package-registry-manager 0.22.3 → 0.22.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.3",
+  "version": "0.22.4",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "provenance": true
   },
   "scripts": {
-    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
+    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/webdriver-automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
     "lint": "eslint src test scripts --max-warnings 0",
     "lint:fix": "eslint src test scripts --fix --max-warnings 0",
     "format": "prettier --write .",
@@ -36,12 +36,14 @@
     "check:duplication": "jscpd src",
     "check": "npm run syntax && npm run lint && npm run format:check && npm run check:duplication",
     "test": "node --test --test-timeout=30000",
-    "pack:check": "npm pack --dry-run"
+    "pack:check": "npm pack --dry-run",
+    "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
     "browser-commander": "^0.25.0",
-    "command-stream": "^1.5.0",
-    "playwright": "^1.63.0"
+    "command-stream": "^1.6.2",
+    "playwright": "^1.63.0",
+    "selenium-webdriver": "^4.50.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/automation.mjs

@@ -5,8 +5,11 @@ import {
   attachViaExtension,
   EXTENSION_DIRECTORY,
   launchRealBrowser,
+  findBrowserSource,
 } from "browser-commander";
 
+import { connectWebDriverAutomation } from "./webdriver-automation.mjs";
+
 import { snapshotBrowser } from "./browser-options.mjs";
 import { defaultBrowserProfile, ensureProfileIgnored } from "./profile.mjs";
 import { IMPORT_CHOICES, migrationFor } from "./sign-in-import.mjs";
@@ -28,7 +31,10 @@ export function relayExtensionDirectory() {
  */
 export function launchOptions(browser, profile, verbose = false, domains = []) {
   const options = {
-    engine: "playwright",
+    engine:
+      findBrowserSource(browser.channel)?.controlProtocol === "cdp"
+        ? "playwright"
+        : "selenium",
     channel: browser.channel,
     headless: false,
     verbose,
@@ -75,25 +81,29 @@ export function extensionInstructions(directory) {
  * Connects the browser that fills forms and returns a page with `goto`,
  * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
-export async function connectAutomation({
-  browser,
-  profile,
-  verbose = false,
-  domains = [],
-}) {
+export async function connectAutomation(
+  { browser, profile, verbose = false, domains = [] },
+  dependencies = {},
+) {
   if (browser.attach?.mode === "extension") {
     return connectExtension();
   }
+  if (findBrowserSource(browser.channel)?.controlProtocol === "bidi") {
+    return connectWebDriverAutomation(
+      { browser, profile, verbose, domains },
+      dependencies,
+    );
+  }
   if (!browser.attach) {
     await ensureProfileIgnored(profile, { verbose });
   }
-  const connection = await launchRealBrowser(
-    launchOptions(browser, profile, verbose, domains),
-  );
+  const connection = await (
+    dependencies.launchRealBrowser ?? launchRealBrowser
+  )(launchOptions(browser, profile, verbose, domains));
   return {
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
-    close: () => connection.browser.close(),
+    close: () => connection.close(),
     async clearCookies(names) {
       for (const name of names) {
         const escaped = name.replaceAll(".", "\\.");

package/src/browser-catalogue.mjs

@@ -1,4 +1,5 @@
-import { existsSync } from "node:fs";
+import { constants, existsSync, realpathSync } from "node:fs";
+import { access } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 
@@ -7,10 +8,10 @@ import { BROWSER_IDS, findBrowserSource } from "browser-commander";
 /** Catalogue entries reached through Browser Commander's public exports. */
 export const browserSources = () => BROWSER_IDS.map(findBrowserSource);
 
-/** The installed channels supported by Browser Commander's real launcher. */
+/** Catalogue channels with a launch control protocol. */
 export function launchChannels() {
   return browserSources()
-    .filter((source) => source.controlProtocol === "cdp")
+    .filter((source) => source.controlProtocol)
     .flatMap((source) => [source.id, ...(source.aliases ?? [])]);
 }
 
