@rynx-ai/daemon 0.1.0 → 0.1.9

package/dist/browser-cli-args.d.ts

@@ -0,0 +1,20 @@
+export type BrowserCliSubcommand = "install" | "update" | "version" | "clean" | "open" | "status" | "pages" | "endpoint" | "close";
+export interface BrowserCliArgs {
+    subcommand: BrowserCliSubcommand;
+    json: boolean;
+    ensure: boolean;
+    channel?: string;
+    version?: string;
+    runtime?: string;
+    session?: string;
+    url?: string;
+}
+export interface BrowserCliTarget {
+    runtimeSelector: string;
+    sessionId: string;
+    credential?: RuntimeBrowserBootstrapCredential;
+}
+export declare function parseBrowserCliArgs(args: readonly string[]): BrowserCliArgs;
+/** Resolve authority without ever turning a managed Session into an operator. */
+export declare function resolveBrowserCliTarget(args: BrowserCliArgs, managedCredential: RuntimeBrowserBootstrapCredential | undefined): BrowserCliTarget;
+import type { RuntimeBrowserBootstrapCredential } from "@rynx-ai/protocol/runtime-browser-bootstrap";

package/dist/browser-cli-args.js

@@ -0,0 +1,100 @@
+const SPECS = {
+    install: { values: ["--channel", "--version"], flags: ["--json"] },
+    update: { values: ["--channel"], flags: ["--json"] },
+    version: { values: [], flags: ["--json"] },
+    clean: { values: [], flags: ["--json"] },
+    open: {
+        values: ["--url", "--session", "--runtime"],
+        flags: ["--json"],
+        positionalUrl: true,
+    },
+    status: { values: ["--session", "--runtime"], flags: ["--json"] },
+    pages: { values: ["--session", "--runtime"], flags: ["--json"] },
+    endpoint: { values: ["--session"], flags: ["--ensure", "--json"] },
+    close: { values: ["--session", "--runtime"], flags: ["--json"] },
+};
+export function parseBrowserCliArgs(args) {
+    const subcommand = args[0];
+    if (!isBrowserSubcommand(subcommand)) {
+        throw new Error("browser: expected install, update, version, clean, open, status, pages, endpoint, or close");
+    }
+    const spec = SPECS[subcommand];
+    const values = new Map();
+    const flags = new Set();
+    const positionals = [];
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg.startsWith("--")) {
+            if (spec.flags.includes(arg)) {
+                if (flags.has(arg))
+                    throw new Error(`browser ${subcommand}: duplicate option ${arg}`);
+                flags.add(arg);
+                continue;
+            }
+            if (spec.values.includes(arg)) {
+                if (values.has(arg))
+                    throw new Error(`browser ${subcommand}: duplicate option ${arg}`);
+                const value = args[index + 1];
+                if (!value || value.startsWith("--")) {
+                    throw new Error(`browser ${subcommand}: ${arg} requires a value`);
+                }
+                values.set(arg, value);
+                index += 1;
+                continue;
+            }
+            throw new Error(`browser ${subcommand}: unknown option ${arg}`);
+        }
+        positionals.push(arg);
+    }
+    if (!spec.positionalUrl && positionals.length > 0) {
+        throw new Error(`browser ${subcommand}: unexpected argument ${positionals[0]}`);
+    }
+    if (positionals.length > 1) {
+        throw new Error(`browser ${subcommand}: unexpected extra argument ${positionals[1]}`);
+    }
+    if (positionals.length === 1 && values.has("--url")) {
+        throw new Error("browser open: pass the URL once, either positionally or with --url");
+    }
+    return {
+        subcommand,
+        json: flags.has("--json"),
+        ensure: flags.has("--ensure"),
+        ...(values.has("--channel") ? { channel: values.get("--channel") } : {}),
+        ...(values.has("--version") ? { version: values.get("--version") } : {}),
+        ...(values.has("--runtime") ? { runtime: values.get("--runtime") } : {}),
+        ...(values.has("--session") ? { session: values.get("--session") } : {}),
+        ...(values.has("--url") || positionals[0]
+            ? { url: values.get("--url") ?? positionals[0] }
+            : {}),
+    };
+}
+/** Resolve authority without ever turning a managed Session into an operator. */
+export function resolveBrowserCliTarget(args, managedCredential) {
+    const runtimeSelector = args.runtime ?? "local";
+    if (runtimeSelector !== "local") {
+        if (managedCredential) {
+            throw new Error("browser: a managed Session cannot select another Runtime");
+        }
+        if (!args.session) {
+            throw new Error("browser: --session is required when selecting a remote Runtime");
+        }
+        return { runtimeSelector, sessionId: args.session };
+    }
+    if (managedCredential) {
+        if (args.session && args.session !== managedCredential.sessionId) {
+            throw new Error("browser: a managed Session cannot control another Session with --session");
+        }
+        return {
+            runtimeSelector: "local",
+            sessionId: managedCredential.sessionId,
+            credential: managedCredential,
+        };
+    }
+    if (!args.session) {
+        throw new Error("browser: run inside a managed Rynx Session or pass --session for operator access");
+    }
+    return { runtimeSelector: "local", sessionId: args.session };
+}
+function isBrowserSubcommand(value) {
+    return value !== undefined && Object.hasOwn(SPECS, value);
+}

