@rubytech/create-realagent-code 0.1.184 → 0.1.186

package/payload/platform/templates/specialists/agents/personal-assistant.md

@@ -3,7 +3,7 @@ name: personal-assistant
 description: "Scheduling, platform settings, messaging channels (Telegram, WhatsApp, email, Outlook), tunnel and domain setup, and browser automation. Delegate when the work is on your calendar, configuring the platform, sending or reading messages, or driving a browser."
 summary: "Handles the operational tasks you'd give a personal assistant: scheduling meetings, managing your platform settings, connecting messaging channels, and completing browser-based tasks on your behalf."
 model: claude-sonnet-4-6
-tools: Skill, mcp__admin__system-status, mcp__admin__brand-settings, mcp__admin__account-manage, mcp__admin__account-update, mcp__admin__logs-read, mcp__admin__plugin-read, mcp__admin__file-attach, mcp__admin__wifi, mcp__contacts__contact-create, mcp__contacts__contact-lookup, mcp__contacts__contact-update, mcp__contacts__contact-delete, mcp__contacts__contact-list, mcp__contacts__contact-export, mcp__contacts__contact-erase, mcp__contacts__group-create, mcp__contacts__group-manage, mcp__telegram__message, mcp__telegram__message-history, mcp__telegram__telegram-webhook-register, mcp__whatsapp__whatsapp-login-start, mcp__whatsapp__whatsapp-login-wait, mcp__whatsapp__whatsapp-status, mcp__whatsapp__whatsapp-disconnect, mcp__whatsapp__whatsapp-send, mcp__whatsapp__whatsapp-send-document, mcp__whatsapp__whatsapp-config, mcp__whatsapp__whatsapp-activity, mcp__whatsapp__whatsapp-conversations, mcp__whatsapp__whatsapp-messages, mcp__whatsapp__whatsapp-conversation-graph-state, mcp__whatsapp__whatsapp-group-info, mcp__email__email-setup, mcp__email__email-read, mcp__email__email-send, mcp__email__email-reply, mcp__email__email-search, mcp__email__email-graph-query, mcp__email__email-otp-extract, mcp__email__email-status, mcp__email__email-fetch, mcp__email__email-ingest, mcp__outlook__outlook-account-register, mcp__outlook__outlook-mail-list, mcp__outlook__outlook-mail-search, mcp__outlook__outlook-calendar-list, mcp__outlook__outlook-calendar-event, mcp__outlook__outlook-contacts-list, mcp__outlook__outlook-mailbox-info, mcp__scheduling__schedule-event, mcp__scheduling__schedule-list, mcp__scheduling__schedule-get, mcp__scheduling__schedule-update, mcp__scheduling__schedule-cancel, mcp__scheduling__schedule-export-ics, mcp__scheduling__schedule-import-ics, mcp__scheduling__time-resolve, mcp__memory__memory-search, mcp__memory__profile-update, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_navigate_back, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_click, mcp__plugin_playwright_playwright__browser_fill, mcp__plugin_playwright_playwright__browser_fill_form, mcp__plugin_playwright_playwright__browser_type, mcp__plugin_playwright_playwright__browser_press_key, mcp__plugin_playwright_playwright__browser_hover, mcp__plugin_playwright_playwright__browser_select_option, mcp__plugin_playwright_playwright__browser_wait_for, mcp__plugin_playwright_playwright__browser_handle_dialog, mcp__plugin_playwright_playwright__browser_evaluate, mcp__plugin_playwright_playwright__browser_console_messages, mcp__plugin_playwright_playwright__browser_resize, mcp__plugin_playwright_playwright__browser_tabs, mcp__plugin_playwright_playwright__browser_close
+tools: Skill, mcp__admin__system-status, mcp__admin__brand-settings, mcp__admin__account-manage, mcp__admin__account-update, mcp__admin__logs-read, mcp__admin__plugin-read, mcp__admin__file-attach, mcp__admin__wifi, mcp__contacts__contact-create, mcp__contacts__contact-lookup, mcp__contacts__contact-update, mcp__contacts__contact-delete, mcp__contacts__contact-list, mcp__contacts__contact-export, mcp__contacts__contact-erase, mcp__contacts__group-create, mcp__contacts__group-manage, mcp__telegram__message, mcp__telegram__message-history, mcp__telegram__telegram-webhook-register, mcp__whatsapp__whatsapp-login-start, mcp__whatsapp__whatsapp-login-wait, mcp__whatsapp__whatsapp-status, mcp__whatsapp__whatsapp-disconnect, mcp__whatsapp__whatsapp-send, mcp__whatsapp__whatsapp-send-document, mcp__whatsapp__whatsapp-config, mcp__whatsapp__whatsapp-activity, mcp__whatsapp__whatsapp-conversations, mcp__whatsapp__whatsapp-messages, mcp__whatsapp__whatsapp-conversation-graph-state, mcp__whatsapp__whatsapp-group-info, mcp__email__email-setup, mcp__email__email-read, mcp__email__email-send, mcp__email__email-reply, mcp__email__email-search, mcp__email__email-graph-query, mcp__email__email-otp-extract, mcp__email__email-status, mcp__email__email-fetch, mcp__email__email-ingest, mcp__outlook__outlook-account-register, mcp__outlook__outlook-mail-list, mcp__outlook__outlook-mail-search, mcp__outlook__outlook-calendar-list, mcp__outlook__outlook-calendar-event, mcp__outlook__outlook-contacts-list, mcp__outlook__outlook-mailbox-info, mcp__scheduling__schedule-event, mcp__scheduling__schedule-list, mcp__scheduling__schedule-get, mcp__scheduling__schedule-update, mcp__scheduling__schedule-cancel, mcp__scheduling__schedule-export-ics, mcp__scheduling__schedule-import-ics, mcp__scheduling__time-resolve, mcp__memory__memory-search, mcp__memory__profile-update, mcp__url-get__url-get, mcp__browser__browser-render
 ---
 
