@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/browser/pw-session.js

@@ -3,6 +3,7 @@ import { formatErrorMessage } from "../infra/errors.js";
 import { appendCdpPath, fetchJson, getHeadersWithAuth, withCdpSocket } from "./cdp.helpers.js";
 import { normalizeCdpWsUrl } from "./cdp.js";
 import { getChromeWebSocketUrl } from "./chrome.js";
+import { assertBrowserNavigationAllowed, withBrowserNavigationPolicy } from "./navigation-guard.js";
 const pageStates = new WeakMap();
 const contextStates = new WeakMap();
 const observedContexts = new WeakSet();
@@ -19,13 +20,23 @@ let connecting = null;
 function normalizeCdpUrl(raw) {
     return raw.replace(/\/$/, "");
 }
+function findNetworkRequestById(state, id) {
+    for (let i = state.requests.length - 1; i >= 0; i -= 1) {
+        const candidate = state.requests[i];
+        if (candidate && candidate.id === id) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
 function roleRefsKey(cdpUrl, targetId) {
     return `${normalizeCdpUrl(cdpUrl)}::${targetId}`;
 }
 export function rememberRoleRefsForTarget(opts) {
     const targetId = opts.targetId.trim();
-    if (!targetId)
+    if (!targetId) {
         return;
+    }
     roleRefsByTarget.set(roleRefsKey(opts.cdpUrl, targetId), {
         refs: opts.refs,
         ...(opts.frameSelector ? { frameSelector: opts.frameSelector } : {}),
@@ -33,8 +44,9 @@ export function rememberRoleRefsForTarget(opts) {
     });
     while (roleRefsByTarget.size > MAX_ROLE_REFS_CACHE) {
         const first = roleRefsByTarget.keys().next();
-        if (first.done)
+        if (first.done) {
             break;
+        }
         roleRefsByTarget.delete(first.value);
     }
 }
@@ -43,8 +55,9 @@ export function storeRoleRefsForTarget(opts) {
     state.roleRefs = opts.refs;
     state.roleRefsFrameSelector = opts.frameSelector;
     state.roleRefsMode = opts.mode;
-    if (!opts.targetId?.trim())
+    if (!opts.targetId?.trim()) {
         return;
+    }
     rememberRoleRefsForTarget({
         cdpUrl: opts.cdpUrl,
         targetId: opts.targetId,
@@ -55,22 +68,26 @@ export function storeRoleRefsForTarget(opts) {
 }
 export function restoreRoleRefsForTarget(opts) {
     const targetId = opts.targetId?.trim() || "";
-    if (!targetId)
+    if (!targetId) {
         return;
+    }
     const cached = roleRefsByTarget.get(roleRefsKey(opts.cdpUrl, targetId));
-    if (!cached)
+    if (!cached) {
         return;
+    }
     const state = ensurePageState(opts.page);
-    if (state.roleRefs)
+    if (state.roleRefs) {
         return;
+    }
     state.roleRefs = cached.refs;
     state.roleRefsFrameSelector = cached.frameSelector;
     state.roleRefsMode = cached.mode;
 }
 export function ensurePageState(page) {
     const existing = pageStates.get(page);
-    if (existing)
+    if (existing) {
         return existing;
+    }
     const state = {
         console: [],
         errors: [],
@@ -92,8 +109,9 @@ export function ensurePageState(page) {
                 location: msg.location(),
             };
             state.console.push(entry);
-            if (state.console.length > MAX_CONSOLE_MESSAGES)
+            if (state.console.length > MAX_CONSOLE_MESSAGES) {
                 state.console.shift();
+            }
         });
         page.on("pageerror", (err) => {
             state.errors.push({
@@ -102,8 +120,9 @@ export function ensurePageState(page) {
                 stack: err?.stack ? String(err.stack) : undefined,
                 timestamp: new Date().toISOString(),
             });
-            if (state.errors.length > MAX_PAGE_ERRORS)
+            if (state.errors.length > MAX_PAGE_ERRORS) {
                 state.errors.shift();
+            }
         });
         page.on("request", (req) => {
             state.nextRequestId += 1;
@@ -116,41 +135,32 @@ export function ensurePageState(page) {
                 url: req.url(),
                 resourceType: req.resourceType(),
             });
-            if (state.requests.length > MAX_NETWORK_REQUESTS)
+            if (state.requests.length > MAX_NETWORK_REQUESTS) {
                 state.requests.shift();
+            }
         });
         page.on("response", (resp) => {
             const req = resp.request();
             const id = state.requestIds.get(req);
-            if (!id)
+            if (!id) {
                 return;
-            let rec;
-            for (let i = state.requests.length - 1; i >= 0; i -= 1) {
-                const candidate = state.requests[i];
-                if (candidate && candidate.id === id) {
-                    rec = candidate;
-                    break;
-                }
             }
-            if (!rec)
+            const rec = findNetworkRequestById(state, id);
+            if (!rec) {