package/dist/browser-runner-session-context.d.ts

@@ -0,0 +1,24 @@
+import { SessionBrowserCapabilityStore } from "./session-browser-capability-store.js";
+export interface BrowserRunnerSessionContextProviderOptions {
+    rootDir: string;
+    capabilities: SessionBrowserCapabilityStore;
+}
+/**
+ * Supplies managed runners with an atomically replaceable Session credential.
+ * A file indirection is necessary because Claude clear/fork keeps the same
+ * process tree while changing the owning Rynx Session.
+ */
+export declare class BrowserRunnerSessionContextProvider {
+    private readonly options;
+    private readonly rootDir;
+    private readonly contexts;
+    private closed;
+    constructor(options: BrowserRunnerSessionContextProviderOptions);
+    open(sessionId: string): {
+        childEnv: Readonly<Record<string, string>>;
+        rotate(newSessionId: string): void;
+        close(): void;
+    };
+    closeAll(): void;
+    private closeContext;
+}

package/dist/browser-runner-session-context.js

@@ -0,0 +1,113 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { RUNTIME_BROWSER_CONTEXT_FILE_ENV, parseRuntimeBrowserBootstrapCredential, } from "@rynx-ai/protocol/runtime-browser-bootstrap";
+/**
+ * Supplies managed runners with an atomically replaceable Session credential.
+ * A file indirection is necessary because Claude clear/fork keeps the same
+ * process tree while changing the owning Rynx Session.
+ */
+export class BrowserRunnerSessionContextProvider {
+    options;
+    rootDir;
+    contexts = new Set();
+    closed = false;
+    constructor(options) {
+        this.options = options;
+        this.rootDir = resolve(options.rootDir);
+        ensureProtectedDirectory(this.rootDir);
+        removeStaleOwnedContexts(this.rootDir);
+    }
+    open(sessionId) {
+        if (this.closed)
+            throw new Error("Browser runner Session context provider is closed");
+        const owned = {
+            file: join(this.rootDir, `context-${randomBytes(18).toString("base64url")}.json`),
+            closed: false,
+        };
+        writeCredential(owned.file, sessionId, this.options.capabilities.issue(sessionId));
+        this.contexts.add(owned);
+        return {
+            childEnv: Object.freeze({ [RUNTIME_BROWSER_CONTEXT_FILE_ENV]: owned.file }),
+            rotate: (newSessionId) => {
+                if (owned.closed || this.closed) {
+                    throw new Error("Browser runner Session context is closed");
+                }
+                writeCredential(owned.file, newSessionId, this.options.capabilities.issue(newSessionId));
+            },
+            close: () => this.closeContext(owned),
+        };
+    }
+    closeAll() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const context of [...this.contexts])
+            this.closeContext(context);
+    }
+    closeContext(context) {
+        if (context.closed)
+            return;
+        context.closed = true;
+        this.contexts.delete(context);
+        removeOwnedRegularFile(context.file);
+    }
+}
+function ensureProtectedDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error("Browser runner Session context root must be a direct directory");
+    }
+    chmodSync(path, 0o700);
+}
+const OWNED_CONTEXT_NAME = /^context-[A-Za-z0-9_-]{24}\.json$/;
+const OWNED_CONTEXT_TEMP_NAME = /^\.context-write-[A-Za-z0-9_-]{24}\.tmp$/;
+/** A fresh provider has no live contexts, so exact-name protected files from
+ * the previous daemon incarnation are stale. Foreign names, links, unusual
+ * permissions, and directories are never treated as provider-owned. */
+function removeStaleOwnedContexts(rootDir) {
+    for (const entry of readdirSync(rootDir, { withFileTypes: true })) {
+        if (!entry.isFile() || entry.isSymbolicLink())
+            continue;
+        if (!OWNED_CONTEXT_NAME.test(entry.name) && !OWNED_CONTEXT_TEMP_NAME.test(entry.name))
+            continue;
+        const file = join(rootDir, entry.name);
+        const stat = lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o600)
+            continue;
+        rmSync(file, { force: true });
+    }
+}
+function writeCredential(file, sessionId, capability) {
+    const credential = parseRuntimeBrowserBootstrapCredential({ sessionId, capability });
+    const temporary = join(dirname(file), `.context-write-${randomBytes(18).toString("base64url")}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporary, "wx", 0o600);
+        writeFileSync(descriptor, `${JSON.stringify(credential)}\n`, "utf8");
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        renameSync(temporary, file);
+        chmodSync(file, 0o600);
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        rmSync(temporary, { force: true });
+        throw error;
+    }
+}
+function removeOwnedRegularFile(file) {
+    try {
+        const stat = lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return;
+        rmSync(file, { force: true });
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}

