jorgex-stack 1.9.62 → 1.9.64

package/dist/browser-playwright.js

@@ -0,0 +1,955 @@
+#!/usr/bin/env node
+
+// src/lib/browser-command.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import path9 from "path";
+
+// src/lib/paths.ts
+import os from "os";
+import path from "path";
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+var HOME = os.homedir();
+function dataDir() {
+  return path.join(HOME, ".jorgex-stack");
+}
+
+// src/lib/browser-managed.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import fs3 from "fs";
+import path5 from "path";
+
+// src/lib/browser-stage.ts
+import { spawnSync } from "child_process";
+import fs2 from "fs";
+import path4 from "path";
+import { createHash as createHash2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/lib/npm-provider.ts
+import fs from "fs";
+import path2 from "path";
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var MAX_METADATA_BYTES = 4 * 1024 * 1024;
+var STABLE_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function isStableSemverVersion(value) {
+  return typeof value === "string" && STABLE_SEMVER.test(value);
+}
+function isCanonicalSha512Integrity(integrity) {
+  if (typeof integrity !== "string" || !integrity.startsWith("sha512-")) return false;
+  const b64 = integrity.slice("sha512-".length);
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return false;
+  let bytes;
+  try {
+    bytes = Buffer.from(b64, "base64");
+  } catch {
+    return false;
+  }
+  return bytes.length === 64 && bytes.toString("base64") === b64;
+}
+function isValidObservedVersion(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const observed = value;
+  return isStableSemverVersion(observed.version) && isCanonicalSha512Integrity(observed.integrity);
+}
+var MAX_TARBALL_BYTES = 128 * 1024 * 1024;
+
+// src/lib/detect.ts
+import path3 from "path";
+import { existsSync as existsSync2, statSync } from "fs";
+import { execFileSync } from "child_process";
+
+// src/lib/browser-stage.ts
+var MAX_ARTIFACT_BYTES = 128 * 1024 * 1024;
+var MAX_JSON_BYTES = 4 * 1024 * 1024;
+var MAX_TREE_BYTES = 512 * 1024 * 1024;
+var MAX_TREE_ENTRIES = 1e5;
+var MAX_TREE_METADATA_BYTES = 32 * 1024 * 1024;
+var MAX_TREE_PATH_BYTES = 16 * 1024;
+var MAX_TREE_SYMLINK_BYTES = 16 * 1024;
+var TREE_HASH_CHUNK_BYTES = 1024 * 1024;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function fail(message) {
+  throw new Error(`browser-stage: ${message}`);
+}
+function lstatOrFail(file, label) {
+  let stat;
+  try {
+    stat = fs2.lstatSync(file);
+  } catch {
+    fail(`missing ${label}: ${file}`);
+  }
+  return stat;
+}
+function assertContained(realRoot, candidate, label) {
+  let resolved;
+  try {
+    resolved = fs2.realpathSync(candidate);
+  } catch {
+    fail(`cannot resolve ${label}: ${candidate}`);
+  }
+  if (resolved !== realRoot && !resolved.startsWith(realRoot + path4.sep)) {
+    fail(`${label} escapes the stage`);
+  }
+  return resolved;
+}
+function isContainedTreePath(root, candidate, allowEqual) {
+  const relative = path4.relative(path4.resolve(root), path4.resolve(candidate));
+  if (relative === "") return allowEqual;
+  return relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+}
+function readContainedTreeSymlinkTarget(linkPath, root, metadata) {
+  let raw;
+  try {
+    raw = fs2.readlinkSync(linkPath, "buffer");
+  } catch {
+    fail(`cannot read staged symlink: ${linkPath}`);
+  }
+  const target = raw.toString("utf8");
+  if (!Buffer.from(target, "utf8").equals(raw) || target === "" || CONTROL_CHARACTERS.test(target) || raw.byteLength > MAX_TREE_SYMLINK_BYTES || path4.isAbsolute(target) || process.platform === "win32" && /^[a-zA-Z]:/.test(target)) {
+    fail(`staged symlink must be an internal relative UTF-8 target: ${linkPath}`);
+  }
+  const separator = process.platform === "win32" ? /[\\/]+/ : /\/+/;
+  const parts = target.split(separator).filter((part) => part !== "" && part !== ".");
+  if (parts.length === 0) fail(`staged symlink target is empty: ${linkPath}`);
+  let current = path4.dirname(path4.resolve(linkPath));
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    const last = index === parts.length - 1;
+    current = part === ".." ? path4.dirname(current) : path4.join(current, part);
+    if (!isContainedTreePath(root, current, true)) fail(`staged symlink escapes its tree: ${linkPath}`);
+    let stat;
+    try {
+      stat = fs2.lstatSync(current);
+    } catch {
+      fail(`staged symlink target is missing: ${linkPath}`);
+    }
+    if (stat.isSymbolicLink()) fail(`staged symlink chain is not allowed: ${linkPath}`);
+    if (last) {
+      if (!stat.isFile() && !stat.isDirectory()) fail(`staged symlink target is not a file or directory: ${linkPath}`);
+    } else if (!stat.isDirectory()) {
+      fail(`staged symlink target traverses a non-directory: ${linkPath}`);
+    }
+  }
+  if (metadata.bytes + raw.byteLength > MAX_TREE_METADATA_BYTES) {
+    fail("staged tree exceeds its metadata bound");
+  }
+  metadata.bytes += raw.byteLength;
+  return target;
+}
