@pa1nd/horse-browser 0.4.0 → 0.5.0

package/SKILL.md

@@ -78,7 +78,7 @@ self.listTabs(label: string) -> Promise<Tab[]>
 //   }
 ```
 
-**`bh_open` / `bh_list` / `bh_switch_tab` are pre-installed.** `install.sh` writes them into browser-harness's `agent-workspace/agent_helpers.py` (which auto-loads on every call), so they're available immediately — just call `bh_open(url)`.
+**`bh_open` / `bh_list` / `bh_switch_tab` are pre-installed.** `install.sh` writes them to browser-harness's `agent-workspace/horse_helpers.py`, loaded on every call via a small stub it adds once to `agent_helpers.py` (your own additions to that file are never touched), so they're available immediately — just call `bh_open(url)`.
 
 If `bh_open` is somehow undefined (a browser-harness checkout that never ran our `install.sh`), re-run `horse-browser`'s `install.sh` to install them — don't hand-roll your own; the focus-safe behaviour is subtle. You pass CDP `targetId`s only — the extension bridges to chrome `tabId`s internally.
 

package/agent-helpers.py

@@ -1,8 +1,10 @@
 # horse-browser helpers for browser-harness.
 #
-# install.sh appends these into browser-harness's agent-workspace/agent_helpers.py
-# (which auto-loads on every browser-harness call), so bh_open() is available on
-# the first run — no agent has to install the recipe by hand.
+# install.sh installs this file as <workspace>/horse_helpers.py and appends a
+# load-once stub to agent_helpers.py (which browser-harness auto-loads on every
+# call), so bh_open() is available on the first run — no agent has to install the
+# recipe by hand. Updates overwrite horse_helpers.py only; anything a user keeps
+# in agent_helpers.py itself is never touched.
 #
 # What they give you (pass CDP targetIds; the extension bridges to chrome tabIds):
 #   bh_open(url)         open a tab WITHOUT raising the browser over your macOS app,
@@ -213,3 +215,48 @@ def bh_open(url):
 
 def bh_list():
     return ext_call("listTabs", _session_id()) or [] if _session_id() else []
+
+
+# ── screenshots: a unique file per call ──────────────────────────────────────────
+# Stock capture_screenshot() defaults every call — from EVERY session's daemon — to
+# the ONE shared file <tmp>/shot.png. With concurrent sessions, a neighbour overwrites
+# it between this session writing the shot and the agent Reading the path it printed,
+# so the "screenshot" shows another session's tab. Same namespace-merge trick as cdp()
+# above: defining capture_screenshot here replaces the stock one everywhere. Each call
+# mints its own file (named after the session's daemon lane) and returns that path, so
+# the agent's existing print-the-path-then-Read flow just works.
+from browser_harness.helpers import capture_screenshot as _real_capture_screenshot
+from browser_harness import _ipc as _bh_ipc
+
+_hb_shots_swept = False
+
+
+def _hb_sweep_shots(max_age_s=86400):
+    # Unique names accumulate where the single shot.png didn't — drop day-old ones.
+    # Once per process, and only in processes that actually screenshot.
+    global _hb_shots_swept
+    if _hb_shots_swept:
+        return
+    _hb_shots_swept = True
+    import time
+    now = time.time()
+    try:
+        for e in os.scandir(_bh_ipc._TMP):
+            if e.name.startswith("shot-") and e.name.endswith(".png") and now - e.stat().st_mtime > max_age_s:
+                try: os.remove(e.path)
+                except OSError: pass
+    except OSError:
+        pass
+
+
+def capture_screenshot(path=None, full=False, max_dim=None):
+    """Save a PNG of the current viewport to a per-call unique file; returns the path.
+    Args as stock browser-harness: full=capture beyond viewport, max_dim=downscale."""
+    if path is None:
+        _hb_sweep_shots()
+        import tempfile
+        fd, path = tempfile.mkstemp(
+            prefix=f"shot-{os.environ.get('BU_NAME', 'default')}-",
+            suffix=".png", dir=str(_bh_ipc._TMP))
+        os.close(fd)
+    return _real_capture_screenshot(path, full=full, max_dim=max_dim)

package/extension/background.js

@@ -137,3 +137,42 @@ chrome.runtime.onInstalled.addListener((details) => {
   // First run on a fresh profile only: open the welcome page (not on updates/restarts).
   if (details.reason === "install") chrome.tabs.create({ url: chrome.runtime.getURL("hello.html"), active: true });
 });
+
+// ── Passive network monitor ── Tier 1 realness debug aid. chrome.webRequest observes every
+// request WITHOUT touching the page — no window.fetch/XHR wrapper, which would itself be a
+// fingerprint tell (a non-native fetch.toString). We buffer the last N *outcomes* per tab
+// (onCompleted carries the status; onErrorOccurred carries blocks/aborts), so an agent can
+// see what a click actually fired — decisive for spotting silent gating. State lives in the
+// SW's memory: the 30s keepalive alarm keeps it warm during a session, but a hard SW
+// eviction resets it — fine for a read-right-after-you-act ring buffer.
