@melaya/runner 1.0.92 → 1.0.94

package/dist/assistantHost.py

@@ -205,13 +205,19 @@ def _build_agent():
         "TikTok). Opening the wrong app is a FAILED task, not a reasonable default. "
         "After the user authorizes the app, phone_list_apps reflects it immediately — "
         "re-check and open the REQUESTED app.\n"
-        "- You are FULLY AUTONOMOUS on the phone: NEVER ask the user a question, "
-        "never end your turn asking for confirmation or offering a choice — make the "
-        "reasonable decision and DO it (the ONE exception is the EXACT-APP rule above: "
-        "a missing app is a stop, not a substitution). If a feed is algorithmic, use "
-        "the app's own Search / Explore to find the right content yourself. Keep going "
-        "until the task is COMPLETE (e.g. all N comments posted) or you are genuinely "
-        "blocked; only then report what you did and what (if anything) is blocked.\n"
+        "- You are AUTONOMOUS on the phone: for routine choices, make the reasonable "
+        "decision and DO it — never stall the run by ENDING YOUR TURN to ask in chat. "
+        "But when you hit a GENUINE fork you cannot reasonably resolve on your own (which "
+        "of several accounts to act as, a truly ambiguous target, a risky irreversible "
+        "step), or you want a go/no-go before continuing a long task, call "
+        "phone_ask_user(question): it expands the Melaya tile ON THE PHONE into a reply "
+        "card and BLOCKS for the user's typed answer WITHOUT ending your turn, so the run "
+        "continues seamlessly the moment they reply. Use it SPARINGLY, for real decisions "
+        "only — not routine ones. The EXACT-APP rule still holds (a missing app is a stop, "
+        "not a substitution). If a feed is algorithmic, use the app's own Search / Explore "
+        "to find the right content yourself. Keep going until the task is COMPLETE (e.g. "
+        "all N comments posted) or you are genuinely blocked; only then report what you "
+        "did and what (if anything) is blocked.\n"
         if phone_enabled else ""
     )
     connector_rule = (
@@ -246,13 +252,16 @@ def _build_agent():
         model_name=model,
         provider=provider,
         api_key="",  # model.py resolves the provider's own creds (OAuth off disk / localhost)
-        # Phone tasks are many-step (each comment ≈ screen_tree→tap→type→post), so
-        # give them room like the device template (40); read-only Q&A needs few.
-        # Connector WRITE tasks are equally many-step (e.g. "message all my recent
-        # LinkedIn connections" = 1 list + N sends, each its own reasoning+HITL
-        # round), so they need the same headroom — 8 hit the cap mid-task and
-        # forced _summarizing() on a half-finished tool batch.
-        max_iters=40 if (phone_enabled or connector_services) else 8,
+        # Phone tasks that act on N items ("like + comment on 10 posts") take
+        # ~10-15 tool calls EACH (screen_tree→read→tap→type→post_comment→verify→
+        # swipe to the next), so a flat 40 capped a 10-post run at ~3 done and
+        # forced a mid-task stop — which also ends the turn and tears down the
+        # phone working-overlay, snapping the phone back to the Melaya app before
+        # the task is finished. Give phone runs real headroom (they are HITL-gated,
+        # so each write still needs the user's tap — cost stays bounded). Connector
+        # WRITE fan-outs (1 list + N sends, each its own reasoning+HITL round) keep
+        # the 40 that fits them; read-only Q&A needs very few.
+        max_iters=100 if phone_enabled else (40 if connector_services else 8),
         reliability=True,
         bounded_memory=True,
     )

package/dist/lumaBrowserBridge.d.ts

@@ -32,9 +32,22 @@
  *    port, mints a per-session token, and exposes both via env vars
  *    `MEL_LUMA_BROWSER_URL` + `MEL_LUMA_BROWSER_TOKEN` to the spawned
  *    Python pipeline subprocess.