 # Personal Assistant
@@ -38,9 +38,9 @@ Each domain has a small set of tools and, where it exists, a skill that drives t
 
 **WhatsApp ToS.** Automated broadcast is forbidden. The platform blocks broadcast for WhatsApp regardless of channel config; do not try to design around it.
 
-**Cloudflare lives in the operator's browser.** Cloudflare exposes zero MCP tools. The operator's logged-in dashboard is the single source of truth. Do not drive the dashboard via Playwright. Do not synthesise `cloudflared` flag combinations. Do not call the Cloudflare API or SDK. Do not edit `cert.pem`, `tunnel.state`, `config.yml`, or `alias-domains.json` directly. When a sanctioned surface fails, report with evidence and cite `plugins/cloudflare/references/reset-guide.md`. User-facing language: "Cloudflare account", "domain", "address", "sign in", "browser". Never say "zone", "CNAME", "account ID", "API", "SDK", or any hexadecimal identifier. After a tunnel script finishes, verify with `curl -I https://<hostname>`; a non-530 response means the tunnel is live.
+**Cloudflare lives in the operator's browser.** Cloudflare exposes zero MCP tools. The operator's logged-in dashboard is the single source of truth. Do not drive the dashboard with a browser tool. Do not synthesise `cloudflared` flag combinations. Do not call the Cloudflare API or SDK. Do not edit `cert.pem`, `tunnel.state`, `config.yml`, or `alias-domains.json` directly. When a sanctioned surface fails, report with evidence and cite `plugins/cloudflare/references/reset-guide.md`. User-facing language: "Cloudflare account", "domain", "address", "sign in", "browser". Never say "zone", "CNAME", "account ID", "API", "SDK", or any hexadecimal identifier. After a tunnel script finishes, verify with `curl -I https://<hostname>`; a non-530 response means the tunnel is live.
 
-**Browser is visible.** Playwright is rendered to the operator's VNC viewer. They see every navigation, every fill, every click. After `browser_navigate`, call `browser_tabs` with `action: "select"` on the current tab index so the VNC viewer shows the page you just opened. Prefer `browser_snapshot` (accessibility tree with `ref` IDs) over `browser_take_screenshot`; take a screenshot only when you need to verify layout, colour, image, or canvas content. Use `browser_fill_form` over repeated `browser_fill`. Use `browser_evaluate` for state checks. Check `browser_console_messages` when something behaves unexpectedly. Dismiss cookie consent before the main task. Report CAPTCHA or bot detection as a blocker; do not try to solve it.
+**Reading JavaScript-rendered pages.** When a page needs JavaScript to show its content — and `url-get` comes back empty or as a shell — use `browser-render` with the page URL. It renders the page in the device's Chromium and returns the rendered HTML plus the visible text. It is read-only: it does not click, fill, or navigate within a page, and it does not save PDFs or screenshots (an interactive automation surface is tracked in Task 496). Report CAPTCHA or bot detection as a blocker; do not try to solve it.
 
