stillhunter 0.0.1 → 0.2.1

package/dist/probe-child.mjs

@@ -0,0 +1,456 @@
+// Runs one probe inside the contained child process. The host starts this file
+// under Node's permission model and sends the job over IPC; the child connects
+// to the browser the host launched, through the host's relay, and gives the
+// probe `rr`: guarded pages, faults on requests, an observation of what the
+// page shows, screenshots and named expectations. The result goes back to the
+// host over IPC.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { layoutCandidates } from './layout.mjs';
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+const DEFAULT_VIEWPORT = { width: 1280, height: 800 };
+const SHOT_NAME = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+function isLoopback(url) {
+    try {
+        const u = new URL(url);
+        if (u.protocol === 'data:' || u.protocol === 'blob:' || u.protocol === 'about:')
+            return true;
+        return LOOPBACK.has(u.hostname) || u.hostname.endsWith('.localhost');
+    }
+    catch {
+        return false;
+    }
+}
+const clip = (s, n) => (s.length > n ? `${s.slice(0, n)}…` : s);
+const isApi = (req) => ['xhr', 'fetch'].includes(req.resourceType());
+const NOT_IN_A_PROBE = 'is not available in a probe: every page and context comes from rr.newPage(), which keeps the loopback-only route, the watchers and the session';
+// The probe gets Playwright objects, and through them the browser and its
+// type. Their constructors are shared, so the methods that would make an
+// unguarded context or another browser are replaced on the prototypes; the
+// factory alone may call the originals.
+function lockDown(browser) {
+    const proto = Object.getPrototypeOf(browser);
+    const realNewContext = proto.newContext;
+    let allowed = false;
+    for (const method of ['newContext', 'newPage', 'newBrowserCDPSession', '_newContextForReuse', '_innerNewContext']) {
+        const original = proto[method];
+        if (typeof original !== 'function')
+            continue;
+        proto[method] = function (...args) {
+            if (!allowed)
+                throw new Error(`browser.${method}() ${NOT_IN_A_PROBE}`);
+            return original.apply(this, args);
+        };
+    }
+    const typeProto = Object.getPrototypeOf(browser.browserType());
+    for (const method of ['launch', 'launchPersistentContext', 'launchServer', 'connect', 'connectOverCDP']) {
+        if (typeof typeProto[method] === 'function')
+            typeProto[method] = () => { throw new Error(`browserType.${method}() ${NOT_IN_A_PROBE}`); };
+    }
+    return (options) => {
+        allowed = true;
+        try {
+            return realNewContext.call(browser, options);
+        }
+        finally {
+            allowed = false;
+        }
+    };
+}
+async function run(job) {
+    const startedAt = Date.now();
+    const { chromium } = await import('playwright-core');
+    const browser = await chromium.connect(job.wsEndpoint, { slowMo: job.slowMo || undefined, timeout: 30_000 });
+    const guardedContext = lockDown(browser);
+    const checks = [];
+    const notes = [];
+    const consoleErrors = [];
+    const pageErrors = [];
+    const requests = [];
+    const records = new Map();
+    const faulted = new WeakMap();
+    const faults = [];
+    const blocked = [];
+    const shots = [];
+    const pageIds = new Map();
+    const contexts = [];
+    const activeFaults = [];
+    let offline = false;
+    let savedSession = false;
+    let signInFlow = null;
+    // Where in `requests` each page's latest navigation began, so a sign-in can
+    // be told apart from the page it lands on.
+    const navigatedAt = new Map();
+    // The page the probe last worked with is the one `final` observes.
