flower-trellis 0.5.2 → 0.5.4

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/network-capture.js

@@ -0,0 +1,339 @@
+const { TextDecoder } = require('util');
+const { MAX_NETWORK_BODY_BYTES } = require('./config');
+
+const TEXT_CONTENT_TYPE_RE = /^(text\/)|json|xml|javascript|ecmascript|graphql|x-www-form-urlencoded|svg/i;
+const BINARY_CONTENT_TYPE_RE = /^(image|audio|video|font)\/|octet-stream|zip|gzip|pdf|wasm/i;
+const RECORDER_PATHS = new Set(['/log', '/events', '/session', '/dashboard', '/dashboard.html', '/health']);
+
+/**
+ * 判断 URL 是否属于 recorder 自身流量。
+ *
+ * @param {string} rawUrl 请求 URL。
+ * @param {Object} [options] 过滤配置。
+ * @param {number} [options.port] logger 端口。
+ * @param {string[]} [options.hosts] 允许识别为本机的主机名。
+ * @return {boolean} 是否应从业务网络事件中排除。
+ */
+function isRecorderRequest(rawUrl, options = {}) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    } catch (error) {
+        return false;
+    }
+    const hosts = new Set(options.hosts || ['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
+    const port = Number(options.port || 7777);
+    const actualPort = Number(url.port || (url.protocol === 'https:' ? 443 : 80));
+    const ownPath = RECORDER_PATHS.has(url.pathname) || url.pathname.startsWith('/control/');
+    return hosts.has(url.hostname) && actualPort === port && ownPath;
+}
+
+/**
+ * 在字节上限内截取合法 UTF-8 文本。
+ *
+ * @param {Buffer} buffer 原始字节。
+ * @param {number} maxBytes 最大字节数。
+ * @return {{text:string,size:number,truncated:boolean}} 截取结果。
+ */
+function truncateUtf8(buffer, maxBytes) {
+    const size = buffer.length;
+    const candidate = buffer.subarray(0, Math.min(size, maxBytes));
+    const decoded = new TextDecoder('utf-8').decode(candidate);
+    const validBuffer = Buffer.from(decoded, 'utf8');
+    if (validBuffer.length <= maxBytes) {
+        return { text: decoded, size, truncated: size > maxBytes };
+    }
+    const decoder = new TextDecoder('utf-8', { fatal: true });
+    for (let end = maxBytes; end >= Math.max(0, maxBytes - 4); end -= 1) {
+        try {
+            return { text: decoder.decode(validBuffer.subarray(0, end)), size, truncated: true };
+        } catch (error) {
+            // UTF-8 字符最多四字节，只需回退到当前字符起点。
+        }
+    }
+    return { text: '', size, truncated: true };
+}
+
+/**
+ * 判断无 Content-Type 的请求正文是否像可打印 UTF-8 文本。
+ *
+ * @param {Buffer} buffer 原始字节。
+ * @return {boolean} 是否可作为文本保存。
+ */
+function isProbablyText(buffer) {
+    if (buffer.length === 0) return true;
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+    } catch (error) {
+        return false;
+    }
+    let controls = 0;
+    for (const char of text) {
+        const code = char.codePointAt(0);
+        if ((code >= 0 && code < 9) || (code > 13 && code < 32)) controls += 1;
+    }
+    return controls / Math.max(1, text.length) < 0.02;
+}
+
+/**
+ * 解析 multipart 的字段和文件元数据，不保存文件正文。
+ *
+ * @param {Buffer} buffer multipart 原始字节。
+ * @param {string} contentType Content-Type。
+ * @param {number} maxBytes 普通字段最大保存字节数。
+ * @return {{parts:Array<Object>,parsed:boolean,reason?:string}} 解析结果。
+ */
+function parseMultipartMetadata(buffer, contentType, maxBytes) {
+    const match = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType || '');
+    const boundary = match && (match[1] || match[2] || '').trim();
+    if (!boundary) return { parts: [], parsed: false, reason: 'multipart-missing-boundary' };
+
+    const raw = buffer.toString('latin1');
+    const chunks = raw.split(`--${boundary}`).slice(1, -1);
+    const parts = [];
+    for (const chunk of chunks.slice(0, 100)) {
+        const normalized = chunk.replace(/^\r\n/, '').replace(/\r\n$/, '');
+        const splitAt = normalized.indexOf('\r\n\r\n');
+        if (splitAt < 0) return { parts, parsed: false, reason: 'multipart-unparsed' };
+        const headerText = normalized.slice(0, splitAt);
+        const bodyText = normalized.slice(splitAt + 4);
+        const disposition = headerText.match(/content-disposition:\s*form-data;([^\r\n]+)/i);
+        const name = disposition && /name="([^"]*)"/i.exec(disposition[1]);
+        const filename = disposition && /filename="([^"]*)"/i.exec(disposition[1]);
