agent-dag 3.22.0 → 3.22.3

package/src/server/browser-presence.mjs

@@ -1,211 +0,0 @@
-// Which browsers are on this machine, which are running, and what can honestly
-// be said about whether any of them is talking to the relay.
-//
-// THE ANSWER IS MOSTLY "I CANNOT TELL", AND SAYING SO IS THE FEATURE. Two facts
-// measured on the machine this was written on decide the whole shape of this
-// file:
-//
-//   dig +short bridge.claudeusercontent.com  ->  160.79.104.10
-//   dig +short api.anthropic.com             ->  160.79.104.10
-//
-// The relay shares an address with the API and with claude.ai. An established
-// connection to it is therefore NOT evidence of a relay session — an open
-// claude.ai tab is indistinguishable — and blocking by address would sever
-// Claude Code itself, which is why the killswitch blocks the NAME.
-//
-//   lsof -nP -i TCP -a -c "Brave Browser"  ->  14 lines
-//   lsof -nP -i TCP -a -c "Google Chrome"  ->  0 lines
-//
-// And lsof cannot see some browsers' sockets at all. Zero lines for a browser
-// that is plainly running is a blind probe, not a quiet one, so absence is not
-// evidence either.
-//
-// Both directions therefore fail, and the honest report has three states rather
-// than two: `live` (with the caveat attached), `none-seen` (the probe worked and
-// found nothing) and `unknown` (the probe could not see, or does not exist on
-// this platform). There is deliberately no state that means "definitely not
-// connected", because nothing here can establish that.
-import { existsSync } from "node:fs";
-import { basename } from "node:path";
-import { browserRoots, hasExtension, profileDirs } from "./browser-profiles.mjs";
-import { run } from "./exec.mjs";
-
-/**
- * The name each browser's processes carry — PER PLATFORM, because they do not
- * agree.
- *
- * This used to be one table of macOS bundle display names, sent to all three
- * probes. `tasklist /FI "IMAGENAME eq Google Chrome.exe"` matches nothing and
- * exits **0** printing `INFO: No tasks are running…`, so the probe read
- * `ok: true` and returned a confident `false`; `pgrep -x "Google Chrome"`
- * matches against `comm`, which on Linux is `chrome`. Every browser on Windows
- * and Linux therefore reported "not running", `relayLink` was never called, and
- * the relay half of this panel was dead on two of the three platforms — while
- * the module's own header forbids exactly that: a state that means "definitely
- * not connected" when nothing established it.
- *
- * Arc is macOS-only and has no entry elsewhere, which is the honest answer: a
- * root with no name here is reported as installed and never as running.
- */
-const APP_NAME = {
-  darwin: {
-    chrome: "Google Chrome",
-    "chrome-beta": "Google Chrome Beta",
-    "chrome-canary": "Google Chrome Canary",
-    chromium: "Chromium",
-    brave: "Brave Browser",
-    edge: "Microsoft Edge",
-    vivaldi: "Vivaldi",
-    arc: "Arc",
-  },
-  // Image names, which is what tasklist's IMAGENAME filter compares against.
-  // The probe appends `.exe`, so these are spelled without it, exactly as the
-  // POSIX ones are.
-  win32: {
-    chrome: "chrome",
-    "chrome-beta": "chrome",
-    "chrome-canary": "chrome",
-    chromium: "chrome",
-    brave: "brave",
-    edge: "msedge",
-    vivaldi: "vivaldi",
-  },
-  // `comm`, which is what `pgrep -x` matches and what the packages install as.
-  linux: {
-    chrome: "chrome",
-    "chrome-beta": "chrome",
-    "chrome-canary": "chrome",
-    chromium: "chromium",
-    // The two roots `browserRoots` emits and this table used to miss (#794).
-    // The snap path's own comment there says it "is the only Chromium root a
-    // default Ubuntu install has" — so on stock Ubuntu the panel reported
-    // Chromium as not running while it was running, and the quit reaction,
-    // which `available("linux")` does offer, answered `unknown_browser` on
-    // every finding from either of them. darwin covers all 8 of its roots and
-    // win32 all 7 of its own; only this table was short.