 ## Optional capabilities
 

package/payload/platform/templates/specialists/agents/research-assistant.md

@@ -3,7 +3,7 @@ name: research-assistant
 description: "Deep research on the web, knowledge management, and writing structured summaries with citations from multiple sources. Delegate when the operator wants you to research a topic, read web pages, combine findings into a summary, or reorganise stored knowledge."
 summary: "Researches topics online, manages your knowledge graph, and produces supporting visuals."
 model: claude-opus-4-7
-tools: WebSearch, WebFetch, Skill, mcp__memory__memory-search, mcp__memory__memory-write, mcp__memory__memory-reindex, mcp__replicate__image-generate, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_evaluate
+tools: WebSearch, WebFetch, Skill, mcp__memory__memory-search, mcp__memory__memory-write, mcp__memory__memory-reindex, mcp__replicate__image-generate, mcp__browser__browser-render, mcp__url-get__url-get
 ---
 
 # Research Assistant
@@ -30,7 +30,7 @@ These three rules win when anything else in this prompt conflicts with them.
 
 **Source hierarchy.** Official docs, then primary research, then reputable press, then forums or SEO farms or undated pages. Flag anything older than 18 months as `[possibly outdated]`.
 
-**Fetch and extract.** Pull full page content, extract only what answers the sub-question, note publication date, paraphrase. Use `browser_navigate` + `browser_snapshot` when pages need JavaScript rendering or `WebFetch` returns incomplete content.
+**Fetch and extract.** Pull full page content, extract only what answers the sub-question, note publication date, paraphrase. Use `browser-render` when pages need JavaScript rendering or `WebFetch` returns incomplete content — it renders the page in the device Chromium and returns the rendered HTML and visible text.
 
 **Synthesise.** Write a structured response that answers the original question. Cite sources inline as `[1]`, `[2]`. List full sources at the end with title and URL.
 
@@ -66,7 +66,7 @@ Return to the admin agent: sources (numbered list with title and URL); key findi
 
 ## When a tool returns an error
 
-Name the tool, the target URL, and the `[tool-failure-diag]` block if present. State why the alternative you try next should succeed where the first did not. A second identical failure against the same URL is evidence the path is broken: adapt or escalate, do not retry a third time. Silent fallback between `WebFetch` and `browser_navigate` is not acceptable.
+Name the tool, the target URL, and the `[tool-failure-diag]` block if present. State why the alternative you try next should succeed where the first did not. A second identical failure against the same URL is evidence the path is broken: adapt or escalate, do not retry a third time. Silent fallback between `WebFetch` and `browser-render` is not acceptable.
 
 ## Plain English
 

package/payload/platform/plugins/admin/hooks/__tests__/playwright-file-guard.test.sh