+    let lastPage = null;
+    const visit = (p) => {
+        const rec = pageIds.get(p);
+        if (!rec)
+            return;
+        if (p.url() && p.url() !== 'about:blank')
+            lastPage = p;
+        const vp = p.viewportSize();
+        rec.viewport = vp;
+        const url = p.url();
+        if (!url || url === 'about:blank')
+            return;
+        if (!rec.visited.some((v) => v.url === url && v.width === (vp?.width ?? null)))
+            rec.visited.push({ url, width: vp?.width ?? null });
+    };
+    const watch = (p) => {
+        if (pageIds.has(p))
+            return;
+        pageIds.set(p, { id: pageIds.size + 1, viewport: p.viewportSize(), visited: [] });
+        const id = pageIds.get(p).id;
+        p.on('console', (m) => { if (m.type() === 'error')
+            consoleErrors.push(clip(m.text(), 300)); });
+        p.on('pageerror', (e) => pageErrors.push(clip(String(e?.message ?? e), 300)));
+        p.on('framenavigated', (f) => {
+            if (f !== p.mainFrame())
+                return;
+            navigatedAt.set(p, requests.length);
+            visit(p);
+        });
+        p.on('request', (req) => {
+            if (!isApi(req))
+                return;
+            const rec = { method: req.method(), url: req.url(), status: null, fault: null, via: 'page', page: id };
+            records.set(req, rec);
+            requests.push(rec);
+        });
+        p.on('response', (r) => {
+            const rec = records.get(r.request());
+            if (rec) {
+                rec.status = r.status();
+                rec.fault = faulted.get(r.request()) ?? null;
+            }
+        });
+        p.on('requestfailed', (req) => {
+            const rec = records.get(req);
+            if (rec) {
+                rec.fault = faulted.get(req) ?? null;
+                rec.failure = req.failure()?.errorText ?? 'failed';
+            }
+        });
+    };
+    const loopbackOnly = (route) => {
+        if (isLoopback(route.request().url()))
+            return route.fallback();
+        if (blocked.length < 20)
+            blocked.push(clip(route.request().url(), 200));
+        return route.abort('blockedbyclient');
+    };
+    // The one place pages and contexts come from.
+    const makeContext = async (opts) => {
+        const ctx = await guardedContext({
+            baseURL: job.target,
+            viewport: { width: opts.width ?? DEFAULT_VIEWPORT.width, height: opts.height ?? DEFAULT_VIEWPORT.height },
+            ...(opts.timezoneId ? { timezoneId: opts.timezoneId } : {}),
+            ...(opts.locale ? { locale: opts.locale } : {}),
+            ...(existsSync(job.sessionFile) ? { storageState: job.sessionFile } : {}),
+        });
+        ctx.on('page', watch);
+        await ctx.route('**/*', loopbackOnly);
+        for (const f of activeFaults)
+            await ctx.route(f.pattern, f.handler);
+        if (offline)
+            await ctx.setOffline(true);
+        contexts.push(ctx);
+        return ctx;
+    };
+    const mainContext = await makeContext({});
+    const page = await mainContext.newPage();
+    watch(page);
+    // A context- or page-level CDP session is another way to reach an unguarded
+    // target (Target.createTarget in the default context, a file: URL), so it is
+    // refused like the browser-level one. The factory never needs it.
+    for (const obj of [mainContext, page]) {
+        const proto = Object.getPrototypeOf(obj);
+        if (typeof proto.newCDPSession === 'function')
+            proto.newCDPSession = () => { throw new Error(`newCDPSession() ${NOT_IN_A_PROBE}`); };
+    }
+    const observe = async (p = page) => {
+        visit(p);
+        const view = await p.evaluate(() => {
+            const visible = (el) => {
+                const r = el.getBoundingClientRect();
+                const s = getComputedStyle(el);
+                return r.width > 0 && r.height > 0 && s.visibility !== 'hidden' && s.display !== 'none';
+            };
+            const name = (el) => (el.getAttribute('aria-label') || el.innerText || el.value || el.getAttribute('name') || '').trim().replace(/\s+/g, ' ');
+            const lines = (document.body?.innerText ?? '').split('\n').map((l) => l.trim()).filter(Boolean);
+            return {
+                url: location.pathname + location.search,
+                title: document.title,
+                headings: [...document.querySelectorAll('h1,h2,h3')].filter(visible).map((h) => h.innerText.trim()),
+                alerts: [...document.querySelectorAll('[role=alert],[role=status],[aria-live]')].filter(visible).map((a) => a.innerText.trim()).filter(Boolean),
+                text: lines.slice(0, 150),
+                disabled: [...document.querySelectorAll('button:disabled,input:disabled,select:disabled,textarea:disabled,[aria-disabled=true]')]
+                    .filter(visible).map((el) => ({ name: name(el), reason: el.getAttribute('title') || el.getAttribute('aria-describedby') || null })),
+                fields: [...document.querySelectorAll('input,textarea,select')].filter(visible).map((el) => ({ label: el.labels?.[0]?.innerText?.trim() ?? el.getAttribute('name'), value: el.value })),
+                overflowX: document.documentElement.scrollWidth > window.innerWidth + 1,
+            };
+        });
+        const layout = await p.evaluate(layoutCandidates, 10).catch((e) => [{ kind: 'error', selector: '', text: '', detail: clip(String(e.message), 200) }]);
+        return {
+            ...view,
+            viewport: p.viewportSize(),
+            text: view.text.map((l) => clip(l, 200)),
+            layout,
+            consoleErrors: [...consoleErrors],
+            pageErrors: [...pageErrors],
+            requests: requests.slice(-30).map(({ method, url, status, fault }) => ({ method, url, status, fault })),
+        };
+    };
+    const rr = {
+        web: job.target,
+        page,
+        context: mainContext,
+        // A page in the main context, or in a fresh guarded context when it needs
+        // its own time zone or locale.