+function readTreeDirectoryEntries(directoryPath, root, remainingEntries, metadata) {
+  let directory;
+  try {
+    directory = fs2.opendirSync(directoryPath);
+  } catch {
+    fail(`cannot open staged tree directory: ${directoryPath}`);
+  }
+  const entries = [];
+  let primary = null;
+  try {
+    for (; ; ) {
+      const entry = directory.readSync();
+      if (entry === null) break;
+      if (entries.length >= remainingEntries) fail("staged tree exceeds its entry bound");
+      const fullPath = path4.join(directoryPath, entry.name);
+      const relativePath = path4.relative(path4.resolve(root), fullPath).split(path4.sep).join("/");
+      const pathBytes = Buffer.byteLength(relativePath, "utf8");
+      if (relativePath === "" || CONTROL_CHARACTERS.test(relativePath) || pathBytes > MAX_TREE_PATH_BYTES || metadata.bytes + pathBytes > MAX_TREE_METADATA_BYTES) {
+        fail(`staged tree contains an invalid or oversized path: ${fullPath}`);
+      }
+      metadata.bytes += pathBytes;
+      entries.push({ fullPath, relativePath });
+    }
+  } catch (error) {
+    primary = error;
+    if (error instanceof Error && error.message.startsWith("browser-stage: ")) throw error;
+    fail(`cannot read staged tree directory: ${directoryPath}`);
+  } finally {
+    try {
+      directory.closeSync();
+    } catch (error) {
+      if (primary === null) fail(`cannot close staged tree directory: ${directoryPath}`);
+    }
+  }
+  return entries;
+}
+function openTrustedTreeFile(filePath) {
+  const flags = fs2.constants.O_RDONLY | (fs2.constants.O_NONBLOCK ?? 0) | (fs2.constants.O_NOFOLLOW ?? 0);
+  let fd;
+  try {
+    fd = fs2.openSync(filePath, flags);
+  } catch {
+    fail(`cannot open staged tree file: ${filePath}`);
+  }
+  let stat;
+  try {
+    stat = fs2.fstatSync(fd);
+  } catch {
+    try {
+      fs2.closeSync(fd);
+    } catch {
+    }
+    fail(`cannot stat staged tree file: ${filePath}`);
+  }
+  if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size < 0) {
+    try {
+      fs2.closeSync(fd);
+    } catch {
+    }
+    fail(`staged tree entry is not a regular file: ${filePath}`);
+  }
+  return { fd, size: stat.size };
+}
+function hashTrustedTreeFile(hash, filePath, total) {
+  const opened = openTrustedTreeFile(filePath);
+  let primary = null;
+  try {
+    if (opened.size > MAX_TREE_BYTES || total.bytes + opened.size > MAX_TREE_BYTES) {
+      fail("staged tree exceeds its byte bound");
+    }
+    const length = Buffer.alloc(8);
+    length.writeBigUInt64BE(BigInt(opened.size));
+    hash.update(length);
+    const buffer = Buffer.allocUnsafe(TREE_HASH_CHUNK_BYTES);
+    let readTotal = 0;
+    for (; ; ) {
+      let read;
+      try {
+        read = fs2.readSync(opened.fd, buffer, 0, buffer.length, null);
+      } catch {
+        fail(`cannot read staged tree file: ${filePath}`);
+      }
+      if (read === 0) break;
+      readTotal += read;
+      if (readTotal > opened.size || total.bytes + readTotal > MAX_TREE_BYTES) {
+        fail(`staged tree file changed or exceeds its byte bound: ${filePath}`);
+      }
+      hash.update(buffer.subarray(0, read));
+    }
+    const finalStat = fs2.fstatSync(opened.fd);
+    if (!finalStat.isFile() || finalStat.size !== readTotal || readTotal !== opened.size) {
+      fail(`staged tree file changed while being verified: ${filePath}`);
+    }
+    total.bytes += readTotal;
+  } catch (error) {
+    primary = error;
+    throw error;
+  } finally {
+    try {
+      fs2.closeSync(opened.fd);
+    } catch {
+      if (primary === null) fail(`cannot close staged tree file: ${filePath}`);
+    }
+  }
+}
+function browserTreeSha256(nodeModulesPath, realStage) {
+  const nodeModulesStat = lstatOrFail(nodeModulesPath, "node_modules");
+  if (!nodeModulesStat.isDirectory() || nodeModulesStat.isSymbolicLink()) {
+    fail("node_modules must be a real directory");
+  }
+  assertContained(realStage, nodeModulesPath, "node_modules");
+  const root = path4.resolve(nodeModulesPath);
+  const entries = [];
+  const pending = [root];
+  const metadata = { bytes: 0 };
+  while (pending.length > 0) {
+    const directory = pending.pop();
+    for (const { fullPath, relativePath } of readTreeDirectoryEntries(
+      directory,
+      root,
+      MAX_TREE_ENTRIES - entries.length,
+      metadata
+    )) {
+      if (entries.length >= MAX_TREE_ENTRIES) fail("staged tree exceeds its entry bound");
+      const stat = lstatOrFail(fullPath, "staged tree entry");
+      if (stat.isSymbolicLink()) {
+        entries.push({
+          kind: "symlink",
+          relativePath,
+          target: readContainedTreeSymlinkTarget(fullPath, root, metadata)
+        });
+      } else if (stat.isDirectory()) {
+        entries.push({ kind: "dir", relativePath });
+        pending.push(fullPath);
+      } else if (stat.isFile()) {
+        entries.push({ kind: "file", relativePath, filePath: fullPath });
+      } else {
+        fail(`staged tree contains an unsupported entry: ${fullPath}`);
+      }
+    }
+  }
+  entries.sort(
+    (left, right) => left.relativePath < right.relativePath ? -1 : left.relativePath > right.relativePath ? 1 : 0