- * 3. Python's `luma_register_event` POSTs the registration body to
- *    `${MEL_LUMA_BROWSER_URL}/luma/forward` with
- *    `Authorization: Bearer ${MEL_LUMA_BROWSER_TOKEN}`. The bridge:
+ * 3. Two endpoints:
+ *
+ *    POST /luma/register  (PREFERRED, Option A — UI-driven)
+ *      Python's `luma_register_event` posts `{ eventApiId, answers,
+ *      ticketPreference }`. The bridge opens the REAL event page, installs a
+ *      response interceptor on Luma's own register XHR, clicks the
+ *      Register/RSVP button, fills required custom questions + ticket, submits,
+ *      and returns Luma's REAL request body + endpoint + response. This lets
+ *      Luma's frontend build the correct wire schema (whatever the current
+ *      release wants) and handles fresh / invited / ticket / approval flows
+ *      uniformly — no hand-built body. If the operator already has a spot the
+ *      page shows a manage state and we return `pageState: already_registered`
+ *      instead of hunting for a Register button.
+ *
+ *    POST /luma/forward   (LEGACY fallback — hand-built body replay)
+ *      Python posts a full `{ url, method, headers, body }`. The bridge:
  *      a. Spawns / reuses a headless Chromium with the saved storage
  *         state, freshly reloaded from disk so a recent reconnect's
  *         cookies are picked up immediately.
@@ -52,9 +65,10 @@
  *   processes on the same machine can't fire requests without it
  *   (the env var is only injected into the runner-spawned pipeline
  *   subprocess).
- * - Endpoint is narrow: the URL must be a luma.com / api.luma.com /
- *   api2.luma.com / lu.ma origin and the method must be GET / POST.
- *   Anything else is rejected with 400.
+ * - Endpoints are narrow: /luma/forward requires a luma.com / api.luma.com /
+ *   api2.luma.com / lu.ma origin URL with a GET/POST method; /luma/register
+ *   requires an evt-… id and only ever opens a luma.com event page. Anything
+ *   else is rejected with 400.
  * - Body size is capped at 64 KB.
  *
  * Cleanup

package/dist/lumaBrowserBridge.js

@@ -32,9 +32,22 @@
  *    port, mints a per-session token, and exposes both via env vars
  *    `MEL_LUMA_BROWSER_URL` + `MEL_LUMA_BROWSER_TOKEN` to the spawned
  *    Python pipeline subprocess.
- * 3. Python's `luma_register_event` POSTs the registration body to
- *    `${MEL_LUMA_BROWSER_URL}/luma/forward` with
- *    `Authorization: Bearer ${MEL_LUMA_BROWSER_TOKEN}`. The bridge:
+ * 3. Two endpoints:
+ *
+ *    POST /luma/register  (PREFERRED, Option A — UI-driven)
+ *      Python's `luma_register_event` posts `{ eventApiId, answers,
+ *      ticketPreference }`. The bridge opens the REAL event page, installs a
+ *      response interceptor on Luma's own register XHR, clicks the
+ *      Register/RSVP button, fills required custom questions + ticket, submits,
+ *      and returns Luma's REAL request body + endpoint + response. This lets
+ *      Luma's frontend build the correct wire schema (whatever the current
+ *      release wants) and handles fresh / invited / ticket / approval flows
+ *      uniformly — no hand-built body. If the operator already has a spot the
+ *      page shows a manage state and we return `pageState: already_registered`
+ *      instead of hunting for a Register button.
+ *
+ *    POST /luma/forward   (LEGACY fallback — hand-built body replay)
+ *      Python posts a full `{ url, method, headers, body }`. The bridge:
  *      a. Spawns / reuses a headless Chromium with the saved storage
  *         state, freshly reloaded from disk so a recent reconnect's
  *         cookies are picked up immediately.
@@ -52,9 +65,10 @@
  *   processes on the same machine can't fire requests without it
  *   (the env var is only injected into the runner-spawned pipeline
  *   subprocess).
- * - Endpoint is narrow: the URL must be a luma.com / api.luma.com /
- *   api2.luma.com / lu.ma origin and the method must be GET / POST.
- *   Anything else is rejected with 400.