package/dist/cdp-keyboard-input.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimeBrowserSurfaceInputEvent } from "@rynx-ai/protocol/runtime-browser-surface";
+type SurfaceKeyboardEvent = Extract<RuntimeBrowserSurfaceInputEvent, {
+    type: "key.down" | "key.up";
+}>;
+export declare function cdpKeyboardEventParams(event: SurfaceKeyboardEvent, targetPlatform: string): Record<string, unknown>;
+export {};

package/dist/cdp-keyboard-input.js

@@ -0,0 +1,209 @@
+export function cdpKeyboardEventParams(event, targetPlatform) {
+    const windowsVirtualKeyCode = windowsVirtualKeyCodeFor(event.key, event.code);
+    const location = keyLocationFor(event.code);
+    const commands = event.type === "key.down"
+        ? editingCommandsFor(event, targetPlatform)
+        : [];
+    return {
+        type: event.type === "key.down" ? "rawKeyDown" : "keyUp",
+        key: event.key,
+        code: event.code,
+        autoRepeat: event.repeat,
+        modifiers: modifierMask(event.modifiers),
+        ...(windowsVirtualKeyCode === undefined ? {} : { windowsVirtualKeyCode }),
+        ...(location === 0 ? {} : { location }),
+        ...(location === 3 ? { isKeypad: true } : {}),
+        ...(commands.length === 0 ? {} : { commands }),
+    };
+}
+const MAC_EDITING_COMMANDS = {
+    Backspace: "deleteBackward",
+    Delete: "deleteForward",
+    Enter: "insertNewline",
+    NumpadEnter: "insertNewline",
+    ArrowUp: "moveUp",
+    ArrowDown: "moveDown",
+    ArrowLeft: "moveLeft",
+    ArrowRight: "moveRight",
+    "Shift+ArrowUp": "moveUpAndModifySelection",
+    "Shift+ArrowDown": "moveDownAndModifySelection",
+    "Shift+ArrowLeft": "moveLeftAndModifySelection",
+    "Shift+ArrowRight": "moveRightAndModifySelection",
+    "Meta+KeyA": "selectAll",
+    "Meta+KeyZ": "undo",
+    "Shift+Meta+KeyZ": "redo",
+};
+const NON_MAC_EDITING_COMMANDS = {
+    "Control+KeyA": "selectAll",
+};
+function editingCommandsFor(event, targetPlatform) {
+    const commandKey = /^[A-Za-z]$/.test(event.key)
+        ? `Key${event.key.toUpperCase()}`
+        : event.code;
+    const shortcut = [
+        event.modifiers.includes("shift") ? "Shift" : undefined,
+        event.modifiers.includes("control") ? "Control" : undefined,
+        event.modifiers.includes("alt") ? "Alt" : undefined,
+        event.modifiers.includes("meta") ? "Meta" : undefined,
+        commandKey,
+    ].filter((part) => part !== undefined).join("+");
+    const command = targetPlatform === "darwin"
+        ? MAC_EDITING_COMMANDS[shortcut]
+        : NON_MAC_EDITING_COMMANDS[shortcut];
+    return command === undefined ? [] : [command];
+}
+function modifierMask(modifiers) {
+    let mask = 0;
+    if (modifiers.includes("alt"))
+        mask |= 1;
+    if (modifiers.includes("control"))
+        mask |= 2;
+    if (modifiers.includes("meta"))
+        mask |= 4;
+    if (modifiers.includes("shift"))
+        mask |= 8;
+    return mask;
+}
+const WINDOWS_VIRTUAL_KEY_CODE_BY_KEY = {
+    Backspace: 0x08,
+    Tab: 0x09,
+    Clear: 0x0c,
+    Enter: 0x0d,
+    Shift: 0x10,
+    Control: 0x11,
+    Alt: 0x12,
+    Pause: 0x13,
+    CapsLock: 0x14,
+    Escape: 0x1b,
+    " ": 0x20,
+    PageUp: 0x21,
+    PageDown: 0x22,
+    End: 0x23,
+    Home: 0x24,
+    ArrowLeft: 0x25,
+    ArrowUp: 0x26,
+    ArrowRight: 0x27,
