mindforge-cc 11.9.4 → 11.9.6

package/bin/browser/browser-daemon.js

@@ -5,37 +5,33 @@
  */
 'use strict';
 
-const http      = require('http');
-const crypto    = require('crypto');
+const http = require('http');
+const crypto = require('crypto');
 const playwright = require('playwright-core');
-const fs        = require('fs');
-const path      = require('path');
+const fs = require('fs');
+const path = require('path');
+const { requiresAuth, isAuthValid } = require('./daemon-auth');
 
-const PORT      = process.env.BROWSER_PORT || 7338;
-const HEADLESS  = process.env.BROWSER_HEADLESS !== 'false';
-const TIMEOUT   = (parseInt(process.env.BROWSER_IDLE_TIMEOUT_MINUTES) || 30) * 60 * 1000;
+const PORT = process.env.BROWSER_PORT || 7338;
+const HEADLESS = process.env.BROWSER_HEADLESS !== 'false';
+const TIMEOUT =
+  (parseInt(process.env.BROWSER_IDLE_TIMEOUT_MINUTES) || 30) * 60 * 1000;
 
 // ── Bearer token authentication ──────────────────────────────────────────────
 const DAEMON_TOKEN = crypto.randomBytes(32).toString('hex');
-const DAEMON_TOKEN_FILE = path.join(process.cwd(), '.mindforge', '.browser-daemon-token');
+const DAEMON_TOKEN_FILE = path.join(
+  process.cwd(),
+  '.mindforge',
+  '.browser-daemon-token',
+);
 
 // Write token to file with restrictive permissions (owner-only read/write)
 fs.mkdirSync(path.dirname(DAEMON_TOKEN_FILE), { recursive: true });
 fs.writeFileSync(DAEMON_TOKEN_FILE, DAEMON_TOKEN, { mode: 0o600 });
 
-/**
- * Validate bearer token from Authorization header.
- * Returns true if valid, false otherwise.
- */
-function isAuthValid(req) {
-  const authHeader = req.headers.authorization;
-  if (!authHeader || !authHeader.startsWith('Bearer ')) return false;
-  const provided = authHeader.slice(7);
-  if (provided.length !== DAEMON_TOKEN.length) return false;
-  return crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(DAEMON_TOKEN));
-}
-
-let browser, lastActionAt = Date.now(), isLaunching = false;
+let browser,
+  lastActionAt = Date.now(),
+  isLaunching = false;
 const sessions = new Map(); // name -> { context, page }
 
 async function init() {
@@ -44,7 +40,7 @@ async function init() {
   try {
     browser = await playwright.chromium.launch({
       headless: HEADLESS,
-      args: ['--no-sandbox', '--disable-setuid-sandbox', '--no-first-run']
+      args: ['--no-sandbox', '--disable-setuid-sandbox', '--no-first-run'],
     });
     setInterval(checkIdle, 60000);
   } finally {
@@ -55,14 +51,14 @@ async function init() {
 function checkIdle() {
   if (Date.now() - lastActionAt > TIMEOUT) {
     console.log('[daemon] Idle timeout reached. Shutting down.');
-    process.exit(0);
+    shutdown();
   }
 }
 
 async function getOrCreateSession(name = 'default') {
   if (sessions.has(name)) return sessions.get(name);
   const context = await browser.newContext();
-  const page    = await context.newPage();
+  const page = await context.newPage();
   const s = { context, page };
   sessions.set(name, s);
   return s;
@@ -77,33 +73,64 @@ const server = http.createServer(async (req, res) => {
 
   // Only allow localhost
   const remote = req.socket.remoteAddress;
-  if (remote !== '127.0.0.1' && remote !== '::1' && remote !== '::ffff:127.0.0.1') {
+  if (
+    remote !== '127.0.0.1' &&
+    remote !== '::1' &&
+    remote !== '::ffff:127.0.0.1'
+  ) {
     return send({ error: 'Forbidden: Localhost only' }, 403);
   }
 
   let body = '';
-  req.on('data', chunk => body += chunk);
+  req.on('data', (chunk) => (body += chunk));
   req.on('end', async () => {
     try {
-      const { url, session: sessionName, selector, text, script, type, expected_text, name } = body ? JSON.parse(body) : {};
+      if (
+        requiresAuth(req.url) &&
+        !isAuthValid(req.headers.authorization, DAEMON_TOKEN)
+      ) {
+        return send(
+          {
+            error:
+              'Authentication required. Use the token written to the daemon token file at startup.',
+          },
+          401,
+        );
+      }
+      const {
+        url,
+        session: sessionName,
+        selector,
+        text,
+        script,
+        type,
+        expected_text,
+        name,
+      } = body ? JSON.parse(body) : {};
       const { page, context } = await getOrCreateSession(sessionName);
 
