@wong2kim/wmux 1.1.2 → 2.0.0

package/dist/mcp/mcp/playwright/PlaywrightEngine.js

@@ -3,32 +3,33 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PlaywrightEngine = void 0;
 const playwright_core_1 = require("playwright-core");
 const wmux_client_1 = require("../wmux-client");
-const MAX_CONNECT_RETRIES = 3;
-const RETRY_DELAY_MS = 1000;
-const PAGE_FIND_RETRIES = 5;
-const PAGE_FIND_DELAY_MS = 800;
+const MAX_CONNECT_RETRIES = 1;
+const RETRY_DELAY_MS = 500;
+const PAGE_FIND_RETRIES = 1;
+const PAGE_FIND_DELAY_MS = 300;
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
  * Returns true if the URL belongs to the Electron main renderer window.
- * Navigating these pages would destroy the app — they must never be returned.
  */
 function isElectronShellUrl(url) {
     return (url.startsWith('http://localhost:') ||
+        url.startsWith('http://127.0.0.1:') ||
         url.startsWith('devtools://') ||
         url.startsWith('chrome://'));
 }
 /**
  * PlaywrightEngine -- singleton wrapper around playwright-core's Chromium CDP connection.
  *
- * Connects to the wmux Electron app via Chrome DevTools Protocol and provides
- * access to browser pages for automation.
+ * Strategy: Connect to the Electron browser endpoint, then use CDP Target domain
+ * to discover and attach to webview targets that aren't visible as regular pages.
  */
 class PlaywrightEngine {
     constructor() {
         this.browser = null;
         this.cdpPort = null;
+        this.playwrightFailed = false;
     }
     static getInstance() {
         if (!PlaywrightEngine.instance) {
@@ -43,25 +44,30 @@ class PlaywrightEngine {
         await this.disconnect();
         this.browser = await playwright_core_1.chromium.connectOverCDP(`http://localhost:${cdpPort}`);
         this.cdpPort = cdpPort;
-        console.log(`[PlaywrightEngine] Connected to CDP on port ${cdpPort}`);
+        console.error(`[PlaywrightEngine] Connected to CDP on port ${cdpPort}`);
+        // Enable auto-attach so Electron webview targets become discoverable as Playwright pages.
+        // Without this, <webview> tags in Electron are separate renderer processes that
+        // don't appear in browser.contexts().pages().
+        try {
+            const session = await this.browser.newBrowserCDPSession();
+            await session.send('Target.setAutoAttach', {
+                autoAttach: true,
+                waitForDebuggerOnStart: false,
+                flatten: true,
+            });
+            console.error(`[PlaywrightEngine] Auto-attach enabled`);
+        }
+        catch (err) {
+            console.error('[PlaywrightEngine] setAutoAttach warning:', err instanceof Error ? err.message : String(err));
+        }
     }
     async disconnect() {
         if (this.browser) {
             this.browser = null;
             this.cdpPort = null;
-            console.log('[PlaywrightEngine] Disconnected');
+            console.error('[PlaywrightEngine] Disconnected');
         }
     }
-    /**
-     * Force reconnect — drops existing connection and creates a fresh one.
-     * Needed when new webviews are created after the initial connection,
-     * because connectOverCDP only discovers targets at connection time.
-     */
-    async reconnect() {
-        const info = (await (0, wmux_client_1.sendRpc)('browser.cdp.info'));
-        await this.disconnect();
-        await this.connect(info.cdpPort);
-    }
     async ensureConnected() {
         if (this.browser?.isConnected())
             return;
@@ -72,7 +78,7 @@ class PlaywrightEngine {
                 return;
             }
             catch (err) {
-                console.warn(`[PlaywrightEngine] Connection attempt ${attempt}/${MAX_CONNECT_RETRIES} failed:`, err instanceof Error ? err.message : String(err));
+                console.error(`[PlaywrightEngine] Connection attempt ${attempt}/${MAX_CONNECT_RETRIES} failed:`, err instanceof Error ? err.message : String(err));
                 if (attempt < MAX_CONNECT_RETRIES) {
                     await sleep(RETRY_DELAY_MS);
                 }
@@ -93,89 +99,190 @@ class PlaywrightEngine {
         return pages;
     }
     /**
-     * Fetch the CDP /json target list.
+     * Find a webview page using multiple strategies:
+     * 1. Check existing Playwright pages (works if webview is in a discoverable context)
