@xingular/harness 2.0.0 → 2.0.1-unstable

package/dist/sdk/annotations/bridge.js

@@ -0,0 +1,268 @@
+// The page bridge (PROP-0018): page notes in a web view that has no DevTools port, such as a Tauri
+// window on macOS. The developer loads one script into their app while developing it; the script
+// carries the page helper and pulls operations from this loopback server, answering each with the
+// helper's JSON. Only 127.0.0.1 listens, every request carries the bridge token, and everything a
+// window answers is untrusted page data.
+import { randomBytes } from 'node:crypto';
+import { chmodSync, existsSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { readJson, writeJson } from "../core/fs.js";
+import { PAGE_SCRIPT } from "./pageScript.js";
+const POLL_MS = 20_000;
+const GONE_MS = 45_000;
+const CALL_MS = 10_000;
+const MAX_BODY = 1_000_000;
+const MAX_WINDOWS = 32;
+const bounded = (value, size) => (typeof value === 'string' ? Array.from(value).slice(0, size).join('') : '');
+/** The script a window loads: the page helper plus a loop that pulls operations from the bridge. */
+export function bridgeScript(base, token) {
+    const helper = PAGE_SCRIPT.replace('__ARGS__', () => '__op');
+    return `(() => {
+  if (window.__harnessPageNotesBridge) return
+  window.__harnessPageNotesBridge = true
+  const base = ${JSON.stringify(base)}
+  const token = ${JSON.stringify(token)}
+  const call = (__op) => ${helper}
+  let windowId = null
+  const post = (path, body) => fetch(base + path, { method: 'POST', headers: { 'content-type': 'text/plain' }, body: JSON.stringify({ token, ...body }) })
+    .then(response => response.ok ? response.json() : Promise.reject(new Error(String(response.status))))
+  const pause = ms => new Promise(resolve => setTimeout(resolve, ms))
+  const loop = async () => {
+    for (;;) {
+      try {
+        if (!windowId) windowId = (await post('/register', { url: location.href, title: document.title })).windowId
+        const query = '?token=' + encodeURIComponent(token) + '&window=' + encodeURIComponent(windowId) + '&url=' + encodeURIComponent(location.href.slice(0, 2000)) + '&title=' + encodeURIComponent(document.title.slice(0, 200))
+        const response = await fetch(base + '/poll' + query)
+        if (response.status === 410) { windowId = null; continue }
+        if (response.status !== 200) { if (response.status !== 204) await pause(2000); continue }
+        const { id, operation } = await response.json()
+        let reply
+        try { reply = call(operation) } catch (error) { reply = JSON.stringify({ ok: false, error: String(error && error.message || error) }) }
+        await post('/reply', { window: windowId, id, reply })
+      } catch {
+        await pause(2000)
+      }
+    }
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', loop, { once: true })
+  else loop()
+})()
+`;
+}
+export class NotesBridge {
+    options;
+    server = null;
+    starting = null;
+    info = null;
+    windows = new Map();
+    nextWindow = 1;
+    nextCall = 1;
+    constructor(options) {
+        this.options = options;
+    }
+    settingsFile() {
+        return join(this.options.stateDir, 'notes-bridge.json');
+    }
+    /** Starts the bridge (once) on the port and token kept from last time, so the app's snippet stays valid. */
+    start() {
+        if (this.info)
+            return Promise.resolve(this.info);
+        this.starting ??= this.listen().finally(() => { this.starting = null; });
+        return this.starting;
+    }
+    /** What a window loads, once the bridge is listening. */
+    current() {
+        return this.info;
+    }
+    async listen() {
+        const settingsFile = this.settingsFile();
+        if (existsSync(settingsFile))
+            chmodSync(settingsFile, 0o600);
+        const saved = existsSync(settingsFile) ? readJson(settingsFile) : null;
+        const token = typeof saved?.token === 'string' && /^[a-f0-9]{48}$/.test(saved.token) ? saved.token : randomBytes(24).toString('hex');
