dsh-builtin-browser 0.4.1 → 0.4.2

package/lib/browser-electron/history-store.js

@@ -12,9 +12,10 @@
  * instead of poisoning the whole file.
  * @module dsh-browser/browser-electron/history-store
  */
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { writeFileAtomic } from './settings-store.js';
 /** Default entry cap — mirrors the documented retention rule. */
 const DEFAULT_MAX_ENTRIES = 5_000;
 /** Default age cap in days. */
@@ -37,6 +38,22 @@ export function visitedHistoryPath() {
  */
 export class HistoryStore {
     file;
+    /**
+     * File size at which the next rewrite happens.
+     *
+     * Advanced after each rewrite so the cost is paid once per PRUNE_SLACK appends
+     * rather than on every append: asking "is it over the cap?" was true from the first
+     * over-cap write onwards, which is what made every later navigation rewrite the file.
+     */
+    pruneThreshold;
+    /**
+     * Appends since the last rewrite.
+     *
+     * prune() runs after every navigation, and the answer is almost always "nothing to
+     * do" — but working that out from the file costs a full parse. Counting instead makes
+     * the common case a comparison.
+     */
+    appendedSincePrune = 0;
     maxEntries;
     maxAgeMs;
     /**
@@ -46,6 +63,8 @@ export class HistoryStore {
     constructor(file = visitedHistoryPath(), limits = {}) {
         this.file = file;
         this.maxEntries = limits.maxEntries ?? DEFAULT_MAX_ENTRIES;
+        // The first rewrite is due once the file has grown PRUNE_SLACK past the cap.
+        this.pruneThreshold = this.maxEntries + this.slack();
         this.maxAgeMs = (limits.maxAgeDays ?? DEFAULT_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000;
     }
     /** Whether the history file exists yet (diagnostics and tests). */
@@ -66,6 +85,7 @@ export class HistoryStore {
         catch {
             // Best-effort: history is not worth failing a navigation over.
         }
+        this.appendedSincePrune++;
     }
     /**
      * Read visits, newest first. Unparseable lines are skipped; entries older
@@ -108,7 +128,22 @@ export class HistoryStore {
      * the count cap. Cheap no-op until the file grows past the cap, so callers can
      * run it after every append.
      */
+    /**
+     * How far past the cap the file may grow before it is rewritten.
+     *
+     * Scaled to the cap rather than fixed: a fixed 500 was meaningless when the cap is
+     * small (a caller asking for three entries would never reach 503), and the slack is
+     * there to batch rewrites, not to overrule the caller's bound.
+     * @returns the number of extra entries tolerated before a rewrite.
+     */
+    slack() {
+        return Math.min(PRUNE_SLACK, Math.max(1, Math.floor(this.maxEntries / 2)));
+    }
     prune() {
+        // Cheap first: past the cap but without enough new entries to justify a rewrite.
+        // Reading the file to reach this conclusion was the remaining per-navigation cost.
+        if (this.appendedSincePrune === 0)
+            return;
         const all = this.readAll();
         const cutoff = Date.now() - this.maxAgeMs;
         const fresh = all.filter(page => page.at >= cutoff);
@@ -117,14 +152,26 @@ export class HistoryStore {
         // is worth a full rewrite.
         if (kept.length === all.length)
             return;
-        if (all.length - kept.length < PRUNE_SLACK && fresh.length <= this.maxEntries)
+        // Only rewrite once the file has grown PRUNE_SLACK past what we last wrote. Asking
+        // "is the file over the cap?" instead was true from the first over-cap append
+        // onwards, so every single navigation after that rewrote the whole file.
+        if (all.length < this.pruneThreshold)
             return;
         try {
             const body = kept.map(page => `${JSON.stringify(page)}\n`).join('');
-            writeFileSync(this.file, body);
+            // Atomic, like the settings document. A plain writeFileSync truncates first, and this is
+            // the whole history in one call: a TerminateProcess mid-write — the browser host is
+            // killed exactly that way on Windows — left a partial file, and the reader drops a
+            // half-written TAIL rather than the middle, so everything after the tear was lost.
+            writeFileAtomic(this.file, body);
+            // The file now holds only what was kept, so the next rewrite is due once
+            // PRUNE_SLACK more entries have been appended.
+            this.pruneThreshold = kept.length + this.slack();
+            this.appendedSincePrune = 0;
         }
         catch {
-            // Best-effort: an unpruned file still reads correctly.
+            // Best-effort: an unpruned file still reads correctly, and the atomic write leaves the
+            // previous one in place when it fails.
