@iola_adm/iola-cli 0.1.30 → 0.1.32

package/README.md

@@ -74,6 +74,8 @@ iola budget status
 iola subagents list
 iola trajectory last
 iola review config
+iola browser status
+iola gosuslugi status
 ```
 
 Локальная модель через Ollama:
@@ -100,6 +102,8 @@ iola version --check
 - [Локальные файлы](https://github.com/adm-iola/iola-cli/wiki/Локальные-файлы)
 - [Рабочая среда агента](https://github.com/adm-iola/iola-cli/wiki/Рабочая-среда-агента)
 - [Платформа агента](https://github.com/adm-iola/iola-cli/wiki/Платформа-агента)
+- [Браузерный агент](https://github.com/adm-iola/iola-cli/wiki/Браузерный-агент)
+- [Подключение Госуслуг](https://github.com/adm-iola/iola-cli/wiki/Подключение-Госуслуг)
 - [Расширения и локальные данные](https://github.com/adm-iola/iola-cli/wiki/Расширения-и-локальные-данные)
 - [Архивы и мастер настройки](https://github.com/adm-iola/iola-cli/wiki/Архивы-и-мастер-настройки)
 - [Daemon, RPC и cron](https://github.com/adm-iola/iola-cli/wiki/Daemon-RPC-и-cron)
@@ -116,6 +120,8 @@ iola version --check
 - skills, toolsets, permissions, memory, hooks и готовые agents;
 - subagents, skill bundles, layered settings, usage/budget accounting и trajectory export;
 - полноценный локальный MCP server по stdio/http: tools, resources и prompts;
+- браузерный runtime через Playwright: чтение страниц, скриншоты, PDF, клики, ввод и eval;
+- локальный OAuth/OIDC-каркас для подключения Госуслуг/ЕСИА через официальный redirect flow;
 - управляемые локальные файловые операции с режимами `locked`, `read-only`, `workspace-write`, `full-access`;
 - планы выполнения, traces, tasks, artifacts, snapshots и policy-профили;
 - экспорт отчетов в Excel/Word-совместимые файлы;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iola_adm/iola-cli",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "CLI и AI-агент для работы с открытыми данными городского округа Йошкар-Ола.",
   "license": "MIT",
   "homepage": "https://github.com/adm-iola/iola-cli#readme",

package/src/cli.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { createServer } from "node:http";
 import { appendFile, copyFile, cp, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
@@ -22,6 +23,8 @@ const DB_SCHEMA_VERSION = 8;
 const PROJECT_IOLA_DIR = path.join(process.cwd(), ".iola");
 const PROJECT_CONFIG_FILE = path.join(PROJECT_IOLA_DIR, "config.json");
 const LOCAL_CONFIG_FILE = path.join(PROJECT_IOLA_DIR, "local.json");
+const BROWSER_RUNTIME_DIR = path.join(CONFIG_DIR, "browser-runtime");
+const BROWSER_RUNTIME_PACKAGE = path.join(BROWSER_RUNTIME_DIR, "node_modules", "playwright", "package.json");
 const INDEXABLE_EXTENSIONS = /\.(md|txt|csv|json|html|docx|xlsx|pptx|pdf)$/i;
 const LOCAL_TOOLS = ["search_local", "get_card", "export_data", "run_report", "save_view"];
 const FILE_TOOLS = ["files_tree", "files_read", "files_search", "files_write", "files_patch"];
@@ -107,6 +110,18 @@ const DEFAULT_AI_CONFIG = {
     baseUrl: "https://apiiola.yasg.ru/api/v1",
     mcpBaseUrl: "https://apiiola.yasg.ru",
   },
+  gosuslugi: {
+    enabled: false,
+    authUrl: "",
+    tokenUrl: "",
+    userinfoUrl: "",
+    clientId: "",
+    clientSecret: "",
+    scope: "openid",
+    redirectHost: "127.0.0.1",
+    redirectPort: 18791,
+    redirectPath: "/gosuslugi/callback",
+  },
   ai: {
     activeProfile: "local",
     provider: "ollama",
@@ -260,6 +275,7 @@ const COMMANDS = new Map([
   ["fork", forkSession],
   ["features", handleFeatures],
   ["settings", handleSettings],
+  ["gosuslugi", handleGosuslugi],
   ["wiki", handleWiki],
   ["context", handleContext],
   ["skills", handleSkills],
@@ -271,6 +287,7 @@ const COMMANDS = new Map([
   ["index", handleIndex],
   ["reports", handleReports],
   ["plugins", handlePlugins],
+  ["browser", handleBrowser],
   ["workspace", handleWorkspace],
   ["tasks", handleTasks],
   ["artifacts", handleArtifacts],
@@ -385,6 +402,7 @@ Usage:
   iola fork SESSION_ID [TEXT]
   iola features list|enable|disable
   iola settings list|get|validate|doctor|init
+  iola gosuslugi configure|status|login|logout|userinfo
   iola wiki [open|links]
   iola context list|show|init
   iola skills list|show|paths|enable|disable|bundles|bundle|doctor
@@ -396,6 +414,7 @@ Usage:
   iola index folder|status|search
   iola reports list|run
   iola plugins list|install|run|remove
+  iola browser status|install|open|text|html|screenshot|pdf|click|type|eval
   iola workspace init|status|use|list
   iola tasks list|add|done|run
   iola artifacts list|show|open
