triflux 10.35.3 → 10.36.0

package/bin/triflux.mjs

@@ -75,6 +75,7 @@ import {
   formatPsmuxUpdateGuidance,
   probePsmuxSupport,
 } from "../scripts/lib/psmux-info.mjs";
+import { main as stealthFetchMain } from "../scripts/lib/stealth-fetch.mjs";
 import {
   buildWindowsHubAutostartCommand,
   cleanupStaleSkills,
@@ -189,6 +190,11 @@ const CLI_COMMAND_SCHEMAS = Object.freeze({
       },
     ],
   },
+  "stealth-fetch": {
+    usage: "tfx stealth-fetch <url>",
+    description:
+      "cloakbrowser 기반 단일 URL fetch (http/https only, JSON stdout)",
+  },
   doctor: {
     usage:
       "tfx doctor [--fix] [--reset] [--audit] [--diagnose] [--purge-logs] [--dynamic-routing] [--cleanup-stale-hubs --dry-run|--apply] [--cleanup-stale-tmux --prefix tfx-* --age-min N --dry-run|--apply] [--json]",
@@ -6327,6 +6333,7 @@ ${updateNotice}
     ${DIM}  --reset${RESET}      ${GRAY}캐시 전체 초기화${RESET}
     ${DIM}  --json${RESET}       ${GRAY}구조화된 진단 결과 JSON 출력${RESET}
     ${WHITE_BRIGHT}tfx auto${RESET}       ${GRAY}tfx-auto 라우팅 결정 미리보기 (--cli codex|antigravity|claude)${RESET}
+    ${WHITE_BRIGHT}tfx stealth-fetch${RESET} ${GRAY}cloakbrowser 기반 URL fetch (JSON stdout)${RESET}
     ${WHITE_BRIGHT}tfx mcp${RESET}        ${GRAY}MCP registry 관리 (list/sync/add/remove)${RESET}
     ${WHITE_BRIGHT}tfx update${RESET}     ${GRAY}최신 안정 버전으로 업데이트${RESET}
     ${DIM}  --dev / dev${RESET}   ${GRAY}dev 태그로 업데이트${RESET}
@@ -7281,6 +7288,13 @@ async function main() {
         enableHubAutostart: cmdArgs.includes("--enable-hub-autostart"),
       });
       return;
+    case "stealth-fetch":
+      if (cmdArgs.some(isHelpArg)) {
+        printCommandHelp("stealth-fetch");
+        return;
+      }
+      await stealthFetchMain([process.argv[0], "stealth-fetch", ...cmdArgs]);
+      return;
     case "doctor": {
       if (cmdArgs.some(isHelpArg)) {
         printCommandHelp("doctor");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triflux",
-  "version": "10.35.3",
+  "version": "10.36.0",
   "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",
   "type": "module",
   "bin": {
@@ -23,6 +23,10 @@
     "@triflux/remote": "^10.25.0",
     "tree-kill": "^1.2.2"
   },
+  "optionalDependencies": {
+    "cloakbrowser": "^0.3.31",
+    "playwright-core": "^1.53.0"
+  },
   "files": [
     "bin",
     "tui",

