@melaya/runner 1.1.81 → 1.1.83

package/dist/browserAuthz.js

@@ -332,54 +332,54 @@ async function interceptWebSockets(page, policy, hooks) {
  *     IP leakage via STUN/TURN. Combined with the CDP Network.enable /
  *     setRTCConfiguration override (applied separately via CDP below), this
  *     provides layered defence. */
-const PAGE_GUARD_INIT_SCRIPT = `(function() {
-  // WebRTC neutralisation: remove peer connection constructors.
-  try { delete window.RTCPeerConnection; } catch (_) {}
-  try { delete window.RTCSessionDescription; } catch (_) {}
-  try { delete window.RTCIceCandidate; } catch (_) {}
-  // Also zero out webkit/moz-prefixed variants some legacy code still uses.
-  try { delete window.webkitRTCPeerConnection; } catch (_) {}
-  try { delete window.mozRTCPeerConnection; } catch (_) {}
-  // Override navigator.mediaDevices.getUserMedia to prevent media/camera
-  // capture that could be combined with a data channel.
-  try {
-    if (navigator.mediaDevices && typeof navigator.mediaDevices === 'object') {
-      Object.defineProperty(navigator, 'mediaDevices', { value: Object.assign({}, navigator.mediaDevices, { getUserMedia: () => Promise.reject(new DOMException('NotAllowedError')) }), configurable: false, writable: false });
-    }
-  } catch (_) {}
-  // WebSocket URL-blocking fallback (defence-in-depth, supplements
-  // routeWebSocket interception which fires at the Playwright layer).
-  var _NativeWS = window.WebSocket;
-  function _isForbiddenWsHost(url) {
-    try {
-      var u = new URL(url);
-      var h = u.hostname.replace(/^\\[|\\]$/g,'');
-      // Loopback / localhost
-      if (h === 'localhost' || h === '127.0.0.1' || h === '::1' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
-      // Link-local (169.254.x.x) — cloud metadata endpoints live here
-      if (/^169\\.254\\./.test(h)) return true;
-      // RFC1918
-      if (/^10\\./.test(h)) return true;
-      if (/^172\\.(1[6-9]|2[0-9]|3[01])\\./.test(h)) return true;
-      if (/^192\\.168\\./.test(h)) return true;
-      // CGNAT
-      if (/^100\\.(6[4-9]|[7-9][0-9]|1([01][0-9]|2[0-7]))\\./.test(h)) return true;
-      // Explicit metadata hosts
-      if (h === '100.100.100.200' || h === 'metadata.google.internal' || h === 'metadata.goog') return true;
-    } catch (_) {}
-    return false;
-  }
-  window.WebSocket = function WrappedWebSocket(url, protocols) {
-    if (_isForbiddenWsHost(String(url))) {
-      throw new DOMException('WebSocket connection to ' + url + ' is blocked by Melaya egress policy', 'SecurityError');
-    }
-    return protocols !== undefined ? new _NativeWS(url, protocols) : new _NativeWS(url);
-  };
-  window.WebSocket.prototype = _NativeWS.prototype;
-  window.WebSocket.CONNECTING = _NativeWS.CONNECTING;
-  window.WebSocket.OPEN = _NativeWS.OPEN;
-  window.WebSocket.CLOSING = _NativeWS.CLOSING;
-  window.WebSocket.CLOSED = _NativeWS.CLOSED;
+const PAGE_GUARD_INIT_SCRIPT = `(function() {
+  // WebRTC neutralisation: remove peer connection constructors.
+  try { delete window.RTCPeerConnection; } catch (_) {}
+  try { delete window.RTCSessionDescription; } catch (_) {}
+  try { delete window.RTCIceCandidate; } catch (_) {}
+  // Also zero out webkit/moz-prefixed variants some legacy code still uses.
+  try { delete window.webkitRTCPeerConnection; } catch (_) {}
+  try { delete window.mozRTCPeerConnection; } catch (_) {}
+  // Override navigator.mediaDevices.getUserMedia to prevent media/camera
+  // capture that could be combined with a data channel.
+  try {
+    if (navigator.mediaDevices && typeof navigator.mediaDevices === 'object') {
+      Object.defineProperty(navigator, 'mediaDevices', { value: Object.assign({}, navigator.mediaDevices, { getUserMedia: () => Promise.reject(new DOMException('NotAllowedError')) }), configurable: false, writable: false });
+    }
+  } catch (_) {}
+  // WebSocket URL-blocking fallback (defence-in-depth, supplements
+  // routeWebSocket interception which fires at the Playwright layer).
