@monoes/monobrowse 1.0.0 → 1.0.2

package/src/browser/workflow/builtin-handlers.ts

@@ -1,379 +0,0 @@
-// Built-in node handlers registered for every `browse workflow run` invocation.
-//
-// action.http         — fetch a URL (GET/POST/etc.) and put the response in item.data
-// action.save_file    — write item data or binaryBase64 to a file on disk
-// action.log          — console.log each item (useful for debugging workflows)
-// action.gemini_image — generate image via Gemini web app (browser automation + session store)
-//                       or Imagen REST API (GEMINI_API_KEY), or mock mode
-import { writeFile, readFile, mkdir, chmod } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
-
-/** Resolve a user-supplied path and assert it stays within the working directory. */
-function safeResolvePath(rawPath: string): string {
-  const cwd = process.cwd();
-  const safePath = resolve(cwd, rawPath);
-  if (safePath !== cwd && !safePath.startsWith(cwd + '/')) {
-    throw new Error(`Path traversal blocked: "${rawPath}" resolves outside working directory`);
-  }
-  return safePath;
-}
-import type { NodeHandler } from './engine.js';
-import type { Item } from './types.js';
-
-// ---------------------------------------------------------------------------
-// Session persistence (shared format with browse-platform.ts)
-// ---------------------------------------------------------------------------
-
-const SESSIONS_FILE = join(homedir(), '.monomind', 'sessions.json');
-
-interface StoredSession {
-  id: string;
-  platform: string;
-  username: string;
-  cookies: string;   // JSON-serialized CDP cookie array
-  userAgent: string;
-  createdAt: number;
-  lastUsedAt: number;
-}
-
-async function loadStoredSession(platform: string): Promise<StoredSession | null> {
-  if (!existsSync(SESSIONS_FILE)) return null;
-  try {
-    const sessions: StoredSession[] = JSON.parse(await readFile(SESSIONS_FILE, 'utf-8'));
-    return sessions.find(s => s.platform === platform) ?? null;
-  } catch { return null; }
-}
-
-async function saveStoredSession(
-  platform: string,
-  cookies: object[],
-  userAgent: string,
-  username: string,
-): Promise<void> {
-  let sessions: StoredSession[] = [];
-  if (existsSync(SESSIONS_FILE)) {
-    try { sessions = JSON.parse(await readFile(SESSIONS_FILE, 'utf-8')); } catch { /* start fresh */ }
-  }
-  const id = `${platform}:${username}`;
-  const now = Date.now();
-  const existing = sessions.findIndex(s => s.platform === platform);
-  const entry: StoredSession = {
-    id, platform, username, userAgent,
-    cookies: JSON.stringify(cookies),
-    createdAt: existing >= 0 ? sessions[existing].createdAt : now,
-    lastUsedAt: now,
-  };
-  if (existing >= 0) sessions[existing] = entry; else sessions.push(entry);
-  await mkdir(join(homedir(), '.monomind'), { recursive: true });
-  await writeFile(SESSIONS_FILE, JSON.stringify(sessions, null, 2));
-  await chmod(SESSIONS_FILE, 0o600);
-}
-
-// ---------------------------------------------------------------------------
-// Gemini browser automation
-// ---------------------------------------------------------------------------
-
-const GEMINI_IMAGE_CHECK = `
-  (() => {
-    const imgs = Array.from(document.querySelectorAll('img'));
-    return imgs.some(img =>
-      img.complete && img.naturalWidth > 200 && img.naturalHeight > 200 &&
-      img.src && !img.src.includes('icon') && !img.src.includes('avatar') &&
-      !img.src.includes('logo') && !img.src.includes('profile')
-    );
-  })()
-`;
-
-const GEMINI_IMAGE_SRC = `
-  (() => {
-    const imgs = Array.from(document.querySelectorAll('img'));
-    const c = imgs.filter(img =>
-      img.complete && img.naturalWidth > 200 && img.naturalHeight > 200 &&
-      img.src && !img.src.includes('icon') && !img.src.includes('avatar') &&
-      !img.src.includes('logo') && !img.src.includes('profile')
-    );
-    return c.length ? c[c.length - 1].src : '';
-  })()
-`;
-
-// Generate an image via the Gemini web app, with session management.