@@ -680,6 +699,11 @@ async function handleAgentLine(line, state) {
     return false;
   }
 
+  if (command === "gosuslugi") {
+    await handleGosuslugi(args);
+    return false;
+  }
+
   if (command === "workspace") {
     await handleWorkspace(args);
     return false;
@@ -829,6 +853,7 @@ async function handleAgentLine(line, state) {
     resume: ["resume", args],
     fork: ["fork", args],
     features: ["features", args],
+    gosuslugi: ["gosuslugi", args],
     wiki: ["wiki", args],
     context: ["context", args],
     skills: ["skills", args],
@@ -887,6 +912,7 @@ function printAgentHelp() {
   /sessions
   /resume SESSION_ID
   /features list
+  /gosuslugi status
   /wiki
   /context list
   /skills list
@@ -1696,6 +1722,74 @@ async function handleSettings(args) {
   throw new Error("Команды settings: list, get [KEY], validate, doctor, init.");
 }
 
+async function handleGosuslugi(args) {
+  const [action = "status", ...rest] = args;
+  const options = parseOptions(rest);
+
+  if (action === "status") {
+    const config = await loadConfig();
+    const secrets = await loadSecrets();
+    const tokens = secrets.gosuslugi?.tokens || null;
+    printKeyValue({
+      enabled: config.gosuslugi?.enabled ? "yes" : "no",
+      configured: isGosuslugiConfigured(config) ? "yes" : "no",
+      clientId: config.gosuslugi?.clientId ? maskSecret(config.gosuslugi.clientId) : "-",
+      authUrl: config.gosuslugi?.authUrl || "-",
+      tokenUrl: config.gosuslugi?.tokenUrl || "-",
+      userinfoUrl: config.gosuslugi?.userinfoUrl || "-",
+      redirectUri: gosuslugiRedirectUri(config),
+      connected: tokens?.access_token ? "yes" : "no",
+      savedAt: secrets.gosuslugi?.savedAt || "-",
+      expiresAt: secrets.gosuslugi?.expiresAt || "-",
+    });
+    return;
+  }
+
+  if (action === "configure") {
+    const current = await loadConfig();
+    const next = {
+      ...(current.gosuslugi || {}),
+      enabled: true,
+      authUrl: options["auth-url"] || current.gosuslugi?.authUrl || "",
+      tokenUrl: options["token-url"] || current.gosuslugi?.tokenUrl || "",
+      userinfoUrl: options["userinfo-url"] || current.gosuslugi?.userinfoUrl || "",
+      clientId: options["client-id"] || current.gosuslugi?.clientId || "",
+      clientSecret: options["client-secret"] || current.gosuslugi?.clientSecret || "",
+      scope: options.scope || current.gosuslugi?.scope || "openid",
+      redirectHost: options["redirect-host"] || current.gosuslugi?.redirectHost || "127.0.0.1",
+      redirectPort: Number(options["redirect-port"] || current.gosuslugi?.redirectPort || 18791),
+      redirectPath: options["redirect-path"] || current.gosuslugi?.redirectPath || "/gosuslugi/callback",
+    };
+    await saveConfig({ gosuslugi: next });
+    console.log("Настройки подключения к Госуслугам сохранены.");
+    console.log(`Redirect URI: ${gosuslugiRedirectUri({ gosuslugi: next })}`);
+    return;
+  }
+
+  if (action === "login") {
+    const result = await gosuslugiLogin(options);
+    printKeyValue(result);
+    return;
+  }
+
+  if (action === "logout") {
+    const secrets = await loadSecrets();
+    delete secrets.gosuslugi;
+    await saveSecrets(secrets);
+    console.log("Локальное подключение Госуслуг удалено.");
+    return;
+  }
+
+  if (action === "userinfo" || action === "me") {
+    const result = await gosuslugiUserinfo(options);
+    if (options.json) printJson(result);
+    else printKeyValue(flattenObjectForPrint(result));
+    return;
+  }
+
+  throw new Error("Команды gosuslugi: configure, status, login, logout, userinfo.");
+}
+
 async function handleWiki(args) {
   const [action = "links"] = args;
   const base = "https://github.com/adm-iola/iola-cli/wiki";
@@ -1709,6 +1803,8 @@ async function handleWiki(args) {
     ["Локальные файлы", `${base}/Локальные-файлы`],
     ["Рабочая среда агента", `${base}/Рабочая-среда-агента`],
     ["Платформа агента", `${base}/Платформа-агента`],
+    ["Браузерный агент", `${base}/Браузерный-агент`],
+    ["Подключение Госуслуг", `${base}/Подключение-Госуслуг`],
     ["Расширения и локальные данные", `${base}/Расширения-и-локальные-данные`],
     ["Архивы и мастер настройки", `${base}/Архивы-и-мастер-настройки`],
     ["Daemon, RPC и cron", `${base}/Daemon-RPC-и-cron`],
@@ -2209,6 +2305,94 @@ async function handlePlugins(args) {
   throw new Error("Команды plugins: list, install NAME --command CMD, run NAME, remove NAME.");
 }
 
+async function handleBrowser(args) {
+  const [action = "status", target, ...rest] = args;