+  var _NativeWS = window.WebSocket;
+  function _isForbiddenWsHost(url) {
+    try {
+      var u = new URL(url);
+      var h = u.hostname.replace(/^\\[|\\]$/g,'');
+      // Loopback / localhost
+      if (h === 'localhost' || h === '127.0.0.1' || h === '::1' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+      // Link-local (169.254.x.x) — cloud metadata endpoints live here
+      if (/^169\\.254\\./.test(h)) return true;
+      // RFC1918
+      if (/^10\\./.test(h)) return true;
+      if (/^172\\.(1[6-9]|2[0-9]|3[01])\\./.test(h)) return true;
+      if (/^192\\.168\\./.test(h)) return true;
+      // CGNAT
+      if (/^100\\.(6[4-9]|[7-9][0-9]|1([01][0-9]|2[0-7]))\\./.test(h)) return true;
+      // Explicit metadata hosts
+      if (h === '100.100.100.200' || h === 'metadata.google.internal' || h === 'metadata.goog') return true;
+    } catch (_) {}
+    return false;
+  }
+  window.WebSocket = function WrappedWebSocket(url, protocols) {
+    if (_isForbiddenWsHost(String(url))) {
+      throw new DOMException('WebSocket connection to ' + url + ' is blocked by Melaya egress policy', 'SecurityError');
+    }
+    return protocols !== undefined ? new _NativeWS(url, protocols) : new _NativeWS(url);
+  };
+  window.WebSocket.prototype = _NativeWS.prototype;
+  window.WebSocket.CONNECTING = _NativeWS.CONNECTING;
+  window.WebSocket.OPEN = _NativeWS.OPEN;
+  window.WebSocket.CLOSING = _NativeWS.CLOSING;
+  window.WebSocket.CLOSED = _NativeWS.CLOSED;
 })();`;
 /** Disable WebRTC at the CDP Network domain level in addition to the
  *  init-script layer (belt-and-suspenders). Silently skips if CDP

package/dist/browserBridge.js

@@ -66,29 +66,29 @@ function cdpRace(p, what, ms = 20_000) {
 // across navigations) and the one-shot page.evaluate on the already-open page.
 // Palette: cyan #22D3EE primary accent, indigo #7C6FF0 subtle secondary,
 // slate/navy #0F172A base. Less purple than the prior version.
-const MELAYA_BRAND_SCRIPT = `(() => {
-  // Top document ONLY: injecting into sub-frames (e.g. the Google Sign-In
-  // iframe) rendered a stray badge on top of third-party widgets.
-  try { if (window.top !== window.self) return; } catch (e) { return; }
-  if (window.__melayaBrand) return; window.__melayaBrand = true;
-  const ID = "__melaya_brand";
-  const LOGO = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC0AAAAsCAMAAADGmMENAAADAFBMVEVMaXEATOaL9vsBTesAEokAF5oAEo0AY9sAHafj/f8ADogAUucAfuoARscAXusAeOce1/8Ac+UAb+QTzv8D2P8CoPfT9v8BCHIAEpMAF5YASsoAQMUAT80AHq4B1f8A0/8ENska0v8FGn8BU9Dy//8AFpECauEAg+0Bie4AO8EBkfIAlfUAGqIAzv8i3f8AXNbM8f8HLosBO+RB7/8CjfBd7P598P4Lre8GQ9cH3P8Ev/067f8w6f8AL7MAObcACnsBU9gHpe4Aaugo4f8FaPBK8f8JxP0AJ7cA0f8ArfoP2//a+/8ADYIDStIBjOgQvPQBi/QInugBhOkKf9sAWNIBgOXe+/8Ltf/r//8AZduf8/4ktfctt/p08P1I1P0Rw/gEleoVyvoAZN8AYtwGadQFm+8Sv/4Cb/ABWdwCQ80AJq8EYeiL8P9r8v912/whsegkeLcMtfEAXuACY+QAWOUBfu0ClO800f3E8v8AZ90+4/+64v4AReyWu/gBSNT5//4u4P8WPoRf0/MNuPkHoOwnxfsas/EAa+TO+/YFie0CQ8sWxvtJjvgAT9QCJ4QAZuxhv+8DkN0AHIoomOoUnfkQS5MdfsgML30CeNMuXJlQib9P5P6m9/sAOtQANs0ALL+h+PwAYuMIne4ZwfUBj+8Oq+yn1/2e+P0BcOp+vfvP+Pw8ofgTaO1no/YHTMOazfsEW6Vg