+        async newPage(opts = {}) {
+            const viewport = { width: opts.width ?? DEFAULT_VIEWPORT.width, height: opts.height ?? DEFAULT_VIEWPORT.height };
+            if (opts.timezoneId || opts.locale) {
+                const ctx = await makeContext(opts);
+                const p = await ctx.newPage();
+                watch(p);
+                return p;
+            }
+            const p = await mainContext.newPage();
+            watch(p);
+            await p.setViewportSize(viewport);
+            pageIds.get(p).viewport = viewport;
+            return p;
+        },
+        // Load settled: the load event, a quiet network (at most 5 s), and a Nuxt or
+        // other client app mounted, when the page has one.
+        async ready(p = page) {
+            await p.waitForLoadState('load').catch(() => { });
+            await p.waitForLoadState('networkidle', { timeout: 5000 }).catch(() => { });
+            await p.waitForFunction(() => {
+                const nuxt = document.querySelector('#__nuxt');
+                return nuxt ? Boolean(nuxt.__vue_app__) : true;
+            }, undefined, { timeout: 10_000 }).catch(() => { });
+            await p.waitForTimeout(300);
+        },
+        async goto(url, p = page) {
+            await p.goto(url);
+            await rr.ready(p);
+            return p;
+        },
+        async saveSession() {
+            await mainContext.storageState({ path: job.sessionFile });
+            // The first save ends the sign-in: the pages before the one it landed
+            // on, and the requests made before that page, are how it signed in.
+            if (!savedSession) {
+                const landed = lastPage ?? page;
+                const landing = landed.url();
+                const seen = [...pageIds.values()].flatMap((r) => r.visited.map((v) => v.url));
+                signInFlow = { requests: navigatedAt.get(landed) ?? requests.length, pages: [...new Set(seen)].filter((u) => u !== landing) };
+            }
+            savedSession = true;
+        },
+        // Makes matching requests fail, hang, slow down or answer with other data,
+        // in every context the probe has or makes. `times` limits how many requests
+        // it hits (default: all), `method` filters.
+        async fault(pattern, spec, opts = {}) {
+            let hits = 0;
+            const label = typeof spec === 'object' ? JSON.stringify(spec) : String(spec);
+            const handler = async (route) => {
+                const req = route.request();
+                if (opts.method && req.method() !== opts.method.toUpperCase())
+                    return route.fallback();
+                if (opts.times !== undefined && hits >= opts.times)
+                    return route.fallback();
+                hits += 1;
+                faulted.set(req, label);
+                faults.push({ method: req.method(), url: req.url(), fault: label });
+                if (spec === 'hang')
+                    return; // never answered
+                if (spec === 'reset')
+                    return route.abort('connectionreset');
+                if (typeof spec === 'number')
+                    return route.fulfill({ status: spec, contentType: 'application/json', body: JSON.stringify({ detail: `Injected ${spec}` }) });
+                if (spec === 'malformed')
+                    return route.fulfill({ status: 200, contentType: 'application/json', body: '{"oops": [1, 2' });
+                if (spec === 'empty')
+                    return route.fulfill({ status: 200, contentType: 'application/json', body: '' });
+                if (spec === 'empty-list')
+                    return route.fulfill({ status: 200, contentType: 'application/json', body: '[]' });
+                if (spec === 'empty-object')
+                    return route.fulfill({ status: 200, contentType: 'application/json', body: '{}' });
+                if ('delay' in spec) {
+                    await new Promise((r) => setTimeout(r, spec.delay));
+                    return route.fallback();
+                }
+                if ('json' in spec)
+                    return route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify(spec.json) });
+                return route.fulfill({ status: spec.status, contentType: 'application/json', body: spec.body ?? JSON.stringify({ detail: `Injected ${spec.status}` }) });
+            };
+            const entry = { pattern, handler };
+            activeFaults.push(entry);
+            for (const ctx of contexts)
+                await ctx.route(pattern, handler);
+            return {
+                hits: () => hits,
+                clear: async () => {
+                    activeFaults.splice(activeFaults.indexOf(entry), 1);
+                    for (const ctx of contexts)
+                        await ctx.unroute(pattern, handler).catch(() => { });
+                },
+            };
+        },
+        async offline(on) {
+            offline = on;
+            for (const ctx of contexts)
+                await ctx.setOffline(on);
+        },
+        // What a person sees: headings, alerts, visible text lines, disabled
+        // controls (with any reason given), fields, layout candidates and sideways
+        // overflow, plus the errors and API requests seen so far.
