dirpush 0.1.4 → 0.1.6

package/.agents/skills/dirpush/references/authentication.md

@@ -13,14 +13,14 @@ Always drive the browser through `dirpush ab` (agent-browser on the agents' own
 
 ## Creating a password without ever seeing it
 
-Generate, fill, and store in **one** shell command so the secret never appears in your context or in any file:
+With the sign-up (or reset) page open in `dirpush ab`, one command generates the password, types it into every field you name, checks the site got it, and saves it to the vault. It never appears in your context or any file:
 
 ```bash
-PW=$(openssl rand -base64 18) && dirpush ab fill @<password-ref> "$PW" && \
-  printf %s "$PW" | agent-browser auth save <directory-id>-<product-id> --url <login-url> --username <email> --password-stdin && unset PW
+dirpush browser password <directory-id>-<product-id> --url <this page's url> --username <email> \
+  [--login-url <the site's sign-in page>] '<password selector>' ['<confirm selector>']
 ```
 
-(Repeat the `fill` for a "confirm password" field inside the same command.) Before `auth save`, check the fields really hold it, e.g. `agent-browser eval '[...document.querySelectorAll("input[type=password]")].map(p=>p.value.length)'` → all 24. A `fill` can report success on a selector that matched nothing, leaving a vault entry for a password the site never got.
+Passwords always have upper, lower, digit and symbol (24 chars). Pass `--login-url` whenever the page isn't the sign-in page (a sign-up form, a reset link): the vault opens that URL for every later `browser login`. Never generate passwords yourself (`openssl rand -base64` can lack a symbol, and sites reject it).
 
 ## Continue with Google (`accounts.oauth_google`)
 

package/package.json

@@ -37,7 +37,7 @@
     "url": "https://github.com/baronunread/dirpush.git"
   },
   "homepage": "https://dirpush.com",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "keywords": [
     "directories",
     "startup",

package/src/browser.ts

@@ -78,8 +78,22 @@ export async function stopBrowser() {
   return { stopped: true };
 }
 
+/**
+ * The CDP port of the agents' Chrome: the one `browser start` runs on BROWSER_PORT, else the one `dirpush ab` launched
+ * through agent-browser (its port is in the profile's DevToolsActivePort file). Only a live port counts.
+ */
+async function agentsChromePort() {
+  const live = async (port: number) => fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(1500) }).then((r) => r.ok, () => false);
+  if (await live(BROWSER_PORT)) return BROWSER_PORT;
+  const file = Bun.file(join(PROFILE, "DevToolsActivePort"));
+  const port = (await file.exists()) ? Number((await file.text()).split("\n")[0]) : NaN;
+  if (port && (await live(port))) return port;
+  throw new Error("the agents' browser is not open: open the page with 'dirpush ab open <url>' first");
+}
+let cdpPort = BROWSER_PORT;
+
 function ab(args: string[], stdin?: string) {
-  const p = Bun.spawnSync(["agent-browser", "--session", SECRETS_SESSION, "--cdp", String(BROWSER_PORT), ...args], { stdin: stdin === undefined ? "ignore" : Buffer.from(stdin), stdout: "pipe", stderr: "pipe", timeout: 60_000 });
+  const p = Bun.spawnSync(["agent-browser", "--session", SECRETS_SESSION, "--cdp", String(cdpPort), ...args], { stdin: stdin === undefined ? "ignore" : Buffer.from(stdin), stdout: "pipe", stderr: "pipe", timeout: 60_000 });
   const out = p.stdout.toString().trim();
   if (p.exitCode !== 0) throw new Error(`agent-browser ${args[0]} failed: ${(p.stderr.toString() || out).trim().slice(0, 300)}`);
   return out;
@@ -88,8 +102,9 @@ function ab(args: string[], stdin?: string) {
 /** The open tab on `site`'s host (the one the agent is working in); the most recently active one if several. */
 async function pageOn(site: string) {
   const host = new URL(site.includes("://") ? site : `https://${site}`).hostname.replace(/^www\./, "");
-  if (!(await browserStatus()).running) throw new Error("the browser is not running: launch browser start");
-  const page = (await json<Target[]>("/json/list")).find((t) => t.type === "page" && /^https?:/.test(t.url) && new URL(t.url).hostname.replace(/^www\./, "").endsWith(host));
+  cdpPort = await agentsChromePort();
+  const list = (await (await fetch(`http://127.0.0.1:${cdpPort}/json/list`, { signal: AbortSignal.timeout(1500) })).json()) as Target[];
+  const page = list.find((t) => t.type === "page" && /^https?:/.test(t.url) && new URL(t.url).hostname.replace(/^www\./, "").endsWith(host));
   if (!page) throw new Error(`no open tab on ${host}; open the login/sign-up page first`);
   ab(["tab", page.id]);
   return page;
@@ -97,6 +112,7 @@ async function pageOn(site: string) {
 
