cdpilot 0.9.3 → 0.9.5

package/bin/cdpilot.js

@@ -5,7 +5,14 @@
  * Entry point: detects Python, finds browser, delegates to cdpilot.py
  */
 
-const { execSync, spawn } = require('child_process');
+const { execSync, spawn, spawnSync } = require('child_process');
+
+// Output the launcher prints itself (help, status) must survive process.exit():
+// on macOS a piped stdout is asynchronous, and exiting right after a write
+// longer than the pipe buffer (8 KB) cut --help off mid-text.
+for (const stream of [process.stdout, process.stderr]) {
+  if (stream._handle && typeof stream._handle.setBlocking === 'function') stream._handle.setBlocking(true);
+}
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
@@ -13,6 +20,16 @@ const os = require('os');
 const SCRIPT = path.join(__dirname, '..', 'src', 'cdpilot.py');
 const VERSION = require('../package.json').version;
 
+// CDPILOT_HOME resolution — must match src/cdpilot.py exactly:
+//   CDPILOT_HOME = os.environ.get("CDPILOT_HOME") or os.path.expanduser("~/.cdpilot")
+// A set-but-empty CDPILOT_HOME falls back to the default (empty string is
+// falsy in both Python's `or` and JS's `||`). A non-empty CDPILOT_HOME is
+// used verbatim — no `~` expansion — same as Python's os.environ.get() here
+// (expanduser is only applied to the hardcoded "~/.cdpilot" fallback).
+function cdpilotHome() {
+  return process.env.CDPILOT_HOME || path.join(os.homedir(), '.cdpilot');
+}
+
 // ── Browser Detection ──
 
 function findBrowser() {
@@ -161,7 +178,7 @@ function checkWebsockets(python) {
 }
 
 function preflight() {
-  const markerFile = path.join(os.homedir(), '.cdpilot', '.preflight-done');
+  const markerFile = path.join(cdpilotHome(), '.preflight-done');
 
   // Skip if already passed (not first run) and all deps present
   const python = findPython();
@@ -229,7 +246,23 @@ function runStatus() {
   const config = resolveProjectConfig();
   const port = config.port === '0' ? '9222' : config.port;
   const projLabel = config.projectId ? ` [${config.projectId}]` : '';
-  console.log(`\n  cdpilot status (port ${port})${projLabel}\n`);
+
+  // Check if this project has an external (connect'ed) browser
+  let isExternal = false;
+  let browserName = '';
+  try {
+    const home = cdpilotHome();
+    const regFile = path.join(home, 'registry.json');
+    const data = JSON.parse(fs.readFileSync(regFile, 'utf-8'));
+    const entry = (data.projects || {})[config.projectId];
+    if (entry && entry.external) {
+      isExternal = true;
+      browserName = entry.browser_name || '';
+    }
+  } catch {}
+
+  const extLabel = isExternal ? ' (external)' : '';
+  console.log(`\n  cdpilot status (port ${port})${projLabel}${extLabel}\n`);
 
   try {
     const http = require('http');
@@ -240,18 +273,31 @@ function runStatus() {
         try {
           const info = JSON.parse(data);
           console.log(`  ✓ Connected`);
-          console.log(`  Browser: ${info.Browser || 'Unknown'}`);
+          console.log(`  Browser: ${info.Browser || 'Unknown'}${isExternal ? ' (external — your browser)' : ''}`);
           console.log(`  Protocol: ${info['Protocol-Version'] || 'Unknown'}`);
           console.log(`  WebSocket: ${info.webSocketDebuggerUrl || 'N/A'}`);
-          console.log(`  ${idleCloseLabel(port)}\n`);
+          if (isExternal) {
+            console.log(`  cdpilot will never close this browser.\n`);
+          } else {
+            const extra = [webmcpLabel(config.profileDir), botAuthLabel(port)].filter(Boolean);
+            console.log(`  ${idleCloseLabel(port)}${extra.length ? '' : '\n'}`);
+            extra.forEach((l, i) => console.log(`  ${l}${i === extra.length - 1 ? '\n' : ''}`));
+          }
         } catch {
           console.log('  ✓ CDP responding but version info unavailable\n');
         }
       });
     });
     req.on('error', () => {
-      console.log('  ❌ No browser connected on this port.');
-      console.log('  Run: cdpilot launch\n');
+      if (isExternal) {
+        console.log(`  ❌ External browser (${browserName || 'unknown'}) is gone.`);
+        console.log('  Run: cdpilot connect again or cdpilot disconnect\n');
+      } else {
+        console.log('  ❌ No browser connected on this port.');
+        const webmcp = webmcpLabel(config.profileDir);
+        if (webmcp) console.log(`  ${webmcp}`);
+        console.log('  Run: cdpilot launch\n');
+      }
     });
     req.on('timeout', () => {
       req.destroy();
@@ -267,7 +313,7 @@ function runStatus() {
 // _idle_status there): CDPILOT_HOME/idle/<port>.json names the watcher and its
 // minutes, CDPILOT_HOME/projects/<id>/last-activity the last command.
 function idleCloseLabel(port) {
-  const home = process.env.CDPILOT_HOME || path.join(os.homedir(), '.cdpilot');
+  const home = cdpilotHome();
   try {
     const st = JSON.parse(fs.readFileSync(path.join(home, 'idle', `${port}.json`), 'utf-8'));
     const minutes = Number(st.minutes) || 0;
@@ -290,6 +336,53 @@ function idleCloseLabel(port) {
   }
 }
 