+     * 2. Use CDP Target domain to find and attach to webview targets directly
+     * 3. Fetch /json endpoint for target discovery
      */
-    async fetchJsonTargets() {
-        if (!this.cdpPort)
-            return [];
-        const resp = await fetch(`http://127.0.0.1:${this.cdpPort}/json`);
-        return (await resp.json());
-    }
-    /**
-     * Try to find a Playwright Page that corresponds to a registered webview target.
-     * Returns null if no safe page can be found.
-     */
-    async findWebviewPage(allPages, target) {
-        // Strategy 1: Match by targetId → URL from /json endpoint
-        if (target) {
+    async getPage(surfaceId) {
+        // Fast-fail if Playwright has already failed to find webview pages.
+        // MCP tools with RPC fallbacks will skip directly to the fast RPC path.
+        if (this.playwrightFailed)
+            return null;
+        await this.ensureConnected();
+        for (let attempt = 1; attempt <= PAGE_FIND_RETRIES; attempt++) {
             try {
-                const jsonTargets = await this.fetchJsonTargets();
-                const jsonTarget = jsonTargets.find((t) => t.id === target.targetId);
-                if (jsonTarget && !isElectronShellUrl(jsonTarget.url)) {
-                    // Find Playwright page with matching URL
-                    const matched = allPages.find((p) => p.url() === jsonTarget.url);
-                    if (matched)
-                        return matched;
-                    // URL might differ slightly (trailing slash, redirect) — try loose match
-                    const normalizedTarget = jsonTarget.url.replace(/\/+$/, '');
-                    const looseMatch = allPages.find((p) => p.url().replace(/\/+$/, '') === normalizedTarget);
-                    if (looseMatch)
-                        return looseMatch;
+                // Strategy 1: Check existing pages
+                const allPages = this.getAllPages();
+                console.error(`[PlaywrightEngine] Attempt ${attempt}: ${allPages.length} pages in ${this.browser?.contexts().length ?? 0} contexts`);
+                const safePage = allPages.find((p) => !isElectronShellUrl(p.url()));
+                if (safePage) {
+                    console.error(`[PlaywrightEngine] Found page via contexts: ${safePage.url()}`);
+                    return safePage;
+                }
+                // Strategy 2: Use CDP Target.getTargets to find webview targets
+                if (this.browser) {
+                    const page = await this.findViaTargetDomain(surfaceId);
+                    if (page)
+                        return page;
+                }
+                // Strategy 3: Use /json endpoint + match registered targets
+                if (this.cdpPort) {
+                    const page = await this.findViaJsonEndpoint(surfaceId);
+                    if (page)
+                        return page;
+                }
+                if (attempt < PAGE_FIND_RETRIES) {
+                    console.error(`[PlaywrightEngine] No page found, reconnecting... (${attempt}/${PAGE_FIND_RETRIES})`);
+                    await sleep(PAGE_FIND_DELAY_MS);
+                    await this.disconnect();
+                    await this.ensureConnected();
                 }
             }
-            catch {
-                // /json fetch failed
+            catch (err) {
+                console.error(`[PlaywrightEngine] getPage attempt ${attempt} failed:`, err instanceof Error ? err.message : String(err));
+                if (attempt < PAGE_FIND_RETRIES) {
+                    await sleep(PAGE_FIND_DELAY_MS);
+                    await this.disconnect();
+                    await this.ensureConnected();
+                }
             }
         }
-        // Strategy 2: Any page that isn't the Electron shell
-        // about:blank is allowed — webviews start there before navigating
-        const candidates = allPages.filter((p) => !isElectronShellUrl(p.url()));
-        if (candidates.length > 0) {
-            return candidates[0];
-        }
+        console.error('[PlaywrightEngine] No webview page found after all retries — marking as failed');
+        this.playwrightFailed = true;
         return null;
     }
     /**
-     * Get a Page matching the given surfaceId.