-// Flow: connect → restore saved session → if not logged in, wait for user login → generate.
-// Returns the saved file path, or null if Chrome is not available.
-async function generateViaGeminiBrowser(
-  prompt: string,
-  outputPath: string,
-  cdpPort: number,
-): Promise<string | null> {
-  let browser: typeof import('../index.js');
-  try { browser = await import('../index.js'); } catch { return null; }
-
-  let conn: Awaited<ReturnType<typeof browser.connectToTarget>>;
-  try { conn = await browser.connectToTarget(cdpPort); } catch { return null; }
-
-  const { client, sessionId } = conn;
-  const refs = new Map();
-
-  try {
-    // Restore stored Gemini session cookies before navigating
-    const stored = await loadStoredSession('gemini');
-    if (stored?.cookies) {
-      try {
-        const cookies = JSON.parse(stored.cookies) as object[];
-        if (cookies.length > 0) {
-          await browser.setCookies(client, sessionId, cookies as Parameters<typeof browser.setCookies>[2]);
-        }
-      } catch { /* ignore malformed cookies */ }
-    }
-
-    // Navigate to Gemini
-    await browser.openUrl(client, sessionId, 'https://gemini.google.com/app');
-
-    // Dismiss cookie consent if present
-    const refs2 = new Map();
-    const consentBtn = await browser.findByRole(client, sessionId, refs2, 'button', { name: 'Accept all' }).catch(() => null);
-    if (consentBtn) {
-      await browser.clickElement(client, sessionId, consentBtn);
-      await new Promise(r => setTimeout(r, 1500));
-    }
-
-    // Check if logged in — .ql-editor only appears when authenticated
-    let inputRef = await browser.findBySelector(client, sessionId, refs, '.ql-editor').catch(() => null);
-
-    if (!inputRef) {
-      // Not logged in — ask the user to authenticate
-      console.log('');
-      console.log('┌─────────────────────────────────────────────────────────┐');
-      console.log('│  Gemini login required                                  │');
-      console.log('│                                                         │');
-      console.log('│  A browser window has been opened to Gemini.            │');
-      console.log('│  Please sign in with your Google account.               │');
-      console.log('│                                                         │');
-      console.log('│  The workflow will resume automatically after login.    │');
-      console.log('│  Waiting up to 5 minutes…                               │');
-      console.log('└─────────────────────────────────────────────────────────┘');
-      console.log('');
-
-      // Navigate to Google sign-in
-      await browser.openUrl(client, sessionId, 'https://accounts.google.com/signin/v2/identifier');
-
-      // Wait up to 5 min for the user to complete login and land back on Gemini
-      const loginDeadline = Date.now() + 5 * 60 * 1000;
-      let loggedIn = false;
-      while (Date.now() < loginDeadline) {
-        await new Promise(r => setTimeout(r, 2000));
-        const url = await browser.getCurrentUrl(client, sessionId).catch(() => '');
-        if (url.includes('gemini.google.com')) {
-          inputRef = await browser.findBySelector(client, sessionId, refs, '.ql-editor').catch(() => null);
-          if (inputRef) { loggedIn = true; break; }
-        }
-      }
-
-      if (!loggedIn) {
-        console.log('[action.gemini_image] Login timeout. Run: monomind browse platform connect gemini');
-        return null;
-      }
-
-      console.log('[action.gemini_image] Login detected! Saving session...');
-    }
-
-    // Save/refresh cookies after confirming login
-    const liveCookies = await browser.getCookies(client, sessionId).catch(() => []);
-    const userAgent = await browser.evaluateJs(client, sessionId, 'navigator.userAgent').catch(() => 'unknown') as string;
-    const username = await browser.evaluateJs(
-      client, sessionId,
-      "document.querySelector('.gb_A.gb_Sa')?.textContent?.trim() ?? 'gemini-user'"
-    ).catch(() => 'gemini-user') as string;
-    await saveStoredSession('gemini', liveCookies, String(userAgent), String(username));
-
-    // Ensure we're on the app page with the input visible
-    if (!inputRef) {
