@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/agent-browser/scripts/playwright-mcp-redact-proxy.py

@@ -0,0 +1,964 @@
+#!/usr/bin/env python3
+"""Redacting stdio JSON-RPC proxy in front of the Playwright MCP server (#7980).
+
+    python3 playwright-mcp-redact-proxy.py [--chromium-fallback] [--user-data-dir-name <basename>] -- npx @playwright/mcp@0.0.78 [server args...]
+
+`--chromium-fallback` (a boolean, given at most once) appends `--browser chromium --sandbox` to the server
+argv, ahead of the proxy's own appended flags, when ALL of: the server argv carries no `--browser`,
+$PLAYWRIGHT_MCP_BROWSER is unset, the platform is Linux or macOS, and no Google Chrome executable
+exists at the platform's known path (`/opt/google/chrome/chrome`, `/Applications/Google
+Chrome.app/Contents/MacOS/Google Chrome`). Without it the server defaults to the `chrome` channel and
+a host with no Google Chrome gets no browser at all; with it Playwright maps `chromium` to its bundled
+build, and `--sandbox` keeps that build's sandbox ON (Playwright defaults it off on Linux for the bundled
+build); a host that cannot run the sandbox fails to launch rather than run unsandboxed. The appended
+`--browser chromium` also overrides a browser chosen in an explicit `--config` /
+$PLAYWRIGHT_MCP_CONFIG file (only argv and env are consulted, and the CLI wins over the file) on a
+Chrome-less host. On any other platform nothing is appended. $PLAYWRIGHT_MCP_PROXY_CHROME_PATHS (an os.pathsep
+list) replaces the known-path list, for the suite. `--browser` is not a sink flag and
+`--executable-path` stays refused, and `--no-sandbox`, $PLAYWRIGHT_MCP_SANDBOX and a config
+`chromiumSandbox: false` stay refused (a caller-supplied `--sandbox` stays allowed: it can only turn the
+sandbox on), so no guarantee below moves. Flag absent: the child argv is exactly
+what it was before.
+
+`--user-data-dir-name` resolves its basename under $XDG_CACHE_HOME (else
+`$HOME/.cache`, both read from os.environ) and injects
+`--user-data-dir=<absolute path>` into the server argv, giving the wrapped
+browser its own profile directory without a literal path in the registration.
+The flag refuses to start on a basename given twice, empty, `.`, containing
+`..` or a path separator, or starting with `-`; on a basename combined with an
+explicit `--user-data-dir` in the server argv; on a relative
+$XDG_CACHE_HOME/$HOME; and when neither variable is set. The resolved root is
+normalized with os.path.realpath, mirroring the XDG semantics of
+scripts/lib/scratch-root.sh. With the flag absent the child argv is exactly
+what it was before.
+
+Sits on the transport between Claude Code and the server and rewrites the text of
+every `tools/call` result through the SAME `redact_text` the agent-browser Bash
+path uses (loaded by path from the sibling `redact-a11y-snapshot.py`; this file
+defines no predicate of its own). Three fail-closed arms, no bypass variable:
+
+  * startup  -- `refuse_argv_and_env`, `load_redactor`, `self_test`: stderr
+                `refusing to start: <reason>`, exit 2, no child spawned (these three catch
+                Exception, SystemExit and KeyboardInterrupt; a BaseException subclass outside
+                them is unreachable here and would die with exit 1 and a traceback before any
+                child is spawned, so nothing is relayed);
+  * per call -- `refuse_request` / `rewrite_result`: an `isError` result naming the
+                tool, built by `error_result`, whose reason never quotes input;
+  * transport -- `teardown`: the child's whole process group is ended on stdin
+                EOF, a signal, or child exit, with the child's exit code clamped.
+
+Reasons never quote page content, on stdout or stderr: Claude Code persists this
+process's stderr (and the server's, which it inherits) under
+`~/.cache/claude-cli-nodejs/<project>/mcp-logs-playwright/*.jsonl`.
+
+Decision, reach per surface, the enumerated raw-sink closure and the named
+residuals: ADR-213 (#7980 addendum) and `agent-browser/SKILL.md` §"Wrapping the
+server". Stdlib only, single `selectors` loop, POSIX.
+"""
+from __future__ import annotations
+
+import contextlib
+import importlib.util
+import json
+import os
+import selectors
+import signal
+import subprocess
+import sys
+import time
+from typing import Any, Dict, List, NoReturn, Optional, Tuple
+
+PREFIX = "playwright-mcp-redact-proxy:"
+REDACTOR_BASENAME = "redact-a11y-snapshot.py"
+# 64 MiB per line: a memory budget. A hostile page can inflate a tree and an
+# OOM-killed proxy runs no teardown (CWE-400). A line whose newline arrives in the
+# same read that crosses the cap is still parsed whole, so the real ceiling is
+# the cap plus one read (READ_CHUNK); the 4 MiB result cap then withholds it.
+MAX_LINE_BYTES = 64 * 1024 * 1024
+READ_CHUNK = 65536
+# Seconds between SIGTERM and SIGKILL for the child's process group. The suite
+# shortens it with PLAYWRIGHT_MCP_PROXY_GRACE_S; it changes timing only.
+GRACE_S = 5.0
+STDIN_CLOSE_WAIT_S = 0.2
+REFUSED_HEAD = "refused by playwright-mcp-redact-proxy:"
+WITHHELD_HEAD = "withheld by playwright-mcp-redact-proxy:"
+TOOLS_LIST_MARKER = (
+    " [Soleur: output is redacted in flight by the a11y-snapshot redactor;"
+    " filename is refused — call browser_snapshot with no filename.]"
+)
+TRAILER = "[Soleur: redacted in flight by playwright-mcp-redact-proxy]"
+REFUSED_NEXT = "Behind this proxy call browser_snapshot with no filename, and call tools without _meta."
+WITHHELD_NEXT = (
+    "The tool itself may have run: its result was withheld, not its action. Before"
+    " retrying, call browser_snapshot with no filename to see the page state. If"
+    " browser_snapshot is over the redactor's size cap, narrow it with target: or depth:."
