demobites 1.24.0 → 1.26.0

package/launcher/index.mjs

@@ -510,10 +510,10 @@ if (arg === "listen") {
   writeJson(LOCK, { pid: process.pid, since: new Date().toISOString(), cwd: process.cwd(), service: SERVICE, repo });
   const noteState = (extra) => writeJson(STATE, { at: new Date().toISOString(), machine_id: listen.machine_id, name, base, workspace: cfg.workspace?.name ?? null, ...extra });
   const readiness = () => {
-    let signins = [];
-    try { signins = Object.keys(JSON.parse(fs.readFileSync(path.join(process.cwd(), ".recorder", "signins.json"), "utf8")).origins || {}); } catch { /* none */ }
+    let signins = [], whos = {};
+    try { const l = JSON.parse(fs.readFileSync(path.join(process.cwd(), ".recorder", "signins.json"), "utf8")); signins = Object.keys(l.origins || {}); whos = l.who && typeof l.who === "object" ? l.who : {}; } catch { /* none */ }
     const repos = Object.entries(readJson(reposFile(process.cwd())) ?? {}).filter(([, v]) => v && typeof v.folder === "string" && fs.existsSync(v.folder)).map(([site, v]) => ({ site, folder: v.folder, repo: v.repo ?? null }));
-    return { ...agentInfo, chrome: haveChrome, recorder: pkg.version, signins, cwd: process.cwd(), platform: process.platform, repo, repos };
+    return { ...agentInfo, chrome: haveChrome, recorder: pkg.version, signins, whos, cwd: process.cwd(), platform: process.platform, repo, repos };
   };
   // The code bound to a job's site (1.22.0): the planner reads there.
   const codeFor = (url) => { try { const site = siteOf(new URL(url).hostname); const b = (readJson(reposFile(process.cwd())) ?? {})[site]; return b && fs.existsSync(b.folder) ? { site, ...b } : null; } catch { return null; } };
@@ -700,7 +700,7 @@ if (arg === "listen") {
       await event(job.id, "started", { machine: name });
       const takeDir = path.join(process.cwd(), ".recorder", "takes", job.id);
       fs.mkdirSync(takeDir, { recursive: true });
-      fs.writeFileSync(path.join(takeDir, "job.json"), JSON.stringify({ id: job.id, brief: job.brief, url: job.url ?? null, model, review_storyboard: job.review_storyboard !== false, ...(job.retake_of ? { retake_of: job.retake_of, retake_note: job.retake_note ?? null, storyboard: job.storyboard ?? null } : {}) }, null, 2) + "\n");
+      fs.writeFileSync(path.join(takeDir, "job.json"), JSON.stringify({ id: job.id, brief: job.brief, url: job.url ?? null, model, review_storyboard: job.review_storyboard !== false, code_repo: job.code_repo ?? null, ...(job.retake_of ? { retake_of: job.retake_of, retake_note: job.retake_note ?? null, storyboard: job.storyboard ?? null } : {}) }, null, 2) + "\n");
       // Spawned async (1.14.1): a spawnSync here blocked the event loop, so the 5 s heartbeat never fired
       // during a take and the rail called the machine offline mid-recording (founder 2026-10-15 17:39).
       const bound = job.url ? codeFor(job.url) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobites",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobites": "launcher/index.mjs"