+const NETLOG = new Map();          // tabId -> [{ t, method, url, type, status, fromCache, error }]
+const NETLOG_MAX = 200;
+function netPush(tabId, entry) {
+  if (tabId == null || tabId < 0) return;   // -1 = not tied to a tab (SW/extension fetches)
+  let buf = NETLOG.get(tabId);
+  if (!buf) { buf = []; NETLOG.set(tabId, buf); }
+  buf.push(entry);
+  if (buf.length > NETLOG_MAX) buf.shift();
+}
+const NET_URLS = { urls: ["http://*/*", "https://*/*"] };
+chrome.webRequest.onCompleted.addListener(
+  (d) => netPush(d.tabId, { t: d.timeStamp, method: d.method, url: d.url, type: d.type, status: d.statusCode, fromCache: d.fromCache }),
+  NET_URLS,
+);
+chrome.webRequest.onErrorOccurred.addListener(
+  (d) => netPush(d.tabId, { t: d.timeStamp, method: d.method, url: d.url, type: d.type, status: null, error: d.error }),
+  NET_URLS,
+);
+chrome.tabs.onRemoved.addListener((tabId) => NETLOG.delete(tabId));   // don't leak buffers
+
+// getNetLog(targetId) / clearNetLog(targetId) — CDP-callable like groupTab/listTabs. Agents
+// pass a CDP targetId; we bridge to the chrome tabId the same way the grouper does.
+self.getNetLog = async (targetId) => {
+  const tabId = await tabIdForTargetId(targetId);
+  return NETLOG.get(tabId) || [];
+};
+self.clearNetLog = async (targetId) => {
+  const tabId = await tabIdForTargetId(targetId);
+  NETLOG.delete(tabId);
+  return true;
+};

package/extension/manifest.json

@@ -1,14 +1,28 @@
 {
   "manifest_version": 3,
   "name": "Agent Tab Grouper",
-  "version": "0.5.12",
-  "description": "Groups CDP-driven automation tabs into a per-session tab group, and serves the Agent Monitor — a live CCTV grid of all sessions' tabs. Driven over CDP via Runtime.evaluate against this extension's service worker.",
+  "version": "0.6.0",
+  "description": "Groups CDP-driven automation tabs into a per-session tab group and serves the Agent Monitor (a live CCTV grid). Also carries Tier 1 realness: an always-on Chrome-real fingerprint (UA-CH + sec-ch-ua) and a passive per-tab network log. Driven over CDP via Runtime.evaluate against this extension's service worker.",
   "icons": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" },
   "background": { "service_worker": "background.js" },
+  "content_scripts": [
+    {
+      "matches": ["http://*/*", "https://*/*"],
+      "js": ["realchrome.js"],
+      "run_at": "document_start",
+      "world": "MAIN",
+      "all_frames": true
+    }
+  ],
+  "declarative_net_request": {
+    "rule_resources": [
+      { "id": "realness_headers", "enabled": true, "path": "rules.json" }
+    ]
+  },
   "action": {
     "default_title": "Open Agent Monitor",
     "default_icon": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" }
   },
-  "permissions": ["tabs", "tabGroups", "debugger", "alarms"],
-  "host_permissions": ["http://127.0.0.1:9223/*"]
+  "permissions": ["tabs", "tabGroups", "debugger", "alarms", "webRequest", "declarativeNetRequest"],
+  "host_permissions": ["http://*/*", "https://*/*"]
 }

package/extension/realchrome.js

@@ -0,0 +1,27 @@
+// Tier 1 realness — the JS half of the Chrome-for-Testing → stable Google Chrome mask.
+// Runs in the page's MAIN world at document_start (see manifest content_scripts), so it
+// patches navigator.userAgentData BEFORE the page's first script reads it (verified: a
+// parse-time read already sees "Google Chrome", 10/10). The wire half — the sec-ch-ua
+// request header — is done coherently by declarativeNetRequest (rules.json), so JS and
+// headers agree. Payload lifted verbatim from the proven real_chrome() helper.