@@ -1,278 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for playwright-file-guard.sh.
-#
-# Covers:
-#   1. file:// URL → hook emits hookSpecificOutput.updatedInput.url JSON,
-#      starts a backgrounded python3 -m http.server on a free port rooted
-#      at the file's parent dir, writes /tmp/playwright-file-guard.<port>.pid,
-#      and the rewritten URL responds 200.
-#   2. https:// URL → silent passthrough, exit 0, no stdout JSON.
-#   3. Free-port under contention: hold 8080, run hook on file://, assert
-#      chosen port != 8080.
-#   4. Stale-PID cleanup mode: pre-create stale PID file pointing at a real
-#      http.server we control, run `cleanup`, assert process killed + file
-#      removed.
-#   5. Reused-PID guard: PID file points at non-http.server process,
-#      cleanup leaves the process alone.
-#   6. Fail-open on missing python3 (PATH override).
-#   7. Malformed stdin → exit 0 silent passthrough.
-#   8. Terminal stdin guard preserved.
-#   9. Hook source contains no copy of the old menu phrase.
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/playwright-file-guard.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-# Track every PID we spawn so we can reap on EXIT.
-TRACKED_PIDS=()
-TMPFILES=()
-
-cleanup_test_state() {
-  for p in "${TRACKED_PIDS[@]:-}"; do
-    [[ -n "$p" ]] && kill -9 "$p" 2>/dev/null || true
-  done
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-  rm -f /tmp/playwright-file-guard.*.pid 2>/dev/null || true
-}
-trap cleanup_test_state EXIT
-
-PASS=0
-FAIL=0
-
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-# Sweep stale PID files BEFORE running tests so prior runs don't poison the
-# fixture. The hook's opportunistic cleanup also triggers on every call, but
-# a clean slate makes assertions deterministic.
-rm -f /tmp/playwright-file-guard.*.pid 2>/dev/null || true
-
-# ---- Test 1: file:// rewrite happy path -------------------------------------
-
-TEST_HTML=$(mktemp -t playwright-file-guard-XXXXXX).html
-echo "<html><body>hello</body></html>" > "$TEST_HTML"
-TMPFILES+=("$TEST_HTML")
-TEST_BASENAME=$(basename "$TEST_HTML")
-
-INPUT_JSON=$(printf '{"hook_event_name":"PreToolUse","tool_name":"mcp__plugin_playwright_playwright__browser_navigate","tool_input":{"url":"file://%s"}}' "$TEST_HTML")
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-
-printf '%s' "$INPUT_JSON" | bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 1: hook exited $RC on file:// rewrite (expected 0)"
-elif ! grep -q '"hookSpecificOutput"' "$STDOUT_FILE"; then
-  fail "Test 1: stdout missing hookSpecificOutput JSON. Got: $(cat "$STDOUT_FILE")"
-elif ! grep -q '"updatedInput"' "$STDOUT_FILE"; then
-  fail "Test 1: stdout missing updatedInput field. Got: $(cat "$STDOUT_FILE")"
-elif ! grep -qE '"url":\s*"http://127.0.0.1:[0-9]+/'"$TEST_BASENAME"'"' "$STDOUT_FILE"; then
-  fail "Test 1: stdout url not rewritten as expected. Got: $(cat "$STDOUT_FILE")"
-elif ! grep -q '\[playwright-file-guard\] action=rewrite' "$STDERR_FILE"; then
-  fail "Test 1: stderr missing rewrite log line. Got: $(cat "$STDERR_FILE")"
-else
-  PORT=$(grep -oE 'http://127\.0\.0\.1:[0-9]+/' "$STDOUT_FILE" | head -1 | grep -oE ':[0-9]+/' | tr -d ':/')
-  PID_FILE="/tmp/playwright-file-guard.${PORT}.pid"
-  if [[ ! -f "$PID_FILE" ]]; then
-    fail "Test 1: PID file $PID_FILE not created"
-  else
-    SERVER_PID=$(cat "$PID_FILE")
-    TRACKED_PIDS+=("$SERVER_PID")
-    HTTP_BODY=$(curl -s --max-time 2 "http://127.0.0.1:${PORT}/${TEST_BASENAME}" 2>/dev/null || true)
-    if echo "$HTTP_BODY" | grep -q "hello"; then
-      pass "Test 1: file:// → rewrite + spawned server responds 200"
-    else
-      fail "Test 1: spawned server at port $PORT did not return file content. Body: $HTTP_BODY"
-    fi
-  fi
-fi
-
