abelworkflow 1.1.3 → 1.2.0

package/skills/context7-auto-research/context7-api.cjs

@@ -12,9 +12,10 @@ const path = require('path');
 const API_BASE = 'https://context7.com/api/v2';
 const STDIN_TIMEOUT_MS = 3000;
 const MAX_STDIN_BYTES = 100 * 1024;
+const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 
 function printJson(value) {
-  console.log(JSON.stringify(value, null, 2));
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
 function buildErrorResult(commandName, error) {
@@ -39,7 +40,7 @@ function buildErrorResult(commandName, error) {
 
 function printErrorResult(commandName, error, exitCode = 1) {
   printJson(buildErrorResult(commandName, error));
-  process.exit(exitCode);
+  process.exitCode = exitCode;
 }
 
 function printUsage() {
@@ -58,7 +59,7 @@ Config:
 // Load API key from .env file in skill directory or from environment variable
 function loadApiKey() {
   // First try environment variable
-  if (process.env.CONTEXT7_API_KEY) {
+  if (Object.hasOwn(process.env, 'CONTEXT7_API_KEY')) {
     return process.env.CONTEXT7_API_KEY;
   }
 
@@ -108,23 +109,77 @@ function makeRequest(path, params = {}) {
     };
 
     const req = https.get(url, options, (res) => {
-      let data = '';
+      const chunks = [];
+      let byteLength = 0;
+      let settled = false;
+
+      function cleanup() {
+        res.removeListener('data', onData);
+        res.removeListener('end', onEnd);
+        res.removeListener('aborted', onAborted);
+      }
+
+      function fail(error, destroy = false) {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        cleanup();
+        if (destroy) {
+          res.destroy();
+        }
+        reject(error);
+      }
 
-      res.on('data', (chunk) => {
-        data += chunk;
-      });
+      function onData(chunk) {
+        const buffer = Buffer.from(chunk);
+        byteLength += buffer.length;
+        if (byteLength > MAX_RESPONSE_BYTES) {
+          fail(new Error(`API response exceeded ${MAX_RESPONSE_BYTES} bytes.`), true);
+          return;
+        }
+        chunks.push(buffer);
+      }
+
+      function onEnd() {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        cleanup();
+        const data = Buffer.concat(chunks).toString('utf8');
 
-      res.on('end', () => {
         if (res.statusCode === 200) {
+          let parsed;
           try {
-            resolve(JSON.parse(data));
-          } catch (e) {
-            resolve(data);
+            parsed = JSON.parse(data);
+          } catch (error) {
+            reject(new Error(`API returned invalid JSON: ${error.message}`));
+            return;
           }
-        } else {
-          reject(new Error(`API Error ${res.statusCode}: ${data}`));
+          if (parsed === null || typeof parsed !== 'object') {
+            reject(new Error('API returned an invalid response shape: expected a JSON object or array.'));
+            return;
+          }
+          resolve(parsed);
+          return;
         }
-      });
+
+        reject(new Error(`API Error ${res.statusCode}: ${data}`));
+      }
+
+      function onError(error) {
+        fail(error);
+      }
+
+      function onAborted() {
+        fail(new Error('API response aborted before completion.'));
+      }
+
+      res.on('data', onData);
+      res.on('end', onEnd);
+      res.on('error', onError);
+      res.on('aborted', onAborted);
     });
 
     req.setTimeout(10000, () => {
@@ -171,6 +226,7 @@ function readStdin() {
 
     function fail(error) {
       cleanup();
+      process.stdin.pause();
       reject(error);
     }
 
@@ -237,7 +293,8 @@ const args = process.argv.slice(3);
 async function main() {
   if (!command || command === '--help' || command === '-h' || command === 'help') {
     printUsage();
-    process.exit(command ? 0 : 1);
+    process.exitCode = command ? 0 : 1;
+    return;
   }
 
   if (command === 'search') {
@@ -268,13 +325,14 @@ async function main() {
     }
   } else {
     printUsage();
-    process.exit(1);
+    process.exitCode = 1;
   }
 }
 
 main().catch((error) => {
   if (command === 'search' || command === 'context') {
     printErrorResult(command, error);
+    return;
   }
-  process.exit(1);
+  process.exitCode = 1;
 });

package/skills/dev-browser/SKILL.md

@@ -17,6 +17,15 @@ Browser automation that maintains page state across script executions while the
 
 Two supported startup modes are available on **Linux** and **native Windows**. Run the following commands from the installed `dev-browser` skill directory. Bash, Git Bash, and WSL are not required.
 