-    "chromium-snap": "chromium",
-    "brave-flatpak": "brave",
-    brave: "brave",
-    edge: "msedge",
-    vivaldi: "vivaldi-bin",
-  },
-};
-
-/** The process name for a browser on a platform, or null when this platform
- *  has no name for it — which is a different answer from "not running". */
-export function processName(key, platform = process.platform) {
-  const table = APP_NAME[platform] ?? APP_NAME.linux;
-  return table[key] ?? null;
-}
-
-/** Every address the relay currently resolves to.
- *
- *  Empty is not an error — a machine with no `dig`, or one where the name is
- *  already blocked in /etc/hosts, both land here — and an empty list makes
- *  every connection probe answer `unknown`, which is the correct answer when
- *  there is nothing to compare against. */
-export async function relayAddresses(host, deps = {}) {
-  const exec = deps.run ?? run;
-  const out = await exec("dig", ["+short", host]).catch(() => null);
-  if (!out?.ok) return [];
-  return String(out.stdout ?? "").split("\n")
-    .map(l => l.trim())
-    .filter(l => /^[0-9.]+$/.test(l) || /^[0-9a-f:]+$/i.test(l) && l.includes(":"));
-}
-
-/** Whether a named application has any process at all. */
-export async function isRunning(app, platform = process.platform, deps = {}) {
-  const exec = deps.run ?? run;
-  if (platform === "win32") {
-    const out = await exec("tasklist", ["/FI", `IMAGENAME eq ${app}.exe`, "/NH"]).catch(() => null);
-    if (!out?.ok) return null;
-    return String(out.stdout ?? "").toLowerCase().includes(`${app.toLowerCase()}.exe`);
-  }
-  const out = await exec("pgrep", ["-x", app]).catch(() => null);
-  // pgrep exits 1 when it matched nothing, which `run` reports as not-ok — the
-  // same shape as "pgrep is missing". Distinguished by whether it said anything
-  // on stderr, because only one of the two is a failure to ask.
-  if (out === null) return null;
-  if (out.ok) return true;
-  return String(out.stderr ?? "").trim() === "" ? false : null;
-}
-
-/**
- * What can be said about this browser's connections to the relay.
- *
- * -> { state: "live" | "none-seen" | "unknown", count, why }
- *
- * `why` is not decoration. Every one of these three answers is qualified, and a
- * panel that showed the state without the qualification would be making a claim
- * this module has already established it cannot make.
- */
-export async function relayLink(app, addresses, platform = process.platform, deps = {}) {
-  const exec = deps.run ?? run;
-  if (platform === "win32") {
-    return { state: "unknown", count: 0, why: "this check needs lsof, which Windows does not have" };
-  }
-  if (addresses.length === 0) {
-    return { state: "unknown", count: 0, why: "the relay name did not resolve, so there is nothing to match against" };
-  }
-  const out = await exec("lsof", ["-nP", "-i", "TCP", "-a", "-c", app]).catch(() => null);
-  if (out === null) return { state: "unknown", count: 0, why: "lsof is not available here" };
-
-  const lines = String(out.stdout ?? "").split("\n").filter(l => l.trim() !== "");
-  // A browser with no visible sockets at all is a BLIND probe, not a quiet one.
-  // Measured: lsof sees fourteen TCP lines for Brave and zero for Google Chrome
-  // while both are running. Reporting "none seen" here would turn "I cannot
-  // look" into "I looked and it was clear".
-  if (lines.length <= 1) {
-    return { state: "unknown", count: 0, why: "lsof cannot see this browser's sockets, so absence proves nothing" };
-  }
-  const hit = lines.filter(l => l.includes("ESTABLISHED") && addresses.some(a => l.includes(a)));
-  if (hit.length === 0) {
-    return { state: "none-seen", count: 0, why: "no TCP connection to that address; QUIC would not appear here" };
-  }
-  return {
-    state: "live",
-    count: hit.length,
-    why: "the relay shares an address with api.anthropic.com and claude.ai, so an open claude.ai tab looks the same",
-  };
-}
-
-/**
- * Every browser this deck knows how to look at, whether or not it is here.