+  );
+  const hash = createHash2("sha256");
+  hash.update("browser-v2\0", "utf8");
+  const total = { bytes: 0 };
+  for (const entry of entries) {
+    hash.update(`${entry.kind}\0${entry.relativePath}\0`, "utf8");
+    if (entry.kind === "symlink") {
+      const payload = Buffer.from(entry.target, "utf8");
+      const length = Buffer.alloc(8);
+      length.writeBigUInt64BE(BigInt(payload.length));
+      hash.update(length);
+      hash.update(payload);
+      total.bytes += payload.length;
+      if (total.bytes > MAX_TREE_BYTES) fail("staged tree exceeds its byte bound");
+    } else if (entry.kind === "dir") {
+      hash.update(Buffer.alloc(8));
+    } else {
+      hashTrustedTreeFile(hash, entry.filePath, total);
+    }
+  }
+  return hash.digest("hex");
+}
+
+// src/lib/browser-managed.ts
+var MANAGED_ROOT = ".browser-managed";
+var LOCK_FILE = ".activation.lock";
+var ACTIVE_POINTER_FILE = "active.v1.json";
+var RECEIPT_FILE = "receipt.json";
+var HASH = /^[a-f0-9]{64}$/;
+var PACKAGE_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+var NPM_VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+var MAX_TREE_BYTES2 = 512 * 1024 * 1024;
+var MAX_TREE_ENTRIES2 = 1e5;
+var MAX_TREE_METADATA_BYTES2 = 32 * 1024 * 1024;
+var MAX_TREE_PATH_BYTES2 = 16 * 1024;
+var MAX_TREE_SYMLINK_BYTES2 = 16 * 1024;
+var TREE_HASH_CHUNK_BYTES2 = 1024 * 1024;
+var CONTROL_CHARACTERS2 = /[\u0000-\u001f\u007f]/;
+function fail2(message) {
+  throw new Error(`browser-managed: ${message}`);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function absolutePath(value, label) {
+  if (typeof value !== "string" || value === "" || !path5.isAbsolute(value)) {
+    fail2(`${label} must be a non-empty absolute path`);
+  }
+  return path5.resolve(value);
+}
+function lstatOrFail2(file, label) {
+  try {
+    return fs3.lstatSync(file);
+  } catch {
+    fail2(`missing ${label}: ${file}`);
+  }
+}
+function fileIdentity(stat) {
+  return { dev: stat.dev, ino: stat.ino };
+}
+function realpathOrFail(file, label) {
+  try {
+    return fs3.realpathSync(file);
+  } catch {
+    fail2(`cannot resolve ${label}: ${file}`);
+  }
+}
+function assertRealDirectory(directory, label) {
+  const stat = lstatOrFail2(directory, label);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail2(`${label} must be a real directory: ${directory}`);
+  return realpathOrFail(directory, label);
+}
+function existingRealDirectory(directory, label) {
+  let stat;
+  try {
+    stat = fs3.lstatSync(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    fail2(`cannot inspect ${label}: ${directory}`);
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail2(`${label} must be a real directory`);
+  return realpathOrFail(directory, label);
+}
+function isContained(root, candidate, allowEqual) {
+  const relative = path5.relative(path5.resolve(root), path5.resolve(candidate));
+  if (relative === "") return allowEqual;
+  return relative !== ".." && !relative.startsWith(`..${path5.sep}`) && !path5.isAbsolute(relative);
+}
+function assertContained2(root, candidate, label) {
+  const resolved = realpathOrFail(candidate, label);
+  if (!isContained(root, resolved, false)) fail2(`${label} escapes its root`);
+  return resolved;
+}
+function packageDirectoryName(packageName) {
+  return packageName === "@playwright/cli" ? "playwright-cli" : "chrome-devtools-mcp";
+}
+function validateClosureIdentity(value, packageName, version, integrity) {
+  if (!Array.isArray(value) || value.length === 0) fail2("staged closure must be a non-empty array");
+  const seen = /* @__PURE__ */ new Set();
+  const closure = [];
+  for (const item of value) {
+    if (!isRecord(item)) fail2("staged closure entry must be an object");
+    if (typeof item.name !== "string" || !PACKAGE_NAME.test(item.name) || typeof item.version !== "string" || !NPM_VERSION.test(item.version) || !isCanonicalSha512Integrity(item.integrity)) {
+      fail2("staged closure entry is invalid");
+    }
+    const key = `${item.name}@${item.version}`;
+    if (seen.has(key)) fail2(`staged closure contains a duplicate: ${key}`);
+    seen.add(key);
+    closure.push({ name: item.name, version: item.version, integrity: item.integrity });
+  }
+  const root = closure.find((item) => item.name === packageName);
+  if (root === void 0 || root.version !== version || root.integrity !== integrity) {
+    fail2("staged closure root differs from release");
+  }
+  return closure;
+}
+function readBoundedRegularFile(file, label, maxBytes) {
+  const stat = lstatOrFail2(file, label);
+  if (!stat.isFile() || stat.isSymbolicLink()) fail2(`${label} must be a regular file`);
+  if (stat.size > maxBytes) fail2(`${label} exceeds its size bound`);
+  try {
+    return fs3.readFileSync(file);
+  } catch {
+    fail2(`cannot read ${label}: ${file}`);
+  }
+}
+function readOptionalRegularFile(file, label, maxBytes) {
+  let stat;
+  try {
+    stat = fs3.lstatSync(file);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    fail2(`cannot inspect ${label}: ${file}`);