+  const options = parseOptions(rest);
+
+  if (action === "status") {
+    printKeyValue(await getBrowserStatus());
+    return;
+  }
+
+  if (action === "install") {
+    await installBrowserRuntime();
+    printKeyValue(await getBrowserStatus());
+    return;
+  }
+
+  if (action === "open") {
+    const url = target || options.url;
+    if (!url) throw new Error("Пример: iola browser open https://example.com");
+    if (options.system) {
+      await openUrl(url);
+      return;
+    }
+    await runBrowserAutomation("open", { url, headed: options.headless ? false : true, waitMs: Number(options.wait || 600000) });
+    return;
+  }
+
+  if (action === "text" || action === "html") {
+    const url = target || options.url;
+    if (!url) throw new Error(`Пример: iola browser ${action} https://example.com`);
+    const result = await runBrowserAutomation(action, browserParams(url, options));
+    if (options.output) {
+      await writeFile(options.output, result, "utf8");
+      console.log(`Файл сохранен: ${options.output}`);
+    } else {
+      console.log(result);
+    }
+    return;
+  }
+
+  if (action === "screenshot" || action === "pdf") {
+    const url = target || options.url;
+    if (!url) throw new Error(`Пример: iola browser ${action} https://example.com --output page.${action === "pdf" ? "pdf" : "png"}`);
+    const output = options.output || path.join(process.cwd(), action === "pdf" ? "browser-page.pdf" : "browser-page.png");
+    await runBrowserAutomation(action, { ...browserParams(url, options), output: path.resolve(output) });
+    saveArtifact(action === "pdf" ? "browser-pdf" : "browser-screenshot", url, path.resolve(output), { url });
+    console.log(`Файл сохранен: ${output}`);
+    return;
+  }
+
+  if (action === "click") {
+    const url = target || options.url;
+    if (!url || !options.selector) throw new Error('Пример: iola browser click https://example.com --selector "button" --output after.png');
+    const result = await runBrowserAutomation("click", { ...browserParams(url, options), selector: options.selector, output: options.output ? path.resolve(options.output) : "" });
+    if (result) console.log(result);
+    return;
+  }
+
+  if (action === "type") {
+    const url = target || options.url;
+    if (!url || !options.selector || options.text === undefined) throw new Error('Пример: iola browser type https://example.com --selector "#q" --text "школа 29"');
+    const result = await runBrowserAutomation("type", { ...browserParams(url, options), selector: options.selector, text: options.text, press: options.press || "", output: options.output ? path.resolve(options.output) : "" });
+    if (result) console.log(result);
+    return;
+  }
+
+  if (action === "eval") {
+    const url = target || options.url;
+    const script = options.script || rest.join(" ");
+    if (!url || !script) throw new Error('Пример: iola browser eval https://example.com --script "document.title"');
+    const result = await runBrowserAutomation("eval", { ...browserParams(url, options), script });
+    console.log(result);
+    return;
+  }
+
+  throw new Error("Команды browser: status, install, open URL, text URL, html URL, screenshot URL --output FILE, pdf URL --output FILE, click URL --selector SEL, type URL --selector SEL --text TEXT, eval URL --script JS.");
+}
+
+function browserParams(url, options = {}) {
+  return {
+    url,
+    headed: Boolean(options.headed),
+    timeout: Number(options.timeout || 30000),
+    waitMs: Number(options.wait || 0),
+    selector: options.selector || "",
+    viewport: options.viewport || "1366x768",
+  };
+}
+
 async function handleWorkspace(args) {
   const [action = "status", nameOrPath] = args;
   const config = await loadConfig();
@@ -2547,6 +2731,177 @@ async function openUrl(url) {
   await runCommand("xdg-open", [url], { inherit: false });
 }
 
+async function gosuslugiLogin(options = {}) {
+  const config = await loadConfig();
+  if (!isGosuslugiConfigured(config)) {
+    throw new Error("Подключение не настроено. Пример: iola gosuslugi configure --auth-url URL --token-url URL --client-id ID --scope openid");
+  }
+
+  const state = randomUrlSafe(24);
+  const codeVerifier = randomUrlSafe(64);
+  const codeChallenge = base64Url(createHash("sha256").update(codeVerifier).digest());
+  const redirectUri = gosuslugiRedirectUri(config);
+  const callback = waitForOAuthCallback(config.gosuslugi, state, Number(options.timeout || 180000));
+  const authUrl = new URL(config.gosuslugi.authUrl);
