? '').slice(0,200) };
+    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type, choiceValue]);
+    return { role, formIndex, action, fingerprint, ...(isChoice(el) ? {checked: el.checked} : {}),
+      label: (labelText(el) ?? (nativeField ? '' : el.textContent) ?? '').slice(0,200) };
   };
-  const expose = ({role, formIndex, action, label}) => ({role, formIndex, action, label});
+  const expose = ({role, formIndex, action, label, checked}) =>
+    ({role, formIndex, action, label, ...(checked === undefined ? {} : {checked})});
   const original = elements.map(describe);
   const validate = (index) => {
     const current = describe(elements[index]);
@@ -51,14 +76,32 @@ export const inspectFrame = `(() => {
     doc, elements, original: original.map(current => current && expose(current)), validate,
     text: () => {
       if (doc !== document) return null;
-      const clone = doc.body?.cloneNode(true);
-      clone?.querySelectorAll('input,textarea,select,script,style,noscript,iframe,object,embed').forEach(el => el.remove());
-      return (clone?.textContent ?? '').slice(0,65536);
+      if (!doc.body) return '';
+      const walker = doc.createTreeWalker(doc.body, NodeFilter.SHOW_TEXT);
+      const range = doc.createRange();
+      let text = '';
+      for (let node = walker.nextNode(); node && text.length < 65536; node = walker.nextNode()) {
+        const parent = node.parentElement;
+        if (!parent || parent.closest('input,textarea,select,script,style,noscript,iframe,object,embed')) continue;
+        if (!presented(parent)) continue;
+        range.selectNodeContents(node);
+        if (![...range.getClientRects()].some(rect => rect.width > 0 && rect.height > 0)) continue;
+        text += (node.textContent ?? '').replace(/\\s+/g, ' ') + ' ';
+      }
+      return text.slice(0,65536);
     },
     fill: (index, role, value) => {
       const current = validate(index);
       if (!current || current.role !== role) return false;
       const el = elements[index];
+      if (role === 'select') {
+        const options = [...el.options].filter(option => !option.matches(':disabled'));
+        const values = options.filter(option => option.value === value);
+        const matches = values.length > 0 ? values : options.filter(option => option.textContent?.trim() === value);
+        if (matches.length !== 1) return 'unsupported';
+        value = matches[0].value;
+        if ([...el.options].filter(option => option.value === value).length !== 1) return 'unsupported';
+      }
       let prototype = Object.getPrototypeOf(el);
       let setter;
       while (prototype && !setter) { setter = Object.getOwnPropertyDescriptor(prototype,'value')?.set; prototype = Object.getPrototypeOf(prototype); }
@@ -73,7 +116,7 @@ export const inspectFrame = `(() => {
     },
     click: (index) => {
       const current = validate(index);
-      if (!current || !['button','submit','link'].includes(current.role)) return false;
+      if (!current || !['button','submit','link','radio','checkbox'].includes(current.role)) return false;
       if (current.role === 'submit' && elements[index].form && !elements[index].form.matches(':valid')) return 'needs-attention';
       elements[index].click();
       return true;

package/src/protected-browser/native.ts

@@ -30,6 +30,7 @@ const Description = Schema.Struct({
   formIndex: Schema.Natural,
   action: Schema.String.check(Schema.isMaxLength(maxAttributeLength)),
   label: Schema.String.check(Schema.isMaxLength(200)),
+  checked: Schema.optionalKey(Schema.Boolean),
 });
 
 const Descriptions = Schema.Array(Schema.NullOr(Description)).check(Schema.isMaxLength(65));
@@ -97,6 +98,7 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
   let closed = false;
   let violation = false;
   let documentRef: string | undefined;
+  let observationOrigins: ReadonlySet<string> | undefined;
   const frames = new Map<Frame, FrameState>();
   const controls = new Map<string, ControlState>();
 
@@ -144,13 +146,30 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
     clear();
   };
 
-  const context = Effect.gen(function* () {
-    yield* check;
+  const observationFrames = Effect.gen(function* () {
     const list = page.frames();
 