+)
+SNAPSHOT_LINK_NOTICE = (
+    "- [Snapshot withheld by playwright-mcp-redact-proxy: the server wrote a raw tree"
+    " file under its output directory (default .playwright-mcp/); do not read it]"
+)
+UNRECOGNISED = "unrecognised result shape"
+RESULT_KEYS = {"content", "isError", "isClose"}
+TEXT_KEYS = {"type", "text", "annotations"}
+BINARY_KEYS = {"type", "data", "mimeType", "annotations"}
+ERROR_KEYS = {"code", "message"}
+# Server-to-client messages relayed, each rebuilt from its method and ids only
+# (`relay_server_message`). 0.0.78 emits no notification at all and one server
+# request, `roots/list`; anything else could carry page text around the rewrite,
+# so it is dropped (a request is answered on the server's side so the server
+# does not wait on it).
+PASSTHROUGH_REQUESTS = {"roots/list"}
+PASSTHROUGH_NOTIFICATIONS = {"notifications/tools/list_changed", "notifications/cancelled"}
+# `--caps` values that open no raw sink: `vision` adds coordinate tools. devtools
+# (tracing, annotate), pdf and storage write raw page state the proxy never sees.
+SAFE_CAPS = {"vision"}
+# Where Playwright's default `chrome` channel looks for Google Chrome. `--chromium-fallback` appends
+# `--browser chromium --sandbox` only when none of these exist; any other platform is a no-op.
+GOOGLE_CHROME_PATHS = {
+    "linux": ["/opt/google/chrome/chrome"],
+    "darwin": ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"],
+}
+
+
+# Control characters (including U+2028/U+2029, which split a JSONL line) are
+# scrubbed from everything log() writes: a client-supplied tool name or a
+# serverInfo field must not forge a `refusing to start:` line in the persisted
+# MCP logs Claude Code keeps for this process's stderr.
+_LOG_SCRUB = {c: " " for c in list(range(0x20)) + [0x7F, 0x2028, 0x2029]}
+
+
+# json.loads can legitimately return None (JSON null), so a failed parse needs its own marker.
+_NOT_JSON = object()
+
+
+def log(msg: str) -> None:
+    sys.stderr.write(f"{PREFIX} {msg.translate(_LOG_SCRUB)}\n")
+    sys.stderr.flush()
+
+
+def _log_quiet(msg: str) -> None:
+    # log() that cannot raise: for lines written on the teardown path, where an exception would skip the reap and the exit.
+    # RuntimeError is in the guard because teardown can run from the SIGTERM handler, where a reentrant stderr write raises it.
+    # A closed, full, busy or missing stderr (None when fd 2 is closed) must not abort teardown.
+    with contextlib.suppress(OSError, ValueError, RuntimeError, AttributeError):
+        log(msg)
+
+
+def _note(exc: BaseException, site: str) -> None:
+    # Class name and a static site label only. Never str(exc)/repr(exc)/input text: exception text can carry page
+    # content, and Claude Code persists this stderr. `site` is a string literal at every call site.
+    _log_quiet(f"swallowed {type(exc).__name__} at {site}")
+
+
+def _flush_notes(pending: List[Tuple[BaseException, str]]) -> None:
+    # Emits the (exc, literal-label) pairs a handler collected while it must not write to stderr (see teardown).
+    for exc, label in pending:
+        _note(exc, label)
+
+
+def refuse_start(reason: str) -> NoReturn:
+    log(f"refusing to start: {reason}")
+    os._exit(2)
+
+
+# ---------------------------------------------------------------------------
+# B1 -- argv
+# ---------------------------------------------------------------------------
+def usage(msg: str) -> NoReturn:
+    refuse_start(f"usage: playwright-mcp-redact-proxy.py [--chromium-fallback] [--user-data-dir-name <basename>] -- <server argv...> ({msg})")
+
+
+def profile_dir_from_args(args: List[str], env: Dict[str, str]) -> Optional[str]:
+    """Resolve `--user-data-dir-name <basename>` to an absolute dir under the cache root.
+
+    XDG semantics mirror scripts/lib/scratch-root.sh: $XDG_CACHE_HOME wins when
+    set, otherwise `$HOME/.cache`; a relative root or an
+    unresolvable `~` refuses rather than resolving against the caller's CWD.
+    Returns None when the flag is absent (the child argv stays untouched).
+    """
+    name: Optional[str] = None
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--user-data-dir-name" or a.startswith("--user-data-dir-name="):
+            if name is not None:
+                refuse_start("--user-data-dir-name given twice")
+            if a == "--user-data-dir-name":
+                if i + 1 >= len(args):
+                    refuse_start("--user-data-dir-name needs a basename argument")
+                name = args[i + 1]
+                i += 2
+            else:
+                name = a.split("=", 1)[1]
+                i += 1
+        else:
+            refuse_start(f"unrecognised proxy flag before `--`: {a}")
+    if name is None:
+        return None
+    if not name or name == "." or ".." in name:
+        refuse_start("--user-data-dir-name must be a basename (empty, '.' or '..' refuses)")
+    if "/" in name or "\\" in name:
+        refuse_start("--user-data-dir-name must be a basename (a path separator refuses)")
+    if name.startswith("-"):
+        refuse_start("--user-data-dir-name must be a basename (a leading '-' refuses)")
+    xdg = env.get("XDG_CACHE_HOME")
+    if xdg:
+        root = xdg
+    else:
+        home = env.get("HOME")
+        if not home:
+            refuse_start("cannot resolve the profile root: neither XDG_CACHE_HOME nor HOME is set")
+        root = os.path.join(home, ".cache")
+    if not os.path.isabs(root):
+        refuse_start("the profile root is not absolute (a relative XDG_CACHE_HOME or HOME refuses)")
+    return os.path.join(os.path.realpath(root), name)
+
+
+def take_chromium_fallback(args: List[str]) -> Tuple[List[str], bool]:
+    """Remove the boolean `--chromium-fallback` from the proxy's own flags; refuse it given twice.
+
+    The value of `--user-data-dir-name` is never inspected here (it stays for profile_dir_from_args
+    to validate, so a basename spelled like a flag still refuses there).
+    """
+    rest: List[str] = []
+    found = False
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--chromium-fallback":
+            if found:
+                refuse_start("--chromium-fallback given twice")
+            found = True
+        else:
+            rest.append(a)
+            if a == "--user-data-dir-name" and i + 1 < len(args):
+                rest.append(args[i + 1])
+                i += 1
+        i += 1
+    return rest, found
+
+
+def chromium_fallback_applies(server: List[str], env: Dict[str, str]) -> bool:
+    """True when the server would default to a Google Chrome that is not installed.