+Startup never installs packages or browsers and treats the skill directory as read-only. If a preflight reports missing dependencies, run its explicit setup command yourself. Typical setup commands from the installed skill directory are:
+
+```text
+npm ci --omit=dev
+node "node_modules/playwright/cli.js" install chromium
+```
+
+The Playwright command is required only for standalone mode. Startup does not download Chromium automatically.
+
 ### Standalone Mode (Default)
 
 Launches a new Chromium browser for fresh automation sessions.
@@ -70,10 +79,15 @@ If the extension hasn't connected yet, tell the user to launch and activate it.
 
 - `standalone mode` owns a temporary Chromium profile only for the server process lifetime and cleans it on exit.
 - `extension mode` depends on the external browser extension and the user's existing Chrome session.
+- Extension mode rejects viewport requests with HTTP 400; viewport sizing is supported only in standalone mode.
 - In `extension mode`, relay readiness means the server is waiting for the extension; it does not imply browser control is available until `Extension connected` appears.
 - `standalone mode` is the default path for deterministic local automation; `extension mode` is for working inside an already-authenticated browser.
 
-## Relay Origin Boundary
+## Server Boundary
+
+- Both server modes and their direct APIs accept only loopback hosts: `localhost`, IPv4 loopback addresses in `127.0.0.0/8`, and `::1` (bracketed IPv6 is accepted in CLI input).
+- Wildcard, LAN, and other hosts are rejected. This loopback-only binding is the primary access boundary.
+- Origin checks are defense-in-depth, not authentication.
 
 - State-changing `/pages` requests accept only originless JSON clients; browser-origin and non-JSON mutations are rejected before backend calls.
 - `/cdp` accepts only originless WebSocket clients, which is the normal behavior of the Node client. Browser pages always send an `Origin` and are rejected.

package/skills/dev-browser/dist/scripts/start.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=start.d.ts.map

