@web-auto/webauto 0.1.17 → 0.1.19

package/modules/camo-runtime/src/container/runtime-core/checkpoint.mjs

@@ -261,15 +261,48 @@ export async function restoreCheckpoint({
       actionResult = { selector: effectiveSelector, count: matches.length };
     } else if (action === 'scroll_into_view') {
       if (!effectiveSelector) return asErrorPayload('CONTAINER_NOT_FOUND', 'Selector is required for scroll_into_view');
-      actionResult = await callAPI('evaluate', {
+      const resolved = await callAPI('evaluate', {
         profileId: resolvedProfile,
-        script: `(async () => {
-          const el = document.querySelector(${JSON.stringify(effectiveSelector)});
-          if (!el) throw new Error('Element not found');
-          el.scrollIntoView({ behavior: 'auto', block: 'center', inline: 'nearest' });
-          return { ok: true, selector: ${JSON.stringify(effectiveSelector)} };
+        script: `(() => {
+          const selector = ${JSON.stringify(effectiveSelector)};
+          const nodes = Array.from(document.querySelectorAll(selector));
+          const target = nodes.find((node) => {
+            if (!(node instanceof Element)) return false;
+            const rect = node.getBoundingClientRect?.();
+            return Boolean(rect && rect.width > 0 && rect.height > 0);
+          }) || nodes[0] || null;
+          if (!target) return { ok: false, selector };
+          const rect = target.getBoundingClientRect?.() || { left: 0, top: 0, width: 1, height: 1 };
+          const rawCenterY = Number(rect.top) + Math.max(1, Number(rect.height) / 2);
+          return {
+            ok: true,
+            selector,
+            center: {
+              x: Math.max(1, Math.min((window.innerWidth || 1) - 1, Math.round(Number(rect.left) + Math.max(1, Number(rect.width) / 2)))),
+              y: Math.max(1, Math.min((window.innerHeight || 1) - 1, Math.round(rawCenterY))),
+            },
+            rawCenterY,
+            viewportHeight: Number(window.innerHeight || 0),
+          };
         })()`,
       });
+      const target = resolved?.result || resolved?.data?.result || resolved?.data || resolved || null;
+      if (!target || target.ok !== true) {
+        return asErrorPayload('CONTAINER_NOT_FOUND', `Container selector not found: ${effectiveSelector}`);
+      }
+      const viewportHeight = Number(target.viewportHeight || 0);
+      const rawCenterY = Number(target.rawCenterY || 0);
+      if (Number.isFinite(viewportHeight) && viewportHeight > 0 && Number.isFinite(rawCenterY)) {
+        const deltaY = Math.round(rawCenterY - viewportHeight / 2);
+        if (Math.abs(deltaY) > 48) {
+          await callAPI('mouse:wheel', {
+            profileId: resolvedProfile,
+            deltaX: 0,
+            deltaY: Math.max(-900, Math.min(900, deltaY)),
+          });
+        }
+      }
+      actionResult = { selector: effectiveSelector, center: target.center || null };
     } else if (action === 'page_back') {
       actionResult = await callAPI('page:back', { profileId: resolvedProfile });
     } else if (action === 'goto_checkpoint_url') {

package/modules/camo-runtime/src/container/runtime-core/operations/index.mjs

@@ -1,10 +1,6 @@
 import { callAPI, getDomSnapshotByProfile } from '../../../utils/browser-service.mjs';
+import { isJsExecutionEnabled } from '../../../utils/js-policy.mjs';
 import { executeTabPoolOperation } from './tab-pool.mjs';
-import {
-  buildSelectorClickScript,
-  buildSelectorScrollIntoViewScript,
-  buildSelectorTypeScript,
-} from './selector-scripts.mjs';
 import { executeViewportOperation } from './viewport.mjs';
 import {
   asErrorPayload,
@@ -54,6 +50,7 @@ async function executeExternalOperationIfAny({
 }
 
 async function flashOperationViewport(profileId, params = {}) {
+  if (!isJsExecutionEnabled()) return;
   if (params.highlight === false) return;
   try {
     await callAPI('evaluate', {
@@ -77,6 +74,150 @@ async function flashOperationViewport(profileId, params = {}) {
   }
 }
 
