@zixt/host 0.0.156 → 0.0.157

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir6 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.156",
+  version: "0.0.157",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14881,6 +14881,23 @@ var BrowserFramePayload = external_exports.object({
   width: external_exports.number().int().min(1).max(3840),
   height: external_exports.number().int().min(1).max(2160)
 }).strict();
+var BrowserCookie = external_exports.object({
+  name: external_exports.string().min(1).max(256),
+  value: external_exports.string().max(8192),
+  domain: external_exports.string().min(1).max(253),
+  path: external_exports.string().min(1).max(2048),
+  expires: external_exports.number().finite().min(-1).max(253402300799),
+  httpOnly: external_exports.boolean(),
+  secure: external_exports.boolean(),
+  sameSite: external_exports.enum(["Strict", "Lax", "None"]),
+  /** Chromium partition key for CHIPS cookies, when present. */
+  partitionKey: external_exports.string().min(1).max(2048).optional()
+}).strict();
+var BROWSER_MAX_SYNCED_COOKIES = 512;
+var BrowserCookieState = external_exports.object({
+  revision: external_exports.number().int().min(0),
+  cookies: external_exports.array(BrowserCookie).max(BROWSER_MAX_SYNCED_COOKIES)
+}).strict();
 var inputCoordinate = external_exports.number().min(0).max(16384);
 var BrowserMouseButton = external_exports.enum(["left", "middle", "right"]);
 var BrowserInputEvent = external_exports.discriminatedUnion("kind", [
@@ -14940,7 +14957,7 @@ var BrowserSessionProjection = external_exports.object({
   canStart: external_exports.boolean(),
   /** Member-safe reason when canStart is false. */
   reason: external_exports.string().max(300).optional(),
-  /** Present only when active work must use a different Machine-local profile. */
+  /** Present only when active work uses a different local profile Machine. */
   profileContext: BrowserProfileContext.optional()
 }).strict();
 var StartBrowserSessionRequest = external_exports.object({ url: external_exports.string().min(1).max(2e3).optional() }).strict();
@@ -18338,7 +18355,7 @@ var ListTasksResponse = external_exports.object({
 }).strict();
 
 // ../../packages/contracts/src/protocol.ts
-var PROTOCOL_VERSION = 13;
+var PROTOCOL_VERSION = 14;
 var BROWSER_PROFILE_INVENTORY_PAGE_SIZE = 200;
 var HELLO_UNWOUND_ASSIGNMENT_LIMIT = 1e3;
 var TASK_CANCEL_ACK_EVENT = "zixt.task.cancel.acknowledged";
@@ -19512,6 +19529,44 @@ var BrowserSessionEndedFrame = external_exports.object({
   agentId: AgentId,
   reason: BrowserSessionEndReason
 });
+var BrowserCookieSyncFrame = external_exports.object({
+  type: external_exports.literal("browser.cookies.sync"),
+  requestId: external_exports.string().min(1).max(200),
+  projectId: ProjectId,
+  taskId: TaskId,
+  agentId: AgentId,
+  browserSessionId: external_exports.string().min(1).max(200),
+  /** Omitted only by a Machine that has not received the canonical jar yet. */
+  baseRevision: external_exports.number().int().min(0).optional(),
+  cookies: external_exports.array(BrowserCookie).max(BROWSER_MAX_SYNCED_COOKIES)
+}).strict();
+var BrowserCookieSyncResultFrame = external_exports.discriminatedUnion("ok", [
+  external_exports.object({
+    type: external_exports.literal("browser.cookies.result"),
+    requestId: external_exports.string().min(1).max(200),
+    projectId: ProjectId,
+    taskId: TaskId,
+    agentId: AgentId,
+    browserSessionId: external_exports.string().min(1).max(200),
+    ok: external_exports.literal(true),
+    /** False asks the Host to reconcile its local changes over this newer jar. */
+    accepted: external_exports.boolean(),
