@rubytech/create-realagent 1.0.853 → 1.0.855

package/payload/platform/plugins/admin/hooks/playwright-file-guard.sh

@@ -1,30 +1,214 @@
 #!/usr/bin/env bash
-# PreToolUse hook — intercepts browser_navigate with file:// URLs.
+# PreToolUse hook — rewrites file:// browser_navigate calls to a backgrounded
+# loopback HTTP server, so Playwright never sees a file:// URL (which it
+# blocks behind a 2-minute MCP timeout).
 #
-# Scoped to mcp__plugin_playwright_playwright__browser_navigate via
-# the settings.json matcher. Blocks file:// attempts with actionable
-# guidance so the agent self-corrects on the first try instead of
-# retrying into Playwright's cryptic error + 2-minute MCP timeout.
+# Scoped to mcp__plugin_playwright_playwright__browser_navigate via the
+# settings.json matcher.
 #
-# Error philosophy: fail open. This is a guidance hook, not a security
-# boundary. If parsing fails, the tool proceeds normally and the agent
-# gets the standard Playwright error.
+# Modes:
+#   default (stdin = PreToolUse JSON):
+#     - Sweeps stale /tmp/playwright-file-guard.*.pid (>1h old) opportunistically.
+#     - If tool_input.url is file://, picks a free port, backgrounds
+#       `python3 -m http.server <port>` rooted at the file's parent dir,
+#       connect-verifies the server within 1s, writes PID to
+#       /tmp/playwright-file-guard.<port>.pid, and emits a JSON object on
+#       stdout setting hookSpecificOutput.updatedInput.url to
+#       http://127.0.0.1:<port>/<basename>.
+#     - Other URLs: passthrough log to stderr, exit 0, no stdout.
+#
+#   `cleanup` argv: only runs the stale-PID sweep; does not read stdin.
+#
+# Error philosophy: fail open. Any internal failure → exit 0 with a stderr
+# diagnostic, letting Playwright handle the original URL (the legacy
+# 2-minute timeout) rather than block on a parser bug.
+#
+# Observability: every action emits one stderr line of the shape
+#   [playwright-file-guard] action=<rewrite|passthrough|cleanup|fail> ...
+
+set -u
 
-if [ -t 0 ]; then
+MODE="${1:-rewrite}"
+
+# Terminal stdin guard. Cleanup mode never reads stdin.
+if [[ "$MODE" != "cleanup" ]] && [ -t 0 ]; then
   exit 0
 fi
-INPUT=$(cat)
-
-if echo "$INPUT" | grep -qiE '"url"\s*:\s*"file://'; then
-  cat >&2 << 'EOF'
-file:// URLs are blocked by Playwright. To view a local HTML file in the browser:
 
-1. Start a local HTTP server: python3 -m http.server 8080
-2. Navigate to http://localhost:8080/filename.html instead
+# Without python3 we cannot do anything useful. Drain stdin (so the upstream
+# tool dispatcher does not get SIGPIPE) and fail open.
+if ! command -v python3 >/dev/null 2>&1; then
+  if [[ "$MODE" != "cleanup" ]]; then
+    cat >/dev/null
+  fi
+  echo "[playwright-file-guard] action=fail reason=python3-missing" >&2
+  exit 0
+fi
 
-Do not retry with file:// — it will always fail.
-EOF
-  exit 2
+if [[ "$MODE" == "cleanup" ]]; then
+  INPUT=""
+else
+  INPUT=$(cat)
 fi
 