+  authUrl.searchParams.set("response_type", "code");
+  authUrl.searchParams.set("client_id", config.gosuslugi.clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("scope", config.gosuslugi.scope || "openid");
+  authUrl.searchParams.set("state", state);
+  authUrl.searchParams.set("code_challenge", codeChallenge);
+  authUrl.searchParams.set("code_challenge_method", "S256");
+
+  console.log("Открываю официальный экран входа Госуслуг/ЕСИА в браузере.");
+  console.log("После входа CLI примет callback на локальном адресе и сохранит токены только на этом компьютере.");
+  await openUrl(authUrl.toString());
+  const params = await callback;
+  if (params.error) throw new Error(`Госуслуги вернули ошибку: ${params.error} ${params.error_description || ""}`.trim());
+  if (!params.code) throw new Error("Authorization code не получен.");
+
+  const tokens = await exchangeGosuslugiCode(config, {
+    code: params.code,
+    codeVerifier,
+    redirectUri,
+  });
+  const secrets = await loadSecrets();
+  const now = new Date();
+  const expiresAt = tokens.expires_in ? new Date(now.getTime() + Number(tokens.expires_in) * 1000).toISOString() : "";
+  secrets.gosuslugi = {
+    savedAt: now.toISOString(),
+    expiresAt,
+    tokens,
+  };
+  await saveSecrets(secrets);
+  return {
+    connected: "yes",
+    savedAt: secrets.gosuslugi.savedAt,
+    expiresAt: expiresAt || "-",
+    tokenType: tokens.token_type || "-",
+    scope: tokens.scope || config.gosuslugi.scope || "-",
+  };
+}
+
+function waitForOAuthCallback(settings, expectedState, timeoutMs) {
+  const host = settings.redirectHost || "127.0.0.1";
+  const port = Number(settings.redirectPort || 18791);
+  const callbackPath = settings.redirectPath || "/gosuslugi/callback";
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close(() => {});
+      reject(new Error("Истекло время ожидания входа через Госуслуги."));
+    }, timeoutMs);
+    const server = createServer((req, res) => {
+      const url = new URL(req.url || "/", `http://${host}:${port}`);
+      if (url.pathname !== callbackPath) {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      const params = Object.fromEntries(url.searchParams.entries());
+      if (params.state !== expectedState) {
+        res.statusCode = 400;
+        res.end("Invalid state");
+        clearTimeout(timer);
+        server.close(() => {});
+        reject(new Error("OAuth state не совпал. Вход отменен."));
+        return;
+      }
+      res.setHeader("content-type", "text/html; charset=utf-8");
+      res.end("<!doctype html><meta charset=\"utf-8\"><title>iola</title><body>Вход выполнен. Можно закрыть это окно и вернуться в терминал.</body>");
+      clearTimeout(timer);
+      server.close(() => resolve(params));
+    });
+    server.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    server.listen(port, host);
+  });
+}
+
+async function exchangeGosuslugiCode(config, { code, codeVerifier, redirectUri }) {
+  const body = new URLSearchParams();
+  body.set("grant_type", "authorization_code");
+  body.set("code", code);
+  body.set("redirect_uri", redirectUri);
+  body.set("client_id", config.gosuslugi.clientId);
+  body.set("code_verifier", codeVerifier);
+  if (config.gosuslugi.clientSecret) body.set("client_secret", config.gosuslugi.clientSecret);
+
+  const response = await fetch(config.gosuslugi.tokenUrl, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body,
+  });
+  const text = await response.text();
+  let payload = {};
+  try {
+    payload = text ? JSON.parse(text) : {};
+  } catch {
+    payload = { raw: text };
+  }
+  if (!response.ok) {
+    throw new Error(`Token endpoint вернул ${response.status}: ${JSON.stringify(payload)}`);
+  }
+  return payload;
+}
+
+async function gosuslugiUserinfo() {
+  const config = await loadConfig();
+  const secrets = await loadSecrets();
+  const accessToken = secrets.gosuslugi?.tokens?.access_token;
+  if (!accessToken) throw new Error("Госуслуги не подключены. Запустите: iola gosuslugi login");
+  if (!config.gosuslugi?.userinfoUrl) throw new Error("userinfoUrl не настроен.");
+  const response = await fetch(config.gosuslugi.userinfoUrl, {
+    headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+  });
+  const text = await response.text();
+  let payload = {};
+  try {
+    payload = text ? JSON.parse(text) : {};
+  } catch {
+    payload = { raw: text };
+  }
+  if (!response.ok) throw new Error(`Userinfo endpoint вернул ${response.status}: ${JSON.stringify(payload)}`);