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function clamp(value, min, max) {
+  return Math.min(Math.max(value, min), max);
+}
+
+function isTargetFullyInViewport(target, margin = 6) {
+  const rect = target?.rect && typeof target.rect === 'object' ? target.rect : null;
+  const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : null;
+  if (!rect || !viewport) return true;
+  const vw = Number(viewport.width || 0);
+  const vh = Number(viewport.height || 0);
+  if (!Number.isFinite(vw) || !Number.isFinite(vh) || vw <= 0 || vh <= 0) return true;
+  const left = Number(rect.left || 0);
+  const top = Number(rect.top || 0);
+  const width = Math.max(0, Number(rect.width || 0));
+  const height = Math.max(0, Number(rect.height || 0));
+  const right = left + width;
+  const bottom = top + height;
+  const m = Math.max(0, Number(margin) || 0);
+  return left >= m && top >= m && right <= (vw - m) && bottom <= (vh - m);
+}
+
+function resolveScrollDeltaY(target, margin = 6) {
+  const rect = target?.rect && typeof target.rect === 'object' ? target.rect : null;
+  const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : null;
+  if (!rect || !viewport) return 0;
+  const vh = Number(viewport.height || 0);
+  if (!Number.isFinite(vh) || vh <= 0) return 0;
+  const top = Number(rect.top || 0);
+  const height = Math.max(0, Number(rect.height || 0));
+  const bottom = top + height;
+  const m = Math.max(0, Number(margin) || 0);
+  if (top < m) {
+    return clamp(Math.round(top - m - 24), -900, -80);
+  }
+  if (bottom > (vh - m)) {
+    return clamp(Math.round(bottom - (vh - m) + 24), 80, 900);
+  }
+  return 0;
+}
+
+async function resolveSelectorTarget(profileId, selector) {
+  const selectorLiteral = JSON.stringify(String(selector || '').trim());
+  const payload = await callAPI('evaluate', {
+    profileId,
+    script: `(() => {
+      const selector = ${selectorLiteral};
+      const nodes = Array.from(document.querySelectorAll(selector));
+      const isVisible = (node) => {
+        if (!(node instanceof Element)) return false;
+        const rect = node.getBoundingClientRect?.();
+        if (!rect || rect.width <= 0 || rect.height <= 0) return false;
+        try {
+          const style = window.getComputedStyle(node);
+          if (!style) return false;
+          if (style.display === 'none') return false;
+          if (style.visibility === 'hidden' || style.visibility === 'collapse') return false;
+          const opacity = Number.parseFloat(String(style.opacity || '1'));
+          if (Number.isFinite(opacity) && opacity <= 0.01) return false;
+        } catch {
+          return false;
+        }
+        return true;
+      };
+      const hitVisible = (node) => {
+        if (!(node instanceof Element)) return false;
+        const rect = node.getBoundingClientRect?.();
+        if (!rect) return false;
+        const x = Math.max(0, Math.min((window.innerWidth || 1) - 1, rect.left + rect.width / 2));
+        const y = Math.max(0, Math.min((window.innerHeight || 1) - 1, rect.top + rect.height / 2));
+        const top = document.elementFromPoint(x, y);
+        if (!top) return false;