package/skills/dev-browser/dist/scripts/start.js

@@ -1,18 +1,15 @@
 import { existsSync, readFileSync } from "node:fs";
-import { spawn } from "node:child_process";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { formatHttpUrl, parseEntrypointArgs, resolveHostForProbe } from "../src/entrypoint.js";
-import { getInvalidRuntimeDependencies, getLockedRuntimeDependencies, getPlaywrightInstallCommand, getRuntimeDependencyInstallCommand, isPlaywrightChromiumInstalled, isTcpPortInUse, resolveSkillDirFromEntrypoint, resolveRuntimePaths, shouldUseShellForPackageCommands, } from "../src/runtime.js";
-import { ensurePlaywrightChromium, preflightStandaloneStartup, runEntrypoint, } from "../src/startup.js";
-const runtimePaths = resolveRuntimePaths(resolveSkillDirFromEntrypoint(import.meta.url));
-const useShell = shouldUseShellForPackageCommands(process.platform);
+import { assertRuntimeDependenciesAvailable, getInvalidRuntimeDependencies, getLockedRuntimeDependencies, isPlaywrightChromiumInstalled, isTcpPortInUse, resolveSkillDirFromEntrypoint, } from "../src/runtime.js";
+import { assertPlaywrightChromiumAvailable, preflightStandaloneStartup, runEntrypoint, } from "../src/startup.js";
+const skillDir = resolveSkillDirFromEntrypoint(import.meta.url);
 const require = createRequire(import.meta.url);
 async function main() {
     const args = parseEntrypointArgs(process.argv.slice(2));
     await ensureSkillDependencies();
     await runEntrypoint(args, {
-        runtimePaths,
         serveStandalone: async (options) => {
             const { serve } = await import("../src/index.js");
             return serve(options);
@@ -26,15 +23,12 @@ async function main() {
         log: (line) => console.log(line),
         ensureBrowser: async () => {
             const { registry } = require("playwright-core/lib/server/registry/index");
-            await ensurePlaywrightChromium({
+            await assertPlaywrightChromiumAvailable({
                 isInstalled: () => isPlaywrightChromiumInstalled({
                     headless: args.headless,
                     findExecutable: (name) => registry.findExecutable(name),
                     exists: existsSync,
                 }),
-                installCommand: getPlaywrightInstallCommand({ skillDir: runtimePaths.skillDir }),
-                runCommand,
-                log: (line) => console.log(line),
             });
         },
         preflightStandalone: () => preflightStandaloneStartup(args, {
@@ -59,9 +53,9 @@ async function main() {
     });
 }
 async function ensureSkillDependencies() {
-    const packageLock = JSON.parse(readFileSync(join(runtimePaths.skillDir, "package-lock.json"), "utf8"));
+    const packageLock = JSON.parse(readFileSync(join(skillDir, "package-lock.json"), "utf8"));
     const invalidDependencies = getInvalidRuntimeDependencies({
-        skillDir: runtimePaths.skillDir,
+        skillDir,
         lockedDependencies: getLockedRuntimeDependencies(packageLock),
         readPackageVersion: (path) => {
             try {
@@ -73,29 +67,8 @@ async function ensureSkillDependencies() {
             }
         },
     });
-    if (invalidDependencies.length === 0)
-        return;
-    console.log("dev-browser dependencies missing or out of date. Installing local packages...");
-    const installCommand = getRuntimeDependencyInstallCommand();
-    await runCommand(installCommand.command, installCommand.args);
-    console.log("dev-browser dependencies installed.");
-}
-async function runCommand(command, args) {
-    await new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            cwd: runtimePaths.skillDir,
-            stdio: "inherit",
-            shell: useShell && command === "npm",
-            windowsHide: useShell && command === "npm",
-        });
-        child.on("error", reject);
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolve();
-                return;
-            }
-            reject(new Error(`${command} ${args.join(" ")} exited with code ${code}`));
-        });
+    assertRuntimeDependenciesAvailable({
+        invalidDependencies,
     });
 }
 function registerShutdown(stop) {
@@ -115,4 +88,3 @@ main().catch((error) => {
     console.error("Failed to start dev-browser:", error);
     process.exit(1);
 });
-//# sourceMappingURL=start.js.map

package/skills/dev-browser/dist/src/client.d.ts

@@ -1,4 +1,4 @@
-import { type Page, type ElementHandle } from "playwright";
+import { type ElementHandle, type Page } from "playwright";
 import type { ViewportSize } from "./types.js";
 /**
  * Options for waiting for page load
@@ -29,11 +29,11 @@ export interface WaitForPageLoadResult {
     timedOut: boolean;
 }
 /**
- * Wait for a page to finish loading using document.readyState and performance API.
+ * Wait for a page to finish loading using document.readyState and Playwright request events.
  *
  * Uses browser-use's approach of:
  * - Checking document.readyState for 'complete'
- * - Monitoring pending network requests via Performance API
+ * - Monitoring pending network requests via Playwright
  * - Filtering out ads, tracking, and non-critical resources
  * - Graceful timeout handling (continues even if timeout reached)
  */
@@ -90,4 +90,3 @@ interface TargetLookupBrowser<TPage> {
 export declare function findPageByTargetId<TPage>(browser: TargetLookupBrowser<TPage>, targetId: string): Promise<TPage | null>;
 export declare function connect(serverUrl?: string): Promise<DevBrowserClient>;
 export {};
-//# sourceMappingURL=client.d.ts.map

