@melaya/runner 1.1.6 → 1.1.7

package/dist/assistantHost.py

@@ -248,13 +248,29 @@ _HITL_MODES = ("safe", "autonomous", "payments_only")
 # PURGED at turn end (success, error, or cancel) so a reusable grant never
 # survives in the warm host environment; the server additionally revokes the
 # jti at turn end, and the grant's own exp bounds it.
-_BROWSER_GRANT_ENVS = ("MEL_BROWSER_TURN_GRANT", "MEL_BROWSER_TURN_TARGET_REF")
+#
+# MEL_BROWSER_URL / MEL_BROWSER_TOKEN are injected per-turn (not at spawn)
+# for the assistant path: the runner registers a per-turn bridge run and
+# delivers the url + bearer token on the turn frame alongside the grant. They
+# are also purged at turn end so the bridge bearer token never leaks between
+# turns (the bridge run is torn down by the runner's "done" watcher anyway,
+# making the token stale, but belt-and-suspenders purge here for parity).
+_BROWSER_GRANT_ENVS = (
+    "MEL_BROWSER_TURN_GRANT",
+    "MEL_BROWSER_TURN_TARGET_REF",
+    "MEL_BROWSER_URL",
+    "MEL_BROWSER_TOKEN",
+)
 
 
 def _apply_browser_turn_grant(req) -> bool:
     """Install (or clear) the turn's browser grant env. Returns True when this
     turn carries a browser target. Absent/empty grant ⇒ env cleared (fail
-    closed: the toolkit refuses to act without a live grant)."""
+    closed: the toolkit refuses to act without a live grant).
+
+    Also applies MEL_BROWSER_URL / MEL_BROWSER_TOKEN from the turn frame when
+    present (injected by the runner's per-turn bridge registration). These are
+    purged at turn end alongside the grant (see _purge_browser_turn_grant)."""
     grant = str((req or {}).get("browser_grant") or "") if isinstance(req, dict) else ""
     target_ref = str((req or {}).get("browser_target_ref") or "") if isinstance(req, dict) else ""
     if grant and _browser_capable():
@@ -263,6 +279,14 @@ def _apply_browser_turn_grant(req) -> bool:
             os.environ["MEL_BROWSER_TURN_TARGET_REF"] = target_ref
         else:
             os.environ.pop("MEL_BROWSER_TURN_TARGET_REF", None)
+        # Per-turn bridge URL + token (assistant path only; pipeline path has
+        # these in the spawn env already). Apply only when present on the frame.
+        bridge_url = str((req or {}).get("mel_browser_url") or "") if isinstance(req, dict) else ""
+        bridge_token = str((req or {}).get("mel_browser_token") or "") if isinstance(req, dict) else ""
+        if bridge_url:
+            os.environ["MEL_BROWSER_URL"] = bridge_url
+        if bridge_token:
+            os.environ["MEL_BROWSER_TOKEN"] = bridge_token
         return True
     _purge_browser_turn_grant()
     return False

