@trusty-squire/mcp 1.1.6 → 1.1.7

package/dist/bot/browser.js

@@ -109,6 +109,24 @@ function getChromium() {
     }
     return cachedChromium;
 }
+export function hasPayPalHostedCheckoutFrame(frames) {
+    return frames.some((frame) => {
+        const marker = `${frame.url} ${frame.name} ${frame.title}`.toLowerCase();
+        if (/__zoid__paypal_(?:buttons|card_fields|checkout)/.test(marker))
+            return true;
+        try {
+            const url = new URL(frame.url);
+            const paypalHost = url.hostname === "paypal.com" ||
+                url.hostname.endsWith(".paypal.com") ||
+                url.hostname === "paypalobjects.com" ||
+                url.hostname.endsWith(".paypalobjects.com");
+            return paypalHost && /(?:smart|checkout|card[_ -]?fields|zoid)/.test(marker);
+        }
+        catch {
+            return false;
+        }
+    });
+}
 const CURRENCY_SYMBOLS = {
     $: "USD",
     "€": "EUR",
@@ -494,7 +512,8 @@ async function withChromeStartupLock(fn) {
 }
 const selfManagedChromePids = new Set();
 let selfManagedCleanupInstalled = false;
-let orphanVerifyReapRan = false;
+let orphanVerifierReapRan = false;
+const orphanOperatorProfilesReaped = new Set();
 function killPid(pid, signal) {
     try {
         process.kill(pid, signal);
@@ -530,18 +549,44 @@ function registerSelfManagedChrome(child) {
             selfManagedChromePids.delete(child.pid);
     });
 }
-// Stale verifier browsers are the expensive leak mode: if the MCP process dies
+// Stale verifier/operator browsers are the expensive leak mode: if the MCP process dies
 // mid-verify, self-launched Chrome survives as PPID=1 with a
-// ~/.trusty-squire/profiles/verify-* user-data-dir. It keeps the profile lock,
+// ~/.trusty-squire/profiles/verify-* or ~/.trusty-squire/chrome-profile
+// user-data-dir. It keeps the profile lock,
 // burns memory, and may leave defunct helper children. A live verifier should
 // never be parented to init, so these are safe to reap at the next browser
 // startup. Best-effort and Linux-only; failure must not block signups.
-function reapOrphanedVerifyBrowsersOnce() {
-    if (orphanVerifyReapRan)
-        return;
-    orphanVerifyReapRan = true;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function matchesReapableBrowserArgs(args, profileDirs, includeVerifier) {
+    if (!/(?:chrome|chromium)/i.test(args))
+        return false;
+    const profiles = [...new Set(profileDirs)].map(escapeRegExp);
+    if (includeVerifier) {
+        profiles.unshift(String.raw `[^\s"']*\.trusty-squire\/profiles\/verify-[^\/\s"']+`);
+    }
+    if (profiles.length === 0)
+        return false;
+    const profile = `(?:${profiles.join("|")})`;
+    return new RegExp(`--user-data-dir=(?:"${profile}"|'${profile}'|${profile})(?=\\s|$)`).test(args);
+}
+export function claimOrphanBrowserReapScope(profileDir) {
+    const includeVerifier = !orphanVerifierReapRan;
+    const profileDirs = [...new Set([CHROME_PROFILE_DIR, profileDir])].filter((candidate) => !orphanOperatorProfilesReaped.has(candidate));
+    if (!includeVerifier && profileDirs.length === 0)
+        return null;
+    orphanVerifierReapRan = true;
+    for (const candidate of profileDirs)
+        orphanOperatorProfilesReaped.add(candidate);
+    return { includeVerifier, profileDirs };
+}
+function reapOrphanedBrowsersOnce(profileDir) {
     if (process.platform !== "linux")
         return;
+    const scope = claimOrphanBrowserReapScope(profileDir);
+    if (scope === null)
+        return;
     let rows = "";
     try {
         rows = execFileSync("ps", ["-eo", "pid=,ppid=,args="], {
@@ -561,14 +606,13 @@ function reapOrphanedVerifyBrowsersOnce() {
         const args = match[3] ?? "";
         if (Number.isFinite(pid) &&
             ppid === 1 &&
-            /(?:chrome|chromium)/i.test(args) &&
-            /--user-data-dir=.*\.trusty-squire\/profiles\/verify-[^/\s]+/.test(args)) {
+            matchesReapableBrowserArgs(args, scope.profileDirs, scope.includeVerifier)) {
             pids.push(pid);
         }
     }
     if (pids.length === 0)
         return;
-    console.error(`[operator] reaping ${pids.length} orphaned verify Chrome process(es)`);
+    console.error(`[operator] reaping ${pids.length} orphaned Chrome process(es)`);
     for (const pid of pids)
         killPid(pid, "SIGTERM");
     setTimeout(() => {
@@ -805,6 +849,11 @@ export class BrowserController {
     // Google session across runs — see profile.ts / google-login.ts.