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) fail2(`${label} must be a regular file`);
+  if (stat.size > maxBytes) fail2(`${label} exceeds its size bound`);
+  try {
+    return fs3.readFileSync(file);
+  } catch {
+    fail2(`cannot read ${label}: ${file}`);
+  }
+}
+function assertStrictKeys(value, expected, label) {
+  const actual = Object.keys(value).sort();
+  const required = [...expected].sort();
+  if (actual.length !== required.length || actual.some((key, index) => key !== required[index])) {
+    fail2(`${label} has unexpected fields`);
+  }
+}
+function parseJsonObject(raw, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.toString("utf8"));
+  } catch {
+    fail2(`${label} is malformed`);
+  }
+  if (!isRecord(parsed)) fail2(`${label} must be an object`);
+  return parsed;
+}
+function validateReceiptObject(value, packageDir, expectedPackageName, expectedRootPath) {
+  if (!isRecord(value)) fail2("managed receipt must be an object");
+  assertStrictKeys(
+    value,
+    [
+      "closure",
+      "entryPath",
+      "integrity",
+      "launcherPath",
+      "launcherSha256",
+      "packageName",
+      "rootPath",
+      "schemaVersion",
+      "treePath",
+      "treeSha256",
+      "version"
+    ],
+    "managed receipt"
+  );
+  if (value.schemaVersion !== 1 || value.packageName !== expectedPackageName) fail2("managed receipt identity is invalid");
+  if (!isStableSemverVersion(value.version) || !isCanonicalSha512Integrity(value.integrity)) {
+    fail2("managed receipt release identity is invalid");
+  }
+  const rootPath = absolutePath(value.rootPath, "managed receipt rootPath");
+  if (rootPath !== expectedRootPath || path5.dirname(rootPath) !== packageDir || !path5.basename(rootPath).startsWith("release-")) {
+    fail2("managed receipt rootPath is not an owned release");
+  }
+  const rootStat = lstatOrFail2(rootPath, "managed release root");
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) fail2("managed release root is not a real directory");
+  const treePath = absolutePath(value.treePath, "managed receipt treePath");
+  if (treePath !== path5.join(rootPath, "node_modules")) fail2("managed receipt treePath is invalid");
+  assertRealDirectory(treePath, "managed receipt tree");
+  const entryPath = absolutePath(value.entryPath, "managed receipt entryPath");
+  const launcherPath = absolutePath(value.launcherPath, "managed receipt launcherPath");
+  if (!isContained(treePath, entryPath, false)) fail2("managed receipt entryPath escapes the tree");
+  if (!isContained(rootPath, launcherPath, false)) fail2("managed receipt launcherPath escapes the release");
+  assertContained2(treePath, entryPath, "managed receipt entryPath");
+  assertContained2(rootPath, launcherPath, "managed receipt launcherPath");
+  const entryStat = lstatOrFail2(entryPath, "managed receipt entry");
+  if (!entryStat.isFile() || entryStat.isSymbolicLink()) fail2("managed receipt entry is not a regular file");
+  const launcherStat = lstatOrFail2(launcherPath, "managed receipt launcher");
+  if (!launcherStat.isFile() || launcherStat.isSymbolicLink()) fail2("managed receipt launcher is not a regular file");
+  if (typeof value.treeSha256 !== "string" || !HASH.test(value.treeSha256)) fail2("managed receipt treeSha256 is invalid");
+  if (typeof value.launcherSha256 !== "string" || !HASH.test(value.launcherSha256)) fail2("managed receipt launcherSha256 is invalid");
+  const closure = validateClosureIdentity(value.closure, expectedPackageName, value.version, value.integrity);
+  const observedTreeSha256 = browserTreeSha256(treePath, rootPath);
+  if (observedTreeSha256 !== value.treeSha256) fail2("managed receipt tree digest drifted");
+  if (hashRegularFile(launcherPath) !== value.launcherSha256) fail2("managed receipt launcher digest drifted");
+  return {
+    schemaVersion: 1,
+    packageName: expectedPackageName,
+    version: value.version,
+    integrity: value.integrity,
+    rootPath,
+    treePath,
+    entryPath,
+    launcherPath,
+    treeSha256: value.treeSha256,
+    launcherSha256: value.launcherSha256,
+    closure
+  };
+}
+function readValidatedActiveBrowser(packageDir, packageName) {
+  const pointerPath = path5.join(packageDir, ACTIVE_POINTER_FILE);
+  const pointerRaw = readOptionalRegularFile(pointerPath, "active browser pointer", 64 * 1024);
+  if (pointerRaw === null) return null;
+  const pointerIdentity = fileIdentity(lstatOrFail2(pointerPath, "active browser pointer"));
+  const pointer = parseJsonObject(pointerRaw, "active browser pointer");
+  assertStrictKeys(pointer, ["packageName", "receiptSha256", "rootPath", "schemaVersion"], "active browser pointer");
+  if (pointer.schemaVersion !== 1 || pointer.packageName !== packageName) fail2("active browser pointer identity is invalid");
+  if (typeof pointer.receiptSha256 !== "string" || !HASH.test(pointer.receiptSha256)) {
+    fail2("active browser pointer receiptSha256 is invalid");
+  }
+  const rootPath = absolutePath(pointer.rootPath, "active browser pointer rootPath");
