@minionry/minion 0.7.36

package/dist/server/services/browser/sandbox-policy.js

@@ -0,0 +1,169 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, readFileSync } from 'node:fs';
+import { defaultGeteuid } from './chrome-sandbox.js';
+export const CHROMIUM_SANDBOX_ENV = 'MINIONRY_CHROMIUM_SANDBOX';
+export const LEGACY_NO_SANDBOX_ENV = 'MINIONRY_CHROMIUM_NO_SANDBOX';
+const ON_VALUES = new Set(['on', '1', 'true', 'strict']);
+const OFF_VALUES = new Set(['off', '0', 'false', 'none']);
+export function parseChromiumSandboxMode(env) {
+    const raw = env[CHROMIUM_SANDBOX_ENV];
+    if (typeof raw === 'string' && raw.trim() !== '') {
+        const value = raw.trim().toLowerCase();
+        if (value === 'auto')
+            return { mode: 'auto', source: 'env' };
+        if (ON_VALUES.has(value))
+            return { mode: 'on', source: 'env' };
+        if (OFF_VALUES.has(value))
+            return { mode: 'off', source: 'env' };
+        return { mode: 'on', source: 'invalid', invalid: raw };
+    }
+    if (env[LEGACY_NO_SANDBOX_ENV] === '1')
+        return { mode: 'off', source: 'legacy-env' };
+    return { mode: 'auto', source: 'default' };
+}
+function defaultReadFile(p) {
+    try {
+        return readFileSync(p, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+export function probablyInContainer(deps = {}) {
+    const pathExists = deps.pathExists ?? existsSync;
+    const readFile = deps.readFile ?? defaultReadFile;
+    if (pathExists('/.dockerenv') || pathExists('/run/.containerenv') || pathExists('/run/systemd/container')) {
+        return true;
+    }
+    const cgroup = readFile('/proc/self/cgroup');
+    if (cgroup !== null && /(?:^|[/:-])(?:docker|containerd|kubepods|lxc|libpod|podman)[/-]/m.test(cgroup))
+        return true;
+    const mountinfo = readFile('/proc/self/mountinfo');
+    if (mountinfo !== null && /\/docker\/containers\/|\/containers\/storage\//.test(mountinfo))
+        return true;
+    return false;
+}
+function describeFailure(kind) {
+    switch (kind) {
+        case 'namespaces-blocked':
+            return "creating PID/network namespaces is blocked — the norm under Docker's default seccomp profile";
+        case 'no-usable-sandbox':
+            return 'user namespaces are unavailable on this kernel and its SUID helper (chrome-sandbox) is not usable — root-owned, mode 4755';
+        case 'root-without-flag':
+            return 'Chromium refuses to run its sandbox as root';
+    }
+}
+export class ChromiumSandboxPolicy {
+    parsed;
+    mode;
+    platform;
+    geteuid;
+    containerProbe;
+    containerCached = null;
+    fallenBack = null;
+    constructor(deps = {}) {
+        const env = deps.env ?? process.env;
+        this.parsed = parseChromiumSandboxMode(env);
+        this.mode = this.parsed.mode;
+        this.platform = deps.platform ?? process.platform;
+        this.geteuid = deps.geteuid ?? defaultGeteuid;
+        this.containerProbe = deps.probablyInContainer ?? (() => probablyInContainer());
+    }
+    get hasFallenBack() {
+        return this.fallenBack !== null;
+    }
+    decide() {
+        if (this.platform !== 'linux') {
+            return {
+                enabled: true,
+                reason: 'platform-unmanaged',
+                detail: `Chromium sandbox on (${this.platform}: not managed by ${CHROMIUM_SANDBOX_ENV})`,
+            };
+        }
+        switch (this.mode) {
+            case 'off':
+                return {
+                    enabled: false,
+                    reason: 'mode-off',
+                    detail: this.parsed.source === 'legacy-env'
+                        ? `Chromium sandbox off (${LEGACY_NO_SANDBOX_ENV}=1)`
+                        : `Chromium sandbox off (${CHROMIUM_SANDBOX_ENV}=off)`,
+                };
+            case 'on':
