auvrynt 1.0.2 → 1.0.5

package/dist/integrations/playwright/web-tools.js

@@ -0,0 +1,504 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { writeFile, mkdir } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
+import { inspectProject } from "../../search-discovery.js";
+import { loadPlaywright } from "./playwright-runtime.js";
+import { closeBrowserWithDeadline, settleWithin, shouldEmbedScreenshot, } from "./browser-stability.js";
+const blockedAddresses = new BlockList();
+blockedAddresses.addSubnet("0.0.0.0", 8, "ipv4");
+blockedAddresses.addSubnet("10.0.0.0", 8, "ipv4");
+blockedAddresses.addSubnet("100.64.0.0", 10, "ipv4");
+blockedAddresses.addSubnet("127.0.0.0", 8, "ipv4");
+blockedAddresses.addSubnet("169.254.0.0", 16, "ipv4");
+blockedAddresses.addSubnet("172.16.0.0", 12, "ipv4");
+blockedAddresses.addSubnet("192.0.0.0", 24, "ipv4");
+blockedAddresses.addSubnet("192.0.2.0", 24, "ipv4");
+blockedAddresses.addSubnet("192.88.99.0", 24, "ipv4");
+blockedAddresses.addSubnet("192.168.0.0", 16, "ipv4");
+blockedAddresses.addSubnet("198.18.0.0", 15, "ipv4");
+blockedAddresses.addSubnet("198.51.100.0", 24, "ipv4");
+blockedAddresses.addSubnet("203.0.113.0", 24, "ipv4");
+blockedAddresses.addSubnet("224.0.0.0", 4, "ipv4");
+blockedAddresses.addSubnet("240.0.0.0", 4, "ipv4");
+blockedAddresses.addAddress("::", "ipv6");
+blockedAddresses.addAddress("::1", "ipv6");
+blockedAddresses.addSubnet("fc00::", 7, "ipv6");
+blockedAddresses.addSubnet("fe80::", 10, "ipv6");
+blockedAddresses.addSubnet("ff00::", 8, "ipv6");
+blockedAddresses.addSubnet("2001:db8::", 32, "ipv6");
+const MAX_BROWSER_JOBS = 4;
+const MAX_BROWSER_DIAGNOSTICS = 100;
+const BROWSER_CONTEXT_CLOSE_TIMEOUT_MS = 3_000;
+const BROWSER_CLOSE_TIMEOUT_MS = 8_000;
+const MAX_INLINE_SCREENSHOT_BYTES = 512 * 1024;
+const MAX_INLINE_RESPONSIVE_BYTES = 1024 * 1024;
+const LAUNCH_ARGS = [
+    "--disable-gpu",
+    "--disable-breakpad",
+    "--disable-crash-reporter",
+    "--noerrdialogs",
+];
+const LAUNCH_OPTIONS = {
+    headless: true,
+    args: LAUNCH_ARGS,
+    ...(process.platform === "win32" ? { channel: "chromium" } : {}),
+};
+let activeBrowserJobs = 0;
+async function closeContextWithTimeout(context) {
+    if (!context)
+        return;
+    await settleWithin(() => context.close(), BROWSER_CONTEXT_CLOSE_TIMEOUT_MS);
+}
+async function closeBrowserWithTimeout(browser) {
+    await closeBrowserWithDeadline(browser, BROWSER_CLOSE_TIMEOUT_MS);
+}
+function inlineScreenshotContent(buffer, label) {
+    if (shouldEmbedScreenshot(buffer.length, 0, MAX_INLINE_SCREENSHOT_BYTES, MAX_INLINE_SCREENSHOT_BYTES)) {
+        return [{ type: "image", data: buffer.toString("base64"), mimeType: "image/png" }];
+    }
+    return [{
+            type: "text",
+            text: `${label} was saved, but its ${buffer.length}-byte PNG was not embedded because it exceeded the stable MCP inline-image limit.`,
+        }];
+}
+function acquireBrowserSlot() {
+    if (activeBrowserJobs >= MAX_BROWSER_JOBS) {
+        throw new Error(`Browser capacity reached (max ${MAX_BROWSER_JOBS} concurrent jobs).`);
+    }
+    activeBrowserJobs += 1;
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        activeBrowserJobs = Math.max(0, activeBrowserJobs - 1);
+    };
+}
+function normalizedHostname(parsed) {
+    const hostname = parsed.hostname.toLowerCase();
+    return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function isExplicitLocalHost(hostname) {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "0.0.0.0" || hostname === "::1" || hostname.startsWith("127.");
+}
+function addressBlocked(address, allowLoopback) {
+    const family = isIP(address);
+    if (!family)
+        return true;
+    const type = family === 4 ? "ipv4" : "ipv6";
+    if (allowLoopback) {
+        if (family === 4 && address.startsWith("127."))