+        const type = /content-type:\s*([^\r\n]+)/i.exec(headerText);
+        const bodyBuffer = Buffer.from(bodyText, 'latin1');
+        if (filename) {
+            parts.push({
+                name: name ? name[1] : '',
+                filename: filename[1],
+                contentType: type ? type[1].trim() : '',
+                size: bodyBuffer.length,
+                fileBodySkipped: true,
+            });
+        } else {
+            const captured = truncateUtf8(bodyBuffer, maxBytes);
+            parts.push({
+                name: name ? name[1] : '',
+                value: captured.text,
+                size: captured.size,
+                truncated: captured.truncated,
+            });
+        }
+    }
+    return { parts, parsed: chunks.length <= 100, reason: chunks.length > 100 ? 'multipart-part-limit' : undefined };
+}
+
+/**
+ * 按内容类型和字节上限生成正文捕获字段。
+ *
+ * @param {Buffer|null|undefined} input 原始正文。
+ * @param {string} contentType Content-Type。
+ * @param {Object} [options] 捕获配置。
+ * @param {number} [options.maxBytes] 最大正文字节数。
+ * @param {boolean} [options.allowUnknownText] 是否允许推断无类型请求正文。
+ * @return {Object} 正文、大小、截断或跳过信息。
+ */
+function captureBody(input, contentType, options = {}) {
+    if (input === null || input === undefined) return { size: 0, body: null, truncated: false };
+    const buffer = Buffer.isBuffer(input) ? input : Buffer.from(input);
+    const maxBytes = options.maxBytes || MAX_NETWORK_BODY_BYTES;
+    const normalizedType = String(contentType || '').toLowerCase();
+    if (normalizedType.includes('multipart/form-data')) {
+        const metadata = parseMultipartMetadata(buffer, String(contentType || ''), Math.min(maxBytes, 64 * 1024));
+        return {
+            size: buffer.length,
+            body: null,
+            truncated: false,
+            bodySkipped: metadata.parsed ? 'multipart-metadata-only' : metadata.reason,
+            multipart: metadata.parts,
+        };
+    }
+    if (BINARY_CONTENT_TYPE_RE.test(normalizedType)) {
+        return { size: buffer.length, body: null, truncated: false, bodySkipped: 'binary-content-type' };
+    }
+    const explicitText = TEXT_CONTENT_TYPE_RE.test(normalizedType);
+    const inferredText = !normalizedType && options.allowUnknownText && isProbablyText(buffer);
+    if (!explicitText && !inferredText) {
+        return { size: buffer.length, body: null, truncated: false, bodySkipped: normalizedType ? 'unsupported-content-type' : 'missing-content-type' };
+    }
+    const captured = truncateUtf8(buffer, maxBytes);
+    return { size: captured.size, body: captured.text, truncated: captured.truncated };
+}
+
+/**
+ * 安装 BrowserContext 级 Fetch/XHR 网络采集。
+ *
+ * @param {import('playwright').BrowserContext} context Playwright BrowserContext。
+ * @param {Object} options 采集配置。
+ * @param {(events:Array<Object>)=>void|Promise<void>} options.appendEvents JSONL 追加回调。
+ * @param {number} [options.port] logger 端口，用于过滤自身请求。
+ * @param {number} [options.maxBodyBytes] 单方向正文上限。
+ * @return {{dispose:()=>void}} 可移除监听器的句柄。
+ */
+function installNetworkCapture(context, options) {
+    if (!options || typeof options.appendEvents !== 'function') {
+        throw new TypeError('appendEvents callback is required');
+    }
+    const requestStates = new WeakMap();
+    let sequence = 0;
+
+    function onRequest(request) {
+        if (!['fetch', 'xhr'].includes(request.resourceType())) return;
+        if (isRecorderRequest(request.url(), { port: options.port })) return;
+        const redirectedFrom = request.redirectedFrom();
+        const redirectedState = redirectedFrom ? requestStates.get(redirectedFrom) : null;
+        requestStates.set(request, {
+            requestId: `net-${++sequence}`,
+            redirectedFromRequestId: redirectedState ? redirectedState.requestId : null,
+            startedAt: Date.now(),
+            clientTime: new Date().toISOString(),
+            finalized: false,
+        });
+    }
+
+    async function finalize(request, terminal) {
+        const state = requestStates.get(request);
+        if (!state || state.finalized) return;
+        state.finalized = true;
+        const completedAt = Date.now();
+        let frame = null;
+        let serviceWorker = null;