+                return { enabled: true, reason: 'mode-on', detail: `Chromium sandbox on, strict (${CHROMIUM_SANDBOX_ENV}=on)` };
+            case 'auto':
+                return this.decideAuto();
+        }
+    }
+    decideAuto() {
+        if (this.fallenBack !== null) {
+            return {
+                enabled: false,
+                reason: 'auto-fallback',
+                detail: `Chromium sandbox off — ${describeFailure(this.fallenBack)} (learned this process; ${CHROMIUM_SANDBOX_ENV}=auto)`,
+            };
+        }
+        if (this.geteuid() === 0) {
+            return {
+                enabled: false,
+                reason: 'auto-root',
+                detail: `Chromium sandbox off — running as root, and Chromium refuses its sandbox as root (${CHROMIUM_SANDBOX_ENV}=auto)`,
+            };
+        }
+        return { enabled: true, reason: 'auto-default', detail: `Chromium sandbox on (${CHROMIUM_SANDBOX_ENV}=auto)` };
+    }
+    recordFailure(kind) {
+        const current = this.decide();
+        if (current.reason === 'platform-unmanaged') {
+            return {
+                fallBack: false,
+                notice: `Chromium reported a Linux sandbox failure (${describeFailure(kind)}) on ${this.platform}, where the sandbox is not managed by ${CHROMIUM_SANDBOX_ENV}`,
+            };
+        }
+        if (!current.enabled) {
+            return {
+                fallBack: false,
+                notice: current.reason === 'auto-fallback'
+                    ? `Chromium's sandbox already failed on this machine (${describeFailure(this.fallenBack ?? kind)}); the browser runs with --no-sandbox from now on`
+                    : `Chromium reported a sandbox failure (${describeFailure(kind)}) although the sandbox was already off (${current.reason}) — not a sandbox-policy failure`,
+            };
+        }
+        if (this.mode === 'on') {
+            const alternative = kind === 'root-without-flag'
+                ? 'or run minion as a non-root user.'
+                : 'or start the container with a seccomp profile that allows user namespaces.';
+            return {
+                fallBack: false,
+                notice: `Chromium's sandbox cannot start on this machine: ${describeFailure(kind)}. ${CHROMIUM_SANDBOX_ENV}=on forbids running without it — ` +
+                    'unset it (auto) or set it to off, so the container is the isolation boundary the way Playwright and Puppeteer run Chromium in Docker, ' +
+                    alternative,
+            };
+        }
+        if (kind === 'no-usable-sandbox' && !this.inContainer()) {
+            return {
+                fallBack: false,
+                notice: "Chromium found no usable sandbox: this kernel offers no user namespaces and the SUID helper (chrome-sandbox) is not root-owned mode 4755 — " +
+                    `run \`minion doctor browser\` for the one-line fix, or set ${CHROMIUM_SANDBOX_ENV}=off to run without the sandbox.`,
+            };
+        }
+        this.fallenBack = kind;
+        return {
+            fallBack: true,
+            notice: `Chromium's sandbox cannot start on this machine (${describeFailure(kind)}); the browser runs with --no-sandbox from now on — ` +
+                'the container is the isolation boundary here, which is how Playwright and Puppeteer run Chromium in Docker. ' +
+                `Set ${CHROMIUM_SANDBOX_ENV}=on to forbid this, or =off to skip the sandboxed attempt.`,
+        };
+    }
+    inContainer() {
+        if (this.containerCached === null) {
+            try {
+                this.containerCached = this.containerProbe();
+            }
+            catch {
+                this.containerCached = false;
+            }
+        }
+        return this.containerCached;
+    }
+}

