venombrowser 4.1.0 → 4.1.2

package/src/bridge-client.js

@@ -18,22 +18,29 @@ class BridgeTimeoutError extends BridgeError {}
 class BridgeCommandError extends BridgeError {}
 
 class BrowserBridge {
-  constructor({ host = '127.0.0.1', port = 10086, session = 'default' } = {}) {
+  constructor({ host = '127.0.0.1', port = 10086, session = 'default', apiKey } = {}) {
+    if (!apiKey) {
+      throw new Error('apiKey is required to connect to the VenomBrowser bridge.');
+    }
     this.baseUrl = `http://${host}:${port}`;
     this.session = session;
     this.http = axios.create({
       baseURL: this.baseUrl,
-      timeout: 60000
+      timeout: 60000,
+      headers: {
+        'x-bridge-key': apiKey
+      }
     });
   }
 
   // ─── Core command method ─────────────────────────────────────────────────
-  async command(action, args = {}, timeout = 30000) {
+  async command(action, args = {}, timeout = 30000, extra = {}) {
     try {
       const response = await this.http.post('/command', {
         action,
         args,
-        session: this.session
+        session: this.session,
+        ...extra
       }, { timeout });
       return response.data;
     } catch (e) {
@@ -73,7 +80,19 @@ class BrowserBridge {
   }
 
   async closeSession() {
-    return this.command('close_session');
+    return this.command('close_session', {}, 30000, { confirm: true });
+  }
+
+  async stopServer() {
+    return this.command('stop_server', {}, 5000, { confirm: true });
+  }
+
+  async restartServer() {
+    return this.command('restart_server', {}, 5000, { confirm: true });
+  }
+
+  async bridgeStatus() {
+    return this.command('status');
   }
 
   // ─── Content interaction (Kimi-style) ────────────────────────────────────
@@ -130,6 +149,47 @@ class BrowserBridge {
     return this.command('scroll', { direction, amount });
   }
 
+  // ─── Phase 1: Cheap Wins ─────────────────────────────────────────────────
+  async scrollTo(selector) {
+    return this.command('scroll_to', { selector });
+  }
+
+  async checkVisibility(selector) {
+    return this.command('check_visibility', { selector });
+  }
+
+  async checkStale(selector) {
+    return this.command('check_stale', { selector });
+  }
+
+  async doubleClick(selector) {
+    return this.command('double_click', { selector });
+  }
+
+  async rightClick(selector) {
+    return this.command('right_click', { selector });
+  }
+
+  async keyboard(key, { modifiers = [] } = {}) {
+    return this.command('keyboard', { key, modifiers });
+  }
+
+  async goBack() {
+    return this.command('go_back');
+  }
+
+  async goForward() {
+    return this.command('go_forward');
+  }
+
+  async manageCookies(cmd, { name, value, domain } = {}) {
+    return this.command('manage_cookies', { cmd, name, value, domain });
+  }
+
+  async manageStorage(cmd, { storageType = 'local', key, value } = {}) {
+    return this.command('manage_storage', { cmd, storage_type: storageType, key, value });
+  }
+
   // ─── Legacy compatibility (maps old names to new) ─────────────────────────
   async extract(selector = null) {
     const r = await this.evaluate(`

package/src/bridge-server.js

@@ -16,13 +16,37 @@ const fs = require('fs');
 const path = require('path');
 const WebSocket = require('ws');
 const { v4: uuidv4 } = require('uuid');
+const crypto = require('crypto');
 
 const PORT = parseInt(process.env.BRIDGE_PORT || '10086', 10);
 const WS_PORT = parseInt(process.env.WS_PORT || String(PORT + 1), 10);
+const WS_AUTH_TOKEN = process.env.WS_AUTH_TOKEN;
+const REST_API_KEY = process.env.REST_API_KEY;
+const CORS_ORIGIN = process.env.CORS_ORIGIN;
+
+if (!WS_AUTH_TOKEN || !REST_API_KEY) {
+  console.error('[Bridge] FATAL: WS_AUTH_TOKEN and REST_API_KEY must be set in the environment.');
+  process.exit(1);
+}
+
 const WS_PING_INTERVAL = 15000;
 const WS_PING_TIMEOUT = 10000;
 const CMD_TIMEOUT = 30000;
+const IDLE_TIMEOUT = 15 * 60 * 1000; // 15 minutes of inactivity shuts down the daemon
 const SCREENSHOT_DIR = path.join(__dirname, '..', '..', 'screenshots');
+const LOG_DIR = path.join(__dirname, '..', 'logs');
+
+if (!fs.existsSync(LOG_DIR)) {
+  fs.mkdirSync(LOG_DIR, { recursive: true });
+}
+
+function safeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length) return false;
+  return crypto.timingSafeEqual(aBuf, bBuf);
+}
 
 class VenomBrowserBridgeServer {
   constructor() {
@@ -37,13 +61,57 @@ class VenomBrowserBridgeServer {
     this.currentTab = null;
     this.pingTimer = null;
     this.lastPong = Date.now();
+    this.idleTimer = null;
+
+    this.lastRestActivity = Date.now();
+    this.EXTENSION_IDLE_TIMEOUT = parseInt(process.env.EXTENSION_IDLE_TIMEOUT || String(120 * 1000), 10);
+    this.DAEMON_IDLE_TIMEOUT = parseInt(process.env.DAEMON_IDLE_TIMEOUT || String(30 * 60 * 1000), 10);
+
+    // Setup uncaught exception handlers
+    process.on('uncaughtException', (err) => {
+      console.error('[Bridge] UNCAUGHT EXCEPTION:', err);
+    });
 