package/skill/scripts/plan.mjs

@@ -63,10 +63,23 @@ const rules = (() => { try { return JSON.parse(fs.readFileSync(path.resolve(".re
 // THE CODE FOLDER (1.22.0, founder 2026-10-16): the folder bound to this site with `demobite repo <site>`
 // (the listener passes it as DEMOBITES_CODE_DIR), else the folder the listener runs in.
 const CODE_DIR = process.env.DEMOBITES_CODE_DIR ? path.resolve(process.env.DEMOBITES_CODE_DIR) : process.cwd();
-const codeOn = !process.env.DEMOBITES_NO_CODE && spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { encoding: "utf8", cwd: CODE_DIR }).status === 0;
+// THE CODE ON GITHUB (1.25.0, founder 2026-10-17: "the game's going to be only GitHub"): when the job carries the
+// repository the workspace chose for its site, the files come from GitHub through the server (read-only, per
+// call, never stored here); the folder on this machine is not used for that site.
+const ghRepo = typeof job.code_repo === "string" && job.code_repo ? job.code_repo : null;
+const localOn = !process.env.DEMOBITES_NO_CODE && spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { encoding: "utf8", cwd: CODE_DIR }).status === 0;
+const codeOn = Boolean(ghRepo) || localOn;
+const codeApi = async (body) => {
+  try {
+    const res = await fetch(`${base}/api/recorder/agent/code`, { method: "PUT", headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.api_key}` }, body: JSON.stringify({ job_id: process.env.RECORDER_JOB, ...body }) });
+    const d = await res.json().catch(() => ({}));
+    return typeof d.text === "string" ? d.text : `(GitHub could not be read${d.error ? `: ${d.error}` : ""})`;
+  } catch (e) { return `(GitHub could not be read: ${e.message})`; }
+};
 const SECRET_RE = /(^|\/)(\.env(\..*)?|.*\.(pem|key|p12|pfx|crt)|.*secret.*|.*credential.*|\.recorder\/.*|node_modules\/.*|\.git\/.*|.*\.lock|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)$/i;
 const UI_RE = /(^|\/)(app|pages|routes|src|components|views|screens|navigation|nav|layouts?|lib\/(nav|routes|menu))(\/|$)|(^|\/)(route|router|routes|nav|navigation|sidebar|menu|layout|page)\.[jt]sx?$|\/page\.[jt]sx?$|\/layout\.[jt]sx?$|\/route\.[jt]s$/i;
-const listFiles = () => {
+const listFiles = async () => {
+  if (ghRepo) return codeApi({ action: "list" });
   if (!codeOn) return "(no repository here, or code sharing is off)";
   const r = spawnSync("git", ["ls-files"], { encoding: "utf8", maxBuffer: 32 * 1024 * 1024, cwd: CODE_DIR });
   if (r.status !== 0) return "(no repository here)";
@@ -77,7 +90,8 @@ const listFiles = () => {
 };
 let reads = 0;
 const shared = [];
-const readFile = (rel) => {
+const readFile = async (rel) => {
+  if (ghRepo) return codeApi({ action: "read", path: rel });
   if (!codeOn) return "Code sharing is off on this machine.";
   if (typeof rel !== "string" || !rel.trim()) return "path required";
   const abs = path.resolve(CODE_DIR, rel);
@@ -192,14 +206,14 @@ const prune = (messages) => {
   }
 };
 
-const firstMessage = () => {
+const firstMessage = async () => {
   const vocab = startUrl ? harvest([startUrl]) : "(no starting address was given: find it from the brief, the code or by looking)";
   const parts = [
     `## The brief\n${job.brief}`,
     `## Starting address\n${startUrl || "(none given)"}`,
     `## The app's words on the starting screen\n${vocab}`,
     `## Workspace rules (version ${rules.version || 0})\n${rules.lines?.length ? rules.lines.map((l, i) => `${i + 1}. ${l}`).join("\n") : "(none)"}`,
-    `## The project's files${codeOn ? " (this machine sits in the app's repository; read_file is on)" : " (no code here)"}\n${listFiles()}`,
+    `## The project's files${ghRepo ? ` (the app's repository on GitHub, ${ghRepo}; read_file reads them there)` : codeOn ? " (this machine sits in the app's repository; read_file is on)" : " (no code here)"}\n${await listFiles()}`,
     // A RETAKE (founder 2026-10-15): the same demo again, because the app changed under it. The previous
     // storyboard is the base; the note says what to keep an eye on; the probe finds what moved.
     job.retake_of && job.storyboard
@@ -211,7 +225,7 @@ const firstMessage = () => {
 
 let storyboard = null;
 let creates = "";
-const messages = [{ role: "user", content: [{ type: "text", text: firstMessage() }] }];
+const messages = [{ role: "user", content: [{ type: "text", text: await firstMessage() }] }];
 const plan = async () => {
   say("Writing the storyboard…");
   storyboard = null;
@@ -236,8 +250,8 @@ const plan = async () => {
       let out;
       try {
         const where = (u) => { try { const x = new URL(u); return (x.pathname === "/" ? x.host : x.pathname).slice(0, 60); } catch { return String(u || "").slice(0, 60); } };
-        if (u.name === "list_files") { say("Listing the project's files…"); out = listFiles(); }
-        else if (u.name === "read_file") { say(`Reading ${String(input.path || "").slice(0, 80)}…`); out = readFile(input.path); }
+        if (u.name === "list_files") { say(ghRepo ? `Listing the files of ${ghRepo} on GitHub…` : "Listing the project's files…"); out = await listFiles(); }
+        else if (u.name === "read_file") { say(`Reading ${String(input.path || "").slice(0, 80)}${ghRepo ? " on GitHub" : ""}…`); out = await readFile(input.path); }
         else if (u.name === "harvest_words") { say(`Reading the app's own words on ${(input.urls || []).length} page${(input.urls || []).length === 1 ? "" : "s"}…`); out = harvest(input.urls); }
         else if (u.name === "explore") { say(`Walking the app from ${where(input.from)}, looking for ${String(input.looking_for || "the brief's words").slice(0, 60)}…`); out = explore(input.from, input.looking_for, input.depth); }
         else if (u.name === "screenshot") { say(`Looking at ${where(input.url)}…`); out = screenshot(input.url); }

