dsh-builtin-browser 0.1.22 → 0.2.0

package/src/browser-electron/history-store.ts

@@ -0,0 +1,162 @@
+/**
+ * Persistent browsing history: which pages the shared browser actually visited,
+ * kept independently from any session's operation log (`browser_history`) and
+ * from the browser process's lifetime.
+ *
+ * It lives beside the browser profile (`$DSH_HOME/dsh-builtin-browser-host/
+ * history.jsonl`), so it follows the same persistence rules as the login state:
+ * closing the interface releases the process, never the record.
+ *
+ * Format: one JSON object per line, append-only. Appending stays cheap for a
+ * long session, and a half-written tail (crash, power loss) is dropped on read
+ * instead of poisoning the whole file.
+ * @module dsh-browser/browser-electron/history-store
+ */
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import type { VisitedPage } from '../browser/types.js'
+
+export type { VisitedPage }
+
+/** Retention limits; whichever is hit first starts trimming. */
+export interface HistoryLimits {
+  /** Maximum retained entries. Default 5000. */
+  readonly maxEntries?: number
+  /** Maximum age in days. Default 90. */
+  readonly maxAgeDays?: number
+}
+
+/** Default entry cap — mirrors the documented retention rule. */
+const DEFAULT_MAX_ENTRIES = 5_000
+/** Default age cap in days. */
+const DEFAULT_MAX_AGE_DAYS = 90
+/** Rewrite the file only once it has grown this far past the cap. */
+const PRUNE_SLACK = 500
+
+/**
+ * Absolute path of the browsing-history file, beside the browser profile so the
+ * record shares the login state's persistence rules.
+ * @returns the history file path.
+ */
+export function visitedHistoryPath(): string {
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  return join(home, 'dsh-builtin-browser-host', 'history.jsonl')
+}
+
+/**
+ * Append-only browsing history with bounded retention. Every method tolerates a
+ * missing or damaged file: recording a visit must never fail a navigation, and
+ * a corrupted line must never hide the rest of the history.
+ */
+export class HistoryStore {
+  private readonly maxEntries: number
+  private readonly maxAgeMs: number
+
+  /**
+   * @param file - absolute path of the JSONL history file.
+   * @param limits - retention overrides (entry count and age).
+   */
+  constructor(
+    private readonly file: string = visitedHistoryPath(),
+    limits: HistoryLimits = {},
+  ) {
+    this.maxEntries = limits.maxEntries ?? DEFAULT_MAX_ENTRIES
+    this.maxAgeMs = (limits.maxAgeDays ?? DEFAULT_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000
+  }
+
+  /** Whether the history file exists yet (diagnostics and tests). */
+  exists(): boolean {
+    return existsSync(this.file)
+  }
+
+  /**
+   * Record one visit. Failures are swallowed by design: history is a
+   * convenience, and losing an entry must never break the tool call that
+   * produced it.
+   * @param page - the visited page.
+   */
+  append(page: VisitedPage): void {
+    try {
+      mkdirSync(dirname(this.file), { recursive: true })