+    process.on('unhandledRejection', (reason, promise) => {
+      console.error('[Bridge] UNHANDLED REJECTION:', reason);
+    });
+  }
+
+  start() {
+    console.log(`\n🚀 Starting VenomBrowser Bridge Server v4.1.0...`);
     this.startHTTP();
     this.startWS();
     this.startPingLoop();
+    this.startIdleMonitor();
+  }
+
+  startIdleMonitor() {
+    setInterval(() => {
+      const now = Date.now();
+      const idleTime = now - this.lastRestActivity;
+
+      // 1. If idle longer than DAEMON_IDLE_TIMEOUT, shut down completely
+      if (idleTime > this.DAEMON_IDLE_TIMEOUT) {
+        console.log(`[Bridge] Daemon idle for > ${this.DAEMON_IDLE_TIMEOUT}ms. Shutting down.`);
+        process.exit(0);
+      }
+
+      // 2. If idle longer than EXTENSION_IDLE_TIMEOUT, disconnect extension
+      if (idleTime > this.EXTENSION_IDLE_TIMEOUT && this.extensionWs && this.extensionWs.readyState === WebSocket.OPEN) {
+        console.log(`[Bridge] No REST activity for > ${this.EXTENSION_IDLE_TIMEOUT}ms. Disconnecting extension.`);
+        this.safeSend(this.extensionWs, { type: 'idle_disconnect' });
+        
+        // Wait a tiny bit for message to send before closing
+        setTimeout(() => {
+          if (this.extensionWs) {
+            this.extensionWs.close(1000, 'Idle Disconnect');
+          }
+        }, 100);
+      }
+    }, 10000); // Check every 10 seconds
   }
 
-  // ─── Safe WebSocket send ─────────────────────────────────────────────────
+  // ─── HTTP Server ─────────────────────────────────────────────────────────
   safeSend(ws, data) {
     try {
       if (ws && ws.readyState === WebSocket.OPEN) {
@@ -59,9 +127,16 @@ class VenomBrowserBridgeServer {
   // ─── HTTP Server ─────────────────────────────────────────────────────────
   startHTTP() {
     this.httpServer = http.createServer((req, res) => {
-      res.setHeader('Access-Control-Allow-Origin', '*');
-      res.setHeader('Access-Control-Allow-Methods', 'POST, GET, OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+      // CORS handling
+      if (CORS_ORIGIN && CORS_ORIGIN !== '*') {
+        if (req.headers.origin === CORS_ORIGIN) {
+          res.setHeader('Access-Control-Allow-Origin', CORS_ORIGIN);
+          res.setHeader('Access-Control-Allow-Methods', 'POST, GET, OPTIONS');
+          res.setHeader('Access-Control-Allow-Headers', 'Content-Type, x-bridge-key');
+        }
+      } else {
+        // No CORS by default. Only allow localhost processes.
+      }
 
       if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
 
@@ -80,6 +155,12 @@ class VenomBrowserBridgeServer {
         });
       }
 
+      // API Key Auth for all other endpoints
+      const apiKey = req.headers['x-bridge-key'];
+      if (!safeCompare(apiKey, REST_API_KEY)) {
+        return send(401, { success: false, error: 'Unauthorized: Invalid x-bridge-key' });
+      }
+
       if (req.method === 'GET' && req.url === '/status') {
         return send(200, {
           success: true,
@@ -139,10 +220,19 @@ class VenomBrowserBridgeServer {
 
     if (!action) throw new Error('action is required');
 
+    const destructiveActions = ['upload', 'close_session', 'stop_server', 'restart_server'];
+    const destructiveArgs = ['delete', 'clear'];
+    if (destructiveActions.includes(action) || (['manage_cookies', 'manage_storage'].includes(action) && destructiveArgs.includes(args.cmd))) {
+      if (request.confirm !== true) {
+        throw new Error(`Confirmation required: The action '${action}' is destructive. You must include "confirm": true in your request to proceed.`);
+      }
+    }
+
     if (!this.sessions.has(session)) {
       this.sessions.set(session, { tabs: new Set(), startTime: Date.now(), commandCount: 0 });
     }
     this.sessions.get(session).commandCount++;
+    this.lastRestActivity = Date.now();
 
     if (action === 'health') return { service: 'venombrowser-bridge' };
 
@@ -156,8 +246,6 @@ class VenomBrowserBridgeServer {
       };
     }
 
-    if (!this.isConnected()) throw new Error('Extension not connected');
-
     return this.executeAction(action, args, session, tabId);
   }
 