         }
     }
     /** Parse the whole file, skipping blank and damaged lines. */

package/lib/browser-electron/host-main.js

@@ -47,26 +47,42 @@ catch (error) {
     process.stderr.write(`[dsh-browser host] userData setup failed: ${String(error)}\n`);
 }
 /**
- * Read the spawn token. The parent sends it two ways and the child prefers
- * the first that yields a value:
+ * Read the spawn token. The parent sends it two ways:
  *   1. stdin (first line) — the secure channel on Unix/macOS;
  *   2. DSH_BROWSER_RPC_TOKEN env — the fallback on Windows, where Electron is
  *      a GUI-subsystem process and never receives piped stdin (the parent
  *      sets it in the spawn env for exactly this reason).
- * stdin wins over env so the parent's token never has to touch argv.
+ *
+ * stdin WINS over env, which is what the ordering here has to express. It used to read env
+ * first and only consult stdin when that came up empty, so the stdin branch never ran while
+ * env was set — every spawn was told both ways, so the documented preference was silently
+ * the other way round. The env value is kept as the default for the common case where stdin
+ * delivers nothing; the interface below overwrites it when a line arrives.
  */
 let RPC_TOKEN = process.env.DSH_BROWSER_RPC_TOKEN ?? '';
-const stdinDelivered = RPC_TOKEN !== '';
-if (process.stdin !== null && process.stdin.readable) {
-    const stdinLines = createInterface({ input: process.stdin, terminal: false });
+/** True once a line actually arrived on stdin (as opposed to env being present). */
+let tokenFromStdin = false;
+/**
+ * The one and only stdin reader.
+ *
+ * It is created here and reused by the hello path inside `whenReady` below: two
+ * `createInterface` calls on the same stream both consume its lines, so the second one saw
+ * nothing at all. A single reader means whoever needs the token from stdin waits on it.
+ */
+const stdinLines = process.stdin !== null && process.stdin.readable
+    ? createInterface({ input: process.stdin, terminal: false })
+    : undefined;
+if (stdinLines !== undefined) {
     stdinLines.on('line', (line) => {
-        if (RPC_TOKEN === '') {
-            RPC_TOKEN = line.trim();
-            stdinLines.close();
-        }
+        if (tokenFromStdin)
+            return;
+        tokenFromStdin = true;
+        const token = line.trim();
+        if (token !== '')
+            RPC_TOKEN = token;
     });
     stdinLines.on('close', () => {
-        if (RPC_TOKEN === '' && !stdinDelivered) {
+        if (RPC_TOKEN === '') {
             process.stderr.write('[dsh-browser host] warning: no token received on stdin or env\n');
         }
     });
@@ -819,12 +835,12 @@ async function handle(op, msg) {
                 try {
                     let image;
                     try {
-                        image = await entry.webContentsView.webContents.capturePage();
+                        image = await withTimeout(entry.webContentsView.webContents.capturePage(), COMMAND_TIMEOUT_MS, 'capturePage');
                     }
                     catch (error) {
                         process.stderr.write(`[dsh-browser host] capturePage failed: ${String(error)}\n`);
                         await new Promise(resolve => setTimeout(resolve, 400));
-                        image = await entry.webContentsView.webContents.capturePage();
+                        image = await withTimeout(entry.webContentsView.webContents.capturePage(), COMMAND_TIMEOUT_MS, 'capturePage');
                     }
                     // Downscale to fit the requested box, preserving aspect ratio.
                     const size = image.getSize();
@@ -870,7 +886,7 @@ async function handle(op, msg) {
                         catch { /* already gone */ }
                     }
                     try {
-                        const shot = await entry.webContentsView.webContents.debugger.sendCommand('Page.captureScreenshot', {});
+                        const shot = await withTimeout(entry.webContentsView.webContents.debugger.sendCommand('Page.captureScreenshot', {}), COMMAND_TIMEOUT_MS, 'Page.captureScreenshot');
                         const data = shot.data;
                         if (typeof data === 'string' && data.length > 0)
                             base64 = data;
@@ -918,7 +934,11 @@ async function handle(op, msg) {
                 // the parent's memory or hit the single-line cap. This also avoids
                 // Electron's download pipeline entirely (CDP debugger attach can
                 // interfere with will-download).
-                const result = await entry.webContentsView.webContents.debugger.sendCommand('Runtime.evaluate', {
+                // Bounded like every other op. The evaluate awaits a page-side fetch, so a slow or
+                // unresponsive server held the serial queue open forever: handle() never settled,
+                // every later op queued behind it, and the parent's plain timeout does not restart
+                // the host.