package/skills/dev-browser/dist/src/client.js

@@ -1,11 +1,38 @@
-import { chromium } from "playwright";
+import { chromium, } from "playwright";
 import { getSnapshotScript } from "./snapshot/browser-script.js";
+const IGNORED_REQUEST_PATTERNS = [
+    "doubleclick.net",
+    "googlesyndication.com",
+    "googletagmanager.com",
+    "google-analytics.com",
+    "facebook.net",
+    "connect.facebook.net",
+    "analytics",
+    "/ads/",
+    "tracking",
+    "pixel",
+    "hotjar.com",
+    "clarity.ms",
+    "mixpanel.com",
+    "segment.com",
+    "newrelic.com",
+    "nr-data.net",
+    "/tracker/",
+    "/collector/",
+    "/beacon/",
+    "/telemetry/",
+    "/log/",
+    "/events/",
+    "/track.",
+    "/metrics/",
+];
+const NON_CRITICAL_RESOURCE_TYPES = ["img", "image", "icon", "font"];
 /**
- * Wait for a page to finish loading using document.readyState and performance API.
+ * Wait for a page to finish loading using document.readyState and Playwright request events.
  *
  * Uses browser-use's approach of:
  * - Checking document.readyState for 'complete'
- * - Monitoring pending network requests via Performance API
+ * - Monitoring pending network requests via Playwright
  * - Filtering out ads, tracking, and non-critical resources
  * - Graceful timeout handling (continues even if timeout reached)
  */
@@ -13,123 +40,96 @@ export async function waitForPageLoad(page, options = {}) {
     const { timeout = 10000, pollInterval = 50, minimumWait = 100, waitForNetworkIdle = true, } = options;
     const startTime = Date.now();
     let lastState = null;
-    // Wait minimum time first
-    if (minimumWait > 0) {
-        await new Promise((resolve) => setTimeout(resolve, minimumWait));
-    }
-    // Poll until ready or timeout
-    while (Date.now() - startTime < timeout) {
-        try {
-            lastState = await getPageLoadState(page);
-            // Check if document is complete
-            const documentReady = lastState.documentReadyState === "complete";
-            // Check if network is idle (no pending critical requests)
-            const networkIdle = !waitForNetworkIdle || lastState.pendingRequests.length === 0;
-            if (documentReady && networkIdle) {
-                return {
-                    success: true,
-                    readyState: lastState.documentReadyState,
-                    pendingRequests: lastState.pendingRequests.length,
-                    waitTimeMs: Date.now() - startTime,
-                    timedOut: false,
-                };
+    const requests = new Map();
+    const trackRequest = (request, startedAt = Date.now()) => {
+        requests.set(request, {
+            url: request.url(),
+            resourceType: request.resourceType(),
+            startedAt,
+        });
+    };
+    const onRequest = (request) => trackRequest(request);
+    const onRequestDone = (request) => requests.delete(request);
+    page.on("request", onRequest);
+    page.on("requestfinished", onRequestDone);
+    page.on("requestfailed", onRequestDone);
+    try {
+        for (const request of await page.requests().catch(() => [])) {
+            const timing = request.timing();
+            if (request.failure() === null && timing.responseEnd === -1) {
+                trackRequest(request, timing.startTime);
             }
         }
-        catch {
-            // Page may be navigating, continue polling
+        // Wait minimum time first
+        if (minimumWait > 0) {
+            await new Promise((resolve) => setTimeout(resolve, minimumWait));
+        }
+        // Poll until ready or timeout
+        while (Date.now() - startTime < timeout) {
+            try {
+                lastState = await getPageLoadState(page, requests);
+                // Check if document is complete
+                const documentReady = lastState.documentReadyState === "complete";
+                // Check if network is idle (no pending critical requests)
+                const networkIdle = !waitForNetworkIdle || lastState.pendingRequests.length === 0;
+                if (documentReady && networkIdle) {
+                    return {
+                        success: true,
+                        readyState: lastState.documentReadyState,
+                        pendingRequests: lastState.pendingRequests.length,
+                        waitTimeMs: Date.now() - startTime,
+                        timedOut: false,
+                    };
+                }
+            }
+            catch {