+            return false;
+        if (family === 6 && address === "::1")
+            return false;
+    }
+    if (blockedAddresses.check(address, type))
+        return true;
+    if (family === 6) {
+        const firstGroup = Number.parseInt(address.split(":", 1)[0] || "0", 16);
+        return firstGroup < 0x2000 || firstGroup > 0x3fff;
+    }
+    return false;
+}
+function parseWebUrl(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        throw new Error(`Invalid URL format: ${urlStr}`);
+    }
+    const protocol = parsed.protocol.toLowerCase();
+    if (protocol !== "http:" && protocol !== "https:") {
+        throw new Error(`Blocked unsafe scheme "${protocol}". Only http: and https: are allowed.`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error("Blocked URL containing embedded credentials.");
+    }
+    return parsed;
+}
+export function validateWebUrl(urlStr) {
+    const parsed = parseWebUrl(urlStr);
+    const hostname = normalizedHostname(parsed);
+    if (isExplicitLocalHost(hostname))
+        return parsed.href;
+    const family = isIP(hostname);
+    if (family && addressBlocked(hostname, false)) {
+        throw new Error(`Blocked SSRF request to non-public address: ${hostname}`);
+    }
+    return parsed.href;
+}
+async function assertSafeResolvedHost(parsed, allowLoopback) {
+    const hostname = normalizedHostname(parsed);
+    if (isExplicitLocalHost(hostname)) {
+        if (allowLoopback)
+            return;
+        throw new Error(`Blocked SSRF request to loopback address: ${hostname}`);
+    }
+    const family = isIP(hostname);
+    if (family) {
+        if (addressBlocked(hostname, allowLoopback)) {
+            throw new Error(`Blocked SSRF request to non-public address: ${hostname}`);
+        }
+        return;
+    }
+    let resolved;
+    try {
+        resolved = await lookup(hostname, { all: true, verbatim: true });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not resolve ${hostname}: ${reason}`);
+    }
+    if (resolved.length === 0)
+        throw new Error(`Could not resolve ${hostname}.`);
+    for (const address of resolved) {
+        if (addressBlocked(address.address, allowLoopback)) {
+            throw new Error(`Blocked SSRF request: ${hostname} resolved to non-public address ${address.address}`);
+        }
+    }
+}
+export async function assertSafeWebUrl(urlStr, allowLoopback = false) {
+    const parsed = parseWebUrl(urlStr);
+    await assertSafeResolvedHost(parsed, allowLoopback);
+    return parsed.href;
+}
+async function assertSafeWebSocketUrl(urlStr, allowLoopback) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        throw new Error(`Invalid WebSocket URL format: ${urlStr}`);
+    }
+    if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
+        throw new Error(`Blocked WebSocket scheme: ${parsed.protocol}`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error("Blocked WebSocket URL containing embedded credentials.");
+    }
+    await assertSafeResolvedHost(parsed, allowLoopback);
+}
+async function installRequestGuard(context, initialUrl, blockedRequests) {
+    const parsed = parseWebUrl(initialUrl);
+    const allowLoopback = isExplicitLocalHost(normalizedHostname(parsed));
+    const safeInitialUrl = await assertSafeWebUrl(initialUrl, allowLoopback);
+    await context.route("**/*", async (route) => {
+        const requestUrl = route.request().url();
+        try {
+            const parsedRequest = new URL(requestUrl);
+            if (["data:", "blob:", "about:"].includes(parsedRequest.protocol)) {
+                await route.continue();
+                return;
+            }
+            await assertSafeWebUrl(requestUrl, allowLoopback);
+            await route.continue();
+        }
+        catch (error) {
+            if (blockedRequests.length < MAX_BROWSER_DIAGNOSTICS) {
+                const reason = error instanceof Error ? error.message : String(error);
+                blockedRequests.push(`${requestUrl} (${reason})`);
+            }
+            await route.abort("blockedbyclient");
+        }
+    });
+    await context.routeWebSocket("**/*", async (webSocket) => {
+        const socketUrl = webSocket.url();
+        try {
+            await assertSafeWebSocketUrl(socketUrl, allowLoopback);
+            webSocket.connectToServer();
+        }
+        catch (error) {