+        observe,
+        async screenshot(name, opts = {}) {
+            const base = name.replace(/\.png$/i, '');
+            if (!SHOT_NAME.test(base))
+                throw new Error('rr.screenshot needs a name of letters, digits, dashes and underscores');
+            const file = path.join(job.shotsDir, `${base}.png`);
+            const p = opts.page ?? page;
+            visit(p);
+            if (opts.locator) {
+                const locator = typeof opts.locator === 'string' ? p.locator(opts.locator) : opts.locator;
+                await locator.screenshot({ path: file });
+            }
+            else {
+                await p.screenshot({ path: file, fullPage: Boolean(opts.fullPage) });
+            }
+            if (!shots.includes(file))
+                shots.push(file);
+            return file;
+        },
+        // A named expectation. A finding names the probe and the expectation that
+        // fails; confirmation re-runs the probe and needs the same one to fail.
+        expect(name, ok, detail = '') {
+            checks.push({ name: String(name), pass: Boolean(ok), detail: clip(typeof detail === 'string' ? detail : JSON.stringify(detail) ?? '', 600) });
+            return Boolean(ok);
+        },
+        note(label, value) {
+            notes.push({ label: String(label), value: typeof value === 'string' ? clip(value, 2000) : value });
+        },
+        // A request with the browser's cookies; a path is relative to the web
+        // origin. A body is sent as JSON unless `raw` is set, when the string goes
+        // as it is (as JSON unless a content-type header says otherwise).
+        async request(method, url, body, opts = {}) {
+            const absolute = new URL(url, job.target).toString();
+            if (!isLoopback(absolute))
+                throw new Error('rr.request reaches loopback hosts only');
+            const headers = { ...(opts.headers ?? {}) };
+            const hasType = Object.keys(headers).some((k) => k.toLowerCase() === 'content-type');
+            // A Buffer, because Playwright re-encodes a string that is not valid JSON.
+            let data;
+            if (body !== undefined) {
+                if (opts.raw && typeof body !== 'string')
+                    throw new Error('rr.request with raw: true needs the body as a string');
+                data = Buffer.from(opts.raw ? body : JSON.stringify(body), 'utf8');
+                if (!hasType)
+                    headers['content-type'] = 'application/json';
+            }
+            const rec = { method: method.toUpperCase(), url: absolute, status: null, fault: null, via: 'rr.request' };
+            requests.push(rec);
+            try {
+                const res = await mainContext.request.fetch(absolute, { method, headers, ...(data === undefined ? {} : { data }), failOnStatusCode: false, maxRedirects: 0 });
+                rec.status = res.status();
+                const text = await res.text();
+                let json = null;
+                try {
+                    json = JSON.parse(text);
+                }
+                catch { }
+                return { status: res.status(), headers: res.headers(), json, text: clip(text, 4000) };
+            }
+            catch (e) {
+                rec.failure = clip(String(e.message), 200);
+                throw e;
+            }
+        },
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    };
+    let error = null;
+    let timedOut = false;
+    let timer;
+    // A stray rejected promise or a throw from a detached callback (an un-awaited
+    // click that times out, a route handler that throws) would otherwise kill the
+    // child and lose every check, note and request already recorded. Catch it,
+    // record it once as the probe's error, and let the probe run on so its
+    // partial result still reaches the host.