+
+    Only Linux and macOS are modelled; any other platform is a no-op. An explicit `--browser`
+    (either spelling) or $PLAYWRIGHT_MCP_BROWSER means the caller chose, so nothing is appended.
+    """
+    plat = "linux" if sys.platform.startswith("linux") else sys.platform
+    if plat not in GOOGLE_CHROME_PATHS:
+        return False
+    if flag_present(server, "--browser") or env.get("PLAYWRIGHT_MCP_BROWSER"):
+        return False
+    seam = env.get("PLAYWRIGHT_MCP_PROXY_CHROME_PATHS")
+    paths = seam.split(os.pathsep) if seam is not None else GOOGLE_CHROME_PATHS[plat]
+    return not any(p and os.path.isfile(p) and os.access(p, os.X_OK) for p in paths)
+
+
+def parse_argv(argv: List[str]) -> Tuple[List[str], Optional[str], bool]:
+    if "--" not in argv:
+        usage("no `--` separator")
+    sep = argv.index("--")
+    server = argv[sep + 1 :]
+    if not server:
+        usage("empty server argv")
+    own, chromium_fallback = take_chromium_fallback(argv[:sep])
+    return server, profile_dir_from_args(own, dict(os.environ)), chromium_fallback
+
+
+# ---------------------------------------------------------------------------
+# B2 -- the one predicate, bound by path; four names, all at startup
+# ---------------------------------------------------------------------------
+def load_redactor() -> Tuple[Any, Any, int, str]:
+    path = os.path.join(os.path.dirname(os.path.abspath(__file__)), REDACTOR_BASENAME)
+    if not os.path.isfile(path):
+        refuse_start(f"sibling {REDACTOR_BASENAME} is missing (drifted plugin install?)")
+    try:
+        spec = importlib.util.spec_from_file_location("redact_a11y_snapshot", path)
+        if spec is None or spec.loader is None:
+            raise ImportError("no loader")
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+    except (Exception, SystemExit, KeyboardInterrupt) as exc:  # a module-level sys.exit is a refusal too
+        refuse_start(f"cannot load {REDACTOR_BASENAME}: {type(exc).__name__}")
+    missing = [n for n in ("redact_text", "looks_like_a11y_tree", "MAX_INPUT_BYTES", "REDACTED") if not hasattr(mod, n)]
+    if missing:
+        refuse_start(f"{REDACTOR_BASENAME} does not export {', '.join(missing)}")
+    return mod.redact_text, mod.looks_like_a11y_tree, int(mod.MAX_INPUT_BYTES), str(mod.REDACTED)
+
+
+# ---------------------------------------------------------------------------
+# B3 -- self-test: the predicate must redact a sentinel row AND remove the value
+# ---------------------------------------------------------------------------
+def self_test(redact_text: Any, looks_like_a11y_tree: Any, redacted: str) -> None:
+    row = '- textbox "Token" [ref=e1]: ZZQP-SENTINEL-7980'
+    try:
+        out = redact_text(row)
+    except (Exception, SystemExit, KeyboardInterrupt) as exc:
+        refuse_start(f"redactor self-test raised {type(exc).__name__}")
+    if redacted not in out or "ZZQP-SENTINEL-7980" in out:
+        refuse_start("redactor self-test did not redact the sentinel row")
+    try:
+        tree_true = looks_like_a11y_tree(row)
+        prose_false = looks_like_a11y_tree("### Page\n- Page URL: x")
+    except (Exception, SystemExit, KeyboardInterrupt) as exc:
+        refuse_start(f"looks_like_a11y_tree raised {type(exc).__name__}")
+    if not tree_true or prose_false:
+        refuse_start("looks_like_a11y_tree self-test failed (tree row / prose row)")
+
+
+# ---------------------------------------------------------------------------
+# B2 (second half) -- raw sinks refused before spawn
+# ---------------------------------------------------------------------------
+def argv_values(server: List[str], flag: str) -> List[str]:
+    """Every value given to `flag` as `--flag v` or `--flag=v`, in order."""
+    values: List[str] = []
+    for i, a in enumerate(server):
+        if a.startswith(flag + "="):
+            values.append(a[len(flag) + 1 :])
+        elif a == flag and i + 1 < len(server):
+            values.append(server[i + 1])
+    return values
+
+
+def debug_pattern_enables_pw(pattern: str) -> bool:
+    """True when a `debug` namespace pattern can enable any `pw:` logger.
+
+    The `debug` package splits DEBUG on whitespace and commas, skips `-`-prefixed
+    exclusions, and treats `*` as its only wildcard, matching anywhere. So a
+    pattern enables some `pw:<x>` namespace iff it reaches a `*` before
+    diverging from `pw:`, or consumes `pw:` literally.
+    """
+    target = "pw:"
+    for i, ch in enumerate(pattern):
+        if ch == "*":
+            return True
+        if i >= len(target):
+            return True
+        if ch != target[i]:
+            return False
+    return False
+
+
+def caps_open_sinks(values: List[str]) -> bool:
+    for v in values:
+        for cap in v.replace(",", " ").split():
+            if cap not in SAFE_CAPS:
+                return True
+    return False
+
+
+def flag_present(server: List[str], flag: str) -> bool:
+    """`flag` given as `--flag` or `--flag=value` anywhere in the server argv."""
+    return any(a == flag or a.startswith(flag + "=") for a in server)
+
+
+# Server argv flags that open a raw sink around this relay, substitute the
+# browser or transport the proxy owns, or inject code/credential material into
+# pages. Each is refused in either `--flag` or `--flag=value` form; the
+# PLAYWRIGHT_MCP_* env equivalent is refused alongside (the child inherits the
+# session env wholesale, so an ambient export is the same setting with no
+# registration-level audit trail).