+(function(){ 'use strict'; try{
+  var u = navigator.userAgentData; if(!u) return;
+  var FULL='150.0.7871.47', MAJOR='150';
+  function low(){ return [{brand:'Not;A=Brand',version:'8'},{brand:'Chromium',version:MAJOR},{brand:'Google Chrome',version:MAJOR}]; }
+  function full(){ return [{brand:'Not;A=Brand',version:'8.0.0.0'},{brand:'Chromium',version:FULL},{brand:'Google Chrome',version:FULL}]; }
+  var proto = Object.getPrototypeOf(u);
+  function nativeProxy(orig, impl){ return new Proxy(orig, { apply:function(t,ta,a){ return impl(t,ta,a); } }); }
+  var bd = Object.getOwnPropertyDescriptor(proto,'brands');
+  if(bd && bd.get && !u.brands.some(function(b){return b.brand==='Google Chrome'})){
+    Object.defineProperty(proto,'brands',{ get: nativeProxy(bd.get, function(){ return low(); }), set:undefined, enumerable:bd.enumerable, configurable:true });
+  }
+  if(typeof proto.getHighEntropyValues==='function'){
+    proto.getHighEntropyValues = nativeProxy(proto.getHighEntropyValues, function(t,ta,a){
+      return Reflect.apply(t,ta,a).then(function(r){ if(r&&typeof r==='object'){ if('brands' in r) r.brands=low(); if('fullVersionList' in r) r.fullVersionList=full(); if('uaFullVersion' in r) r.uaFullVersion=FULL; } return r; });
+    });
+  }
+  if(typeof proto.toJSON==='function'){
+    proto.toJSON = nativeProxy(proto.toJSON, function(t,ta,a){ var o=Reflect.apply(t,ta,a); if(o&&typeof o==='object') o.brands=low(); return o; });
+  }
+  try{ if(navigator.webdriver===true) Object.defineProperty(Navigator.prototype,'webdriver',{get:function(){return false},configurable:true}); }catch(e){}
+}catch(e){} })();

package/extension/rules.json

@@ -0,0 +1,23 @@
+[
+  {
+    "id": 1,
+    "priority": 1,
+    "action": {
+      "type": "modifyHeaders",
+      "requestHeaders": [
+        {
+          "header": "sec-ch-ua",
+          "operation": "set",
+          "value": "\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\", \"Google Chrome\";v=\"150\""
+        }
+      ]
+    },
+    "condition": {
+      "urlFilter": "*",
+      "resourceTypes": [
+        "main_frame", "sub_frame", "stylesheet", "script", "image",
+        "font", "object", "xmlhttprequest", "ping", "csp_report", "media", "websocket", "other"
+      ]
+    }
+  }
+]

package/install.sh

@@ -64,12 +64,14 @@ else
 fi
 
 # 3. bh_open helpers into browser-harness ───────────────────────────────────────
-# browser-harness auto-loads <workspace>/agent_helpers.py on every call; we append our
-# bh_open/bh_list/bh_switch_tab helpers there so they exist on the first run — no agent
-# installs the recipe by hand. The workspace location varies by version/install (≤0.1.0:
-# <repo>/agent-workspace; 0.1.1+: ~/.config/browser-harness/agent-workspace; or whatever
-# BH_AGENT_WORKSPACE points at) — so instead of guessing, we ASK browser-harness itself
-# where it loads from via its own python (helpers.AGENT_WORKSPACE). Append-once.
+# browser-harness auto-loads <workspace>/agent_helpers.py on every call. Our helpers
+# ship as horse_helpers.py — a file THIS installer owns and overwrites outright on
+# every sync — plus a load-once stub appended to agent_helpers.py exactly once and
+# never rewritten, so anything a user adds to agent_helpers.py is never touched.
+# The workspace location varies by version/install (≤0.1.0: <repo>/agent-workspace;
+# 0.1.1+: ~/.config/browser-harness/agent-workspace; or whatever BH_AGENT_WORKSPACE
+# points at) — so instead of guessing, we ASK browser-harness itself where it loads
+# from via its own python (helpers.AGENT_WORKSPACE).
 if ! command -v browser-harness >/dev/null 2>&1; then
   # browser-harness is a separate (Python) prerequisite. In a hand/curl install it's
   # required up front. Under npm it's a *declared* prereq the user may not have yet — so
@@ -82,17 +84,54 @@ if ! command -v browser-harness >/dev/null 2>&1; then
   exit 1
 fi
 HELPERS_SRC="$HERE/agent-helpers.py"
+# Legacy marker: pre-0.4.1 installs appended the helpers INLINE under this line, and
+# re-syncs replaced marker→EOF — silently eating anything a user had added below the
+# block. Kept only so those files can be migrated once.