                 return;
+            }
             rec.status = resp.status();
             rec.ok = resp.ok();
         });
         page.on("requestfailed", (req) => {
             const id = state.requestIds.get(req);
-            if (!id)
+            if (!id) {
                 return;
-            let rec;
-            for (let i = state.requests.length - 1; i >= 0; i -= 1) {
-                const candidate = state.requests[i];
-                if (candidate && candidate.id === id) {
-                    rec = candidate;
-                    break;
-                }
             }
-            if (!rec)
+            const rec = findNetworkRequestById(state, id);
+            if (!rec) {
                 return;
+            }
             rec.failureText = req.failure()?.errorText;
             rec.ok = false;
         });
@@ -162,32 +172,38 @@ export function ensurePageState(page) {
     return state;
 }
 function observeContext(context) {
-    if (observedContexts.has(context))
+    if (observedContexts.has(context)) {
         return;
+    }
     observedContexts.add(context);
     ensureContextState(context);
-    for (const page of context.pages())
+    for (const page of context.pages()) {
         ensurePageState(page);
+    }
     context.on("page", (page) => ensurePageState(page));
 }
 export function ensureContextState(context) {
     const existing = contextStates.get(context);
-    if (existing)
+    if (existing) {
         return existing;
+    }
     const state = { traceActive: false };
     contextStates.set(context, state);
     return state;
 }
 function observeBrowser(browser) {
-    for (const context of browser.contexts())
+    for (const context of browser.contexts()) {
         observeContext(context);
+    }
 }
 async function connectBrowser(cdpUrl) {
     const normalized = normalizeCdpUrl(cdpUrl);
-    if (cached?.cdpUrl === normalized)
+    if (cached?.cdpUrl === normalized) {
         return cached;
-    if (connecting)
+    }
+    if (connecting) {
         return await connecting;
+    }
     const connectWithRetry = async () => {
         let lastErr;
         for (let attempt = 0; attempt < 3; attempt += 1) {
@@ -243,11 +259,25 @@ async function pageTargetId(page) {
 }
 async function findPageByTargetId(browser, targetId, cdpUrl) {
     const pages = await getAllPages(browser);
+    let resolvedViaCdp = false;
     // First, try the standard CDP session approach
     for (const page of pages) {
-        const tid = await pageTargetId(page).catch(() => null);
-        if (tid && tid === targetId)
+        let tid = null;
+        try {
+            tid = await pageTargetId(page);
+            resolvedViaCdp = true;
+        }
+        catch {
+            tid = null;
+        }
+        if (tid && tid === targetId) {
             return page;
+        }
+    }
+    // Extension relays can block CDP attachment APIs entirely. If that happens and
+    // Playwright only exposes one page, return it as the best available mapping.
+    if (!resolvedViaCdp && pages.length === 1) {
+        return pages[0];
     }
     // If CDP sessions fail (e.g., extension relay blocks Target.attachToBrowserTarget),
     // fall back to URL-based matching using the /json/list endpoint
@@ -291,18 +321,21 @@ async function findPageByTargetId(browser, targetId, cdpUrl) {
 export async function getPageForTargetId(opts) {
     const { browser } = await connectBrowser(opts.cdpUrl);
     const pages = await getAllPages(browser);
-    if (!pages.length)
+    if (!pages.length) {
         throw new Error("No pages available in the connected browser.");
+    }
     const first = pages[0];
-    if (!opts.targetId)
+    if (!opts.targetId) {
         return first;
+    }
     const found = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl);
     if (!found) {
         // Extension relays can block CDP attachment APIs (e.g. Target.attachToBrowserTarget),
         // which prevents us from resolving a page's targetId via newCDPSession(). If Playwright
         // only exposes a single Page, use it as a best-effort fallback.
-        if (pages.length === 1)
+        if (pages.length === 1) {
             return first;
+        }
         throw new Error("tab not found");
     }
     return found;
@@ -509,6 +542,10 @@ export async function createPageViaPlaywright(opts) {
     // Navigate to the URL
     const targetUrl = opts.url.trim() || "about:blank";
     if (targetUrl !== "about:blank") {
+        await assertBrowserNavigationAllowed({
+            url: targetUrl,
+            ...withBrowserNavigationPolicy(opts.ssrfPolicy),
+        });
         await page.goto(targetUrl, { timeout: 30_000 }).catch(() => {
             // Navigation might fail for some URLs, but page is still created
         });