package/dist/server/services/browser/stderr-noise-filter.js

@@ -0,0 +1,26 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+const SUPPRESS_PATTERNS = [
+    /WARNING:ui\/gfx\/linux\/gbm_support_x11\.cc.*dri3 extension not supported/,
+    /WARNING:third_party\/webrtc\/rtc_base\/openssl_stream_adapter\.cc.*WebRTC-ForceDtls13/,
+    /INFO:third_party\/blink\/renderer\/modules\/peerconnection\/peer_connection_dependency_factory\.cc.*Running WebRTC/,
+    /INFO:third_party\/blink\/renderer\/platform\/p2p\/ipc_socket_factory\.cc.*Setting new p2p socket buffer limit/,
+    /WARNING:third_party\/webrtc\/call\/rtp_video_sender\.cc.*ULPFEC/,
+    /\[OpenH264\].*Warning:/,
+    /ERROR:third_party\/webrtc\/media\/engine\/simulcast_encoder_adapter\.cc.*\[SEA\] StreamContext ctor parent is null/,
+    /Inconsistent congestion control feedback types/,
+    /Failed to resolve address for [\w-]+\.local/,
+    /Failed to resolve ICE candidate hostname [\w-]+\.local/,
+    /INFO:CONSOLE[:(]\d+.*source: (?:https?|blob:https?|chrome-extension):/,
+];
+export function shouldForwardStderrLine(line, opts) {
+    if (opts.debug)
+        return true;
+    if (!line.trim())
+        return false;
+    for (const pattern of SUPPRESS_PATTERNS) {
+        if (pattern.test(line))
+            return false;
+    }
+    return true;
+}

package/dist/server/services/browser/telemetry.js

@@ -0,0 +1,107 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { trackEvent } from '../analytics.js';
+export const BrowserWebrtcEvents = {
+    CANVAS_STATS: 'browser_canvas_stats',
+    SESSION_STATS: 'browser_session_stats',
+    ICE_STATE: 'browser_webrtc_ice_state',
+    STATS: 'browser_webrtc_stats',
+    PATH: 'browser_webrtc_path',
+    FALLBACK: 'browser_webrtc_fallback',
+    TURN_FETCH: 'browser_webrtc_turn_fetch',
+};
+export const DEFAULT_WEBRTC_STATS_INTERVAL_MS = 10_000;
+export const MIN_WEBRTC_STATS_INTERVAL_MS = 5_000;
+const PII_KEY_DENYLIST = new Set([
+    'url',
+    'href',
+    'src',
+    'origin',
+    'host',
+    'hostname',
+    'pathname',
+    'search',
+    'hash',
+    'title',
+    'document',
+    'dom',
+    'html',
+    'innerhtml',
+    'outerhtml',
+    'content',
+    'text',
+    'textcontent',
+    'value',
+    'placeholder',
+    'cookie',
+]);
+export function sanitizeTelemetryProps(props) {
+    const out = {};
+    for (const [key, value] of Object.entries(props)) {
+        if (PII_KEY_DENYLIST.has(key.toLowerCase()))
+            continue;
+        const sanitized = sanitizeValue(value);
+        if (sanitized !== undefined)
+            out[key] = sanitized;
+    }
+    return out;
+}
+function sanitizeString(value) {
+    if (value.includes('://'))
+        return undefined;
+    if (value.length > 256)
+        return `${value.slice(0, 256)}…[${value.length}]`;
+    return value;
+}
+function isPrimitiveArrayItem(item) {
+    if (typeof item === 'number' || typeof item === 'boolean')
+        return true;
+    return typeof item === 'string' && !item.includes('://') && item.length <= 256;
+}
+function sanitizeValue(value) {
+    if (value === null)
+        return null;
+    if (typeof value === 'string')
+        return sanitizeString(value);
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : undefined;
+    if (typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value))
+        return value.filter(isPrimitiveArrayItem);
+    return undefined;
+}
+export function classifyWebrtcPath(candidateType, relayProtocol) {
+    if (!candidateType)
+        return 'unknown';
+    const ct = candidateType.toLowerCase();
+    if (ct === 'relay') {
+        const proto = (relayProtocol ?? 'udp').toLowerCase();
+        if (proto === 'tls' || proto === 'turns')
+            return 'turn_tls';
+        if (proto === 'tcp')
+            return 'turn_tcp';
+        return 'turn_udp';
+    }
+    if (ct === 'host' || ct === 'srflx' || ct === 'prflx')
+        return 'p2p';
+    return 'unknown';
+}
+function asProps(props) {
+    return props;
+}
+export function trackWebrtcIceState(props) {
+    trackEvent(BrowserWebrtcEvents.ICE_STATE, sanitizeTelemetryProps(asProps(props)));
+}
+export function trackWebrtcPath(props) {
+    trackEvent(BrowserWebrtcEvents.PATH, sanitizeTelemetryProps(asProps(props)));
+}
+export function trackWebrtcFallback(props) {
+    trackEvent(BrowserWebrtcEvents.FALLBACK, sanitizeTelemetryProps(asProps(props)));
+}
+export function trackWebrtcStats(props) {
+    trackEvent(BrowserWebrtcEvents.STATS, sanitizeTelemetryProps(asProps(props)));
+}
+export function trackTurnFetch(props) {
+    trackEvent(BrowserWebrtcEvents.TURN_FETCH, sanitizeTelemetryProps(asProps(props)));
+}