+SINK_FLAGS = [
+    ("--save-session", "PLAYWRIGHT_MCP_SAVE_SESSION", "writes every response to a session.md on disk"),
+    ("--storage-state", "PLAYWRIGHT_MCP_STORAGE_STATE", "persists cookies and storage state to a file"),
+    ("--secrets", "PLAYWRIGHT_MCP_SECRETS_FILE", "loads secrets from a file the model can be steered to fill into pages"),
+    ("--output-dir", "PLAYWRIGHT_MCP_OUTPUT_DIR", "names a directory for raw output files"),
+    ("--init-script", "PLAYWRIGHT_MCP_INIT_SCRIPT", "runs a script in every page, around this relay"),
+    ("--init-page", "PLAYWRIGHT_MCP_INIT_PAGE", "evaluates a file in every page, around this relay"),
+    ("--cdp-endpoint", "PLAYWRIGHT_MCP_CDP_ENDPOINT", "connects to a browser this proxy did not launch"),
+    ("--endpoint", "PLAYWRIGHT_MCP_ENDPOINT", "connects to a remote Playwright server this proxy did not launch"),
+    ("--extension", "PLAYWRIGHT_MCP_EXTENSION", "connects to a running browser this proxy did not launch"),
+    ("--executable-path", "PLAYWRIGHT_MCP_EXECUTABLE_PATH", "substitutes the browser binary this proxy launches"),
+    ("--allow-unrestricted-file-access", "PLAYWRIGHT_MCP_ALLOW_UNRESTRICTED_FILE_ACCESS", "lets pages reach arbitrary local files"),
+    ("--grant-permissions", "PLAYWRIGHT_MCP_GRANT_PERMISSIONS", "grants pages permissions (clipboard, geolocation) the model did not audit"),
+    ("--save-trace", "PLAYWRIGHT_MCP_SAVE_TRACE", "writes a Playwright Trace of the session to disk"),
+    ("--save-video", "PLAYWRIGHT_MCP_SAVE_VIDEO", "writes session video to the output directory"),
+    ("--ignore-https-errors", "PLAYWRIGHT_MCP_IGNORE_HTTPS_ERRORS", "drops TLS validation on page requests"),
+    ("--no-sandbox", "PLAYWRIGHT_MCP_SANDBOX", "controls the browser sandbox"),
+    ("--daemon", "PLAYWRIGHT_MCP_DAEMON", "serves the tools over a socket, around this stdio relay"),
+]
+# Env-only refusals: the argv/config form stays allowed because it is explicit
+# and audited in the registration; the ambient env form is not.
+SINK_ENV_ONLY = [
+    ("PLAYWRIGHT_MCP_USER_DATA_DIR", "sets a profile outside the audited registration argv"),
+    ("PLAYWRIGHT_MCP_SNAPSHOT_MODE", "the proxy owns --snapshot-mode"),
+]
+# Valued flags: a bare one as the LAST server arg would bind the appended
+# `--user-data-dir=<dir>` (or `--snapshot-mode`) as its value instead of
+# refusing cleanly. Boolean flags are deliberately absent — a trailing
+# `--headless` does not consume the next token.
+VALUE_FLAGS = {
+    "--allowed-hosts", "--allowed-origins", "--blocked-origins", "--browser",
+    "--caps", "--cdp-endpoint", "--cdp-header", "--cdp-timeout", "--codegen",
+    "--config", "--console-level", "--daemon", "--device", "--endpoint",
+    "--executable-path", "--grant-permissions", "--host", "--image-responses",
+    "--init-page", "--init-script", "--output-dir", "--output-max-size",
+    "--output-mode", "--port", "--proxy-bypass", "--proxy-server", "--save-video",
+    "--secrets", "--snapshot-mode", "--storage-state", "--test-id-attribute",
+    "--timeout-action", "--timeout-navigation", "--user-agent", "--user-data-dir",
+    "--viewport-size",
+}
+
+
+def refuse_argv_and_env(server: List[str], profile_dir: Optional[str], env: Dict[str, str]) -> None:
+    if profile_dir is not None and (argv_values(server, "--user-data-dir") or flag_present(server, "--user-data-dir")):
+        refuse_start("--user-data-dir-name cannot be combined with an explicit --user-data-dir in the server argv")
+    if server and server[-1] in VALUE_FLAGS:
+        refuse_start(f"{server[-1]} expects a value that would bind an appended flag")
+    for flag, envvar, why in SINK_FLAGS:
+        if flag_present(server, flag):
+            refuse_start(f"{flag} {why}")
+        if env.get(envvar):
+            refuse_start(f"{envvar} is set ({why})")
+    for envvar, why in SINK_ENV_ONLY:
+        if env.get(envvar):
+            refuse_start(f"{envvar} is set ({why})")
+    if argv_values(server, "--port") or flag_present(server, "--port") or env.get("PLAYWRIGHT_MCP_PORT"):
+        refuse_start("--port serves the tools over HTTP, around this stdio relay")
+    if argv_values(server, "--host") or flag_present(server, "--host") or env.get("PLAYWRIGHT_MCP_HOST"):
+        refuse_start("--host binds an HTTP transport around this stdio relay")
+    if caps_open_sinks(argv_values(server, "--caps")) or caps_open_sinks([env.get("PLAYWRIGHT_MCP_CAPS", "")]):
+        refuse_start("--caps enables a capability other than vision (devtools, pdf and storage write raw page state)")
+    if any(v != "stdout" for v in argv_values(server, "--output-mode") + [env.get("PLAYWRIGHT_MCP_OUTPUT_MODE", "stdout")]):
+        refuse_start("--output-mode file writes snapshots and logs to disk")
+    config_path: Optional[str] = None
+    named = argv_values(server, "--config")
+    if named:
+        config_path = named[-1]
+    elif env.get("PLAYWRIGHT_MCP_CONFIG"):
+        config_path = env["PLAYWRIGHT_MCP_CONFIG"]
+    if config_path:
+        if not os.path.isfile(config_path):
+            refuse_start("the config file named by --config or PLAYWRIGHT_MCP_CONFIG does not exist")
+        try:
+            with open(config_path, "rb") as fh:
+                cfg = json.loads(fh.read().decode("utf-8-sig"))
+        except (OSError, ValueError, RecursionError):
+            # The server falls back to an INI parser, where saveSession is a typed
+            # key; a file this proxy cannot read is a file it cannot vet.
