instar 1.3.1255 → 1.3.1256

package/dist/core/ChromeCdpReloginBrowser.d.ts

@@ -1,10 +1,21 @@
 import type { ReloginBrowserPort, ReloginBrowserSnapshot } from './AnthropicReloginBrowserDriver.js';
+import { type OriginPolicy } from './PasskeyBrowserPolicy.js';
 export interface ChromeCdpReloginBrowserOptions {
     userDataDir: string;
     chromePath?: string;
     headless?: boolean;
     launchTimeoutMs?: number;
     operationTimeoutMs?: number;
+    /**
+     * Passkey mode (spec agent-held-google-passkey §3.5): CDP over the debugging
+     * PIPE (no TCP port, no DevToolsActivePort), extensions and prerendering off,
+     * every target created at about:blank and given a virtual authenticator BEFORE
+     * its first navigation, popups auto-attached and paused until prepared,
+     * service workers bypassed, and request-time credential removal.
+     */
+    passkeyMode?: boolean;
+    /** Where the credential may be present. Production: the Google policy (default). */
+    originPolicy?: OriginPolicy;
 }
 /** Closed structural floor for OpenAI's device confirmation; consent prose can never enter this class. */
 export declare function isClosedOpenAiDeviceApproval(input: {
@@ -14,6 +25,15 @@ export declare function isClosedOpenAiDeviceApproval(input: {
     body: string;
 }): boolean;
 export declare function resolveChromeExecutable(): string | null;
+/** An exported WebAuthn credential, in the shape CDP's WebAuthn domain uses. */
+export interface WebAuthnCredential {
+    credentialId: string;
+    isResidentCredential: boolean;
+    rpId: string;
+    privateKey: string;
+    userHandle?: string;
+    signCount: number;
+}
 /**
  * Narrow Chrome DevTools implementation of ReloginBrowserPort.
  * It returns only a closed page classification; raw DOM, URLs-with-query,
@@ -25,25 +45,113 @@ export declare class ChromeCdpReloginBrowser implements ReloginBrowserPort {
     private readonly headless;
     private readonly launchTimeoutMs;
     private readonly operationTimeoutMs;
+    private readonly passkeyMode;
+    private readonly policy;
     private child;
-    private socket;
+    private transport;
     private requestId;
     private pending;
+    private readonly eventHandlers;
+    /** Pipe mode: every attached target by sessionId. */
+    private readonly sessions;
+    private mainSessionId;
+    private mainSessionReady;
+    /** The credential currently loaded into the authenticators, or null. */
+    private credential;
+    /**
+     * Every credential id this browser has EVER loaded into an authenticator. Removal
+     * sweeps these from every authenticator regardless of the in-memory flag, so a
+     * target that received the key during a prepare/remove interleave can never keep it.
+     */
+    private readonly knownCredentialIds;
+    /** Serialises add / remove / prepare-time load so they can never interleave. */
+    private credentialLock;
+    private readonly assertedCredentialIds;
+    /** True if a Google-origin document navigation was ever seen before an attach completed. */
+    private navigationBeforeAttach;
     constructor(options: ChromeCdpReloginBrowserOptions);
     open(url: string): Promise<void>;
+    /** Legacy transport: TCP debugging port + a page-level WebSocket (non-passkey sessions). */
+    private openTcp;
+    /**
+     * Passkey transport: the debugging pipe. The initial about:blank page is
+     * auto-attached and PREPARED (authenticator, interception, service-worker
+     * bypass) before the first navigation; popups are paused until prepared.
+     */
+    private openPipe;
+    private onAttached;
+    /** Everything a target needs BEFORE it is allowed to navigate. */
+    private prepareSession;
+    private onRequestPaused;
+    /**
+     * Add the credential to every prepared authenticator. Allowed only while the
+     * main target's frames satisfy the origin policy (top-level on the holder
+     * origin, no other RP-family frame). The value stays inside this process.
+     */
+    addCredential(credential: WebAuthnCredential): Promise<void>;
+    /**
+     * Remove every credential this browser ever loaded from EVERY authenticator, and
+     * forget the current one. Does not trust the in-memory flag: the sweep runs whenever
+     * any id is known, so no target can keep a key the flag says is gone. Idempotent.
+     */
+    removeCredential(): Promise<void>;
+    /** Run `fn` with exclusive access to the credential state (add / remove / prepare-time load). */
+    private withCredentialLock;
+    /** Whether the credential is currently loaded into the authenticators. */
+    hasCredential(): boolean;
+    /** True once Google (or the fixture) actually asked for and received an assertion from this credential. */
+    observedAssertion(credentialId: string): boolean;
+    /** Export every credential in the MAIN target's authenticator (used at mint). */
+    exportCredentials(): Promise<WebAuthnCredential[]>;
+    /** Credential COUNT per prepared target (never material) — proves every attached target's authenticator is loaded. */
+    credentialCountsByTarget(): Promise<number[]>;
+    /** Number of credentials the MAIN authenticator holds (a count, never material). */
+    credentialCount(): Promise<number>;
+    /**
+     * Compare the signed-in identity shown on the current page with the expected
+     * email INSIDE the browser; only the boolean leaves. Structural first
+     * (`data-email` / `data-identifier` / `aria-label`), then an exact-text element.
+     */
+    readSignedInIdentityMatches(expected: string): Promise<boolean>;
+    /**
+     * Whether any target was seen navigating before its authenticator was attached. A
+     * DIAGNOSTIC only: it observes from `Page.enable` onward, so it can confirm a breach
+     * it saw but not prove absence. The guarantee itself is Chrome's
+     * `waitForDebuggerOnStart` pause, which the popup test exercises.
+     */
+    sawNavigationBeforeAttach(): boolean;
+    /**
+     * Run an expression in the main page. FIXTURE-ONLY: refused under the production
+     * Google policy so no caller can turn the repair browser into an arbitrary-evaluate
+     * surface on a real account page.
+     */
+    runInPage<T>(expression: string): Promise<T>;
+    private assertFixturePolicy;
+    /** Origins of every frame in ONE page target (its own tree plus its out-of-process iframes). */
+    private frameOrigins;
     snapshot(expectedIdentity: string): Promise<ReloginBrowserSnapshot>;
     chooseExpectedAccount(expectedIdentity: string): Promise<void>;
     fillPublic(field: 'email' | 'device-code', value: string): Promise<void>;
     fillSecret(field: 'password' | 'totp', value: string): Promise<void>;
     click(action: 'next' | 'authorize' | 'google'): Promise<void>;
+    /** Click a fixture/test element by CSS selector with a REAL pointer event. FIXTURE-ONLY (see runInPage). */
+    clickSelector(selector: string): Promise<void>;
     readPasteCode(): Promise<string | null>;
     wait(ms: number): Promise<void>;
     close(): Promise<void>;
     private waitForChildExit;
+    /**
+     * Real pointer click: resolve the element with `finderExpression` (must
+     * evaluate to an HTMLElement or null), scroll it into view, read its centre,
+     * and dispatch mouse pressed/released through the Input domain.
+     */
+    private clickReal;
     private fillAndSubmit;
     private evaluate;
     private waitForPort;
-    private connect;
+    private connectWs;
+    private attachTransport;
+    private on;
     private send;
 }
 //# sourceMappingURL=ChromeCdpReloginBrowser.d.ts.map

