demobites 1.25.0 → 1.27.0

package/launcher/index.mjs

@@ -509,11 +509,41 @@ if (arg === "listen") {
   })();
   writeJson(LOCK, { pid: process.pid, since: new Date().toISOString(), cwd: process.cwd(), service: SERVICE, repo });
   const noteState = (extra) => writeJson(STATE, { at: new Date().toISOString(), machine_id: listen.machine_id, name, base, workspace: cfg.workspace?.name ?? null, ...extra });
+  // PERSONAS (1.27.0, founder 2026-10-17: "the same domain, but three different users sign in, so three tabs"):
+  // a tab's jobs run in the tab's own Chrome profile, seeded once from the machine's profile (so what was
+  // signed in stays), with its own ledger. The server names the profile on the job ("t12"); none = the machine's.
+  const SKIP_IN_PROFILE = /^(Singleton|lockfile$|.*Cache$|Crashpad$|BrowserMetrics|Safe Browsing|component_crx_cache|extensions_crx_cache)/i;
+  const rec = () => path.join(process.cwd(), ".recorder");
+  const profileFor = (job) => {
+    const key = typeof job?.profile === "string" && /^[a-z0-9_-]{1,40}$/i.test(job.profile) ? job.profile : null;
+    if (!key) return {};
+    const dir = path.join(rec(), "profiles", key);
+    const ledger = path.join(rec(), "sessions", `${key}.json`);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+      const base = path.join(rec(), "profile");
+      if (fs.existsSync(base)) { try { fs.cpSync(base, dir, { recursive: true, force: true, filter: (src) => !SKIP_IN_PROFILE.test(path.basename(src)) }); } catch (e) { console.log(`  ! profile seed: ${e.message}`); } }
+      fs.mkdirSync(path.dirname(ledger), { recursive: true });
+      if (!fs.existsSync(ledger)) { try { fs.copyFileSync(path.join(rec(), "signins.json"), ledger); } catch { fs.writeFileSync(ledger, JSON.stringify({ origins: {} }, null, 2) + "\n"); } }
+      console.log(`  · a profile of its own for this tab (${key}), seeded from the machine's`);
+    }
+    return { RECORDER_PROFILE: dir, RECORDER_LEDGER: ledger };
+  };
   const readiness = () => {
-    let signins = [];
-    try { signins = Object.keys(JSON.parse(fs.readFileSync(path.join(process.cwd(), ".recorder", "signins.json"), "utf8")).origins || {}); } catch { /* none */ }
+    let signins = [], whos = {};
+    try { const l = JSON.parse(fs.readFileSync(path.join(process.cwd(), ".recorder", "signins.json"), "utf8")); signins = Object.keys(l.origins || {}); whos = l.who && typeof l.who === "object" ? l.who : {}; } catch { /* none */ }
+    // Every session on this machine, by profile: the machine's own, then each tab's.
+    const sessions = [];
+    for (const o of signins) sessions.push({ profile: "default", origin: o, who: whos[o] ?? null });
+    try {
+      const dir = path.join(process.cwd(), ".recorder", "sessions");
+      for (const f of fs.existsSync(dir) ? fs.readdirSync(dir) : []) {
+        if (!f.endsWith(".json")) continue;
+        try { const l = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8")); const key = f.slice(0, -5); for (const o of Object.keys(l.origins || {})) sessions.push({ profile: key, origin: o, who: l.who?.[o] ?? null }); } catch { /* skip */ }
+      }
+    } catch { /* none */ }
     const repos = Object.entries(readJson(reposFile(process.cwd())) ?? {}).filter(([, v]) => v && typeof v.folder === "string" && fs.existsSync(v.folder)).map(([site, v]) => ({ site, folder: v.folder, repo: v.repo ?? null }));
-    return { ...agentInfo, chrome: haveChrome, recorder: pkg.version, signins, cwd: process.cwd(), platform: process.platform, repo, repos };
+    return { ...agentInfo, chrome: haveChrome, recorder: pkg.version, signins, whos, sessions, cwd: process.cwd(), platform: process.platform, repo, repos };