+  if (path5.dirname(rootPath) !== packageDir || !path5.basename(rootPath).startsWith("release-")) {
+    fail2("active browser pointer rootPath is not an owned release");
+  }
+  const receiptPath = path5.join(rootPath, RECEIPT_FILE);
+  const receiptRaw = readBoundedRegularFile(receiptPath, "managed receipt", 4 * 1024 * 1024);
+  const expectedReceiptSha256 = createHash3("sha256").update(receiptRaw).digest("hex");
+  if (expectedReceiptSha256 !== pointer.receiptSha256) fail2("active browser pointer receipt hash differs");
+  const receipt = validateReceiptObject(parseJsonObject(receiptRaw, "managed receipt"), packageDir, packageName, rootPath);
+  return { pointerPath, pointerIdentity, pointerRaw, receiptPath, receiptRaw, receipt };
+}
+function assertNoOrphanedManagedBrowserState(packageDir, allowActiveLock) {
+  let entries;
+  try {
+    entries = fs3.readdirSync(packageDir, { withFileTypes: true });
+  } catch {
+    fail2(`cannot inspect managed browser package root: ${packageDir}`);
+  }
+  const managedArtifacts = entries.filter((entry) => {
+    if (allowActiveLock && entry.name === LOCK_FILE) return false;
+    return entry.name === LOCK_FILE || entry.name === RECEIPT_FILE || entry.name.startsWith("release-") || entry.name.startsWith(".pending-") || entry.name.startsWith(".active-");
+  });
+  if (managedArtifacts.length > 0) {
+    fail2(
+      `orphaned managed browser state without an active pointer: ${managedArtifacts.map((entry) => entry.name).join(", ")}`
+    );
+  }
+}
+function loadVerifiedManagedBrowserReceipt(stateDir, packageName) {
+  if (packageName !== "@playwright/cli" && packageName !== "chrome-devtools-mcp") {
+    fail2("unsupported managed browser package");
+  }
+  const statePath = absolutePath(stateDir, "stateDir");
+  const realStateDir = existingRealDirectory(statePath, "stateDir");
+  if (realStateDir === null) return null;
+  const managedRoot = existingRealDirectory(path5.join(realStateDir, MANAGED_ROOT), "managed browser root");
+  if (managedRoot === null) return null;
+  const packageDirectory = existingRealDirectory(
+    path5.join(managedRoot, packageDirectoryName(packageName)),
+    "managed browser package root"
+  );
+  if (packageDirectory === null) return null;
+  const active = readValidatedActiveBrowser(packageDirectory, packageName);
+  if (active !== null) return active.receipt;
+  assertNoOrphanedManagedBrowserState(packageDirectory, false);
+  return null;
+}
+function hashRegularFile(file) {
+  const stat = lstatOrFail2(file, "launcher");
+  if (!stat.isFile() || stat.isSymbolicLink()) fail2("launcher must be a regular file");
+  let fd;
+  try {
+    fd = fs3.openSync(file, fs3.constants.O_RDONLY | (fs3.constants.O_NOFOLLOW ?? 0));
+  } catch {
+    fail2(`cannot open launcher: ${file}`);
+  }
+  const hash = createHash3("sha256");
+  const buffer = Buffer.allocUnsafe(TREE_HASH_CHUNK_BYTES2);
+  try {
+    for (; ; ) {
+      const read = fs3.readSync(fd, buffer, 0, buffer.length, null);
+      if (read === 0) break;
+      hash.update(buffer.subarray(0, read));
+    }
+    const finalStat = fs3.fstatSync(fd);
+    if (!finalStat.isFile() || finalStat.size !== stat.size) fail2("launcher changed while being hashed");
+    return hash.digest("hex");
+  } finally {
+    try {
+      fs3.closeSync(fd);
+    } catch {
+    }
+  }
+}
+function launcherSource(nodeModulesPath, entryPath, expectedTreeSha256) {
+  return `const fs = (await import("node:fs")).default;
+const path = (await import("node:path")).default;
+const { createHash } = await import("node:crypto");
+const { pathToFileURL } = await import("node:url");
+
+const root = ${JSON.stringify(nodeModulesPath)};
+const entry = ${JSON.stringify(entryPath)};
+const expected = ${JSON.stringify(expectedTreeSha256)};
+const MAX_BYTES = ${MAX_TREE_BYTES2};
+const MAX_ENTRIES = ${MAX_TREE_ENTRIES2};
+const MAX_METADATA_BYTES = ${MAX_TREE_METADATA_BYTES2};
+const MAX_PATH_BYTES = ${MAX_TREE_PATH_BYTES2};
+const MAX_SYMLINK_BYTES = ${MAX_TREE_SYMLINK_BYTES2};
+const CHUNK_BYTES = ${TREE_HASH_CHUNK_BYTES2};
+const CONTROL = /[\\u0000-\\u001f\\u007f]/;
+
+function contained(base, candidate, allowEqual) {
+  const relative = path.relative(path.resolve(base), path.resolve(candidate));
+  if (relative === "") return allowEqual;
+  return relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative);
+}
+
+function targetFor(linkPath, tree, metadata) {
+  const raw = fs.readlinkSync(linkPath, "buffer");
+  const target = raw.toString("utf8");
+  if (Buffer.from(target, "utf8").compare(raw) !== 0 || target === "" || CONTROL.test(target) || raw.byteLength > MAX_SYMLINK_BYTES || path.isAbsolute(target) || (process.platform === "win32" && /^[a-zA-Z]:/.test(target))) {
+    throw new Error("managed browser symlink is not an internal relative target");
+  }
+  const parts = target.split(process.platform === "win32" ? /[\\\\/]+/ : /\\/+/).filter((part) => part !== "" && part !== ".");
+  if (parts.length === 0) throw new Error("managed browser symlink target is empty");
+  let current = path.dirname(path.resolve(linkPath));