+    const onStray = (kind) => (e) => {
+        error ??= clip(`${kind}: ${String(e?.stack ?? e).split('\n').slice(0, 3).join(' | ')}`, 800);
+    };
+    process.on('unhandledRejection', onStray('unhandled rejection'));
+    process.on('uncaughtException', onStray('uncaught exception'));
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => { timedOut = true; error = `probe timed out after ${Math.round(job.timeoutMs / 1000)} s`; resolve(); }, job.timeoutMs);
+    });
+    // Node's permission model has no rule for signals, so a probe could end the
+    // runner, the app or any process the user owns. Take the means away, for
+    // good, before the probe's code loads; the child itself never signals.
+    for (const name of ['kill', '_kill']) {
+        Object.defineProperty(process, name, {
+            value: () => { throw new Error('A probe may not signal other processes.'); },
+            writable: false,
+            configurable: false,
+        });
+    }
+    const body = (async () => {
+        const mod = await import(pathToFileURL(job.probeFile).href);
+        if (typeof mod.default !== 'function')
+            throw new Error('a probe must `export default async function (rr) { ... }`');
+        await mod.default(rr);
+    })().catch((e) => {
+        error ??= clip(String(e?.stack ?? e).split('\n').slice(0, 4).join(' | '), 800);
+    });
+    await Promise.race([body, deadline]);
+    clearTimeout(timer);
+    let final = null;
+    try {
+        const current = lastPage && !lastPage.isClosed() ? lastPage : page;
+        final = await Promise.race([observe(current), new Promise((_, reject) => setTimeout(() => reject(new Error('observe timed out')), 5000))]);
+    }
+    catch { }
+    for (const [req, rec] of records)
+        rec.fault ??= faulted.get(req) ?? null;
+    for (const p of pageIds.keys())
+        if (!p.isClosed())
+            visit(p);
+    if (job.keepOpenMs > 0)
+        await new Promise((r) => setTimeout(r, job.keepOpenMs));
+    return {
+        probe: job.probe,
+        startedAt,
+        finishedAt: Date.now(),
+        checks,
+        notes,
+        error,
+        hostError: timedOut ? 'timeout' : null,
+        blocked,
+        savedSession,
+        ...(signInFlow ? { signInFlow } : {}),
+        shots,
+        requests,
+        faults,
+        pages: [...pageIds.values()],
+        final,
+        output: '',
+    };
+}
+// A failure before the probe ran: its message, the path the permission model
+// refused when that is the cause (Node's message leaves it out), and where.
+export function fatalText(e) {
+    const err = e;
+    const refused = err?.resource ? `(${err.code ?? 'refused'}: ${err.resource})` : '';
+    const where = String(err?.stack ?? '').split('\n').slice(1, 4).map((l) => l.trim()).join(' | ');
+    return [String(err?.message ?? e), refused, where].filter(Boolean).join(' ');
+}
+process.once('message', (job) => {
+    run(job).then((result) => process.send?.({ nonce: job.nonce, result }, () => process.exit(0)), (e) => process.send?.({ nonce: job.nonce, fatal: clip(fatalText(e), 800) }, () => process.exit(0)));
+});

package/dist/probe-host.mjs

@@ -0,0 +1,206 @@
+// The probe host: it launches the browser, then runs the probe in a child Node
+// process under Node's permission model. The child may read the run folder and
+// this package's own code, but write only a scratch folder and its shots
+// folder, so it cannot touch the runner's own files (context.json, the result
+// files, findings.json, finish-state.json) that the runner trusts. It starts
+// no processes, workers or addons, sees only PATH and the sign-in variables
+// `start` named, and never launches a browser: it connects to this one, and
+// only through the relay, which checks every protocol message it sends.
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { createServer } from 'node:net';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { playwrightCoreDir } from './browser.mjs';
+import { startRelay } from './relay.mjs';
+import { emptyResult } from './results.mjs';
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const CHILD = path.join(HERE, 'probe-child.mjs');
+export const PROBE_TIMEOUT_MS = 100_000;
+export const KILL_GRACE_MS = 20_000;
+const OUTPUT_TAIL = 2000;
+// The child's one writable place for a session and its own scratch, shared by
+// every probe of a run so a saved session carries from one probe to the next.