-     *
-     * Includes retry logic: if no webview page is found on the first attempt,
-     * reconnects to CDP (to discover newly created webview targets) and retries.
+     * Use CDP Target domain to discover webview targets and create a page for them.
      */
-    async getPage(surfaceId) {
-        await this.ensureConnected();
-        for (let attempt = 1; attempt <= PAGE_FIND_RETRIES; attempt++) {
-            const allPages = this.getAllPages();
-            if (allPages.length === 0 && attempt < PAGE_FIND_RETRIES) {
-                // No pages yet — reconnect to discover new targets
-                await sleep(PAGE_FIND_DELAY_MS);
-                await this.reconnect();
-                continue;
+    async findViaTargetDomain(surfaceId) {
+        if (!this.browser)
+            return null;
+        try {
+            // Get the default context's first page to create a CDP session
+            const defaultContext = this.browser.contexts()[0];
+            if (!defaultContext) {
+                console.error('[PlaywrightEngine] No default context available');
+                return null;
+            }
+            let cdpSession;
+            const existingPages = defaultContext.pages();
+            if (existingPages.length > 0) {
+                cdpSession = await existingPages[0].context().newCDPSession(existingPages[0]);
+            }
+            else {
+                cdpSession = await this.browser.newBrowserCDPSession();
             }
-            // Get registered webview targets
+            // Get all targets
+            const { targetInfos } = await cdpSession.send('Target.getTargets');
+            console.error(`[PlaywrightEngine] CDP targets: ${targetInfos.map(t => `${t.type}:${t.url.substring(0, 40)}`).join(', ')}`);
+            // Get registered wmux targets for matching
             const info = (await (0, wmux_client_1.sendRpc)('browser.cdp.info'));
-            const target = surfaceId
+            const wmuxTarget = surfaceId
                 ? info.targets.find((t) => t.surfaceId === surfaceId)
                 : info.targets[0];
-            // If no targets registered yet, wait for webview to initialize
-            if (!target && attempt < PAGE_FIND_RETRIES) {
-                console.log(`[PlaywrightEngine] No CDP targets registered yet, retry ${attempt}/${PAGE_FIND_RETRIES}...`);
-                await sleep(PAGE_FIND_DELAY_MS);
-                // Reconnect to pick up newly created webview targets
-                await this.reconnect();
-                continue;
+            // Find the webview target — match by targetId from WebviewCdpManager
+            let webviewTarget = wmuxTarget
+                ? targetInfos.find((t) => t.targetId === wmuxTarget.targetId)
+                : undefined;
+            // Fallback: find any page target that isn't the Electron shell
+            if (!webviewTarget) {
+                webviewTarget = targetInfos.find((t) => t.type === 'page' && !isElectronShellUrl(t.url) && t.url !== 'about:blank');
             }
-            const page = await this.findWebviewPage(allPages, target);
-            if (page)
-                return page;
-            // Page not found — reconnect and retry (new webview might not be visible yet)
-            if (attempt < PAGE_FIND_RETRIES) {
-                console.log(`[PlaywrightEngine] Webview page not found, reconnecting... (${attempt}/${PAGE_FIND_RETRIES})`);
-                await sleep(PAGE_FIND_DELAY_MS);
-                await this.reconnect();
+            if (!webviewTarget) {
+                console.error('[PlaywrightEngine] No webview target found in Target.getTargets');
+                return null;
             }
+            console.error(`[PlaywrightEngine] Found webview target: ${webviewTarget.targetId} url=${webviewTarget.url}`);
+            // Try to attach to the target and get a page
+            // Attach with flatten:true creates a session in the current connection
+            if (!webviewTarget.attached) {
+                await cdpSession.send('Target.attachToTarget', {
+                    targetId: webviewTarget.targetId,
+                    flatten: true,
+                });
+                console.error(`[PlaywrightEngine] Attached to target ${webviewTarget.targetId}`);
+            }
