demobite 1.19.1 → 1.21.0

package/launcher/index.mjs

@@ -113,12 +113,16 @@ if (arg === "logs") {
   let text = ""; try { text = fs.readFileSync(LOG, "utf8"); } catch { /* none */ }
   const lines = text.trimEnd().split("\n"); console.log(lines.slice(-n).join("\n") || "  (no log yet)"); process.exit(0);
 }
-if (arg === "off") {
+// The login service, removed: the file, the registration, and (unless we ARE the service) the listener.
+const removeService = () => {
   const def = serviceDef();
+  fs.rmSync(def.file, { force: true });
   if (process.platform === "darwin") spawnSync("launchctl", ["bootout", `gui/${process.getuid()}/${SERVICE_LABEL}`], { stdio: "ignore" });
   else if (process.platform === "linux") spawnSync("systemctl", ["--user", "disable", "--now", SERVICE_UNIT], { stdio: "ignore" });
   else spawnSync("reg", ["delete", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "/v", RUN_NAME, "/f"], { stdio: "ignore" });
-  fs.rmSync(def.file, { force: true });
+};
+if (arg === "off") {
+  removeService();
   const pid = killListener();
   // the browsers of an interrupted take go with it
   for (const c of readJson(CHILDREN) ?? []) { try { process.kill(process.platform === "win32" ? c : -c, "SIGTERM"); } catch { /* gone */ } }
@@ -562,8 +566,9 @@ if (arg === "listen") {
   // in the app (look phrases), its verdict posted as the job's result.
   const runLookOrSignin = async (job) => {
     const isLook = job.kind === "look";
-    const script = path.join(dest, "scripts", isLook ? "look.mjs" : "signin.mjs");
-    console.log(`\n  ${isLook ? "◉ Looking at" : "⚿ Sign-in at"} ${job.url}`);
+    const isOut = job.kind === "signout";
+    const script = path.join(dest, "scripts", isLook ? "look.mjs" : isOut ? "signout.mjs" : "signin.mjs");
+    console.log(`\n  ${isLook ? "◉ Looking at" : isOut ? "⊘ Signing out of" : "⚿ Sign-in at"} ${job.url}`);
     noteState({ busy: true, job: job.id });
     await event(job.id, "started", { machine: name });
     // Alive while the person signs in (a window can wait minutes): the heartbeat, or the rail calls this machine offline.
@@ -590,15 +595,35 @@ if (arg === "listen") {
     if (isLook) {
       if (verdict) await event(job.id, "looked", verdict);
       else await event(job.id, "failed", { message: "The look did not finish" });
+    } else if (isOut) {
+      if (code === 0) await event(job.id, "ready", { signedOut: true, url: job.url, ...(verdict ?? {}) });
+      else await event(job.id, "failed", { message: "The sign-out did not complete" });
     } else if (code === 0) await event(job.id, "ready", { signedIn: true, url: job.url });
     else await event(job.id, "failed", { message: "The sign-in did not complete" });
-    console.log(`  ■ ${isLook ? `Look: ${verdict?.access ?? "failed"}` : code === 0 ? "Signed in." : "Sign-in did not complete."}\n`);
+    console.log(`  ■ ${isLook ? `Look: ${verdict?.access ?? "failed"}` : isOut ? (code === 0 ? "Signed out." : "Sign-out did not complete.") : code === 0 ? "Signed in." : "Sign-in did not complete."}\n`);
     waitOn();
   };
 
+  // DISCONNECT FROM THE APP (1.21.0, founder 2026-10-16: "go back to the connected machine via my browser
+  // and disconnect"): the app's order, taken at check-in. Says so to the app first (the key is needed for
+  // that), then the sign-ins, the ledger and the key go from this machine, the login service is removed,
+  // and the process ends. `demobite on` with a new line from the app connects it again.
+  const runOff = async (job) => {
+    console.log(`\n  ⏏ Disconnecting this machine, on your word from the app.`);
+    noteState({ busy: true, job: job.id });
+    await event(job.id, "started", { machine: name });
+    await event(job.id, "ready", { disconnected: true, machine: name });
+    const rec = path.join(process.cwd(), ".recorder");
+    for (const f of ["profile", "signins.json", "config.json", "listen.json"]) fs.rmSync(path.join(rec, f), { recursive: true, force: true });
+    noteState({ busy: false, job: null, last_error: null, disconnected: true });
+    console.log(`  ○ Disconnected. The sign-ins and the key are gone from this machine; the login service is removed.`);
+    if (SERVICE) removeService(); // bootout ends this process; the handlers below clear the lock
+    bye("OFF");
+  };
   const runJob = async (job) => {
     waitOff();
-    if (job.kind === "look" || job.kind === "signin") return runLookOrSignin(job);
+    if (job.kind === "off") return runOff(job);
+    if (job.kind === "look" || job.kind === "signin" || job.kind === "signout") return runLookOrSignin(job);
     const model = typeof job.model === "string" && job.model ? job.model : JOB_MODEL;
     // Alive while filming (1.13.1): a heartbeat every 5 s so the rail never shows this machine
     // offline mid-take (the gap after the last step used to do exactly that).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobite",
-  "version": "1.19.1",
+  "version": "1.21.0",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"