+  return payload;
+}
+
+function isGosuslugiConfigured(config) {
+  return Boolean(config.gosuslugi?.authUrl && config.gosuslugi?.tokenUrl && config.gosuslugi?.clientId);
+}
+
+function gosuslugiRedirectUri(config) {
+  const settings = config.gosuslugi || DEFAULT_AI_CONFIG.gosuslugi;
+  return `http://${settings.redirectHost || "127.0.0.1"}:${Number(settings.redirectPort || 18791)}${settings.redirectPath || "/gosuslugi/callback"}`;
+}
+
+function randomUrlSafe(bytes) {
+  return base64Url(randomBytes(bytes));
+}
+
+function base64Url(buffer) {
+  return Buffer.from(buffer).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+function maskSecret(value) {
+  const text = String(value || "");
+  if (text.length <= 8) return text ? "***" : "-";
+  return `${text.slice(0, 4)}...${text.slice(-4)}`;
+}
+
+function flattenObjectForPrint(value, prefix = "") {
+  const rows = {};
+  for (const [key, item] of Object.entries(value || {})) {
+    const name = prefix ? `${prefix}.${key}` : key;
+    if (item && typeof item === "object" && !Array.isArray(item)) {
+      Object.assign(rows, flattenObjectForPrint(item, name));
+    } else {
+      rows[name] = Array.isArray(item) ? item.join(", ") : item;
+    }
+  }
+  return rows;
+}
+
 async function handlePermissions(args) {
   const [action = "list", name] = args;
   const config = await loadConfig();
@@ -5903,12 +6258,12 @@ function parseOptions(args) {
 
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
-    if (arg === "--json" || arg === "--yes" || arg === "--silent" || arg === "--events" || arg === "--stream-json" || arg === "--stdio" || arg === "--no-history" || arg === "--summary" || arg === "--all" || arg === "--local" || arg === "--cache" || arg === "--tools" || arg === "--files" || arg === "--plan" || arg === "--trace" || arg === "--diff" || arg === "--stage" || arg === "--fts" || arg === "--bare" || arg === "--quiet" || arg === "--no-color" || arg === "--fail-on-empty" || arg === "--debug" || arg === "--fix" || arg === "--append") {
+    if (arg === "--json" || arg === "--yes" || arg === "--silent" || arg === "--events" || arg === "--stream-json" || arg === "--stdio" || arg === "--system" || arg === "--headed" || arg === "--headless" || arg === "--no-history" || arg === "--summary" || arg === "--all" || arg === "--local" || arg === "--cache" || arg === "--tools" || arg === "--files" || arg === "--plan" || arg === "--trace" || arg === "--diff" || arg === "--stage" || arg === "--fts" || arg === "--bare" || arg === "--quiet" || arg === "--no-color" || arg === "--fail-on-empty" || arg === "--debug" || arg === "--fix" || arg === "--append") {
       result[arg.slice(2)] = true;
     } else if (arg === "--check" || arg === "--upgrade-node") {
       result.check = true;
       result[arg.slice(2)] = true;
-    } else if (arg === "--limit" || arg === "--offset" || arg === "--search" || arg === "--replace" || arg === "--text" || arg === "--path" || arg === "--depth" || arg === "--max-bytes" || arg === "--query" || arg === "--where" || arg === "--columns" || arg === "--inn" || arg === "--model" || arg === "--provider" || arg === "--profile" || arg === "--name" || arg === "--source" || arg === "--command" || arg === "--prompt" || arg === "--description" || arg === "--base-url" || arg === "--sandbox" || arg === "--approval" || arg === "--cwd" || arg === "--codex-profile" || arg === "--format" || arg === "--output" || arg === "--schema" || arg === "--session" || arg === "--temperature" || arg === "--config" || arg === "--dataset" || arg === "--save" || arg === "--reasoning" || arg === "--agent" || arg === "--scope" || arg === "--debug-file") {
+    } else if (arg === "--limit" || arg === "--offset" || arg === "--search" || arg === "--replace" || arg === "--text" || arg === "--path" || arg === "--depth" || arg === "--max-bytes" || arg === "--query" || arg === "--where" || arg === "--columns" || arg === "--inn" || arg === "--model" || arg === "--provider" || arg === "--profile" || arg === "--name" || arg === "--source" || arg === "--command" || arg === "--prompt" || arg === "--description" || arg === "--base-url" || arg === "--sandbox" || arg === "--approval" || arg === "--cwd" || arg === "--codex-profile" || arg === "--format" || arg === "--output" || arg === "--schema" || arg === "--session" || arg === "--temperature" || arg === "--config" || arg === "--dataset" || arg === "--save" || arg === "--reasoning" || arg === "--agent" || arg === "--scope" || arg === "--selector" || arg === "--url" || arg === "--timeout" || arg === "--wait" || arg === "--viewport" || arg === "--press" || arg === "--script" || arg === "--auth-url" || arg === "--token-url" || arg === "--userinfo-url" || arg === "--client-id" || arg === "--client-secret" || arg === "--redirect-host" || arg === "--redirect-port" || arg === "--redirect-path" || arg === "--debug-file") {
