@szc-ft/mcp-szcd-client 0.30.0 → 0.32.0

package/standard-skill/local-browser-test/lib/cdp-browser-config.js

@@ -0,0 +1,115 @@
+/**
+ * CDP 方式获取浏览器运行配置
+ * 通过 Chrome DevTools Protocol 获取浏览器命令行参数，解析 user-data-dir 等配置
+ */
+import { execSync } from 'child_process';
+import { join } from 'path';
+
+/**
+ * 通过 wmic 获取 msedge.exe 的完整命令行，解析关键参数
+ * @param {"msedge"|"chrome"} browserName
+ * @returns {{ userDataDir: string, remoteDebuggingPort: string, args: string[] }}
+ */
+export function getBrowserConfigFromProcess(browserName = 'msedge') {
+  const exeName = browserName === 'chrome' ? 'chrome.exe' : 'msedge.exe';
+  // 方案1：wmic /format:list 获取命令行
+  let output = '';
+  try {
+    const raw = execSync(
+      `wmic process where "name='${exeName}'" get commandline /format:list`,
+      { encoding: 'utf8', timeout: 5000, windowsHide: true }
+    );
+    // 解析 key=value 格式（每行 CommandLine=...，空格行分隔进程）
+    const blocks = raw.split(/\r\n\r\n/);
+    output = blocks
+      .map(b => {
+        const m = b.match(/CommandLine=(.+)/s);
+        return m ? m[1].trim() : '';
+      })
+      .filter(Boolean)
+      .join('\n');
+  } catch {
+    // 方案2：PowerShell Get-CimInstance
+    try {
+      const psScript = `Get-CimInstance Win32_Process -Filter 'Name="${exeName}"' | Where-Object { $_.CommandLine -like '*--remote-debugging-port*' } | ForEach-Object { $_.CommandLine }`;
+      output = execSync(
+        `powershell -NoProfile -Command "${psScript.replace(/"/g, '\\"')}"`,
+        { encoding: 'utf8', timeout: 8000, windowsHide: true }
+      );
+    } catch {
+      return null;
+    }
+  }
+
+  // 解析命令行参数
+  const lines = output.split('\n').filter(l => l.includes('--remote-debugging-port') && l.trim());
+  if (lines.length === 0) return null;
+
+  const cmdLine = lines[0].trim();
+
+  // 提取关键参数
+  const config = {
+    userDataDir: null,
+    remoteDebuggingPort: null,
+    args: [],
+  };
+
+  // 解析 --user-data-dir="path" 或 --user-data-dir=path 或 --user-data-dir path
+  const uddMatch = cmdLine.match(/--user-data-dir[= ]"?([^ "]+)"?/i);
+  if (uddMatch) {
+    config.userDataDir = uddMatch[1].replace(/\\/g, '/');
+  }
+
+  // 解析 --remote-debugging-port
+  const rdpMatch = cmdLine.match(/--remote-debugging-port[= ](\d+)/i);
+  if (rdpMatch) {
+    config.remoteDebuggingPort = rdpMatch[1];
+  }
+
+  // 返回所有参数
+  const argMatches = cmdLine.match(/--[\w-]+(?:[= ][^ "]+)?/g);
+  if (argMatches) {
+    config.args = argMatches.map(a => a.trim());
+  }
+
+  return config;
+}
+
+/**
+ * 通过 CDP 连接获取浏览器版本信息
+ * @param {string} cdpUrl - CDP 地址，默认 http://localhost:9222
+ */
+export async function getBrowserInfoFromCDP(cdpUrl = 'http://localhost:9222') {
+  try {
+    const resp = await fetch(`${cdpUrl}/json/version`);
+    const data = await resp.json();
+    return {
+      browser: data.Browser || data.browser,
+      userAgent: data['User-Agent'],
+      protocolVersion: data['Protocol-Version'],
+      webSocketDebuggerUrl: data.webSocketDebuggerUrl,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 综合获取浏览器完整配置
+ * 先通过进程命令行获取 user-data-dir，再通过 CDP 获取版本信息
+ */
+export async function getFullBrowserConfig(cdpUrl = 'http://localhost:9222') {
+  const procConfig = getBrowserConfigFromProcess();
+  const browserInfo = await getBrowserInfoFromCDP(cdpUrl);
+
+  return {
+    ...procConfig,
+    browserInfo,
+    loginDataPath: procConfig?.userDataDir
+      ? join(procConfig.userDataDir, 'Default', 'Login Data')
+      : null,
+    localStatePath: procConfig?.userDataDir
+      ? join(procConfig.userDataDir, 'Local State')
+      : null,
+  };
+}