+ * - Endpoints are narrow: /luma/forward requires a luma.com / api.luma.com /
+ *   api2.luma.com / lu.ma origin URL with a GET/POST method; /luma/register
+ *   requires an evt-… id and only ever opens a luma.com event page. Anything
+ *   else is rejected with 400.
  * - Body size is capped at 64 KB.
  *
  * Cleanup
@@ -90,6 +104,176 @@ function _stateDir() {
 export function lumaStorageStatePath() {
     return path.join(_stateDir(), "storage-state.json");
 }
+/** Detect the "you already have a spot" state. Luma shows a manage / "You're
+ *  In" / "Request Sent" / "On the Waitlist" panel instead of a Register button
+ *  for guests it already knows. Returns a short state label or "" if fresh. */
+async function _detectAlreadyRegistered(page) {
+    try {
+        return await page.evaluate(() => {
+            const txt = (document.body.innerText || "").toLowerCase();
+            // Order matters: more specific first.
+            if (/pending approval|request sent|awaiting approval|pending review/.test(txt))
+                return "approval_pending";
+            if (/on the waitlist|you.?re on the waitlist|waitlist.?ed/.test(txt))
+                return "waitlisted";
+            if (/you.?re in|you are in|you.?re going|manage registration|change registration|cancel registration|edit registration/.test(txt))
+                return "already_registered";
+            return "";
+        });
+    }
+    catch {
+        return "";
+    }
+}
+/** Click the primary Register / RSVP / Join button. Returns true on click. */
+async function _clickRegisterButton(page) {
+    // 1) data-testid / known attribute hooks first (most stable).
+    const testidSelectors = [
+        '[data-testid="register-button"]',
+        '[data-testid="rsvp-button"]',
+        'button[data-luma-action="register"]',
+    ];
+    for (const sel of testidSelectors) {
+        try {
+            const el = page.locator(sel).first();
+            if (await el.count() && await el.isVisible()) {
+                await el.click({ timeout: 4000 });
+                return true;
+            }
+        }
+        catch { /* next */ }
+    }
+    // 2) button/anchor text — try each verb. getByRole with an accessible-name
+    //    regex catches "Register", "RSVP", "Join", "One-Click Register", "Get
+    //    Ticket", "Request to Join" without over-matching "Register a friend".
+    const nameRx = /^(register|rsvp|join|one[- ]?click register|get ticket|request to join|reserve( a)? spot)/i;
+    for (const role of ["button", "link"]) {
+        try {
+            const el = page.getByRole(role, { name: nameRx }).first();
+            if (await el.count() && await el.isVisible()) {
+                await el.click({ timeout: 4000 });
+                return true;
+            }
+        }
+        catch { /* next */ }
+    }
+    // 3) last resort: any visible button whose text starts with a register verb.
+    try {
+        const btn = page.locator("button, a[role='button']").filter({ hasText: nameRx }).first();
+        if (await btn.count() && await btn.isVisible()) {
+            await btn.click({ timeout: 4000 });
+            return true;
+        }
+    }
+    catch { /* give up */ }
+    return false;
+}
+/** Select a ticket when the event offers a choice. Best-effort: if a preferred
+ *  ticket name/id is given, click the row containing it; otherwise pick the
+ *  first free ("Free"/$0) ticket, else the first ticket. No-op when there's no
+ *  ticket selector (plain free RSVP). */
+async function _selectTicketIfPresent(page, preference) {
+    try {
+        // Luma renders ticket options as clickable rows/radios. We look for a
+        // container that mentions "ticket" then click a matching option.
+        if (preference) {
+            const pref = page.getByText(preference, { exact: false }).first();
+            if (await pref.count() && await pref.isVisible()) {
+                await pref.click({ timeout: 2500 });
+                return;
+            }
+        }
+        // Prefer a free ticket.