+    state: BrowserCookieState,
+    error: external_exports.never().optional()
+  }).strict(),
+  external_exports.object({
+    type: external_exports.literal("browser.cookies.result"),
+    requestId: external_exports.string().min(1).max(200),
+    projectId: ProjectId,
+    taskId: TaskId,
+    agentId: AgentId,
+    browserSessionId: external_exports.string().min(1).max(200),
+    ok: external_exports.literal(false),
+    accepted: external_exports.never().optional(),
+    state: external_exports.never().optional(),
+    error: external_exports.string().min(1).max(300)
+  }).strict()
+]);
 var BrowserCredentialRequestFrame = external_exports.object({
   type: external_exports.literal("browser.credential.request"),
   projectId: ProjectId,
@@ -19939,6 +19994,7 @@ var HostToCloudFrame = external_exports.discriminatedUnion("type", [
   BrowserStateFrame,
   BrowserScreencastFrame,
   BrowserSessionEndedFrame,
+  BrowserCookieSyncFrame,
   BrowserCredentialRequestFrame,
   BrowserProfilePurged,
   PingFrame,
@@ -19946,6 +20002,7 @@ var HostToCloudFrame = external_exports.discriminatedUnion("type", [
 ]);
 var CloudToHostFrame = external_exports.discriminatedUnion("type", [
   HelloAckFrame,
+  BrowserCookieSyncResultFrame,
   DeliverFrame,
   ConnectionProbeFrame,
   ApiOperationCallFrame,
@@ -25813,6 +25870,8 @@ var HostClient = class _HostClient {
   operationGrantWaiters = /* @__PURE__ */ new Map();
   /** Project/Task-qualified, socket-generation-bound web_login exchanges. */
   browserCredentialWaiters = /* @__PURE__ */ new Map();
+  /** Project-scoped, socket-generation-bound Browser cookie exchanges. */
+  browserCookieSyncWaiters = /* @__PURE__ */ new Map();
   /** True only after the connected cloud's helloAck advertised the feature. */
   browserFeatureActive = false;
   workingContextFeatureActive = false;
@@ -25978,6 +26037,13 @@ var HostClient = class _HostClient {
       waiter.deny("No sign-in was attempted: this machine lost its connection to Zixt.");
     }
   }
+  rejectBrowserCookieSyncWaiters() {
+    for (const [requestId, waiter] of this.browserCookieSyncWaiters) {
+      clearTimeout(waiter.timer);
+      this.browserCookieSyncWaiters.delete(requestId);
+      waiter.deny("Browser cookie synchronization lost its Zixt connection.");
+    }
+  }
   async unwindAllRuns(reason, stopReason) {
     const runs = [...this.activeRuns.values()];
     const unwindingAssignments = [...this.activeAssignments.values()];
@@ -26017,6 +26083,7 @@ var HostClient = class _HostClient {
     }
     this.rejectOperationGrantWaiters();
     this.rejectBrowserCredentialWaiters();
+    this.rejectBrowserCookieSyncWaiters();
     for (const deadline of this.authorityExpiryTimers.values()) clearTimeout(deadline.timer);
     this.cancels.clear();
     this.secretGrants.clear();
@@ -26369,10 +26436,46 @@ var HostClient = class _HostClient {
    * frame at a non-advertising cloud would each close the socket outright.
    */
   sendBrowserFrame(frame) {
-    if (!this.browserFeatureActive) return;
+    if (!this.browserFeatureActive) return false;
     const projectId = frame.type === "browser.state" ? frame.state.projectId : frame.type === "browser.frame" ? frame.frame.projectId : frame.projectId;
-    if (this.purgingProjects.has(projectId)) return;
-    this.send(frame);
+    if (this.purgingProjects.has(projectId)) return false;
+    return this.send(frame);
+  }
+  requestBrowserCookieSync(input) {
+    const socket = this.ws;
+    if (!socket || !this.browserFeatureActive || !this.protocolReady) {
+      return Promise.reject(
+        new Error("Browser cookie synchronization has no live Zixt connection.")