4PwAK7Uck/qI9v5Gca09wPxim8s4ZKkIPpkCfuMBbuNb6v0AYuRe7PyL9v0AhfOL8vJO5fsBmvQAV+aM9vwESNwALb1F4Pwp0fcAKLcAIaoEQtoXX/EAU88BW+cAGJkAfPAsdPMgfe8oaaLQ+vtTg7o/pdIzuul5sNh3vNwAY98PoOG27/4T3/8AWOkAGaABY+4Csv0BRuQCuf0k5v8EqvsBmvYCy/8PyP8DpPwHg/oDePQKsPYAML4Bdesb4/8AmvwBYdoIb7dP/P8BWfMAUPIAIJsAkfsTpOMARLUDY/Vostxr/v8r7v8zndiULzD1AAAA3nRSTlMA/gP+/v7+Av7+/v7+/v79/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/vz+/v3+/v7+/v7+/v7+/v79/v7+/v7+/f3+/v3+/gn+/P7+/v79/f76+v7+/v0gFP7+/v7++/79/f3+/v7+/vxC/vX+/v3+/v4z/v7+/v4t90pmEpFn/v7+/qr++P7++/7+/v7+/v5HUM6PaeZkptHN/o6A/ij+9/6j/v7+qv7q/v7+/v6xz7CH0LPFKoyow9Chu2PJfevd/t3c5L3+/v6a/v7+/qny6f5DYJsMAAAACXBIWXMAAAsTAAALEwEAmpwYAAAFTklEQVR42oXVd1jSeRzA8Z8JCCEgIJi4Q4npDs+BkaKgYplmpqkt98ortdKu1Pbe++queXXta9/ee49u/KFAoiiouRtW9/n+0MrOuu/z8Dw8PK/f5/f+wcP3i2Ej15gx8FpzbOqJNSkYZmeHvWwBxdZ9/c3c1pD29hNHc17qkf3k08W+7Kmvhkyeltuyff0q5Ee7AE94/f1qo9fc2bieM2VKUuq7lWNG8ciue/PDoEcODs/oVIal8721zwehhLffmtj7KDra9xmdnMpgCqJURz6Y/zTImvBRaW94RATCbNDtIZNzcc0SLFrY2FextdLO6vGELx72BoUP642zVyJdNSXZHumKCqpNP/XztegbRQlXHvbGxCAdbdV5K9vbOblVwgn2nayoYirVBlZ/30+nIOiPDGRjgoLCI2KqG+JBt4Ju5rSIk0BH0YvP2sKyoVL7+86uxzLkJaVgYbSxZGbGQS9T68a8NENzW4skyWzJ/+1czWvLbPFFV6nMWNadg1klpUEREeFGube395Iyr7CmtLTmtq67ZvOZC/4JFKvuUy1SFrIwudE33uFSSVaQ8Y7cm0LxXjEjIxvHZ07XJCRw/RNA9z9QFRSKChM7QUc7sE2x2WXyCPmKmRQKZSa6Qea2k9wZXH9YlNf6HxQnijoAb2ZgWaC92LFNhsyy0gwK7uECCsVqExJqNlW4KNQiFxqPr7QH7evAbo0Na4rLnBhaK+eu8EZ+BpfL9YfpFzbZ9onUHSKRC891ul8yPOVTfachtGHiEm98MjeBsuT0r8sCb+tpCNNc+X7dQqS9hnUDcEfH6gxUQqk590Ng4G0bGxWtwwV1TO9OD8ay8B8E6VlIx4c6emhqS7gnN9nilkpV8VA0dKQvFWJXHsWz2a1hTbhuQLPd3WUeuwLBItzYmO8qAsz380vv3IX9M1hfawoLazLgGka7e2hkjsFgcUwHDU8Impnacx4re3zger1DmOGp1mhk7uKhyXQ63cJ34fH4rH0XAwaUWLZp473yA9sWp3Fw7QjZGpmHGE8GrNeD3izYd3HLgFqdiGU3GQzt28tvDV7LPBgKGoWYPCS3wSKs0lu6BXt2bxlwI0vJSMdxxOLc7T1X/5YbHd0hRCYzaSQ2jYD1sCy7wBLJunFEstsrWLYhjlOVzGKl7rt5Y/CS0UOG6xYqFOvpevPlPXVORKnP2HFEKdKLDc0twcnMdD7/5p/lN67XGzUmE+hGPbI7y+t2RI6fpB1LGtbNHInQnpU+nRbwl9eCnv236ms1sTIOna4Cu3eHoqNwvNNYpHVIr27jiJMZgm7QCwyGvJCe3Ve3VbtLHlze+TtYBVnnOVK3BNszl/rxkY7jcNJCeur2D157vH+8T1GRs7OUPKzxktVdEiEDQlxdQMOfN1jcNrlnb50TgTxAIDjryOQRs2dJxBOYEILrNo5ILLS3l1TdJ/potSRn4vM6L0mIh/BEAffQvhAM2wizk+akJRBGarzkWNtdhgBCaKBhW0CYwey8P4lAIPg80QTSOGed2vNLDFv1WZLFz5VHiwy41wUdCLOikCaBlj7Rburzy/G9bdV6RjFPFBkwrcs6mSWIihzS1tlagvS7N+bjFu2x808dUYKWDOF5i0ZqndVa92S01+as/fH+nKQh3L0w8kmJ1HPg529zRhwQ6H3KhuNdZisuKBjWRDfP7zfk/PcwQf7ocXP+vHkLC5QFikmAfXzIHYc3pIx+sMFndms+tkQplZuVCi2JRJKqDx9KecGhNuQrf8lvTExUaAm6oq8O2b3YDvVglVuLqQpi0TvL//cwtoLlW2mj238Bms49IJNu4nIAAAAASUVORK5CYII=";
-  const inject = () => {
-    const root = document.documentElement; if (!root) return;
-    if (document.getElementById(ID + "_border")) return;
-    const style = document.createElement("style");
-    style.id = ID + "_style";