+        const free = page.locator("[class*='ticket'], [data-testid*='ticket']")
+            .filter({ hasText: /free|\$0(\.00)?/i }).first();
+        if (await free.count() && await free.isVisible()) {
+            await free.click({ timeout: 2500 });
+            return;
+        }
+    }
+    catch { /* no ticket selector — plain RSVP */ }
+}
+/** Fill required custom questions in the registration modal from the provided
+ *  answers map, matched by visible label. Handles text inputs, textareas, and
+ *  select dropdowns. Checkboxes labelled with agreement text are left to the
+ *  operator's profile-driven answers (passed in `answers` as "yes"). */
+async function _fillCustomQuestions(page, answers) {
+    for (const [label, rawVal] of Object.entries(answers)) {
+        const val = rawVal == null ? "" : String(rawVal);
+        if (!val)
+            continue;
+        const labelRx = new RegExp(label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+        try {
+            // Try an input/textarea associated with a label matching the question.
+            const field = page.getByLabel(labelRx).first();
+            if (await field.count() && await field.isVisible()) {
+                const tag = await field.evaluate((el) => el.tagName.toLowerCase()).catch(() => "");
+                if (tag === "select") {
+                    await field.selectOption({ label: val }).catch(async () => {
+                        await field.selectOption(val).catch(() => { });
+                    });
+                }
+                else if (val.toLowerCase() === "yes") {
+                    await field.check({ timeout: 2000 }).catch(() => field.click({ timeout: 2000 }).catch(() => { }));
+                }
+                else {
+                    await field.fill(val, { timeout: 2500 }).catch(() => { });
+                }
+                continue;
+            }
+        }
+        catch { /* fall through to placeholder match */ }
+        // Fallback: match by placeholder text.
+        try {
+            const ph = page.getByPlaceholder(labelRx).first();
+            if (await ph.count() && await ph.isVisible()) {
+                await ph.fill(val, { timeout: 2500 }).catch(() => { });
+            }
+        }
+        catch { /* skip this question — submit will surface if it was required */ }
+    }
+}
+/** Click the modal's final submit/confirm button. Distinct from the initial
+ *  Register button: the modal's CTA is usually "Register" / "Confirm" / "Get
+ *  Ticket" / "Request to Join". Idempotent — safe if there's no modal. */
+async function _submitRegistration(page) {
+    const nameRx = /^(register|confirm|rsvp|get ticket|request to join|submit|one[- ]?click register|reserve)/i;
+    // Prefer a submit inside a dialog/modal so we don't re-click the page's
+    // primary button (which may just re-open the modal).
+    const scopes = [
+        page.getByRole("dialog"),
+        page.locator("[role='dialog'], [class*='modal'], [class*='Modal']"),
+        page, // whole page fallback
+    ];
+    for (const scope of scopes) {
+        try {
+            const anyScope = scope;
+            const btn = (typeof anyScope.getByRole === "function"
+                ? anyScope.getByRole("button", { name: nameRx })
+                : page.getByRole("button", { name: nameRx })).first();
+            if (await btn.count() && await btn.isVisible()) {
+                await btn.click({ timeout: 4000 });
+                return;
+            }
+        }
+        catch { /* next scope */ }
+    }
+}
+/** Screenshot to base64 PNG, capped, best-effort. Returns "" on failure. */
+async function _safeScreenshot(page) {
+    try {
+        const buf = await page.screenshot({ type: "png", fullPage: false });
+        // Cap at ~1.5MB base64 to stay well under the bridge's 64KB *request*
+        // limit is irrelevant here (this is a RESPONSE); but keep it bounded so a
+        // huge PNG doesn't bloat the trace. Truncate rather than drop so the
+        // operator still gets a partial visual.
+        const b64 = buf.toString("base64");
+        return b64.length > 1_500_000 ? b64.slice(0, 1_500_000) : b64;
+    }
+    catch {
+        return "";
+    }
+}
 // ── Public starter ──────────────────────────────────────────────────────────
 /**
  * Starts the bridge if a saved Luma storage state exists. Returns null
@@ -237,6 +421,165 @@ export async function startLumaBrowserBridge(opts) {
             }
         }
     }
+    // ── UI-driven register (Option A) ──────────────────────────────────────────
+    //
+    // Open the real event page, install a response interceptor on Luma's own
+    // register XHR, then click the Register/RSVP button and fill the form. This
+    // lets Luma's frontend build the CORRECT wire body (whatever the current
+    // release's schema is) and clears Cloudflare (cf_bm refreshes on-page, TLS
+    // is Chrome's). We return the intercepted request body + endpoint + upstream
+    // response verbatim.