       if (req.url === '/status' && req.method === 'GET') {
-        return send({ alive: true, sessions: Array.from(sessions.keys()), uptime: process.uptime() });
+        return send({
+          alive: true,
+          sessions: Array.from(sessions.keys()),
+          uptime: process.uptime(),
+        });
       }
 
       if (req.url === '/navigate' && req.method === 'POST') {
         const start = Date.now();
         const r = await page.goto(url, { waitUntil: 'load', timeout: 30000 });
-        return send({ 
-          success: true, 
-          status_code: r ? r.status() : 200, 
-          load_time_ms: Date.now() - start 
+        return send({
+          success: true,
+          status_code: r ? r.status() : 200,
+          load_time_ms: Date.now() - start,
         });
       }
 
       if (req.url === '/click' && req.method === 'POST') {
-        const target = selector ? page.locator(selector) : page.getByText(text, { exact: false });
+        const target = selector
+          ? page.locator(selector)
+          : page.getByText(text, { exact: false });
         await target.first().click({ timeout: 5000 });
         return send({ success: true, element_found: true });
       }
@@ -119,9 +146,6 @@ const server = http.createServer(async (req, res) => {
       }
 
       if (req.url === '/evaluate' && req.method === 'POST') {
-        if (!isAuthValid(req)) {
-          return send({ error: 'Authentication required. Use the token printed at daemon startup.' }, 401);
-        }
         const result = await page.evaluate(script);
         return send({ success: true, result });
       }
@@ -131,11 +155,20 @@ const server = http.createServer(async (req, res) => {
           const loc = page.locator(selector).first();
           const visible = await loc.isVisible();
           const actual = visible ? await loc.innerText() : '';
-          const passed = visible && (!expected_text || actual.includes(expected_text));
+          const passed =
+            visible && (!expected_text || actual.includes(expected_text));
           return send({ passed, actual_text: actual });
         }
-        if (type === 'url') return send({ passed: page.url().includes(expected_text), actual_url: page.url() });
-        if (type === 'title') return send({ passed: (await page.title()).includes(expected_text), actual_title: await page.title() });
+        if (type === 'url')
+          return send({
+            passed: page.url().includes(expected_text),
+            actual_url: page.url(),
+          });
+        if (type === 'title')
+          return send({
+            passed: (await page.title()).includes(expected_text),
+            actual_title: await page.title(),
+          });
         if (type === 'no_console_errors') return send({ passed: true }); // simplified
       }
 
@@ -146,16 +179,19 @@ const server = http.createServer(async (req, res) => {
   });
 });
 
-init().then(() => {
-  server.listen(PORT, '127.0.0.1', () => {
-    console.log(`[BrowserDaemon] Listening on port ${PORT}`);
-    console.log(`[BrowserDaemon] Auth token: ${DAEMON_TOKEN}`);
-    console.log(`[BrowserDaemon] Token file: ${DAEMON_TOKEN_FILE}`);
+init()
+  .then(() => {
+    server.listen(PORT, '127.0.0.1', () => {
+      console.log(`[BrowserDaemon] Listening on port ${PORT}`);
+      console.log(
+        `[BrowserDaemon] Auth token written to: ${DAEMON_TOKEN_FILE}`,
+      );
+    });
+  })
+  .catch((err) => {
+    console.error('[daemon] Initialization failed:', err);
+    process.exit(1);
   });
-}).catch(err => {
-  console.error('[daemon] Initialization failed:', err);
-  process.exit(1);
-});
 
 async function shutdown() {
   console.log('[daemon] Shutting down gracefully...');

package/bin/browser/daemon-auth.js

@@ -0,0 +1,36 @@
+/**
+ * MindForge v2 — Browser Daemon Auth
+ * Pure bearer-token validation extracted from browser-daemon.js so it can be
+ * unit-tested without booting Chromium. See ADR-024 / ADR-026.
+ */
+'use strict';
+
+const crypto = require('crypto');
+
+/**
+ * Endpoints that MUST present a valid bearer token. /status is intentionally
+ * excluded: it is the unauthenticated liveness probe daemon-manager.js#isRunning
+ * relies on, it leaks only session names + uptime, and it is already covered by
+ * ADR-024's localhost bind + remoteAddress check.
+ */
+const AUTH_REQUIRED_PATHS = new Set([
+  '/navigate',
+  '/click',
+  '/type',
+  '/screenshot',
+  '/evaluate',
+  '/assert',
+]);
+
+function requiresAuth(urlPath) {
+  return AUTH_REQUIRED_PATHS.has(urlPath);
+}
+
+function isAuthValid(authHeader, token) {
+  if (!authHeader || !authHeader.startsWith('Bearer ')) return false;
+  const provided = authHeader.slice(7);
+  if (provided.length !== token.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(token));
+}
+
+module.exports = { AUTH_REQUIRED_PATHS, requiresAuth, isAuthValid };

