@wenathlan/extension 1.1.41 → 1.1.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,5 +1,5 @@
1
1
  <!doctype html>
2
2
  <html lang="en">
3
3
  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Devthink review</title><link rel="stylesheet" href="style.css"></head>
4
- <body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Navigation trail</h2><ol id="trail" class="audit"></ol></section><section><h2>Navigation state</h2><div id="navigation" class="panel"></div></section><section><h2>Tabs and windows</h2><div id="tabswindows" class="panel"></div></section><section><h2>Forms and data</h2><div id="forms" class="panel"></div></section><section><h2>Files and downloads</h2><div id="files" class="panel"></div></section><section><h2>Capture gallery</h2><div id="captures" class="panel"></div></section><section><h2>Media</h2><div id="media" class="panel"></div></section><section><h2>Datasets</h2><div id="datasets" class="panel"></div></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
4
+ <body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Navigation trail</h2><ol id="trail" class="audit"></ol></section><section><h2>Navigation state</h2><div id="navigation" class="panel"></div></section><section><h2>Tabs and windows</h2><div id="tabswindows" class="panel"></div></section><section><h2>Forms and data</h2><div id="forms" class="panel"></div></section><section><h2>Files and downloads</h2><div id="files" class="panel"></div></section><section><h2>Capture gallery</h2><div id="captures" class="panel"></div></section><section><h2>Media</h2><div id="media" class="panel"></div></section><section><h2>Network calls</h2><div id="calls" class="panel"></div></section><section><h2>Datasets</h2><div id="datasets" class="panel"></div></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
5
5
  </html>
@@ -1,7 +1,7 @@
1
1
  // policy.ts
2
- var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages"]);
2
+ var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql"]);
3
3
  var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
4
- var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs"]);
4
+ var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml"]);
5
5
  var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
6
6
 
7
7
  // extension/tabscommand.ts
@@ -65,6 +65,7 @@ var datasetsroot = document.querySelector("#datasets");
65
65
  var filesroot = document.querySelector("#files");
66
66
  var capturesroot = document.querySelector("#captures");
67
67
  var mediaroot = document.querySelector("#media");
68
+ var callsroot = document.querySelector("#calls");
68
69
  var statusnode = document.querySelector("#status");
69
70
  var progressnode = document.querySelector("#planprogress");
70
71
  var capabilitiestext = document.querySelector("#capabilitiestext");
@@ -1687,6 +1688,151 @@ function rendercaptures(context) {
1687
1688
  capturesroot.append(card);
1688
1689
  }
1689
1690
  }
1691
+ function rendercalls(context) {
1692
+ if (!callsroot) return;
1693
+ callsroot.replaceChildren();
1694
+ const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
1695
+ for (const consent of (context.fetchconsents ?? []).filter((item) => item.approved === void 0)) {
1696
+ const card = document.createElement("div");
1697
+ card.className = "panel consentcard";
1698
+ const head = document.createElement("p");
1699
+ head.textContent = `Fetch consent ${consent.id} for ${consent.origin}: review every custom header before it is sent.`;
1700
+ card.append(head);
1701
+ for (const header of consent.headers) {
1702
+ const row = document.createElement("p");
1703
+ row.textContent = `${header.name}: ${header.value}`;
1704
+ card.append(row);
1705
+ }
1706
+ const note = document.createElement("p");
1707
+ note.className = "muted";
1708
+ note.textContent = `The prompt appears once per origin and expires ${new Date(consent.expiresat).toLocaleTimeString()}; header values never enter the audit trail.`;
1709
+ card.append(note);
1710
+ const actions2 = document.createElement("div");
1711
+ actions2.className = "actions";
1712