package/scripts/lib/stealth-fetch.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+// SSRF boundary: stealthFetch only accepts http: and https: URLs. It does not
+// guard private IPs, metadata hosts such as 169.254.x.x, or localhost; callers
+// must treat the URL as already inside their trust boundary.
+
+import { pathToFileURL } from "node:url";
+
+export class CloakBrowserUnavailableError extends Error {}
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_WAIT_UNTIL = "load";
+const SUPPORTED_PLATFORMS = new Set([
+  "linux:x64",
+  "linux:arm64",
+  "darwin:x64",
+  "darwin:arm64",
+  "win32:x64",
+]);
+const EXIT_CODES = {
+  not_installed: 3,
+  unsupported_platform: 4,
+  runtime_error: 5,
+  blocked_scheme: 6,
+};
+
+function isSupportedPlatform(platform, arch) {
+  return SUPPORTED_PLATFORMS.has(`${platform}:${arch}`);
+}
+
+function isModuleNotFound(error) {
+  return (
+    error?.code === "ERR_MODULE_NOT_FOUND" || error?.code === "MODULE_NOT_FOUND"
+  );
+}
+
+function htmlToText(html) {
+  return String(html || "")
+    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/giu, " ")
+    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/giu, " ")
+    .replace(/<[^>]+>/gu, " ")
+    .replace(/&nbsp;/giu, " ")
+    .replace(/&amp;/giu, "&")
+    .replace(/&lt;/giu, "<")
+    .replace(/&gt;/giu, ">")
+    .replace(/&quot;/giu, '"')
+    .replace(/&#39;/gu, "'")
+    .replace(/\s+/gu, " ")
+    .trim();
+}
+
+function responseStatus(response) {
+  if (!response) return null;
+  if (typeof response.status === "function") return response.status();
+  return response.status ?? null;
+}
+
+function responseUrl(response, fallbackUrl) {
+  if (!response) return fallbackUrl;
+  if (typeof response.url === "function") return response.url();
+  return response.url ?? fallbackUrl;
+}
+
+function parseAllowedFetchUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, scheme: null };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, scheme: parsed.protocol };
+  }
+  return { ok: true, href: parsed.href };
+}
+
+async function closeBrowser(browser) {
+  if (!browser || typeof browser.close !== "function") return;
+  try {
+    await browser.close();
+  } catch {
+    // best effort: fetch callers only need the primary result signal
+  }
+}
+
+export async function stealthFetch(url, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const waitUntil = opts.waitUntil ?? DEFAULT_WAIT_UNTIL;
+  const loadCloakBrowser = opts._import ?? (() => import("cloakbrowser"));
+  const platform = opts._platform ?? process.platform;
+  const arch = opts._arch ?? process.arch;
+
+  if (!isSupportedPlatform(platform, arch)) {
+    return {
+      ok: false,
+      reason: "unsupported_platform",
+      platform,
+      arch,
+    };
+  }
+
+  const parsedUrl = parseAllowedFetchUrl(url);
+  if (!parsedUrl.ok) {
+    return {
+      ok: false,
+      reason: "blocked_scheme",
+      scheme: parsedUrl.scheme,
+    };
+  }
+
+  let cloakbrowser;
+  try {
+    cloakbrowser = await loadCloakBrowser();
+  } catch (error) {
+    if (isModuleNotFound(error)) return { ok: false, reason: "not_installed" };
+    return { ok: false, reason: "runtime_error", error: String(error) };
+  }
+
+  let browser;
+  try {
+    const launch = cloakbrowser?.launch;
+    if (typeof launch !== "function") {
+      throw new CloakBrowserUnavailableError("cloakbrowser launch unavailable");
+    }
+    browser = await launch();
+    const page = await browser.newPage();
+    const response = await page.goto(parsedUrl.href, {
+      waitUntil,
+      timeout: timeoutMs,
+    });
+    const html = await page.content();
+    return {
+      ok: true,
+      engine: "cloakbrowser",
+      url: parsedUrl.href,
+      finalUrl: responseUrl(response, parsedUrl.href),
+      status: responseStatus(response),
+      html,
+      text: htmlToText(html),
+    };
+  } catch (error) {
+    return { ok: false, reason: "runtime_error", error: String(error) };
+  } finally {
+    await closeBrowser(browser);
+  }
+}
+
+export function exitCodeFor(result) {
+  return EXIT_CODES[result?.reason] ?? 5;
+}
+
+export async function main(argv = process.argv) {
+  const url = argv[2];
+  if (!url) {
+    console.error("usage: stealth-fetch <url>");
+    process.exitCode = 2;
+    return;
+  }
+
+  const result = await stealthFetch(url);
+  if (result.ok) {
+    console.log(JSON.stringify(result));
+    process.exitCode = 0;
+    return;
+  }
+
+  console.error(`[stealth-fetch] 폴백: ${result.reason}`);
+  console.log(JSON.stringify(result));
+  process.exitCode = exitCodeFor(result);
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  await main();
+}

package/scripts/setup.mjs

@@ -18,6 +18,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "fs";
+import { createRequire } from "module";
 import { homedir } from "os";
 import { dirname, join, relative, resolve } from "path";
 import { fileURLToPath } from "url";
@@ -32,6 +33,7 @@ import { addPluginRootFallbackToCommand } from "./lib/doctor-env-checks.mjs";
 import { cleanupTmpFiles } from "./tmp-cleanup.mjs";
 
 const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const require = createRequire(import.meta.url);
 // Windows 에서 os.homedir() 가 USERPROFILE 만 보고 process.env.HOME swap 을
 // 무시하기 때문에, integration test 가 fixture 격리한 spawn child 에서도
 // production ~/.codex/config.toml 을 건드릴 수 있다. (#193 회귀)
@@ -698,6 +700,90 @@ function isProtectedCodexConfigMutationEnv(env = process.env) {
   );
 }
 