package/dist/browserBridge.js

@@ -139,6 +139,28 @@ export async function startBrowserBridge(opts) {
                 },
                 isCancelled: () => reg.cancelled,
             };
+            // INTERACTIVE ATTACH: if the grant carries a browserSession that matches
+            // a live interactive session, reuse its Playwright context instead of
+            // launching a new browser. The run is a NON-OWNER (externalAttach=true):
+            // teardownRun will release the registration and its lease but NEVER close
+            // the interactive context — the user's browser stays open.
+            const browserSessionId = String(reg.spec.grant.browserSession || "");
+            if (browserSessionId) {
+                const interactive = getInteractiveSession(browserSessionId);
+                if (interactive && interactive.context && interactive.state !== "closed" && interactive.state !== "crashed") {
+                    reg.externalAttach = true;
+                    const context = interactive.context;
+                    const page = context.pages()[0] ?? (await context.newPage());
+                    sessions.leaseTarget(interactive, reg.spec.grant.target.ref, page);
+                    // Enforce policy on the leased page only (same as cdp-attach mode):
+                    // we do not take over context-wide routing for the interactive session.
+                    await enforceOnPage(page, reg.policy, hooks);
+                    log(`browser session attached to interactive: run=${reg.spec.runId.slice(0, 10)} session=${browserSessionId.slice(0, 16)}`);
+                    // Return the interactive record directly — ensureSession callers
+                    // (getLease, captureSnapshot, etc.) work against it unchanged.
+                    return interactive;
+                }
+            }
             if (reg.spec.mode === "attach") {
                 const ws = String(reg.spec.cdpWsEndpoint || "");
                 if (!/^wss?:\/\/(127\.0\.0\.1|localhost|\[::1\])[:/]/.test(ws)) {
@@ -1176,6 +1198,7 @@ export async function startBrowserBridge(opts) {
             violations: [],
             sessionInit: null,
             traces: [],
+            externalAttach: false,
         };
         byToken.set(token, reg);
         byRunId.set(spec.runId, reg);
@@ -1195,11 +1218,30 @@ export async function startBrowserBridge(opts) {
             if (lease.runId === runId)
                 stopWatchLease(sid);
         }
-        await sessions.teardownRun(runId, reason);
-        // The grant object becomes unreachable here (revocation-by-forget:
-        // the jti was already burned at verification, the claims held only
-        // in this registration are dropped, and the bearer token dies).
-        log(`browser run torn down: ${runId.slice(0, 10)} reason=${reason}`);
+        if (reg.externalAttach) {
+            // This run was attached to an existing interactive session (non-owner).
+            // Release only the target lease the run placed on the interactive record;
+            // do NOT close the interactive Playwright context — the user's browser
+            // must remain open after the turn ends.
+            const browserSessionId = String(reg.spec.grant.browserSession || "");
+            if (browserSessionId) {
+                const interactive = interactiveSessions.get(browserSessionId);
+                if (interactive) {
+                    // Remove only the run's own target ref from the interactive record's
+                    // lease map; all other leases (e.g. "interactive" from the watch
+                    // producer) are preserved.
+                    interactive.targets.delete(reg.spec.grant.target.ref);
+                }
+            }
+            log(`browser run detached (non-owner): ${runId.slice(0, 10)} reason=${reason}`);
+        }
+        else {
+            await sessions.teardownRun(runId, reason);
+            // The grant object becomes unreachable here (revocation-by-forget:
+            // the jti was already burned at verification, the claims held only
+            // in this registration are dropped, and the bearer token dies).
+            log(`browser run torn down: ${runId.slice(0, 10)} reason=${reason}`);
+        }
     };
     const teardownAll = async (reason) => {
         // Tear down grant-scoped run sessions.