@@ -121,13 +122,88 @@ export function installedDescription(options = {}) {
 /** Reject unavailable engines before creating an automated profile. */
 export function validateChannel(channel) {
   const known = findBrowserSource(channel);
-  if (known?.controlProtocol === "cdp") {
+  if (known?.controlProtocol) {
     return channel;
   }
   const reason = known
-    ? `${channel} requires ${known.controlProtocol ?? known.family} control, which browser-commander's real launcher does not support yet (https://github.com/link-foundation/browser-commander/issues/114)`
+    ? `${channel} has no launch control protocol in browser-commander's catalogue${known.family === "safari" ? " (Safari setup: https://github.com/link-foundation/browser-commander/issues/126)" : ""}`
     : `unknown --browser-channel '${channel}'`;
   throw new Error(
     `${reason}; choose from ${launchChannels().join(", ")}. ${installedDescription()}`,
   );
 }
+
+/** Resolves the selected installed binary using catalogue paths and PATH. */
+export async function resolveExecutable(
+  { channel, executablePath },
+  discovery = {},
+) {
+  const platform = discovery.platform ?? process.platform;
+  const environment = discovery.environment ?? process.env;
+  const options = {
+    ...discovery,
+    platform,
+    environment:
+      platform === "win32"
+        ? Object.fromEntries(
+            Object.entries(environment).map(([key, value]) => [
+              key.toUpperCase(),
+              value,
+            ]),
+          )
+        : environment,
+  };
+  const source = findBrowserSource(channel);
+  const candidates = executablePath
+    ? [executablePath]
+    : installedCandidates({ ...source, roots: {} }, options);
+  for (const candidate of candidates) {
+    try {
+      await (discovery.access ?? access)(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      // Continue through the catalogue's executable paths and PATH names.
+    }
+  }
+  throw new Error(
+    `could not find an installed ${channel} browser; use --browser-executable`,
+  );
+}
+
+/** Refuses a source profile even when reached through a symlink. */
+export function assertDedicatedProfile(profile, discovery = {}) {
+  const physical = (file) => {
+    try {
+      return realpathSync(file);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+      return path.join(physical(path.dirname(file)), path.basename(file));
+    }
+  };
+  const requested = physical(path.resolve(profile));
+  const roots = browserSources().flatMap((source) =>
+    installedCandidates(
+      {
+        ...source,
+        executables: {},
+        executableNames: [],
+      },
+      discovery,
+    ),
+  );
+  for (const root of roots) {
+    const relative = path.relative(physical(path.resolve(root)), requested);
+    if (
+      relative === "" ||
+      (!relative.startsWith(`..${path.sep}`) &&
+        relative !== ".." &&
+        !path.isAbsolute(relative))
+    ) {
+      throw new Error(
+        "automation requires a dedicated profile, not a browser default profile; use --browser-import to reuse sign-in",
+      );
+    }
+  }
+}

package/src/browser-options.mjs

@@ -55,7 +55,11 @@ export function parseBrowserOptions({
     channel: attach === "extension" ? channel : validateChannel(channel),
     executable: executable ? path.resolve(executable) : null,
     import: importFrom ? parseImport(importFrom) : null,
-    importScope: parseImportScope(importScope, importFrom),
+    importScope:
+      (importScope === undefined || importScope === null) &&
+      findBrowserSource(channel)?.controlProtocol === "bidi"
+        ? "domains"
+        : parseImportScope(importScope, importFrom),
     attach: attach ? parseAttach(attach) : null,
     preferences: parsePreferences(preferences),
     restrictions: validateRestrictions(restrictions),
@@ -80,9 +84,34 @@ export function parseBrowserOptions({
       "--browser-attach extension cannot be combined with --browser-executable, --browser-pref, or --browser-restriction",
     );
   }
+  validateEngineOptions(options);
   return options;
 }
 