-    if (list.length > 16) return yield* transportError("unsupported");
+    if (list.length > 32) return yield* transportError("unsupported");
+
+    // Opaque/blank child documents have no observation channel or credential targets.
+    // The main document and every retained HTTPS child still require strict origin validation.
+    return yield* Effect.filter(list, (frame) =>
+      frame === page.mainFrame()
+        ? Effect.succeed(true)
+        : Effect.try({
+            try: () => frame.url() !== "" && new URL(frame.url()).protocol === "https:",
+            catch: () => transportError("provider"),
+          }),
+    );
+  });
+
+  const context = Effect.gen(function* () {
+    yield* check;
+    const list = yield* observationFrames;
     const topOrigin = yield* origin(page.url());
-    const frameOrigins = yield* Effect.forEach(list, (frame) => origin(frame.url()));
+    const frameOrigins = [...new Set(yield* Effect.forEach(list, (frame) => origin(frame.url())))];
+
+    if (frameOrigins.length > 16) return yield* transportError("unsupported");
 
     if (documentRef === undefined) documentRef = yield* uuid;
 
@@ -175,6 +194,8 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
 
     if (
       !state ||
+      (observationOrigins !== undefined &&
+        !observationOrigins.has(state.control.target.frameOrigin)) ||
       state.expires <= (yield* clock.currentTimeMillis) ||
       !(yield* isCurrent(state.frame))
     )
@@ -232,6 +253,22 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
   );
 
   return {
+    restrictObservation: Effect.fn("ProtectedNativeTransport.restrictObservation")(
+      function* (origins) {
+        yield* check;
+        observationOrigins =
+          origins === undefined
+            ? undefined
+            : new Set(yield* decode(Schema.Array(CredentialOrigin), origins));
+        // A later grant expansion must not revive previously excluded references.
+        for (const [ref, state] of controls)
+          if (
+            observationOrigins !== undefined &&
+            !observationOrigins.has(state.control.target.frameOrigin)
+          )
+            controls.delete(ref);
+      },
+    ),
     context,
     invalidate,
     close,
@@ -252,8 +289,13 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
       const discovered: Array<ProtectedBrowserControl> = [];
       let text = "";
       let truncated = false;
+      const frameOrigins = new Set<string>();
+
+      for (const frame of yield* observationFrames) {
+        const frameOrigin = yield* origin(frame.url());
 
-      for (const frame of page.frames()) {
+        if (observationOrigins !== undefined && !observationOrigins.has(frameOrigin)) continue;
+        frameOrigins.add(frameOrigin);
         if (typeof frame.isolatedRealm !== "function") return yield* transportError("unsupported");
         const handle = yield* remote(() => frame.isolatedRealm().evaluateHandle(inspectFrame));
 
@@ -300,6 +342,8 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
             ref: yield* uuid,
             role: desc.role,
             label: desc.label,
+            ...(desc.checked === undefined ? {} : { checked: desc.checked }),
+            ...(desc.role === "link" ? { url: desc.action } : {}),
             target: CredentialTarget.make({
               topOrigin: before.topOrigin,
               frameOrigin: yield* origin(frame.url()),
@@ -338,6 +382,7 @@ export const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.
 
       return yield* decode(ProtectedDiscovery, {
         ...before,
+        frameOrigins: [...frameOrigins],
         text,
         controls: discovered,
         truncated,

package/src/protected-browser/policy.ts

@@ -7,6 +7,7 @@ import {
   CredentialOffer,
   CredentialOfferMetadata,
   CredentialOrigin,
+  CredentialObservationDecision,
   type CredentialTarget,
   CredentialUseResult,
   ListCredentialOffers,
@@ -14,6 +15,7 @@ import {
   ProtectedBrowser,
   ProtectedBrowserClick,
   ProtectedBrowserError,
+  ProtectedBrowserFill,
   ProtectedBrowserNavigate,
   ProtectedBrowserObservation,
   ProtectedBrowserControl,
@@ -22,6 +24,7 @@ import {
   type CredentialKind,
   type CredentialUseAuthorization,
   type ProtectedBrowserHandle,
+  type ProtectedBrowserAction,
   type ProtectedCleanup,
   type ProtectedObservationState,
 } from "@effect-agent/sandbox/ProtectedBrowser";
@@ -51,6 +54,10 @@ export class ProtectedBrowserDispatch extends Context.Service<
 