   };
   // The code bound to a job's site (1.22.0): the planner reads there.
   const codeFor = (url) => { try { const site = siteOf(new URL(url).hostname); const b = (readJson(reposFile(process.cwd())) ?? {})[site]; return b && fs.existsSync(b.folder) ? { site, ...b } : null; } catch { return null; } };
@@ -624,7 +654,7 @@ if (arg === "listen") {
     // Alive while the person signs in (a window can wait minutes): the heartbeat, or the rail calls this machine offline.
     const heartbeat = setInterval(() => { void api({ action: "checkin", machine_id: listen.machine_id, name, readiness: readiness(), busy: true }); }, 5000);
     const { spawn } = await import("node:child_process");
-    const child = spawn(process.execPath, [script, job.url], { cwd: process.cwd(), env: { ...process.env, RECORDER_JOB: job.id, RECORDER_BASE: base, RECORDER_LISTEN: "1" }, stdio: ["ignore", "pipe", "pipe"], detached: process.platform !== "win32" });
+    const child = spawn(process.execPath, [script, job.url, ...(job.fresh && !isLook && !isOut ? ["--fresh"] : [])], { cwd: process.cwd(), env: { ...process.env, RECORDER_JOB: job.id, RECORDER_BASE: base, RECORDER_LISTEN: "1", ...profileFor(job) }, stdio: ["ignore", "pipe", "pipe"], detached: process.platform !== "win32" });
     track(child);
     let verdict = null;
     let buf = "";
@@ -664,7 +694,7 @@ if (arg === "listen") {
     await event(job.id, "started", { machine: name });
     await event(job.id, "ready", { disconnected: true, machine: name });
     const rec = path.join(process.cwd(), ".recorder");
-    for (const f of ["profile", "signins.json", "config.json", "listen.json"]) fs.rmSync(path.join(rec, f), { recursive: true, force: true });
+    for (const f of ["profile", "profiles", "sessions", "signins.json", "config.json", "listen.json"]) fs.rmSync(path.join(rec, f), { recursive: true, force: true });
     noteState({ busy: false, job: null, last_error: null, disconnected: true });
     console.log(`  ○ Disconnected. The sign-ins and the key are gone from this machine; the login service is removed.`);
     if (SERVICE) removeService(); // bootout ends this process; the handlers below clear the lock
@@ -705,7 +735,7 @@ if (arg === "listen") {
       // during a take and the rail called the machine offline mid-recording (founder 2026-10-15 17:39).
       const bound = job.url ? codeFor(job.url) : null;
       if (bound) console.log(`  Code: ${bound.repo ?? bound.site} (${bound.folder.replace(os.homedir(), "~")})`);
-      const child = (await import("node:child_process")).spawn(process.execPath, [path.join(dest, "scripts", "plan.mjs"), takeDir], { cwd: process.cwd(), stdio: "inherit", env: { ...process.env, RECORDER_JOB: job.id, RECORDER_BASE: base, RECORDER_LISTEN: "1", ...(bound ? { DEMOBITES_CODE_DIR: bound.folder } : {}) }, detached: process.platform !== "win32" });
+      const child = (await import("node:child_process")).spawn(process.execPath, [path.join(dest, "scripts", "plan.mjs"), takeDir], { cwd: process.cwd(), stdio: "inherit", env: { ...process.env, RECORDER_JOB: job.id, RECORDER_BASE: base, RECORDER_LISTEN: "1", ...(bound ? { DEMOBITES_CODE_DIR: bound.folder } : {}), ...profileFor(job) }, detached: process.platform !== "win32" });
       track(child);
       const code = await new Promise((resolve) => child.on("close", resolve));
       const st = await api({ action: "poll", job_id: job.id });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobites",
-  "version": "1.25.0",
+  "version": "1.27.0",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobites": "launcher/index.mjs"