+// This project's WebMCP mode, as src/cdpilot.py reads it (get_webmcp_config):
+// CDPILOT_WEBMCP=1|0 wins, else <profile>/webmcp.json written by
+// `launch --webmcp` / `launch --no-webmcp`.
+function webmcpMode(profileDir) {
+  const raw = (process.env.CDPILOT_WEBMCP || '').trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(raw)) return { on: true, from: 'CDPILOT_WEBMCP' };
+  if (['0', 'false', 'no', 'off'].includes(raw)) return { on: false, from: 'CDPILOT_WEBMCP' };
+  try {
+    const st = JSON.parse(fs.readFileSync(path.join(profileDir, 'webmcp.json'), 'utf-8'));
+    return { on: st.webmcp === true, from: 'launch --webmcp' };
+  } catch {
+    return { on: false, from: null };
+  }
+}
+
+// Printed by `status` only while the mode is on (the default output is unchanged).
+function webmcpLabel(profileDir) {
+  const m = webmcpMode(profileDir);
+  if (!m.on) return null;
+  return `WebMCP: on (${m.from}; browsers start with --enable-features=WebMCP)`;
+}
+
+// Web Bot Auth signer line, printed by `status` only when bot-auth is set up
+// (a key in CDPILOT_HOME/bot-auth/, or signer state for this port), so the
+// default output is unchanged. With no signer state file or stale marker in
+// CDPILOT_HOME/bot-auth/signers/ it is "off" without starting Python.
+// Otherwise Python decides (hidden --_bot-auth-label, see
+// _bot_auth_helper_state there): a pid alone proves nothing, the signer is
+// "on" only if that pid's command line is this port's signer and the browser
+// is still the one it attached to; a dead or stale signer also prints the
+// one-line "requests go out unsigned" warning on stderr.
+function botAuthLabel(port) {
+  const home = cdpilotHome();
+  const dir = path.join(home, 'bot-auth', 'signers');
+  const signer = fs.existsSync(path.join(dir, `${port}.json`)) || fs.existsSync(path.join(dir, `${port}.stale`));
+  if (!signer) return fs.existsSync(path.join(home, 'bot-auth', 'config.json')) ? 'bot-auth: off' : null;
+  const python = findPython();
+  if (!python) return 'bot-auth: off';
+  const r = spawnSync(python, [SCRIPT, '--_bot-auth-label'], {
+    encoding: 'utf-8', timeout: 20000,
+    env: { ...process.env, CDP_PORT: String(port), CDPILOT_LOG: '0' },
+  });
+  if (r.stderr) process.stderr.write(r.stderr);
+  const line = (r.stdout || '').trim().split('\n').pop();
+  return /^bot-auth: /.test(line || '') ? line : 'bot-auth: off';
+}
+
 // ── Version ──
 
 function showVersion() {
@@ -316,8 +409,8 @@ function resolveProjectConfig() {
   }
 
   const projectId = getProjectId();
-  const registryFile = path.join(os.homedir(), '.cdpilot', 'registry.json');
-  const defaultProfile = path.join(os.homedir(), '.cdpilot', 'projects', projectId, 'profile');
+  const registryFile = path.join(cdpilotHome(), 'registry.json');
+  const defaultProfile = path.join(cdpilotHome(), 'projects', projectId, 'profile');
 
   let registry = {};
   try {
@@ -363,10 +456,21 @@ function showHelp() {
 
   SETUP
     setup              Auto-detect browser, create isolated profile
-    launch [--idle-close <min>]  Start browser with CDP enabled (--idle-close or
-                       CDPILOT_IDLE_CLOSE: close it after <min> idle minutes)
-    status             Check browser connection
+    launch [--idle-close <min>] [--webmcp|--no-webmcp] [--bot-auth]
+                       Start browser with CDP enabled (--idle-close or
+                       CDPILOT_IDLE_CLOSE: close it after <min> idle minutes;
+                       --webmcp: this project's browsers start with WebMCP on,
+                       saved until --no-webmcp; see WEBMCP below; --bot-auth:
+                       sign every request, see WEB BOT AUTH)
+    status             Check browser connection (idle close; WebMCP and the
+                       bot-auth signer when set up)
     stop [--smart]     Stop browser (--smart = close owned tabs, quit if empty)
+    connect [<port> | <ws-url> | --auto]
+                       Use a browser you started with --remote-debugging-port
+                       and --user-data-dir; cdpilot never closes or injects
+                       into it. --auto reads DevToolsActivePort files.
+                       (chrome://inspect remote-debugging mode: not supported yet)
+    disconnect         Forget the connected browser (it keeps running)
     close [--force|--keep]  Smart close: close cdpilot's tabs; quit browser only
                        if no user tabs remain (--force quits anyway, --keep never quits)
 
@@ -378,7 +482,8 @@ function showHelp() {
     pdf [file]         Save page as PDF
 
   INTERACTION
-    click <sel>        Click element
+    click <sel>        Click element; exit 3 =
+                       pressed, release missed the target, not clicked
     type <sel> <text>  Type into input
     fill <sel> <val>   Set input value (React-compatible)
     submit <form>      Submit form
@@ -458,8 +563,32 @@ function showHelp() {
     cookies load <file>
                        Import previously-saved cookies into the current jar.
 