+        return top === node || node.contains(top) || top.contains(node);
+      };
+      const target = nodes.find((item) => isVisible(item) && hitVisible(item))
+        || nodes.find((item) => isVisible(item))
+        || nodes[0]
+        || null;
+      if (!target) {
+        return { ok: false, error: 'selector_not_found', selector };
+      }
+      const rect = target.getBoundingClientRect?.() || { left: 0, top: 0, width: 1, height: 1 };
+      const rawCenterX = Number(rect.left) + Math.max(1, Number(rect.width) / 2);
+      const rawCenterY = Number(rect.top) + Math.max(1, Number(rect.height) / 2);
+      const viewport = {
+        width: Number(window.innerWidth || 0),
+        height: Number(window.innerHeight || 0),
+      };
+      const center = {
+        x: Math.max(1, Math.min((viewport.width || 1) - 1, Math.round(rawCenterX))),
+        y: Math.max(1, Math.min((viewport.height || 1) - 1, Math.round(rawCenterY))),
+      };
+      return {
+        ok: true,
+        selector,
+        matchedIndex: Math.max(0, nodes.indexOf(target)),
+        center,
+        rawCenter: {
+          x: rawCenterX,
+          y: rawCenterY,
+        },
+        rect: {
+          left: Number(rect.left || 0),
+          top: Number(rect.top || 0),
+          width: Number(rect.width || 0),
+          height: Number(rect.height || 0),
+        },
+        viewport,
+      };
+    })()`,
+  });
+  const result = payload?.result || payload?.data?.result || payload?.data || payload || null;
+  if (!result || result.ok !== true || !result.center) {
+    throw new Error(`Element not found: ${selector}`);
+  }
+  return result;
+}
+
+async function scrollTargetIntoViewport(profileId, selector, initialTarget, params = {}) {
+  let target = initialTarget;
+  const maxSteps = Math.max(0, Math.min(8, Number(params.maxScrollSteps ?? 3) || 3));
+  const settleMs = Math.max(0, Number(params.scrollSettleMs ?? 0) || 0);
+  const margin = Math.max(0, Number(params.viewportMargin ?? 6) || 6);
+  for (let i = 0; i < maxSteps; i += 1) {
+    if (isTargetFullyInViewport(target, margin)) break;
+    const deltaY = resolveScrollDeltaY(target, margin);
+    if (!Number.isFinite(deltaY) || Math.abs(deltaY) < 1) break;
+    const vw = Number(target?.viewport?.width || 0);
+    const vh = Number(target?.viewport?.height || 0);
+    if (Number.isFinite(vw) && vw > 2 && Number.isFinite(vh) && vh > 2) {
+      const anchorX = clamp(Math.round(vw / 2), 1, Math.max(1, vw - 1));
+      const anchorY = clamp(Math.round(vh / 2), 1, Math.max(1, vh - 1));
+      await callAPI('mouse:move', { profileId, x: anchorX, y: anchorY, steps: 1 });
+    }
+    await callAPI('mouse:wheel', { profileId, deltaX: 0, deltaY });
+    if (settleMs > 0) await sleep(settleMs);
+    target = await resolveSelectorTarget(profileId, selector);
+  }
+  return target;
+}
+
 async function executeSelectorOperation({ profileId, action, operation, params }) {
   const selector = maybeSelector({
     profileId,
@@ -85,22 +226,66 @@ async function executeSelectorOperation({ profileId, action, operation, params }
   });
   if (!selector) return asErrorPayload('CONTAINER_NOT_FOUND', `${action} requires selector/containerId`);
 