package/dist/server/services/browser/xvfb-supervisor.js

@@ -0,0 +1,139 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { spawn as defaultSpawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+export const XVFB_FB_WIDTH = 3840;
+export const XVFB_FB_HEIGHT = 2160;
+export const XVFB_REAP_GRACE_MS = 2_000;
+export function allocateXvfbDisplayNumber(lockDir = '/tmp', start = 99, range = 100) {
+    for (let n = start; n < start + range; n++) {
+        if (!existsSync(join(lockDir, `.X${n}-lock`))) {
+            return n;
+        }
+    }
+    throw new Error(`No free X display number found in :${start}-:${start + range - 1}`);
+}
+export function shouldRunXvfb(platform = process.platform, env = process.env) {
+    if (platform !== 'linux')
+        return false;
+    if (env.MINIONRY_NO_XVFB === '1')
+        return false;
+    return true;
+}
+export function buildXvfbArgs(displayNumber, fbWidth = XVFB_FB_WIDTH, fbHeight = XVFB_FB_HEIGHT) {
+    return [
+        `:${displayNumber}`,
+        '-screen', '0', `${fbWidth}x${fbHeight}x24`,
+        '+extension', 'RANDR',
+        '-nolisten', 'tcp',
+        '-ac',
+    ];
+}
+export class XvfbSupervisor {
+    spawnFn;
+    platform;
+    env;
+    allocateDisplayNumberFn;
+    reapGraceMs;
+    fbWidth;
+    fbHeight;
+    current = null;
+    exitHook = null;
+    constructor(options = {}) {
+        this.spawnFn = options.spawn ?? defaultSpawn;
+        this.platform = options.platform ?? process.platform;
+        this.env = options.env ?? process.env;
+        this.allocateDisplayNumberFn = options.allocateDisplayNumber ?? (() => allocateXvfbDisplayNumber());
+        this.reapGraceMs = options.reapGraceMs ?? XVFB_REAP_GRACE_MS;
+        this.fbWidth = options.fbWidth ?? XVFB_FB_WIDTH;
+        this.fbHeight = options.fbHeight ?? XVFB_FB_HEIGHT;
+    }
+    start(onError) {
+        if (this.current)
+            return this.current;
+        if (!shouldRunXvfb(this.platform, this.env)) {
+            this.current = { proc: null, displayNumber: null };
+            return this.current;
+        }
+        const displayNumber = this.allocateDisplayNumberFn();
+        const args = buildXvfbArgs(displayNumber, this.fbWidth, this.fbHeight);
+        const spawnOpts = {
+            stdio: 'ignore',
+            detached: false,
+        };
+        const proc = this.spawnFn('Xvfb', args, spawnOpts);
+        if (onError) {
+            proc.on('error', (err) => onError(err));
+        }
+        this.current = { proc, displayNumber };
+        this.installExitHook(proc);
+        return this.current;
+    }
+    getHandle() {
+        return this.current;
+    }
+    async stop() {
+        const handle = this.current;
+        this.current = null;
+        this.uninstallExitHook();
+        if (!handle?.proc)
+            return;
+        const proc = handle.proc;
+        if (proc.exitCode !== null || proc.signalCode !== null) {
+            return;
+        }
+        await new Promise((resolve) => {
+            let settled = false;
+            const onExit = () => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve();
+            };
+            proc.once('exit', onExit);
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                try {
+                    proc.kill('SIGKILL');
+                }
+                catch {   }
+                resolve();
+            }, this.reapGraceMs);
+            try {
+                proc.kill('SIGTERM');
+            }
+            catch {
+                settled = true;
+                clearTimeout(timer);
+                resolve();
+            }
+        });
+    }
+    installExitHook(proc) {
+        if (this.exitHook)
+            return;
+        const hook = () => {
+            try {
+                proc.kill('SIGTERM');
+            }
+            catch {
+            }
+        };
+        this.exitHook = hook;
+        process.once('exit', hook);
+    }
+    uninstallExitHook() {
+        if (!this.exitHook)
+            return;
+        try {
+            process.off('exit', this.exitHook);
+        }
+        catch {
+        }
+        this.exitHook = null;
+    }
+}