- *
- * Installed browsers with no profile are included on purpose. "Chrome is
- * installed and has never been opened" and "Chrome is not installed" are
- * different answers, and a panel that lists only what it found makes them
- * indistinguishable — which is the same failure browser-profiles.mjs guards
- * against one level down.
- */
-export async function browserSurvey({
-  relayHost,
-  platform = process.platform,
-  env = process.env,
-  home,
-  deps = {},
-} = {}) {
-  const exists = deps.existsSync ?? existsSync;
-  const roots = browserRoots(platform, env, home);
-  const addresses = await relayAddresses(relayHost, deps);
-
-  const out = [];
-  for (const root of roots) {
-    const installed = exists(root.root);
-    const profiles = installed ? profileDirs(root.root, deps.fs) : [];
-    const app = processName(root.key, platform);
-    const running = installed && app ? await isRunning(app, platform, deps) : false;
-    out.push({
-      key: root.key,
-      name: root.name,
-      installed,
-      profiles: profiles.length,
-      withExtension: profiles.filter(d => hasExtension(d, undefined, deps.fs)).map(d => basename(d)),
-      running,
-      relay: installed && running && app
-        ? await relayLink(app, addresses, platform, deps)
-        : { state: "unknown", count: 0, why: running ? "no process name known for this browser" : "not running" },
-    });
-  }
-  return out;
-}

package/src/server/browser-profiles.mjs

@@ -1,279 +0,0 @@
-// Which Chromium-family browsers are on this machine, which of their profiles
-// exist, and which of those carry the Claude in Chrome extension.
-//
-// This is the floor of Browser Watch: every other part of the feature opens a
-// profile's History or its Secure Preferences, and neither is findable until
-// something has answered "where are the profiles". The whole module is a claim
-// about somebody else's directory layout, which is why nothing here reaches the
-// disk except through an injected `deps` — the Windows layout and the two Linux
-// sandbox layouts have to be exercisable from a Mac, exactly as
-// claudeCliCandidates() and cswapCandidates() are, or the list rots on every
-// platform its author does not sit at.
-//
-// THE ASYMMETRY THAT SILENTLY BREAKS IT. Chromium's user-data directory is the
-// parent of `Default` and `Profile N`, and macOS spells it differently from
-// everywhere else:
-//
-//   macOS    ~/Library/Application Support/Google/Chrome/Default
-//   Windows  %LOCALAPPDATA%\Google\Chrome\User Data\Default
-//   Linux    ~/.config/google-chrome/Default
-//
-// There is NO `User Data` level on macOS — the app-support directory is itself
-// the user-data directory — and the mistake is invisible in both directions.
-// Insert the level on macOS and every root misses by one; drop it on Windows
-// and every root misses by one. Both produce an empty list, and an empty list
-// is also the honest answer for a machine that has no Chrome. So a bug here
-// never looks like a bug. It looks like a user who does not use Chrome, on a
-// panel whose entire job is to say which browsers are watched.
-//
-// Arc is the exception that proves the rule: it keeps `User Data` under its own
-// app-support directory on macOS, because Arc is Chromium shipped by people who
-// did not inherit Chrome's macOS habit. It is the reason the macOS list is a
-// table of paths rather than a directory name plus a formula.
-import { existsSync as fsExistsSync, readdirSync as fsReaddirSync, statSync as fsStatSync } from "node:fs";
-import { homedir } from "node:os";
-import { posix as posixPath, win32 as winPath } from "node:path";
-// ONE DECLARATION OF THE EXTENSION ID (#798). It was written out here and again
-// in relay-guard.mjs, with the same literal, in two modules that never imported
-// each other — so republishing the extension under a new id and updating one
-// would leave the other detector answering "not installed" forever, with
-// nothing going red anywhere. It comes from relay-guard because that direction
-// is the safe one: relay-guard imports node:path and nothing else, a property
-// its own header states and relay-guard.test.ts pins by reading the source, and
-// importing this module (node:fs) into it would break that.
-import { CLAUDE_EXT_ID } from "./relay-guard.mjs";
-
-/**
- * Claude in Chrome's extension id, which is the same 32 characters in every
- * Chromium-family browser that can install it.