+/** Rejects capabilities the installed upstream non-CDP launchers lack. */
+function validateEngineOptions(options) {
+  if (
+    options.attach?.mode === "extension" ||
+    findBrowserSource(options.channel)?.controlProtocol === "cdp"
+  ) {
+    return;
+  }
+  const unsupported = options.attach
+    ? "--browser-attach snapshot"
+    : options.restrictions.length
+      ? "--browser-restriction"
+      : Object.keys(options.preferences).length
+        ? "--browser-pref"
+        : options.import && options.importScope === "full"
+          ? "--browser-import-scope full"
+          : null;
+  if (unsupported) {
+    throw new Error(
+      `${unsupported} is unavailable for ${options.channel} in the installed browser-commander; use --browser-import-scope domains for sign-in cookies`,
+    );
+  }
+}
+
 /** Parses `<browser>[:profile]`, `default`, or `auto`. */
 export function parseImport(spec, discovery = {}) {
   const separator = spec.indexOf(":");

package/src/cli.mjs

@@ -227,7 +227,8 @@ export async function main(args = process.argv.slice(2)) {
     browser: values.browser,
     browserOptions,
     browserProfile: path.resolve(
-      values["browser-profile"] ?? defaultBrowserProfile(),
+      values["browser-profile"] ??
+        defaultBrowserProfile({ channel: browserOptions.channel }),
     ),
     verbose: values.verbose,
     verifyRelease: values["verify-release"],
@@ -273,7 +274,10 @@ function browserSummary(command, values, browserOptions) {
     channel: browserOptions.channel,
     profile:
       values.browser === "automated" && !browserOptions.attach
-        ? path.resolve(values["browser-profile"] ?? defaultBrowserProfile())
+        ? path.resolve(
+            values["browser-profile"] ??
+              defaultBrowserProfile({ channel: browserOptions.channel }),
+          )
         : undefined,
     import: browserOptions.import ?? undefined,
     attach: browserOptions.attach ?? undefined,

package/src/profile.mjs

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 
 import { exec } from "command-stream";
+import { findBrowserSource } from "browser-commander";
 
 const APPLICATION = "package-registry-manager";
 const PROFILE = "browser-profile";
@@ -17,20 +18,26 @@ export function defaultBrowserProfile({
   platform = process.platform,
   env = process.env,
   home = os.homedir(),
+  channel = "chrome",
 } = {}) {
+  const source = findBrowserSource(channel);
+  const profile =
+    source?.controlProtocol && source.controlProtocol !== "cdp"
+      ? `${PROFILE}-${source.id}`
+      : PROFILE;
   const join = platform === "win32" ? path.win32.join : path.posix.join;
   if (platform === "win32") {
     const base = env.LOCALAPPDATA || join(home, "AppData", "Local");
-    return join(base, APPLICATION, PROFILE);
+    return join(base, APPLICATION, profile);
   }
   if (platform === "darwin") {
-    return join(home, "Library", "Application Support", APPLICATION, PROFILE);
+    return join(home, "Library", "Application Support", APPLICATION, profile);
   }
   // The XDG specification ignores relative values.
   const state = path.posix.isAbsolute(env.XDG_STATE_HOME ?? "")
     ? env.XDG_STATE_HOME
     : join(home, ".local", "state");
-  return join(state, APPLICATION, PROFILE);
+  return join(state, APPLICATION, profile);
 }
 