+      appendFileSync(this.file, `${JSON.stringify(page)}\n`)
+    } catch {
+      // Best-effort: history is not worth failing a navigation over.
+    }
+  }
+
+  /**
+   * Read visits, newest first. Unparseable lines are skipped; entries older
+   * than the age limit are filtered out but left on disk until the next prune.
+   * @param options - optional result cap and domain filter.
+   * @returns the matching visits, newest first.
+   */
+  list(options: { readonly limit?: number; readonly domain?: string } = {}): VisitedPage[] {
+    const all = this.readAll()
+    const cutoff = Date.now() - this.maxAgeMs
+    const domain = options.domain?.toLowerCase()
+    const matches = all.filter(page => {
+      if (page.at < cutoff) return false
+      if (domain === undefined) return true
+      try {
+        return new URL(page.url).hostname.toLowerCase().includes(domain)
+      } catch {
+        return page.url.toLowerCase().includes(domain)
+      }
+    })
+    matches.reverse()
+    return options.limit === undefined ? matches : matches.slice(0, Math.max(0, options.limit))
+  }
+
+  /**
+   * Enforce retention: drop entries past the age limit, then the oldest beyond
+   * the count cap. Cheap no-op until the file grows past the cap, so callers can
+   * run it after every append.
+   */
+  prune(): void {
+    const all = this.readAll()
+    const cutoff = Date.now() - this.maxAgeMs
+    const fresh = all.filter(page => page.at >= cutoff)
+    const kept = fresh.length > this.maxEntries ? fresh.slice(fresh.length - this.maxEntries) : fresh
+    // Only rewrite when something actually fell off, and only once the excess
+    // is worth a full rewrite.
+    if (kept.length === all.length) return
+    if (all.length - kept.length < PRUNE_SLACK && fresh.length <= this.maxEntries) return
+    try {
+      const body = kept.map(page => `${JSON.stringify(page)}\n`).join('')
+      writeFileSync(this.file, body)
+    } catch {
+      // Best-effort: an unpruned file still reads correctly.
+    }
+  }
+
+  /** Parse the whole file, skipping blank and damaged lines. */
+  private readAll(): VisitedPage[] {
+    let raw: string
+    try {
+      raw = readFileSync(this.file, 'utf8')
+    } catch {
+      return []
+    }
+    const pages: VisitedPage[] = []
+    for (const line of raw.split('\n')) {
+      const trimmed = line.trim()
+      if (trimmed === '') continue
+      try {
+        const parsed = JSON.parse(trimmed) as Partial<VisitedPage>
+        if (typeof parsed.at !== 'number' || typeof parsed.url !== 'string') continue
+        pages.push({
+          at: parsed.at,
+          url: parsed.url,
+          ...typeof parsed.title === 'string' && parsed.title !== '' ? { title: parsed.title } : {},
+          ...typeof parsed.session === 'string' && parsed.session !== '' ? { session: parsed.session } : {},
+        })
+      } catch {
+        // A damaged line (typically a truncated tail) must not hide the rest.
+        continue
+      }
+    }
+    return pages
+  }
+}