+            // After attaching, check if new pages appeared
+            await sleep(500);
+            const newPages = this.getAllPages();
+            console.error(`[PlaywrightEngine] After attach: ${newPages.length} pages`);
+            const matchedPage = newPages.find((p) => !isElectronShellUrl(p.url()));
+            if (matchedPage) {
+                console.error(`[PlaywrightEngine] Found page after attach: ${matchedPage.url()}`);
+                return matchedPage;
+            }
+            // If pages still empty, try creating a new CDP connection specifically to the webview
+            // by reconnecting — this forces Playwright to re-discover all targets
+            console.error('[PlaywrightEngine] Attach did not create a page, will retry with reconnect');
+            return null;
+        }
+        catch (err) {
+            console.error('[PlaywrightEngine] findViaTargetDomain error:', err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+    /**
+     * Use the /json HTTP endpoint to find webview targets and attach via CDP.
+     */
+    async findViaJsonEndpoint(surfaceId) {
+        if (!this.cdpPort || !this.browser)
+            return null;
+        try {
+            const resp = await fetch(`http://127.0.0.1:${this.cdpPort}/json`);
+            const targets = (await resp.json());
+            console.error(`[PlaywrightEngine] /json targets: ${targets.map(t => `${t.type}:${t.url.substring(0, 40)}`).join(', ')}`);
+            // Get registered wmux targets
+            const info = (await (0, wmux_client_1.sendRpc)('browser.cdp.info'));
+            const wmuxTarget = surfaceId
+                ? info.targets.find((t) => t.surfaceId === surfaceId)
+                : info.targets[0];
+            // Find the webview in /json
+            let jsonTarget = wmuxTarget
+                ? targets.find((t) => t.id === wmuxTarget.targetId)
+                : undefined;
+            if (!jsonTarget) {
+                jsonTarget = targets.find((t) => t.type === 'page' && !isElectronShellUrl(t.url) && t.url !== 'about:blank');
+            }
+            if (!jsonTarget) {
+                console.error('[PlaywrightEngine] No webview found in /json');
+                return null;
+            }
+            console.error(`[PlaywrightEngine] Found target in /json: ${jsonTarget.id} url=${jsonTarget.url}`);
+            // Attach to the target via browser-level CDP session (don't disconnect!)
+            try {
+                const session = await this.browser.newBrowserCDPSession();
+                // Re-enable auto-attach to pick up the webview target
+                await session.send('Target.setAutoAttach', {
+                    autoAttach: true,
+                    waitForDebuggerOnStart: false,
+                    flatten: true,
+                });
+                // Also explicitly attach to the discovered target
+                await session.send('Target.attachToTarget', {
+                    targetId: jsonTarget.id,
+                    flatten: true,
+                });
+                console.error(`[PlaywrightEngine] Attached to target ${jsonTarget.id} via /json`);
+                // Brief wait for Playwright to process the attached target
+                await sleep(200);
+                const pages = this.getAllPages();
+                console.error(`[PlaywrightEngine] After /json attach: ${pages.length} pages`);
+                const matchedPage = pages.find((p) => !isElectronShellUrl(p.url()));
+                if (matchedPage) {
+                    console.error(`[PlaywrightEngine] Found page via /json attach: ${matchedPage.url()}`);
+                    return matchedPage;
+                }
+            }
+            catch (attachErr) {
+                console.error(`[PlaywrightEngine] /json attach failed: ${attachErr instanceof Error ? attachErr.message : String(attachErr)}`);
+            }
+            return null;
+        }
+        catch (err) {
+            console.error('[PlaywrightEngine] findViaJsonEndpoint error:', err instanceof Error ? err.message : String(err));
+            return null;
         }
-        console.warn('[PlaywrightEngine] No webview page found after all retries');
-        return null;
     }
     async getBrowser() {
         await this.ensureConnected();