package/dist/server/services/browser-frame-policy.js

@@ -0,0 +1,56 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+export const BROWSER_CONTENT_FRAME_TYPES = new Set([
+    'browser_tab_state',
+    'browser_navigation_state',
+    'browser_error',
+    'browser_resize_ack',
+    'browser_preflight_result',
+    'browser_webrtc_offer',
+    'browser_driver_state',
+    'browser_status',
+    'browser_state_update',
+    'browser_session_reset',
+    'browser_input_rejected',
+    'browser_input_focus',
+    'browser_agent_proposed',
+    'browser_agent_step',
+    'browser_agent_done',
+    'browser_webrtc_ice',
+    'browser_webrtc_state',
+    'agent_tab_state',
+]);
+export const E2EE_REQUIRED_ERROR_CODE = 'e2ee_required';
+export function mustRefuseWhenCleartext(type) {
+    return BROWSER_CONTENT_FRAME_TYPES.has(type);
+}
+export function buildE2eeRequiredBrowserError(type) {
+    return {
+        type: 'browser_error',
+        data: {
+            code: E2EE_REQUIRED_ERROR_CODE,
+            message: `Refused to send "${type}": end-to-end encryption is not active for this Space (public Space, or a legacy/incapable viewer is connected).`,
+        },
+    };
+}
+export const BROWSER_CONTENT_SDK_METHODS = new Set([
+    'browser.tabs.list',
+    'browser.tabs.subscribe',
+    'browser.snapshot',
+    'browser.screenshot',
+    'browser.evaluate',
+    'browser.automate',
+    'browser.view.attach',
+    'browser.view.answer',
+    'browser.view.ice',
+    'browser.view.state',
+    'browser.view.input',
+]);
+export function mustRefuseSdkMethodWhenCleartext(method) {
+    return BROWSER_CONTENT_SDK_METHODS.has(method);
+}
+export function e2eeRequiredSdkMessage(method) {
+    return (`${E2EE_REQUIRED_ERROR_CODE}: refused to answer "${method}" — end-to-end encryption is not active ` +
+        `for this Space (public Space, or a legacy/incapable viewer is connected), and browser page content ` +
+        `has no safe cleartext fallback.`);
+}

package/dist/server/services/client-id.js

@@ -0,0 +1,32 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { resolveClientId } from '../../bin/machine-identity.js';
+import { machineFile } from '../../bin/machine-layout.js';
+function clientIdFile() {
+    return machineFile('clientId');
+}
+let resolved = null;
+function resolveOnce() {
+    if (resolved)
+        return resolved;
+    const outcome = resolveClientId();
+    if (outcome.rotated) {
+        console.warn(`[identity] This home directory was last used on a different machine. `
+            + `Minted a new device identity ${outcome.clientId} (was ${outcome.previousClientId}) `
+            + `so this machine does not evict the original. Run "minion login --force" to register it.`);
+    }
+    resolved = { clientId: outcome.clientId, fingerprint: outcome.fingerprint };
+    return resolved;
+}
+export function getClientId() {
+    return resolveOnce().clientId;
+}
+export function getMachineFingerprint() {
+    return resolveOnce().fingerprint;
+}
+export function getClientIdPath() {
+    return clientIdFile();
+}
+export function _resetClientIdCacheForTests() {
+    resolved = null;
+}