+  WEB BOT AUTH (signed agent — the opposite of stealth; needs: pip install cryptography)
+    bot-auth init --agent-url https://your-domain.com [--force]
+                       Generate an Ed25519 key (0600, never printed) in CDPILOT_HOME/bot-auth/
+    bot-auth directory Print the JWKS to serve at
+                       https://your-domain.com/.well-known/http-message-signatures-directory
+    bot-auth directory --headers [--authority <host>] [--ttl <s>] [--content-digest] [--json]
+                       The same plus the Signature / Signature-Input headers that
+                       response must carry (Cloudflare checks them; one per key)
+    bot-auth format [legacy|dict]
+                       Signature-Agent format. legacy (default): "https://…",
+                       what Cloudflare verifies; dict: sig1="https://…" (draft-05)
+    bot-auth status    Agent URL, keyid, and whether the signer is running
+    launch --bot-auth  Launch with a signer that adds Signature, Signature-Input and
+                       Signature-Agent to EVERY request the browser makes (new tabs,
+                       popups, iframes, workers, page fetches after cdpilot exits).
+                       Or CDPILOT_BOT_AUTH=1. With stealth mode: one warning, stealth
+                       injection skipped. "stop" ends the signer.
+
   RELIABILITY
-    browser [name]     Show or set preferred browser (chrome|brave|chromium|edge|vivaldi|auto)
+    browser [name]     Show or set preferred browser
+                       (chrome|brave|chromium|edge|vivaldi|chrome-for-testing|auto)
+    browser install chrome-for-testing [--channel stable|beta|dev|canary] [--version X]
+                       Download Chrome for Testing (~150-190 MB, only on this
+                       command) for extension development: Chrome 137+ ignores
+                       --load-extension, CfT does not. Used instead of Chrome
+                       while dev extensions are registered. Not for stealth.
     health             JSON status: alive, port, tabs, browser, today's crashes
 
   PROJECTS
@@ -469,6 +598,7 @@ function showHelp() {
 
   AI AGENT
     mcp                Start MCP server (stdin/stdout JSON-RPC)
+                       --tools core|all|a,b (env CDPILOT_MCP_TOOLS): smaller tool list
 
   SESSION LOG (always on, local, redacted)
     log                Today's commands for this project: time, exit, command,
@@ -480,6 +610,17 @@ function showHelp() {
                        params are redacted. CDPILOT_LOG=0 turns it off;
                        CDPILOT_LOG_DAYS (default 14) sets how many days are kept.
 
+  WEBMCP (tools a page registers on document.modelContext; needs launch --webmcp)
+    tools list [--json] The page's tools from getTools(): imperative, <form
+                        toolname> and same-origin iframe tools, with title,
+                        annotations, inputSchema. None: says why (WebMCP off,
+                        insecure page, old browser, none registered); exit 0.
+    tools call <name> [json-args | --arg k=v ...] [--frame <url-part>]
+                        Check args against inputSchema, run executeTool() with
+                        an abort signal (--timeout, default 20s), print the
+                        result. Bad args / tool error: exit 1; timeout: 124.
+                        Runs the page's own code: its result is untrusted.
+
   WATCH (continuous screencast for AI video understanding)
     watch start <url>  Begin JPEG screencast at N fps to a disk ring buffer
                        (default 10fps, 5min retention, 100MB cap). Background
@@ -715,6 +856,10 @@ if (cmd === 'status') {
 
   if (browser && !process.env.CHROME_BIN) {
     env.CHROME_BIN = browser;
+    // Tells src/cdpilot.py this CHROME_BIN is our guess, not the user's: it
+    // still applies `cdpilot browser <name>` and the dev-extension rule
+    // (Chrome -> Chrome for Testing) on top of it.
+    env.CDPILOT_CHROME_BIN_AUTO = '1';
   }
 
   const child = spawn(python, [SCRIPT, ...args], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdpilot",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "mcpName": "io.github.mehmetnadir/cdpilot",
   "description": "Zero-dependency browser automation CLI. Raw CDP, 70+ commands, friction ladder, 3-tier stealth, CAPTCHA + press-and-hold solvers, proxy pools, MCP server. No Puppeteer/Playwright/Selenium.",
   "bin": {
@@ -9,7 +9,8 @@
   },
   "scripts": {
     "test": "node test/test.js",
-    "start": "node bin/cdpilot.js"
+    "start": "node bin/cdpilot.js",
+    "build:mcpb": "bash scripts/build-mcpb.sh"
   },
   "keywords": [
     "browser-automation",