 /** Decoded adapter boundary. SDK exceptions and page diagnostics never cross this port. */
 export interface ProtectedBrowserTransport {
+  /** Select observation/target origins; undefined restores all network-permitted HTTPS frames. */
+  readonly restrictObservation: (
+    origins: ReadonlyArray<typeof CredentialOrigin.Type> | undefined,
+  ) => Effect.Effect<void, ProtectedTransportError>;
   readonly context: Effect.Effect<typeof ProtectedPageContext.Type, ProtectedTransportError>;
   readonly discover: Effect.Effect<typeof ProtectedDiscovery.Type, ProtectedTransportError>;
   readonly target: (ref: string) => Effect.Effect<ProtectedBrowserControl, ProtectedTransportError>;
@@ -58,7 +65,7 @@ export interface ProtectedBrowserTransport {
   readonly click: (ref: string) => Effect.Effect<void, ProtectedTransportError>;
   readonly fill: (
     ref: string,
-    role: typeof CredentialFieldRole.Type,
+    role: typeof CredentialFieldRole.Type | "text" | "select",
     value: Redacted.Redacted<string>,
   ) => Effect.Effect<void, ProtectedTransportError, ProtectedBrowserDispatch>;
   /** Invalidates local references synchronously before bounded exact-session cleanup. */
@@ -133,7 +140,7 @@ const secretFor = (material: BrowserCredentialMaterial, role: typeof CredentialF
 
 /**
  * Fresh private passes only. Account administrators and Browser Rendering token holders are
- * trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext-fill API exists.
+ * trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
  * Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
  */
 export const browserRunProtectedLayer = () =>
@@ -240,24 +247,69 @@ export const browserRunProtectedLayer = () =>
 
         const permitObservation = Effect.gen(function* () {
           const context = yield* pageContext;
+          let origins: ReadonlyArray<typeof CredentialOrigin.Type> | undefined;
 
           if (exposures.length > 0) {
             observation = "protected";
+            const principal = yield* caller;
 
-            const decision = yield* access
-              .observation({ ...context, caller: yield* caller, exposures: [...exposures] })
+            const rawDecision = yield* access
+              .observation({ ...context, caller: principal, exposures: [...exposures] })
               .pipe(Effect.mapError((error) => fail(error.reason)));
 
-            if (decision !== "trust-recipient-no-credential-echo")
-              return yield* fail("observation-blocked");
+            if (Redacted.value(yield* caller) !== Redacted.value(principal))
+              return yield* fail("denied");
+
+            const decision = yield* Schema.decodeUnknownEffect(CredentialObservationDecision)(
+              rawDecision,
+            ).pipe(Effect.mapError(() => fail("observation-blocked")));
+
+            if (decision === "deny") return yield* fail("observation-blocked");
+            if (typeof decision !== "string") {
+              origins = [...decision.origins];
+              if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
+            }
             observation = "approved-after-exposure";
           }
+          yield* remote(driver.restrictObservation(origins));
 
-          return context;
+          return {
+            ...context,
+            frameOrigins: context.frameOrigins.filter(
+              (origin) => origins === undefined || origins.includes(origin),
+            ),
+          };
         });
 
         const target = (ref: string) => remote(driver.target(ref));
 
+        const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (
+          action: ProtectedBrowserAction,
+        ) {
+          if (access.authorizeAction === undefined) {
+            if (action._tag === "Submit") return yield* fail("unsupported");
+
+            return;
+          }
+          const principal = yield* caller;
+
+          yield* access
+            .authorizeAction({ caller: principal, action, exposures: [...exposures] })
+            .pipe(Effect.mapError((error) => fail(error.reason)));
+          if (Redacted.value(yield* caller) !== Redacted.value(principal))
+            return yield* fail("denied");
+          if (action._tag !== "Navigate") {
+            const current = yield* target(action.ref);
+
+            if (
+              !sameTarget(current.target, action.target) ||
+              current.role !== (action._tag === "Submit" ? "submit" : action.role) ||
+              (action._tag === "Click" && action.role === "link" && current.url !== action.url)
+            )
+              return yield* fail("stale-reference");
+          }
+        }, Effect.withTracerEnabled(false));
+
         const bounded = <A>(result: A) => {
           const bytes = new TextEncoder().encode(JSON.stringify(result)).byteLength;
 