-# ---- Test 2: https:// passthrough -------------------------------------------
-
-INPUT_JSON='{"hook_event_name":"PreToolUse","tool_name":"mcp__plugin_playwright_playwright__browser_navigate","tool_input":{"url":"https://example.com"}}'
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' "$INPUT_JSON" | bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 2: hook exited $RC on https:// passthrough"
-elif [[ -s "$STDOUT_FILE" ]]; then
-  fail "Test 2: stdout should be empty on passthrough. Got: $(cat "$STDOUT_FILE")"
-elif ! grep -q '\[playwright-file-guard\] action=passthrough scheme=https' "$STDERR_FILE"; then
-  fail "Test 2: stderr missing passthrough log line. Got: $(cat "$STDERR_FILE")"
-else
-  pass "Test 2: https:// → silent passthrough"
-fi
-
-# ---- Test 3: free port under :8080 contention -------------------------------
-
-python3 -c "
-import socket, time, sys
-s = socket.socket()
-try:
-  s.bind(('127.0.0.1', 8080))
-  s.listen(1)
-  print('READY', flush=True)
-  time.sleep(15)
-except OSError as e:
-  print('SKIP', e, flush=True)
-  sys.exit(0)
-" >/tmp/playwright-file-guard-test-blocker.stdout 2>&1 &
-BLOCKER_PID=$!
-TRACKED_PIDS+=("$BLOCKER_PID")
-TMPFILES+=("/tmp/playwright-file-guard-test-blocker.stdout")
-
-for _ in 1 2 3 4 5 6 7 8 9 10; do
-  if grep -qE 'READY|SKIP' /tmp/playwright-file-guard-test-blocker.stdout 2>/dev/null; then break; fi
-  sleep 0.1
-done
-
-if grep -q SKIP /tmp/playwright-file-guard-test-blocker.stdout 2>/dev/null; then
-  echo "SKIP: Test 3 — port 8080 already held by another process; cannot run contention test"
-else
-  TEST_HTML2=$(mktemp -t playwright-file-guard-XXXXXX).html
-  echo "<html>2</html>" > "$TEST_HTML2"
-  TMPFILES+=("$TEST_HTML2")
-  INPUT_JSON=$(printf '{"hook_event_name":"PreToolUse","tool_name":"mcp__plugin_playwright_playwright__browser_navigate","tool_input":{"url":"file://%s"}}' "$TEST_HTML2")
-  STDOUT_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE")
-  printf '%s' "$INPUT_JSON" | bash "$HOOK" >"$STDOUT_FILE" 2>/dev/null
-  CHOSEN_PORT=$(grep -oE 'http://127\.0\.0\.1:[0-9]+/' "$STDOUT_FILE" | head -1 | grep -oE ':[0-9]+/' | tr -d ':/')
-  if [[ -z "$CHOSEN_PORT" ]]; then
-    fail "Test 3: hook did not produce a rewrite under contention. Stdout: $(cat "$STDOUT_FILE")"
-  elif [[ "$CHOSEN_PORT" == "8080" ]]; then
-    fail "Test 3: hook picked 8080 even though it was bound"
-  else
-    SERVER_PID=$(cat "/tmp/playwright-file-guard.${CHOSEN_PORT}.pid" 2>/dev/null || echo "")
-    [[ -n "$SERVER_PID" ]] && TRACKED_PIDS+=("$SERVER_PID")
-    pass "Test 3: free-port under :8080 contention picked $CHOSEN_PORT"
-  fi
-fi
-
-# ---- Test 4: stale-PID cleanup mode (explicit argv) -------------------------
-
-STALE_DIR=$(mktemp -d); TMPFILES+=("$STALE_DIR")
-( cd "$STALE_DIR" && exec python3 -u -m http.server 0 >/tmp/playwright-file-guard-stale.stdout 2>&1 ) &
-STALE_PID=$!
-TRACKED_PIDS+=("$STALE_PID")
-TMPFILES+=("/tmp/playwright-file-guard-stale.stdout")
-# Wait up to 2s for the http.server banner to flush.
-for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-  if grep -qE 'port [0-9]+' /tmp/playwright-file-guard-stale.stdout 2>/dev/null; then break; fi
-  sleep 0.1
-done
-STALE_PORT=$(grep -oE 'port [0-9]+' /tmp/playwright-file-guard-stale.stdout 2>/dev/null | head -1 | grep -oE '[0-9]+' || echo "")
-if [[ -z "$STALE_PORT" ]]; then
-  fail "Test 4 setup: could not extract port from python3 http.server"
-else
-  STALE_PID_FILE="/tmp/playwright-file-guard.${STALE_PORT}.pid"
-  echo "$STALE_PID" > "$STALE_PID_FILE"
-  TMPFILES+=("$STALE_PID_FILE")
-  touch -t "$(date -u -v-2H +%Y%m%d%H%M.%S 2>/dev/null || date -u -d '2 hours ago' +%Y%m%d%H%M.%S)" "$STALE_PID_FILE"
-
-  bash "$HOOK" cleanup >/dev/null 2>&1
-
-  # SIGTERM is asynchronous — wait up to 1s for the process to actually die.