-  const highlight = params.highlight !== false;
+  let target = await resolveSelectorTarget(profileId, selector);
+  target = await scrollTargetIntoViewport(profileId, selector, target, params);
+
   if (action === 'scroll_into_view') {
-    const script = buildSelectorScrollIntoViewScript({ selector, highlight });
-    const result = await callAPI('evaluate', {
+    await callAPI('mouse:move', { profileId, x: target.center.x, y: target.center.y, steps: 2 });
+    return {
+      ok: true,
+      code: 'OPERATION_DONE',
+      message: 'scroll_into_view done',
+      data: { selector, target },
+    };
+  }
+
+  if (action === 'click') {
+    const button = String(params.button || 'left').trim() || 'left';
+    const clicks = Math.max(1, Number(params.clicks ?? 1) || 1);
+    const delay = Number(params.delay);
+    const result = await callAPI('mouse:click', {
       profileId,
-      script,
+      x: target.center.x,
+      y: target.center.y,
+      button,
+      clicks,
+      ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
     });
-    return { ok: true, code: 'OPERATION_DONE', message: 'scroll_into_view done', data: result };
+    return { ok: true, code: 'OPERATION_DONE', message: 'click done', data: { selector, target, result } };
   }
 
-  const typeText = String(params.text ?? params.value ?? '');
-  const script = action === 'click'
-    ? buildSelectorClickScript({ selector, highlight })
-    : buildSelectorTypeScript({ selector, highlight, text: typeText });
-  const result = await callAPI('evaluate', { profileId, script });
-  return { ok: true, code: 'OPERATION_DONE', message: `${action} done`, data: result };
+  const text = String(params.text ?? params.value ?? '');
+  await callAPI('mouse:click', {
+    profileId,
+    x: target.center.x,
+    y: target.center.y,
+    button: 'left',
+    clicks: 1,
+    delay: 30,
+  });
+  const clearBeforeType = params.clear !== false;
+  if (clearBeforeType) {
+    await callAPI('keyboard:press', {
+      profileId,
+      key: process.platform === 'darwin' ? 'Meta+A' : 'Control+A',
+    });
+    await callAPI('keyboard:press', { profileId, key: 'Backspace' });
+  }
+  const delay = Number(params.keyDelayMs ?? params.delay);
+  await callAPI('keyboard:type', {
+    profileId,
+    text,
+    ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
+  });
+  if (params.pressEnter === true) {
+    await callAPI('keyboard:press', { profileId, key: 'Enter' });
+  }
+  return {
+    ok: true,
+    code: 'OPERATION_DONE',
+    message: 'type done',
+    data: { selector, target, length: text.length },
+  };
 }
 
 async function executeVerifySubscriptions({ profileId, params }) {
@@ -365,26 +550,11 @@ export async function executeOperation({ profileId, operation, context = {} }) {
     if (action === 'press_key') {
       const key = String(params.key || params.value || '').trim();
       if (!key) return asErrorPayload('OPERATION_FAILED', 'press_key requires params.key');
-      const result = await callAPI('evaluate', {
+      const delay = Number(params.delay);
+      const result = await callAPI('keyboard:press', {
         profileId: resolvedProfile,
-        script: `(async () => {
-          const target = document.activeElement || document.body || document.documentElement;
-          const key = ${JSON.stringify(key)};
-          const code = key.length === 1 ? 'Key' + key.toUpperCase() : key;
-          const opts = { key, code, bubbles: true, cancelable: true };
-          target.dispatchEvent(new KeyboardEvent('keydown', opts));
-          target.dispatchEvent(new KeyboardEvent('keypress', opts));
-          target.dispatchEvent(new KeyboardEvent('keyup', opts));
-          if (key === 'Escape') {
-            const closeButton = document.querySelector('.note-detail-mask .close-box, .note-detail-mask .close-circle');
-            if (closeButton instanceof HTMLElement) closeButton.click();
-          }
-          if (key === 'Enter' && target instanceof HTMLInputElement && target.form) {
-            if (typeof target.form.requestSubmit === 'function') target.form.requestSubmit();
-            else target.form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
-          }
-          return { key, targetTag: target?.tagName || null };
-        })()`,
+        key,
+        ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
       });
       return { ok: true, code: 'OPERATION_DONE', message: 'press_key done', data: result };
     }
@@ -394,10 +564,7 @@ export async function executeOperation({ profileId, operation, context = {} }) {
     }
 
     if (action === 'evaluate') {
-      const script = String(params.script || '').trim();
-      if (!script) return asErrorPayload('OPERATION_FAILED', 'evaluate requires params.script');
-      const result = await callAPI('evaluate', { profileId: resolvedProfile, script });
-      return { ok: true, code: 'OPERATION_DONE', message: 'evaluate done', data: result };
+      return asErrorPayload('JS_DISABLED', 'evaluate is disabled in webauto runtime');
     }
 