+    async function _register(req) {
+        const eid = String(req.eventApiId || "").trim();
+        if (!eid.startsWith("evt-")) {
+            return { ok: false, status: 0, body: "", error: `invalid_event_api_id: ${eid}` };
+        }
+        const eventUrl = req.eventUrl && /^https?:\/\//.test(req.eventUrl)
+            ? req.eventUrl
+            : `https://luma.com/${eid}`;
+        try {
+            const u = new URL(eventUrl);
+            if (!ALLOWED_HOSTNAMES.has(u.hostname)) {
+                return { ok: false, status: 0, body: "", error: `host_not_allowed: ${u.hostname}` };
+            }
+        }
+        catch {
+            return { ok: false, status: 0, body: "", error: "invalid_event_url" };
+        }
+        const b = await _ensureBrowser();
+        let ctx = null;
+        try {
+            const storageState = await _readStorageState();
+            ctx = await b.newContext({
+                storageState: storageState,
+                userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+                    "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
+                viewport: { width: 1280, height: 900 },
+            });
+            const page = await ctx.newPage();
+            // Response interceptor: capture the FIRST register/RSVP XHR Luma fires.
+            // We match on the URL path so we catch whichever surface the current
+            // release uses (/event/register, /event/independent-register-for-event,
+            // or a future rename that still contains "register").
+            let capturedStatus = 0;
+            let capturedBody = "";
+            let capturedEndpoint = "";
+            let capturedRequestBody = "";
+            const REGISTER_PATH_RX = /\/event\/[a-z-]*register[a-z-]*/i;
+            page.on("request", (request) => {
+                try {
+                    const url = request.url();
+                    if (request.method() === "POST" && REGISTER_PATH_RX.test(new URL(url).pathname)) {
+                        if (!capturedRequestBody) {
+                            capturedEndpoint = new URL(url).pathname;
+                            capturedRequestBody = request.postData() || "";
+                        }
+                    }
+                }
+                catch { /* ignore */ }
+            });
+            page.on("response", async (response) => {
+                try {
+                    const url = response.url();
+                    if (response.request().method() === "POST" && REGISTER_PATH_RX.test(new URL(url).pathname)) {
+                        // First register response wins.
+                        if (!capturedStatus) {
+                            capturedStatus = response.status();
+                            try {
+                                capturedBody = await response.text();
+                            }
+                            catch {
+                                capturedBody = "";
+                            }
+                            if (!capturedEndpoint)
+                                capturedEndpoint = new URL(url).pathname;
+                        }
+                    }
+                }
+                catch { /* ignore */ }
+            });
+            try {
+                await page.goto(eventUrl, {
+                    waitUntil: "domcontentloaded",
+                    timeout: req.navigationTimeoutMs || PAGE_GOTO_TIMEOUT_MS,
+                });
+            }
+            catch (e) {
+                opts.log(`[luma-bridge] register goto failed (${e?.message || e}).`);
+            }
+            await page.waitForTimeout(PAGE_SETTLE_MS);
+            // If the operator already has a spot, Luma shows a "You're In" / manage
+            // state instead of a Register button. Detect it up-front so we don't
+            // hunt for a button that isn't there.
+            const alreadyState = await _detectAlreadyRegistered(page);
+            if (alreadyState) {
+                return {
+                    ok: true, status: 0, body: "", pageState: alreadyState,
+                    capturedEndpoint, capturedRequestBody,
+                };
+            }
+            // Click the Register / RSVP / Join button. Resilient to Luma's copy +
+            // markup drift: try data-testids, then a set of button texts, then any
+            // button whose accessible name contains a register-ish verb.