-    style.textContent = "@keyframes melBrandPulse{0%,100%{box-shadow:inset 0 0 9px 2px rgba(34,211,238,.5),inset 0 0 30px 7px rgba(124,111,240,.18)}50%{box-shadow:inset 0 0 16px 4px rgba(34,211,238,.8),inset 0 0 54px 13px rgba(124,111,240,.32)}}@keyframes melBrandGlow{0%,100%{opacity:.78}50%{opacity:1}}#" + ID + "_border{position:fixed;inset:0;pointer-events:none;z-index:2147483647;border-radius:7px;animation:melBrandPulse 2.6s ease-in-out infinite}#" + ID + "_badge{position:fixed;top:10px;left:50%;transform:translateX(-50%);pointer-events:none;z-index:2147483647;font-family:-apple-system,Segoe UI,Roboto,sans-serif;font-weight:600;font-size:12px;line-height:1;white-space:nowrap;max-width:calc(100vw - 24px);box-sizing:border-box;color:#E2E8F0;background:linear-gradient(180deg,rgba(15,23,42,.94),rgba(15,23,42,.82));padding:5px 13px 5px 7px;border-radius:999px;letter-spacing:.2px;border:1px solid rgba(34,211,238,.45);box-shadow:0 0 16px 1px rgba(34,211,238,.4),0 4px 14px rgba(0,0,0,.45);display:flex;align-items:center;gap:8px;backdrop-filter:blur(6px);animation:melBrandGlow 2.6s ease-in-out infinite}#" + ID + "_logo{height:16px;width:auto;display:block;filter:drop-shadow(0 0 4px rgba(34,211,238,.55))}#" + ID + "_label{display:inline-flex;align-items:center;height:16px;line-height:1}@media (max-width:600px){#" + ID + "_badge{font-size:10px;padding:4px 10px 4px 6px;gap:6px;top:6px}#" + ID + "_logo{height:13px}#" + ID + "_label{height:13px}}";
-    (document.head || root).appendChild(style);
-    const border = document.createElement("div"); border.id = ID + "_border";
-    const badge = document.createElement("div"); badge.id = ID + "_badge";
-    const logo = document.createElement("img"); logo.id = ID + "_logo"; logo.src = LOGO; logo.alt = "Melaya";
-    const label = document.createElement("span"); label.id = ID + "_label"; label.textContent = "Controlled by Melaya";
-    badge.appendChild(logo); badge.appendChild(label);
-    root.appendChild(border); root.appendChild(badge);
-  };
-  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", inject); else inject();
-  try { new MutationObserver(() => { if (!document.getElementById(ID + "_border")) inject(); }).observe(document.documentElement, { childList: true }); } catch (e) {}
+const MELAYA_BRAND_SCRIPT = `(() => {
+  // Top document ONLY: injecting into sub-frames (e.g. the Google Sign-In
+  // iframe) rendered a stray badge on top of third-party widgets.
+  try { if (window.top !== window.self) return; } catch (e) { return; }
+  if (window.__melayaBrand) return; window.__melayaBrand = true;
+  const ID = "__melaya_brand";
+  const LOGO = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC0AAAAsCAMAAADGmMENAAADAFBMVEVMaXEATOaL9vsBTesAEokAF5oAEo0AY9sAHafj/f8ADogAUucAfuoARscAXusAeOce1/8Ac+UAb+QTzv8D2P8CoPfT9v8BCHIAEpMAF5YASsoAQMUAT80AHq4B1f8A0/8ENska0v8FGn8BU9Dy//8AFpECauEAg+0Bie4AO8EBkfIAlfUAGqIAzv8i3f8AXNbM8f8HLosBO+RB7/8CjfBd7P598P4Lre8GQ9cH3P8Ev/067f8w6f8AL7MAObcACnsBU9gHpe4Aaugo4f8FaPBK8f8JxP0AJ7cA0f8ArfoP2//a+/8ADYIDStIBjOgQvPQBi/QInugBhOkKf9sAWNIBgOXe+/8Ltf/r//8AZduf8/4ktfctt/p08P1I1P0Rw/gEleoVyvoAZN8AYtwGadQFm+8Sv/4Cb/ABWdwCQ80AJq8EYeiL8P9r8v912/whsegkeLcMtfEAXuACY+QAWOUBfu0ClO800f3E8v8AZ90+4/+64v4AReyWu/gBSNT5//4u4P8WPoRf0/MNuPkHoOwnxfsas/EAa+TO+/YFie0CQ8sWxvtJjvgAT9QCJ4QAZuxhv+8DkN0AHIoomOoUnfkQS5MdfsgML30CeNMuXJlQib9P5P6m9/sAOtQANs0ALL+h+PwAYuMIne4ZwfUBj+8Oq+yn1/2e+P0BcOp+vfvP+Pw8ofgTaO1no/YHTMOazfsEW6Vg4PwAK7Uck/qI9v5Gca09wPxim8s4ZKkIPpkCfuMBbuNb6v0AYuRe7PyL9v0AhfOL8vJO5fsBmvQAV+aM9vwESNwALb1F4Pwp0fcAKLcAIaoEQtoXX/EAU88BW+cAGJkAfPAsdPMgfe8oaaLQ+vtTg7o/pdIzuul5sNh3vNwAY98PoOG27/4T3/8AWOkAGaABY+4Csv0BRuQCuf0k5v8EqvsBmvYCy/8PyP8DpPwHg/oDePQKsPYAML4Bdesb4/8AmvwBYdoIb7dP/P8BWfMAUPIAIJsAkfsTpOMARLUDY/Vostxr/v8r7v8zndiULzD1AAAA3nRSTlMA/gP+/v7+Av7+/v7+/v79/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/vz+/v3+/v7+/v7+/v7+/v79/v7+/v7+/f3+/v3+/gn+/P7+/v79/f76+v7+/v0gFP7+/v7++/79/f3+/v7+/vxC/vX+/v3+/v4z/v7+/v4t90pmEpFn/v7+/qr++P7++/7+/v7+/v5HUM6PaeZkptHN/o6A/ij+9/6j/v7+qv7q/v7+/v6xz7CH0LPFKoyow9Chu2PJfevd/t3c5L3+/v6a/v7+/qny6f5DYJsMAAAACXBIWXMAAAsTAAALEwEAmpwYAAAFTklEQVR42oXVd1jSeRzA8Z8JCCEgIJi4Q4npDs+BkaKgYplmpqkt98ortdKu1Pbe++queXXta9/ee49u/KFAoiiouRtW9/n+0MrOuu/z8Dw8PK/f5/f+wcP3i2Ej15gx8FpzbOqJNSkYZmeHvWwBxdZ9/c3c1pD29hNHc17qkf3k08W+7Kmvhkyeltuyff0q5Ee7AE94/f1qo9fc2bieM2VKUuq7lWNG8ciue/PDoEcODs/oVIal8721zwehhLffmtj7KDra9xmdnMpgCqJURz6Y/zTImvBRaW94RATCbNDtIZNzcc0SLFrY2FextdLO6vGELx72BoUP642zVyJdNSXZHumKCqpNP/XztegbRQlXHvbGxCAdbdV5K9vbOblVwgn2nayoYirVBlZ/30+nIOiPDGRjgoLCI2KqG+JBt4Ju5rSIk0BH0YvP2sKyoVL7+86uxzLkJaVgYbSxZGbGQS9T68a8NENzW4skyWzJ/+1czWvLbPFFV6nMWNadg1klpUEREeFGube395Iyr7CmtLTmtq67ZvOZC/4JFKvuUy1SFrIwudE33uFSSVaQ8Y7cm0LxXjEjIxvHZ07XJCRw/RNA9z9QFRSKChM7QUc7sE2x2WXyCPmKmRQKZSa6Qea2k9wZXH9YlNf6HxQnijoAb2ZgWaC92LFNhsyy0gwK7uECCsVqExJqNlW4KNQiFxqPr7QH7evAbo0Na4rLnBhaK+eu8EZ+BpfL9YfpFzbZ9onUHSKRC891ul8yPOVTfachtGHiEm98MjeBsuT0r8sCb+tpCNNc+X7dQqS9hnUDcEfH6gxUQqk590Ng4G0bGxWtwwV1TO9OD8ay8B8E6VlIx4c6emhqS7gnN9nilkpV8VA0dKQvFWJXHsWz2a1hTbhuQLPd3WUeuwLBItzYmO8qAsz380vv3IX9M1hfawoLazLgGka7e2hkjsFgcUwHDU8Impnacx4re3zger1DmOGp1mhk7uKhyXQ63cJ34fH4rH0XAwaUWLZp473yA9sWp3Fw7QjZGpmHGE8GrNeD3izYd3HLgFqdiGU3GQzt28tvDV7LPBgKGoWYPCS3wSKs0lu6BXt2bxlwI0vJSMdxxOLc7T1X/5YbHd0hRCYzaSQ2jYD1sCy7wBLJunFEstsrWLYhjlOVzGKl7rt5Y/CS0UOG6xYqFOvpevPlPXVORKnP2HFEKdKLDc0twcnMdD7/5p/lN67XGzUmE+hGPbI7y+t2RI6fpB1LGtbNHInQnpU+nRbwl9eCnv236ms1sTIOna4Cu3eHoqNwvNNYpHVIr27jiJMZgm7QCwyGvJCe3Ve3VbtLHlze+TtYBVnnOVK3BNszl/rxkY7jcNJCeur2D157vH+8T1GRs7OUPKzxktVdEiEDQlxdQMOfN1jcNrlnb50TgTxAIDjryOQRs2dJxBOYEILrNo5ILLS3l1TdJ/potSRn4vM6L0mIh/BEAffQvhAM2wizk+akJRBGarzkWNtdhgBCaKBhW0CYwey8P4lAIPg80QTSOGed2vNLDFv1WZLFz5VHiwy41wUdCLOikCaBlj7Rburzy/G9bdV6RjFPFBkwrcs6mSWIihzS1tlagvS7N+bjFu2x808dUYKWDOF5i0ZqndVa92S01+as/fH+nKQh3L0w8kmJ1HPg529zRhwQ6H3KhuNdZisuKBjWRDfP7zfk/PcwQf7ocXP+vHkLC5QFikmAfXzIHYc3pIx+sMFndms+tkQplZuVCi2JRJKqDx9KecGhNuQrf8lvTExUaAm6oq8O2b3YDvVglVuLqQpi0TvL//cwtoLlW2mj238Bms49IJNu4nIAAAAASUVORK5CYII=";
+  const inject = () => {
+    const root = document.documentElement; if (!root) return;
+    if (document.getElementById(ID + "_border")) return;
+    const style = document.createElement("style");
+    style.id = ID + "_style";