package/dist/connection.js

@@ -1457,6 +1457,11 @@ export async function connect(opts) {
         // them for the duration of the turn and purge them afterward.
         let verifiedGrantToken = null;
         let browserTargetRef = null;
+        // Per-turn bridge run registration (plan 0.4 assistant path).
+        // Stable runId scoped to this turn; cleaned up at turn "done".
+        let turnBridgeRunId = null;
+        let turnBridgeUrl = null;
+        let turnBridgeToken = null;
         if (payload.browserGrant) {
             try {
                 const grant = await verifyBrowserGrant(payload.browserGrant, {
@@ -1475,17 +1480,91 @@ export async function connect(opts) {
                 // it locally via MEL_BROWSER_TURN_GRANT at call time, fail closed).
                 verifiedGrantToken = payload.browserGrant;
                 browserTargetRef = String(payload.browserTargetRef || grant.target.ref || "");
+                // Register a per-turn bridge run so MEL_BROWSER_URL / MEL_BROWSER_TOKEN
+                // reach the host process env for this turn. The run attaches to the
+                // interactive session (grant.browserSession) via ensureSession's
+                // interactive-attach path; teardownRun at turn "done" releases the
+                // lease without closing the interactive browser (externalAttach guard).
+                const bridge = await _ensureBrowserBridge();
+                if (bridge) {
+                    const turnRunId = `${payload.sessionId}:${payload.turnId}`;
+                    // Avoid duplicate registration if a prior turn's teardown raced.
+                    if (!bridge.hasRun(turnRunId)) {
+                        const spec = {
+                            runId: turnRunId,
+                            grant,
+                            // Interactive session attach: ensureSession will reuse the
+                            // interactive browser via grant.browserSession.
+                            mode: "launch",
+                            space: { kind: "ephemeral" },
+                            codeMode: false,
+                            headless: false,
+                        };
+                        const { token } = bridge.registerRun(spec);
+                        turnBridgeRunId = turnRunId;
+                        turnBridgeUrl = bridge.url;
+                        turnBridgeToken = token;
+                    }
+                }
                 if (opts.verbose) {
                     console.log(chalk.gray(`  [browser-bridge] turn grant ok (session=${payload.sessionId.slice(0, 10)} ceiling=${grant.effectCeiling})`));
                 }
             }
             catch (e) {
+                // Tear down the partial bridge registration if we registered before
+                // the error (e.g. a bind-assertion failed after registerRun).
+                if (turnBridgeRunId) {
+                    const bridge = await _ensureBrowserBridge().catch(() => null);
+                    if (bridge)
+                        await bridge.teardownRun(turnBridgeRunId, "turn_grant_rejected").catch(() => { });
+                    turnBridgeRunId = null;
+                    turnBridgeUrl = null;
+                    turnBridgeToken = null;
+                }
                 const code = e instanceof BrowserGrantError ? e.code : "grant_error";
                 console.log(chalk.yellow(`  [browser-bridge] turn grant rejected [${code}]: ${e?.message || e}`));
                 socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: `browser turn grant rejected (${code})` });
                 return;
             }
         }
+        // Capture for the stdout "done" handler closure below.
+        const _turnBridgeRunId = turnBridgeRunId;
+        const _turnId = payload.turnId;
+        // When the host emits "done" for this turn, tear down the per-turn bridge
+        // run. The teardown is additive-only to the pipeline RUN path and is safe
+        // to call even if the run never had an active session (e.g. if the host
+        // never called any browser tool this turn).
+        if (_turnBridgeRunId) {
+            // Attach a one-shot "done" watcher on the session's existing stdout
+            // parser via a disposable event. We piggyback on the session's existing
+            // event forwarding: s.proc already has a "data" listener; we add one
+            // more small listener that self-removes after the first "done" for this
+            // exact turnId.
+            const _bridge = await _ensureBrowserBridge().catch(() => null);
+            if (_bridge) {
+                let _teardownBuf = "";
+                const _onData = (data) => {
+                    _teardownBuf += data.toString();
+                    let idx;
+                    while ((idx = _teardownBuf.indexOf("\n")) >= 0) {
+                        const line = _teardownBuf.slice(0, idx);
+                        _teardownBuf = _teardownBuf.slice(idx + 1);
+                        const t = line.trim();
+                        if (!t.startsWith("MELASSIST "))
+                            continue;
+                        try {
+                            const parsed = JSON.parse(t.slice("MELASSIST ".length));
+                            if (parsed?.kind === "done" && parsed?.turnId === _turnId) {
+                                s.proc.stdout?.removeListener("data", _onData);
+                                void _bridge.teardownRun(_turnBridgeRunId, "turn_done");
+                            }
+                        }
+                        catch { /* skip malformed */ }
+                    }
+                };
+                s.proc.stdout?.on("data", _onData);
+            }
+        }
         try {
             s.proc.stdin?.write(JSON.stringify({
                 turnId: payload.turnId,
@@ -1497,9 +1576,20 @@ export async function connect(opts) {
                 // (defence-in-depth) and install MEL_BROWSER_TURN_GRANT in the
                 // host env for THIS turn only. Absent when no grant was provided.
                 ...(verifiedGrantToken ? { browser_grant: verifiedGrantToken, browser_target_ref: browserTargetRef ?? "" } : {}),
+                // Bridge URL + token for the host process env (applied per-turn by
+                // _apply_browser_turn_grant alongside the grant token).
+                ...(turnBridgeUrl && turnBridgeToken
+                    ? { mel_browser_url: turnBridgeUrl, mel_browser_token: turnBridgeToken }
+                    : {}),
             }) + "\n");
         }
         catch (e) {
+            // Turn write failed — clean up the bridge registration immediately.
+            if (_turnBridgeRunId) {
+                const bridge = await _ensureBrowserBridge().catch(() => null);
+                if (bridge)
+                    void bridge.teardownRun(_turnBridgeRunId, "turn_write_failed");
+            }
             socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: `turn write failed: ${e?.message || e}` });
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,