+export const scratchDir = (runDir) => path.join(runDir, 'scratch');
+// The session the run's sign-in saved, which every probe of the run starts from.
+export const sessionPath = (runDir) => path.join(scratchDir(runDir), 'session.json');
+// Node 22 has no network permission; later versions have one switch for all
+// of it, and the child needs it to reach the browser. Either way a probe's own
+// Node code can reach the network; the browser is held to loopback below.
+export const NODE_NET_PERMISSION = process.allowedNodeEnvironmentFlags.has('--allow-net');
+function both(p) {
+    try {
+        const real = realpathSync.native(p);
+        return real === p ? [p] : [p, real];
+    }
+    catch {
+        return [p];
+    }
+}
+// When playwright-core loads on Linux it asks whether it runs under WSL or in a
+// container, by reading these system files. One of those checks is not
+// wrapped in a try, and the permission model makes a refused existsSync throw,
+// so without them every probe would stop before it ran. They hold no user data,
+// and they are granted as exact paths.
+export const LINUX_PLATFORM_FILES = ['/proc/version', '/proc/sys/fs/binfmt_misc/WSLInterop', '/run/WSL', '/run/.containerenv', '/.dockerenv', '/proc/self/cgroup'];
+// Reads cover the run folder (its own probe, session and results) and this
+// package's compiled code and playwright-core, but not the package root, so a
+// dev checkout's repository, node_modules and benchmark answers stay unread.
+// Writes cover only the folders the child owns.
+export function permissionArgs(runDir, writeDirs, platform = process.platform) {
+    const reads = [
+        ...new Set([
+            ...[runDir, HERE, playwrightCoreDir()].map((p) => path.resolve(p)).flatMap(both),
+            ...(platform === 'linux' ? LINUX_PLATFORM_FILES : []),
+        ]),
+    ];
+    const writes = [...new Set(writeDirs.map((p) => path.resolve(p)).flatMap(both))];
+    return [
+        '--permission',
+        ...reads.map((p) => `--allow-fs-read=${p}`),
+        ...writes.map((p) => `--allow-fs-write=${p}`),
+        ...(NODE_NET_PERMISSION ? ['--allow-net'] : []),
+        '--disable-warning=ExperimentalWarning',
+    ];
+}
+export function childEnv(names, env = process.env, platform = process.platform) {
+    const out = {};
+    const pathKey = Object.keys(env).find((k) => k.toUpperCase() === 'PATH');
+    if (pathKey && env[pathKey] !== undefined)
+        out[pathKey] = env[pathKey];
+    // Windows cannot open a socket in a process without SystemRoot.
+    if (platform === 'win32') {
+        const root = Object.keys(env).find((k) => k.toUpperCase() === 'SYSTEMROOT');
+        if (root && env[root] !== undefined)
+            out[root] = env[root];
+    }
+    for (const name of names)
+        if (env[name] !== undefined)
+            out[name] = env[name];
+    return out;
+}
+// A local port that drops every connection. The browser's proxy points here
+// and WebRTC is held to the proxy, so a connection to any host but loopback
+// (which Chrome never proxies) fails, whatever context or socket a page opens.
+function closedProxy() {
+    return new Promise((resolve, reject) => {
+        const server = createServer((socket) => socket.destroy());
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve(server));
+    });
+}
+export const REDACTED = '[session value]';
+const MIN_REDACTED = 8;
+// The cookie and storage values of the run's saved session. The child must
+// read the session to start signed in, so a probe could print it; the result
+// the hunter reads never holds these values as they are.