+    style.textContent = "@keyframes melBrandPulse{0%,100%{box-shadow:inset 0 0 9px 2px rgba(34,211,238,.5),inset 0 0 30px 7px rgba(124,111,240,.18)}50%{box-shadow:inset 0 0 16px 4px rgba(34,211,238,.8),inset 0 0 54px 13px rgba(124,111,240,.32)}}@keyframes melBrandGlow{0%,100%{opacity:.78}50%{opacity:1}}#" + ID + "_border{position:fixed;inset:0;pointer-events:none;z-index:2147483647;border-radius:7px;animation:melBrandPulse 2.6s ease-in-out infinite}#" + ID + "_badge{position:fixed;top:10px;left:50%;transform:translateX(-50%);pointer-events:none;z-index:2147483647;font-family:-apple-system,Segoe UI,Roboto,sans-serif;font-weight:600;font-size:12px;line-height:1;white-space:nowrap;max-width:calc(100vw - 24px);box-sizing:border-box;color:#E2E8F0;background:linear-gradient(180deg,rgba(15,23,42,.94),rgba(15,23,42,.82));padding:5px 13px 5px 7px;border-radius:999px;letter-spacing:.2px;border:1px solid rgba(34,211,238,.45);box-shadow:0 0 16px 1px rgba(34,211,238,.4),0 4px 14px rgba(0,0,0,.45);display:flex;align-items:center;gap:8px;backdrop-filter:blur(6px);animation:melBrandGlow 2.6s ease-in-out infinite}#" + ID + "_logo{height:16px;width:auto;display:block;filter:drop-shadow(0 0 4px rgba(34,211,238,.55))}#" + ID + "_label{display:inline-flex;align-items:center;height:16px;line-height:1}@media (max-width:600px){#" + ID + "_badge{font-size:10px;padding:4px 10px 4px 6px;gap:6px;top:6px}#" + ID + "_logo{height:13px}#" + ID + "_label{height:13px}}";
+    (document.head || root).appendChild(style);
+    const border = document.createElement("div"); border.id = ID + "_border";
+    const badge = document.createElement("div"); badge.id = ID + "_badge";
+    const logo = document.createElement("img"); logo.id = ID + "_logo"; logo.src = LOGO; logo.alt = "Melaya";
+    const label = document.createElement("span"); label.id = ID + "_label"; label.textContent = "Controlled by Melaya";
+    badge.appendChild(logo); badge.appendChild(label);
+    root.appendChild(border); root.appendChild(badge);
+  };
+  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", inject); else inject();
+  try { new MutationObserver(() => { if (!document.getElementById(ID + "_border")) inject(); }).observe(document.documentElement, { childList: true }); } catch (e) {}
 })();`;
 // ── Stealth init script ────────────────────────────────────────────────────
 // Runs in EVERY frame BEFORE page scripts (context.addInitScript).
@@ -103,31 +103,31 @@ const MELAYA_BRAND_SCRIPT = `(() => {
 // Any function we replace is given a native-looking toString so the patch is not
 // itself a tell. We do NOT fake plugins/webgl/hardware/languages/chrome — a real
 // headed browser already has correct, self-consistent values.
-const STEALTH_SCRIPT = `(() => {
-  const def = (o, k, get) => { try { Object.defineProperty(o, k, { get, configurable: true }); } catch (e) {} };
-  const nativeToString = (fn, name) => {
-    try {
-      const s = "function " + name + "() { [native code] }";
-      Object.defineProperty(fn, "toString", { value: function () { return s; }, configurable: true, writable: true });
-    } catch (e) {}
-  };
-  // 1. navigator.webdriver → false. The launch flag disables it, but some CDP
-  // builds still expose it truthy; keep it false as a belt-and-suspenders.
-  def(Object.getPrototypeOf(navigator) || navigator, "webdriver", () => false);
-  try { delete Navigator.prototype.webdriver; } catch (e) {}
-  // 2. Notification.permission must agree with permissions.query (CDP mismatch).