package/skill/scripts/signout.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// SIGN OUT (founder 2026-10-16: "there should be an option to sign out… the credentials will be
+// removed"). The recorder films in its own Chrome profile (.recorder/profile), apart from the
+// person's browser. This script forgets ONE SITE in that profile: every cookie of the site and
+// its subdomains, the site's local storage, and the ledger entries (.recorder/signins.json) that
+// said the recorder was signed in there. The person's own browser is never touched.
+//
+//   node scripts/signout.mjs <url or host>
+//
+// A site is the registrable domain (app.acme.com and auth.acme.com are one site, as the cookies
+// are), so a sign-in made on one subdomain and used on another goes in one move. Headless: no
+// window, nothing to click. Prints one line; RESULT {…} for the listener.
+import fs from "node:fs";
+import path from "node:path";
+import { postEvent } from "./listen-event.mjs";
+
+const arg = process.argv[2];
+if (!arg) { console.error("Usage: node scripts/signout.mjs <url or host>"); process.exit(2); }
+let target;
+try { target = new URL(/^https?:\/\//i.test(arg) ? arg : `https://${arg}`); } catch { console.error("Not an address."); process.exit(2); }
+
+// The registrable domain, near enough: the last two labels, or three under a short second level
+// (co.uk, com.au). Local names and IPs stay as they are.
+const SLD = new Set(["co", "com", "net", "org", "gov", "edu", "ac"]);
+export const siteOf = (hostname) => {
+  const h = hostname.toLowerCase();
+  if (/^[\d.]+$/.test(h) || h === "localhost" || !h.includes(".")) return h;
+  const l = h.split(".");
+  if (l.length >= 3 && SLD.has(l[l.length - 2]) && l[l.length - 1].length === 2) return l.slice(-3).join(".");
+  return l.slice(-2).join(".");
+};
+const site = siteOf(target.hostname);
+const ofSite = (hostname) => { const h = String(hostname).replace(/^\./, "").toLowerCase(); return h === site || h.endsWith("." + site); };
+
+const ledgerPath = path.resolve(process.cwd(), ".recorder", "signins.json");
+let ledger = { origins: {} };
+try { ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8")); } catch { /* none */ }
+const origins = Object.keys(ledger.origins ?? {}).filter((o) => { try { return ofSite(new URL(o).hostname); } catch { return false; } });
+const visit = [...new Set([target.origin, ...origins])];
+
+const { chromium } = await import("playwright");
+const profileDir = process.env.RECORDER_PROFILE || path.resolve(process.cwd(), ".recorder", "profile");
+const launchOpts = {
+  headless: true,
+  viewport: { width: 1440, height: 900 },
+  args: ["--force-color-profile=srgb", "--disable-blink-features=AutomationControlled", "--disable-features=MediaRouter,DialMediaRouteProvider", "--disable-component-update", "--no-default-browser-check"],
+  ignoreDefaultArgs: ["--enable-automation"],
+};
+let ctx;
+try { ctx = await chromium.launchPersistentContext(profileDir, { ...launchOpts, channel: "chrome" }); }
+catch { ctx = await chromium.launchPersistentContext(profileDir, launchOpts); }
+const page = ctx.pages()[0] ?? (await ctx.newPage());
+
+// Storage first (a page load could set a fresh anonymous cookie), then every cookie of the site.
+let stores = 0;
+for (const o of visit) {
+  try {
+    await page.goto(o, { waitUntil: "domcontentloaded", timeout: 15000 });
+    await page.evaluate(async () => {
+      try { localStorage.clear(); } catch { /* opaque */ }
+      try { sessionStorage.clear(); } catch { /* opaque */ }
+      try { const dbs = (await indexedDB.databases?.()) ?? []; for (const d of dbs) if (d.name) indexedDB.deleteDatabase(d.name); } catch { /* none */ }
+    });
+    stores++;
+  } catch { /* unreachable now: the cookies still go */ }
+}
+const before = (await ctx.cookies()).filter((c) => ofSite(c.domain));
+try { await ctx.clearCookies({ domain: new RegExp(`(^|\\.)${site.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "i") }); }
+catch { for (const c of before) { try { await ctx.clearCookies({ name: c.name, domain: c.domain }); } catch { /* old playwright */ } } }
+const after = (await ctx.cookies()).filter((c) => ofSite(c.domain));
+await ctx.close();
+
+if (origins.length) {
+  for (const o of origins) delete ledger.origins[o];
+  try { fs.writeFileSync(ledgerPath, JSON.stringify(ledger, null, 2) + "\n"); } catch { /* the cookies are gone either way */ }
+}
+const cleared = before.length - after.length;
+console.log(`✓ Signed out of ${site} on this machine: ${cleared} cookie${cleared === 1 ? "" : "s"} cleared, ${stores} page store${stores === 1 ? "" : "s"} emptied${origins.length ? `, ${origins.length} saved sign-in${origins.length === 1 ? "" : "s"} forgotten` : ""}.`);
+await postEvent("signed_out", { site, origins, cleared });
+console.log("RESULT " + JSON.stringify({ site, origins, cleared, left: after.length }));
+process.exit(0);