       result[arg.slice(2)] = args[index + 1];
       index += 1;
     } else {
@@ -6285,6 +6640,105 @@ async function installCodexIfMissing() {
   await runCommand("npm", ["install", "-g", "@openai/codex"], { inherit: true });
 }
 
+async function getBrowserStatus() {
+  const installed = existsSync(BROWSER_RUNTIME_PACKAGE);
+  let playwright = "не установлен";
+  if (installed) {
+    try {
+      playwright = JSON.parse(await readFile(BROWSER_RUNTIME_PACKAGE, "utf8")).version || "installed";
+    } catch {
+      playwright = "installed";
+    }
+  }
+  return {
+    runtime: BROWSER_RUNTIME_DIR,
+    playwright,
+    installed: installed ? "yes" : "no",
+    install_command: "iola browser install",
+    chromium: installed ? "managed by Playwright" : "not installed",
+  };
+}
+
+async function installBrowserRuntime() {
+  await mkdir(BROWSER_RUNTIME_DIR, { recursive: true });
+  const packageFile = path.join(BROWSER_RUNTIME_DIR, "package.json");
+  if (!existsSync(packageFile)) {
+    await writeFile(packageFile, `${JSON.stringify({ private: true, type: "module", dependencies: {} }, null, 2)}\n`, "utf8");
+  }
+  console.log(`Устанавливаю Playwright runtime: ${BROWSER_RUNTIME_DIR}`);
+  await runPackageManager("npm", ["install", "playwright@latest"], { inherit: true, cwd: BROWSER_RUNTIME_DIR });
+  await runPackageManager("npx", ["playwright", "install", "chromium"], { inherit: true, cwd: BROWSER_RUNTIME_DIR });
+}
+
+function runPackageManager(command, args, options = {}) {
+  if (process.platform === "win32") {
+    return runCommand(process.env.ComSpec || "cmd.exe", ["/d", "/c", [command, ...args].join(" ")], options);
+  }
+  return runCommand(command, args, options);
+}
+
+async function ensureBrowserRuntime() {
+  if (existsSync(BROWSER_RUNTIME_PACKAGE)) return;
+  throw new Error("Browser runtime не установлен. Запустите: iola browser install");
+}
+
+async function runBrowserAutomation(action, params) {
+  await ensureBrowserRuntime();
+  const scriptFile = path.join(BROWSER_RUNTIME_DIR, `iola-browser-${Date.now()}-${Math.random().toString(16).slice(2)}.mjs`);
+  await writeFile(scriptFile, browserAutomationScript(action, params), "utf8");
+  try {
+    const { stdout } = await runCommand(process.execPath, [scriptFile], { cwd: BROWSER_RUNTIME_DIR });
+    return stdout.trim();
+  } finally {
+    await rm(scriptFile, { force: true }).catch(() => {});
+  }
+}
+
+function browserAutomationScript(action, params) {
+  return `
+import { chromium } from "playwright";
+const action = ${JSON.stringify(action)};
+const params = ${JSON.stringify(params)};
+const [width, height] = String(params.viewport || "1366x768").split("x").map(Number);
+const browser = await chromium.launch({ headless: !params.headed });
+const page = await browser.newPage({ viewport: { width: width || 1366, height: height || 768 } });
+page.setDefaultTimeout(params.timeout || 30000);
+try {
+  await page.goto(params.url, { waitUntil: "domcontentloaded", timeout: params.timeout || 30000 });
+  if (params.waitMs) await page.waitForTimeout(params.waitMs);
+  if (action === "open") {
+    if (params.waitMs > 0) await page.waitForTimeout(params.waitMs);
+    else if (!page.context().browser()?.isConnected()) {}
+  } else if (action === "text") {
+    console.log((await page.locator("body").innerText()).trim());
+  } else if (action === "html") {
+    console.log(await page.content());
+  } else if (action === "screenshot") {
+    await page.screenshot({ path: params.output, fullPage: true });
+  } else if (action === "pdf") {
+    await page.pdf({ path: params.output, format: "A4", printBackground: true });
+  } else if (action === "click") {
+    await page.locator(params.selector).first().click();
+    if (params.waitMs) await page.waitForTimeout(params.waitMs);
+    if (params.output) await page.screenshot({ path: params.output, fullPage: true });
+    console.log((await page.locator("body").innerText()).trim().slice(0, 4000));
+  } else if (action === "type") {
+    const locator = page.locator(params.selector).first();
+    await locator.fill(params.text || "");
+    if (params.press) await locator.press(params.press);