package/bin/browser/daemon-manager.js

@@ -6,15 +6,28 @@
 
 const { spawn, execSync } = require('child_process');
 const path = require('path');
-const fs   = require('fs');
+const fs = require('fs');
 const http = require('http');
 
 const PORT = process.env.BROWSER_PORT || 7338;
 const DAEMON_SCRIPT = path.join(__dirname, 'browser-daemon.js');
+const TOKEN_FILE = path.join(
+  process.cwd(),
+  '.mindforge',
+  '.browser-daemon-token',
+);
+
+function readToken() {
+  try {
+    return fs.readFileSync(TOKEN_FILE, 'utf8').trim();
+  } catch {
+    return null;
+  }
+}
 
 async function isRunning() {
-  return new Promise(resolve => {
-    const req = http.get(`http://127.0.0.1:${PORT}/status`, res => {
+  return new Promise((resolve) => {
+    const req = http.get(`http://127.0.0.1:${PORT}/status`, (res) => {
       resolve(res.statusCode === 200);
     });
     req.on('error', () => resolve(false));
@@ -25,13 +38,19 @@ async function isRunning() {
 async function start() {
   if (await isRunning()) return;
 
-  const out = fs.openSync(path.join(process.cwd(), '.planning/browser-daemon.log'), 'a');
-  const err = fs.openSync(path.join(process.cwd(), '.planning/browser-daemon.log'), 'a');
+  const out = fs.openSync(
+    path.join(process.cwd(), '.planning/browser-daemon.log'),
+    'a',
+  );
+  const err = fs.openSync(
+    path.join(process.cwd(), '.planning/browser-daemon.log'),
+    'a',
+  );
 
   const child = spawn(process.execPath, [DAEMON_SCRIPT], {
     detached: true,
     stdio: ['ignore', out, err],
-    env: { ...process.env, BROWSER_HEADLESS: 'true' }
+    env: { ...process.env, BROWSER_HEADLESS: 'true' },
   });
 
   child.unref();
@@ -39,7 +58,7 @@ async function start() {
 
   // Wait for it to wake up
   for (let i = 0; i < 10; i++) {
-    await new Promise(r => setTimeout(r, 500));
+    await new Promise((r) => setTimeout(r, 500));
     if (await isRunning()) {
       console.log('[manager] Browser daemon ready.');
       return;
@@ -53,7 +72,9 @@ async function stop() {
   // Simple way to kill on localhost
   try {
     if (process.platform === 'win32') {
-      execSync(`for /f "tokens=5" %a in ('netstat -aon ^| find ":${PORT}" ^| find "LISTENING"') do taskkill /f /pid %a`);
+      execSync(
+        `for /f "tokens=5" %a in ('netstat -aon ^| find ":${PORT}" ^| find "LISTENING"') do taskkill /f /pid %a`,
+      );
     } else {
       execSync(`lsof -t -i:${PORT} | xargs kill -9`);
     }
@@ -69,20 +90,30 @@ async function ensureRunning(opts = {}) {
 
 async function request(method, endpoint, body = null) {
   return new Promise((resolve, reject) => {
-    const req = http.request({
-      hostname: '127.0.0.1',
-      port: PORT,
-      path: endpoint,
-      method: method,
-      headers: { 'Content-Type': 'application/json' }
-    }, res => {
-      let data = '';
-      res.on('data', chunk => data += chunk);
-      res.on('end', () => {
-        try { resolve(JSON.parse(data)); } catch { resolve({ success: false, error: 'Invalid JSON response' }); }
-      });
-    });
-    req.on('error', err => reject(err));
+    const headers = { 'Content-Type': 'application/json' };
+    const token = readToken();
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const req = http.request(
+      {
+        hostname: '127.0.0.1',
+        port: PORT,
+        path: endpoint,
+        method: method,
+        headers,
+      },
+      (res) => {
+        let data = '';
+        res.on('data', (chunk) => (data += chunk));
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(data));
+          } catch {
+            resolve({ success: false, error: 'Invalid JSON response' });
+          }
+        });
+      },
+    );
+    req.on('error', (err) => reject(err));
     if (body) req.write(JSON.stringify(body));
     req.end();
   });