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    const last = index === parts.length - 1;
+    current = part === ".." ? path.dirname(current) : path.join(current, part);
+    if (!contained(tree, current, true)) throw new Error("managed browser symlink escapes tree");
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink()) throw new Error("managed browser symlink chain is not allowed");
+    if (last ? (!stat.isFile() && !stat.isDirectory()) : !stat.isDirectory()) throw new Error("managed browser symlink target is invalid");
+  }
+  if (metadata.bytes + raw.byteLength > MAX_METADATA_BYTES) throw new Error("managed browser metadata is too large");
+  metadata.bytes += raw.byteLength;
+  return target;
+}
+
+function readEntries(directory, tree, remaining, metadata) {
+  const handle = fs.opendirSync(directory);
+  const entries = [];
+  let primary = null;
+  try {
+    for (;;) {
+      const dirent = handle.readSync();
+      if (dirent === null) break;
+      if (entries.length >= remaining) throw new Error("managed browser tree has too many entries");
+      const full = path.join(directory, dirent.name);
+      const relative = path.relative(path.resolve(tree), full).split(path.sep).join("/");
+      const pathBytes = Buffer.byteLength(relative, "utf8");
+      if (relative === "" || CONTROL.test(relative) || pathBytes > MAX_PATH_BYTES || metadata.bytes + pathBytes > MAX_METADATA_BYTES) throw new Error("managed browser tree contains an invalid path");
+      metadata.bytes += pathBytes;
+      entries.push({ full, relative });
+    }
+  } catch (error) {
+    primary = error;
+    throw error;
+  } finally {
+    try { handle.closeSync(); } catch (error) { if (primary === null) throw error; }
+  }
+  return entries;
+}
+
+function openFile(file) {
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0);
+  const fd = fs.openSync(file, flags);
+  const stat = fs.fstatSync(fd);
+  if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size < 0) { fs.closeSync(fd); throw new Error("managed browser tree entry is not a regular file"); }
+  return { fd, size: stat.size };
+}
+
+function hashFile(hash, file, total) {
+  const opened = openFile(file);
+  let primary = null;
+  try {
+    if (opened.size > MAX_BYTES || total.bytes + opened.size > MAX_BYTES) throw new Error("managed browser tree is too large");
+    const length = Buffer.alloc(8);
+    length.writeBigUInt64BE(BigInt(opened.size));
+    hash.update(length);
+    const buffer = Buffer.allocUnsafe(CHUNK_BYTES);
+    let readTotal = 0;
+    for (;;) {
+      const read = fs.readSync(opened.fd, buffer, 0, buffer.length, null);
+      if (read === 0) break;
+      readTotal += read;
+      if (readTotal > opened.size || total.bytes + readTotal > MAX_BYTES) throw new Error("managed browser tree changed");
+      hash.update(buffer.subarray(0, read));
+    }
+    const finalStat = fs.fstatSync(opened.fd);
+    if (!finalStat.isFile() || finalStat.size !== readTotal || readTotal !== opened.size) throw new Error("managed browser tree changed");
+    total.bytes += readTotal;
+  } catch (error) {
+    primary = error;
+    throw error;
+  } finally {
+    try { fs.closeSync(opened.fd); } catch (error) { if (primary === null) throw error; }
+  }
+}
+
+function treeHash(tree) {
+  const rootStat = fs.lstatSync(tree);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error("managed browser node_modules is invalid");
+  const entries = [];
+  const pending = [path.resolve(tree)];
+  const metadata = { bytes: 0 };
+  while (pending.length > 0) {
+    const directory = pending.pop();
+    for (const { full, relative } of readEntries(directory, tree, MAX_ENTRIES - entries.length, metadata)) {
+      if (entries.length >= MAX_ENTRIES) throw new Error("managed browser tree has too many entries");
+      const stat = fs.lstatSync(full);
+      if (stat.isSymbolicLink()) entries.push({ kind: "symlink", relative, target: targetFor(full, tree, metadata) });
+      else if (stat.isDirectory()) { entries.push({ kind: "dir", relative }); pending.push(full); }
+      else if (stat.isFile()) entries.push({ kind: "file", relative, filePath: full });
+      else throw new Error("managed browser tree contains an unsupported entry");
+    }
+  }
+  entries.sort((left, right) => left.relative < right.relative ? -1 : left.relative > right.relative ? 1 : 0);
+  const hash = createHash("sha256");
+  hash.update("browser-v2\\0", "utf8");
+  const total = { bytes: 0 };
+  for (const item of entries) {
+    hash.update(item.kind + "\\0" + item.relative + "\\0", "utf8");
+    if (item.kind === "symlink") {
+      const payload = Buffer.from(item.target, "utf8");
+      const length = Buffer.alloc(8);
+      length.writeBigUInt64BE(BigInt(payload.length));
+      hash.update(length); hash.update(payload); total.bytes += payload.length;
+    } else if (item.kind === "dir") hash.update(Buffer.alloc(8));
+    else hashFile(hash, item.filePath, total);
+  }
+  return hash.digest("hex");
+}
+
+if (treeHash(root) !== expected) throw new Error("managed browser tree digest drifted before launch");