package/skill/scripts/signin.mjs

@@ -101,13 +101,54 @@ const wallCheck = async () => {
     });
   } catch { return { wall: true }; }
 };
+// WHO SIGNED IN (1.26.0, founder 2026-10-17: "three different users sign in, three tabs… get some data about
+// the signed-in email or username"): never a credential, only what the app itself shows once you are in —
+// an email in the page, an account menu's label, the address a Google chooser was told. Best effort; null
+// is fine. It goes to the ledger beside the origin and to the app as `who`.
+let chooserEmail = null;
+const whoAmI = async () => {
+  try {
+    await page.waitForTimeout(2500);
+    const found = await page.evaluate(() => {
+      const EMAIL = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+      const pick = (s) => { const m = String(s || "").match(EMAIL); return m ? m[0] : null; };
+      const attrs = [];
+      for (const el of document.querySelectorAll("[aria-label], [title], img[alt], [data-email], [data-user-email]")) {
+        for (const a of ["aria-label", "title", "alt", "data-email", "data-user-email"]) { const v = el.getAttribute(a); if (v) attrs.push(v); }
+      }
+      for (const v of attrs) { const e = pick(v); if (e) return { email: e }; }
+      const text = document.body?.innerText || "";
+      const e = pick(text);
+      if (e) return { email: e };
+      for (const v of attrs) if (/account|profile|avatar|signed in as|logged in as|user menu/i.test(v)) { const name = v.replace(/^(open|toggle)\s+/i, "").replace(/\s*(menu|avatar|profile|account)\s*$/i, "").trim(); if (name && name.length <= 60 && !/^(account|profile|avatar|user)$/i.test(name)) return { name }; }
+      return null;
+    });
+    if (found?.email) return found.email.toLowerCase();
+    if (chooserEmail) return chooserEmail;
+    if (found?.name) return found.name;
+  } catch { /* nothing */ }
+  return chooserEmail;
+};
+const noteChooser = async (here) => {
+  if (!/accounts\.google\.com|login\.microsoftonline\.com|okta\.com|auth0\.com/i.test(here.host)) return;
+  try {
+    const v = await page.evaluate(() => {
+      const el = document.querySelector("[data-identifier], [data-email], input[type=email], #identifierId, input[name=loginfmt]");
+      const s = el?.getAttribute?.("data-identifier") || el?.getAttribute?.("data-email") || el?.value || "";
+      const m = String(s).match(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i); return m ? m[0] : null;
+    });
+    if (v) chooserEmail = v.toLowerCase();
+  } catch { /* nothing */ }
+};
+const remember = (origin, who) => { try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [origin]: new Date().toISOString() }; if (who) l.who = { ...(l.who ?? {}), [origin]: who }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* the session still lives in the profile */ } };
 await page.waitForTimeout(4000);
 const first = await wallCheck();
 if (!first.wall) {
   const origin = new URL(page.url()).origin;
   console.log(`✓ No sign-in needed for ${origin}.`);
-  try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [origin]: new Date().toISOString() }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* fine */ }
-  await postEvent("signed_in", { origin, none: true });
+  const who = await whoAmI();
+  remember(origin, who);
+  await postEvent("signed_in", { origin, none: true, ...(who ? { who } : {}) });
   await ctx.close();
   process.exit(0);
 }
@@ -119,10 +160,12 @@ while (Date.now() - started < timeoutMs) {
   await page.waitForTimeout(1000);
   let here;
   try { here = new URL(page.url()); } catch { continue; }
-  if (here.pathname !== startPath && !/sign-?in|log-?in|auth|sso|oauth|callback/i.test(here.pathname)) {
-    console.log(`✓ Signed in. The session is saved for ${here.origin}; next time there is no question and no window.`);
-    await postEvent("signed_in", { origin: here.origin });
-    try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [here.origin]: new Date().toISOString() }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* the session still lives in the profile */ }
+  await noteChooser(here);
+  if (here.pathname !== startPath && !/sign-?in|log-?in|auth|sso|oauth|callback/i.test(here.pathname) && !/accounts\.google\.com|login\.microsoftonline\.com|okta\.com|auth0\.com/i.test(here.host)) {
+    const who = await whoAmI();
+    console.log(`✓ Signed in${who ? ` as ${who}` : ""}. The session is saved for ${here.origin}; next time there is no question and no window.`);
+    await postEvent("signed_in", { origin: here.origin, ...(who ? { who } : {}) });
+    remember(here.origin, who);
     await ctx.close();
     process.exit(0);
   }