-exit 0
+MODE="$MODE" INPUT="$INPUT" python3 <<'PY' || exit 0
+import os, sys, json, glob, time, socket, subprocess
+from urllib.parse import unquote
+
+MODE = os.environ.get('MODE', 'rewrite')
+INPUT = os.environ.get('INPUT', '')
+NOW = time.time()
+STALE_THRESHOLD = 3600  # 1h
+PID_GLOB = '/tmp/playwright-file-guard.*.pid'
+
+def log(line):
+    print(line, file=sys.stderr, flush=True)
+
+def port_from_pidfile(path):
+    parts = os.path.basename(path).split('.')
+    return parts[1] if len(parts) >= 3 else 'unknown'
+
+def sweep_stale():
+    for pid_file in glob.glob(PID_GLOB):
+        try:
+            mtime = os.stat(pid_file).st_mtime
+        except OSError:
+            continue
+        if NOW - mtime < STALE_THRESHOLD:
+            continue
+        port = port_from_pidfile(pid_file)
+        try:
+            with open(pid_file) as f:
+                pid = int(f.read().strip())
+        except Exception:
+            try: os.remove(pid_file)
+            except OSError: pass
+            log(f'[playwright-file-guard] action=cleanup port={port} status=unparseable-pid')
+            continue
+        cmd = subprocess.run(
+            ['ps', '-p', str(pid), '-o', 'command='],
+            capture_output=True, text=True,
+        )
+        cmdline = cmd.stdout if cmd.returncode == 0 else ''
+        # macOS ps resolves /usr/local/bin/python3 → Python.app binary "Python";
+        # Linux/Pi ps shows "python3". Match either via case-insensitive
+        # `python` substring + the unambiguous `http.server` invocation.
+        cmdline_lower = cmdline.lower()
+        if 'python' in cmdline_lower and 'http.server' in cmdline_lower:
+            subprocess.run(['kill', str(pid)], capture_output=True)
+            log(f'[playwright-file-guard] action=cleanup port={port} pid={pid} status=killed')
+        else:
+            log(f'[playwright-file-guard] action=cleanup port={port} pid={pid} status=pid-reused-skip')
+        try: os.remove(pid_file)
+        except OSError: pass
+
+# Opportunistic sweep on every invocation — closes the gap that nothing
+# currently calls cleanup on a periodic schedule.
+sweep_stale()
+
+if MODE == 'cleanup':
+    sys.exit(0)
+
+try:
+    payload = json.loads(INPUT) if INPUT else {}
+except Exception:
+    sys.exit(0)
+
+tool_input = payload.get('tool_input') or {}
+url = tool_input.get('url')
+if not isinstance(url, str) or not url:
+    sys.exit(0)
+
+clean_url = url.split('#', 1)[0].split('?', 1)[0]
+
+if '://' not in clean_url:
+    log('[playwright-file-guard] action=passthrough scheme=none')
+    sys.exit(0)
+
+scheme, rest = clean_url.split('://', 1)
+scheme = scheme.lower()
+if scheme != 'file':
+    log(f'[playwright-file-guard] action=passthrough scheme={scheme}')
+    sys.exit(0)
+
+# file:///abs/path → /abs/path; file://host/path → /path (host ignored).
+if rest.startswith('/'):
+    file_path = rest
+elif '/' in rest:
+    file_path = '/' + rest.split('/', 1)[1]
+else:
+    file_path = '/'
+
+file_path = unquote(file_path)
+abs_path = os.path.abspath(file_path)
+
+if not os.path.isfile(abs_path):
+    log(f'[playwright-file-guard] action=fail reason=file-not-found path={abs_path}')
+    sys.exit(0)
+
+served_dir = os.path.dirname(abs_path)
+basename = os.path.basename(abs_path)
+
+try:
+    s = socket.socket()
+    s.bind(('127.0.0.1', 0))
+    port = s.getsockname()[1]
+    s.close()
+except Exception as e:
+    log(f'[playwright-file-guard] action=fail reason=port-pick-failed err={type(e).__name__}')
+    sys.exit(0)
+
+try:
+    proc = subprocess.Popen(
+        [sys.executable, '-m', 'http.server', str(port), '--bind', '127.0.0.1'],
+        cwd=served_dir,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        start_new_session=True,
+    )
+except Exception as e:
+    log(f'[playwright-file-guard] action=fail reason=spawn-failed err={type(e).__name__}')
+    sys.exit(0)
+
+pid_file = f'/tmp/playwright-file-guard.{port}.pid'
+try:
+    with open(pid_file, 'w') as f:
+        f.write(str(proc.pid))
+except Exception:
+    pass
+
+# Connect-verify within 1s closes the TOCTOU window between bind(0) and the
+# http.server actually accepting connections.
+deadline = time.time() + 1.0
+ready = False
+while time.time() < deadline:
+    try:
+        sock = socket.create_connection(('127.0.0.1', port), timeout=0.2)
+        sock.close()
+        ready = True
+        break
+    except OSError:
+        time.sleep(0.05)
+
+if not ready:
+    try: proc.kill()
+    except Exception: pass
+    try: os.remove(pid_file)
+    except OSError: pass
+    log(f'[playwright-file-guard] action=fail reason=server-not-ready port={port}')
+    sys.exit(0)
+
+new_url = f'http://127.0.0.1:{port}/{basename}'
+updated_input = dict(tool_input)
+updated_input['url'] = new_url
+
+print(json.dumps({
+    'hookSpecificOutput': {
+        'hookEventName': 'PreToolUse',
+        'permissionDecision': 'allow',
+        'permissionDecisionReason': 'file:// rewritten to local http.server',
+        'updatedInput': updated_input,
+    },
+}))
+log(f'[playwright-file-guard] action=rewrite original=file://{abs_path} served_dir={served_dir} port={port} pid={proc.pid}')
+PY