package/dist/mcp/mcp/playwright/anti-detection.js

@@ -24,21 +24,26 @@ async function applyAntiDetection(page) {
 // CDP-powered evaluate with user gesture
 // ---------------------------------------------------------------------------
 /**
- * Evaluate a JavaScript expression in the page context with the
- * `userGesture` flag set to `true`.
+ * Evaluate a JavaScript expression in the page context via CDP
+ * `Runtime.evaluate`.
  *
- * This is useful for actions that require a transient user activation
- * (e.g. opening a popup, triggering downloads) without an actual mouse /
- * keyboard event.
+ * @param page       - The Playwright page to evaluate in.
+ * @param expression - The JavaScript expression to evaluate.
+ * @param options    - Optional settings.
+ * @param options.userGesture - When `true`, the evaluation is treated as if
+ *   triggered by a user gesture (transient activation). Defaults to `false`
+ *   to follow the principle of least privilege. Callers that genuinely need
+ *   user activation (e.g. opening popups, triggering downloads) should
+ *   explicitly pass `true`.
  *
  * Internally opens a CDP session and calls `Runtime.evaluate`.
  */
-async function evaluateWithGesture(page, expression) {
+async function evaluateWithGesture(page, expression, options) {
     const client = await page.context().newCDPSession(page);
     try {
         const result = await client.send('Runtime.evaluate', {
             expression,
-            userGesture: true,
+            userGesture: options?.userGesture ?? false,
             returnByValue: true,
             awaitPromise: true,
         });

package/dist/mcp/mcp/playwright/security.js

@@ -0,0 +1,29 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// Dangerous pattern detection for browser code execution
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDangerousPatterns = detectDangerousPatterns;
+const DANGEROUS_PATTERNS = [
+    { pattern: /\bfetch\s*\(/, label: 'fetch()' },
+    { pattern: /\bXMLHttpRequest\b/, label: 'XMLHttpRequest' },
+    { pattern: /\bWebSocket\b/, label: 'WebSocket' },
+    { pattern: /\bnavigator\.sendBeacon\b/, label: 'sendBeacon' },
+    { pattern: /\brequire\s*\(/, label: 'require()' },
+    { pattern: /\bimport\s*\(/, label: 'dynamic import()' },
+    { pattern: /\beval\s*\(/, label: 'eval()' },
+    { pattern: /\bnew\s+Function\b/, label: 'new Function()' },
+    { pattern: /\bdocument\.cookie\b/, label: 'document.cookie access' },
+    { pattern: /\blocalStorage\b/, label: 'localStorage access' },
+    { pattern: /\bsessionStorage\b/, label: 'sessionStorage access' },
+    { pattern: /\bindexedDB\b/, label: 'indexedDB access' },
+];
+/**
+ * Detect dangerous patterns in a JavaScript code string.
+ * Returns an array of human-readable labels for each matched pattern.
+ */
+function detectDangerousPatterns(code) {
+    return DANGEROUS_PATTERNS
+        .filter(({ pattern }) => pattern.test(code))
+        .map(({ label }) => label);
+}

package/dist/mcp/mcp/playwright/tools/extraction.js

@@ -33,7 +33,7 @@ function registerExtractionTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             const snapshot = await (0, dom_intelligence_1.getSmartSnapshot)(page, {
                 maxContentLength: maxContentLength ?? 3000,
@@ -86,7 +86,7 @@ function registerExtractionTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             const markdown = await (0, markdown_extractor_1.extractMarkdown)(page, {
                 selector,
@@ -120,7 +120,7 @@ function registerExtractionTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             const records = await (0, markdown_extractor_1.extractStructuredData)(page, goal, fields);
             return {

package/dist/mcp/mcp/playwright/tools/file.js

@@ -69,7 +69,7 @@ function registerFileTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             if (ref) {
                 const el = await (0, snapshot_1.resolveRef)(page, ref);
@@ -119,7 +119,7 @@ function registerFileTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             const el = await (0, snapshot_1.resolveRef)(page, ref);
             if (!el) {
@@ -177,7 +177,7 @@ function registerFileTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             const download = await page.waitForEvent('download', {
                 timeout: resolvedTimeout,
@@ -243,7 +243,7 @@ function registerFileTools(server) {
         try {
             const page = await engine.getPage(surfaceId);
             if (!page) {
-                throw new Error('No browser page available. Call browser_open first.');
+                throw new Error('No browser page available. Call browser_open with a URL first to establish a CDP connection (required even if a browser panel is already visible).');
             }
             page.once('dialog', async (dialog) => {
                 if (accept) {