-  try {
-    const q = navigator.permissions && navigator.permissions.query ? navigator.permissions.query.bind(navigator.permissions) : null;
-    if (q) {
-      const patched = function (p) {
-        return (p && p.name === "notifications")
-          ? Promise.resolve({ state: (typeof Notification !== "undefined" ? Notification.permission : "default"), onchange: null })
-          : q(p);
-      };
-      nativeToString(patched, "query");
-      navigator.permissions.query = patched;
-    }
-  } catch (e) {}
+const STEALTH_SCRIPT = `(() => {
+  const def = (o, k, get) => { try { Object.defineProperty(o, k, { get, configurable: true }); } catch (e) {} };
+  const nativeToString = (fn, name) => {
+    try {
+      const s = "function " + name + "() { [native code] }";
+      Object.defineProperty(fn, "toString", { value: function () { return s; }, configurable: true, writable: true });
+    } catch (e) {}
+  };
+  // 1. navigator.webdriver → false. The launch flag disables it, but some CDP
+  // builds still expose it truthy; keep it false as a belt-and-suspenders.
+  def(Object.getPrototypeOf(navigator) || navigator, "webdriver", () => false);
+  try { delete Navigator.prototype.webdriver; } catch (e) {}
+  // 2. Notification.permission must agree with permissions.query (CDP mismatch).
+  try {
+    const q = navigator.permissions && navigator.permissions.query ? navigator.permissions.query.bind(navigator.permissions) : null;
+    if (q) {
+      const patched = function (p) {
+        return (p && p.name === "notifications")
+          ? Promise.resolve({ state: (typeof Notification !== "undefined" ? Notification.permission : "default"), onchange: null })
+          : q(p);
+      };
+      nativeToString(patched, "query");
+      navigator.permissions.query = patched;
+    }
+  } catch (e) {}
 })();`;
 // ── Humanized input helpers ────────────────────────────────────────────────
 // Instant teleport-clicks and zero-delay typing are a behavioural bot tell.

package/dist/codeWorker.js

@@ -95,74 +95,74 @@ const WORKER_OP_ALLOWLIST = new Set([
 // boundary is the process + OS sandbox around it. The vm context exposes
 // exactly: browser.<op>(), console.log/warn/error, sleep(ms), and
 // JSON/Math/Date via the fresh realm.
-const WORKER_ENTRY_SOURCE = `"use strict";
-const vm = require("node:vm");
-const readline = require("node:readline");
-
-let seq = 0;
-const pending = new Map();
-function send(msg) { process.stdout.write(JSON.stringify(msg) + "\\n"); }
-
-const rl = readline.createInterface({ input: process.stdin, terminal: false });
-let scriptSource = null;
-rl.on("line", (line) => {
-  let m;
-  try { m = JSON.parse(line); } catch { return; }
-  if (m.type === "start" && typeof m.script === "string" && scriptSource === null) {
-    scriptSource = m.script;
-    run(scriptSource);
-  } else if (m.type === "op_result" && pending.has(m.id)) {
-    const { resolve, reject } = pending.get(m.id);
-    pending.delete(m.id);
-    if (m.ok) resolve(m.result);
-    else reject(new Error(m.error || "op failed"));
-  }
-});
-
-function facadeOp(op) {
-  return (args) => new Promise((resolve, reject) => {
-    const id = ++seq;
-    pending.set(id, { resolve, reject });
-    send({ type: "op", id, op, args: args && typeof args === "object" ? args : {} });
-  });
-}
-
-async function run(source) {
-  const browser = Object.freeze({
-    currentTarget: facadeOp("current_target"),
-    getScreenTree: facadeOp("get_screen_tree"),
-    screenshot: facadeOp("screenshot"),
-    act: facadeOp("act"),
-    wait: facadeOp("wait"),
-  });
-  const consoleShim = {
-    log: (...a) => send({ type: "console", line: a.map(String).join(" ") }),
-    warn: (...a) => send({ type: "console", line: "[warn] " + a.map(String).join(" ") }),
-    error: (...a) => send({ type: "console", line: "[error] " + a.map(String).join(" ") }),
-  };
-  const sleep = (ms) => facadeOp("wait")({ ms });
-  const ctx = vm.createContext(Object.create(null), { codeGeneration: { strings: false, wasm: false } });
-  ctx.browser = browser;
-  ctx.console = consoleShim;
-  ctx.sleep = sleep;
-  ctx.JSON = JSON;
-  try {
-    const script = new vm.Script(
-      "(async () => {\\n" + source + "\\n})()",
-      { filename: "model-script.js" },
-    );
-    const result = await script.runInContext(ctx, { timeout: 30000 });
-    send({ type: "done", result: safeJson(result) });
-  } catch (e) {
-    send({ type: "error", message: String((e && e.message) || e) });
-  }
-  process.exit(0);
-}
-
-function safeJson(v) {
-  try { return JSON.parse(JSON.stringify(v === undefined ? null : v)); }
-  catch { return String(v); }
-}
+const WORKER_ENTRY_SOURCE = `"use strict";
+const vm = require("node:vm");
+const readline = require("node:readline");
+
+let seq = 0;
+const pending = new Map();
+function send(msg) { process.stdout.write(JSON.stringify(msg) + "\\n"); }
+
+const rl = readline.createInterface({ input: process.stdin, terminal: false });
+let scriptSource = null;
+rl.on("line", (line) => {
+  let m;
+  try { m = JSON.parse(line); } catch { return; }