 HELPERS_MARKER="# ── horse-browser helpers (installed by horse-browser/install.sh) ──"
-install_helpers_into() {  # $1 = workspace dir; (re)syncs our helpers block — idempotent, so
-  local dst="$1/agent_helpers.py"  # re-running install.sh deploys helper UPDATES, not just the first time.
-  mkdir -p "$1" 2>/dev/null || return 0
-  # drop any previously-installed block (marker → EOF), trim trailing blanks, then re-append
+LOADER_MARKER="# >>> horse-browser: bh_open helpers (managed loader — do not edit) >>>"
+install_helpers_into() {  # $1 = workspace dir; (re)syncs the helpers — idempotent, so
+  local ws="$1" dst="$1/agent_helpers.py"  # re-running install.sh deploys helper UPDATES too.
+  mkdir -p "$ws" 2>/dev/null || return 0
+  cp "$HELPERS_SRC" "$ws/horse_helpers.py"
+  # one-time migration of a legacy inline block: strip it ONLY on an exact byte match
+  # with the shipped source, so user additions below it survive. A modified/unknown
+  # block is left in place — harmless, the loader runs after it and its defs win.
   if [ -f "$dst" ] && grep -qF "$HELPERS_MARKER" "$dst"; then
-    awk -v m="$HELPERS_MARKER" 'index($0,m){exit} {print}' "$dst" \
-      | awk 'NF{last=NR} {b[NR]=$0} END{for(i=1;i<=last;i++)print b[i]}' > "$dst.tmp" && mv "$dst.tmp" "$dst"
+    python3 - "$dst" "$HELPERS_SRC" "$HELPERS_MARKER" <<'PY' || true
+import sys
+dst, src, marker = sys.argv[1], sys.argv[2], sys.argv[3]
+text, block = open(dst).read(), open(src).read()
+i = text.find(marker)
+legacy = marker + "\n" + block
+if i >= 0 and text[i:].startswith(legacy):
+    head = text[:i].rstrip("\n")
+    rest = text[i + len(legacy):].lstrip("\n")
+    parts = [p for p in (head, rest) if p]
+    open(dst, "w").write("\n\n".join(parts) + ("\n" if parts else ""))
+    print("  migrated: legacy inline helper block removed (everything else kept)")
+elif i >= 0:
+    print("  note: a legacy horse-browser block is present but doesn't match the shipped", file=sys.stderr)
+    print("        source — left in place (the horse_helpers.py loader below supersedes", file=sys.stderr)
+    print("        it); remove it from " + dst + " by hand when convenient.", file=sys.stderr)
+PY
+  fi
+  if ! grep -qF "$LOADER_MARKER" "$dst" 2>/dev/null; then
+    if [ -s "$dst" ]; then printf '\n' >> "$dst"; fi
+    printf '%s\n' "$LOADER_MARKER" >> "$dst"
+    cat >> "$dst" <<'LOADER'
+# The helpers live in horse_helpers.py next to this file. install.sh overwrites THAT
+# file on every sync and never rewrites this one — your own code here is safe.
+try:
+    import os as _hb_os
+    _hb_path = _hb_os.path.join(_hb_os.path.dirname(_hb_os.path.abspath(__file__)), "horse_helpers.py")
+    exec(compile(open(_hb_path).read(), _hb_path, "exec"))
+except Exception as _hb_err:
+    import sys as _hb_sys
+    print("horse-browser: couldn't load horse_helpers.py (%r) — re-run horse-browser's install.sh" % (_hb_err,), file=_hb_sys.stderr)
+# <<< horse-browser: bh_open helpers <<<
+LOADER
   fi
-  { [ -s "$dst" ] && printf '\n\n'; printf '%s\n' "$HELPERS_MARKER"; cat "$HELPERS_SRC"; } >> "$dst"
-  echo "✓ synced bh_open helpers → $dst"
+  echo "✓ synced bh_open helpers → $ws/horse_helpers.py (loaded via stub in $dst)"
 }
 # (a) the workspace browser-harness ACTUALLY loads from — ask it via its own python
 # (the CLI's shebang points at it); helpers.AGENT_WORKSPACE honours BH_AGENT_WORKSPACE and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pa1nd/horse-browser",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "publishConfig": {
     "access": "public"
   },