+            if (blockedRequests.length < MAX_BROWSER_DIAGNOSTICS) {
+                const reason = error instanceof Error ? error.message : String(error);
+                blockedRequests.push(`${socketUrl} (${reason})`);
+            }
+            await webSocket.close({ code: 1008, reason: "Blocked by Auvrynt network policy" });
+        }
+    });
+    return safeInitialUrl;
+}
+export async function startDevServer(registry, processManager, input, ownerClientId) {
+    let command = input.command;
+    if (!command) {
+        const summary = await inspectProject(registry, {
+            workspaceId: input.workspaceId,
+            path: input.workingDirectory,
+        });
+        command = summary.recommendedCommands.run;
+        if (!command) {
+            throw new Error("No development run command detected in project. Please specify command parameter.");
+        }
+    }
+    const result = processManager.startProcess({
+        workspaceId: input.workspaceId,
+        ownerClientId,
+        command,
+        workingDirectory: input.workingDirectory,
+    });
+    return {
+        processId: result.processId,
+        command,
+        status: result.status,
+        detectedUrls: result.detectedUrls,
+        recentOutput: result.recentOutput,
+    };
+}
+export async function capturePageScreenshot(registry, input) {
+    const workspace = registry.getWorkspace(input.workspaceId);
+    const validatedUrl = validateWebUrl(input.url);
+    const absoluteOutputPath = registry.resolveArtifactPath(workspace, input.outputPath, "playwright");
+    let playwright;
+    try {
+        playwright = await loadPlaywright();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{
+                    type: "text",
+                    text: `Playwright browser support is unavailable: ${message}. Run 'auvrynt start' to repair it automatically.`,
+                }],
+            isError: true,
+        };
+    }
+    let releaseSlot;
+    let browser;
+    let context;
+    try {
+        releaseSlot = acquireBrowserSlot();
+        const width = Math.min(Math.max(input.viewportWidth ?? 1280, 320), 3840);
+        const height = Math.min(Math.max(input.viewportHeight ?? 800, 240), 2160);
+        browser = await playwright.chromium.launch(LAUNCH_OPTIONS);
+        context = await browser.newContext({ viewport: { width, height }, serviceWorkers: "block" });
+        const blockedRequests = [];
+        const safeUrl = await installRequestGuard(context, validatedUrl, blockedRequests);
+        const page = await context.newPage();
+        const consoleErrors = [];
+        const failedRequests = [];
+        page.on("console", (msg) => {
+            if (msg.type() === "error" && consoleErrors.length < MAX_BROWSER_DIAGNOSTICS)
+                consoleErrors.push(msg.text());
+        });
+        page.on("requestfailed", (req) => {
+            if (failedRequests.length < MAX_BROWSER_DIAGNOSTICS) {
+                failedRequests.push(`${req.url()} (${req.failure()?.errorText ?? "failed"})`);
+            }
+        });
+        await page.goto(safeUrl, {
+            waitUntil: input.waitUntil ?? "domcontentloaded",
+            timeout: 15_000,
+        });
+        if (input.delayMs && input.delayMs > 0) {
+            await page.waitForTimeout(Math.min(input.delayMs, 5_000));
+        }
+        await mkdir(dirname(absoluteOutputPath), { recursive: true });
+        const buffer = await page.screenshot({ fullPage: input.fullPage ?? false, type: "png" });
+        await writeFile(absoluteOutputPath, buffer);
+        const relPath = relative(workspace.root, absoluteOutputPath).replace(/\\/g, "/");
+        return {
+            content: [
+                ...inlineScreenshotContent(buffer, `Screenshot ${relPath}`),
+                {
+                    type: "text",
+                    text: `Saved screenshot to ${relPath}${consoleErrors.length > 0 ? `\nConsole Errors: ${consoleErrors.join("; ")}` : ""}${failedRequests.length > 0 ? `\nFailed Requests: ${failedRequests.join("; ")}` : ""}${blockedRequests.length > 0 ? `\nBlocked Requests: ${blockedRequests.join("; ")}` : ""}`,
+                },
+            ],
+        };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return { content: [{ type: "text", text: `Browser screenshot failed: ${msg}` }], isError: true };
+    }
+    finally {
+        await closeContextWithTimeout(context);