     context = null;
     page = null;
+    // The page start() configured with the controller's navigation/captcha
+    // handlers. OAuth may temporarily switch `this.page` to a popup, but warm
+    // reuse must always restore this original page rather than adopting a popup
+    // whose lifecycle handlers were never installed.
+    primaryPage = null;
     // Self-launch path (Turnstile-safe; see selfLaunchEnabled). When we spawn
     // Chrome ourselves and attach over CDP, these hold the child process and
     // the connected Browser so close() can tear both down.
@@ -865,6 +914,20 @@ export class BrowserController {
     // Per-launch egress override (verify-fleet identities each get their own IP).
     // null → use the env-global proxy. See resolveProxy().
     proxyOverride;
+    // Warm reuse is deliberately narrow: a browser belongs to exactly one
+    // persistent profile and one explicit egress override. Undefined/blank proxy
+    // values both mean "use the environment/default route".
+    matchesLaunchOptions(opts) {
+        const profileDir = opts.profileDir ?? CHROME_PROFILE_DIR;
+        const proxyUrl = opts.proxyUrl !== undefined && opts.proxyUrl.trim().length > 0 ? opts.proxyUrl.trim() : null;
+        return this.profileDir === profileDir && this.proxyOverride === proxyUrl;
+    }
+    // Required health gate for a warm browser. BrowserContext alone is not a
+    // sufficient signal: a dead CDP transport can leave stale JS objects behind.
+    isConnected() {
+        const browser = this.cdpBrowser ?? this.context?.browser() ?? null;
+        return browser?.isConnected() === true;
+    }
     // Which browser channel the most recent .start() actually used.
     // `null` means bundled Chromium; a string like "chrome" means a
     // real installed browser of that channel. Throws if .start() hasn't
@@ -1072,7 +1135,7 @@ export class BrowserController {
         console.error("[operator] resource blocking ON (image/media/font + analytics aborted; captcha/CSS/JS allowed)");
     }
     async start() {
-        reapOrphanedVerifyBrowsersOnce();
+        reapOrphanedBrowsersOnce(this.profileDir);
         const channel = await detectChromiumChannel();
         this.launchedChannel = channel;
         const proxy = await this.resolveProxy();
@@ -1427,6 +1490,7 @@ export class BrowserController {
         if (!remoteMode)
             await context.addInitScript({ content: installWebglSpoofScript });
         this.page = context.pages()[0] ?? (await context.newPage());
+        this.primaryPage = this.page;
         // addInitScript covers document-start page JS, but Playwright's
         // page.evaluate utility execution can run in a separate realm. Install the
         // same no-op helper there with a STRING evaluate (tsx cannot wrap strings
@@ -3301,6 +3365,13 @@ export class BrowserController {
             }
         }
         if (tagName === "select") {
+            // Keep the resolved target as a Locator. Walker selectors can include
+            // Playwright chains such as `select.foo >> nth=1`; appending CSS text to
+            // those strings changes the chain's meaning (`... >> nth=1 option`) and
+            // makes a full select appear option-less. Descendant lookup, selection,
+            // and verification must all stay anchored to the same resolved element.
+            const selectLocator = this.page.locator(activeSelector).first();
+            const optionLocator = selectLocator.locator("option");
             // Native path. rc.15 — keep value="" options selectable. The
             // Railway workspace dropdown's "No workspace" option is value=""
             // and it IS the right pick for an account-scoped token. The
@@ -3309,9 +3380,7 @@ export class BrowserController {
             // never reach that option. Now: fallback list keeps every option
             // (with the first option's value, even if empty), and a matched
             // text-based pick is honored verbatim — including empty values.