+        const wanted = this.options.port ?? (Number.isSafeInteger(saved?.port) ? saved.port : 0);
+        const server = createServer((request, response) => void this.handle(request, response, token));
+        const port = await new Promise((resolve, reject) => {
+            const attempt = (port, retry) => {
+                server.once('error', (error) => {
+                    if (retry && error.code === 'EADDRINUSE')
+                        attempt(0, false);
+                    else
+                        reject(error);
+                });
+                server.listen(port, '127.0.0.1', () => resolve(server.address().port));
+            };
+            attempt(wanted, wanted !== 0);
+        });
+        this.server = server;
+        writeJson(settingsFile, { port, token });
+        chmodSync(settingsFile, 0o600);
+        const base = `http://127.0.0.1:${port}`;
+        const scriptUrl = `${base}/page-notes.js?token=${token}`;
+        this.info = {
+            port,
+            token,
+            scriptUrl,
+            snippet: `<script src="${scriptUrl}"></script>`
+        };
+        return this.info;
+    }
+    list() {
+        this.sweep();
+        return [...this.windows.values()].map(({ id, url, title, lastSeen }) => ({ id, url, title, lastSeen }));
+    }
+    /** Sends one helper operation to a window and waits for its JSON reply. */
+    call(windowId, operation) {
+        this.sweep();
+        const live = this.windows.get(windowId);
+        if (!live)
+            return Promise.reject(new Error('That app window is no longer connected.'));
+        return new Promise((resolve, reject) => {
+            const id = String(this.nextCall++);
+            const pending = {
+                id, operation, resolve, reject,
+                timer: setTimeout(() => {
+                    live.sent.delete(id);
+                    live.queue = live.queue.filter((entry) => entry !== pending);
+                    reject(new Error('The app window did not answer.'));
+                }, CALL_MS)
+            };
+            live.queue.push(pending);
+            this.flush(live);
+        });
+    }
+    flush(live) {
+        if (!live.waiter || !live.queue.length)
+            return;
+        const pending = live.queue.shift();
+        live.sent.set(pending.id, pending);
+        const waiter = live.waiter;
+        live.waiter = null;
+        if (live.waiterTimer)
+            clearTimeout(live.waiterTimer);
+        live.waiterTimer = null;
+        this.json(waiter, 200, { id: pending.id, operation: pending.operation });
+    }
+    sweep() {
+        const now = Date.now();
+        for (const live of this.windows.values()) {
+            if (now - live.lastSeen <= GONE_MS || live.waiter)
+                continue;
+            this.windows.delete(live.id);
+            for (const pending of [...live.queue, ...live.sent.values()]) {
+                clearTimeout(pending.timer);
+                pending.reject(new Error('That app window is no longer connected.'));
+            }
+        }
+    }
+    json(response, status, body) {
+        response.writeHead(status, { 'content-type': 'application/json', 'access-control-allow-origin': '*', 'cache-control': 'no-store' });
+        response.end(body === undefined ? undefined : JSON.stringify(body));
+    }
+    async body(request) {
+        let size = 0;
+        const chunks = [];
+        for await (const chunk of request) {
+            size += chunk.length;
+            if (size > MAX_BODY)
+                return null;
+            chunks.push(chunk);
+        }
+        try {
+            const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            return value && typeof value === 'object' ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async handle(request, response, token) {
+        try {
+            const port = this.server?.address()?.port;
+            // Refuse other host names, so a web page cannot reach the bridge by DNS rebinding.