package/src/browser-electron/host-main.ts

@@ -13,6 +13,7 @@
  *      { id, op: 'destroyView', viewId } | { id, op: 'showView', viewId } |
  *      { id, op: 'groupView', viewId, windowId, label? } |
  *      { id, op: 'command', viewId, method, params } |
+ *      { id, op: 'focus', viewId } |
  *      { id, op: 'userActionError', windowId, message }
  *   -> { id: 0, op: 'hello', token } (our FIRST message — proves we know the
  *      parent's stdin token; the parent refuses the connection otherwise)
@@ -286,6 +287,14 @@ function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise
  */
 const COMMAND_TIMEOUT_MS = 20000
 
+/**
+ * How long to let a `focus` request land before answering it. Focus moves
+ * asynchronously and a key dispatched in the same turn as the request is still
+ * dropped, so the caller needs this settle — but only on the call where focus
+ * actually had to move.
+ */
+const FOCUS_SETTLE_MS = 80
+
 /**
  * A brand-new WebContentsView has no renderer process until something loads,
  * and CDP commands (Runtime.evaluate …) sent to a renderer-less view never
@@ -380,7 +389,32 @@ function windowFor(windowId: string | undefined): HostWindow {
   const existing = windows.get(key)
   if (existing !== undefined) return existing
   const w = new BrowserWindow({ width: 1400, height: 900, show: true, title: 'dsh-browser' })
-  w.on('closed', () => { windows.delete(key) })
+  w.on('closed', () => {
+    const closing = windows.get(key)
+    windows.delete(key)
+    // A BrowserWindow does not destroy its child views: their webContents (the
+    // renderer process, its timers and audio) outlive the window unless closed
+    // explicitly, so release them here instead of leaking a renderer per window.
+    if (closing !== undefined) {
+      for (const view of closing.views.values()) {
+        try {
+          view.webContentsView.webContents.close()
+        } catch {
+          // Already destroyed along with the window.
+        }
+      }
+      closing.views.clear()
+    }
+    // The interface is gone for good. Report it, so the plugin ends that session
+    // instead of holding one whose window the human already closed. Browsing
+    // history and login state live on disk, so the next open starts a clean
+    // session rather than resurrecting this one.
+    try {
+      rpcSocket?.write(JSON.stringify({ id: 0, op: 'viewClosed', windowId: key }) + '\n')
+    } catch {
+      // Socket already gone (parent shutting down): nothing left to report to.
+    }
+  })
   const win: HostWindow = { windowId: key, window: w, toolbarView: undefined, views: new Map(), visibleViewId: undefined, lastFocusedViewId: undefined, closeTimer: undefined }
   // Keep every view (and the toolbar) filling the window as the human
   // resizes it; otherwise pages stay at their original size and break.
@@ -714,6 +748,26 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         reply(msg.id, { ok: true, result })
         return
       }
+      case 'focus': {
+        const viewId = msg.viewId
+        if (viewId === undefined) throw new Error('focus missing viewId')
+        const win = windowOfView(viewId)
+        const entry = win?.views.get(viewId)
+        if (win === undefined || entry === undefined) throw new Error(`focus: unknown view ${viewId}`)
+        // Keys go to the view that holds web focus. A view that was never
+        // clicked holds none, so the FIRST browser_key of a session was dropped
+        // by the renderer while CDP still answered the dispatch with success —
+        // and `document.hasFocus()` inside the page even read true.
+        const contents = entry.webContentsView.webContents
+        const hadWebFocus = contents.isFocused()
+        contents.focus()
+        // Focus lands asynchronously, and a key dispatched in the same turn as
+        // the request is still dropped, so hold the reply until the renderer can
+        // take input. Only on the call where focus actually had to move.
+        if (!hadWebFocus) await new Promise(resolve => setTimeout(resolve, FOCUS_SETTLE_MS))
+        reply(msg.id, { ok: true, focused: contents.isFocused() })
+        return
+      }
       case 'capture': {
         const viewId = msg.viewId
         if (viewId === undefined) throw new Error('capture missing viewId')
@@ -942,6 +996,34 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
   }
 }
 
+/**
+ * Chromium's native-window occlusion tracker (Windows only) asks DWM whether a
+ * window is covered by another window and, when it is, moves the WebContents to
+ * `Visibility::HIDDEN`. That is the wrong model for this host: the shared
+ * browser window normally sits *behind* whatever the human is working in, and
+ * that is exactly the state the agent drives it from. A hidden WebContents
+ * produces no frames at all (`requestAnimationFrame` never fires) and
+ * `RenderWidgetHostImpl::CanReceiveInput()` returns false, so every
+ * `Input.dispatchMouseEvent`/`dispatchKeyEvent` sent over CDP is dropped on the
+ * floor while the CDP call itself still answers `{}` — clicks and keys that
+ * silently do nothing, with no error anywhere. Keep the window's visibility
+ * state application-controlled instead; the parent already shows/raises views
+ * explicitly, and `webContentsView.setVisible()` remains the single source of
+ * truth for whether a view renders.
+ */
+function keepWindowsNonOccluding(): void {
+  if (process.platform !== 'win32') return
+  const DISABLED = 'CalculateNativeWinOcclusion'
+  const current = app.commandLine.getSwitchValue('disable-features') ?? ''
+  const features = current
+    .split(',')
+    .map(part => part.trim())
+    .filter(part => part !== '')
+  if (!features.includes(DISABLED)) features.push(DISABLED)
+  app.commandLine.appendSwitch('disable-features', features.join(','))
+}
+keepWindowsNonOccluding()
+
 /**
  * Electron entry: connect back to the parent's RPC server (port from
  * `--rpc-port`) and serve line-delimited JSON-RPC. `ELECTRON_RUN_AS_NODE` is