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -9,6 +9,7 @@ import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeKey, validateKey, hasKey, keyFilePath, deleteKey } from "../../../../lib/anthropic-key/dist/index.js";
 import { writeAdminEntry, removeAdminFromAccount } from "../../../../lib/admins-write/dist/index.js";
+import { isPersistentComponent } from "../../../../lib/persistent-components/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
 import { substituteBrandPlaceholders } from "../../../../lib/brand-templating/dist/index.js";
 import { resolveEntitlement } from "../../../../lib/entitlement/dist/index.js";
@@ -1631,12 +1632,50 @@ server.tool("plugin-read", "Read a plugin definition (PLUGIN.md) or one of its r
         };
     }
 });
+// Task 940 — `"rendered"` is a sentinel, not a persistence ack. The platform
+// UI's stream-parser intercepts this tool_use upstream of the SDK reply
+// (platform/ui/app/lib/claude-agent/stream-parser.ts:362) and emits a typed
+// `component` event that admin-agent.ts's persistMessage flushes to Neo4j as
+// a sibling :Component node.
+//
+// Task 942 — render-component is also the *server commitment surface* for
+// PERSISTENT_COMPONENTS (action-list, document-editor, rich-content-editor,
+// grid-editor). The actual file write + :KnowledgeDocument projection lives
+// in the admin server process (stream-parser path) because the SDK delivers
+// `tool_use.input` to the UI in the assistant message but the MCP handler's
+// return reaches only the agent — there is no path back to persistMessage
+// from here. This handler emits a one-line observability marker per
+// persistence-eligible call so operators can grep for the commitment, and
+// returns richer JSON so the doctrine grep
+// `render-component.*"rendered"` resolves to a persistence-aware handler
+// rather than a bare stub.
 server.tool("render-component", "Render a pre-built UI component inline in the conversation. " +
     "Call this instead of describing a UI — the component handles input collection. " +
     "Wait for the user's response before continuing.", {
     name: z.string().describe("Component name from the UI suite (e.g. single-select, confirm, info-card, form, progress)"),
     data: z.record(z.string(), z.unknown()),
-}, async () => ({ content: [{ type: "text", text: "rendered" }] }));
+}, async ({ name, data }) => {
+    if (isPersistentComponent(name)) {
+        // Persistence-eligible: log the commitment so the live + audit grep
+        // (`[render-component-persist]`) can correlate the MCP call against
+        // the downstream :KnowledgeDocument MERGE. Byte counts come from
+        // data.html (preferred) or data.content; both being absent is a
+        // legitimate render of an empty editor and the projection is skipped
+        // server-side.
+        const html = typeof data?.html === "string" ? data.html : "";
+        const content = typeof data?.content === "string" ? data.content : "";
+        const bytes = html.length > 0 ? html.length : content.length;
+        const mimeType = html.length > 0 ? "text/html" : (content.length > 0 ? "text/markdown" : "");
+        console.error(`[render-component-persist] componentName=${name} bytes=${bytes} mimeType=${mimeType || "none"}`);
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({ rendered: true, name, persistent: true, bytes, mimeType }),
+                }],
+        };
+    }
+    return { content: [{ type: "text", text: "rendered" }] };
+});
 server.tool("session-reset", "Reset the current session. Compacts conversation history to memory, clears the visible conversation, " +
     "and starts a fresh session with a new greeting. Call when the user asks to start a new session, " +
     "clear the conversation, or start fresh.", {}, async () => ({ content: [{ type: "text", text: "reset" }] }));