+                const result = await withTimeout(entry.webContentsView.webContents.debugger.sendCommand('Runtime.evaluate', {
                     // Stream the body through a reader so the size cap is enforced as
                     // bytes arrive — never buffer an unbounded download into memory
                     // before checking the limit (a huge URL would otherwise OOM the
@@ -959,7 +979,7 @@ async function handle(op, msg) {
           })()`,
                     awaitPromise: true,
                     returnByValue: true,
-                });
+                }), COMMAND_TIMEOUT_MS, 'download evaluate');
                 const value = result.result?.value;
                 if (typeof value !== 'string') {
                     const detail = result.exceptionDetails;
@@ -994,7 +1014,21 @@ async function handle(op, msg) {
                     throw new Error(`flushAuth: unknown view ${viewId}`);
                 // Export the session's cookies so login state can be saved/restored
                 // across browser hosts (or shared with another machine).
-                const cookies = await entry.webContentsView.webContents.session.cookies.get({});
+                //
+                // Scoped to this view's own page. The jar is SHARED on purpose: views here are built
+                // without a partition and every window drives the same browser, so signing in once
+                // works everywhere. What must not be shared is the HANDING OVER — an unfiltered read
+                // would put every domain every task has visited, plus whatever the human is signed
+                // into, in front of one task's caller. Least exposure, not isolation. An unknown page
+                // refuses rather than widening.
+                //
+                // Bounded like every other op: a renderer that stops answering here would hold the
+                // serial queue forever, and the parent's plain timeout does not restart the host.
+                const pageUrl = entry.webContentsView.webContents.getURL();
+                if (pageUrl === '' || pageUrl === 'about:blank') {
+                    throw new Error('flushAuth: this view has no page loaded, so the cookie scope is unknown — reading everything would expose other sessions');
+                }
+                const cookies = await withTimeout(entry.webContentsView.webContents.session.cookies.get({ url: pageUrl }), COMMAND_TIMEOUT_MS, 'cookies.get');
                 const exported = cookies.map(c => {
                     // Electron types the cookie domain as optional; a missing domain
                     // cannot be exported meaningfully, so default to '' (matches the
@@ -1032,7 +1066,9 @@ async function handle(op, msg) {
                 for (const c of cookies) {
                     if (typeof c.url !== 'string' || typeof c.name !== 'string' || typeof c.value !== 'string')
                         continue;
-                    await entry.webContentsView.webContents.session.cookies.set({
+                    // Bounded per cookie: this runs once for every cookie, so a single hang held the
+                    // serial queue open forever with no path to recovery.
+                    await withTimeout(entry.webContentsView.webContents.session.cookies.set({
                         url: c.url,
                         name: c.name,
                         value: c.value,
@@ -1041,7 +1077,7 @@ async function handle(op, msg) {
                         ...typeof c.secure === 'boolean' ? { secure: c.secure } : {},
                         ...typeof c.httpOnly === 'boolean' ? { httpOnly: c.httpOnly } : {},
                         ...typeof c.expirationDate === 'number' ? { expirationDate: c.expirationDate } : {},
-                    });
+                    }), COMMAND_TIMEOUT_MS, 'cookies.set');
                     restored++;
                 }
                 reply(msg.id, { ok: true, result: { restored } });
@@ -1110,17 +1146,19 @@ void app.whenReady().then(() => {
         socket.write(JSON.stringify({ id: 0, op: 'hello', token: RPC_TOKEN }) + '\n');
     };
     if (RPC_TOKEN !== '') {
+        // Either stdin already delivered a line (it wins) or env supplied the fallback.
         writeHello();
     }
     else {
-        // No token yet (env absent and stdin still pending): wait for stdin's
-        // first line with a bounded fallback, then send whatever we have — an
-        // empty hello is refused by the parent, which then fails cleanly.
+        // Neither yet: wait for stdin's first line with a bounded fallback, then send whatever
+        // we have — an empty hello is refused by the parent, which then fails cleanly. The
+        // reader is the module-level one, NOT a second createInterface on the same stream: two
+        // readers of one stdin both consume its lines, so the second one never saw the token.
         const fallback = setTimeout(() => writeHello(), 2_000);
-        if (process.stdin !== null && process.stdin.readable) {
-            const stdinLines = createInterface({ input: process.stdin, terminal: false });
-            stdinLines.once('line', () => { clearTimeout(fallback); writeHello(); });
-            stdinLines.once('close', () => { clearTimeout(fallback); writeHello(); });
+        if (stdinLines !== undefined) {
+            const send = () => { clearTimeout(fallback); writeHello(); };
+            stdinLines.once('line', send);
+            stdinLines.once('close', send);
         }
     }
     const rl = createInterface({ input: socket });
@@ -1156,7 +1194,17 @@ void app.whenReady().then(() => {
     // without cleanup, exit so no zombie Electron window is left behind.