package/dist/browser/pw-tools-core.interactions.js

@@ -59,8 +59,9 @@ export async function hoverViaPlaywright(opts) {
 export async function dragViaPlaywright(opts) {
     const startRef = requireRef(opts.startRef);
     const endRef = requireRef(opts.endRef);
-    if (!startRef || !endRef)
+    if (!startRef || !endRef) {
         throw new Error("startRef and endRef are required");
+    }
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
@@ -75,8 +76,9 @@ export async function dragViaPlaywright(opts) {
 }
 export async function selectOptionViaPlaywright(opts) {
     const ref = requireRef(opts.ref);
-    if (!opts.values?.length)
+    if (!opts.values?.length) {
         throw new Error("values are required");
+    }
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
@@ -91,8 +93,9 @@ export async function selectOptionViaPlaywright(opts) {
 }
 export async function pressKeyViaPlaywright(opts) {
     const key = String(opts.key ?? "").trim();
-    if (!key)
+    if (!key) {
         throw new Error("key is required");
+    }
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     await page.keyboard.press(key, {
@@ -137,8 +140,9 @@ export async function fillFormViaPlaywright(opts) {
             : typeof rawValue === "number" || typeof rawValue === "boolean"
                 ? String(rawValue)
                 : "";
-        if (!ref || !type)
+        if (!ref || !type) {
             continue;
+        }
         const locator = refLocator(page, ref);
         if (type === "checkbox" || type === "radio") {
             const checked = rawValue === true || rawValue === 1 || rawValue === "1" || rawValue === "true";
@@ -354,15 +358,17 @@ export async function takeScreenshotViaPlaywright(opts) {
     restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
     const type = opts.type ?? "png";
     if (opts.ref) {
-        if (opts.fullPage)
+        if (opts.fullPage) {
             throw new Error("fullPage is not supported for element screenshots");
+        }
         const locator = refLocator(page, opts.ref);
         const buffer = await locator.screenshot({ type });
         return { buffer };
     }
     if (opts.element) {
-        if (opts.fullPage)
+        if (opts.fullPage) {
             throw new Error("fullPage is not supported for element screenshots");
+        }
         const locator = page.locator(opts.element).first();
         const buffer = await locator.screenshot({ type });
         return { buffer };
@@ -486,8 +492,9 @@ export async function setInputFilesViaPlaywright(opts) {
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
-    if (!opts.paths.length)
+    if (!opts.paths.length) {
         throw new Error("paths are required");
+    }
     const inputRef = typeof opts.inputRef === "string" ? opts.inputRef.trim() : "";
     const element = typeof opts.element === "string" ? opts.element.trim() : "";
     if (inputRef && element) {

package/dist/browser/pw-tools-core.state.js

@@ -28,8 +28,9 @@ export async function setHttpCredentialsViaPlaywright(opts) {
     }
     const username = String(opts.username ?? "");
     const password = String(opts.password ?? "");
-    if (!username)
+    if (!username) {
         throw new Error("username is required (or set clear=true)");
+    }
     await page.context().setHTTPCredentials({ username, password });
 }
 export async function setGeolocationViaPlaywright(opts) {
@@ -71,8 +72,9 @@ export async function setLocaleViaPlaywright(opts) {
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     const locale = String(opts.locale ?? "").trim();
-    if (!locale)
+    if (!locale) {
         throw new Error("locale is required");
+    }
     await withCdpSession(page, async (session) => {
         try {
             await session.send("Emulation.setLocaleOverride", { locale });
@@ -89,18 +91,21 @@ export async function setTimezoneViaPlaywright(opts) {
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     const timezoneId = String(opts.timezoneId ?? "").trim();
-    if (!timezoneId)
+    if (!timezoneId) {
         throw new Error("timezoneId is required");
+    }
     await withCdpSession(page, async (session) => {
         try {
             await session.send("Emulation.setTimezoneOverride", { timezoneId });
         }
         catch (err) {
             const msg = String(err);
-            if (msg.includes("Timezone override is already in effect"))
+            if (msg.includes("Timezone override is already in effect")) {
                 return;
-            if (msg.includes("Invalid timezone"))
+            }
+            if (msg.includes("Invalid timezone")) {
                 throw new Error(`Invalid timezone ID: ${timezoneId}`, { cause: err });
+            }
             throw err;
         }
     });
@@ -109,8 +114,9 @@ export async function setDeviceViaPlaywright(opts) {
     const page = await getPageForTargetId(opts);
     ensurePageState(page);
     const name = String(opts.name ?? "").trim();
-    if (!name)
+    if (!name) {
         throw new Error("device name is required");
+    }
     const descriptor = playwrightDevices[name];
     if (!descriptor) {
         throw new Error(`Unknown device "${name}".`);