     if (action === 'click' || action === 'type' || action === 'scroll_into_view') {

package/modules/camo-runtime/src/container/runtime-core/operations/tab-pool.mjs

@@ -242,34 +242,6 @@ async function waitForTabCountIncrease({
   };
 }
 
-async function tryOpenTabWithAnchor(profileId, seedUrl, timeoutMs) {
-  try {
-    const popupResult = await callApiWithTimeout('evaluate', {
-      profileId,
-      script: `(() => {
-        const href = ${JSON.stringify(seedUrl || 'about:blank')};
-        const anchor = document.createElement('a');
-        anchor.href = href;
-        anchor.target = '_blank';
-        anchor.rel = 'noopener noreferrer';
-        anchor.style.position = 'fixed';
-        anchor.style.left = '-9999px';
-        anchor.style.top = '-9999px';
-        document.body.appendChild(anchor);
-        const evt = new MouseEvent('click', { bubbles: true, cancelable: true, view: window });
-        const dispatched = anchor.dispatchEvent(evt);
-        anchor.click();
-        anchor.remove();
-        return { opened: true, dispatched };
-      })()`,
-    }, timeoutMs);
-    const popupData = popupResult?.result || popupResult || {};
-    return { ok: Boolean(popupData?.opened || popupData?.ok), error: null };
-  } catch (err) {
-    return { ok: false, error: err };
-  }
-}
-
 async function openTabBestEffort({
   profileId,
   seedUrl,
@@ -335,57 +307,6 @@ async function openTabBestEffort({
     openError = err;
   }
 
-  try {
-    const popupResult = await callApiWithTimeout('evaluate', {
-      profileId,
-      script: `(() => {
-        const popup = window.open(${JSON.stringify(seedUrl || 'about:blank')}, '_blank');
-        return { opened: !!popup };
-      })()`,
-    }, apiTimeoutMs);
-    const popupData = popupResult?.result || popupResult || {};
-    if (Boolean(popupData?.opened || popupData?.ok)) {
-      await settle();
-      const popupOpened = await waitForTab();
-      if (popupOpened.ok) {
-        await seedNewestTabIfNeeded({
-          profileId,
-          seedUrl,
-          openDelayMs,
-          apiTimeoutMs,
-          navigationTimeoutMs,
-          syncConfig,
-        });
-        return { ok: true, mode: 'window.open', error: null };
-      }
-    }
-  } catch (err) {
-    openError = err;
-  }
-
-  const anchorResult = await tryOpenTabWithAnchor(
-    profileId,
-    seedUrl,
-    Math.max(1200, Math.min(apiTimeoutMs, 5000)),
-  );
-  if (anchorResult.ok) {
-    await settle();
-    const anchorOpened = await waitForTab();
-    if (anchorOpened.ok) {
-      await seedNewestTabIfNeeded({
-        profileId,
-        seedUrl,
-        openDelayMs,
-        apiTimeoutMs,
-        navigationTimeoutMs,
-        syncConfig,
-      });
-      return { ok: true, mode: 'anchor_click', error: null };
-    }
-  } else {
-    openError = anchorResult.error || openError;
-  }
-
   return { ok: false, mode: null, error: openError };
 }
 

package/modules/camo-runtime/src/container/runtime-core/operations/viewport.mjs

@@ -41,6 +41,7 @@ export async function executeViewportOperation({ profileId, action, params = {}
     const width = hasTargetViewport ? Math.max(320, rawWidth) : null;
     const height = hasTargetViewport ? Math.max(240, rawHeight) : null;
     const followWindow = params.followWindow !== false;
+    const fitDisplayWindow = params.fitDisplayWindow !== false;
     const settleMs = Math.max(0, Number(params.settleMs ?? 180) || 180);
     const attempts = Math.max(1, Number(params.attempts ?? 3) || 3);
     const tolerance = Math.max(0, Number(params.tolerancePx ?? 3) || 3);
@@ -56,6 +57,49 @@ export async function executeViewportOperation({ profileId, action, params = {}
 