-      await browser.openUrl(client, sessionId, 'https://gemini.google.com/app');
-      inputRef = await browser.findBySelector(client, sessionId, refs, '.ql-editor').catch(() => null);
-    }
-    if (!inputRef) return null;
-
-    // Fill and submit the prompt
-    await browser.fillElement(client, sessionId, inputRef, prompt);
-    await new Promise(r => setTimeout(r, 300));
-    await browser.pressKey(client, sessionId, 'Return');
-    console.log('[action.gemini_image] Prompt submitted to Gemini, waiting for image...');
-
-    // Poll up to 90s for generated image
-    const deadline = Date.now() + 90_000;
-    while (Date.now() < deadline) {
-      const found = await browser.evaluateJs(client, sessionId, GEMINI_IMAGE_CHECK).catch(() => false);
-      if (found) break;
-      await new Promise(r => setTimeout(r, 500));
-    }
-
-    await mkdir(dirname(outputPath), { recursive: true });
-
-    // Extract image URL and download
-    const imgSrc = (await browser.evaluateJs(client, sessionId, GEMINI_IMAGE_SRC).catch(() => '')) as string;
-    if (imgSrc && (imgSrc.startsWith('https://') || imgSrc.startsWith('http://'))) {
-      try {
-        const resp = await fetch(imgSrc);
-        if (resp.ok) {
-          await writeFile(outputPath, Buffer.from(await resp.arrayBuffer()));
-          console.log(`[action.gemini_image] Image saved → ${outputPath}`);
-          return outputPath;
-        }
-      } catch { /* fall through to screenshot */ }
-    }
-
-    // Fallback: screenshot the response
-    const screenshotPath = outputPath.replace(/\.(png|jpe?g|webp)$/i, '') + '-screenshot.png';
-    const ss = await browser.captureScreenshot(client, sessionId, { path: screenshotPath, fullPage: true }).catch(() => null);
-    if (ss) { console.log(`[action.gemini_image] Screenshot saved → ${ss.path}`); return ss.path; }
-
-    return null;
-  } finally {
-    client.close();
-  }
-}
-
-export function createBuiltinHandlers(): Map<string, NodeHandler> {
-  const handlers = new Map<string, NodeHandler>();
-
-  // action.http
-  // config: { url, method?, headers?, body?, responseField? }
-  // Puts { statusCode, body, json? } into item.data[responseField ?? 'response']
-  handlers.set('action.http', async (items, config) => {
-    const url = String(config['url'] ?? '');
-    const method = String(config['method'] ?? 'GET').toUpperCase();
-    const headers = (config['headers'] as Record<string, string>) ?? {};
-    const body = config['body'] !== undefined ? JSON.stringify(config['body']) : undefined;
-    const responseField = String(config['responseField'] ?? 'response');
-
-    const res = await fetch(url, {
-      method,
-      headers: { 'Content-Type': 'application/json', ...headers },
-      body: method !== 'GET' && method !== 'HEAD' ? body : undefined,
-    });
-
-    const text = await res.text();
-    let json: unknown;
-    try { json = JSON.parse(text); } catch { /* not JSON */ }
-
-    return items.map(item => ({
-      ...item,
-      data: {
-        ...item.data,
-        [responseField]: { statusCode: res.status, body: text, json },
-      },
-    }));
-  });
-
-  // action.save_file
-  // config: { path, content?, field?, encoding? }
-  // Writes item.data[field] (or binaryBase64 decoded) to disk
-  handlers.set('action.save_file', async (items, config) => {
-    const results: Item[] = [];
-    for (const item of items) {
-      const outPath = safeResolvePath(String(config['path'] ?? './output.txt'));
-      const field = config['field'] as string | undefined;
-      const encoding = String(config['encoding'] ?? 'utf8');
-
-      await mkdir(dirname(outPath), { recursive: true });
-
-      if (item.binaryBase64) {
-        await writeFile(outPath, Buffer.from(item.binaryBase64, 'base64'));
-      } else {
-        const content = field
-          ? JSON.stringify(item.data[field] ?? '', null, 2)
-          : (config['content'] as string ?? JSON.stringify(item.data, null, 2));
-        await writeFile(outPath, content, encoding as BufferEncoding);
-      }
-
-      results.push({ ...item, data: { ...item.data, savedPath: outPath } });
-    }
-    return results;
-  });
-
-  // action.log
-  // config: { label? }
-  handlers.set('action.log', async (items, config) => {