package/dist/core/ChromeCdpReloginBrowser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChromeCdpReloginBrowser.d.ts","sourceRoot":"","sources":["../../src/core/ChromeCdpReloginBrowser.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,0GAA0G;AAC1G,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CACvE,GAAG,OAAO,CAOV;AAYD,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AAID;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,OAAO,CAAmI;gBAEtI,OAAO,EAAE,8BAA8B;IAS7C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAiDnE,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9D,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxE,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7D,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQvC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBd,gBAAgB;YAoBhB,aAAa;YAoBb,QAAQ;YAQR,WAAW;YAaX,OAAO;IAwBrB,OAAO,CAAC,IAAI;CAcb"}
+{"version":3,"file":"ChromeCdpReloginBrowser.d.ts","sourceRoot":"","sources":["../../src/core/ChromeCdpReloginBrowser.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,0GAA0G;AAC1G,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CACvE,GAAG,OAAO,CAOV;AAYD,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AA8ED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,OAAO,CAAmI;IAClJ,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAgE;IACxF,wEAAwE;IACxE,OAAO,CAAC,UAAU,CAAmC;IACrD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,gFAAgF;IAChF,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,4FAA4F;IAC5F,OAAO,CAAC,sBAAsB,CAAS;gBAE3B,OAAO,EAAE,8BAA8B;IAa7C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStC,4FAA4F;YAC9E,OAAO;IAgCrB;;;;OAIG;YACW,QAAQ;YA4CR,UAAU;IAqBxB,kEAAkE;YACpD,cAAc;YAgCd,eAAe;IAyB7B;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBvC,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAM1B,0EAA0E;IAC1E,aAAa,IAAI,OAAO;IAExB,2GAA2G;IAC3G,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAEhD,iFAAiF;IAC3E,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQxD,sHAAsH;IAChH,wBAAwB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYnD,oFAAoF;IAC9E,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;;;OAIG;IACG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBrE;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO;IAEpC;;;;OAIG;IACG,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKlD,OAAO,CAAC,mBAAmB;IAM3B,gGAAgG;YAClF,YAAY;IA2BpB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAiDnE,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9D,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxE,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAanE,4GAA4G;IACtG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQvC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YA0Bd,gBAAgB;IAoB9B;;;;OAIG;YACW,SAAS;YAgBT,aAAa;YA+Bb,QAAQ;YAQR,WAAW;YAaX,SAAS;IAUvB,OAAO,CAAC,eAAe;IA4BvB,OAAO,CAAC,EAAE;IAMV,OAAO,CAAC,IAAI;CAcb"}