+      );
+    }
+    const requestId = crypto.randomUUID();
+    return new Promise((resolve24, reject3) => {
+      const timer = setTimeout(() => {
+        if (this.browserCookieSyncWaiters.delete(requestId)) {
+          reject3(new Error("Zixt did not answer Browser cookie synchronization in time."));
+        }
+      }, 3e4);
+      timer.unref?.();
+      this.browserCookieSyncWaiters.set(requestId, {
+        projectId: input.projectId,
+        taskId: input.taskId,
+        agentId: input.agentId,
+        browserSessionId: input.browserSessionId,
+        socket,
+        timer,
+        accept: resolve24,
+        deny: (reason) => reject3(new Error(reason))
+      });
+      if (!this.sendBrowserFrame({
+        type: "browser.cookies.sync",
+        requestId,
+        ...input
+      })) {
+        clearTimeout(timer);
+        this.browserCookieSyncWaiters.delete(requestId);
+        reject3(new Error("Browser cookie synchronization has no live Zixt connection."));
+      }
+    });
   }
   replaceablePendingUp(message) {
     return message.type === "host.report" || message.type === "task.working_context" || message.type === "task.runner_runtime" || message.type === "task.title" || message.type === "task.event" && message.event.ephemeral === true;
@@ -26594,7 +26697,8 @@ var HostClient = class _HostClient {
               taskId,
               agentId,
               reason
-            })
+            }),
+            syncCookies: (input) => this.requestBrowserCookieSync(input)
           });
         } else {
           this.opts.browser?.attach(null);
@@ -26708,6 +26812,17 @@ var HostClient = class _HostClient {
         waiter.accept(grant);
         return;
       }
+      case "browser.cookies.result": {
+        const waiter = this.browserCookieSyncWaiters.get(frame.requestId);
+        if (!waiter || waiter.socket !== sourceSocket || waiter.projectId !== frame.projectId || waiter.taskId !== frame.taskId || waiter.agentId !== frame.agentId || waiter.browserSessionId !== frame.browserSessionId) {
+          return;
+        }
+        clearTimeout(waiter.timer);
+        this.browserCookieSyncWaiters.delete(frame.requestId);
+        if (frame.ok) waiter.accept({ accepted: frame.accepted, state: frame.state });
+        else waiter.deny(frame.error);
+        return;
+      }
       case "browser.open": {
         if (!this.acceptsVolatileProjectWork(frame.projectId, frame.projectWorkFenceRevision)) {
           return;
@@ -32486,6 +32601,7 @@ function createDemoBrowserAdapterFactory() {
       const tabs = [newDemoTab()];
       let activeIndex = 0;
       let sink = null;
+      let cookies = [];
       const listeners = [];
       const frame = () => ({
         jpegBase64: DEMO_FRAME_JPEG_BASE64,
@@ -32629,6 +32745,12 @@ function createDemoBrowserAdapterFactory() {
           }
           emit();
         },
+        async cookies() {
+          return cookies.map((cookie) => ({ ...cookie }));
+        },
+        async replaceCookies(next) {
+          cookies = next.map((cookie) => ({ ...cookie }));
+        },
         async close() {
           sink = null;
         }
@@ -44384,6 +44506,10 @@ var BrowserManager = class {
   deniedAuthorizations = /* @__PURE__ */ new Map();
   /** Serializes profile lifecycle and session open/close per teammate. */
   locks = /* @__PURE__ */ new Map();
+  /** Last cloud-canonical jar observed for each exact Project teammate. */
+  cookieStates = /* @__PURE__ */ new Map();
+  cookieSyncTails = /* @__PURE__ */ new Map();
+  cookieSyncTimers = /* @__PURE__ */ new Map();
   events = null;
   profileRoot;
   profileStateRoot;
@@ -44400,8 +44526,15 @@ var BrowserManager = class {
   attach(events) {
     this.events = events;
     if (!events) return;
+    const scheduledProfiles = /* @__PURE__ */ new Set();
     for (const session of this.sessions.values()) {
-      if (!session.closed) events.state(this.stateOf(session));
+      if (session.closed) continue;
+      events.state(this.stateOf(session));
+      const profileKey = this.profileKey(session.projectId, session.agentId);
+      if (!scheduledProfiles.has(profileKey)) {
+        scheduledProfiles.add(profileKey);
+        this.scheduleCookieSync(session, 0);
+      }
     }
   }
   capability() {
@@ -44486,6 +44619,39 @@ var BrowserManager = class {
   profileKey(projectId, agentId) {
     return `${projectId}:${agentId}`;
   }
+  cookieKey(cookie) {
+    return `${cookie.name}\0${cookie.domain}\0${cookie.path}\0${cookie.partitionKey ?? ""}`;
+  }
+  normalizedCookies(cookies) {
+    return [
+      ...new Map(cookies.map((cookie) => [this.cookieKey(cookie), { ...cookie }])).values()
+    ].sort((left, right) => this.cookieKey(left).localeCompare(this.cookieKey(right)));
+  }
+  cookiesEqual(left, right) {
+    return JSON.stringify(this.normalizedCookies(left)) === JSON.stringify(this.normalizedCookies(right));
+  }
+  /**
+   * Rebase only the changes this Machine made since its last canonical jar
+   * over the newer jar returned by another Machine. Unchanged cookies retain
+   * the remote value; local additions, changes, and deletions win per cookie.