- *
- * A Chrome extension id is derived from the packing key, not from the store or
- * the browser, so Brave, Edge and Vivaldi all hold it under this exact name.
- * That is what makes a directory test sufficient here and what lets one
- * constant serve every row this module returns.
- *
- * Re-exported rather than moved, so the callers that read it from here keep
- * working and the name still documents itself where it is used.
- */
-export { CLAUDE_EXT_ID };
-
-/**
- * The directories inside a user-data root that are browsing profiles.
- *
- * `Default` and `Profile N` only. Chromium also keeps `Guest Profile` and
- * `System Profile` beside them on every install — the second exists before the
- * user has ever opened a window — and both carry a History file that never gets
- * a row. Reporting them would put two permanently empty entries on the panel of
- * every machine in the world and make "no browsing here yet" indistinguishable
- * from "this is not a profile at all".
- */
-const PROFILE_DIR = /^(?:Default|Profile \d+)$/;
-
-/**
- * The path rules a root is written in, read off the root itself.
- *
- * `profileDirs` and `hasExtension` take a path and no platform — they are handed
- * a root `browserRoots` already spelled — so the flavour has to come out of the
- * string. It matters more than it looks. POSIX `join` would answer
- * `C:\…\User Data/Default`, a mixed-separator path that Windows itself would
- * happily open, so nothing on a real machine would ever complain; but
- * `posixPath.basename` of that string is the WHOLE string, so `profile` would
- * come back as an absolute path instead of `Default` and every caller keying on
- * the profile name would miss. The failure only ever appears on the leg that
- * checks Windows from a Mac, which is every leg that exists for this module.
- *
- * Anchored at the front rather than sniffing for a backslash anywhere: a POSIX
- * directory may legally be named `Brave\Browser`, and every root built here is
- * absolute, so a drive letter or a UNC prefix is the entire test.
- */
-const WINDOWS_ROOT = /^(?:[A-Za-z]:[\\/]|\\\\)/;
-const flavourOf = p => (WINDOWS_ROOT.test(String(p)) ? winPath : posixPath);
-
-/**
- * Whether `p` is a directory, answering false for everything else a real disk
- * can put there.
- *
- * Never throws, and that is the point rather than tidiness. This runs once per
- * candidate profile across every browser on the machine: one profile on a
- * disconnected network home, one `Default` that a sync tool left as a file, one
- * broken symlink into an unmounted volume would otherwise abort the whole walk
- * and take every other browser's profiles down with it.
- */
-function isDirectory(p, statSync) {
-  try { return statSync(p).isDirectory(); } catch { return false; }
-}
-
-/**
- * Every known Chromium-family user-data root for this platform, whether or not
- * it exists.
- *
- * Pure, and platform, environment and home are parameters, so the Windows and
- * Linux answers are checkable from a Mac — the same reason claudeCliCandidates()
- * takes them. Deliberately does NOT stat anything: "which browsers could be
- * here" and "which are" are separate questions, and keeping the first one pure
- * is what lets a test assert the whole table without a disk of any kind.
- *
- * `key` is the stable identifier the rest of Browser Watch keys rows on; `name`
- * is the string a human reads. They are separate because Brave's directory is
- * `Brave-Browser` on one platform and `com.brave.Browser` on another, and no
- * panel should ever show either.
- */
-export function browserRoots(platform = process.platform, env = process.env, home = homedir()) {
-  // The path flavour follows the PLATFORM ARGUMENT, not the host: node's `join`
-  // emits forward slashes when the Windows table is built on a Mac, which is
-  // both wrong for the caller and invisible in a test that only compares
-  // against a string it built the same wrong way.
-  const path = platform === "win32" ? winPath : posixPath;
-
-  if (platform === "darwin") {
-    // No `User Data` anywhere in here except Arc. See the module header.
