@inetafrica/open-claudia 3.5.23 → 3.5.25

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 3.5.25
+
+The Browser app feels like a browser on the phone and on the web (Sumeet, 10 Oct 08:53 EAT on his phone: "it feels like a browser on my phone… like Google Chrome app", and 09:18: "the web and mobile still need to also feel native… don't forget the website"). A canary build for the Browser canary bot first; the fleet waits for his OK.
+
+- **The bot's tab takes the driver's screen.** With Chrome in its own container, a take (or a `fit` when the screen changes: a turned phone, a resized panel, a keyboard that opens) that carries the driver's screen (`viewport`: CSS size, pixel density, phone layout, touch) fits the bot's tab to it through `core/browser-drive.js`. A phone gets the page's phone layout, full screen and sharp; the web gets a desktop page at the panel's size. Handing back puts the tab back to its own size. The browser's identity (user agent) never changes, so sites signed into stay signed in after the hand back. `GET /api/browser/control` says `fit: true`.
+- **The driver's input goes straight to Chrome,** through the view's own DevTools session, in order. Touches keep their timing, so a swipe flings; typed text is inserted whole (`input_text`, at most 500 characters: accents, emoji, the keyboard's corrections); every point is scaled by the view's density, because Chrome reads input in the drawn picture's pixels. A bot without the view takes `input_text` as key presses.
+- **The page's text fields.** The view reads where the page's text fields are and what kind they are (never a value) and streams them as `fields` events, so the Browser page opens the phone's own keyboard of the right kind the moment a field is tapped.
+- **Pictures.** The view streams its own screencast at the driver's size (at most 1.6 million pixels, 30 a second). `/api/browser/stream` serves it while someone drives, up to 30 fps, and keeps the newest frame while a slow viewer drains instead of dropping it, so the last picture of a scroll always arrives.
+- **A hand back wakes the bot only when it waits for that person:** it sent them an Open Browser card (cards now record `openApp`), or one of its browser commands was refused while they drove (the tool guard marks it). Otherwise the hand back is only logged. On 9 Oct a test hand back set off a 28-minute tangent on the canary.
+- **Correction to 3.5.24:** in container mode, sessions are not pinned to tabs (Agent Space dropped `AGENT_BROWSER_PIN_TAB` in a98f239); a session uses the tab that is open.
+- **Tests:** `test-browser-drive.js` (new), `test-browser-control.js`, `test-web-browser-app.js`.
+
+## 3.5.24
+
+The Browser app's address bar, and Chrome in its own container (Sumeet, 9 Oct 21:27 EAT on his phone: "I can't change the url on the mobile app"). A canary build for the Browser canary bot first; the fleet waits for his OK.
+
+- **The driver can change the page.** `POST /api/browser/navigate` (open, back, forward, reload) for the person who has taken over, from Agent Space's address bar. Public internet addresses only (`core/browser-address.js`): http or https, no user name or password; no localhost, single-label, .local, .internal, .svc or .home.arpa name; no private, loopback, link-local, shared, benchmarking, multicast or reserved IP, typed in any form the URL parser reads or found in any of the name's DNS answers (3 s at most). It needs the driver's live lock and extends it, runs in order with the driver's input, gives the page 20 s, and logs origin and path only. Teach me records it as a step ("Go to …"). `GET /api/browser/control` says `navigate: true`.
+- **One way to run agent-browser on the bot's own sessions** (`core/agent-browser-cli.js`): Teach me's element lookup and the address bar run it with the agent's environment and only `--session`, `--json` and a command, so no launch setting can ride along. On a bot pod a session reached with other launch settings is relaunched and loses its page.
+- **The agent gets agent-browser's settings.** Every `AGENT_BROWSER_*` variable now reaches the agent process (provider credentials and control-plane tokens are still stripped after), so its own browser commands and the Browser app share one set of launch settings. On a pod the agent used to run agent-browser without the image's `AGENT_BROWSER_EXECUTABLE_PATH`.
+- **Container mode.** With Agent Space's browser container (`AGENT_BROWSER_CDP`, `AGENT_BROWSER_PIN_TAB`), Chrome runs in its own container without the bot's files or keys and every agent-browser call attaches to it, each session pinned to its own tab. One Chrome window paints only its front tab, so opening a viewer brings that session's tab forward (Chrome's `/json/activate`, loopback only). The prompt now says how this bot's Chrome really runs, and no longer claims agent-browser adds `--no-sandbox` by itself.
+- **Tests:** `test-browser-address.js` (new), `test-browser-control.js`, `test-browser-teach.js`, `test-web-browser-app.js`, `test-browser-view.js`, `test-kazee-bot-apps.js`, `test-provider-env-isolation.js`.