+            const clicked = await _clickRegisterButton(page);
+            if (!clicked) {
+                const shot = await _safeScreenshot(page);
+                return {
+                    ok: false, status: 0, body: "",
+                    pageState: "no_register_button",
+                    screenshotB64: shot,
+                    error: "could not locate a Register/RSVP button on the event page",
+                };
+            }
+            // A registration modal may appear with required custom questions and/or a
+            // ticket selector. Fill what we can, then submit. Best-effort — Luma's own
+            // client-side validation will block submit if something required is empty,
+            // and we surface that as a precise error rather than a silent 400.
+            await page.waitForTimeout(800);
+            await _selectTicketIfPresent(page, req.ticketPreference);
+            await _fillCustomQuestions(page, req.answers || {});
+            await _submitRegistration(page);
+            // Wait for the register XHR to fire + resolve. Poll up to ~15s.
+            const deadline = Date.now() + 15_000;
+            while (Date.now() < deadline && !capturedStatus) {
+                await page.waitForTimeout(300);
+            }
+            if (capturedStatus) {
+                return {
+                    ok: true,
+                    status: capturedStatus,
+                    body: capturedBody,
+                    capturedEndpoint,
+                    capturedRequestBody,
+                };
+            }
+            // No register XHR observed. Re-check for an "already in" state the submit
+            // may have produced, else return a diagnosable failure with a screenshot.
+            const postState = await _detectAlreadyRegistered(page);
+            if (postState) {
+                return { ok: true, status: 0, body: "", pageState: postState, capturedEndpoint, capturedRequestBody };
+            }
+            const shot = await _safeScreenshot(page);
+            return {
+                ok: false, status: 0, body: "",
+                pageState: "no_register_xhr",
+                capturedEndpoint, capturedRequestBody,
+                screenshotB64: shot,
+                error: "clicked register but no register XHR fired (form may have unmet required fields)",
+            };
+        }
+        catch (e) {
+            return { ok: false, status: 0, body: "", error: `register_bridge_error: ${e?.message || e}` };
+        }
+        finally {
+            if (ctx) {
+                try {
+                    await ctx.close();
+                }
+                catch { /* ignore */ }
+            }
+        }
+    }
     // ── HTTP server ──────────────────────────────────────────────────────────
     const server = createServer(async (req, res) => {
         res.setHeader("X-Frame-Options", "DENY");
@@ -256,7 +599,8 @@ export async function startLumaBrowserBridge(opts) {
             res.end(JSON.stringify({ ok: false, error: "unauthorized" }));
             return;
         }
-        if (req.url !== "/luma/forward") {
+        const route = req.url || "";
+        if (route !== "/luma/forward" && route !== "/luma/register") {
             res.statusCode = 404;
             res.end(JSON.stringify({ ok: false, error: "not_found" }));
             return;
@@ -287,12 +631,32 @@ export async function startLumaBrowserBridge(opts) {
             res.end(JSON.stringify({ ok: false, error: "invalid_json" }));
             return;
         }
-        if (!payload || typeof payload !== "object" || !payload.url) {
+        if (!payload || typeof payload !== "object") {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ ok: false, error: "invalid_payload" }));
+            return;
+        }
+        // Route to the UI-driven register path (Option A) or the legacy forward.
+        if (route === "/luma/register") {
+            const rreq = payload;
+            if (!rreq.eventApiId) {
+                res.statusCode = 400;
+                res.end(JSON.stringify({ ok: false, error: "missing_eventApiId" }));
+                return;
+            }
+            const rout = await _register(rreq);
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify(rout));
+            return;
+        }
+        const freq = payload;
+        if (!freq.url) {
             res.statusCode = 400;
             res.end(JSON.stringify({ ok: false, error: "missing_url" }));
             return;
         }
-        const out = await _forward(payload);
+        const out = await _forward(freq);
         res.statusCode = 200;
         res.setHeader("Content-Type", "application/json");
         res.end(JSON.stringify(out));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.92",
+  "version": "1.0.94",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,