     socket.on('close', () => {
         process.stderr.write('[dsh-browser host] parent connection closed, exiting\n');
-        app.exit(0);
+        // A normal quit, not `app.exit(0)`. exit() skips before-quit/will-quit and does not wait
+        // for Chromium to finish writing the profile — the leveldb files holding cookies and site
+        // data. This path runs on every dispose, and a session that has just logged in is exactly
+        // when the profile holds unwritten state, so a hard exit could leave a half-written leveldb
+        // behind, which is what makes a browser profile fail to open on the next launch.
+        app.quit();
+        // Belt and braces: the parent is already gone, so there is nothing left to serve. If a
+        // listener or a window blocks the quit, forcing the exit after a grace period is still
+        // strictly better than an orphaned Electron window the user has to close by hand.
+        const force = setTimeout(() => app.exit(0), 5000);
+        force.unref();
     });
     // Keep the process alive until the parent closes the socket or kills us.
 });

package/lib/browser-electron/provider.d.ts

@@ -204,7 +204,16 @@ export interface ElectronBrowserProviderConfig {
     readonly settings?: () => BrowserSettings;
     /** Maximum snapshot elements before truncation. Default 60. */
     readonly snapshotMaxElements?: number;
-    /** Maximum content characters before truncation when no maxChars is given. Default 100_000. */
+    /**
+     * Explicit content cap, overriding the per-format default when set.
+     *
+     * Honoured again, and it is worth saying why that is a fix rather than a feature: this was
+     * `config.contentMaxChars ?? 100_000`, one number for every format, and when the caps became
+     * per-format (html and json 50 000, otherwise 20 000) the field was left assigned and never
+     * read. A configuration knob that silently does nothing is worse than no knob — it is an
+     * operator's decision that quietly went nowhere. Leaving it unset means the per-format
+     * default; setting it means the operator meant it.
+     */
     readonly contentMaxChars?: number;
     /**
      * Directory `browser_download` save paths must resolve inside (prevents a
@@ -390,8 +399,26 @@ export declare class ElectronBrowserProvider implements BrowserProvider {
      * Chromium drops `Input.*` events for a view with no display surface, so this
      * runs before click/type/key and fails loudly (BROWSER_VIEW_NOT_PRESENTED)
      * rather than reporting a success the page never saw.
+     * @param s - the session whose active view must be presented.
+     * @param signal - optional cancellation.
+     * @returns the view the session's active tab has AFTER the presentation barrier.
      */
     private present;
+    /**
+     * Refuse to send synthesized input to a view that is no longer the one it was located
+     * against.
+     *
+     * `locateHandle` was captured before a page-side locate that can consume its whole
+     * 10s budget; the session's active tab is re-read afterwards. If they differ, the human
+     * switched tabs mid-flight (the product's whole point is that they can take over), and
+     * the coordinates belong to one page while the dispatch would go to another. Comparing
+     * the handles turns that into a loud, retryable error instead of input the caller
+     * believes landed.
+     * @param session - the session id, for the message.
+     * @param locateHandle - the view the locate ran in.
+     * @param liveHandle - the view that is active now.
+     */
+    private assertSameView;
     /**
      * Give the view web focus before synthesizing keyboard input.
      *
@@ -498,6 +525,22 @@ export declare class ElectronBrowserProvider implements BrowserProvider {
      * of text (`a@href` yields an absolute URL).
      */
     scrape(session: BrowserSessionId, request: BrowserScrapeRequest, signal?: AbortSignal): Promise<BrowserScrapeResult>;
+    /**
+     * Refuse an action the settings have switched off.
+     *
+     * These switches belong to the OPERATOR. The settings document is written through the
+     * plugin's own panel and no tool can reach it, so — unlike `browser_restrict`, which the
+     * model owns and can lift at will — a refusal here stands for as long as the setting does.
+     * That is the point of them: a deployment can take page-script execution, downloads, or
+     * login-state writes off the table without relying on the model's cooperation.
+     *
+     * Read through `settingsSource` on every call rather than captured at construction, so
+     * flipping a switch applies to the next command instead of the next restart — the same
+     * rule the credentials gate follows.
+     * @param action - which switch to consult.
+     * @throws BrowserError when that switch is off.
+     */
+    private assertActionAllowed;
     /**
      * Admit a caller-supplied save path for a file the browser writes to disk.
      * ONE gate for both `browser_download` and `browser_screenshot`: the path