+ actions2.append(button("Approve headers", () => request({ kind: "approvefetchconsent", id: consent.id, approved: true }).then(() => status(`Fetch consent ${consent.id} approved; rerun the fetch step.`)).then(refresh)));
1713
+ actions2.append(button("Decline", () => request({ kind: "approvefetchconsent", id: consent.id, approved: false }).then(() => status(`Fetch consent ${consent.id} declined.`)).then(refresh)));
1714
+ card.append(actions2);
1715
+ callsroot.append(card);
1716
+ }
1717
+ const endpoints = context.endpoints ?? [];
1718
+ if (endpoints.length > 0) {
1719
+ const card = document.createElement("div");
1720
+ card.className = "panel";
1721
+ const head = document.createElement("p");
1722
+ head.textContent = `typed endpoints: ${endpoints.length}`;
1723
+ card.append(head);
1724
+ for (const endpoint of endpoints) {
1725
+ const row = document.createElement("p");
1726
+ row.textContent = `${endpoint.name} \xB7 ${endpoint.method} ${endpoint.url} \xB7 v${endpoint.version} \xB7 ${endpoint.schema?.fields.length ?? 0} payload field${endpoint.schema?.fields.length === 1 ? "" : "s"}${endpoint.headers !== void 0 ? ` \xB7 ${Object.keys(endpoint.headers).length} reviewed header${Object.keys(endpoint.headers).length === 1 ? "" : "s"}` : ""}`;
1727
+ card.append(row);
1728
+ }
1729
+ callsroot.append(card);
1730
+ }
1731
+ const apikeys = context.apikeys ?? [];
1732
+ if (apikeys.length > 0) {
1733
+ const card = document.createElement("div");
1734
+ card.className = "panel";
1735
+ const head = document.createElement("p");
1736
+ head.textContent = `api key references: ${apikeys.length} (secrets never listed)`;
1737
+ card.append(head);
1738
+ for (const ref of apikeys) {
1739
+ const row = document.createElement("p");
1740
+ row.textContent = `${ref.name} \xB7 header ${ref.header} \xB7 scoped to ${ref.origins.join(", ")}`;
1741
+ card.append(row);
1742
+ const actions2 = document.createElement("div");
1743
+ actions2.className = "actions";
1744
+ actions2.append(button(`Remove ${ref.name}`, () => request({ kind: "deleteapikey", name: ref.name }).then(() => status(`Api key reference ${ref.name} removed.`)).then(refresh)));
1745
+ card.append(actions2);
1746
+ }
1747
+ callsroot.append(card);
1748
+ }
1749
+ const callsmeta = context.calls ?? [];
1750
+ const filters = document.createElement("div");
1751
+ filters.className = "actions";
1752
+ const originfilter = document.createElement("input");
1753
+ originfilter.placeholder = "filter by origin";
1754
+ const methodfilter = document.createElement("input");
1755
+ methodfilter.placeholder = "filter by method";
1756
+ const classfilter = document.createElement("input");
1757
+ classfilter.placeholder = "filter by status class";
1758
+ filters.append(originfilter, methodfilter, classfilter);
1759
+ callsroot.append(filters);
1760
+ const list = document.createElement("div");
1761
+ const applyfilters = () => {
1762
+ list.replaceChildren();
1763
+ const origin = originfilter.value.trim().toLowerCase();
1764
+ const method = methodfilter.value.trim().toUpperCase();
1765
+ const statusclass = classfilter.value.trim().toLowerCase();
1766
+ const matched = callsmeta.filter((call) => (!origin || call.origin.toLowerCase().includes(origin)) && (!method || call.method.toUpperCase().includes(method)) && (!statusclass || call.statusclass.includes(statusclass)));
1767
+ if (matched.length === 0) {
1768
+ list.textContent = "No outbound call matches the filters yet.";
1769
+ return;
1770
+ }
1771
+ for (const call of matched) {
1772
+ const card = document.createElement("details");
1773
+ card.className = "panel callcard";
1774
+ const summary = document.createElement("summary");
1775
+ const credential = call.headernames.some((name) => name.toLowerCase().startsWith("apikey:") || ["authorization", "cookie", "proxy-authorization", "api-key", "x-api-key", "x-auth-token"].includes(name.toLowerCase()));
1776
+ summary.textContent = `${call.method} ${call.kind} ${call.status} ${call.statusclass} \xB7 ${new URL(call.url).host} \xB7 ${call.duration} ms \xB7 ${call.retries} retr${call.retries === 1 ? "y" : "ies"} \xB7 ${call.bytes} bytes \xB7 step ${call.stepid}`;