+function isProtectedCloakBrowserInstallEnv(env = process.env) {
+  return (
+    env.NODE_ENV === "test" ||
+    env.CI === "true" ||
+    env.TFX_TEST === "1" ||
+    Boolean(env.TRIFLUX_TEST_HOME) ||
+    Boolean(env.TEST_LOCK_PID) ||
+    Boolean(env.NODE_TEST_CONTEXT) ||
+    Boolean(env.NODE_TEST_WORKER_ID) ||
+    env.TFX_SKIP_CLOAKBROWSER_SETUP === "1"
+  );
+}
+
+function isCloakBrowserSupportedPlatform(platform, arch) {
+  return (
+    (platform === "linux" && (arch === "x64" || arch === "arm64")) ||
+    (platform === "darwin" && (arch === "x64" || arch === "arm64")) ||
+    (platform === "win32" && arch === "x64")
+  );
+}
+
+function ensureCloakBrowser({
+  env = process.env,
+  platform = process.platform,
+  arch = process.arch,
+  requireResolve = require.resolve,
+  execFileSyncFn = execFileSync,
+  warn = (message) => console.warn(message),
+} = {}) {
+  if (isProtectedCloakBrowserInstallEnv(env)) {
+    return {
+      ok: true,
+      installed: false,
+      skipped: true,
+      reason: "protected-env",
+    };
+  }
+
+  if (!isCloakBrowserSupportedPlatform(platform, arch)) {
+    warn(
+      `[setup] cloakbrowser optional setup skipped: unsupported_platform (${platform}/${arch})`,
+    );
+    return {
+      ok: true,
+      installed: false,
+      skipped: true,
+      reason: "unsupported_platform",
+    };
+  }
+
+  try {
+    requireResolve("cloakbrowser", { paths: [PLUGIN_ROOT] });
+    return { ok: true, installed: true, skipped: false, reason: "installed" };
+  } catch {
+    // CloakBrowser downloads its browser binary lazily on first launch; there is
+    // no separate browser install command to run here.
+  }
+
+  try {
+    execFileSyncFn(
+      "npm",
+      ["install", "--no-save", "cloakbrowser", "playwright-core"],
+      {
+        cwd: PLUGIN_ROOT,
+        stdio: "ignore",
+        env,
+        timeout: 120_000,
+      },
+    );
+    return { ok: true, installed: true, skipped: false, reason: "installed" };
+  } catch (error) {
+    warn(
+      `[setup] cloakbrowser optional setup failed: ${_normalizeErrorMessage(error)}`,
+    );
+    return {
+      ok: false,
+      installed: false,
+      skipped: false,
+      reason: "install_failed",
+      error: _normalizeErrorMessage(error),
+    };
+  }
+}
+
 /**
  * Codex config.json에 tfx-hub MCP 서버 엔트리를 보장한다.
  * @param {{ mcpUrl: string, createIfMissing?: boolean, enabled?: boolean }} opts
@@ -1404,6 +1490,7 @@ export {
   DEPRECATED_SKILLS,
   detectDevMode,
   ensureAgyHooks,
+  ensureCloakBrowser,
   ensureCodexHooks,
   ensureCodexHubServerConfig,
   ensureCodexProfiles,
@@ -1490,6 +1577,15 @@ export async function runDeferred(stdinData) {
       result.action === "updated" ||
       result.action === "removed",
   ).length;
+  const cloakBrowserResult = ensureCloakBrowser({
+    warn: (message) => io.log(`  \x1b[33m⚠\x1b[0m ${message}`),
+  });
+  if (
+    cloakBrowserResult.reason === "installed" &&
+    cloakBrowserResult.installed
+  ) {
+    io.log("  \x1b[32m✓\x1b[0m cloakbrowser optional backend ready");
+  }
   if (pkgVersion && marker?.version === pkgVersion && !isForce) {
     if (claudeRoutingChangedCount > 0) {
       io.log(

package/skills/tfx-research/SKILL.md

@@ -123,6 +123,13 @@ AskUserQuestion:
   5. URL 콘텐츠 추출
 ```
 
+## URL 콘텐츠 수집 (stealth-first)
+
+Quick 모드 Step 1.5 에서 `5. URL 콘텐츠 추출` 을 선택했거나 Deep 모드에서 소스 URL 본문이 필요하면:
+1. 기본 경로로 먼저 `node scripts/lib/stealth-fetch.mjs <url>` 를 실행한다.
+2. exit 0 이면 stdout JSON 의 `html` 또는 `text` 를 URL 본문 근거로 사용한다.
+3. exit 3/4/5 이면 stderr/stdout 의 reason 을 확인하고 `stealth-fetch 폴백: <이유>` 1줄 경고 후 기존 폴백을 사용한다: WebFetch → Tavily extract → Exa fetch.
+
 ### Step 2: Antigravity Google Search 위임
 
 ```