+        await closeBrowserWithTimeout(browser);
+        releaseSlot?.();
+    }
+}
+export async function inspectPage(registry, input) {
+    registry.getWorkspace(input.workspaceId);
+    const validatedUrl = validateWebUrl(input.url);
+    let playwright;
+    try {
+        playwright = await loadPlaywright();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{
+                    type: "text",
+                    text: `Playwright browser support is unavailable: ${message}. Run 'auvrynt start' to repair it automatically.`,
+                }],
+            isError: true,
+        };
+    }
+    let releaseSlot;
+    let browser;
+    let context;
+    try {
+        releaseSlot = acquireBrowserSlot();
+        browser = await playwright.chromium.launch(LAUNCH_OPTIONS);
+        context = await browser.newContext({ viewport: { width: 1280, height: 800 }, serviceWorkers: "block" });
+        const blockedRequests = [];
+        const safeUrl = await installRequestGuard(context, validatedUrl, blockedRequests);
+        const page = await context.newPage();
+        const consoleErrors = [];
+        const failedRequests = [];
+        page.on("console", (msg) => {
+            if (msg.type() === "error" && consoleErrors.length < MAX_BROWSER_DIAGNOSTICS)
+                consoleErrors.push(msg.text());
+        });
+        page.on("requestfailed", (req) => {
+            if (failedRequests.length < MAX_BROWSER_DIAGNOSTICS) {
+                failedRequests.push(`${req.url()} (${req.failure()?.errorText ?? "failed"})`);
+            }
+        });
+        await page.goto(safeUrl, { waitUntil: "domcontentloaded", timeout: 15_000 });
+        const title = await page.title();
+        const maxElements = Math.min(Math.max(input.maxElements ?? 20, 1), 100);
+        const elementsSummary = await page.evaluate((maxElem) => {
+            const headings = Array.from(document.querySelectorAll("h1, h2, h3"))
+                .slice(0, maxElem)
+                .map((el) => `${el.tagName}: ${el.textContent?.trim()}`);
+            const buttons = Array.from(document.querySelectorAll("button, input[type='button'], input[type='submit']"))
+                .slice(0, maxElem)
+                .map((el) => el.textContent?.trim() || el.value || "button");
+            const links = Array.from(document.querySelectorAll("a[href]"))
+                .slice(0, maxElem)
+                .map((el) => `${el.textContent?.trim() || "link"} -> ${el.href}`);
+            return { headings, buttons, links };
+        }, maxElements);
+        const accessibility = input.includeAccessibilityTree
+            ? await page.evaluate((maxElem) => Array.from(document.querySelectorAll("[role], button, a[href], input, select, textarea, h1, h2, h3, h4, h5, h6")).slice(0, maxElem).map((el) => ({
+                tag: el.tagName.toLowerCase(),
+                role: el.getAttribute("role"),
+                label: el.getAttribute("aria-label"),
+                text: el.textContent?.trim().slice(0, 160) || null,
+                disabled: el.disabled || el.getAttribute("aria-disabled") === "true",
+            })), maxElements)
+            : undefined;
+        const computedStyles = input.includeComputedStyles
+            ? await page.evaluate((maxElem) => Array.from(document.querySelectorAll("body, h1, h2, h3, button, a, input"))
+                .slice(0, maxElem)
+                .map((el) => {
+                const styles = getComputedStyle(el);
+                return {
+                    element: el.tagName.toLowerCase(),
+                    display: styles.display,
+                    position: styles.position,
+                    color: styles.color,
+                    backgroundColor: styles.backgroundColor,
+                    fontSize: styles.fontSize,
+                    fontFamily: styles.fontFamily,
+                };
+            }), maxElements)
+            : undefined;
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        url: safeUrl,
+                        title,
+                        elements: elementsSummary,
+                        accessibility,
+                        computedStyles,
+                        consoleErrors,
+                        failedRequests,
+                        blockedRequests,
+                    }, null, 2),
+                }],