-    const label = String(config['label'] ?? 'action.log');
-    for (const item of items) {
-      console.log(`[${label}]`, JSON.stringify(item.data, null, 2));
-    }
-    return items;
-  });
-
-  // action.gemini_image
-  // config: { prompt, cdpPort?, outputPath?, apiKey?, model?, aspectRatio? }
-  // Priority: (1) Gemini web browser via CDP port 9222, (2) Imagen REST API, (3) mock
-  handlers.set('action.gemini_image', async (items, config) => {
-    const cdpPort = Number(config['cdpPort'] ?? process.env['GEMINI_CDP_PORT'] ?? 9222);
-    const apiKey = String(config['apiKey'] ?? process.env['GEMINI_API_KEY'] ?? process.env['GOOGLE_API_KEY'] ?? '');
-    const model = String(config['model'] ?? 'imagen-3.0-generate-001');
-    const aspectRatio = String(config['aspectRatio'] ?? '1:1');
-    const outputPath = config['outputPath'] as string | undefined;
-
-    const results: Item[] = [];
-
-    for (const item of items) {
-      const prompt = String(config['prompt'] ?? item.data['prompt'] ?? '');
-      const filePath = safeResolvePath(outputPath ?? `./output/gemini-image-${Date.now()}.png`);
-
-      // Priority 1: Browser automation via authenticated Chrome session
-      const browserPath = await generateViaGeminiBrowser(prompt, filePath, cdpPort);
-      if (browserPath) {
-        results.push({
-          ...item,
-          data: { ...item.data, prompt, generatedImagePath: browserPath, source: 'gemini-browser' },
-        });
-        continue;
-      }
-
-      // Priority 2: Gemini Imagen REST API
-      if (apiKey) {
-        console.log(`[action.gemini_image] Browser unavailable — trying Imagen REST API`);
-        const url = `https://generativelanguage.googleapis.com/v1beta/models/${model}:predict?key=${apiKey}`;
-        const res = await fetch(url, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            instances: [{ prompt }],
-            parameters: { sampleCount: 1, aspectRatio },
-          }),
-        });
-
-        if (!res.ok) throw new Error(`Gemini Imagen API error ${res.status}: ${await res.text()}`);
-
-        const data = await res.json() as { predictions?: { bytesBase64Encoded?: string; mimeType?: string }[] };
-        const prediction = data.predictions?.[0];
-        if (!prediction?.bytesBase64Encoded) throw new Error('No image data in Gemini response');
-
-        await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(filePath, Buffer.from(prediction.bytesBase64Encoded, 'base64'));
-
-        results.push({
-          ...item,
-          data: { ...item.data, prompt, generatedImagePath: filePath, mimeType: prediction.mimeType ?? 'image/png', source: 'gemini-api' },
-          binaryBase64: prediction.bytesBase64Encoded,
-        });
-        continue;
-      }
-
-      // Priority 3: Mock mode — no browser on port 9222 and no API key
-      console.log(`[action.gemini_image] No browser on port ${cdpPort} and no API key — mock mode.`);
-      console.log(`  Prompt: "${prompt}"`);
-      results.push({
-        ...item,
-        data: {
-          ...item.data,
-          prompt,
-          mockMode: true,
-          note: `Set GEMINI_CDP_PORT env var (default: 9222) for browser mode, or GEMINI_API_KEY for REST API`,
-        },
-      });
-    }
-
-    return results;
-  });
-
-  return handlers;
-}

package/src/browser/workflow/engine.ts

@@ -1,202 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { resolveExpression, resolveConfig } from './expression.js';
-import { getDashboard } from '../dashboard/server.js';
-import type { WorkflowDef, NodeDef, Item, RunRecord, StepEvent, RunStatus } from './types.js';
-
-export type NodeHandler = (items: Item[], config: Record<string, unknown>) => Promise<Item[]>;
-
-export interface EngineOptions {
-  handlers?: Map<string, NodeHandler>;
-  onEvent?: (event: StepEvent) => void;
-  signal?: AbortSignal;
-  params?: Record<string, string>;
-}
-
-export async function runWorkflow(
-  def: WorkflowDef,
-  options: EngineOptions = {},
-): Promise<RunRecord> {
-  const { handlers = new Map(), onEvent = () => {}, signal, params = {} } = options;
-  const runId = randomUUID();
-  const startedAt = Date.now();
-
-  // Build a unified abort controller that merges the caller's signal with dashboard stop-requests.
