@q-agent/agent 0.1.11 → 0.1.12

package/dist/src/runner.js

@@ -849,11 +849,18 @@ async function processExplorationJob(cfg, session) {
         }
     }
     const storageState = origin && (0, session_1.hasValidSession)(origin) ? (0, session_1.sessionPathsForOrigin)(origin).storageStatePath : "";
+    // Pair the sessionStorage snapshot (MSAL/SPA auth tokens) with the saved
+    // session so the explore browser authenticates the same way a run does — the
+    // run path replays it via fixtures (see `replaySession`). Without it an
+    // MSAL/SPA app boots unauthenticated and bounces to login.
+    const sessionStoragePath = storageState && origin && (0, session_1.hasSessionStorage)(origin) ? (0, session_1.sessionPathsForOrigin)(origin).sessionStoragePath : "";
     const script = (0, paths_1.vendorExploreScript)();
     const nm = (0, paths_1.agentNodeModules)();
     const args = [script, session.baseUrl];
     if (storageState)
         args.push(storageState);
+    if (storageState && sessionStoragePath)
+        args.push(sessionStoragePath);
     // Run the explore browser HEADED on the paired device: the user watches the
     // session, and a headed browser dodges WAF/bot-protection that blocks headless.
     const child = (0, child_process_1.spawn)((0, paths_1.nodeBin)(), args, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@q-agent/agent",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Q-Agent Local Agent — claims execution jobs from the Q-Agent server and runs Playwright locally, so manual login/MFA happens on the user's own machine and session credentials never leave it.",
   "license": "UNLICENSED",
   "bin": {

package/vendor/explore_session.cjs

@@ -13,8 +13,11 @@
 // whole session, reading newline-delimited JSON commands on stdin and writing
 // newline-delimited JSON responses on stdout.
 //
-// Args: baseURL, [storageState]  (storageState = absolute path to a saved
-// Playwright session for auth reuse, per ADR 0002).
+// Args: baseURL, [storageState], [sessionState]  (storageState = absolute path
+// to a saved Playwright session for auth reuse, per ADR 0002; sessionState =
+// absolute path to the sibling sessionStorage.json snapshot, replayed for auth
+// reuse on MSAL/SPA apps whose token lives in sessionStorage — which Playwright's
+// storageState cannot persist).
 //
 // Protocol (one JSON object per line, each way):
 //   {"cmd":"observe"}
@@ -29,8 +32,9 @@
 // self-heal loop's tolerance for stale actions).
 const { chromium } = require('playwright');
 const readline = require('readline');
+const fs = require('fs');
 
-const [, , baseURL, storageState] = process.argv;
+const [, , baseURL, storageState, sessionState] = process.argv;
 
 process.on('unhandledRejection', (e) => console.error('explore unhandledRejection:', e && (e.message || e)));
 process.on('uncaughtException', (e) => console.error('explore uncaughtException:', e && (e.message || e)));
@@ -166,6 +170,21 @@ async function handle(line) {
   const contextOpts = { baseURL };
   if (storageState) contextOpts.storageState = storageState;
   const context = await browser.newContext(contextOpts);
+  // Replay the captured sessionStorage (MSAL/SPA auth tokens) for the matching
+  // origin BEFORE any app code runs — mirrors playwright_runner._fixtures_ts.
+  // storageState persists cookies + localStorage but NOT sessionStorage, so
+  // without this an MSAL/SPA app boots unauthenticated and bounces to login even
+  // with a valid saved session. The snapshot is {origin: {key: value}}.
+  if (sessionState) {
+    let sessions = {};
+    try { sessions = JSON.parse(fs.readFileSync(sessionState, 'utf-8')); } catch {}
+    await context.addInitScript((byOrigin) => {
+      try {
+        const entries = byOrigin[location.origin];
+        if (entries) for (const k in entries) window.sessionStorage.setItem(k, entries[k]);
+      } catch {}
+    }, sessions);
+  }
   page = await context.newPage();
 
   // Land on the app before the first observe so step 1 sees the real page,