package/standard-skill/local-browser-test/lib/decrypt-passwords.js

@@ -0,0 +1,210 @@
+/**
+ * 从 Edge/Chrome 的 Login Data 数据库中解密保存的密码
+ *
+ * 支持 v10 格式（使用 AES-256-GCM + DPAPI 加密密钥）
+ * 不支持 v20 格式（App-Bound Encryption，需在浏览器进程内解密）
+ *
+ * 依赖：
+ *   - sql.js（纯 JS SQLite，npm install sql.js）
+ *   - Node.js 内置 crypto
+ *   - Windows DPAPI（通过 PowerShell 子进程）
+ */
+import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'fs';
+import { createDecipheriv } from 'crypto';
+import { execSync } from 'child_process';
+import { join, dirname } from 'path';
+import { createRequire } from 'module';
+
+// sql.js 在共享缓存 ~/.szcd-mcp/deps/node_modules/ 中
+// ESM 的 NODE_PATH 不支持，用 createRequire 兼容
+const require = createRequire(import.meta.url);
+const initSqlJs = require('sql.js');
+
+// ============ DPAPI 解密（通过 PowerShell） ============
+
+/**
+ * 使用 Windows DPAPI 解密数据
+ * 通过 PowerShell 调用 System.Security.Cryptography.ProtectedData
+ */
+export function dpapiDecrypt(encryptedBuffer) {
+  const tmpDir = process.env.TEMP || process.env.TMP || '/tmp';
+  const tmpIn = join(tmpDir, '_dpapi_in.bin');
+  const tmpOut = join(tmpDir, '_dpapi_out.bin');
+
+  writeFileSync(tmpIn, encryptedBuffer);
+
+  // PowerShell 脚本：读文件 → DPAPI 解密 → 写文件
+  const psScript = [
+    'Add-Type -AssemblyName System.Security',
+    `$in=[System.IO.File]::ReadAllBytes('${tmpIn.replace(/\\/g, '\\\\')}')`,
+    `$out=[System.Security.Cryptography.ProtectedData]::Unprotect($in,$null,'CurrentUser')`,
+    `[System.IO.File]::WriteAllBytes('${tmpOut.replace(/\\/g, '\\\\')}',$out)`,
+  ].join(';');
+
+  try {
+    execSync(`powershell -NoProfile -Command "${psScript}"`, {
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 10000,
+    });
+    return readFileSync(tmpOut);
+  } finally {
+    try { unlinkSync(tmpIn); } catch {}
+    try { unlinkSync(tmpOut); } catch {}
+  }
+}
+
+
+// ============ 浏览器配置检测 ============
+
+/**
+ * 获取 Edge/Chrome 的 user-data-dir 配置
+ * 通过解析进程命令行参数
+ */
+export function detectUserDataDir(browserName = 'msedge') {
+  const exeName = browserName === 'chrome' ? 'chrome.exe' : 'msedge.exe';
+
+  let output = '';
+  try {
+    output = execSync(
+      `wmic process where "name='${exeName}'" get commandline /format:csv`,
+      { encoding: 'utf8', timeout: 5000, windowsHide: true }
+    );
+  } catch {
+    try {
+      output = execSync(
+        `powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"Name='${exeName}'\\" | Where-Object {\\$_.CommandLine -like '*--remote-debugging-port*'} | Select-Object -ExpandProperty CommandLine"`,
+        { encoding: 'utf8', timeout: 5000, windowsHide: true }
+      );
+    } catch {
+      return null;
+    }
+  }
+
+  const lines = output.split('\n').filter(l => l.includes('--remote-debugging-port'));
+  if (lines.length === 0) return null;
+
+  const match = lines[0].match(/--user-data-dir[= ]"?([^ "]+)"?/i);
+  return match ? match[1].replace(/\\/g, '/') : null;
+}
+
+
+// ============ AES-256-GCM 解密（v10 格式） ============
+
+/**
+ * 解密 v10 格式的密码
+ * 格式: "v10" (3 bytes) + nonce (12 bytes) + ciphertext + tag (16 bytes)
+ */
+function decryptV10Password(aesKey, encryptedBlob) {
+  const raw = Buffer.from(encryptedBlob);
+  if (raw.length < 31) throw new Error('v10 blob too short');
+
+  const nonce = raw.subarray(3, 15);           // 12 bytes after v10
+  const tag = raw.subarray(raw.length - 16);    // last 16 bytes
+  const ciphertext = raw.subarray(15, raw.length - 16);
+
+  const decipher = createDecipheriv('aes-256-gcm', aesKey, nonce);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+
+
+// ============ 主入口 ============