-            const allValues = await this.page
-                .locator(`${activeSelector} option`)
-                .evaluateAll((opts) => opts.map((o) => (o instanceof HTMLOptionElement ? o.value : "")));
+            const allValues = await optionLocator.evaluateAll((opts) => opts.map((o) => (o instanceof HTMLOptionElement ? o.value : "")));
             if (allValues.length === 0) {
                 throw new Error(`<select> ${activeSelector} has no selectable option`);
             }
@@ -3325,9 +3394,7 @@ export class BrowserController {
                 // Returns either a matched value (may be "") or null when no
                 // option's text matches. Wrap in an object so we can
                 // distinguish "matched to empty value" from "no match".
-                const matched = await this.page
-                    .locator(`${activeSelector} option`)
-                    .evaluateAll((opts, needle) => {
+                const matched = await optionLocator.evaluateAll((opts, needle) => {
                     const hit = opts
                         .filter((o) => o instanceof HTMLOptionElement)
                         .find((o) => o.textContent?.toLowerCase().includes(needle));
@@ -3341,8 +3408,8 @@ export class BrowserController {
             if (chosenValue === undefined) {
                 throw new Error(`<select> ${activeSelector} has no selectable option`);
             }
-            await this.page.selectOption(activeSelector, chosenValue);
-            const committedValue = await this.page.locator(activeSelector).first().inputValue();
+            await selectLocator.selectOption(chosenValue);
+            const committedValue = await selectLocator.inputValue();
             if (committedValue !== chosenValue) {
                 throw new Error(`<select> ${activeSelector}: selected value ${JSON.stringify(chosenValue)} did not stick`);
             }
@@ -3352,19 +3419,19 @@ export class BrowserController {
             // "No workspace") keeps tripping the warning every round, and
             // the planner gets stuck in a select→select→… loop trying to
             // satisfy a warning the form has already satisfied.
-            await this.page
-                .locator(activeSelector)
-                .first()
+            await selectLocator
                 .evaluate((el) => {
                 if (el instanceof HTMLElement)
                     el.setAttribute("data-ts-touched", "1");
             })
                 .catch(() => { });
-            return;
+            return await selectLocator.evaluate((select) => select instanceof HTMLSelectElement
+                ? (select.selectedOptions[0]?.textContent ?? "").replace(/\s+/g, " ").trim()
+                : "");
         }
         // Custom combobox path. Sentry, Radix, Headless UI, React Aria
         // — every modern React picker emits role=option on its items.
-        await this.selectFromCombobox(activeSelector, optionMatcher);
+        return await this.selectFromCombobox(activeSelector, optionMatcher);
     }
     // Set the country on a phone-number field backed by a phone-local native
     // <select>, including react-phone-number-input's opacity:0 country select.
@@ -3380,11 +3447,50 @@ export class BrowserController {
             throw new Error("setPhoneCountry: empty country argument");
         }
         await this.clearPhoneCountryMarkers();
+        await this.page
+            .locator('[data-ts-phone-country-control="1"]')
+            .evaluateAll((elements) => {
+            elements.forEach((element) => element.removeAttribute("data-ts-phone-country-control"));
+        })
+            .catch(() => undefined);
         if (await this.trySetPhoneCountryNativeSelect(query))
             return;
         throw new Error("set_phone_country: no supported native phone-country <select> found " +
             "(this widget family is not supported yet) — enter a valid contact number instead.");
     }
+    async verifyPhoneCountry(country) {
+        if (!this.page)
+            return false;
+        const query = classifyPhoneCountryQuery(country);
+        if (query.dialCode === undefined && query.iso2 === undefined && query.name === undefined) {
+            return false;
+        }
+        const selected = await this.page.evaluate(() => {
+            const control = document.querySelector('select[data-ts-phone-country-control="1"]');
+            if (!(control instanceof HTMLSelectElement))
+                return null;
+            const option = control.selectedOptions[0];
+            return option === undefined
+                ? null
+                : {
+                    value: option.value,
+                    text: (option.textContent ?? "").replace(/\s+/g, " ").trim(),
+                };
+        });
+        if (selected === null)
+            return false;
+        const option = {
+            text: selected.text.length > 0 ? selected.text : undefined,
+            iso2: /^[A-Za-z]{2}$/.test(selected.value) ? selected.value.toUpperCase() : undefined,
+            dialCode: /^\+?\d{1,4}$/.test(selected.value) ? selected.value.replace(/\D/g, "") : undefined,
+        };
+        return phoneCountryOptionMatches(query, option);
+    }
+    async hasPhoneCountryControl() {
+        if (!this.page)
+            return false;
+        return (await this.page.locator('select[data-ts-phone-country-control="1"]').count()) === 1;
+    }
     // Strategy 1 — a native <select> that governs the phone country (react-