+    if (params.waitMs) await page.waitForTimeout(params.waitMs);
+    if (params.output) await page.screenshot({ path: params.output, fullPage: true });
+    console.log((await page.locator("body").innerText()).trim().slice(0, 4000));
+  } else if (action === "eval") {
+    const value = await page.evaluate(new Function("return (" + params.script + ")"));
+    console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
+  }
+} finally {
+  await browser.close();
+}
+`;
+}
+
 async function probeEndpoint(url) {
   try {
     const response = await fetch(url, { headers: { accept: "application/json" } });
@@ -6468,6 +6922,8 @@ function mcpTools() {
     { name: "files.search", description: "Поиск текста в файлах workspace.", inputSchema: schema({ query: { type: "string" }, path: { type: "string" }, limit: { type: "number" } }) },
     { name: "index.search", description: "Поиск по индексу локальных документов.", inputSchema: schema({ query: { type: "string" }, limit: { type: "number" } }) },
     { name: "report", description: "Запуск встроенного отчета.", inputSchema: schema({ name: { type: "string" }, format: { type: "string" }, output: { type: "string" } }) },
+    { name: "browser.text", description: "Открыть страницу в headless Chromium и вернуть видимый текст.", inputSchema: schema({ url: { type: "string" }, waitMs: { type: "number" } }) },
+    { name: "browser.screenshot", description: "Сделать скриншот страницы через Chromium.", inputSchema: schema({ url: { type: "string" }, output: { type: "string" }, waitMs: { type: "number" } }) },
   ];
 }
 
@@ -6497,6 +6953,14 @@ async function callMcpTool(name, args = {}) {
     await handleExport([args.name || "education-contacts", "--format", args.format || "xlsx", "--output", output]);
     return { output };
   }
+  if (name === "browser.text") {
+    return runBrowserAutomation("text", { url: args.url, waitMs: Number(args.waitMs || 0), timeout: Number(args.timeout || 30000), viewport: args.viewport || "1366x768" });
+  }
+  if (name === "browser.screenshot") {
+    const output = path.resolve(args.output || "browser-page.png");
+    await runBrowserAutomation("screenshot", { url: args.url, output, waitMs: Number(args.waitMs || 0), timeout: Number(args.timeout || 30000), viewport: args.viewport || "1366x768" });
+    return { output };
+  }
   return executeRpc(name, { ...args, _: [] });
 }
 
@@ -7567,6 +8031,10 @@ function mergeConfig(base, override) {
       ...base.api,
       ...(override.api || {}),
     },
+    gosuslugi: {
+      ...base.gosuslugi,
+      ...(override.gosuslugi || {}),
+    },
     ai: {
       ...base.ai,
       ...(override.ai || {}),
@@ -7641,6 +8109,9 @@ function validateConfig(config) {
   for (const toolset of config.toolsets?.enabled || []) {
     if (!TOOLSETS[toolset]) errors.push(`toolsets.enabled содержит неизвестный toolset: ${toolset}`);
   }
+  if (config.gosuslugi?.enabled && !isGosuslugiConfigured(config)) {
+    errors.push("gosuslugi включен, но authUrl/tokenUrl/clientId не заполнены");
+  }
   return errors;
 }
 
@@ -7650,6 +8121,7 @@ function configSchema() {
     required: ["api", "ai"],
     properties: {
       api: { required: ["baseUrl", "mcpBaseUrl"] },
+      gosuslugi: { requiredWhenEnabled: ["authUrl", "tokenUrl", "clientId"], optional: ["userinfoUrl", "clientSecret", "scope", "redirectHost", "redirectPort", "redirectPath"] },
       ai: { required: ["activeProfile", "profiles"], providers: ["ollama", "openai", "openrouter", "codex"] },
       permissions: { localTools: ALL_LOCAL_TOOLS, runtime: ["readFiles", "writeFiles", "editFiles", "deleteFiles", "sync", "externalApi", "externalAi", "codex"] },
       toolsets: { available: Object.keys(TOOLSETS) },

package/wiki/Home.md

@@ -32,6 +32,8 @@ iola ask "найди школу 29"
 - [Локальные файлы](Локальные-файлы)
 - [Рабочая среда агента](Рабочая-среда-агента)
 - [Платформа агента](Платформа-агента)
+- [Браузерный агент](Браузерный-агент)
+- [Подключение Госуслуг](Подключение-Госуслуг)
 - [Расширения и локальные данные](Расширения-и-локальные-данные)
 - [Архивы и мастер настройки](Архивы-и-мастер-настройки)
 - [Daemon, RPC и cron](Daemon-RPC-и-cron)

package/wiki//320/221/321/200/320/260/321/203/320/267/320/265/321/200/320/275/321/213/320/271-/320/260/320/263/320/265/320/275/321/202.md

@@ -0,0 +1,68 @@
+# Браузерный агент
+
+`iola-cli` умеет подключать локальный браузерный runtime на Playwright. Сам npm-пакет остается легким: Chromium и Playwright ставятся отдельно при первом включении браузера.