+process.argv[1] = entry;
+await import(pathToFileURL(entry).href);
+`;
+}
+function managedTreeVerifierSource() {
+  const source = launcherSource("/jorgex-browser-verifier/node_modules", "/jorgex-browser-verifier/entry.mjs", "0".repeat(64));
+  const start = source.indexOf("function contained(base, candidate, allowEqual)");
+  const end = source.indexOf("if (treeHash(root) !== expected)");
+  if (start < 0 || end < 0 || end <= start) fail2("managed browser tree verifier source is unavailable");
+  return source.slice(start, end);
+}
+var DEVTOOLS_PRIVACY_FLAGS = [
+  "--isolated",
+  "--redact-network-headers",
+  "--no-performance-crux",
+  "--no-usage-statistics"
+];
+function invocationGuardSource(receipt, runtimeArgs) {
+  const treeVerifier = managedTreeVerifierSource();
+  return `const fs = (await import("node:fs")).default;
+const { createHash } = await import("node:crypto");
+const path = (await import("node:path")).default;
+
+const expectedLauncherPath = ${JSON.stringify(receipt.launcherPath)};
+const expectedLauncherSha256 = ${JSON.stringify(receipt.launcherSha256)};
+const root = ${JSON.stringify(receipt.treePath)};
+const expected = ${JSON.stringify(receipt.treeSha256)};
+const expectedRuntimeArgs = ${JSON.stringify([...runtimeArgs])};
+const MAX_LAUNCHER_BYTES = 4 * 1024 * 1024;
+const MAX_BYTES = ${MAX_TREE_BYTES2};
+const MAX_ENTRIES = ${MAX_TREE_ENTRIES2};
+const MAX_METADATA_BYTES = ${MAX_TREE_METADATA_BYTES2};
+const MAX_PATH_BYTES = ${MAX_TREE_PATH_BYTES2};
+const MAX_SYMLINK_BYTES = ${MAX_TREE_SYMLINK_BYTES2};
+const CHUNK_BYTES = ${TREE_HASH_CHUNK_BYTES2};
+const CONTROL = /[\\u0000-\\u001f\\u007f]/;
+
+${treeVerifier}
+
+function readVerifiedLauncher(file) {
+  let initial;
+  try { initial = fs.lstatSync(file); } catch { throw new Error("managed browser launcher is unavailable"); }
+  if (!initial.isFile() || initial.isSymbolicLink()) throw new Error("managed browser launcher is not a regular file");
+  if (initial.size > MAX_LAUNCHER_BYTES) throw new Error("managed browser launcher exceeds 4 MiB");
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0);
+  const fd = fs.openSync(file, flags);
+  const chunks = [];
+  let total = 0;
+  let primary = null;
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.size > MAX_LAUNCHER_BYTES) throw new Error("managed browser launcher is invalid");
+    const buffer = Buffer.allocUnsafe(CHUNK_BYTES);
+    for (;;) {
+      const read = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (read === 0) break;
+      total += read;
+      if (total > MAX_LAUNCHER_BYTES) throw new Error("managed browser launcher exceeds 4 MiB");
+      chunks.push(Buffer.from(buffer.subarray(0, read)));
+    }
+    const finalStat = fs.fstatSync(fd);
+    if (!finalStat.isFile() || finalStat.size !== total || total !== opened.size) throw new Error("managed browser launcher changed while being read");
+  } catch (error) {
+    primary = error;
+    throw error;
+  } finally {
+    try { fs.closeSync(fd); } catch (error) { if (primary === null) throw error; }
+  }
+  const bytes = Buffer.concat(chunks);
+  const text = bytes.toString("utf8");
+  if (!Buffer.from(text, "utf8").equals(bytes)) throw new Error("managed browser launcher is not strict UTF-8");
+  if (createHash("sha256").update(bytes).digest("hex") !== expectedLauncherSha256) throw new Error("managed browser launcher digest drifted");
+  return text;
+}
+
+if (process.argv[1] !== expectedLauncherPath) throw new Error("managed browser launcher path changed");
+if (JSON.stringify(process.argv.slice(2)) !== JSON.stringify(expectedRuntimeArgs)) throw new Error("managed browser runtime args changed");
+const launcherSource = readVerifiedLauncher(expectedLauncherPath);
+if (treeHash(root) !== expected) throw new Error("managed browser tree digest drifted before launch");
+process.argv[1] = expectedLauncherPath;
+const evaluateVerifiedLauncher = (verifiedSource) => new Function("return (async()=>{\\n" + verifiedSource + "\\n})()")();
+await evaluateVerifiedLauncher(launcherSource);
+`;
+}
+function planManagedBrowserInvocation(stateDir, packageName, runtimeArgs) {
+  if (packageName !== "@playwright/cli" && packageName !== "chrome-devtools-mcp") {
+    fail2("unsupported managed browser package");
+  }
+  if (!Array.isArray(runtimeArgs)) fail2("runtimeArgs must be an array");
+  if (runtimeArgs.some((arg) => typeof arg !== "string" || CONTROL_CHARACTERS2.test(arg))) {
+    fail2("runtimeArgs contain an invalid control character");
+  }
+  if (packageName === "chrome-devtools-mcp" && (runtimeArgs.length !== DEVTOOLS_PRIVACY_FLAGS.length || runtimeArgs.some((arg, index) => arg !== DEVTOOLS_PRIVACY_FLAGS[index]))) {
+    fail2("chrome-devtools-mcp requires the fixed privacy flags in order");
+  }
+  const receipt = loadVerifiedManagedBrowserReceipt(stateDir, packageName);
+  if (receipt === null) fail2("verified managed browser receipt not found");
+  return {
+    command: process.execPath,
+    args: [
+      "--input-type=module",
+      "--eval",