+        try { frame = request.frame(); } catch (error) { /* Service Worker 请求没有 frame。 */ }
+        try { serviceWorker = request.serviceWorker(); } catch (error) { /* 旧 Playwright 不提供该方法。 */ }
+        let frameDepth = null;
+        let pageUrl = null;
+        if (frame) {
+            frameDepth = 0;
+            for (let parent = frame.parentFrame(); parent; parent = parent.parentFrame()) frameDepth += 1;
+            try { pageUrl = frame.page().url(); } catch (error) { pageUrl = null; }
+        }
+
+        let requestHeaders = {};
+        let requestHeaderError = null;
+        try { requestHeaders = await request.allHeaders(); } catch (error) { requestHeaderError = error.message; }
+        const requestContentType = requestHeaders['content-type'] || '';
+        let requestBody;
+        try {
+            requestBody = captureBody(request.postDataBuffer(), requestContentType, {
+                maxBytes: options.maxBodyBytes,
+                allowUnknownText: true,
+            });
+        } catch (error) {
+            requestBody = { size: 0, body: null, truncated: false, captureError: error.message };
+        }
+
+        let response = terminal.response || null;
+        if (!response && terminal.kind === 'finished') {
+            try { response = await request.response(); } catch (error) { response = null; }
+        }
+        let responseHeaders = {};
+        let responseHeaderError = null;
+        let responseBody = { size: 0, body: null, truncated: false };
+        if (response) {
+            try { responseHeaders = await response.allHeaders(); } catch (error) { responseHeaderError = error.message; }
+            const responseContentType = responseHeaders['content-type'] || '';
+            const declaredSize = Number.parseInt(responseHeaders['content-length'], 10);
+            const maxBodyBytes = options.maxBodyBytes || MAX_NETWORK_BODY_BYTES;
+            if (Number.isFinite(declaredSize) && declaredSize > maxBodyBytes) {
+                // Playwright 的 response.body() 会一次性物化完整响应；已知超限时直接跳过，避免先占满内存再截断。
+                responseBody = {
+                    size: declaredSize,
+                    body: null,
+                    truncated: true,
+                    bodySkipped: 'content-length-exceeds-capture-limit',
+                };
+            } else {
+                try {
+                    responseBody = captureBody(await response.body(), responseContentType, {
+                        maxBytes: maxBodyBytes,
+                        allowUnknownText: false,
+                    });
+                } catch (error) {
+                    responseBody = { size: 0, body: null, truncated: false, captureError: error.message };
+                }
+            }
+        }
+
+        const failure = terminal.failure || null;
+        const event = {
+            kind: 'network',
+            type: request.resourceType(),
+            source: 'playwright',
+            requestId: state.requestId,
+            redirectedFromRequestId: state.redirectedFromRequestId,
+            clientTime: state.clientTime,
+            completedTime: new Date(completedAt).toISOString(),
+            durationMs: completedAt - state.startedAt,
+            method: request.method(),
+            requestUrl: request.url(),
+            requestHeaders,
+            requestHeaderCaptureError: requestHeaderError,
+            requestContentType,
+            requestBody: requestBody.body,
+            requestSize: requestBody.size,
+            requestBodyTruncated: requestBody.truncated,
+            requestBodySkipped: requestBody.bodySkipped || null,
+            requestBodyCaptureError: requestBody.captureError || null,
+            requestMultipart: requestBody.multipart || null,
+            status: response ? response.status() : null,
+            responseHeaders,
+            responseHeaderCaptureError: responseHeaderError,
+            responseContentType: responseHeaders['content-type'] || '',
+            responseBody: responseBody.body,
+            responseSize: responseBody.size,
+            responseBodyTruncated: responseBody.truncated,
+            responseBodySkipped: responseBody.bodySkipped || null,