     // phone-number-input's `opacity:0` PhoneInputCountrySelect, or any bespoke
     // widget backed by a real <select>). Detection is deliberately conservative
@@ -3487,6 +3593,7 @@ export class BrowserController {
                 sel.value = val;
             sel.dispatchEvent(new Event("input", { bubbles: true }));
             sel.dispatchEvent(new Event("change", { bubbles: true }));
+            sel.setAttribute("data-ts-phone-country-control", "1");
             return true;
         }, { marker: best.marker, val: value });
         const committedValue = assigned
@@ -3651,7 +3758,9 @@ export class BrowserController {
             else if ((await options.count()) === 0) {
                 throw new Error(`combobox ${triggerSelector}: opened popup has no actionable options`);
             }
+            const committedText = (await target.innerText()).replace(/\s+/g, " ").trim();
             await this.clickComboboxOption(target);
+            return committedText;
         }
         finally {
             await this.clearComboboxMarkers();
@@ -5104,6 +5213,21 @@ export class BrowserController {
             ...amount,
         };
     }
+    async isPayPalHostedCheckout() {
+        if (!this.page)
+            throw new Error("Browser not started");
+        const iframeDescriptors = await this.page.evaluate(() => Array.from(document.querySelectorAll("iframe"), (iframe) => ({
+            url: iframe.src,
+            name: iframe.name,
+            title: iframe.title,
+        })));
+        const frameDescriptors = this.page.frames().map((frame) => ({
+            url: frame.url(),
+            name: frame.name(),
+            title: "",
+        }));
+        return hasPayPalHostedCheckoutFrame([...iframeDescriptors, ...frameDescriptors]);
+    }
     // Common autocomplete/name selectors across all CDP-reachable frames,
     // including cross-origin hosted fields. No PSP-specific adapters.
     async fillAndSubmitCheckout(card) {
@@ -5111,7 +5235,7 @@ export class BrowserController {
             throw new Error("Browser not started");
         const frames = this.page.frames();
         const filled = new Set();
-        const fillFirst = async (field, value, selectors) => {
+        const fillFirst = async (field, value, selectors, typePerKey = false) => {
             if (value === undefined || value.length === 0)
                 return false;
             for (const frame of frames) {
@@ -5137,6 +5261,10 @@ export class BrowserController {
                         if (!selected)
                             continue;
                     }
+                    else if (typePerKey) {
+                        await input.fill("");
+                        await input.pressSequentially(value, { delay: this.humanize ? rand(40, 110) : 0 });
+                    }
                     else {
                         await input.fill(value);
                     }
@@ -5146,13 +5274,38 @@ export class BrowserController {
             }
             return false;
         };
+        const hasFillable = async (selectors) => {
+            for (const frame of frames) {
+                const matches = frame.locator(selectors);
+                const count = Math.min(await matches.count().catch(() => 0), 10);
+                for (let i = 0; i < count; i += 1) {
+                    const input = matches.nth(i);
+                    if (!(await input.isVisible().catch(() => false)))
+                        continue;
+                    if (await input.isEnabled().catch(() => false))
+                        return true;
+                }
+            }
+            return false;
+        };
         try {
             await fillFirst("pan", card.pan, 'input[autocomplete~="cc-number"],input[name*="cardnumber" i],input[id*="card-number" i],input[id*="cardnumber" i]');
-            const combinedExpiry = `${card.exp_month.padStart(2, "0")}/${card.exp_year.slice(-2)}`;
-            const combined = await fillFirst("expiry", combinedExpiry, 'input[autocomplete~="cc-exp"],input[name*="expir" i]:not([name*="month" i]):not([name*="year" i]),input[name="exp" i],input[name*="exp-date" i],input[id*="expir" i]:not([id*="month" i]):not([id*="year" i]),input[id="exp" i],input[id*="exp-date" i]');
-            if (!combined) {
-                await fillFirst("exp_month", card.exp_month.padStart(2, "0"), '[autocomplete~="cc-exp-month"],[name*="exp_month" i],[name*="expmonth" i]');
-                await fillFirst("exp_year", card.exp_year, '[autocomplete~="cc-exp-year"],[name*="exp_year" i],[name*="expyear" i]');
+            const expiryMonthSelectors = '[autocomplete~="cc-exp-month"],[name*="exp_month" i],[name*="expmonth" i],[name*="exp" i][name*="month" i],[id*="exp" i][id*="month" i]';
+            const expiryYearSelectors = '[autocomplete~="cc-exp-year"],[name*="exp_year" i],[name*="expyear" i],[name*="exp" i][name*="year" i],[id*="exp" i][id*="year" i]';
+            const hasSplitExpiry = (await hasFillable(expiryMonthSelectors)) && (await hasFillable(expiryYearSelectors));
+            if (hasSplitExpiry) {
+                await fillFirst("exp_month", card.exp_month.padStart(2, "0"), expiryMonthSelectors);
+                await fillFirst("exp_year", card.exp_year, expiryYearSelectors);
+            }
+            else {
+                // A combined expiry field's formatter owns the slash. Send only the four
+                // digits as real key events so numeric-only fields accept them and the
+                // site's key/input handlers can turn e.g. "1230" into "12/30".