+    ArrowDown: 0x28,
+    PrintScreen: 0x2c,
+    Insert: 0x2d,
+    Delete: 0x2e,
+    Meta: 0x5b,
+    ContextMenu: 0x5d,
+    NumLock: 0x90,
+    ScrollLock: 0x91,
+    ";": 0xba,
+    ":": 0xba,
+    "=": 0xbb,
+    "+": 0xbb,
+    ",": 0xbc,
+    "<": 0xbc,
+    "-": 0xbd,
+    _: 0xbd,
+    ".": 0xbe,
+    ">": 0xbe,
+    "/": 0xbf,
+    "?": 0xbf,
+    "`": 0xc0,
+    "~": 0xc0,
+    "[": 0xdb,
+    "{": 0xdb,
+    "\\": 0xdc,
+    "|": 0xdc,
+    "]": 0xdd,
+    "}": 0xdd,
+    "'": 0xde,
+    '"': 0xde,
+};
+const WINDOWS_VIRTUAL_KEY_CODE_BY_CODE = {
+    Backspace: 0x08,
+    Tab: 0x09,
+    Clear: 0x0c,
+    Enter: 0x0d,
+    NumpadEnter: 0x0d,
+    ShiftLeft: 0x10,
+    ShiftRight: 0x10,
+    ControlLeft: 0x11,
+    ControlRight: 0x11,
+    AltLeft: 0x12,
+    AltRight: 0x12,
+    Pause: 0x13,
+    CapsLock: 0x14,
+    Escape: 0x1b,
+    Space: 0x20,
+    PageUp: 0x21,
+    PageDown: 0x22,
+    End: 0x23,
+    Home: 0x24,
+    ArrowLeft: 0x25,
+    ArrowUp: 0x26,
+    ArrowRight: 0x27,
+    ArrowDown: 0x28,
+    PrintScreen: 0x2c,
+    Insert: 0x2d,
+    Delete: 0x2e,
+    MetaLeft: 0x5b,
+    MetaRight: 0x5c,
+    ContextMenu: 0x5d,
+    NumpadMultiply: 0x6a,
+    NumpadAdd: 0x6b,
+    NumpadComma: 0x6c,
+    NumpadSubtract: 0x6d,
+    NumpadDecimal: 0x6e,
+    NumpadDivide: 0x6f,
+    NumLock: 0x90,
+    ScrollLock: 0x91,
+    Semicolon: 0xba,
+    Equal: 0xbb,
+    Comma: 0xbc,
+    Minus: 0xbd,
+    Period: 0xbe,
+    Slash: 0xbf,
+    Backquote: 0xc0,
+    BracketLeft: 0xdb,
+    Backslash: 0xdc,
+    BracketRight: 0xdd,
+    Quote: 0xde,
+    IntlBackslash: 0xe2,
+};
+function windowsVirtualKeyCodeFor(key, code) {
+    if (code === "MetaLeft" || code === "MetaRight" || code === "IntlBackslash") {
+        return WINDOWS_VIRTUAL_KEY_CODE_BY_CODE[code];
+    }
+    if (code.startsWith("Numpad")) {
+        const numpadDigit = /^Numpad([0-9])$/.exec(code)?.[1];
+        if (numpadDigit && /^[0-9]$/.test(key))
+            return 0x60 + Number(numpadDigit);
+        const namedNumpadKey = key.length > 1 ? WINDOWS_VIRTUAL_KEY_CODE_BY_KEY[key] : undefined;
+        if (namedNumpadKey !== undefined)
+            return namedNumpadKey;
+        const numpadCode = WINDOWS_VIRTUAL_KEY_CODE_BY_CODE[code];
+        if (numpadCode !== undefined)
+            return numpadCode;
+    }
+    const functionKey = /^F([1-9]|1[0-9]|2[0-4])$/.exec(code)?.[1];
+    if (functionKey)
+        return 0x6f + Number(functionKey);
+    if (/^[A-Za-z]$/.test(key))
+        return key.toUpperCase().charCodeAt(0);
+    if (/^[0-9]$/.test(key))
+        return key.charCodeAt(0);
+    const logical = WINDOWS_VIRTUAL_KEY_CODE_BY_KEY[key];
+    if (logical !== undefined)
+        return logical;
+    const physicalDigit = /^Digit([0-9])$/.exec(code)?.[1];
+    if (physicalDigit)
+        return physicalDigit.charCodeAt(0);
+    const physical = WINDOWS_VIRTUAL_KEY_CODE_BY_CODE[code];
+    if (physical !== undefined)
+        return physical;
+    return undefined;
+}
+function keyLocationFor(code) {
+    if (code.startsWith("Numpad"))
+        return 3;
+    if (["ShiftLeft", "ControlLeft", "AltLeft", "MetaLeft"].includes(code))
+        return 1;
+    if (["ShiftRight", "ControlRight", "AltRight", "MetaRight"].includes(code))
+        return 2;
+    return 0;
+}