 /** Fills a saved login (agent-browser vault) into the open tab on that site. The password never leaves the vault. */
 export async function vaultLogin(name: string) {
+  cdpPort = await agentsChromePort();
   const meta = JSON.parse(ab(["auth", "show", name, "--json"])) as { data?: { profile?: { url?: string } } };
   const url = meta.data?.profile?.url;
   if (!url) throw new Error(`vault entry ${name} has no login URL`);
@@ -105,19 +121,31 @@ export async function vaultLogin(name: string) {
   return { vault: name, page: page.url.slice(0, 200), filled: true };
 }
 
+/** 24 random characters with every class sites ask for (upper, lower, digit, symbol), symbols that forms accept. */
+export function strongPassword() {
+  const sets = ["ABCDEFGHJKLMNPQRSTUVWXYZ", "abcdefghijkmnopqrstuvwxyz", "23456789", "!@#%^*-_=+?"];
+  const all = sets.join("");
+  const pick = (set: string, b: number) => set[b % set.length]!;
+  const bytes = randomBytes(32);
+  const chars = [...sets.map((set, i) => pick(set, bytes[i]!)), ...Array.from({ length: 20 }, (_, i) => pick(all, bytes[i + 4]!))];
+  for (let i = chars.length - 1; i > 0; i--) { const j = bytes[(i + 8) % 32]! % (i + 1); [chars[i], chars[j]] = [chars[j]!, chars[i]!]; }
+  return chars.join("");
+}
+
 /**
  * New account password: generated here, typed into every given field of the open tab on `url`'s site, checked,
  * then saved to the vault as `name`. Returns no secret.
  */
-export async function newPassword(name: string, url: string, username: string, selectors: string[]) {
+export async function newPassword(name: string, url: string, username: string, selectors: string[], loginUrl = url) {
   if (!selectors.length) throw new Error("pass the password field selector(s), e.g. 'input[type=password]'");
   const page = await pageOn(url);
-  const pw = randomBytes(18).toString("base64");
+  const pw = strongPassword();
   for (const s of selectors) ab(["fill", s, pw]);
   // A fill can "succeed" on a selector that matched nothing; never save a password the site didn't get.
   const lengths = JSON.parse(ab(["eval", `JSON.stringify(${JSON.stringify(selectors)}.map((s) => document.querySelector(s)?.value.length ?? -1))`]));
   const got = (typeof lengths === "string" ? JSON.parse(lengths) : lengths) as number[];
   if (got.some((n) => n !== pw.length)) throw new Error(`password fields not filled (lengths ${got.join(", ")}); nothing saved`);
-  ab(["auth", "save", name, "--url", url, "--username", username, "--password-stdin"], pw);
+  // The vault keeps the sign-in page: `browser login` opens on it later, so a reset or sign-up URL there breaks logins.
+  ab(["auth", "save", name, "--url", loginUrl, "--username", username, "--password-stdin"], pw);
   return { vault: name, username, fields: selectors.length, page: page.url.slice(0, 200), saved: true };
 }

package/src/cli.ts

@@ -79,6 +79,7 @@ const { values: flags, positionals } = parseArgs({
     source: { type: "string" },
     job: { type: "string" },
     url: { type: "string" },
+    "login-url": { type: "string" },
     username: { type: "string" },
     rel: { type: "string" }, // registry set-link
     samples: { type: "string" },
@@ -655,8 +656,8 @@ const commands: Record<string, (() => Promise<unknown> | unknown) | undefined> =
   "browser stop": () => stopBrowser(),
   "browser login": () => vaultLogin(arg(0, "vault-name")),
   "browser password": () => {
-    if (!flags.url || !flags.username) throw new Error("browser password <vault-name> --url <login-url> --username <email> <field-selector…>");
-    return newPassword(arg(0, "vault-name"), flags.url, flags.username, args.slice(1));
+    if (!flags.url || !flags.username) throw new Error("browser password <vault-name> --url <page-url> --username <email> [--login-url <sign-in page>] <field-selector…>");
+    return newPassword(arg(0, "vault-name"), flags.url, flags.username, args.slice(1), flags["login-url"]);
   },
   async "serve"() {
     const { serve } = await import("./server");
@@ -730,7 +731,7 @@ const HELP: [string, [string, string][]][] = [
     ["google-login", "the human signs into Google once in the agents' Chrome profile"],
     ["browser start | status | stop", "the dedicated Chrome (real profile, Google services blocked) agents drive"],
     ["browser login <vault-name>", "fill a saved login into the open tab on that site (password never shown)"],
-    ["browser password <vault-name> --url u --username e <selector…>", "new account: generate, fill, verify and save a password (never shown)"],
+    ["browser password <vault-name> --url u --username e [--login-url u] <selector…>", "new password (sign-up or reset): generate, fill, verify and save it (never shown); --login-url when the page isn't the sign-in page (e.g. a reset link)"],
   ]],
   ["Other", [
     ["dr show | dr refresh [--all]", "Domain Rating history (refresh needs AHREFS_API_KEY)"],