+                // Page may be navigating, continue polling
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollInterval));
         }
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        // Timeout reached - return current state
+        return {
+            success: false,
+            readyState: lastState?.documentReadyState ?? "unknown",
+            pendingRequests: getPendingRequests(requests).length,
+            waitTimeMs: Date.now() - startTime,
+            timedOut: true,
+        };
+    }
+    finally {
+        page.off("request", onRequest);
+        page.off("requestfinished", onRequestDone);
+        page.off("requestfailed", onRequestDone);
     }
-    // Timeout reached - return current state
-    return {
-        success: false,
-        readyState: lastState?.documentReadyState ?? "unknown",
-        pendingRequests: lastState?.pendingRequests.length ?? 0,
-        waitTimeMs: Date.now() - startTime,
-        timedOut: true,
-    };
 }
-/**
- * Get the current page load state including document ready state and pending requests.
- * Filters out ads, tracking, and non-critical resources that shouldn't block loading.
- */
-async function getPageLoadState(page) {
-    const result = await page.evaluate(() => {
+async function getPageLoadState(page, requests) {
+    const documentReadyState = await page.evaluate(() => {
         // Access browser globals via globalThis for TypeScript compatibility
         /* eslint-disable @typescript-eslint/no-explicit-any */
         const g = globalThis;
         /* eslint-enable @typescript-eslint/no-explicit-any */
-        const perf = g.performance;
-        const doc = g.document;
-        const now = perf.now();
-        const resources = perf.getEntriesByType("resource");
-        const pending = [];
-        // Common ad/tracking domains and patterns to filter out
-        const adPatterns = [
-            "doubleclick.net",
-            "googlesyndication.com",
-            "googletagmanager.com",
-            "google-analytics.com",
-            "facebook.net",
-            "connect.facebook.net",
-            "analytics",
-            "ads",
-            "tracking",
-            "pixel",
-            "hotjar.com",
-            "clarity.ms",
-            "mixpanel.com",
-            "segment.com",
-            "newrelic.com",
-            "nr-data.net",
-            "/tracker/",
-            "/collector/",
-            "/beacon/",
-            "/telemetry/",
-            "/log/",
-            "/events/",
-            "/track.",
-            "/metrics/",
-        ];
-        // Non-critical resource types
-        const nonCriticalTypes = ["img", "image", "icon", "font"];
-        for (const entry of resources) {
-            // Resources with responseEnd === 0 are still loading
-            if (entry.responseEnd === 0) {
-                const url = entry.name;
-                // Filter out ads and tracking
-                const isAd = adPatterns.some((pattern) => url.includes(pattern));
-                if (isAd)
-                    continue;
-                // Filter out data: URLs and very long URLs
-                if (url.startsWith("data:") || url.length > 500)
-                    continue;
-                const loadingDuration = now - entry.startTime;
-                // Skip requests loading > 10 seconds (likely stuck/polling)
-                if (loadingDuration > 10000)
-                    continue;
-                const resourceType = entry.initiatorType || "unknown";
-                // Filter out non-critical resources loading > 3 seconds
-                if (nonCriticalTypes.includes(resourceType) && loadingDuration > 3000)
-                    continue;
-                // Filter out image URLs even if type is unknown
-                const isImageUrl = /\.(jpg|jpeg|png|gif|webp|svg|ico)(\?|$)/i.test(url);
-                if (isImageUrl && loadingDuration > 3000)
-                    continue;
-                pending.push({
-                    url,
-                    loadingDurationMs: Math.round(loadingDuration),
-                    resourceType,
-                });
-            }
-        }
-        return {
-            documentReadyState: doc.readyState,
-            documentLoading: doc.readyState !== "complete",
-            pendingRequests: pending,
-        };
+        return g.document.readyState;
+    });
+    return { documentReadyState, pendingRequests: getPendingRequests(requests) };
+}
+function getPendingRequests(requests) {