     let measured = await probeWindow();
     if (followWindow && !hasTargetViewport) {
+      let resizedWindow = false;
+      let windowTarget = null;
+      if (fitDisplayWindow) {
+        try {
+          const displayPayload = await callWithTimeout('system:display', {}, apiTimeoutMs);
+          const display = displayPayload?.metrics || displayPayload || {};
+          const reserveFromEnv = Number(process.env.CAMO_DEFAULT_WINDOW_VERTICAL_RESERVE ?? 0);
+          const reservePx = Number.isFinite(reserveFromEnv) ? Math.max(0, Math.min(240, Math.floor(reserveFromEnv))) : 0;
+          const workWidth = Number(display.workWidth || 0);
+          const workHeight = Number(display.workHeight || 0);
+          const width = Number(display.width || 0);
+          const height = Number(display.height || 0);
+          const baseW = Math.floor(workWidth > 0 ? workWidth : width);
+          const baseH = Math.floor(workHeight > 0 ? workHeight : height);
+          if (baseW > 0 && baseH > 0) {
+            windowTarget = {
+              width: Math.max(960, baseW),
+              height: Math.max(700, baseH - reservePx),
+            };
+            const currentOuterWidth = Number(measured.outerWidth || 0);
+            const currentOuterHeight = Number(measured.outerHeight || 0);
+            const shouldResize = (
+              !Number.isFinite(currentOuterWidth)
+              || !Number.isFinite(currentOuterHeight)
+              || currentOuterWidth < Math.floor(windowTarget.width * 0.92)
+              || currentOuterHeight < Math.floor(windowTarget.height * 0.92)
+            );
+            if (shouldResize) {
+              await callWithTimeout('window:resize', {
+                profileId,
+                width: windowTarget.width,
+                height: windowTarget.height,
+              }, apiTimeoutMs);
+              if (settleMs > 0) await new Promise((resolve) => setTimeout(resolve, settleMs));
+              measured = await probeWindow();
+              resizedWindow = true;
+            }
+          }
+        } catch {
+          // display probing is best-effort and must not block follow-window sync
+        }
+      }
+
       const innerWidth = Math.max(320, Number(measured.innerWidth || 0) || 1280);
       const innerHeight = Math.max(240, Number(measured.innerHeight || 0) || 720);
       const outerWidth = Math.max(320, Number(measured.outerWidth || 0) || innerWidth);
@@ -77,6 +121,8 @@ export async function executeViewportOperation({ profileId, action, params = {}
           followWindow: true,
           viewport: { width: followWidth, height: followHeight },
           frame: { width: frameW, height: frameH },
+          resizedWindow,
+          windowTarget,
           measured: synced,
         },
       };

package/modules/camo-runtime/src/utils/browser-service.mjs

@@ -9,6 +9,7 @@ import { BROWSER_SERVICE_URL, loadConfig, setRepoRoot } from './config.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_API_TIMEOUT_MS = 30000;
 
 function resolveNodeBin() {
   const explicit = String(process.env.WEBAUTO_NODE_BIN || '').trim();
@@ -54,12 +55,46 @@ function runCamoCli(args = [], options = {}) {
   };
 }
 