 /** The profile location used before it moved out of the repository. */

package/src/webdriver-automation.mjs

@@ -0,0 +1,125 @@
+// Firefox-family browsers use Browser Commander's native WebDriver/BiDi API.
+// Its real/CDP launcher and migration target writers do not support them yet.
+import { launchWebDriver, readBrowserCookies } from "browser-commander";
+
+import {
+  assertDedicatedProfile,
+  resolveExecutable,
+} from "./browser-catalogue.mjs";
+import { ensureProfileIgnored } from "./profile.mjs";
+import { IMPORT_CHOICES } from "./sign-in-import.mjs";
+
+/** True only for a requested host or its subdomains, never a substring. */
+export function matchesDomains(host, domains) {
+  const normalized = host.replace(/^\./, "").toLowerCase();
+  return domains.some(
+    (domain) => normalized === domain || normalized.endsWith(`.${domain}`),
+  );
+}
+
+/** The BiDi cookie shape; session cookies omit expiry. */
+export function bidiCookie(cookie) {
+  const result = {
+    name: cookie.name,
+    value: { type: "string", value: cookie.value },
+    domain: cookie.domain,
+    path: cookie.path ?? "/",
+    httpOnly: cookie.httpOnly ?? false,
+    secure: cookie.secure ?? false,
+    sameSite: (cookie.sameSite ?? "Lax").toLowerCase(),
+  };
+  if (cookie.expires > 0) {
+    result.expiry = cookie.expires;
+  }
+  return result;
+}
+
+/** Launches the selected installed Firefox variant and exposes the common page API. */
+export async function connectWebDriverAutomation(
+  { browser, profile, verbose, domains },
+  dependencies = {},
+) {
+  // Validation happens before profile creation, including programmatic callers.
+  if (
+    browser.attach ||
+    browser.restrictions.length ||
+    Object.keys(browser.preferences).length ||
+    (browser.import && browser.importScope === "full")
+  ) {
+    throw new Error(
+      `unsupported Firefox launch options for ${browser.channel}; use --browser-import-scope domains without snapshot, preferences or restrictions`,
+    );
+  }
+  if (browser.import && domains.length === 0) {
+    throw new Error("a domains import needs the registry's sign-in domains");
+  }
+  const executablePath = await (
+    dependencies.resolveExecutable ?? resolveExecutable
+  )({
+    channel: browser.channel.toLowerCase(),
+    executablePath: browser.executable,
+  });
+  assertDedicatedProfile(profile);
+  await ensureProfileIgnored(profile, { verbose });
+  const connection = await (dependencies.launchWebDriver ?? launchWebDriver)({
+    browser: "firefox",
+    executablePath,
+    userDataDir: profile,
+    headless: false,
+    bidi: true,
+    verbose,
+  });
+  try {
+    await connection.page.bidiCommand("storage.getCookies", {});
+    if (browser.import && !IMPORT_CHOICES.includes(browser.import.browser)) {
+      const read = dependencies.readCookies ?? readBrowserCookies;
+      const seen = new Set();
+      for (const domain of domains) {
+        const cookies = await read({
+          browser: browser.import.browser,
+          profile: browser.import.profile ?? undefined,
+          domainFilter: domain,
+          cache: false,
+        });
+        for (const cookie of cookies) {
+          const key = JSON.stringify([cookie.domain, cookie.path, cookie.name]);
+          if (!matchesDomains(cookie.domain, domains) || seen.has(key)) {
+            continue;
+          }
+          seen.add(key);
+          await connection.page.bidiCommand("storage.setCookie", {
+            cookie: bidiCookie(cookie),
+          });
+        }
+      }
+    }
+  } catch (error) {
+    await connection.close().catch(() => {});
+    throw new Error(
+      `could not prepare ${browser.channel} sign-in cookies (WebDriver BiDi storage is required)`,
+      { cause: error },
+    );
+  }
+  return {
+    goto: (url) => connection.page.goto(url),
+    evaluate: (script) => connection.page.evaluate(script),
+    close: () => connection.close(),
+    async clearCookies(names) {
+      const { cookies } = await connection.page.bidiCommand(
+        "storage.getCookies",
+        {},
+      );
+      for (const cookie of cookies) {
+        if (matchesDomains(cookie.domain, names)) {
+          await connection.page.bidiCommand("storage.deleteCookies", {
+            filter: {
+              name: cookie.name,
+              domain: cookie.domain,
+              path: cookie.path,
+            },
+          });
+        }
+      }
+    },
+  };
+}