-  const controller = new AbortController();
-  if (signal) {
-    if (signal.aborted) {
-      controller.abort();
-    } else {
-      signal.addEventListener('abort', () => controller.abort(), { once: true });
-    }
-  }
-  const dashboard = getDashboard();
-  let stopPollTimer: ReturnType<typeof setInterval> | undefined;
-  if (dashboard) {
-    stopPollTimer = setInterval(() => {
-      if (dashboard.isStopRequested(runId)) controller.abort();
-    }, 500);
-    // Avoid keeping Node.js event loop alive if nothing else is running
-    stopPollTimer.unref?.();
-  }
-
-  const emit = (partial: Omit<StepEvent, 'runId' | 'workflowId' | 'workflowName' | 'timestamp'>) =>
-    onEvent({ runId, workflowId: def.id, workflowName: def.name, timestamp: Date.now(), ...partial });
-
-  emit({ nodeId: '', nodeName: '', eventType: 'run_started' });
-
-  // Build adjacency structures
-  const nodeMap = new Map(def.nodes.map(n => [n.id, n]));
-  const inDegree = new Map<string, number>(def.nodes.map(n => [n.id, 0]));
-  const outEdges = new Map<string, { to: string; handle?: string }[]>();
-  const toEdges = new Map<string, { from: string; handle?: string }[]>();
-
-  for (const conn of def.connections) {
-    inDegree.set(conn.to, (inDegree.get(conn.to) ?? 0) + 1);
-    const edges = outEdges.get(conn.from) ?? [];
-    edges.push({ to: conn.to, handle: conn.handle });
-    outEdges.set(conn.from, edges);
-    const toList = toEdges.get(conn.to) ?? [];
-    toList.push({ from: conn.from, handle: conn.handle });
-    toEdges.set(conn.to, toList);
-  }
-
-  // Kahn's topological sort
-  const queue: string[] = [];
-  const sorted: string[] = [];
-  for (const [id, deg] of inDegree) {
-    if (deg === 0) queue.push(id);
-  }
-  while (queue.length > 0) {
-    const id = queue.shift()!;
-    sorted.push(id);
-    for (const edge of outEdges.get(id) ?? []) {
-      const newDeg = (inDegree.get(edge.to) ?? 0) - 1;
-      inDegree.set(edge.to, newDeg);
-      if (newDeg === 0) queue.push(edge.to);
-    }
-  }
-  if (sorted.length !== def.nodes.length) {
-    throw new Error('Workflow contains a cycle');
-  }
-
-  // Node output accumulator
-  const nodeOutputs = new Map<string, Item[]>();
-  let itemsProcessed = 0;
-  let runStatus: RunStatus = 'completed';
-  let runError: string | undefined;
-
-  try {
-    for (const nodeId of sorted) {
-      if (controller.signal.aborted) {
-        runStatus = 'stopped';
-        emit({ nodeId, nodeName: nodeId, eventType: 'run_stopped' });
-        break;
-      }
-
-      const node = nodeMap.get(nodeId)!;
-      const nodeName = node.name ?? node.id;
-      const t0 = Date.now();
-
-      // Collect inputs from predecessor outputs
-      const inputItems = collectInputs(nodeId, nodeOutputs, toEdges);
-
-      emit({ nodeId, nodeName, eventType: 'step_started', itemTotal: inputItems.length });
-
-      try {
-        const outputs = await executeNode(node, inputItems, handlers, nodeOutputs, params, def.allowEnvAccess);
-        nodeOutputs.set(nodeId, outputs);
-        itemsProcessed += outputs.length;
-        emit({ nodeId, nodeName, eventType: 'step_completed', durationMs: Date.now() - t0, itemTotal: outputs.length });
-      } catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        emit({ nodeId, nodeName, eventType: 'step_failed', error, durationMs: Date.now() - t0 });
-        if (node.onError === 'skip') {
-          nodeOutputs.set(nodeId, []);
-        } else {
-          runStatus = 'failed';
-          runError = error;