package/skill/scripts/look.mjs

@@ -20,7 +20,7 @@ const host = target.host;
 say(`Knocking on ${host}…`);
 
 let ledger = {};
-try { ledger = JSON.parse(fs.readFileSync(path.resolve(process.cwd(), ".recorder", "signins.json"), "utf8")).origins ?? {}; } catch { /* none yet */ }
+try { ledger = JSON.parse(fs.readFileSync(process.env.RECORDER_LEDGER ? path.resolve(process.env.RECORDER_LEDGER) : path.resolve(process.cwd(), ".recorder", "signins.json"), "utf8")).origins ?? {}; } catch { /* none yet */ }
 
 const { chromium } = await import("playwright");
 const profileDir = process.env.RECORDER_PROFILE || path.resolve(process.cwd(), ".recorder", "profile");

package/skill/scripts/signin.mjs

@@ -29,7 +29,9 @@ import path from "node:path";
 import { postEvent } from "./listen-event.mjs";
 
 const argv = process.argv.slice(2);
-const ledgerPath = path.resolve(process.cwd(), ".recorder", "signins.json");
+// PERSONAS (1.27.0, founder 2026-10-17: "three different users sign in, three tabs"): a tab has its own profile
+// and its own ledger (RECORDER_PROFILE / RECORDER_LEDGER from the listener); the defaults are the machine's.
+const ledgerPath = process.env.RECORDER_LEDGER ? path.resolve(process.env.RECORDER_LEDGER) : path.resolve(process.cwd(), ".recorder", "signins.json");
 const readLedger = () => { try { return JSON.parse(fs.readFileSync(ledgerPath, "utf8")); } catch { return { origins: {} }; } };
 if (argv[0] === "--check") {
   let origin; try { origin = new URL(argv[1]).origin; } catch { console.error("Usage: node scripts/signin.mjs --check <url>"); process.exit(2); }
@@ -41,6 +43,8 @@ const { chromium } = await import("playwright"); // after --check, which needs n
 const url = argv.find((a) => !a.startsWith("--"));
 if (!url) { console.error("Usage: node scripts/signin.mjs <login url> [--timeout <ms>] [--probe]"); process.exit(2); }
 const probe = argv.includes("--probe");
+// --fresh: sign in as a different user — the site's cookies in THIS profile go first, so the wall shows.
+const fresh = argv.includes("--fresh");
 const timeoutMs = Number(argv[argv.indexOf("--timeout") + 1]) || 10 * 60 * 1000;
 const profileDir = process.env.RECORDER_PROFILE || path.resolve(process.cwd(), ".recorder", "profile");
 
@@ -60,6 +64,15 @@ try {
   ctx = await chromium.launchPersistentContext(profileDir, launchOpts);
 }
 const page = ctx.pages()[0] ?? (await ctx.newPage());
+if (fresh) {
+  try {
+    const host = new URL(url).hostname;
+    const site = host.split(".").slice(-2).join(".");
+    await ctx.clearCookies({ domain: new RegExp(`(^|\\.)${site.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "i") });
+    try { const l = readLedger(); for (const o of Object.keys(l.origins ?? {})) { try { if (new URL(o).hostname.endsWith(site)) { delete l.origins[o]; if (l.who) delete l.who[o]; } } catch { /* skip */ } } fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* fine */ }
+    console.log(`· Forgot ${site} in this tab's profile; sign in as the other user.`);
+  } catch { /* the wall may still show */ }
+}
 await page.goto(url, { waitUntil: "domcontentloaded" });
 const startPath = new URL(page.url()).pathname;
 