+            if (request.headers.host !== `127.0.0.1:${port}` && request.headers.host !== `localhost:${port}`)
+                return this.json(response, 421);
+            const url = new URL(request.url ?? '/', `http://127.0.0.1:${port}`);
+            if (request.method === 'OPTIONS')
+                return this.json(response, 204);
+            if (request.method === 'GET' && url.pathname === '/page-notes.js') {
+                if (url.searchParams.get('token') !== token)
+                    return this.json(response, 403);
+                response.writeHead(200, { 'content-type': 'application/javascript; charset=utf-8', 'access-control-allow-origin': '*', 'cache-control': 'no-store' });
+                response.end(bridgeScript(`http://127.0.0.1:${port}`, token));
+                return;
+            }
+            if (request.method === 'GET' && url.pathname === '/poll') {
+                if (url.searchParams.get('token') !== token)
+                    return this.json(response, 403);
+                const live = this.windows.get(url.searchParams.get('window') ?? '');
+                if (!live)
+                    return this.json(response, 410);
+                live.lastSeen = Date.now();
+                live.url = bounded(url.searchParams.get('url'), 2000) || live.url;
+                live.title = bounded(url.searchParams.get('title'), 200);
+                if (live.waiter)
+                    this.json(live.waiter, 204);
+                live.waiter = response;
+                live.waiterTimer = setTimeout(() => {
+                    if (live.waiter !== response)
+                        return;
+                    live.waiter = null;
+                    this.json(response, 204);
+                }, POLL_MS);
+                response.on('close', () => { if (live.waiter === response)
+                    live.waiter = null; });
+                this.flush(live);
+                return;
+            }
+            if (request.method === 'POST' && (url.pathname === '/register' || url.pathname === '/reply')) {
+                const body = await this.body(request);
+                if (!body || body.token !== token)
+                    return this.json(response, 403);
+                if (url.pathname === '/register') {
+                    this.sweep();
+                    if (this.windows.size >= MAX_WINDOWS)
+                        return this.json(response, 429);
+                    const id = `a${this.nextWindow++}`;
+                    this.windows.set(id, { id, url: bounded(body.url, 2000), title: bounded(body.title, 200), lastSeen: Date.now(), queue: [], sent: new Map(), waiter: null, waiterTimer: null });
+                    return this.json(response, 200, { windowId: id });
+                }
+                const live = this.windows.get(typeof body.window === 'string' ? body.window : '');
+                const pending = live?.sent.get(typeof body.id === 'string' ? body.id : '');
+                if (!live || !pending)
+                    return this.json(response, 410);
+                live.sent.delete(pending.id);
+                clearTimeout(pending.timer);
+                pending.resolve(body.reply);
+                return this.json(response, 200, {});
+            }
+            this.json(response, 404);
+        }
+        catch {
+            if (!response.headersSent)
+                this.json(response, 500);
+        }
+    }
+    async close() {
+        for (const live of this.windows.values()) {
+            if (live.waiter)
+                this.json(live.waiter, 204);
+            if (live.waiterTimer)
+                clearTimeout(live.waiterTimer);
+            for (const pending of [...live.queue, ...live.sent.values()]) {
+                clearTimeout(pending.timer);
+                pending.reject(new Error('The page bridge closed.'));
+            }
+        }
+        this.windows.clear();
+        const server = this.server;
+        this.server = null;
+        this.info = null;
+        if (server) {
+            const closed = new Promise((resolve) => server.close(() => resolve()));
+            server.closeAllConnections();
+            await closed;
+        }
+    }
+}

package/dist/sdk/annotations/capture.d.ts

@@ -0,0 +1,158 @@
+import type { Browser } from 'playwright-core';
+import { NetworkPolicy } from "../browser/network.js";
+import { type Launcher } from "../browser/session.js";
+import { NotesBridge, type BridgeInfo } from "./bridge.js";
+import { type NoteApp, type NoteTarget } from "./store.js";
+export interface CaptureEnvelope {
+    url: string;
+    title: string;
+    documentId: string;
+    target: NoteTarget;
+}
+export type CaptureTargetSpec = {
+    kind: 'web';
+} | {
+    kind: 'cdp';
+    endpoint: string;
+    name?: string | null;
+} | {
+    kind: 'bridge';
+    name?: string | null;
+};
+export interface CaptureWindow {
+    id: string;
+    url: string;
+    title: string;
+    current: boolean;
+}
+/** One comment the person submitted in the inspector's popover. */
+export interface InspectResult extends CaptureEnvelope {
+    body: string;
+    action: 'save' | 'send';
+}
+export interface InspectState {
+    /** False once the person or the page ended it. */
+    active: boolean;
+    url: string;
+    title: string;
+    documentId: string;