+
+/**
+ * 从浏览器配置目录解密所有保存的密码
+ * @param {object} options
+ * @param {string} [options.userDataDir] - Edge/Chrome 的 user-data-dir 路径，不传则自动检测
+ * @param {string} [options.filter] - 过滤 URL 的关键词，默认 '%'（全部）
+ * @param {boolean} [options.verbose] - 是否输出详细信息
+ * @returns {Array<{url: string, username: string, password: string}>}
+ */
+export async function decryptAllPasswords(options = {}) {
+  const {
+    userDataDir = detectUserDataDir(),
+    filter = '%',
+    verbose = false,
+  } = options;
+
+  if (!userDataDir) {
+    throw new Error(
+      '未检测到浏览器 user-data-dir。请确保 Edge/Chrome 以 --remote-debugging-port 和 --user-data-dir 参数启动'
+    );
+  }
+
+  const localStatePath = join(userDataDir, 'Local State');
+  const loginDataPath = join(userDataDir, 'Default', 'Login Data');
+
+  if (!existsSync(localStatePath)) {
+    throw new Error(`Local State 文件不存在: ${localStatePath}`);
+  }
+  if (!existsSync(loginDataPath)) {
+    throw new Error(`Login Data 文件不存在: ${loginDataPath}`);
+  }
+
+  if (verbose) {
+    console.log(`[decrypt] userDataDir: ${userDataDir}`);
+    console.log(`[decrypt] Login Data: ${loginDataPath}`);
+    console.log(`[decrypt] Local State: ${localStatePath}`);
+  }
+
+  // 1. 读取 Local State 获取加密密钥
+  const localState = JSON.parse(readFileSync(localStatePath, 'utf8'));
+  if (!localState.os_crypt?.encrypted_key) {
+    throw new Error('Local State 中未找到 os_crypt.encrypted_key');
+  }
+
+  const encKeyBuf = Buffer.from(localState.os_crypt.encrypted_key, 'base64');
+  if (encKeyBuf.length < 5) throw new Error('加密密钥格式异常');
+
+  // 去除 "DPAPI" 前缀（5 字节）
+  const aesKey = dpapiDecrypt(encKeyBuf.subarray(5));
+  if (verbose) console.log(`[decrypt] AES key: ${aesKey.length} bytes`);
+
+  // 2. 读取 SQLite 数据库
+  const SQL = await initSqlJs();
+  const db = new SQL.Database(readFileSync(loginDataPath));
+  const rows = db.exec(
+    `SELECT origin_url, username_value, password_value FROM logins WHERE origin_url LIKE '${filter}'`
+  );
+
+  const credentials = [];
+  const values = rows[0]?.values || [];
+
+  for (const [url, username, pwdBlob] of values) {
+    if (!pwdBlob || pwdBlob.length < 3) continue;
+
+    const raw = Buffer.from(pwdBlob);
+    const prefix = raw.subarray(0, 3).toString();
+
+    if (prefix === 'v10') {
+      try {
+        const password = decryptV10Password(aesKey, pwdBlob).toString('utf8');
+        credentials.push({ url, username, password });
+        if (verbose) console.log(`[decrypt] ✓ ${username} @ ${url}`);
+      } catch (e) {
+        if (verbose) console.log(`[decrypt] ✗ ${username}: ${e.message}`);
+      }
+    } else if (verbose) {
+      console.log(`[decrypt] ⊘ ${username}: unsupported format (${prefix})`);
+    }
+  }
+
+  db.close();
+  return credentials;
+}
+
+/**
+ * 获取指定 URL 的凭据（便捷方法）
+ * @param {string} urlPattern - URL 匹配模式
+ * @param {object} [options]
+ * @returns {Promise<{username: string, password: string}|null>}
+ */
+export async function getCredential(urlPattern, options = {}) {
+  const creds = await decryptAllPasswords({
+    ...options,
+    filter: `%${urlPattern}%`,
+    verbose: false,
+  });
+  return creds.length > 0 ? creds[0] : null;
+}

package/standard-skill/local-browser-test/lib/shared-deps.js

@@ -13,8 +13,8 @@ import fs from "node:fs";
 /** 共享缓存目录 */
 const SHARED_DEPS_DIR = path.join(homedir(), ".szcd-mcp", "deps");
 
-/** 核心浏览器自动化依赖 */
-const CORE_PACKAGES = ["puppeteer-core"];
+/** 核心浏览器自动化依赖（主链路 observe/act/assert + 凭据解密） */
+const CORE_PACKAGES = ["puppeteer-core", "sql.js"];
 
 /** 视觉对比依赖 */
 const VISUAL_COMPARE_PACKAGES = ["pixelmatch", "pngjs", "sharp"];