+   */
+  mergeCookieChanges(base, local, remote) {
+    const baseByKey = new Map(base.map((cookie) => [this.cookieKey(cookie), cookie]));
+    const localByKey = new Map(local.map((cookie) => [this.cookieKey(cookie), cookie]));
+    const merged = new Map(remote.map((cookie) => [this.cookieKey(cookie), { ...cookie }]));
+    for (const [key, baseCookie] of baseByKey) {
+      const localCookie = localByKey.get(key);
+      if (!localCookie) {
+        merged.delete(key);
+      } else if (!this.cookiesEqual([baseCookie], [localCookie])) {
+        merged.set(key, { ...localCookie });
+      }
+    }
+    for (const [key, localCookie] of localByKey) {
+      if (!baseByKey.has(key)) merged.set(key, { ...localCookie });
+    }
+    return this.normalizedCookies([...merged.values()]);
+  }
   exactChild(root, child) {
     const canonicalRoot = resolve16(root);
     const target = resolve16(canonicalRoot, child);
@@ -44606,6 +44772,85 @@ var BrowserManager = class {
       throw error52;
     }
   }
+  synchronizeCookies(session) {
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const tail = this.cookieSyncTails.get(profileKey) ?? Promise.resolve();
+    const next = tail.then(async () => {
+      if (session.closed) return;
+      const synchronize = this.events?.syncCookies;
+      if (!synchronize) return;
+      let baseline = this.cookieStates.get(profileKey);
+      let observedLocal = this.normalizedCookies(await session.adapter.cookies());
+      let desired = observedLocal;
+      for (let attempt = 0; attempt < 8; attempt++) {
+        if (desired.length > BROWSER_MAX_SYNCED_COOKIES) {
+          throw new Error(
+            `the browser profile has more than ${BROWSER_MAX_SYNCED_COOKIES} cookies and cannot be synchronized safely`
+          );
+        }
+        const result = await synchronize({
+          projectId: session.projectId,
+          taskId: session.taskId,
+          agentId: session.agentId,
+          browserSessionId: session.browserSessionId,
+          ...baseline ? { baseRevision: baseline.revision } : {},
+          cookies: desired
+        });
+        if (result.accepted) {
+          const canonical = {
+            revision: result.state.revision,
+            cookies: this.normalizedCookies(result.state.cookies)
+          };
+          this.cookieStates.set(profileKey, canonical);
+          const current2 = this.normalizedCookies(await session.adapter.cookies());
+          if (!this.cookiesEqual(current2, observedLocal)) {
+            baseline = canonical;
+            desired = this.mergeCookieChanges(observedLocal, current2, canonical.cookies);
+            observedLocal = current2;
+            continue;
+          }
+          if (!this.cookiesEqual(current2, canonical.cookies)) {
+            await session.adapter.replaceCookies(canonical.cookies);
+          }
+          return;
+        }
+        const remote = {
+          revision: result.state.revision,
+          cookies: this.normalizedCookies(result.state.cookies)
+        };
+        if (!baseline) {
+          this.cookieStates.set(profileKey, remote);
+          await session.adapter.replaceCookies(remote.cookies);
+          return;
+        }
+        const current = this.normalizedCookies(await session.adapter.cookies());
+        const currentDesired = this.cookiesEqual(current, observedLocal) ? desired : this.mergeCookieChanges(observedLocal, current, desired);
+        desired = this.mergeCookieChanges(baseline.cookies, currentDesired, remote.cookies);
+        baseline = remote;
+        observedLocal = current;
+      }
+      throw new Error("browser cookies changed too many times while synchronizing");
+    });
+    const tracked = next.finally(() => {
+      if (this.cookieSyncTails.get(profileKey) === tracked) this.cookieSyncTails.delete(profileKey);
+    });
+    this.cookieSyncTails.set(profileKey, tracked);
+    return next;
+  }
+  scheduleCookieSync(session, delayMs = 250) {
+    if (session.closed || !this.events?.syncCookies) return;
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const existing = this.cookieSyncTimers.get(profileKey);
+    if (existing) clearTimeout(existing);
+    const timer = setTimeout(() => {
+      if (this.cookieSyncTimers.get(profileKey) !== timer) return;
+      this.cookieSyncTimers.delete(profileKey);
+      void this.synchronizeCookies(session).catch(() => {
+      });
+    }, delayMs);
+    timer.unref?.();
+    this.cookieSyncTimers.set(profileKey, timer);
+  }
   /**