+      invocationGuardSource(receipt, runtimeArgs),
+      receipt.launcherPath,
+      ...runtimeArgs
+    ]
+  };
+}
+
+// src/lib/tool-preferences.ts
+import fs5 from "fs";
+import path7 from "path";
+
+// src/lib/fsx.ts
+import fs4 from "fs";
+import path6 from "path";
+
+// src/lib/tool-preferences.ts
+var PLAYWRIGHT_RUNTIMES = ["opencode", "claude-code", "codex", "pi"];
+function normalizeObservedVersion(value) {
+  return { version: value.version, integrity: value.integrity };
+}
+function parseObservedField(value) {
+  if (value.observed === void 0) return void 0;
+  if (!isValidObservedVersion(value.observed)) return null;
+  const observed = value.observed;
+  return normalizeObservedVersion(observed);
+}
+function readPreference(file) {
+  try {
+    return { raw: fs5.readFileSync(file, "utf8"), errorCode: null };
+  } catch (error) {
+    const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "UNKNOWN";
+    return code === "ENOENT" ? { raw: null, errorCode: null } : { raw: null, errorCode: code };
+  }
+}
+function playwrightCliPreferenceFile(stateDir = dataDir()) {
+  return path7.join(stateDir, "playwright-cli.json");
+}
+function parsePlaywrightCliPreference(raw) {
+  try {
+    const value = JSON.parse(raw);
+    if (!isRecord2(value)) return void 0;
+    const observedField = parseObservedField(value);
+    if (observedField === null) return void 0;
+    const observed = observedField === void 0 ? void 0 : observedField;
+    if (value.version === 1 && typeof value.enabled === "boolean") {
+      return observed === void 0 ? { version: 1, enabled: value.enabled } : { version: 1, enabled: value.enabled, observed };
+    }
+    if (value.version !== 2 || !isRecord2(value.enabled)) return void 0;
+    if (Object.entries(value.enabled).some(([runtime, enabled2]) => !PLAYWRIGHT_RUNTIMES.includes(runtime) || typeof enabled2 !== "boolean")) return void 0;
+    const enabled = value.enabled;
+    return observed === void 0 ? { version: 2, enabled } : { version: 2, enabled, observed };
+  } catch {
+    return void 0;
+  }
+}
+function playwrightCliPreferenceError(file = playwrightCliPreferenceFile()) {
+  const { raw, errorCode } = readPreference(file);
+  if (errorCode !== null) {
+    return `Playwright CLI: no se pudo leer la preferencia en ${file} (${errorCode}). Corrige o borra ese archivo antes de reintentar.`;
+  }
+  if (raw === null || parsePlaywrightCliPreference(raw) !== void 0) return null;
+  return `Playwright CLI: preferencia inv\xE1lida en ${file}. Corrige o borra ese archivo antes de reintentar.`;
+}
+function loadPlaywrightCliPreference(file = playwrightCliPreferenceFile(), runtime) {
+  const { raw } = readPreference(file);
+  const state = raw === null ? void 0 : parsePlaywrightCliPreference(raw);
+  if (state === void 0) return void 0;
+  if (state.version === 1) return state.enabled;
+  return runtime === void 0 ? Object.values(state.enabled).some(Boolean) : state.enabled[runtime] === true;
+}
+function loadPlaywrightCliObservation(file = playwrightCliPreferenceFile()) {
+  const { raw } = readPreference(file);
+  if (raw === null) return null;
+  const state = parsePlaywrightCliPreference(raw);
+  if (state === void 0 || state.observed === void 0) return null;
+  return { ...state.observed };
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/lib/external-tools.ts
+import fs6 from "fs";
+import os2 from "os";
+import path8 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+
+// src/lib/browser-command.ts
+function runManagedPlaywrightCommand(args, stateDir = dataDir()) {
+  const preferenceFile = playwrightCliPreferenceFile(stateDir);
+  const preferenceError = playwrightCliPreferenceError(preferenceFile);
+  if (preferenceError !== null) throw new Error(preferenceError);
+  if (loadPlaywrightCliPreference(preferenceFile) !== true) {
+    throw new Error("Playwright CLI: opt-in no habilitado; ejecuta install --playwright.");
+  }
+  const observed = loadPlaywrightCliObservation(preferenceFile);
+  const receipt = loadVerifiedManagedBrowserReceipt(stateDir, "@playwright/cli");
+  if (observed === null || receipt === null || observed.version !== receipt.version || observed.integrity !== receipt.integrity) {
+    throw new Error("Playwright CLI: falta un receipt gestionado coincidente con la observaci\xF3n.");
+  }
+  const result = runVerifiedManagedPlaywright(stateDir, args);
+  if (result.error !== void 0) throw result.error;
+  return result.status ?? 1;
+}
+function runVerifiedManagedPlaywright(stateDir, args, options = {}) {
+  const plan = planManagedBrowserInvocation(stateDir, "@playwright/cli", args);
+  const result = spawnSync2(plan.command, [...plan.args], {
+    encoding: "utf8",
+    stdio: options.captureOutput ? "pipe" : "inherit",
+    shell: false,
+    timeout: options.timeoutMs ?? 12e4,
+    maxBuffer: 2 * 1024 * 1024,
+    env: { ...process.env, NO_UPDATE_NOTIFIER: "1" }
+  });
+  return result;
+}
+
+// src/browser-playwright.ts
+try {
+  process.exitCode = runManagedPlaywrightCommand(process.argv.slice(2));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}