+
+## Установка
+
+```bash
+iola browser status
+iola browser install
+```
+
+Runtime хранится в `~/.iola/browser-runtime`.
+
+## Базовые команды
+
+```bash
+iola browser open https://example.com
+iola browser text https://example.com
+iola browser html https://example.com --output page.html
+iola browser screenshot https://example.com --output page.png
+iola browser pdf https://example.com --output page.pdf
+```
+
+`open` запускает видимый Chromium и держит его открытым. По умолчанию окно живет 10 минут. Можно задать время:
+
+```bash
+iola browser open https://example.com --wait 30000
+```
+
+## Действия на странице
+
+Клик:
+
+```bash
+iola browser click https://example.com --selector "button" --output after-click.png
+```
+
+Ввод:
+
+```bash
+iola browser type https://example.com --selector "#q" --text "школа 29" --press Enter --wait 2000 --output search.png
+```
+
+Выполнение JavaScript-выражения:
+
+```bash
+iola browser eval https://example.com --script "document.title"
+```
+
+## MCP
+
+Локальный MCP server также отдает браузерные tools:
+
+- `browser.text`;
+- `browser.screenshot`.
+
+Перед использованием этих tools нужно один раз выполнить:
+
+```bash
+iola browser install
+```
+
+## Режимы
+
+- Для чтения страниц используйте `text`, `html`, `screenshot`, `pdf`.
+- Для действий используйте `click` и `type`.
+- Для ручной авторизации или просмотра используйте `open`.
+

package/wiki//320/232/320/276/320/274/320/260/320/275/320/264/321/213.md

@@ -74,6 +74,10 @@ iola import file data.csv --dataset custom
 iola index folder ./docs
 iola reports list
 iola plugins list
+iola browser status
+iola browser install
+iola browser text https://example.com
+iola browser screenshot https://example.com --output page.png
 iola mcp serve
 iola mcp serve --stdio
 iola memory suggest
@@ -88,6 +92,10 @@ iola context init
 iola context list
 iola settings list
 iola settings validate
+iola gosuslugi status
+iola gosuslugi configure --auth-url URL --token-url URL --client-id ID --scope openid
+iola gosuslugi login
+iola gosuslugi userinfo --json
 iola cron add "каждый день 09:00 -- quality"
 iola cron tick
 iola daemon status

package/wiki//320/237/320/276/320/264/320/272/320/273/321/216/321/207/320/265/320/275/320/270/320/265-/320/223/320/276/321/201/321/203/321/201/320/273/321/203/320/263.md

@@ -0,0 +1,73 @@
+# Подключение Госуслуг
+
+`iola-cli` поддерживает локальный OAuth/OIDC-каркас для подключения учетной записи через официальный flow ЕСИА/Госуслуг.
+
+Важно: CLI не извлекает cookies, токены или session storage из браузера. Пользователь входит на официальном экране ЕСИА, после чего ЕСИА возвращает `authorization code` на локальный `redirect_uri`, а CLI обменивает его на токены через `token endpoint`.
+
+## Настройка
+
+Для работы нужны параметры официально подключенной информационной системы:
+
+- authorization endpoint;
+- token endpoint;
+- client ID;
+- разрешенный redirect URI;
+- scope;
+- при необходимости client secret или иной официальный способ подписи/аутентификации клиента;
+- optional userinfo endpoint.
+
+Команда настройки:
+
+```bash
+iola gosuslugi configure \
+  --auth-url "https://..." \
+  --token-url "https://..." \
+  --userinfo-url "https://..." \
+  --client-id "CLIENT_ID" \
+  --scope "openid" \
+  --redirect-port 18791
+```
+
+CLI покажет redirect URI:
+
+```text
+http://127.0.0.1:18791/gosuslugi/callback
+```
+
+Этот URI должен быть разрешен в настройках подключенной информационной системы.
+
+## Вход
+
+```bash
+iola gosuslugi login
+```
+
+Что происходит:
+
+1. CLI запускает локальный callback server на `127.0.0.1`.
+2. Открывается официальный экран входа ЕСИА/Госуслуг.
+3. Пользователь сам вводит логин, пароль, SMS/2FA.
+4. ЕСИА возвращает `authorization code` на локальный callback.
+5. CLI обменивает code на токены и сохраняет их локально.
+
+Токены хранятся в `~/.iola/secrets.json` на компьютере пользователя.
+
+## Проверка
+
+```bash
+iola gosuslugi status
+iola gosuslugi userinfo --json
+```
+
+## Выход
+
+```bash
+iola gosuslugi logout
+```
+
+Команда удаляет локально сохраненные токены.
+
+## Ограничения
+
+Без официальных параметров ЕСИА команда `login` не сможет завершить подключение. Это сделано намеренно: CLI реализует легальный redirect flow, а не копирование живой браузерной сессии.
+