+  if (m.type === "start" && typeof m.script === "string" && scriptSource === null) {
+    scriptSource = m.script;
+    run(scriptSource);
+  } else if (m.type === "op_result" && pending.has(m.id)) {
+    const { resolve, reject } = pending.get(m.id);
+    pending.delete(m.id);
+    if (m.ok) resolve(m.result);
+    else reject(new Error(m.error || "op failed"));
+  }
+});
+
+function facadeOp(op) {
+  return (args) => new Promise((resolve, reject) => {
+    const id = ++seq;
+    pending.set(id, { resolve, reject });
+    send({ type: "op", id, op, args: args && typeof args === "object" ? args : {} });
+  });
+}
+
+async function run(source) {
+  const browser = Object.freeze({
+    currentTarget: facadeOp("current_target"),
+    getScreenTree: facadeOp("get_screen_tree"),
+    screenshot: facadeOp("screenshot"),
+    act: facadeOp("act"),
+    wait: facadeOp("wait"),
+  });
+  const consoleShim = {
+    log: (...a) => send({ type: "console", line: a.map(String).join(" ") }),
+    warn: (...a) => send({ type: "console", line: "[warn] " + a.map(String).join(" ") }),
+    error: (...a) => send({ type: "console", line: "[error] " + a.map(String).join(" ") }),
+  };
+  const sleep = (ms) => facadeOp("wait")({ ms });
+  const ctx = vm.createContext(Object.create(null), { codeGeneration: { strings: false, wasm: false } });
+  ctx.browser = browser;
+  ctx.console = consoleShim;
+  ctx.sleep = sleep;
+  ctx.JSON = JSON;
+  try {
+    const script = new vm.Script(
+      "(async () => {\\n" + source + "\\n})()",
+      { filename: "model-script.js" },
+    );
+    const result = await script.runInContext(ctx, { timeout: 30000 });
+    send({ type: "done", result: safeJson(result) });
+  } catch (e) {
+    send({ type: "error", message: String((e && e.message) || e) });
+  }
+  process.exit(0);
+}
+
+function safeJson(v) {
+  try { return JSON.parse(JSON.stringify(v === undefined ? null : v)); }
+  catch { return String(v); }
+}
 `;
 function nodePermissionFlags(scratchDir, entryPath) {
     const major = Number(process.version.replace(/^v/, "").split(".")[0]) || 0;

package/dist/connection.js

@@ -40,6 +40,7 @@ import { getRunnerDeviceId } from "./sessionManager.js";
 import { scrubTriggeredEnv } from "./triggerEnv.js";
 import { pickNativeFolder } from "./folderPicker.js";
 import { newTurnFileState, readTurnFile, turnOutputDir } from "./assistantFiles.js";
+import { formatTurnSummary } from "./turnSummary.js";
 // Obsidian vault host (docs/plans/obsidian-vault-protocol.md): device vaults
 // registered on this computer, served after the runner verifies each
 // capability itself.
@@ -1871,6 +1872,15 @@ export async function connect(opts) {
                         }
                         if (parsed?.kind === "done" && typeof parsed.turnId === "string")
                             session.turnFiles?.delete(parsed.turnId);
+                        // One line per turn (why it ended, the model's finish_reason, tool
+                        // calls, context use): the runner log used to show only the session
+                        // start, which made a looping local model hard to diagnose. Logged
+                        // here and not forwarded (the server protocol is unchanged).
+                        if (parsed?.kind === "done" && parsed.summary && typeof parsed.summary === "object") {
+                            if (session.forward)
+                                console.log(chalk.gray(`  ◆ Assistant turn ${String(parsed.turnId || "").slice(0, 8)}… ${formatTurnSummary(parsed.summary)}`));
+                            delete parsed.summary;
+                        }
                         if (typeof parsed?.memoryWatermark === "number")
                             session.memoryWatermark = parsed.memoryWatermark;
                         if (parsed?.kind === "ready") {
@@ -2031,8 +2041,20 @@ export async function connect(opts) {
         const certBundle = (await import("./pythonEnv.js")).getCertBundlePath();
         const sslEnv = certBundle ? { SSL_CERT_FILE: certBundle, REQUESTS_CA_BUNDLE: certBundle } : {};
         const httpBase = opts.serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
+        // Same MEL_MODEL_* scrub as the pipeline spawns: a stray value in the
+        // runner's own env (e.g. MEL_MODEL_MAX_ITERS) must never govern the host.
+        const inherited = { ...process.env };
+        for (const k of Object.keys(inherited)) {
+            if (k.startsWith("MEL_MODEL_"))
+                delete inherited[k];
+        }
+        // Local models (ollama / lmstudio): output cap, family and the context
+        // window the model is loaded with, like a pipeline run's preflight profile.
+        const { assistantModelEnv } = await import("./modelLoader.js");
+        const modelEnv = await assistantModelEnv(String(payload.provider || ""), String(payload.model || ""));
         const env = {
-            ...process.env,
+            ...inherited,
+            ...modelEnv,
             PYTHONPATH: sharedDir,
             PYTHONIOENCODING: "utf-8",
             PYTHONUTF8: "1",