+        };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return { content: [{ type: "text", text: `Inspect page failed: ${msg}` }], isError: true };
+    }
+    finally {
+        await closeContextWithTimeout(context);
+        await closeBrowserWithTimeout(browser);
+        releaseSlot?.();
+    }
+}
+export async function testResponsivePage(registry, input) {
+    const workspace = registry.getWorkspace(input.workspaceId);
+    const validatedUrl = validateWebUrl(input.url);
+    const outputDirectory = registry.resolveArtifactPath(workspace, input.outputDirectory, "playwright");
+    const requestedViewports = input.viewports ?? [
+        { name: "mobile", width: 390, height: 844 },
+        { name: "tablet", width: 768, height: 1024 },
+        { name: "desktop", width: 1440, height: 900 },
+    ];
+    if (requestedViewports.length < 1 || requestedViewports.length > 6) {
+        return { content: [{ type: "text", text: "Responsive testing requires 1 to 6 viewports." }], isError: true };
+    }
+    const viewports = requestedViewports.map((viewport, index) => ({
+        name: viewport.name.trim().replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64) || `viewport_${index + 1}`,
+        width: Math.min(Math.max(Math.trunc(viewport.width), 240), 3840),
+        height: Math.min(Math.max(Math.trunc(viewport.height), 240), 2160),
+    }));
+    const names = new Set(viewports.map((viewport) => viewport.name.toLowerCase()));
+    if (names.size !== viewports.length) {
+        return { content: [{ type: "text", text: "Responsive viewport names must be unique after filename sanitization." }], isError: true };
+    }
+    let playwright;
+    try {
+        playwright = await loadPlaywright();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{ type: "text", text: `Playwright browser support is unavailable: ${message}. Run 'auvrynt start' to repair it automatically.` }],
+            isError: true,
+        };
+    }
+    let releaseSlot;
+    let browser;
+    try {
+        releaseSlot = acquireBrowserSlot();
+        browser = await playwright.chromium.launch(LAUNCH_OPTIONS);
+        await mkdir(outputDirectory, { recursive: true });
+        const content = [];
+        const results = [];
+        let inlineScreenshotBytes = 0;
+        for (const viewport of viewports) {
+            const context = await browser.newContext({ viewport: { width: viewport.width, height: viewport.height }, serviceWorkers: "block" });
+            try {
+                const blockedRequests = [];
+                const safeUrl = await installRequestGuard(context, validatedUrl, blockedRequests);
+                const page = await context.newPage();
+                await page.goto(safeUrl, { waitUntil: "domcontentloaded", timeout: 15_000 });
+                const buffer = await page.screenshot({ fullPage: input.fullPage ?? true, type: "png" });
+                const outputPath = join(outputDirectory, `${viewport.name}.png`);
+                await writeFile(outputPath, buffer);
+                const relPath = relative(workspace.root, outputPath).replace(/\\/g, "/");
+                results.push({ ...viewport, path: relPath, blockedRequests });
+                if (shouldEmbedScreenshot(buffer.length, inlineScreenshotBytes, MAX_INLINE_SCREENSHOT_BYTES, MAX_INLINE_RESPONSIVE_BYTES)) {
+                    inlineScreenshotBytes += buffer.length;
+                    content.push({ type: "image", data: buffer.toString("base64"), mimeType: "image/png" });
+                }
+                else {
+                    content.push({
+                        type: "text",
+                        text: `${viewport.name} screenshot was saved but not embedded (${buffer.length} bytes) to keep the MCP response stable.`,
+                    });
+                }
+                content.push({ type: "text", text: `${viewport.name}: ${viewport.width}x${viewport.height} → ${relPath}` });
+            }
+            finally {
+                await closeContextWithTimeout(context);
+            }
+        }
+        content.push({ type: "text", text: JSON.stringify({ url: validatedUrl, results }, null, 2) });
+        return { content };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { content: [{ type: "text", text: `Responsive page test failed: ${message}` }], isError: true };
+    }
+    finally {
+        await closeBrowserWithTimeout(browser);
+        releaseSlot?.();
+    }
+}