1777
+ if (credential) {
1778
+ const badge = document.createElement("span");
1779
+ badge.className = "credentialbadge";
1780
+ badge.textContent = " credential call ";
1781
+ summary.append(badge);
1782
+ }
1783
+ card.append(summary);
1784
+ const urlrow = document.createElement("p");
1785
+ urlrow.textContent = `url: ${call.url}${call.endpoint !== void 0 ? ` \xB7 endpoint ${call.endpoint}` : ""}${call.bodyexpired === true ? " \xB7 body expired from retention" : ""}`;
1786
+ card.append(urlrow);
1787
+ const headersrow = document.createElement("p");
1788
+ headersrow.textContent = `request header names: ${call.headernames.length > 0 ? call.headernames.join(", ") : "none"} (values never persist)`;
1789
+ card.append(headersrow);
1790
+ if ((call.fields ?? []).length > 0) {
1791
+ const fieldstitle = document.createElement("p");
1792
+ fieldstitle.textContent = `parsed fields: ${(call.fields ?? []).length}`;
1793
+ card.append(fieldstitle);
1794
+ for (const field of call.fields ?? []) {
1795
+ const fieldrow = document.createElement("p");
1796
+ fieldrow.textContent = `${field.name} (${field.kind}) from ${field.path}: ${field.missing === true ? "miss filled by the reviewed default" : JSON.stringify(field.value)}`;
1797
+ card.append(fieldrow);
1798
+ }
1799
+ }
1800
+ if (call.streambytes !== void 0) {
1801
+ const streamrow = document.createElement("p");
1802
+ streamrow.textContent = `streamed ${call.streambytes} bytes of the response body`;
1803
+ card.append(streamrow);
1804
+ const gauge = document.createElement("progress");
1805
+ gauge.max = Math.max(call.streambytes, call.bytes);
1806
+ gauge.value = call.streambytes;
1807
+ card.append(gauge);
1808
+ }
1809
+ for (const error of call.errors ?? []) {
1810
+ const errorrow = document.createElement("p");
1811
+ errorrow.className = "diffrow.removed";
1812
+ errorrow.textContent = `error of step ${call.stepid}: ${error}`;
1813
+ card.append(errorrow);
1814
+ }
1815
+ list.append(card);
1816
+ }
1817
+ };
1818
+ originfilter.addEventListener("input", applyfilters);
1819
+ methodfilter.addEventListener("input", applyfilters);
1820
+ classfilter.addEventListener("input", applyfilters);
1821
+ applyfilters();
1822
+ callsroot.append(list);
1823
+ const actions = document.createElement("div");
1824
+ actions.className = "actions";
1825
+ actions.append(button(`Export ${callsmeta.length} call${callsmeta.length === 1 ? "" : "s"}`, () => request({ kind: "exportcalls" }).then(() => status(`Exported ${callsmeta.length} call record${callsmeta.length === 1 ? "" : "s"} through the reviewed download flow.`)).catch((error) => status(error instanceof Error ? error.message : String(error), true))));
1826
+ if (active) {
1827
+ const retentioninput = document.createElement("input");
1828
+ retentioninput.placeholder = "call body retention (records)";
1829
+ retentioninput.value = context.callretention !== void 0 ? String(context.callretention) : "";
1830
+ retentioninput.setAttribute("aria-label", "call body retention window");
1831
+ const retentionbutton = button("Save call retention", () => request({ kind: "setcallretention", retention: retentioninput.value === "" ? void 0 : Number(retentioninput.value) }).then(() => status(`Call body retention saved as ${retentioninput.value === "" ? "keep every body" : retentioninput.value} records; metadata always survives.`)).then(refresh));
1832
+ actions.append(retentioninput, retentionbutton);
1833
+ }
1834
+ callsroot.append(actions);
1835
+ }
1690
1836
  function rendercapabilities(report) {
1691
1837
  if (!capabilitiestext) return;
1692
1838
  if (!report) {
@@ -1738,6 +1884,7 @@ async function refresh() {
1738
1884
  renderfiles(context);
1739
1885
  rendercaptures(context);
1740
1886
  rendermedia(context);
1887
+ rendercalls(context);
1741
1888
  renderaudit(context.audit);
1742
1889
  rendercapabilities(context.capabilities);
1743
1890
  if (context.session?.pausedat) status("Session paused. Reviewed actions are blocked until resume.");