-  for _ in 1 2 3 4 5 6 7 8 9 10; do
-    if ! kill -0 "$STALE_PID" 2>/dev/null; then break; fi
-    sleep 0.1
-  done
-
-  if kill -0 "$STALE_PID" 2>/dev/null; then
-    fail "Test 4: stale PID $STALE_PID still alive after cleanup"
-    kill -9 "$STALE_PID" 2>/dev/null || true
-  elif [[ -f "$STALE_PID_FILE" ]]; then
-    fail "Test 4: stale PID file $STALE_PID_FILE not removed after cleanup"
-  else
-    pass "Test 4: stale-PID cleanup killed http.server + removed PID file"
-  fi
-fi
-
-# ---- Test 5: reused-PID guard ----------------------------------------------
-
-REUSED_PID_FILE="/tmp/playwright-file-guard.59999.pid"
-echo "$$" > "$REUSED_PID_FILE"
-TMPFILES+=("$REUSED_PID_FILE")
-touch -t "$(date -u -v-2H +%Y%m%d%H%M.%S 2>/dev/null || date -u -d '2 hours ago' +%Y%m%d%H%M.%S)" "$REUSED_PID_FILE"
-
-bash "$HOOK" cleanup >/dev/null 2>&1
-
-if ! kill -0 "$$" 2>/dev/null; then
-  fail "Test 5: reused-PID guard killed our own bash process — fatal"
-elif [[ -f "$REUSED_PID_FILE" ]]; then
-  fail "Test 5: reused-PID file $REUSED_PID_FILE not removed (hook should drop the stale ref)"
-else
-  pass "Test 5: reused-PID guard left process alive, dropped stale PID file"
-fi
-
-# ---- Test 6: missing python3 fails open ------------------------------------
-
-EMPTY_PATH_DIR=$(mktemp -d); TMPFILES+=("$EMPTY_PATH_DIR")
-ln -s "$(command -v bash)" "$EMPTY_PATH_DIR/bash"
-ln -s "$(command -v grep)" "$EMPTY_PATH_DIR/grep"
-ln -s "$(command -v cat)" "$EMPTY_PATH_DIR/cat"
-ln -s "$(command -v rm)" "$EMPTY_PATH_DIR/rm"
-ln -s "$(command -v mktemp)" "$EMPTY_PATH_DIR/mktemp"
-
-INPUT_JSON='{"hook_event_name":"PreToolUse","tool_name":"mcp__plugin_playwright_playwright__browser_navigate","tool_input":{"url":"file:///tmp/missing-python.html"}}'
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-PATH="$EMPTY_PATH_DIR" printf '%s' "$INPUT_JSON" | PATH="$EMPTY_PATH_DIR" bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 6: missing python3 should fail open (exit 0), got $RC"
-elif [[ -s "$STDOUT_FILE" ]]; then
-  fail "Test 6: stdout should be empty on fail-open. Got: $(cat "$STDOUT_FILE")"
-elif ! grep -q '\[playwright-file-guard\] action=fail reason=python3-missing' "$STDERR_FILE"; then
-  fail "Test 6: stderr missing python3-missing log line. Got: $(cat "$STDERR_FILE")"
-else
-  pass "Test 6: missing python3 → fail open with diagnostic"
-fi
-
-# ---- Test 7: malformed stdin → silent passthrough ---------------------------
-
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' 'not json at all { ' | bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 7: malformed stdin should fail open (exit 0), got $RC"
-elif [[ -s "$STDOUT_FILE" ]]; then
-  fail "Test 7: stdout should be empty on malformed stdin"
-else
-  pass "Test 7: malformed stdin → silent passthrough"
-fi
-
-# ---- Test 8: terminal stdin guard preserved --------------------------------
-
-if ! grep -q '\[ -t 0 \]' "$HOOK"; then
-  fail "Test 8: terminal stdin guard ([ -t 0 ]) missing from hook"
-else
-  pass "Test 8: terminal stdin guard present"
-fi
-
-# ---- Test 9: zero-grep-hits for old menu copy in this hook ------------------
-
-# The pattern uses [l] to break self-match: this file's bytes contain "[l]ocal"
-# but the hook source contains "local" if the menu copy was reintroduced. The
-# extended-regex bracket class matches "local" without our query containing
-# the literal string we're forbidding.
-OLD_MENU_PATTERN='Start a [l]ocal HTTP server'
-if grep -qE "$OLD_MENU_PATTERN" "$HOOK"; then
-  fail "Test 9: hook still contains the old menu copy"
-else
-  pass "Test 9: hook does not contain the old menu copy"
-fi
-
-echo
-echo "──────── playwright-file-guard test summary ────────"
-echo "PASS: $PASS"
-echo "FAIL: $FAIL"
-
-[[ "$FAIL" -gt 0 ]] && exit 1
-exit 0