-          break;
-        }
-      }
-    }
-  } finally {
-    if (stopPollTimer !== undefined) clearInterval(stopPollTimer);
-  }
-
-  const completedAt = Date.now();
-  const record: RunRecord = {
-    id: runId,
-    workflowId: def.id,
-    workflowName: def.name,
-    status: runStatus,
-    startedAt,
-    completedAt,
-    itemsProcessed,
-    itemsTotal: itemsProcessed,
-    error: runError,
-  };
-
-  emit({ nodeId: '', nodeName: '', eventType: runStatus === 'completed' ? 'run_completed' : 'run_stopped', error: runError });
-  return record;
-}
-
-function collectInputs(nodeId: string, nodeOutputs: Map<string, Item[]>, toEdges: Map<string, { from: string; handle?: string }[]>): Item[] {
-  const predecessors = toEdges.get(nodeId) ?? [];
-  if (predecessors.length === 0) return [{ data: {} }];
-  return predecessors.flatMap(({ from, handle }) => {
-    const items = nodeOutputs.get(from) ?? [];
-    if (handle === 'true') return items.filter(item => item.data['__ifResult'] === true);
-    if (handle === 'false') return items.filter(item => item.data['__ifResult'] === false);
-    return items;
-  });
-}
-
-async function executeNode(
-  node: NodeDef,
-  inputs: Item[],
-  handlers: Map<string, NodeHandler>,
-  nodeOutputs: Map<string, Item[]>,
-  params: Record<string, string>,
-  allowEnvAccess?: boolean,
-): Promise<Item[]> {
-  const allOutputs: Record<string, Item[]> = Object.fromEntries(nodeOutputs);
-  const { type, config } = node;
-
-  if (type === 'trigger.manual') {
-    const items = config['items'];
-    if (Array.isArray(items)) return items as Item[];
-    return inputs;
-  }
-
-  if (type === 'core.set') {
-    return inputs.map(item => {
-      const resolved = resolveConfig(config, item, allOutputs, params, allowEnvAccess);
-      return { ...item, data: { ...item.data, ...resolved } };
-    });
-  }
-
-  if (type === 'core.filter') {
-    const predicate = config['expression'] as string;
-    return inputs.filter(item => {
-      try {
-        return Boolean(resolveExpression(predicate, item, allOutputs, params, allowEnvAccess));
-      } catch {
-        return false;
-      }
-    });
-  }
-
-  if (type === 'core.if') {
-    const predicate = config['expression'] as string;
-    return inputs.map(item => {
-      const result = Boolean(resolveExpression(predicate, item, allOutputs, params, allowEnvAccess));
-      return { ...item, data: { ...item.data, __ifResult: result } };
-    });
-  }
-
-  // action.* — delegate to registered handler
-  const handler = handlers.get(type);
-  if (!handler) throw new Error(`No handler registered for node type: ${type}`);
-  const resolvedConfig = resolveConfig(config, inputs[0] ?? { data: {} }, allOutputs, params, allowEnvAccess);
-  return handler(inputs, resolvedConfig);
-}

package/src/browser/workflow/expression.ts

@@ -1,107 +0,0 @@
-import type { Item } from './types.js';
-
-const TEMPLATE_PATTERN = '\\{\\{([^}]+)\\}\\}';
-
-/** Env var names matching this pattern are blocked from $env expressions to prevent secret exfiltration. */
-const ENV_DENYLIST = /(_KEY|_TOKEN|_SECRET|_PASSWORD|_JWT|_API_KEY|_PRIVATE_KEY|_PASS|_PWD|_CERT|_PEM|_CREDENTIAL|_CREDENTIALS|_AUTH)$/i;
-type ParsedTemplate = RegExpMatchArray[];
-const cache = new Map<string, ParsedTemplate>();
-
-function extractTemplates(template: string): ParsedTemplate {
-  if (cache.has(template)) return cache.get(template)!;
-  // LRU eviction: drop the oldest entry rather than clearing all at once (thundering-herd).