-export async function callAPI(action, payload = {}) {
-  const r = await fetch(`${BROWSER_SERVICE_URL}/command`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ action, args: payload }),
-  });
+function resolveApiTimeoutMs(options = {}) {
+  const optionValue = Number(options?.timeoutMs);
+  if (Number.isFinite(optionValue) && optionValue > 0) {
+    return Math.max(1000, Math.floor(optionValue));
+  }
+  const envValue = Number(process.env.CAMO_API_TIMEOUT_MS);
+  if (Number.isFinite(envValue) && envValue > 0) {
+    return Math.max(1000, Math.floor(envValue));
+  }
+  return DEFAULT_API_TIMEOUT_MS;
+}
+
+function isTimeoutError(error) {
+  const name = String(error?.name || '').toLowerCase();
+  const message = String(error?.message || '').toLowerCase();
+  return (
+    name.includes('timeout')
+    || name.includes('abort')
+    || message.includes('timeout')
+    || message.includes('timed out')
+    || message.includes('aborted')
+  );
+}
+
+export async function callAPI(action, payload = {}, options = {}) {
+  const timeoutMs = resolveApiTimeoutMs(options);
+  let r;
+  try {
+    r = await fetch(`${BROWSER_SERVICE_URL}/command`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ action, args: payload }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      throw new Error(`browser-service timeout after ${timeoutMs}ms: ${action}`);
+    }
+    throw error;
+  }
 
   let body;
   try {

package/modules/camo-runtime/src/utils/js-policy.mjs

@@ -0,0 +1,28 @@
+const FORBIDDEN_JS_ACTION_RULES = [
+  { code: 'dom_click', re: /\.click\s*\(/i },
+  { code: 'dispatch_event', re: /\.dispatchEvent\s*\(/i },
+  { code: 'js_scroll_by', re: /\bscrollBy\s*\(/i },
+  { code: 'js_scroll_to', re: /\bscrollTo\s*\(/i },
+  { code: 'js_scroll_into_view', re: /\bscrollIntoView\s*\(/i },
+  { code: 'keyboard_event_ctor', re: /\bKeyboardEvent\s*\(/i },
+  { code: 'input_event_ctor', re: /\bInputEvent\s*\(/i },
+  { code: 'dom_value_assign', re: /\.value\s*=/i },
+];
+
+export function detectForbiddenJsAction(script = '') {
+  const source = String(script || '');
+  for (const rule of FORBIDDEN_JS_ACTION_RULES) {
+    if (rule.re.test(source)) return rule.code;
+  }
+  return null;
+}
+
+export function assertNoForbiddenJsAction(script = '', scope = 'evaluate') {
+  const hit = detectForbiddenJsAction(script);
+  if (!hit) return;
+  throw new Error(`${scope} blocked: forbidden_js_action(${hit})`);
+}
+
+export function isJsExecutionEnabled() {
+  return false;
+}

package/modules/workflow/blocks/EnsureSession.ts

@@ -207,7 +207,6 @@ export async function execute(input: EnsureSessionInput): Promise<EnsureSessionO
     }
 
     async function clearCssZoom(): Promise<void> {
-      if (!profileId.startsWith('xiaohongshu_')) return;
       try {
         await fetch(statusUrl, {
           method: 'POST',
@@ -230,7 +229,6 @@ export async function execute(input: EnsureSessionInput): Promise<EnsureSessionO
     }
 
     async function applyZoom(): Promise<void> {
-      if (!profileId.startsWith('xiaohongshu_')) return;
       const metrics = await loadMetrics();
       const zoom = resolveZoom(metrics);
       if (zoom === null) {
@@ -281,7 +279,6 @@ export async function execute(input: EnsureSessionInput): Promise<EnsureSessionO
     }
 
     async function applyBrowserZoom(): Promise<void> {
-      if (!profileId.startsWith('xiaohongshu_')) return;
       const target = resolveBrowserZoomTarget();
       if (!target || Math.abs(target - 1) < 0.01) return;
       const zoomOutSteps = [0.9, 0.8, 0.67, 0.5, 0.33, 0.25];
@@ -327,7 +324,6 @@ export async function execute(input: EnsureSessionInput): Promise<EnsureSessionO
     }
 
     async function resetBrowserZoom(): Promise<void> {
-      if (!profileId.startsWith('xiaohongshu_')) return;
       if (process.env.WEBAUTO_RESET_BROWSER_ZOOM === '0') return;
       const key = os.platform() === 'darwin' ? 'Meta+0' : 'Control+0';
       try {