+            responseBodyCaptureError: responseBody.captureError || null,
+            failure,
+            error: failure ? failure.errorText : null,
+            url: pageUrl || request.url(),
+            frame: frame ? { url: frame.url(), depth: frameDepth } : null,
+            context: {
+                pageUrl,
+                frameUrl: frame ? frame.url() : null,
+                frameDepth,
+                serviceWorkerUrl: serviceWorker ? serviceWorker.url() : null,
+            },
+        };
+        await options.appendEvents([event]);
+    }
+
+    function onFinished(request) {
+        void finalize(request, { kind: 'finished' }).catch(error => {
+            console.error('[network] finalize finished request failed:', error.message);
+        });
+    }
+
+    function onFailed(request) {
+        void finalize(request, { kind: 'failed', failure: request.failure() || { errorText: 'request failed' } }).catch(error => {
+            console.error('[network] finalize failed request failed:', error.message);
+        });
+    }
+
+    context.on('request', onRequest);
+    context.on('requestfinished', onFinished);
+    context.on('requestfailed', onFailed);
+
+    return {
+        /**
+         * 移除本次安装的全部 BrowserContext 网络监听器。
+         *
+         * @return {void}
+         */
+        dispose() {
+            context.off('request', onRequest);
+            context.off('requestfinished', onFinished);
+            context.off('requestfailed', onFailed);
+        },
+    };
+}
+
+module.exports = {
+    captureBody,
+    installNetworkCapture,
+    isProbablyText,
+    isRecorderRequest,
+    parseMultipartMetadata,
+    truncateUtf8,
+};

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/package.json

@@ -5,7 +5,8 @@
     "description": "本地浏览器交互记录工具：持久化 profile 的 Chrome + 自动注入监听 + 本地落盘",
     "scripts": {
         "logger": "node logger.js",
-        "launch": "node launch.js"
+        "launch": "node launch.js",
+        "test": "node --test test/*.test.js"
     },
     "dependencies": {
         "playwright": "^1.48.0"

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/test/browser-controller.test.js

@@ -0,0 +1,90 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { BrowserController, ControlError, limitText } = require('../browser-controller');
+
+function createLocator(visibleIndexes) {
+    return {
+        count: async () => 3,
+        nth: index => ({
+            isVisible: async () => visibleIndexes.includes(index),
+            evaluate: async () => ({ tag: 'button', id: `button-${index}`, role: 'button', name: `按钮 ${index}` }),
+        }),
+    };
+}
+
+function createPage(locator) {
+    const frame = {
+        url: () => 'https://example.test/frame',
+        name: () => 'main',
+        getByText: () => locator,
+    };
+    return {
+        frames: () => [frame],
+        mainFrame: () => frame,
+    };
+}
+
+test('可见文本按 UTF-8 字节边界截断', () => {
+    const result = limitText('你你你你', 10);
+    assert.equal(result.value, '你你你');
+    assert.equal(result.size, 12);
+    assert.equal(result.truncated, true);
+});
+
+test('未指定 nth 的多可见匹配返回 AMBIGUOUS_TARGET', async () => {
+    const controller = new BrowserController({ getContext: () => null, sessionDir: '/tmp' });
+    await assert.rejects(
+        controller.resolveTarget(createPage(createLocator([0, 2])), { target: { text: '提交', exact: true } }),
+        error => error instanceof ControlError && error.code === 'AMBIGUOUS_TARGET' && error.details.count === 2,
+    );
+});
+
+test('显式 nth 可以选择调用方接受的可见匹配', async () => {
+    const controller = new BrowserController({ getContext: () => null, sessionDir: '/tmp' });
+    const result = await controller.resolveTarget(createPage(createLocator([0, 2])), {
+        target: { text: '提交', exact: true, nth: 2 },
+    });
+    assert.equal(result.summary.id, 'button-2');
+    assert.equal(result.frame.index, 0);
+});
+
+test('target 同时提供两种主定位策略时拒绝执行', async () => {
+    const controller = new BrowserController({ getContext: () => null, sessionDir: '/tmp' });
+    await assert.rejects(
+        controller.resolveTarget(createPage(createLocator([0])), { target: { text: '提交', selector: '#submit' } }),