package/payload/platform/plugins/admin/hooks/playwright-file-guard.sh

@@ -1,214 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse hook — rewrites file:// browser_navigate calls to a backgrounded
-# loopback HTTP server, so Playwright never sees a file:// URL (which it
-# blocks behind a 2-minute MCP timeout).
-#
-# Scoped to mcp__plugin_playwright_playwright__browser_navigate via the
-# settings.json matcher.
-#
-# Modes:
-#   default (stdin = PreToolUse JSON):
-#     - Sweeps stale /tmp/playwright-file-guard.*.pid (>1h old) opportunistically.
-#     - If tool_input.url is file://, picks a free port, backgrounds
-#       `python3 -m http.server <port>` rooted at the file's parent dir,
-#       connect-verifies the server within 1s, writes PID to
-#       /tmp/playwright-file-guard.<port>.pid, and emits a JSON object on
-#       stdout setting hookSpecificOutput.updatedInput.url to
-#       http://127.0.0.1:<port>/<basename>.
-#     - Other URLs: passthrough log to stderr, exit 0, no stdout.
-#
-#   `cleanup` argv: only runs the stale-PID sweep; does not read stdin.
-#
-# Error philosophy: fail open. Any internal failure → exit 0 with a stderr
-# diagnostic, letting Playwright handle the original URL (the legacy
-# 2-minute timeout) rather than block on a parser bug.
-#
-# Observability: every action emits one stderr line of the shape
-#   [playwright-file-guard] action=<rewrite|passthrough|cleanup|fail> ...
-
-set -u
-
-MODE="${1:-rewrite}"
-
-# Terminal stdin guard. Cleanup mode never reads stdin.
-if [[ "$MODE" != "cleanup" ]] && [ -t 0 ]; then
-  exit 0
-fi
-
-# Without python3 we cannot do anything useful. Drain stdin (so the upstream
-# tool dispatcher does not get SIGPIPE) and fail open.
-if ! command -v python3 >/dev/null 2>&1; then
-  if [[ "$MODE" != "cleanup" ]]; then
-    cat >/dev/null
-  fi
-  echo "[playwright-file-guard] action=fail reason=python3-missing" >&2
-  exit 0
-fi
-
-if [[ "$MODE" == "cleanup" ]]; then
-  INPUT=""
-else
-  INPUT=$(cat)
-fi
-
-MODE="$MODE" INPUT="$INPUT" python3 <<'PY' || exit 0
-import os, sys, json, glob, time, socket, subprocess
-from urllib.parse import unquote
-
-MODE = os.environ.get('MODE', 'rewrite')
-INPUT = os.environ.get('INPUT', '')
-NOW = time.time()
-STALE_THRESHOLD = 3600  # 1h
-PID_GLOB = '/tmp/playwright-file-guard.*.pid'
-
-def log(line):
-    print(line, file=sys.stderr, flush=True)
-
-def port_from_pidfile(path):
-    parts = os.path.basename(path).split('.')
-    return parts[1] if len(parts) >= 3 else 'unknown'
-
-def sweep_stale():
-    for pid_file in glob.glob(PID_GLOB):
-        try:
-            mtime = os.stat(pid_file).st_mtime
-        except OSError:
-            continue
-        if NOW - mtime < STALE_THRESHOLD:
-            continue
-        port = port_from_pidfile(pid_file)
-        try:
-            with open(pid_file) as f:
-                pid = int(f.read().strip())
-        except Exception:
-            try: os.remove(pid_file)
-            except OSError: pass
-            log(f'[playwright-file-guard] action=cleanup port={port} status=unparseable-pid')
-            continue
-        cmd = subprocess.run(
-            ['ps', '-p', str(pid), '-o', 'command='],
-            capture_output=True, text=True,
-        )
-        cmdline = cmd.stdout if cmd.returncode == 0 else ''
-        # macOS ps resolves /usr/local/bin/python3 → Python.app binary "Python";
-        # Linux/Pi ps shows "python3". Match either via case-insensitive
-        # `python` substring + the unambiguous `http.server` invocation.
-        cmdline_lower = cmdline.lower()