+export function sessionValues(file) {
+    let state;
+    try {
+        state = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return [];
+    }
+    const values = [...(state.cookies ?? []).map((c) => c?.value), ...(state.origins ?? []).flatMap((o) => (o?.localStorage ?? []).map((i) => i?.value))];
+    return [...new Set(values.filter((v) => typeof v === 'string' && v.length >= MIN_REDACTED))].sort((a, b) => b.length - a.length);
+}
+export function redact(value, secrets) {
+    if (secrets.length === 0)
+        return value;
+    const walk = (v) => {
+        if (typeof v === 'string')
+            return secrets.reduce((s, x) => s.split(x).join(REDACTED), v);
+        if (Array.isArray(v))
+            return v.map(walk);
+        if (v && typeof v === 'object')
+            return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
+        return v;
+    };
+    return walk(value);
+}
+const tail = (s) => (s.length > OUTPUT_TAIL ? `…${s.slice(-OUTPUT_TAIL)}` : s);
+export async function runProbe(job) {
+    const scratch = scratchDir(job.runDir);
+    mkdirSync(job.shotsDir, { recursive: true });
+    mkdirSync(scratch, { recursive: true });
+    const sessionFile = sessionPath(job.runDir);
+    const before = sessionValues(sessionFile);
+    const timeoutMs = job.timeoutMs ?? PROBE_TIMEOUT_MS;
+    const { chromium } = await import('playwright-core');
+    let proxy = null;
+    let server = null;
+    let relay = null;
+    try {
+        proxy = await closedProxy();
+        const { port } = proxy.address();
+        server = await chromium.launchServer({ channel: job.browser, headless: !job.headed, host: '127.0.0.1', args: [`--proxy-server=http://127.0.0.1:${port}`, '--force-webrtc-ip-handling-policy=disable_non_proxied_udp'] });
+        relay = await startRelay(server.wsEndpoint(), job.target);
+    }
+    catch (e) {
+        await server?.kill().catch(() => { });
+        proxy?.close();
+        return emptyResult(job.probe, `the browser did not start: ${String(e.message).split('\n')[0]}`, 'crash');
+    }
+    const nonce = randomBytes(16).toString('hex');
+    const child = spawn(process.execPath, [...permissionArgs(job.runDir, [scratch, job.shotsDir]), CHILD], {
+        cwd: scratch,
+        env: childEnv(job.signInVariables),
+        stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+    });
+    let output = '';
+    child.stdout?.on('data', (d) => { output = tail(output + d.toString('utf8')); });
+    child.stderr?.on('data', (d) => { output = tail(output + d.toString('utf8')); });
+    const result = await new Promise((resolve) => {
+        let settled = false;
+        const settle = (r) => { if (!settled) {
+            settled = true;
+            clearTimeout(killer);
+            resolve(r);
+        } };
+        const killer = setTimeout(() => {
+            child.kill('SIGKILL');
+            settle(emptyResult(job.probe, `probe timed out after ${Math.round((timeoutMs + KILL_GRACE_MS) / 1000)} s and was stopped`, 'timeout'));
+        }, timeoutMs + KILL_GRACE_MS + (job.keepOpenMs ?? 0));
+        child.on('message', (m) => {
+            if (m?.nonce !== nonce)
+                return;
+            if (m.result)
+                settle(m.result);
+            else
+                settle(emptyResult(job.probe, `probe host failed: ${m.fatal ?? 'unknown error'}`, 'crash'));
+        });
+        child.on('error', (e) => settle(emptyResult(job.probe, `probe host failed to start: ${e.message}`, 'crash')));
+        child.on('exit', (code, signal) => {
+            // Let a message sent just before exit arrive first.
+            setImmediate(() => settle(emptyResult(job.probe, `probe host gave no result (exit ${code ?? signal})`, code === 0 ? 'no-result' : 'crash')));
+        });
+        const message = {
+            nonce,
+            wsEndpoint: relay.endpoint,
+            probe: job.probe,
+            probeFile: job.probeFile,
+            target: job.target,
+            sessionFile,
+            shotsDir: job.shotsDir,
+            timeoutMs,
+            slowMo: job.slowMo ?? 0,
+            keepOpenMs: job.keepOpenMs ?? 0,
+        };
+        child.send(message);
+    });
+    if (child.exitCode === null)
+        child.kill('SIGKILL');
+    // Each run starts from scratch, so the browser is killed rather than closed
+    // gracefully: it is much faster, and its profile folder is removed either way.
+    await relay.close().catch(() => { });
+    await server.kill().catch(() => { });
+    proxy.close();
+    result.refused = [...relay.refused];
+    result.output = output.trim();
+    if (result.hostError && result.output)
+        result.error = `${result.error ?? ''} | output: ${result.output.slice(-400)}`;
+    // The session as it was before this run and as the run may have saved it.
+    return redact(result, [...new Set([...before, ...sessionValues(sessionFile)])]);
+}