+        error => error instanceof ControlError && error.code === 'INVALID_TARGET',
+    );
+});
+
+test('禁用元素在动作前返回 TARGET_NOT_ACTIONABLE', async () => {
+    const controller = new BrowserController({ getContext: () => null, sessionDir: '/tmp' });
+    await assert.rejects(
+        controller.ensureTargetActionable({ isEnabled: async () => false }, 'click'),
+        error => error instanceof ControlError && error.code === 'TARGET_NOT_ACTIONABLE' && error.statusCode === 409,
+    );
+});
+
+test('observe 对不响应的 frame 应用整体超时', async () => {
+    const frame = {
+        parentFrame: () => null,
+        url: () => 'https://example.test/',
+        name: () => '',
+        locator: selector => selector === 'body'
+            ? {
+                innerText: async () => '',
+                ariaSnapshot: async () => '',
+            }
+            : { evaluateAll: async () => new Promise(() => {}) },
+    };
+    const page = {
+        frames: () => [frame],
+        mainFrame: () => frame,
+        url: () => 'https://example.test/',
+    };
+    const context = { pages: () => [page] };
+    const controller = new BrowserController({ getContext: () => context, sessionDir: '/tmp' });
+    await assert.rejects(
+        controller.observe({ timeoutMs: 100, includeText: false, includeAria: false }),
+        error => error instanceof ControlError && error.code === 'OBSERVE_TIMEOUT' && error.statusCode === 408,
+    );
+});

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/test/browser-smoke.test.js

@@ -0,0 +1,121 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const http = require('node:http');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { createBrowserController } = require('../browser-controller');
+const { installNetworkCapture } = require('../network-capture');
+
+let chromium = null;
+try {
+    ({ chromium } = require('playwright'));
+} catch (error) {
+    // 普通单测不要求预装运行时依赖；显式 smoke 会在依赖可用时执行。
+}
+
+function listen(server) {
+    return new Promise(resolve => server.listen(0, '127.0.0.1', () => resolve(server.address().port)));
+}
+
+function close(server) {
+    return new Promise(resolve => server.close(resolve));
+}
+
+test('真实浏览器可感知页面、操作元素并采集跨 frame Fetch/XHR', {
+    skip: process.env.CRAFT_RPA_BROWSER_SMOKE !== '1'
+        ? '未启用 CRAFT_RPA_BROWSER_SMOKE'
+        : chromium === null ? 'Playwright 运行时依赖不可用' : false,
+    timeout: 60000,
+}, async t => {
+    const events = [];
+    const frameServer = http.createServer((req, res) => {
+        if (req.url === '/frame') {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(`<!doctype html><button id="frame-button">Frame button</button><script>
+                fetch('/frame-api').catch(() => {});
+                const xhr = new XMLHttpRequest(); xhr.open('GET', '/frame-xhr'); xhr.send();
+            </script>`);
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ path: req.url, source: 'frame' }));
+    });
+    const framePort = await listen(frameServer);
+    t.after(() => close(frameServer));
+
+    const mainServer = http.createServer((req, res) => {
+        if (req.url === '/') {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(`<!doctype html>
+                <label for="name">姓名</label><input id="name">
+                <label for="agree">同意</label><input id="agree" type="checkbox">
+                <label for="region">地区</label><select id="region"><option value="cn">中国</option><option value="sg">新加坡</option></select>
+                <button data-testid="submit">提交</button>
+                <input type="submit" value="原生提交">
+                <output id="result"></output>
+                <iframe src="http://127.0.0.1:${framePort}/frame"></iframe>
+                <script>
+                    document.querySelector('[data-testid="submit"]').addEventListener('click', async () => {
+                        const response = await fetch('/submit', {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ name: document.querySelector('#name').value }),
+                        });
+                        document.querySelector('#result').textContent = await response.text();
+                    });