package/dist/channel-store.d.ts

@@ -20,9 +20,3 @@ export declare function renameChannel(id: string, name: string): void;
 export declare function setChannelOptions(id: string, options: Record<string, unknown>): void;
 /** Remove a channel; its bound instance (if any) cascades away (FK ON DELETE CASCADE). */
 export declare function removeChannel(id: string): void;
-/**
- * Bridge each channel's stored `options` into `process.env`, so a channel reads
- * its credentials from the environment as usual. Existing env (including `.env`)
- * wins — only undefined keys are filled.
- */
-export declare function applyChannelEnv(): void;

package/dist/channel-store.js

@@ -3,8 +3,8 @@
  * (`options`), configured and authorized on its own. No agent binding here;
  * that lives on an {@link import("./instance-store.js")} instance.
  *
- * Credentials stay in each channel's `options` (and `.env`); {@link applyChannelEnv}
- * bridges them into `process.env` at boot, with explicit env always winning.
+ * Credentials stay in each channel's `options` and are sent only to that
+ * plugin runner instance; they are never copied into the daemon environment.
  */
 import { randomUUID } from "node:crypto";
 import { db } from "./db.js";
@@ -63,19 +63,3 @@ export function setChannelOptions(id, options) {
 export function removeChannel(id) {
     db().prepare("DELETE FROM channels WHERE id = ?").run(id);
 }
-/**
- * Bridge each channel's stored `options` into `process.env`, so a channel reads
- * its credentials from the environment as usual. Existing env (including `.env`)
- * wins — only undefined keys are filled.
- */
-export function applyChannelEnv() {
-    for (const channel of listChannels()) {
-        if (!channel.options)
-            continue;
-        for (const [key, value] of Object.entries(channel.options)) {
-            if (typeof value === "string" && process.env[key] === undefined) {
-                process.env[key] = value;
-            }
-        }
-    }
-}

package/dist/chrome-for-testing-release-resolver.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Resolves an explicit Chrome for Testing channel or full version through the
+ * public GoogleChromeLabs JSON API.
+ *
+ * The upstream manifests intentionally contain download URLs but no archive
+ * digest. A resolved release therefore does not claim a SHA-256. The artifact
+ * store computes and records the archive digest when it installs these bytes.
+ */
+import { type ResolvedChromeForTestingBuildMetadata } from "./chrome-for-testing-store.js";
+export type ChromeForTestingReleaseChannel = "Stable" | "Beta" | "Dev" | "Canary";
+export type ChromeForTestingReleaseSelector = {
+    kind: "channel";
+    channel: ChromeForTestingReleaseChannel;
+} | {
+    kind: "version";
+    version: string;
+};
+/**
+ * Officially resolved release metadata. There is deliberately no `sha256`:
+ * Chrome for Testing's JSON API does not publish one.
+ */
+export interface ResolvedChromeForTestingRelease extends ResolvedChromeForTestingBuildMetadata {
+    manifestUrl: string;
+}
+export type ChromeForTestingMetadataFetcher = (url: string, init: RequestInit) => Promise<Response>;
+export interface ResolveChromeForTestingReleaseOptions {
+    /** Injectable only so platform behavior can be tested on any build host. */
+    platform?: string;
+    /** Injectable only so platform behavior can be tested on any build host. */
+    arch?: string;
+    fetchMetadata?: ChromeForTestingMetadataFetcher;
+    signal?: AbortSignal;
+}
+export declare function resolveChromeForTestingRelease(selector: ChromeForTestingReleaseSelector, options?: ResolveChromeForTestingReleaseOptions): Promise<ResolvedChromeForTestingRelease>;