-  if (cache.size >= 500) {
-    const oldest = cache.keys().next().value;
-    if (oldest !== undefined) cache.delete(oldest);
-  }
-  const matches = [...template.matchAll(new RegExp(TEMPLATE_PATTERN, 'g'))];
-  cache.set(template, matches);
-  return matches;
-}
-
-export function resolveExpression(
-  template: string,
-  item: Item,
-  nodeOutputs: Record<string, Item[]>,
-  params: Record<string, string>,
-  allowEnvAccess?: boolean,
-): string {
-  const matches = extractTemplates(template);
-  if (matches.length === 0) return template;
-
-  let result = template;
-  for (const match of matches) {
-    const expr = match[1].trim();
-    const value = resolveToken(expr, item, nodeOutputs, params, allowEnvAccess);
-    result = result.split(match[0]).join(String(value));
-  }
-  return result;
-}
-
-function resolveToken(
-  expr: string,
-  item: Item,
-  nodeOutputs: Record<string, Item[]>,
-  params: Record<string, string>,
-  allowEnvAccess?: boolean,
-): unknown {
-  if (expr.startsWith('$json.')) {
-    const key = expr.slice(6);
-    if (!(key in item.data)) throw new Error(`Unresolved: $json.${key} not found in item data`);
-    return item.data[key];
-  }
-  if (expr.startsWith('$env.')) {
-    const key = expr.slice(5);
-    if (!allowEnvAccess && ENV_DENYLIST.test(key)) {
-      throw new Error(
-        `Blocked: env var "${key}" matches secret pattern. Set allowEnvAccess: true in workflow config to override.`,
-      );
-    }
-    const val = process.env[key];
-    if (val === undefined) throw new Error(`Unresolved: $env.${key} not set`);
-    return val;
-  }
-  if (expr.startsWith('params.')) {
-    const key = expr.slice(7);
-    if (!(key in params)) throw new Error(`Unresolved: params.${key} not provided`);
-    return params[key];
-  }
-  if (expr.startsWith('$node.') || expr.startsWith('$node["')) {
-    let nodeId: string;
-    let field: string;
-    if (expr.startsWith('$node["')) {
-      // $node["NodeId"].field
-      const bracketEnd = expr.indexOf('"].');
-      if (bracketEnd === -1) throw new Error(`Unresolved: malformed $node bracket expression: ${expr}`);
-      nodeId = expr.slice(7, bracketEnd);       // slice off '$node["'
-      field = expr.slice(bracketEnd + 3);       // slice off '"].'
-    } else {
-      // $node.NodeId.field
-      const parts = expr.slice(6).split('.');
-      nodeId = parts[0];
-      field = parts.slice(1).join('.');
-    }
-    const items = nodeOutputs[nodeId];
-    if (!items || items.length === 0) throw new Error(`Unresolved: $node.${nodeId} has no output`);
-    const val = items[0].data[field];
-    if (val === undefined) throw new Error(`Unresolved: $node.${nodeId}.${field} not found`);
-    return val;
-  }
-  // Named ref (e.g. {{box}} from a find step) — action executor resolves these using its element handle map
-  return `{{${expr}}}`;
-}
-
-// Note: only resolves top-level string values. Nested objects/arrays are passed through unchanged.
-export function resolveConfig(
-  config: Record<string, unknown>,
-  item: Item,
-  nodeOutputs: Record<string, Item[]>,
-  params: Record<string, string>,
-  allowEnvAccess?: boolean,
-): Record<string, unknown> {
-  const result: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(config)) {
-    result[k] = typeof v === 'string' ? resolveExpression(v, item, nodeOutputs, params, allowEnvAccess) : v;
-  }
-  return result;
-}

package/src/browser/workflow/index.ts

@@ -1,5 +0,0 @@
-export * from './types.js';
-export * from './store.js';
-export * from './engine.js';
-export * from './expression.js';
-export * from './builtin-handlers.js';