+            refuse_start("the config file is not JSON, so its raw-sink settings cannot be checked")
+        if not isinstance(cfg, dict):
+            refuse_start("the config file is not a JSON object, so its raw-sink settings cannot be checked")
+        if cfg.get("saveSession"):
+            refuse_start("config saveSession is set (a raw session.md sink)")
+        if cfg.get("saveVideo"):
+            refuse_start("config saveVideo is set (video frames of every page are written to disk)")
+        if cfg.get("saveTrace"):
+            refuse_start("config saveTrace is set (a raw trace written to disk)")
+        if cfg.get("secrets"):
+            refuse_start("config secrets injects credential material into pages")
+        if cfg.get("outputDir"):
+            refuse_start("config outputDir names a directory for raw output files")
+        if cfg.get("allowUnrestrictedFileAccess"):
+            refuse_start("config allowUnrestrictedFileAccess lets pages reach arbitrary local files")
+        if cfg.get("extension"):
+            refuse_start("config extension connects to a running browser this proxy did not launch")
+        caps = cfg.get("capabilities")
+        if caps is not None and (not isinstance(caps, list) or caps_open_sinks([str(c) for c in caps])):
+            refuse_start("config capabilities enables a capability other than vision")
+        srv = cfg.get("server")
+        if isinstance(srv, dict) and (srv.get("port") is not None or srv.get("host") is not None):
+            refuse_start("config server.port/server.host serves the tools over HTTP, around this stdio relay")
+        browser = cfg.get("browser")
+        if isinstance(browser, dict):
+            if browser.get("cdpEndpoint") or browser.get("remoteEndpoint"):
+                refuse_start("config browser.cdpEndpoint/browser.remoteEndpoint connects to a browser this proxy did not launch")
+            if browser.get("initPage") or browser.get("initScript"):
+                refuse_start("config browser.initPage/browser.initScript injects code into every page")
+            if profile_dir is not None and browser.get("userDataDir"):
+                refuse_start("config browser.userDataDir conflicts with --user-data-dir-name")
+            ctx = browser.get("contextOptions")
+            if isinstance(ctx, dict):
+                if ctx.get("storageState"):
+                    refuse_start("config browser.contextOptions.storageState persists cookies and storage state to a file")
+                if ctx.get("permissions"):
+                    refuse_start("config browser.contextOptions.permissions grants page permissions the model did not audit")
+                if ctx.get("ignoreHTTPSErrors"):
+                    refuse_start("config browser.contextOptions.ignoreHTTPSErrors drops TLS validation on page requests")
+            lo = browser.get("launchOptions")
+            if isinstance(lo, dict):
+                if lo.get("executablePath"):
+                    refuse_start("config browser.launchOptions.executablePath substitutes the browser binary")
+                if lo.get("chromiumSandbox") is False:
+                    refuse_start("config browser.launchOptions.chromiumSandbox disables the browser sandbox")
+                args = lo.get("args")
+                if isinstance(args, list) and any(str(a).startswith("--remote-debugging") for a in args):
+                    refuse_start("config launchOptions.args opens a remote debugging channel around this relay")
+    patterns = env.get("DEBUG", "").replace(",", " ").split()
+    if any(debug_pattern_enables_pw(p) for p in patterns if not p.startswith("-")):
+        refuse_start("DEBUG enables a pw:* logger, which prints unredacted results to stderr")
+    if env.get("DEBUG_FILE"):
+        refuse_start("DEBUG_FILE is set (a raw debug sink on disk)")
+
+
+# ---------------------------------------------------------------------------
+# B9 -- ONE builder for every synthesized client-bound tools/call result
+# ---------------------------------------------------------------------------
+def error_result(rid: Any, tool: str, reason: str, *, refused: bool = False) -> bytes:
+    kind = "refused" if refused else "withheld"
+    head = REFUSED_HEAD if refused else WITHHELD_HEAD
+    text = f"### Error\n{head} {reason} (tool: {tool})\n{REFUSED_NEXT if refused else WITHHELD_NEXT}"
+    log(f"{kind} tool={tool} reason={reason}")
+    obj = {"jsonrpc": "2.0", "id": rid, "result": {"content": [{"type": "text", "text": text}], "isError": True}}
+    return json.dumps(obj, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def jsonrpc_error(rid: Any, code: int, message: str) -> bytes:
+    obj = {"jsonrpc": "2.0", "id": rid, "error": {"code": code, "message": message}}
+    return json.dumps(obj, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def write_line(fobj: Any, data: bytes) -> None:
+    fobj.write(data + b"\n")
+    fobj.flush()
+
+
+# ---------------------------------------------------------------------------
+# B5 -- client -> server
+# ---------------------------------------------------------------------------
+def id_key(rid: Any) -> str:
+    """The JSON text of the id: keeps 2 and "2" apart and is hashable for any id shape."""
+    return json.dumps(rid, sort_keys=True)
+
+
+def refuse_request(req: Dict[str, Any]) -> Optional[bytes]:
+    """Return an error_result line for a request that must never reach the server, else None."""
+    if req.get("method") != "tools/call":
+        return None
+    params = req.get("params") if isinstance(req.get("params"), dict) else {}
+    name = str(params.get("name", ""))
+    args = params.get("arguments")
+    if not isinstance(args, dict):
+        return None
+    if "_meta" in args:
+        # measured: `_meta.json` returns the tree as one JSON-escaped string the
+        # line-anchored predicate cannot see.
+        return error_result(req.get("id"), name, "arguments._meta is an undocumented hook that returns the tree in a shape the redactor cannot see; call the tool without _meta", refused=True)
+    if name == "browser_snapshot" and "filename" in args:
+        return error_result(req.get("id"), name, "filename writes the raw tree to disk; call browser_snapshot with no filename", refused=True)
+    return None
+
+
+def json_strings(node: Any) -> List[str]:
+    if isinstance(node, str):
+        return [node]
+    if isinstance(node, dict):
+        return [s for v in node.values() for s in json_strings(v)]
+    if isinstance(node, list):
+        return [s for v in node for s in json_strings(v)]
+    return []
+
+
+class Proxy:
+    def __init__(self, server: List[str], redactor: Tuple[Any, Any, int, str], profile_dir: Optional[str] = None, chromium_fallback: bool = False) -> None:
+        self.redact_text, self.looks_like_a11y_tree, self.max_input_bytes, self.redacted = redactor
+        self.pending: Dict[str, Tuple[Any, str, str]] = {}  # id_key -> (raw id, method, tool name)
+        self.out = sys.stdout.buffer
+        self.child: Optional[subprocess.Popen] = None
+        self.pgid = 0
+        self.tearing_down = False
+        self.grace = GRACE_S
+        try:
+            self.grace = float(os.environ.get("PLAYWRIGHT_MCP_PROXY_GRACE_S", GRACE_S))
+        except ValueError:
+            log("ignored a non-numeric PLAYWRIGHT_MCP_PROXY_GRACE_S")
+        # Installed BEFORE the spawn, so a signal in between still ends the group.