+    result: InspectResult | null;
+    /** Whether the result came from a script world the page cannot reach. */
+    trusted: boolean;
+    /** The app the window belongs to, for the note's source. */
+    app: NoteApp | null;
+}
+/** Opens a DevTools connection to a running app; tests replace it. */
+export type AppConnector = (endpoint: string) => Promise<Browser>;
+/** A desktop app on this computer that answers on a DevTools port. */
+export interface DevToolsApp {
+    endpoint: string;
+    port: number;
+    /** The title of its first window, or what the app calls itself. */
+    name: string;
+    /** What the DevTools port reports, such as `Chrome/126.0` or `Electron/31.0`. */
+    browser: string;
+    electron: boolean;
+    windows: number;
+}
+/** Reads a JSON answer from a loopback DevTools port, or null when nothing answers in time; tests replace it. */
+export type DevToolsFetch = (url: string, timeoutMs: number) => Promise<unknown>;
+/** Starts an app the person named; tests replace it. */
+export type AppSpawner = (command: string, args: string[]) => void;
+export interface AnnotationCaptureOptions {
+    stateDir: string;
+    launch?: Launcher;
+    network?: NetworkPolicy;
+    connect?: AppConnector;
+    bridge?: NotesBridge;
+    fetchJson?: DevToolsFetch;
+    spawnApp?: AppSpawner;
+    /** A free loopback port for an app started here; tests replace it. */
+    freePort?: () => Promise<number>;
+    /** How long a started app has to open its DevTools port, in milliseconds. */
+    launchTimeoutMs?: number;
+}
+/** Where apps started with `--remote-debugging-port` or `--inspect` usually listen. */
+export declare const DEVTOOLS_PORTS: readonly [9222, 9223, 9224, 9225, 9226, 9227, 9228, 9229, 9230];
+/** The program inside a macOS `.app` bundle, or the path itself. */
+export declare function appExecutable(path: string): string;
+export declare class AnnotationCapture {
+    private readonly options;
+    private readonly targets;
+    /** Ports the person attached to or started an app on, checked again by `discover`. */
+    private readonly knownPorts;
+    private readonly inspecting;
+    private readonly network;
+    readonly bridge: NotesBridge;
+    constructor(options: AnnotationCaptureOptions);
+    private web;
+    private target;
+    private replace;
+    private call;
+    /** What `key` captures in now, with the script to load while it captures a bridge. */
+    describe(key: string): {
+        kind: CaptureTargetSpec['kind'];
+        app: NoteApp | null;
+        inspecting: boolean;
+        bridge?: {
+            snippet: string;
+        };
+    };
+    /** Captures in an app's windows instead of the browser: over its DevTools port, or the page bridge. */
+    attach(key: string, spec: CaptureTargetSpec): Promise<{
+        kind: CaptureTargetSpec['kind'];
+        app: NoteApp | null;
+        windows: CaptureWindow[];
+        bridge?: BridgeInfo;
+    }>;
+    windows(key: string): Promise<CaptureWindow[]>;
+    /** Apps on this computer that answer on a DevTools port: the usual ports and any used before. */
+    discover(ports?: readonly number[]): Promise<DevToolsApp[]>;
+    /**
+     * Starts the app the person named with a DevTools port and attaches to its windows. A macOS `.app`
+     * bundle starts its own program. The app keeps running when the capture ends.
+     */
+    launchApp(key: string, path: string, args?: readonly string[]): Promise<{
+        kind: 'cdp';
+        app: NoteApp | null;
+        windows: CaptureWindow[];
+        endpoint: string;
+    }>;
+    /** Switches to another window or tab of the target; an inspector there starts again. */
+    selectWindow(key: string, id: string): Promise<void>;
+    /** Shows the capture window, at `url` when given. Captures in the browser again if an app was attached. */
+    open(key: string, url?: string | null): Promise<{
+        url: string;
+        title: string;
+    }>;
+    identity(key: string): Promise<{
+        url: string;
+        title: string;
+        documentId: string;
+    }>;
+    /** Starts listening for the person's selection or click. Returns the id `capture` takes. */
+    begin(key: string, kind: 'text' | 'element'): Promise<{
+        captureId: string;
+    }>;
+    /** What the person selected, or null when nothing is selected yet. */
+    capture(key: string, captureId: string): Promise<CaptureEnvelope | null>;
+    cancel(key: string, captureId?: string): Promise<void>;
+    /** Turns on the inspector in the current window: hover outlines, a click opens the comment popover. */
+    inspect(key: string): Promise<{
+        captureId: string;
+    }>;
+    stopInspect(key: string): Promise<void>;
+    /**
+     * The next comment the person submitted, if any. A new document (a reload, a link) loses the
+     * inspector; it is turned on again there, so the person can keep going.
+     */
+    next(key: string): Promise<InspectState>;
+    toast(key: string, text: string): Promise<void>;
+    /** Opens the note's page when another one is showing, then scrolls to and marks its target. */
+    reveal(key: string, url: string, target: NoteTarget): Promise<{
+        state: 'matched' | 'ambiguous' | 'unresolved';
+        reason?: string;
+    }>;
+    release(key: string): Promise<void>;
+    close(): Promise<void>;
+}