+
 ## 3.5.23
 
 Usage limits as one rule, /stop as a real cancel, the queue's ✕ and run-together, and background checks on Haiku 5.5 and Sonnet 5.5 (Sumeet, 9 Oct 15:56 EAT: "yeh release and upgrade all the bots, include rahil for the updates going forward"). 3.5.20 below, the Browser app, only ever went out as a canary build, so this is the first release that brings it to everyone. 3.5.21 and 3.5.22 were tagged with the same changes but never published: 3.5.21's build stopped on the new /stop and queue test, which needed the fake agent its neighbours run on (CI has no Claude or Codex installed), and 3.5.22's builds stopped on two timing checks that busy build machines pushed past their limits (the boot matrix's 30 s per boot, the /stop test's 3 s and 2.5 s windows); those checks now allow more time.

package/core/agent-browser-cli.js

@@ -0,0 +1,98 @@
+// The bot's own agent-browser CLI calls on a session its agent already has open: Teach me's element
+// lookup (core/browser-teach.js) and the Browser app's address bar (core/browser-control.js).
+//
+// agent-browser keeps one browser per session and remembers the settings it was launched with
+// (the executable, its launch args, the idle timeout). A command that arrives with other launch
+// settings restarts that browser, and the person's page is lost. So every call from here runs
+// with the environment the bot's own agent-browser commands get, and never with a launch flag
+// (--args, --idle-timeout, --executable-path, --headed, --cdp, ...): only what the CLI needs goes
+// along (PATH, HOME, TMPDIR, LANG, LC_ALL, USER and every AGENT_BROWSER_* variable), none of the
+// bot's tokens, and no XDG_RUNTIME_DIR (the agent's own commands run without it). The session is
+// found by its socket folder, the one it was listed from: AGENT_BROWSER_SOCKET_DIR. Without that
+// folder nothing runs, since agent-browser starts a new browser for a session it cannot find.
+
+const childProcess = require("child_process");
+const { SESSION_NAME } = require("./browser-view");
+
+const ENV_KEYS = new Set(["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "USER"]);
+const DEFAULT_TIMEOUT_MS = 20 * 1000;
+// After a kill the CLI's output can stay open (a child of its own holding it); the call settles
+// this long after its time is up all the same, so a session's queue never waits on it for good.
+const SETTLE_GRACE_MS = 2000;
+const MAX_BUFFER = 512 * 1024;
+// The only dash argument a command may carry: eval's -b (a base64 script follows).
+const COMMAND_FLAGS = new Set(["-b"]);
+
+function agentBrowserBin() {
+  return process.env.OC_AGENT_BROWSER_BIN || "agent-browser";
+}
+
+function agentBrowserEnv(session) {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (ENV_KEYS.has(key) || key.startsWith("AGENT_BROWSER_")) env[key] = value;
+  }
+  if (session && session.dir) env.AGENT_BROWSER_SOCKET_DIR = session.dir;
+  return env;
+}
+
+// ["--session", <name>, ("--json"), <command>, <its arguments>...]. The command's own arguments
+// (an address, a script) are never flags, so no launch setting can ride along; null when the
+// session name or the command is not one of these.
+function commandArgs(session, command, { json = false } = {}) {
+  const name = String((session && session.name) || "");
+  if (!SESSION_NAME.test(name) || name.startsWith("-")) return null;
+  if (!Array.isArray(command) || !command.length || !/^[a-z]+$/.test(String(command[0]))) return null;
+  for (const arg of command.slice(1)) {
+    if (typeof arg !== "string" || (arg.startsWith("-") && !COMMAND_FLAGS.has(arg))) return null;
+  }
+  return ["--session", name, ...(json ? ["--json"] : []), ...command];
+}
+
+// Run `agent-browser --session <name> [--json] <command...>` on that session:
+// { ok, stdout, timedOut }. Never rejects. A call past timeoutMs is killed (SIGKILL).
