browserclaw 0.3.3 → 0.3.5

package/dist/index.cjs

@@ -751,12 +751,13 @@ async function getPageForTargetId(opts) {
   const found = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl);
   if (!found) {
     if (pages.length === 1) return first;
-    throw new Error("tab not found");
+    throw new Error(`Tab not found (targetId: ${opts.targetId}). Call browser.tabs() to list open tabs.`);
   }
   return found;
 }
 function refLocator(page, ref) {
   const normalized = ref.startsWith("@") ? ref.slice(1) : ref.startsWith("ref=") ? ref.slice(4) : ref;
+  if (!normalized.trim()) throw new Error("ref is required");
   if (/^e\d+$/.test(normalized)) {
     const state = pageStates.get(page);
     if (state?.roleRefsMode === "aria") {
@@ -1105,7 +1106,7 @@ async function snapshotRole(opts) {
   const frameSelector = opts.frameSelector?.trim() || "";
   const selector = opts.selector?.trim() || "";
   const locator = frameSelector ? selector ? page.frameLocator(frameSelector).locator(selector) : page.frameLocator(frameSelector).locator(":root") : selector ? page.locator(selector) : page.locator(":root");
-  const ariaSnapshot = await locator.ariaSnapshot({ timeout: 1e4 });
+  const ariaSnapshot = await locator.ariaSnapshot({ timeout: normalizeTimeoutMs(opts.timeoutMs, 5e3) });
   const built = buildRoleSnapshotFromAriaSnapshot(String(ariaSnapshot ?? ""), opts.options);
   storeRoleRefsForTarget({
     page,
@@ -1411,7 +1412,7 @@ async function assertBrowserNavigationAllowed(opts) {
     throw new InvalidBrowserNavigationUrlError(`Navigation blocked: unsupported protocol "${parsed.protocol}"`);
   }
   const policy = opts.ssrfPolicy;
-  if (policy?.allowPrivateNetwork) return;
+  if (policy?.dangerouslyAllowPrivateNetwork ?? policy?.allowPrivateNetwork ?? true) return;
   const allowedHostnames = [
     ...policy?.allowedHostnames ?? [],
     ...policy?.hostnameAllowlist ?? []
@@ -1422,7 +1423,7 @@ async function assertBrowserNavigationAllowed(opts) {
   }
   if (await isInternalUrlResolved(rawUrl, opts.lookupFn)) {
     throw new InvalidBrowserNavigationUrlError(
-      `Navigation to internal/loopback address blocked: "${rawUrl}". Use ssrfPolicy: { allowPrivateNetwork: true } if this is intentional.`
+      `Navigation to internal/loopback address blocked: "${rawUrl}". ssrfPolicy.dangerouslyAllowPrivateNetwork is false (strict mode).`
     );
   }
 }
@@ -1569,7 +1570,7 @@ async function isInternalUrlResolved(url, lookupFn = promises.lookup) {
 async function navigateViaPlaywright(opts) {
   const url = String(opts.url ?? "").trim();
   if (!url) throw new Error("url is required");
-  const policy = opts.allowInternal ? { ...opts.ssrfPolicy, allowPrivateNetwork: true } : opts.ssrfPolicy;
+  const policy = opts.allowInternal ? { ...opts.ssrfPolicy, dangerouslyAllowPrivateNetwork: true } : opts.ssrfPolicy;
   await assertBrowserNavigationAllowed({ url, ssrfPolicy: policy });
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
   ensurePageState(page);
@@ -1594,7 +1595,7 @@ async function listPagesViaPlaywright(opts) {
 async function createPageViaPlaywright(opts) {
   const targetUrl = (opts.url ?? "").trim() || "about:blank";
   if (targetUrl !== "about:blank") {
-    const policy = opts.allowInternal ? { ...opts.ssrfPolicy, allowPrivateNetwork: true } : opts.ssrfPolicy;
+    const policy = opts.allowInternal ? { ...opts.ssrfPolicy, dangerouslyAllowPrivateNetwork: true } : opts.ssrfPolicy;
     await assertBrowserNavigationAllowed({ url: targetUrl, ssrfPolicy: policy });
   }
   const { browser } = await connectBrowser(opts.cdpUrl);
@@ -1834,7 +1835,7 @@ async function setGeolocationViaPlaywright(opts) {
     return;
   }
   if (opts.latitude === void 0 || opts.longitude === void 0) {
-    throw new Error("latitude and longitude are required when not clearing geolocation.");
+    throw new Error("latitude and longitude are required (or set clear=true)");
   }
   await context.grantPermissions(["geolocation"], opts.origin ? { origin: opts.origin } : void 0);
   await context.setGeolocation({
@@ -1981,8 +1982,9 @@ async function responseBodyViaPlaywright(opts) {
   const response = await page.waitForResponse(opts.url, { timeout });
   let body = await response.text();
   let truncated = false;
-  if (opts.maxChars && body.length > opts.maxChars) {
-    body = body.slice(0, opts.maxChars);
+  const maxChars = typeof opts.maxChars === "number" && Number.isFinite(opts.maxChars) ? Math.max(1, Math.min(5e6, Math.floor(opts.maxChars))) : void 0;
+  if (maxChars !== void 0 && body.length > maxChars) {
+    body = body.slice(0, maxChars);
     truncated = true;
   }
   const headers = {};
@@ -2153,6 +2155,7 @@ var CrawlPage = class {
         selector: opts.selector,
         frameSelector: opts.frameSelector,
         refsMode: opts.refsMode,
+        timeoutMs: opts.timeoutMs,
         options: {
           interactive: opts.interactive,
           compact: opts.compact,
@@ -3016,7 +3019,7 @@ var BrowserClaw = class _BrowserClaw {
   static async launch(opts = {}) {
     const chrome = await launchChrome(opts);
     const cdpUrl = `http://127.0.0.1:${chrome.cdpPort}`;
-    const ssrfPolicy = opts.allowInternal ? { ...opts.ssrfPolicy, allowPrivateNetwork: true } : opts.ssrfPolicy;
+    const ssrfPolicy = opts.allowInternal ? { ...opts.ssrfPolicy, dangerouslyAllowPrivateNetwork: true } : opts.ssrfPolicy;
     return new _BrowserClaw(cdpUrl, chrome, ssrfPolicy);
   }
   /**
@@ -3038,7 +3041,7 @@ var BrowserClaw = class _BrowserClaw {
       throw new Error(`Cannot connect to Chrome at ${cdpUrl}. Is Chrome running with --remote-debugging-port?`);
     }
     await connectBrowser(cdpUrl, opts?.authToken);
-    const ssrfPolicy = opts?.allowInternal ? { ...opts.ssrfPolicy, allowPrivateNetwork: true } : opts?.ssrfPolicy;
+    const ssrfPolicy = opts?.allowInternal ? { ...opts.ssrfPolicy, dangerouslyAllowPrivateNetwork: true } : opts?.ssrfPolicy;
     return new _BrowserClaw(cdpUrl, null, ssrfPolicy);
   }
   /**