-    const support = path.join(home, "Library", "Application Support");
-    return [
-      { key: "chrome",        name: "Google Chrome",        root: path.join(support, "Google", "Chrome") },
-      { key: "chrome-beta",   name: "Google Chrome Beta",   root: path.join(support, "Google", "Chrome Beta") },
-      { key: "chrome-canary", name: "Google Chrome Canary", root: path.join(support, "Google", "Chrome Canary") },
-      { key: "chromium",      name: "Chromium",             root: path.join(support, "Chromium") },
-      { key: "brave",         name: "Brave",                root: path.join(support, "BraveSoftware", "Brave-Browser") },
-      { key: "edge",          name: "Microsoft Edge",       root: path.join(support, "Microsoft Edge") },
-      { key: "vivaldi",       name: "Vivaldi",              root: path.join(support, "Vivaldi") },
-      { key: "arc",           name: "Arc",                  root: path.join(support, "Arc", "User Data") },
-    ];
-  }
-
-  if (platform === "win32") {
-    // %LOCALAPPDATA% rather than a path under the home directory, because a
-    // roaming profile puts AppData\Roaming on a network share while Local stays
-    // on the machine — the same reason claudeCliCandidates() reads %APPDATA%.
-    // An empty value is what a broken login script leaves behind, not a
-    // relative path anybody means, so it falls back rather than joining onto "".
-    const local = env.LOCALAPPDATA?.trim() || path.join(home, "AppData", "Local");
-    return [
-      { key: "chrome",      name: "Google Chrome",      root: path.join(local, "Google", "Chrome", "User Data") },
-      { key: "chrome-beta", name: "Google Chrome Beta", root: path.join(local, "Google", "Chrome Beta", "User Data") },
-      // Canary is `Chrome SxS` here and `Chrome Canary` on macOS — the same
-      // channel under two names, because the Windows installer has always used
-      // the side-by-side codename. Spelling it the macOS way finds nothing, and
-      // finding nothing is this module's indistinguishable failure. Linux has
-      // no Canary channel at all, which is why the third table has no such row.
-      { key: "chrome-canary", name: "Google Chrome Canary", root: path.join(local, "Google", "Chrome SxS", "User Data") },
-      { key: "chromium",    name: "Chromium",           root: path.join(local, "Chromium", "User Data") },
-      { key: "brave",       name: "Brave",              root: path.join(local, "BraveSoftware", "Brave-Browser", "User Data") },
-      { key: "edge",        name: "Microsoft Edge",     root: path.join(local, "Microsoft", "Edge", "User Data") },
-      { key: "vivaldi",     name: "Vivaldi",            root: path.join(local, "Vivaldi", "User Data") },
-    ];
-  }
-
-  // Linux, and every other POSIX that is not macOS. Falling through rather than
-  // testing for "linux" is deliberate: a deck on FreeBSD gets the XDG layout,
-  // which is the one its Chromium package actually uses, instead of nothing.
-  //
-  // XDG_CONFIG_HOME is honoured because Chromium honours it — it is where the
-  // browser itself puts the directory, not a preference of ours — and trimmed
-  // and truthiness-tested for the reason codexHome() spells out: an empty
-  // variable is a shell accident, and joining onto it yields a CWD-relative
-  // path that would have the deck reading profiles out of wherever it was
-  // started from.
-  const config = env.XDG_CONFIG_HOME?.trim() || path.join(home, ".config");
-  return [
-    { key: "chrome",         name: "Google Chrome",       root: path.join(config, "google-chrome") },
-    { key: "chrome-beta",    name: "Google Chrome Beta",  root: path.join(config, "google-chrome-beta") },
-    { key: "chromium",       name: "Chromium",            root: path.join(config, "chromium") },
-    { key: "brave",          name: "Brave",               root: path.join(config, "BraveSoftware", "Brave-Browser") },
-    { key: "edge",           name: "Microsoft Edge",      root: path.join(config, "microsoft-edge") },
-    { key: "vivaldi",        name: "Vivaldi",             root: path.join(config, "vivaldi") },
-    // Snap and Flatpak confine the browser to a private filesystem, so their
-    // profiles are NOT under XDG_CONFIG_HOME and never appear in the six above.
-    // On Ubuntu this is not an edge case: `chromium` from the archive has been
-    // a snap-only transitional package for years, so the snap path is the only
-    // Chromium root a default Ubuntu install has.