+                    document.querySelector('input[type="submit"]').addEventListener('click', event => {
+                        event.preventDefault();
+                        document.querySelector('#result').dataset.nativeClicked = 'yes';
+                    });
+                </script>`);
+            return;
+        }
+        const chunks = [];
+        req.on('data', chunk => chunks.push(chunk));
+        req.on('end', () => {
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'X-Smoke': 'yes' });
+            res.end(JSON.stringify({ ok: true, requestBody: Buffer.concat(chunks).toString('utf8') }));
+        });
+    });
+    const mainPort = await listen(mainServer);
+    t.after(() => close(mainServer));
+
+    const browser = await chromium.launch({ channel: 'chrome', headless: true });
+    t.after(() => browser.close());
+    const context = await browser.newContext();
+    const sessionDir = fs.mkdtempSync(path.join(os.tmpdir(), 'craft-rpa-smoke-'));
+    const controller = createBrowserController({ getContext: () => context, sessionDir });
+    await context.exposeBinding('__craftRpaAppendEvents', (source, payload) => {
+        events.push(...(Array.isArray(payload) ? payload : [payload]));
+        return { ok: true };
+    });
+    const injectContent = fs.readFileSync(path.join(__dirname, '..', 'inject.js'), 'utf8');
+    await context.addInitScript({ content: `globalThis.__CRAFT_RPA_CONFIG__ = {};\n${injectContent}` });
+    const capture = installNetworkCapture(context, { appendEvents: batch => events.push(...batch), port: 7777, maxBodyBytes: 20 * 1024 * 1024 });
+    t.after(() => capture.dispose());
+
+    const page = await context.newPage();
+    await page.goto(`http://127.0.0.1:${mainPort}/`, { waitUntil: 'networkidle' });
+    const observed = await controller.observe({ index: 0, screenshot: true, dom: true });
+    assert.equal(observed.frames.length, 2);
+    assert.equal(fs.existsSync(observed.artifacts.screenshot.path), true);
+    assert.equal(observed.artifacts.dom.length, 2);
+    const nativeSubmit = observed.frames[0].elements.find(element => element.name === '原生提交');
+    assert.deepEqual(nativeSubmit.target, { role: 'button', name: '原生提交', exact: true });
+    await controller.dispatch('click', { index: 0, target: nativeSubmit.target });
+    assert.equal(await page.locator('#result').getAttribute('data-native-clicked'), 'yes');
+
+    await controller.dispatch('fill', { index: 0, target: { label: '姓名', exact: true }, value: '静默花' });
+    await controller.dispatch('select', { index: 0, target: { label: '地区', exact: true }, value: 'sg' });
+    await controller.dispatch('check', { index: 0, target: { label: '同意', exact: true } });
+    await controller.dispatch('click', { index: 0, target: { testId: 'submit' } });
+    await page.waitForFunction(() => document.querySelector('#result').textContent.includes('requestBody'));
+    await page.waitForTimeout(700);
+
+    const networkEvents = events.filter(event => event.kind === 'network');
+    assert.equal(networkEvents.some(event => event.requestUrl.includes('/submit') && event.requestBody.includes('静默花')), true);
+    assert.equal(networkEvents.some(event => event.requestUrl.includes('/frame-api')), true);
+    assert.equal(networkEvents.some(event => event.requestUrl.includes('/frame-xhr')), true);
+    assert.equal(events.some(event => event.kind === 'interaction' && event.type === 'click'), true);
+});

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/test/control-http.test.js

@@ -0,0 +1,100 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const http = require('node:http');
+const net = require('node:net');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { callControl } = require('../../scripts/control-client');
+const { startLogger } = require('../logger');
+
+function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const port = server.address().port;
+            server.close(error => error ? reject(error) : resolve(port));
+        });
+    });
+}
+
+function request(url, options = {}, payload = null) {
+    return new Promise((resolve, reject) => {
+        const body = payload === null ? null : (Buffer.isBuffer(payload) ? payload : Buffer.from(JSON.stringify(payload)));