@@ -366,6 +418,7 @@ export const browserRunProtectedLayer = () =>
                 )
                   return yield* fail("denied");
                 if (exposures.length > 0) yield* permitObservation;
+                yield* authorizeAction({ _tag: "Navigate", url: decoded.url });
                 offers.clear();
                 dispatch = "possibly-dispatched";
                 yield* remote(driver.navigate(decoded.url));
@@ -379,8 +432,14 @@ export const browserRunProtectedLayer = () =>
               const result = yield* remote(driver.discover);
               const after = yield* permitObservation;
 
-              if (before.document !== after.document || result.document !== after.document)
+              if (
+                before.document !== after.document ||
+                result.document !== after.document ||
+                result.topOrigin !== after.topOrigin
+              )
                 return yield* fail("stale-reference");
+              if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin)))
+                return yield* fail("observation-blocked");
 
               return yield* bounded(
                 ProtectedBrowserObservation.make({
@@ -400,12 +459,78 @@ export const browserRunProtectedLayer = () =>
                 yield* permitObservation;
                 const control = yield* target(decoded.ref);
 
-                // Credential submission goes through useCredential, never a generic click.
-                if (control.role !== "link" && control.role !== "button")
+                if (
+                  control.role !== "link" &&
+                  control.role !== "button" &&
+                  control.role !== "radio" &&
+                  control.role !== "checkbox" &&
+                  control.role !== "submit"
+                )
                   return yield* fail("unsupported");
+                let action: ProtectedBrowserAction;
+
+                if (control.role === "link") {
+                  if (control.url === undefined) return yield* fail("unsupported");
+                  action = {
+                    _tag: "Click",
+                    ref: decoded.ref,
+                    target: control.target,
+                    role: "link",
+                    url: control.url,
+                  };
+                } else if (control.role === "submit") {
+                  action = { _tag: "Submit", ref: decoded.ref, target: control.target };
+                } else {
+                  action = {
+                    _tag: "Click",
+                    ref: decoded.ref,
+                    target: control.target,
+                    role: control.role,
+                  };
+                }
+                yield* authorizeAction(action);
                 dispatch = "possibly-dispatched";
-                yield* remote(driver.click(decoded.ref));
+                yield* remote(driver.click(decoded.ref)).pipe(
+                  Effect.catch((error) => {
+                    if (error.reason === "needs-attention") dispatch = "not-dispatched";
+
+                    return Effect.fail(error);
+                  }),
+                );
+                dispatch = "dispatched";
+                if (control.role === "submit") milestone = "submission-dispatched";
+                yield* permitObservation;
+              }),
+            ),
+          fill: (request) =>
+            run(
+              Effect.gen(function* () {
+                const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserFill)(
+                  request,
+                ).pipe(Effect.mapError(() => fail("denied")));
+
+                yield* permitObservation;
+                const control = yield* target(decoded.ref);
+
+                if (control.role !== "text" && control.role !== "select")
+                  return yield* fail("unsupported");
+                yield* authorizeAction({
+                  _tag: "Fill",
+                  ref: decoded.ref,
+                  target: control.target,
+                  role: control.role,
+                });
+                yield* remote(
+                  driver.fill(decoded.ref, control.role, Redacted.make(decoded.value)),
+                ).pipe(
+                  Effect.provideService(ProtectedBrowserDispatch, {
+                    mark: Effect.sync(() => {
+                      dispatch = "possibly-dispatched";
+                    }),
+                  }),
+                );
                 dispatch = "dispatched";
+                milestone = "filled";
                 yield* permitObservation;
               }),
             ),
@@ -475,8 +600,6 @@ export const browserRunProtectedLayer = () =>
 
                 if (Redacted.value(principal) !== Redacted.value(offer.caller))
                   return yield* fail("denied");
-                if (offer.kind === "card" && decoded.submit !== undefined)
-                  return yield* fail("unsupported");
                 if (
                   new Set(decoded.fields.map((field) => field.ref)).size !==
                     decoded.fields.length ||
@@ -522,6 +645,8 @@ export const browserRunProtectedLayer = () =>
                   yield* access
                     .authorize(authorization)
                     .pipe(Effect.mapError((error) => fail(error.reason)));
+                  if (Redacted.value(yield* caller) !== Redacted.value(principal))
+                    return yield* fail("denied");
                 });
 
                 yield* authorize;