+    const now = Date.now();
+    return [...requests.values()].flatMap(({ url, resourceType, startedAt }) => {
+        const loadingDurationMs = now - startedAt;
+        if (shouldIgnoreRequest(url, resourceType, loadingDurationMs))
+            return [];
+        return [{ url, resourceType, loadingDurationMs }];
     });
-    return result;
+}
+function shouldIgnoreRequest(url, resourceType, loadingDurationMs) {
+    if (IGNORED_REQUEST_PATTERNS.some((pattern) => url.includes(pattern)))
+        return true;
+    if (url.startsWith("data:") || url.length > 500)
+        return true;
+    if (NON_CRITICAL_RESOURCE_TYPES.includes(resourceType) && loadingDurationMs > 3000) {
+        return true;
+    }
+    return /\.(jpg|jpeg|png|gif|webp|svg|ico)(\?|$)/i.test(url) && loadingDurationMs > 3000;
 }
 export async function findPageByTargetId(browser, targetId) {
     for (const context of browser.contexts()) {
@@ -155,6 +155,7 @@ export async function findPageByTargetId(browser, targetId) {
     return null;
 }
 export async function connect(serverUrl = "http://localhost:9222") {
+    const normalizedServerUrl = serverUrl.replace(/\/+$/, "");
     let browser = null;
     let connectingPromise = null;
     async function ensureConnected() {
@@ -169,7 +170,7 @@ export async function connect(serverUrl = "http://localhost:9222") {
         // Start new connection with mutex
         connectingPromise = (async () => {
             try {
-                const { wsEndpoint } = await fetchServerInfo(serverUrl);
+                const { wsEndpoint } = await fetchServerInfo(normalizedServerUrl);
                 // Connect to the browser via CDP
                 browser = await chromium.connectOverCDP(wsEndpoint);
                 return browser;
@@ -183,7 +184,7 @@ export async function connect(serverUrl = "http://localhost:9222") {
     // Helper to get a page by name (used by multiple methods)
     async function getPage(name, options) {
         // Request the page from server (creates if doesn't exist)
-        const res = await fetch(`${serverUrl}/pages`, {
+        const res = await fetch(`${normalizedServerUrl}/pages`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ name, viewport: options?.viewport }),
@@ -204,12 +205,12 @@ export async function connect(serverUrl = "http://localhost:9222") {
     return {
         page: getPage,
         async list() {
-            const res = await fetch(`${serverUrl}/pages`);
+            const res = await fetch(`${normalizedServerUrl}/pages`);
             const data = (await res.json());
             return data.pages;
         },
         async close(name) {
-            const res = await fetch(`${serverUrl}/pages/${encodeURIComponent(name)}`, {
+            const res = await fetch(`${normalizedServerUrl}/pages/${encodeURIComponent(name)}`, {
                 method: "DELETE",
             });
             if (!res.ok) {
@@ -268,7 +269,7 @@ export async function connect(serverUrl = "http://localhost:9222") {
             return element;
         },
         async getServerInfo() {
-            return fetchServerInfo(serverUrl);
+            return fetchServerInfo(normalizedServerUrl);
         },
     };
 }
@@ -283,7 +284,7 @@ function parseServerInfo(value) {
     const info = typeof value === "object" && value !== null
         ? value
         : {};
-    const mode = Object.hasOwn(info, "mode") ? info.mode : "standalone";
+    const mode = info.mode;
     if (mode !== "standalone" && mode !== "extension") {
         throw new Error(`Invalid dev-browser server mode: expected "standalone" or "extension", received ${JSON.stringify(mode)}`);
     }
@@ -307,4 +308,3 @@ async function waitForExactPage(browser, targetId) {
         await new Promise((resolve) => setTimeout(resolve, 25));
     } while (true);
 }
-//# sourceMappingURL=client.js.map

package/skills/dev-browser/dist/src/entrypoint.d.ts

@@ -24,6 +24,6 @@ export declare function formatHostForUrl(host: string): string;
 export declare function formatHttpUrl(host: string, port: number): string;
 export declare function formatWsUrl(host: string, port: number, path?: string): string;
 export declare function resolveHostForProbe(host: string): string;
+export declare function normalizeLoopbackHost(host: string): string;
 export declare function parseEntrypointArgs(argv: string[], env?: Record<string, string | undefined>): EntrypointArgs;
 export declare function formatReadinessLines(info: ReadinessInfo): string[];
-//# sourceMappingURL=entrypoint.d.ts.map