@@ -101,13 +114,54 @@ const wallCheck = async () => {
     });
   } catch { return { wall: true }; }
 };
+// WHO SIGNED IN (1.26.0, founder 2026-10-17: "three different users sign in, three tabs… get some data about
+// the signed-in email or username"): never a credential, only what the app itself shows once you are in —
+// an email in the page, an account menu's label, the address a Google chooser was told. Best effort; null
+// is fine. It goes to the ledger beside the origin and to the app as `who`.
+let chooserEmail = null;
+const whoAmI = async () => {
+  try {
+    await page.waitForTimeout(2500);
+    const found = await page.evaluate(() => {
+      const EMAIL = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+      const pick = (s) => { const m = String(s || "").match(EMAIL); return m ? m[0] : null; };
+      const attrs = [];
+      for (const el of document.querySelectorAll("[aria-label], [title], img[alt], [data-email], [data-user-email]")) {
+        for (const a of ["aria-label", "title", "alt", "data-email", "data-user-email"]) { const v = el.getAttribute(a); if (v) attrs.push(v); }
+      }
+      for (const v of attrs) { const e = pick(v); if (e) return { email: e }; }
+      const text = document.body?.innerText || "";
+      const e = pick(text);
+      if (e) return { email: e };
+      for (const v of attrs) if (/account|profile|avatar|signed in as|logged in as|user menu/i.test(v)) { const name = v.replace(/^(open|toggle)\s+/i, "").replace(/\s*(menu|avatar|profile|account)\s*$/i, "").trim(); if (name && name.length <= 60 && !/^(account|profile|avatar|user)$/i.test(name)) return { name }; }
+      return null;
+    });
+    if (found?.email) return found.email.toLowerCase();
+    if (chooserEmail) return chooserEmail;
+    if (found?.name) return found.name;
+  } catch { /* nothing */ }
+  return chooserEmail;
+};
+const noteChooser = async (here) => {
+  if (!/accounts\.google\.com|login\.microsoftonline\.com|okta\.com|auth0\.com/i.test(here.host)) return;
+  try {
+    const v = await page.evaluate(() => {
+      const el = document.querySelector("[data-identifier], [data-email], input[type=email], #identifierId, input[name=loginfmt]");
+      const s = el?.getAttribute?.("data-identifier") || el?.getAttribute?.("data-email") || el?.value || "";
+      const m = String(s).match(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i); return m ? m[0] : null;
+    });
+    if (v) chooserEmail = v.toLowerCase();
+  } catch { /* nothing */ }
+};
+const remember = (origin, who) => { try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [origin]: new Date().toISOString() }; if (who) l.who = { ...(l.who ?? {}), [origin]: who }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* the session still lives in the profile */ } };
 await page.waitForTimeout(4000);
 const first = await wallCheck();
 if (!first.wall) {
   const origin = new URL(page.url()).origin;
   console.log(`✓ No sign-in needed for ${origin}.`);
-  try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [origin]: new Date().toISOString() }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* fine */ }
-  await postEvent("signed_in", { origin, none: true });
+  const who = await whoAmI();
+  remember(origin, who);
+  await postEvent("signed_in", { origin, none: true, ...(who ? { who } : {}) });
   await ctx.close();
   process.exit(0);
 }
@@ -119,10 +173,12 @@ while (Date.now() - started < timeoutMs) {
   await page.waitForTimeout(1000);
   let here;
   try { here = new URL(page.url()); } catch { continue; }
-  if (here.pathname !== startPath && !/sign-?in|log-?in|auth|sso|oauth|callback/i.test(here.pathname)) {
-    console.log(`✓ Signed in. The session is saved for ${here.origin}; next time there is no question and no window.`);
-    await postEvent("signed_in", { origin: here.origin });
-    try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [here.origin]: new Date().toISOString() }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* the session still lives in the profile */ }
+  await noteChooser(here);
+  if (here.pathname !== startPath && !/sign-?in|log-?in|auth|sso|oauth|callback/i.test(here.pathname) && !/accounts\.google\.com|login\.microsoftonline\.com|okta\.com|auth0\.com/i.test(here.host)) {
+    const who = await whoAmI();
+    console.log(`✓ Signed in${who ? ` as ${who}` : ""}. The session is saved for ${here.origin}; next time there is no question and no window.`);
+    await postEvent("signed_in", { origin: here.origin, ...(who ? { who } : {}) });
+    remember(here.origin, who);
     await ctx.close();
     process.exit(0);
   }

package/skill/scripts/signout.mjs

@@ -32,7 +32,7 @@ export const siteOf = (hostname) => {
 const site = siteOf(target.hostname);
 const ofSite = (hostname) => { const h = String(hostname).replace(/^\./, "").toLowerCase(); return h === site || h.endsWith("." + site); };
 
-const ledgerPath = path.resolve(process.cwd(), ".recorder", "signins.json");
+const ledgerPath = process.env.RECORDER_LEDGER ? path.resolve(process.env.RECORDER_LEDGER) : path.resolve(process.cwd(), ".recorder", "signins.json");
 let ledger = { origins: {} };
 try { ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8")); } catch { /* none */ }
 const origins = Object.keys(ledger.origins ?? {}).filter((o) => { try { return ofSite(new URL(o).hostname); } catch { return false; } });