    * Ensure a live session for this Task. An existing session is adopted
    * as-is (the cloud-minted id loses to the live one — the cloud reconciles
@@ -44683,8 +44928,20 @@ var BrowserManager = class {
         closeFailed: false
       };
       this.sessions.set(taskKey, session);
+      try {
+        await this.synchronizeCookies(session);
+      } catch (error52) {
+        session.closed = true;
+        this.sessions.delete(taskKey);
+        await adapter.close().catch(() => {
+        });
+        throw error52;
+      }
       adapter.onStateChanged(() => {
-        if (!session.closed) this.events?.state(this.stateOf(session));
+        if (!session.closed) {
+          this.events?.state(this.stateOf(session));
+          this.scheduleCookieSync(session);
+        }
       });
       this.armIdleTimer(session);
       this.events?.state(this.stateOf(session));
@@ -44714,6 +44971,14 @@ var BrowserManager = class {
       return;
     }
     if (!session || session.closed && !session.closeFailed) return;
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const pendingCookieTimer = this.cookieSyncTimers.get(profileKey);
+    if (pendingCookieTimer) {
+      clearTimeout(pendingCookieTimer);
+      this.cookieSyncTimers.delete(profileKey);
+    }
+    await this.synchronizeCookies(session).catch(() => {
+    });
     session.closed = true;
     session.closeFailed = false;
     if (session.frameTimer) clearTimeout(session.frameTimer);
@@ -44763,6 +45028,12 @@ var BrowserManager = class {
         force: true,
         maxRetries: 3
       });
+      const profileKey = this.profileKey(projectId, agentId);
+      const timer = this.cookieSyncTimers.get(profileKey);
+      if (timer) clearTimeout(timer);
+      this.cookieSyncTimers.delete(profileKey);
+      this.cookieSyncTails.delete(profileKey);
+      this.cookieStates.delete(profileKey);
       await this.syncDirectory(this.projectProfileRoot(projectId));
     });
   }
@@ -44797,6 +45068,17 @@ var BrowserManager = class {
     this.deniedAuthorizations.forEach((_revision, key) => {
       if (key.startsWith(`${projectId}:`)) this.deniedAuthorizations.delete(key);
     });
+    this.cookieSyncTimers.forEach((timer, key) => {
+      if (!key.startsWith(`${projectId}:`)) return;
+      clearTimeout(timer);
+      this.cookieSyncTimers.delete(key);
+    });
+    this.cookieSyncTails.forEach((_tail, key) => {
+      if (key.startsWith(`${projectId}:`)) this.cookieSyncTails.delete(key);
+    });
+    this.cookieStates.forEach((_state, key) => {
+      if (key.startsWith(`${projectId}:`)) this.cookieStates.delete(key);
+    });
     await this.syncDirectory(this.profileRoot);
     await this.syncDirectory(this.profileStateRoot);
   }
@@ -44865,6 +45147,11 @@ var BrowserManager = class {
     const next = session.inputQueue.then(work, work);
     session.inputQueue = next.catch(() => {
     });
+    void next.then(
+      () => this.scheduleCookieSync(session),
+      () => {
+      }
+    );
     return next;
   }
   /** Tool surface: every call ensures the session and counts as activity. */
@@ -45666,6 +45953,37 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
             }
           }
         },
+        async cookies() {
+          return (await context.cookies()).map((cookie) => ({
+            name: cookie.name,
+            value: cookie.value,
+            domain: cookie.domain,
+            path: cookie.path,
+            expires: cookie.expires,
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite,
+            ...cookie.partitionKey ? { partitionKey: cookie.partitionKey } : {}
+          }));
+        },
+        async replaceCookies(cookies) {
+          await context.clearCookies();
+          if (cookies.length > 0) {
+            await context.addCookies(
+              cookies.map((cookie) => ({
+                name: cookie.name,
+                value: cookie.value,
+                domain: cookie.domain,
+                path: cookie.path,
+                expires: cookie.expires,
+                httpOnly: cookie.httpOnly,
+                secure: cookie.secure,
+                sameSite: cookie.sameSite,
+                ...cookie.partitionKey !== void 0 ? { partitionKey: cookie.partitionKey } : {}
+              }))
+            );
+          }
+        },
         async close() {
           closed = true;
           for (const tab of [...tabs]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.156",
+  "version": "0.0.157",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",