+        signal.signal(signal.SIGTERM, self.on_signal)
+        signal.signal(signal.SIGINT, self.on_signal)
+        argv = list(server)
+        if chromium_fallback and chromium_fallback_applies(server, dict(os.environ)):
+            argv += ["--browser", "chromium", "--sandbox"]
+            log("no Google Chrome found; adding --browser chromium --sandbox (the bundled build, sandbox kept on; if the first browser call reports a sandbox failure, install Google Chrome - the sandbox is never disabled)")
+        if profile_dir is not None:
+            argv.append("--user-data-dir=" + profile_dir)
+        argv += ["--snapshot-mode", "none"]
+        self.child = subprocess.Popen(argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=None, bufsize=0, start_new_session=True)
+        self.pgid = os.getpgid(self.child.pid)
+        log(f"child pgid {self.pgid}")
+
+    def on_signal(self, _signum: int, _frame: Any) -> None:
+        self.teardown("signal")
+
+    # -- B5 -----------------------------------------------------------------
+    def pump_client_to_server(self, line: bytes) -> None:
+        assert self.child is not None and self.child.stdin is not None
+        try:
+            req = json.loads(line.decode("utf-8", errors="replace"))
+        except (ValueError, RecursionError):
+            # Never forwarded: a line this proxy cannot read is a line it cannot
+            # vet for filename/_meta, and a JSON parser the server uses may still
+            # accept it (e.g. an integer past Python's digit limit).
+            log(f"dropped unparsable client line ({len(line)} bytes)")
+            return
+        if isinstance(req, list):
+            log(f"dropped list line from client ({len(line)} bytes)")
+            return
+        if not isinstance(req, dict):
+            log(f"dropped non-object client line ({len(line)} bytes)")
+            return
+        refusal = refuse_request(req)
+        if refusal is not None:
+            write_line(self.out, refusal)
+            return
+        if "method" in req and "id" in req:
+            rid = req["id"]
+            key = id_key(rid)
+            if key in self.pending:
+                log("refused a request reusing a pending id")
+                write_line(self.out, jsonrpc_error(rid, -32600, "request id is already pending (refused by playwright-mcp-redact-proxy)"))
+                return
+            params = req.get("params") if isinstance(req.get("params"), dict) else {}
+            self.pending[key] = (rid, str(req["method"]), str(params.get("name", "")))
+        write_line(self.child.stdin, line)
+
+    # -- B6/B7/B8 -----------------------------------------------------------
+    def pump_server_to_client(self, line: bytes) -> None:
+        try:
+            msg = json.loads(line.decode("utf-8", errors="replace"))
+        except (ValueError, RecursionError):
+            log(f"dropped unparsable server line ({len(line)} bytes)")
+            return
+        if isinstance(msg, list):
+            answered = 0
+            for el in msg:
+                if isinstance(el, dict) and ("result" in el or "error" in el):
+                    entry = self.pending.pop(self.safe_key(el.get("id")), None)
+                    if entry is not None:
+                        write_line(self.out, error_result(entry[0], entry[2], "the server answered inside a JSON list line, which the proxy does not relay"))
+                        answered += 1
+            log(f"dropped list line from server ({len(line)} bytes, {answered} pending answered)")
+            return
+        if not isinstance(msg, dict):
+            log(f"dropped non-object server line ({len(line)} bytes)")
+            return
+        if "result" not in msg and "error" not in msg:
+            self.relay_server_message(msg)
+            return
+        entry = self.pending.pop(self.safe_key(msg.get("id")), None)
+        if entry is None:
+            log(f"dropped unknown-id response ({len(line)} bytes)")
+            return
+        rid, method, tool = entry
+        if "method" in msg:
+            write_line(self.out, error_result(rid, tool, UNRECOGNISED + " (response carries a method)"))
+            return
+        result = msg.get("result")
+        if method == "tools/call" or (isinstance(result, dict) and "content" in result):
+            # Routed by SHAPE as well as by method: a content-bearing result is
+            # rewritten whatever request it answers.
+            write_line(self.out, self.rewrite_result(msg, line, tool))
+        elif "error" in msg:
+            write_line(self.out, self.vet_error(msg, line, tool))
+        elif method == "tools/list":
+            write_line(self.out, self.annotate_tools_list(msg, line))
+        elif method == "initialize":
+            info = result if isinstance(result, dict) else {}
+            si = info.get("serverInfo", {}) if isinstance(info.get("serverInfo"), dict) else {}
+            log(f"wrapping {si.get('name', '?')} {si.get('version', '?')} protocol {info.get('protocolVersion', '?')}")
+            write_line(self.out, self.vet_other_result(msg, line, rid, tool))
+        else:
+            write_line(self.out, self.vet_other_result(msg, line, rid, tool))
+
+    def safe_key(self, rid: Any) -> str:
+        try:
+            return id_key(rid)
+        except (TypeError, ValueError):
+            return "\x00unkeyable"
+
+    def plain_id(self, value: Any) -> bool:
+        """An id the proxy may echo: an integer, or a string with no tree row or redactable value."""
+        if isinstance(value, bool):
+            return False
+        if isinstance(value, int):
+            return True
+        return isinstance(value, str) and not self.looks_like_a11y_tree(value) and self.redact_text(value) == value
+
+    def relay_server_message(self, msg: Dict[str, Any]) -> None:
+        """A server request or notification: relay only the ones 0.0.78 can send,
+        rebuilt from method and ids alone so no params field (a cancel reason, a
+        _meta) carries page text past the proxy."""