+function runAgentBrowser(session, command, { json = false, timeoutMs = DEFAULT_TIMEOUT_MS, maxBuffer = MAX_BUFFER, execFile = childProcess.execFile } = {}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let guard = null;
+    const done = (ok, stdout, timedOut) => {
+      if (settled) return;
+      settled = true;
+      if (guard) clearTimeout(guard);
+      resolve({ ok, stdout: ok ? String(stdout || "") : "", timedOut });
+    };
+    const args = commandArgs(session, command, { json });
+    if (!args || !session.dir) return done(false, "", false);
+    let child = null;
+    try {
+      child = execFile(agentBrowserBin(), args, {
+        env: agentBrowserEnv(session),
+        timeout: timeoutMs,
+        killSignal: "SIGKILL",
+        maxBuffer,
+        windowsHide: true,
+      }, (error, stdout) => {
+        if (!error) return done(true, stdout, false);
+        done(false, "", error.killed === true && error.code !== "ERR_CHILD_PROCESS_STDIO_MAXBUFFER");
+      });
+    } catch (_) {
+      return done(false, "", false);
+    }
+    if (child && typeof child.on === "function") child.on("error", () => { /* reported through the callback */ });
+    if (child && child.stdin) child.stdin.end();
+    if (settled) return;
+    guard = setTimeout(() => {
+      try { if (child && typeof child.kill === "function") child.kill("SIGKILL"); } catch (_) { /* already gone */ }
+      done(false, "", true);
+    }, timeoutMs + SETTLE_GRACE_MS);
+    if (guard.unref) guard.unref();
+  });
+}
+
+module.exports = {
+  DEFAULT_TIMEOUT_MS,
+  agentBrowserBin,
+  agentBrowserEnv,
+  commandArgs,
+  runAgentBrowser,
+};

package/core/browser-address.js

@@ -0,0 +1,171 @@
+// Where the Browser app's address bar may go (core/browser-control.js navigate): public internet
+// addresses only. The bot's browser runs inside the pod, next to the cluster's services and the
+// cloud's metadata endpoint, so a typed address must not reach what a person outside could not:
+//   - http or https, at most 2048 characters, no user name or password in it;
+//   - no localhost, no single-label name, nothing under .localhost, .local, .internal, .svc,
+//     .cluster.local or .home.arpa;
+//   - no private, loopback, link-local, shared, benchmarking, multicast or reserved IP: typed as
+//     one in any form the URL parser reads as an IP (decimal, octal or hex IPv4, IPv6, IPv4 inside
+//     IPv6), or found in ANY of the name's DNS answers (A and AAAA, 3 s at most).
+//
+// parseAddress(raw)            { url, lookupName } | { error: "bad-url" | "blocked-address" }
+//                              No network: lookupName is the name still to resolve, null for an IP.
+// resolveAddress(name)         { addresses } | { error: "blocked-address" | "unknown-host" }
+// checkAddress(raw)            both: { ok: true, url, addresses } | { ok: false, error }
+//
+// The browser resolves the name again when it loads the page; this check keeps a typed address
+// from reaching the inside, it does not follow redirects.
+
+const dns = require("dns");
+const net = require("net");
+
+const MAX_URL_LENGTH = 2048;
+const DNS_TIMEOUT_MS = 3000;
+
+function v4Bytes(text) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(String(text));
+  if (!m) return null;
+  const bytes = m.slice(1).map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : null;
+}
+
+function v4Number(bytes) {
+  return ((bytes[0] << 24) | (bytes[1] << 16) | (bytes[2] << 8) | bytes[3]) >>> 0;
+}
+
+const BLOCKED_V4 = [
+  ["0.0.0.0", 8], // "this network"
+  ["10.0.0.0", 8], // private
+  ["100.64.0.0", 10], // shared address space (carrier-grade NAT)
+  ["127.0.0.0", 8], // loopback
+  ["169.254.0.0", 16], // link-local, the cloud metadata endpoint
+  ["172.16.0.0", 12], // private
+  ["192.0.0.0", 24], // IETF protocol assignments
+  ["192.168.0.0", 16], // private
+  ["198.18.0.0", 15], // benchmarking
+  ["224.0.0.0", 4], // multicast
+  ["240.0.0.0", 4], // reserved
+  ["255.255.255.255", 32], // broadcast
+].map(([base, bits]) => ({ base: v4Number(v4Bytes(base)), mask: (0xffffffff << (32 - bits)) >>> 0 }));
+
+function v4Blocked(bytes) {
+  const n = v4Number(bytes);
+  return BLOCKED_V4.some(({ base, mask }) => ((n & mask) >>> 0) === base);
+}
+
+// The eight 16-bit words of an IPv6 address (brackets and a zone allowed), or null.
