@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/commands/qa-scan-browser-launch.js

@@ -1 +1,55 @@
-import{lstatSync as i,realpathSync as h,mkdtempSync as l,mkdirSync as u,rmSync as b}from"node:fs";import{join as c}from"node:path";import{tmpdir as d}from"node:os";import{chromium as m}from"playwright-core";function f(n=process){return Object.freeze({headless:!0,timeout:15e3,...n.platform==="linux"&&n.arch==="arm64"?{executablePath:"/usr/bin/chromium"}:{channel:"chrome"}})}async function v(n=process){const o=f(n);if(o.executablePath)try{for(const r of["/","/usr","/usr/bin",o.executablePath]){const t=i(r);if(h(r)!==r||t.uid!==0||(t.mode&18)!==0||(r===o.executablePath?!t.isFile()||(t.mode&73)===0:!t.isDirectory()))throw new Error("qa-scan-browser-unavailable")}}catch{throw new Error("qa-scan-browser-unavailable")}if(!o.executablePath)return m.launch(o);const e=l(c(d(),"neocortex-qa-browser-")),a=i(e),s=()=>{try{const r=i(e);!r.isSymbolicLink()&&r.isDirectory()&&r.dev===a.dev&&r.ino===a.ino&&r.uid===a.uid&&b(e,{recursive:!0})}catch{}};try{u(c(e,"config"),{mode:448}),u(c(e,"cache"),{mode:448});const r=await m.launch({...o,env:{PATH:"/usr/bin:/bin",LANG:"C.UTF-8",HOME:e,XDG_CONFIG_HOME:c(e,"config"),XDG_CACHE_HOME:c(e,"cache")}});return r.once("disconnected",s),r}catch(r){throw s(),r}}export{v as launchRootQaBrowser,f as rootQaBrowserLaunchOptions};
+/** Fixed host browser selection. Caller payloads never choose an executable. */
+import { lstatSync, realpathSync, mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { chromium } from 'playwright-core';
+export function rootQaBrowserLaunchOptions(host = process) {
+    return Object.freeze({ headless: true, timeout: 15000,
+        ...(host.platform === 'linux' && host.arch === 'arm64'
+            ? { executablePath: '/usr/bin/chromium' } : { channel: 'chrome' }) });
+}
+export async function launchRootQaBrowser(host = process) {
+    const options = rootQaBrowserLaunchOptions(host);
+    if (options.executablePath) {
+        try {
+            for (const path of ['/', '/usr', '/usr/bin', options.executablePath]) {
+                const stat = lstatSync(path);
+                if (realpathSync(path) !== path || stat.uid !== 0 || (stat.mode & 0o022) !== 0
+                    || (path === options.executablePath ? !stat.isFile() || (stat.mode & 0o111) === 0 : !stat.isDirectory())) {
+                    throw new Error('qa-scan-browser-unavailable');
+                }
+            }
+        }
+        catch {
+            throw new Error('qa-scan-browser-unavailable');
+        }
+    }
+    if (!options.executablePath)
+        return chromium.launch(options);
+    const home = mkdtempSync(join(tmpdir(), 'neocortex-qa-browser-'));
+    const identity = lstatSync(home);
+    const cleanup = () => {
+        try {
+            const current = lstatSync(home);
+            if (!current.isSymbolicLink() && current.isDirectory()
+                && current.dev === identity.dev && current.ino === identity.ino && current.uid === identity.uid) {
+                rmSync(home, { recursive: true });
+            }
+        }
+        catch { /* Browser shutdown cannot remove a replaced or unavailable directory. */ }
+    };
+    try {
+        mkdirSync(join(home, 'config'), { mode: 0o700 });
+        mkdirSync(join(home, 'cache'), { mode: 0o700 });
+        const browser = await chromium.launch({ ...options, env: {
+                PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', HOME: home,
+                XDG_CONFIG_HOME: join(home, 'config'), XDG_CACHE_HOME: join(home, 'cache'),
+            } });
+        browser.once('disconnected', cleanup);
+        return browser;
+    }
+    catch (error) {
+        cleanup();
+        throw error;
+    }
+}

package/packages/client/dist/commands/qa-scan-browser-route.js

@@ -1 +1,28 @@
-async function c(a,i,n){const e=async()=>{n(),await a.abort("blockedbyclient").catch(()=>{})};if(!i){await e();return}let t;try{if(t=await a.fetch({maxRedirects:0,maxRetries:0,timeout:15e3}),t.status()>=300&&t.status()<400){await e();return}await a.fulfill({response:t})}catch{await e()}finally{await t?.dispose().catch(()=>{})}}export{c as routeRootQaScanRequest};
+export async function routeRootQaScanRequest(route, allowed, onDenied) {
+    const deny = async () => {
+        onDenied();
+        await route.abort('blockedbyclient').catch(() => undefined);
+    };
+    if (!allowed) {
+        await deny();
+        return;
+    }
+    let response;
+    try {
+        // route.continue() lets the browser follow a redirect without a second
+        // routing callback. Fetch exactly this hop, inspect it, then fulfill only
+        // a non-redirect response; never fulfill a redirect back to the browser.
+        response = await route.fetch({ maxRedirects: 0, maxRetries: 0, timeout: 15_000 });
+        if (response.status() >= 300 && response.status() < 400) {
+            await deny();
+            return;
+        }
+        await route.fulfill({ response });
+    }
+    catch {
+        await deny();
+    }
+    finally {
+        await response?.dispose().catch(() => undefined);
+    }
+}