+        method = msg.get("method")
+        if "id" in msg:
+            if method in PASSTHROUGH_REQUESTS and self.plain_id(msg.get("id")):
+                write_line(self.out, json.dumps({"jsonrpc": "2.0", "id": msg["id"], "method": method}, separators=(",", ":")).encode())
+                return
+            log("dropped a server request other than roots/list")
+            assert self.child is not None and self.child.stdin is not None
+            try:
+                write_line(self.child.stdin, jsonrpc_error(msg.get("id"), -32601, "method not relayed by playwright-mcp-redact-proxy"))
+            except (OSError, ValueError) as exc:
+                _note(exc, "reply-unrelayed-request")
+            return
+        if method in PASSTHROUGH_NOTIFICATIONS:
+            rebuilt: Dict[str, Any] = {"jsonrpc": "2.0", "method": method}
+            params = msg.get("params")
+            if method == "notifications/cancelled":
+                if not isinstance(params, dict) or not self.plain_id(params.get("requestId")):
+                    log("dropped a cancellation whose requestId is not a plain id")
+                    return
+                rebuilt["params"] = {"requestId": params["requestId"]}
+            write_line(self.out, json.dumps(rebuilt, separators=(",", ":")).encode())
+            return
+        log("dropped a server notification outside the relayed set")
+
+    def vet_error(self, msg: Dict[str, Any], line: bytes, tool: str) -> bytes:
+        err = msg.get("error")
+        if "result" in msg or not isinstance(err, dict) or not set(err.keys()) <= ERROR_KEYS:
+            return error_result(msg.get("id"), tool, "error response had an unrecognised shape")
+        if not isinstance(err.get("code"), int) or isinstance(err.get("code"), bool):
+            return error_result(msg.get("id"), tool, "error response had an unrecognised shape")
+        message = err.get("message", "")
+        if not isinstance(message, str) or self.looks_like_a11y_tree(message) or self.redact_text(message) != message:
+            return error_result(msg.get("id"), tool, "error message carried tree-shaped text")
+        # Rebuilt, not relayed: no other top-level key of `msg` reaches the client.
+        return json.dumps({"jsonrpc": "2.0", "id": msg.get("id"), "error": {"code": err["code"], "message": message}}, separators=(",", ":"), ensure_ascii=True).encode()
+
+    def vet_other_result(self, msg: Dict[str, Any], line: bytes, rid: Any, tool: str) -> bytes:
+        """A matched non-tools/call result (initialize, ping, a future method):
+        forwarded only when no string anywhere in the frame is tree-shaped or
+        redactable — a future server's `resources/read`-style payload must not
+        carry page text around the result-shape whitelist."""
+        if any(self.looks_like_a11y_tree(s) or self.redact_text(s) != s for s in json_strings(msg)):
+            return error_result(rid, tool, UNRECOGNISED + " (non-tools/call result carried redactable text)")
+        return line
+
+    def escaped_tree_in(self, text: str) -> bool:
+        """True when a `### Result` body (or a JSON line) carries a JSON-escaped tree.
+
+        `browser_run_code_unsafe` and `browser_evaluate` return JSON; an
+        `ariaSnapshot()` returned that way is one escaped string the line-anchored
+        predicate cannot see, the same shape the `_meta` refusal exists for.
+        """
+        candidates: List[str] = []
+        section: List[str] = []
+        in_result = False
+        for tline in text.split("\n") + ["### end"]:
+            if tline.startswith("### "):
+                if in_result:
+                    candidates.append("\n".join(section))
+                in_result = tline == "### Result"
+                section = []
+            elif in_result:
+                section.append(tline)
+            stripped = tline.strip().rstrip(",")
+            if stripped[:1] in ('"', "{", "["):
+                candidates.append(stripped)
+                if stripped.startswith('"') and '":' in stripped:
+                    candidates.append("{" + stripped + "}")
+        for cand in candidates:
+            try:
+                parsed = json.loads(cand)
+            except (ValueError, RecursionError):
+                parsed = _NOT_JSON  # a per-line probe over page text: most lines are not JSON, the negative result is the normal one
+            if parsed is _NOT_JSON:
+                continue
+            # No newline requirement: one row returned by `ariaSnapshot()` on a
+            # single locator is a whole tree to the redactor's predicate.
+            if any(self.looks_like_a11y_tree(s) for s in json_strings(parsed)):
+                return True
+        return False
+
+    def rewrite_result(self, msg: Dict[str, Any], line: bytes, tool: str) -> bytes:
+        rid = msg.get("id")
+        try:
+            if "error" in msg:
+                return self.vet_error(msg, line, tool)
+            result = msg.get("result")
+            if not isinstance(result, dict) or not set(result.keys()) <= RESULT_KEYS:
+                return error_result(rid, tool, UNRECOGNISED)
+            if not isinstance(result.get("isError", False), bool):
+                return error_result(rid, tool, UNRECOGNISED)
+            content = result.get("content")
+            if not isinstance(content, list):
+                return error_result(rid, tool, UNRECOGNISED)
+            changed = False
+            tree_seen = False
+            new_content: List[Dict[str, Any]] = []
+            for block in content:
+                if not isinstance(block, dict):
+                    return error_result(rid, tool, UNRECOGNISED)
+                btype = block.get("type")
+                if btype == "text":
+                    if not set(block.keys()) <= TEXT_KEYS or not isinstance(block.get("text"), str):
+                        return error_result(rid, tool, UNRECOGNISED)
+                    text = block["text"]
+                    if len(text.encode("utf-8", "surrogatepass")) > self.max_input_bytes:
+                        return error_result(rid, tool, "result exceeds the redactor's size cap")
+                    if self.escaped_tree_in(text):
+                        return error_result(rid, tool, "result carries a JSON-escaped accessibility tree")
+                    lines = text.split("\n")
+                    in_snapshot = False
+                    for i, tline in enumerate(lines):
+                        if tline.startswith("### "):
+                            in_snapshot = tline == "### Snapshot"
+                        elif in_snapshot and tline.startswith("- [Snapshot]("):
+                            # The disk sink reappearing (a version bump). The file
+                            # is already written; hide the path, keep the result.