+function v6Words(text) {
+  let s = String(text).replace(/^\[(.*)\]$/, "$1").replace(/%.*$/, "");
+  if (!net.isIPv6(s)) return null;
+  const tail = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(s);
+  if (tail) {
+    const b = v4Bytes(tail[2]);
+    if (!b) return null;
+    s = `${tail[1]}${((b[0] << 8) | b[1]).toString(16)}:${((b[2] << 8) | b[3]).toString(16)}`;
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const words = [...head, ...Array(fill).fill("0"), ...rest].map((h) => (/^[0-9a-f]{1,4}$/i.test(h) ? parseInt(h, 16) : NaN));
+  return words.length === 8 && words.every(Number.isInteger) ? words : null;
+}
+
+function v6Blocked(words) {
+  const zero = (from, to) => words.slice(from, to).every((w) => w === 0);
+  if (zero(0, 8)) return true; // ::
+  if (zero(0, 7) && words[7] === 1) return true; // ::1
+  if ((words[0] & 0xfe00) === 0xfc00) return true; // fc00::/7, unique local
+  if ((words[0] & 0xffc0) === 0xfe80) return true; // fe80::/10, link-local
+  if ((words[0] & 0xff00) === 0xff00) return true; // ff00::/8, multicast
+  const v4 = [words[6] >> 8, words[6] & 0xff, words[7] >> 8, words[7] & 0xff];
+  if (zero(0, 5) && words[5] === 0xffff) return v4Blocked(v4); // ::ffff:a.b.c.d, IPv4-mapped
+  if (zero(0, 6)) return v4Blocked(v4); // ::a.b.c.d, IPv4-compatible
+  if (words[0] === 0x64 && words[1] === 0xff9b && zero(2, 6)) return v4Blocked(v4); // 64:ff9b::/96, NAT64
+  return false;
+}
+
+// Is this IP (as text) off limits? Anything that is not an IP is.
+function ipBlocked(ip) {
+  const text = String(ip == null ? "" : ip);
+  if (net.isIPv4(text)) return v4Blocked(v4Bytes(text));
+  const words = v6Words(text);
+  return words ? v6Blocked(words) : true;
+}
+
+// A name that never means the public internet (an IP is judged by ipBlocked instead).
+function blockedName(hostname) {
+  const host = String(hostname || "").toLowerCase().replace(/\.+$/, "");
+  if (!host.includes(".")) return true; // localhost, a bare name: a machine or a Service nearby
+  return /(^|\.)(localhost|local|internal|svc|home\.arpa)$/.test(host); // .local covers .cluster.local
+}
+
+function parseAddress(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_URL_LENGTH) return { error: "bad-url" };
+  let url;
+  try {
+    url = new URL(raw);
+  } catch (_) {
+    return { error: "bad-url" };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return { error: "bad-url" };
+  if (url.username || url.password || !url.hostname) return { error: "bad-url" };
+  const host = url.hostname; // the URL parser's own reading: IPv4 in dotted decimal, IPv6 in brackets
+  if (host.startsWith("[")) {
+    const words = v6Words(host);
+    if (!words) return { error: "bad-url" };
+    return v6Blocked(words) ? { error: "blocked-address" } : { url, lookupName: null };
+  }
+  if (net.isIPv4(host)) return v4Blocked(v4Bytes(host)) ? { error: "blocked-address" } : { url, lookupName: null };
+  if (blockedName(host)) return { error: "blocked-address" };
+  return { url, lookupName: host };
+}
+
+function defaultLookup(hostname, options) {
+  return dns.promises.lookup(hostname, options);
+}
+
+function withTimeout(promise, ms) {
+  let timer = null;
+  const late = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("timed out")), ms);
+  });
+  return Promise.race([promise, late]).finally(() => clearTimeout(timer));
+}
+
+// Every A and AAAA answer must be public; none at all (or no answer in time) is unknown.
+async function resolveAddress(hostname, { lookup = defaultLookup, timeoutMs = DNS_TIMEOUT_MS } = {}) {
+  let answers;
+  try {
+    answers = await withTimeout(Promise.resolve().then(() => lookup(hostname, { all: true })), timeoutMs);
+  } catch (_) {
+    return { error: "unknown-host" };
+  }
+  const addresses = (Array.isArray(answers) ? answers : [answers])
+    .filter((a) => a != null)
+    .map((a) => (typeof a === "object" ? a.address : a));
+  if (!addresses.length) return { error: "unknown-host" };
+  if (addresses.some((a) => typeof a !== "string" || ipBlocked(a))) return { error: "blocked-address" };
+  return { addresses };
+}
+
+async function checkAddress(raw, options = {}) {
+  const parsed = parseAddress(raw);
+  if (parsed.error) return { ok: false, error: parsed.error };
+  if (!parsed.lookupName) return { ok: true, url: parsed.url, addresses: [parsed.url.hostname.replace(/^\[(.*)\]$/, "$1")] };
+  const found = await resolveAddress(parsed.lookupName, options);
+  if (found.error) return { ok: false, error: found.error };
+  return { ok: true, url: parsed.url, addresses: found.addresses };
+}
+
+module.exports = {
+  DNS_TIMEOUT_MS,
+  MAX_URL_LENGTH,
+  blockedName,
+  checkAddress,
+  ipBlocked,
+  parseAddress,
+  resolveAddress,
+};