@farmslot/adapter-web 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to `@farmslot/adapter-web` are tracked here.
 
 - Active-development baseline; add user-facing changes here before release or package publication.
 
+## 0.6.2 - 2026-10-08
+
+- Fix: `launch-browser` no longer builds its `node -e` CDP request from the port, path or target id. They reach the child as argv, `cdpHttp` takes only an integer port from 1 to 65535 and the paths it uses (`/json/list`, `/json/version`, `/json/close/<id>`), and closing duplicate home tabs skips, with a warning, a target id from `/json/list` that is not a CDP id (letters, digits, `-`). Before, a hostile or substituted local CDP endpoint could run code in that child through a crafted target id. `cdpHttp` and `pruneExtraHomeTabs` are exported for tests. ([#859](https://github.com/deeeed/farmslot/pull/859))
+- Publish with adapter-sdk 0.7.1 and recipe-runner 0.27.0 so consumers share one adapter-sdk and one recipe-runner copy.
+
 ## 0.6.1 - 2026-10-08
 
 - `web-dapp` refuses a headful launch while the macOS login session is locked (`SESSION_LOCKED`, with the unlock step), before starting, reusing or stopping a browser, as mm-harness does since its #363 (0.6.0 shipped `web-dapp` without it). `macosSessionLocked()`, `parseSessionLocked()`, `SESSION_LOCKED_MESSAGE` and `SESSION_LOCKED_USER_ACTION` are exported.

package/dist/launch-browser.d.cts

@@ -116,3 +116,22 @@ export function homeTabsToClose(targets: unknown[], { extensionId, homePage, def
     id: string;
     url: string;
 }[];
+/**
+ * GET a CDP HTTP path on 127.0.0.1. Returns the body, or null when the port or
+ * path is not one the launcher uses, or the request fails.
+ * @param {number} port
+ * @param {string} pathname `/json/list`, `/json/version` or `/json/close/<target id>`
+ * @returns {string | null}
+ */
+export function cdpHttp(port: number, pathname: string): string | null;
+/**
+ * Close the extra `homePage` tabs and stray blank tabs the browser on `port` has.
+ * @param {number} port CDP port on 127.0.0.1.
+ * @param {string} extensionDir The unpacked extension, for its id.
+ * @param {{ homePage?: string, defaultTitle?: string }} options
+ * @returns {string[]} What could not be done, one line each; empty when all went well.
+ */
+export function pruneExtraHomeTabs(port: number, extensionDir: string, { homePage, defaultTitle }: {
+    homePage?: string;
+    defaultTitle?: string;
+}): string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farmslot/adapter-web",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Web platform adapter for Farmslot recipes: resolve and launch an isolated Chromium, own its CDP port, load unpacked extensions, and keep macOS focus.",
   "type": "commonjs",
   "exports": {

package/src/launch-browser.cjs

@@ -643,25 +643,39 @@ function extensionPageUrl(extensionDir, page) {
   return id ? `chrome-extension://${id}/${page}` : '';
 }
 
+// The CDP HTTP paths the launcher reads: the target list, the version, or one
+// target to close. CDP target ids are hex or UUIDs.
+const CDP_HTTP_PATH = /^\/json\/(?:list|version|close\/[A-Za-z0-9-]+)$/u;
+const CDP_TARGET_ID = /^[A-Za-z0-9-]+$/u;
+// A child node keeps cdpHttp synchronous. The port and path reach it as argv,
+// never as script source, so a path cannot change what it runs.
+const CDP_HTTP_SCRIPT = `
+const http = require('http');
+const [port, pathname] = process.argv.slice(1);
+http.get({ host: '127.0.0.1', port: Number(port), path: pathname }, (res) => {
+  let body = '';
+  res.on('data', (chunk) => { body += chunk; });
+  res.on('end', () => {
+    process.stdout.write(body);
+    process.exitCode = res.statusCode === 200 ? 0 : 1;
+  });
+}).on('error', () => process.exit(1));
+`;
+
+/**
+ * GET a CDP HTTP path on 127.0.0.1. Returns the body, or null when the port or
+ * path is not one the launcher uses, or the request fails.
+ * @param {number} port
+ * @param {string} pathname `/json/list`, `/json/version` or `/json/close/<target id>`
+ * @returns {string | null}
+ */
 function cdpHttp(port, pathname) {
-  const result = spawnSync(
-    process.execPath,
-    [
-      '-e',
-      `
-    const http = require('http');
-    http.get('http://127.0.0.1:${Number(port)}${pathname}', (res) => {
-      let body = '';
-      res.on('data', (chunk) => { body += chunk; });
-      res.on('end', () => {
-        process.stdout.write(body);
-        process.exitCode = res.statusCode === 200 ? 0 : 1;
-      });
-    }).on('error', () => process.exit(1));
-  `,
-    ],
-    { encoding: 'utf8', timeout: 4000 },
-  );
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  if (typeof pathname !== 'string' || !CDP_HTTP_PATH.test(pathname)) return null;
+  const result = spawnSync(process.execPath, ['-e', CDP_HTTP_SCRIPT, String(port), pathname], {
+    encoding: 'utf8',
+    timeout: 4000,
+  });
   if (result.status !== 0) return null;
   return result.stdout;
 }
@@ -710,6 +724,13 @@ function homeTabsToClose(targets, { extensionId, homePage, defaultTitle }) {
 // readiness converges home tabs again, so a pruning failure must not fail the
 // launch. Every failure is returned so the launch log says why a duplicate tab
 // survived instead of hiding it.
+/**
+ * Close the extra `homePage` tabs and stray blank tabs the browser on `port` has.
+ * @param {number} port CDP port on 127.0.0.1.
+ * @param {string} extensionDir The unpacked extension, for its id.
+ * @param {{ homePage?: string, defaultTitle?: string }} options
+ * @returns {string[]} What could not be done, one line each; empty when all went well.
+ */
 function pruneExtraHomeTabs(port, extensionDir, { homePage, defaultTitle }) {
   if (!homePage) return [];
   const extensionId = extensionIdFromExtensionDir(extensionDir);
@@ -725,10 +746,17 @@ function pruneExtraHomeTabs(port, extensionDir, { homePage, defaultTitle }) {
   if (!Array.isArray(targets)) return ['/json/list did not return a target list'];
   const problems = [];
   for (const target of homeTabsToClose(targets, { extensionId, homePage, defaultTitle })) {
-    if (cdpHttp(port, `/json/close/${target.id}`) === null)
+    // The id comes from the endpoint's own response: close only a CDP-shaped one.
+    if (!CDP_TARGET_ID.test(target.id)) {
+      problems.push(
+        `skipped target with an invalid id: ${JSON.stringify(target.id)} (${target.url})`,
+      );
+      continue;
+    }
+    if (cdpHttp(port, `/json/close/${encodeURIComponent(target.id)}`) === null)
       problems.push(`could not close ${target.url} (${target.id})`);
   }
   return problems;
 }
 
-module.exports = { launchBrowser, homeTabsToClose };
+module.exports = { launchBrowser, homeTabsToClose, cdpHttp, pruneExtraHomeTabs };