+                            lines[i] = SNAPSHOT_LINK_NOTICE
+                            log(f"replaced a snapshot file link tool={tool}")
+                    relinked = "\n".join(lines)
+                    if self.looks_like_a11y_tree(relinked):
+                        tree_seen = True
+                    new_text = self.redact_text(relinked)
+                    if new_text != text:
+                        changed = True
+                        block = dict(block)
+                        block["text"] = new_text
+                elif btype in ("image", "audio"):
+                    if not set(block.keys()) <= BINARY_KEYS:
+                        return error_result(rid, tool, UNRECOGNISED)
+                else:
+                    return error_result(rid, tool, UNRECOGNISED)
+                new_content.append(block)
+            if tree_seen:
+                new_content.append({"type": "text", "text": TRAILER})
+                changed = True
+            if not changed:
+                return line
+            new_result = dict(result)
+            new_result["content"] = new_content
+            out = dict(msg)
+            out["result"] = new_result
+            return json.dumps(out, separators=(",", ":"), ensure_ascii=True, allow_nan=False).encode()
+        except Exception as exc:  # noqa: BLE001 - any failure withholds
+            return error_result(rid, tool, f"redaction raised {type(exc).__name__}")
+
+    def annotate_tools_list(self, msg: Dict[str, Any], line: bytes) -> bytes:
+        try:
+            for t in msg["result"]["tools"]:
+                if t.get("name") == "browser_snapshot" and isinstance(t.get("description"), str):
+                    t["description"] = t["description"] + TOOLS_LIST_MARKER
+            return json.dumps(msg, separators=(",", ":"), ensure_ascii=True).encode()
+        except Exception as exc:  # noqa: BLE001 - fail safe: original bytes (no content key reaches here)
+            log(f"annotate failed: {type(exc).__name__}")
+            return line
+
+    # -- B10 ----------------------------------------------------------------
+    def group_alive(self) -> bool:
+        try:
+            os.killpg(self.pgid, 0)
+            return True
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            return True
+
+    def wait_group_empty(self, seconds: float) -> bool:
+        deadline = time.monotonic() + seconds
+        while time.monotonic() < deadline:
+            if self.child is not None and self.child.poll() is None:
+                # A 50 ms poll: the child still running is the normal outcome of each tick.
+                with contextlib.suppress(subprocess.TimeoutExpired):
+                    self.child.wait(timeout=0.05)
+            if not self.group_alive():
+                return True
+            time.sleep(0.05)
+        return not self.group_alive()
+
+    def teardown(self, why: str) -> NoReturn:
+        if self.tearing_down:
+            os._exit(1)
+        self.tearing_down = True
+        child = self.child
+        if child is None:
+            log(f"no child to tear down ({why})")
+            os._exit(1)
+        # Notes are collected here and written after the kill ladder: teardown also runs from on_signal, and a
+        # stderr write that raises ahead of os.killpg would skip the group kill, the proxy's core invariant.
+        pending: List[Tuple[BaseException, str]] = []
+        try:
+            if child.stdin and not child.stdin.closed:
+                child.stdin.close()
+        except OSError as exc:
+            pending.append((exc, "teardown-stdin-close"))
+        # The designed route into the SIGTERM step: a child that ignores EOF is the case the ladder exists for.
+        with contextlib.suppress(subprocess.TimeoutExpired):
+            child.wait(timeout=STDIN_CLOSE_WAIT_S)
+        # Always signal the GROUP: the direct child (npx) may already have exited
+        # while Chrome, its grandchild, still holds the group.
+        # The group is already empty after a clean exit: the normal outcome of every clean session.
+        with contextlib.suppress(ProcessLookupError):
+            os.killpg(self.pgid, signal.SIGTERM)
+        if not self.wait_group_empty(self.grace):
+            try:
+                os.killpg(self.pgid, signal.SIGKILL)
+            except ProcessLookupError as exc:
+                pending.append((exc, "teardown-sigkill"))
+            _log_quiet(f"group {self.pgid} survived SIGTERM; SIGKILL sent")  # after the kill
+            self.wait_group_empty(self.grace)
+        try:
+            child.wait(timeout=self.grace)
+        except subprocess.TimeoutExpired as exc:
+            pending.append((exc, "teardown-final-wait"))
+        rc = child.returncode
+        if rc is None:
+            rc = 1
+        sig = -rc if rc < 0 else 0
+        _flush_notes(pending)
+        _log_quiet(f"child exited rc={rc} signal={sig} ({why})")
+        code = rc if rc >= 0 else 128 - rc
+        try:
+            self.out.flush()
+        except (OSError, ValueError) as exc:
+            _note(exc, "teardown-flush")
+        os._exit(code)
+
+    # -- B4 -- the single loop ------------------------------------------------
+    def run(self) -> NoReturn:
+        assert self.child is not None and self.child.stdout is not None
+        sel = selectors.DefaultSelector()
+        sel.register(sys.stdin.buffer.fileno(), selectors.EVENT_READ, "client")
+        sel.register(self.child.stdout.fileno(), selectors.EVENT_READ, "server")
+        bufs = {"client": bytearray(), "server": bytearray()}
+        discarding = {"client": False, "server": False}
+        while True:
+            for key, _mask in sel.select():
+                side = key.data
+                try:
+                    data = os.read(key.fd, READ_CHUNK)
+                except OSError:
+                    data = b""
+                if not data:
+                    self.teardown("stdin EOF" if side == "client" else "child stdout EOF")
+                buf = bufs[side]
+                buf += data
+                while True:
+                    nl = buf.find(b"\n")
+                    if nl < 0:
+                        if len(buf) > MAX_LINE_BYTES and not discarding[side]:
+                            discarding[side] = True
+                            log(f"discarding oversize {side} line (> {MAX_LINE_BYTES} bytes, buffered {len(buf)})")
+                            if side == "server":
+                                for k, (rid, _m, tool) in list(self.pending.items()):
+                                    write_line(self.out, error_result(rid, tool, "oversize"))
+                                    self.pending.pop(k, None)
+                            del buf[:]
+                        elif discarding[side]:
+                            del buf[:]
+                        break
+                    line = bytes(buf[:nl])
+                    del buf[: nl + 1]
+                    if discarding[side]:
+                        discarding[side] = False
+                        continue
+                    try:
+                        if side == "client":
+                            self.pump_client_to_server(line)
+                        else:
+                            self.pump_server_to_client(line)
+                    except Exception as exc:  # noqa: BLE001 - one bad line must not strand the lines behind it
+                        log(f"pump error: {type(exc).__name__}")
+                        if self.child.poll() is not None:
+                            self.teardown("pump error after child exit")
+
+
+def main(argv: List[str]) -> int:
+    server, profile_dir, chromium_fallback = parse_argv(argv)
+    redactor = load_redactor()
+    self_test(redactor[0], redactor[1], redactor[3])
+    refuse_argv_and_env(server, profile_dir, dict(os.environ))
+    Proxy(server, redactor, profile_dir, chromium_fallback).run()
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))