+        const req = http.request(url, {
+            method: options.method || 'GET',
+            headers: {
+                ...(options.headers || {}),
+                ...(body ? { 'Content-Type': 'application/json', 'Content-Length': body.length } : {}),
+            },
+        }, res => {
+            const chunks = [];
+            res.on('data', chunk => chunks.push(chunk));
+            res.on('end', () => resolve({ status: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }));
+        });
+        req.on('error', reject);
+        req.end(body || undefined);
+    });
+}
+
+test('无 token 的本机客户端可控制，第三方 Origin 被拒绝，跨域 /log 保持可用', async t => {
+    const port = await findFreePort();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'craft-rpa-logger-'));
+    const logFile = path.join(dir, 'session.jsonl');
+    const controller = {
+        dispatch: async (action, body) => ({ ok: true, action, body }),
+    };
+    const server = startLogger({ port, host: '127.0.0.1', logFile, browserController: controller });
+    await new Promise(resolve => server.once('listening', resolve));
+    t.after(() => new Promise(resolve => server.close(resolve)));
+    const origin = `http://127.0.0.1:${port}`;
+
+    const cliResult = await callControl('click', { target: { testId: 'submit' } }, { origin });
+    assert.equal(cliResult.ok, true);
+    assert.equal(cliResult.action, 'click');
+
+    const forbidden = await request(`${origin}/control/click`, {
+        method: 'POST',
+        headers: { Origin: 'https://third-party.example' },
+    }, { target: { testId: 'submit' } });
+    assert.equal(forbidden.status, 403);
+    assert.equal(JSON.parse(forbidden.body).error.code, 'ORIGIN_FORBIDDEN');
+
+    const logged = await request(`${origin}/log`, {
+        method: 'POST',
+        headers: { Origin: 'https://third-party.example' },
+    }, { kind: 'interaction', type: 'click' });
+    assert.equal(logged.status, 200);
+    const event = JSON.parse(fs.readFileSync(logFile, 'utf8').trim());
+    assert.equal(event.kind, 'interaction');
+    assert.ok(event.serverTime);
+
+    server.appendEvents({
+        kind: 'network',
+        requestUrl: 'https://example.test/private',
+        requestHeaders: { authorization: 'Bearer local' },
+        requestBody: 'raw-request-body',
+        requestSize: 16,
+        responseHeaders: { 'set-cookie': 'session=raw-secret' },
+        responseBody: 'raw-response-body',
+        responseSize: 17,
+    });
+    const summaries = JSON.parse((await request(`${origin}/events`)).body);
+    const networkSummary = summaries.find(item => item.kind === 'network');
+    assert.equal(networkSummary.requestBody, undefined);
+    assert.equal(networkSummary.responseBody, undefined);
+    assert.equal(networkSummary.requestHeaders, undefined);
+    assert.equal(networkSummary.responseHeaders, undefined);
+    assert.equal(networkSummary.requestBodyCaptured, true);
+    assert.equal(networkSummary.responseBodyCaptured, true);
+
+    const session = await request(`${origin}/session`);
+    assert.equal(session.status, 200);
+    assert.match(session.body, /raw-request-body/);
+    assert.match(session.body, /Bearer local/);
+
+    const tooLarge = await request(`${origin}/control/click`, { method: 'POST' }, Buffer.alloc(2 * 1024 * 1024 + 1, 0x61));
+    assert.equal(tooLarge.status, 413);
+    assert.equal(JSON.parse(tooLarge.body).error.code, 'BODY_TOO_LARGE');
+});

package/enhancements/common/.common/.claude/skills/craft-rpa/recorder/test/logger.test.js

@@ -0,0 +1,14 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { isProtectedOriginAllowed } = require('../logger');
+
+test('无 Origin 的本机客户端和同源 Dashboard 可访问控制接口', () => {
+    assert.equal(isProtectedOriginAllowed(undefined, 'localhost:7777'), true);
+    assert.equal(isProtectedOriginAllowed('http://localhost:7777', 'localhost:7777'), true);
+    assert.equal(isProtectedOriginAllowed('http://127.0.0.1:3000', 'localhost:7777'), true);
+});
+
+test('第三方页面 Origin 不能调用控制接口', () => {
+    assert.equal(isProtectedOriginAllowed('https://example.test', 'localhost:7777'), false);
+    assert.equal(isProtectedOriginAllowed('invalid-origin', 'localhost:7777'), false);
+});