+                const combined = await fillFirst("expiry", `${card.exp_month.padStart(2, "0")}${card.exp_year.slice(-2)}`, 'input[autocomplete~="cc-exp"],input[name*="expir" i]:not([name*="month" i]):not([name*="year" i]),input[name="exp" i],input[name*="exp-date" i],input[id*="expir" i]:not([id*="month" i]):not([id*="year" i]),input[id="exp" i],input[id*="exp-date" i],input[placeholder="MM/YY" i],input[placeholder="MM / YY" i],input[aria-label="MM/YY" i],input[aria-label="MM / YY" i],label:has-text("MM/YY") input,label:has-text("MM / YY") input', true);
+                if (!combined) {
+                    await fillFirst("exp_month", card.exp_month.padStart(2, "0"), expiryMonthSelectors);
+                    await fillFirst("exp_year", card.exp_year, expiryYearSelectors);
+                }
             }
             const fields = [
                 [
@@ -8266,6 +8419,47 @@ export class BrowserController {
             // best-effort
         }
     }
+    // End one sequential task without tearing down Chrome. The original,
+    // handler-bound page survives; OAuth popups and any other incidental tabs are
+    // closed. about:blank replaces the task document while the persistent profile
+    // (cookies, OAuth identity, local profile data) intentionally remains intact.
+    async resetPageForReuse() {
+        const context = this.context;
+        const primaryPage = this.primaryPage;
+        if (!this.isConnected() || context === null || primaryPage === null || primaryPage.isClosed()) {
+            throw new Error("warm browser page is not reusable");
+        }
+        this.page = primaryPage;
+        this.oauthProductPage = null;
+        this.oauthNetLog = [];
+        this.mouseX = 100;
+        this.mouseY = 100;
+        for (const page of context.pages()) {
+            if (page !== primaryPage && !page.isClosed()) {
+                let timer;
+                try {
+                    await Promise.race([
+                        page.close(),
+                        new Promise((_, reject) => {
+                            timer = setTimeout(() => reject(new Error("timed out closing warm browser popup")), 5_000);
+                            timer.unref();
+                        }),
+                    ]);
+                }
+                finally {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                }
+            }
+        }
+        if (context.pages().some((page) => page !== primaryPage && !page.isClosed())) {
+            throw new Error("warm browser reset left a non-primary page open");
+        }
+        await primaryPage.goto("about:blank", {
+            waitUntil: "domcontentloaded",
+            timeout: 30_000,
+        });
+    }
     async close() {
         // Each step is best-effort and independent: a throw closing the page
         // or context must NOT skip the Xvfb teardown below, or the virtual
@@ -8286,6 +8480,10 @@ export class BrowserController {
         ]);
         if (this.page)
             await capped(this.page.close(), 5_000);
+        this.page = null;
+        this.primaryPage = null;
+        this.oauthProductPage = null;
+        this.oauthNetLog = [];
         if (this.context)
             await capped(this.context.close(), 10_000);
         // Self-launch path: disconnect the CDP browser and SIGKILL the Chrome we