-    { key: "chromium-snap",  name: "Chromium (snap)",     root: path.join(home, "snap", "chromium", "common", "chromium") },
-    { key: "brave-flatpak",  name: "Brave (Flatpak)",     root: path.join(home, ".var", "app", "com.brave.Browser", "config", "BraveSoftware", "Brave-Browser") },
-  ];
-}
-
-/** Where a profile name sits in the browser's own numbering; `Default` is first. */
-const profileIndex = name => (name === "Default" ? -1 : Number(name.slice("Profile ".length)));
-
-/**
- * The profile directories that actually exist inside `root`, `Default` first
- * and then `Profile N` in numeric order.
- *
- * A root that is absent, unreadable, or a file is not an error — it is the
- * ordinary state of five of the eight roots on any real machine — so it answers
- * with an empty list and the caller moves on.
- *
- * THE SORT IS NUMERIC ON PURPOSE. readdir returns whatever order the filesystem
- * feels like, and the obvious repair — a plain `.sort()` — puts `Profile 10`
- * between `Profile 1` and `Profile 2`. Nothing breaks visibly; the panel just
- * lists a user's profiles in an order that changes meaning as soon as they
- * create their tenth, which is the sort of wrongness nobody reports and
- * everybody notices.
- */
-export function profileDirs(root, { readdirSync = fsReaddirSync, statSync = fsStatSync } = {}) {
-  const path = flavourOf(root);
-  let names;
-  try { names = readdirSync(root); } catch { return []; }
-  return names
-    .map(String)
-    .filter(name => PROFILE_DIR.test(name))
-    // `Default` is profile zero in everything but its name, and it sorts ahead
-    // of `Profile 1` here rather than by luck of the alphabet.
-    .sort((a, b) => profileIndex(a) - profileIndex(b))
-    .map(name => path.join(root, name))
-    .filter(dir => isDirectory(dir, statSync));
-}
-
-/**
- * Whether this profile has the extension's payload on disk.
- *
- * Chromium unpacks an extension to `Extensions/<id>/<version>/`, one directory
- * per profile, so the id directory is the cheap and complete answer to "is it
- * installed here" — one stat per profile, at boot, across every browser found.
- *
- * It deliberately does NOT answer "is it enabled". That state lives in Secure
- * Preferences, which is signed against the profile and is another part of this
- * feature's job; conflating the two here would mean parsing a several-megabyte
- * JSON file per profile to answer a question this function is not being asked.
- */
-export function hasExtension(profileDir, extId = CLAUDE_EXT_ID, { existsSync = fsExistsSync } = {}) {
-  const path = flavourOf(profileDir);
-  return existsSync(path.join(profileDir, "Extensions", extId));
-}
-
-/**
- * Every browsing profile on this machine, with the two files Browser Watch
- * reads and whether Claude in Chrome is installed in it.
- *
- * A PROFILE WITHOUT THE EXTENSION IS REPORTED, NOT DROPPED. "You have Brave
- * here and the extension is not in it" is the one sentence on this panel that
- * gets somebody unstuck, and it can only be said by a row that exists. Filtering
- * to extension-carrying profiles would make an un-extended browser look exactly
- * like an absent one — the same indistinguishable-from-nothing failure the
- * `User Data` trap produces, arrived at on purpose.
- *
- * A ROOT WITH NO PROFILES CONTRIBUTES NOTHING, which is not the same thing. On
- * the machine this was written against, Edge, Vivaldi, Chromium and Arc all have
- * a root and no profile inside it — installed, or merely left behind by an
- * uninstall — and a row for one of them would point the History reader at a
- * path that will never exist.
- */
-export function discoverProfiles(platform = process.platform, env = process.env, home = homedir(), deps = {}) {
-  const profiles = [];
-  for (const { key, name, root } of browserRoots(platform, env, home)) {
-    // Read off the root rather than off `platform`, so the two can never
-    // disagree about which separator this row's paths are spelled with.
-    const path = flavourOf(root);
-    for (const dir of profileDirs(root, deps)) {
-      profiles.push({
-        browser: key,
-        name,
-        profile: path.basename(dir),
-        dir,
-        historyPath: path.join(dir, "History"),
-        securePrefsPath: path.join(dir, "Secure Preferences"),
-        hasClaudeExt: hasExtension(dir, CLAUDE_EXT_ID, deps),
-      });
-    }
-  }
-  return profiles;
-}