-        if 'python' in cmdline_lower and 'http.server' in cmdline_lower:
-            subprocess.run(['kill', str(pid)], capture_output=True)
-            log(f'[playwright-file-guard] action=cleanup port={port} pid={pid} status=killed')
-        else:
-            log(f'[playwright-file-guard] action=cleanup port={port} pid={pid} status=pid-reused-skip')
-        try: os.remove(pid_file)
-        except OSError: pass
-
-# Opportunistic sweep on every invocation — closes the gap that nothing
-# currently calls cleanup on a periodic schedule.
-sweep_stale()
-
-if MODE == 'cleanup':
-    sys.exit(0)
-
-try:
-    payload = json.loads(INPUT) if INPUT else {}
-except Exception:
-    sys.exit(0)
-
-tool_input = payload.get('tool_input') or {}
-url = tool_input.get('url')
-if not isinstance(url, str) or not url:
-    sys.exit(0)
-
-clean_url = url.split('#', 1)[0].split('?', 1)[0]
-
-if '://' not in clean_url:
-    log('[playwright-file-guard] action=passthrough scheme=none')
-    sys.exit(0)
-
-scheme, rest = clean_url.split('://', 1)
-scheme = scheme.lower()
-if scheme != 'file':
-    log(f'[playwright-file-guard] action=passthrough scheme={scheme}')
-    sys.exit(0)
-
-# file:///abs/path → /abs/path; file://host/path → /path (host ignored).
-if rest.startswith('/'):
-    file_path = rest
-elif '/' in rest:
-    file_path = '/' + rest.split('/', 1)[1]
-else:
-    file_path = '/'
-
-file_path = unquote(file_path)
-abs_path = os.path.abspath(file_path)
-
-if not os.path.isfile(abs_path):
-    log(f'[playwright-file-guard] action=fail reason=file-not-found path={abs_path}')
-    sys.exit(0)
-
-served_dir = os.path.dirname(abs_path)
-basename = os.path.basename(abs_path)
-
-try:
-    s = socket.socket()
-    s.bind(('127.0.0.1', 0))
-    port = s.getsockname()[1]
-    s.close()
-except Exception as e:
-    log(f'[playwright-file-guard] action=fail reason=port-pick-failed err={type(e).__name__}')
-    sys.exit(0)
-
-try:
-    proc = subprocess.Popen(
-        [sys.executable, '-m', 'http.server', str(port), '--bind', '127.0.0.1'],
-        cwd=served_dir,
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-        start_new_session=True,
-    )
-except Exception as e:
-    log(f'[playwright-file-guard] action=fail reason=spawn-failed err={type(e).__name__}')
-    sys.exit(0)
-
-pid_file = f'/tmp/playwright-file-guard.{port}.pid'
-try:
-    with open(pid_file, 'w') as f:
-        f.write(str(proc.pid))
-except Exception:
-    pass
-
-# Connect-verify within 1s closes the TOCTOU window between bind(0) and the
-# http.server actually accepting connections.
-deadline = time.time() + 1.0
-ready = False
-while time.time() < deadline:
-    try:
-        sock = socket.create_connection(('127.0.0.1', port), timeout=0.2)
-        sock.close()
-        ready = True
-        break
-    except OSError:
-        time.sleep(0.05)
-
-if not ready:
-    try: proc.kill()
-    except Exception: pass
-    try: os.remove(pid_file)
-    except OSError: pass
-    log(f'[playwright-file-guard] action=fail reason=server-not-ready port={port}')
-    sys.exit(0)
-
-new_url = f'http://127.0.0.1:{port}/{basename}'
-updated_input = dict(tool_input)
-updated_input['url'] = new_url
-
-print(json.dumps({
-    'hookSpecificOutput': {
-        'hookEventName': 'PreToolUse',
-        'permissionDecision': 'allow',
-        'permissionDecisionReason': 'file:// rewritten to local http.server',
-        'updatedInput': updated_input,
-    },
-}))
-log(f'[playwright-file-guard] action=rewrite original=file://{abs_path} served_dir={served_dir} port={port} pid={proc.pid}')
-PY