@@ -218,6 +306,19 @@ class VenomBrowserBridgeServer {
         return { closed };
       }
 
+      case 'stop_server': {
+        console.log('[Bridge] Received stop_server command from agent/CLI. Shutting down gracefully.');
+        setTimeout(() => this.shutdown(), 100);
+        return { success: true, message: 'Server is shutting down.' };
+      }
+
+      case 'restart_server': {
+        console.log('[Bridge] Received restart_server command. Shutting down for restart...');
+        // The MCP server / agent will auto-spawn a new daemon on next command
+        setTimeout(() => this.shutdown(), 100);
+        return { success: true, message: 'Server is restarting. Next command will auto-spawn a new daemon.' };
+      }
+
       case 'snapshot': {
         const r = await send('SNAPSHOT', {}, tabId || this.currentTab);
         const res = r.result || {};
@@ -245,12 +346,18 @@ class VenomBrowserBridgeServer {
       }
 
       case 'evaluate': {
-        const r = await send('EVALUATE', { code: args.code }, tabId || this.currentTab, 30000);
+        const code = args.code;
+        fs.appendFileSync(path.join(LOG_DIR, 'audit.log'), `[${new Date().toISOString()}] evaluate: ${code}\n`);
+        const r = await send('EVALUATE', { code }, tabId || this.currentTab, 30000);
         return { type: r.result?.type, value: r.result?.result };
       }
 
       case 'cdp': {
-        const r = await send('CDP', { method: args.method, params: args.params }, tabId || this.currentTab, 30000);
+        const { method, params = {} } = args;
+        if (method === 'Runtime.evaluate' || method === 'Runtime.evaluateOnNewDocument') {
+          fs.appendFileSync(path.join(LOG_DIR, 'audit.log'), `[${new Date().toISOString()}] CDP ${method}: ${JSON.stringify(params)}\n`);
+        }
+        const r = await send('CDP', { method, params }, tabId || this.currentTab, 30000);
         return r.result;
       }
 
@@ -294,6 +401,57 @@ class VenomBrowserBridgeServer {
         return r.result;
       }
 
+      // ── Phase 1: Cheap Wins ──
+      case 'scroll_to': {
+        const r = await send('SCROLL_TO', { selector: args.selector }, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'check_visibility': {
+        const r = await send('CHECK_VISIBILITY', { selector: args.selector }, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'check_stale': {
+        const r = await send('CHECK_STALE', { selector: args.selector }, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'double_click': {
+        const r = await send('DOUBLE_CLICK', { selector: args.selector }, tabId || this.currentTab);
+        return { success: true, tag: r.result?.tag, text: r.result?.text };
+      }
+
+      case 'right_click': {
+        const r = await send('RIGHT_CLICK', { selector: args.selector }, tabId || this.currentTab);
+        return { success: true, tag: r.result?.tag, text: r.result?.text };
+      }
+
+      case 'keyboard': {
+        const r = await send('KEYBOARD', { key: args.key, modifiers: args.modifiers || [] }, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'go_back': {
+        const r = await send('GO_BACK', {}, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'go_forward': {
+        const r = await send('GO_FORWARD', {}, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'manage_cookies': {
+        const r = await send('COOKIES', { cmd: args.cmd, name: args.name, value: args.value, domain: args.domain }, tabId || this.currentTab);
+        return r.result;
+      }
+
+      case 'manage_storage': {
+        const r = await send('STORAGE', { cmd: args.cmd, storageType: args.storage_type || args.storageType || 'local', key: args.key, value: args.value }, tabId || this.currentTab);
+        return r.result;
+      }
+
       default:
         throw new Error(`Unknown action: ${action}`);
     }
@@ -301,8 +459,8 @@ class VenomBrowserBridgeServer {
 
   // ─── WebSocket server ────────────────────────────────────────────────────
   startWS() {
-    this.wss = new WebSocket.Server({ port: WS_PORT }, () => {
-      console.log(`[Bridge] WebSocket on ws://localhost:${WS_PORT}`);
+    this.wss = new WebSocket.Server({ host: '127.0.0.1', port: WS_PORT }, () => {
+      console.log(`[Bridge] WebSocket on ws://127.0.0.1:${WS_PORT}`);
     });
 
     this.wss.on('error', (e) => {
@@ -316,6 +474,16 @@ class VenomBrowserBridgeServer {
       const addr = req.socket.remoteAddress || 'unknown';
       console.log(`[Bridge] Extension connected from ${addr}`);
 
+      // Handshake timeout
+      ws.authTimeout = setTimeout(() => {
+        if (!ws.authenticated) {
+          console.log('[Bridge] Extension handshake timed out.');
+          ws.close(4001, 'Auth timeout');
+        }
+      }, 5000);
+
+      ws.authenticated = false;
+
       // Replace previous connection
       if (this.extensionWs && this.extensionWs.readyState === WebSocket.OPEN) {
         console.log('[Bridge] Replacing previous extension');
@@ -364,9 +532,19 @@ class VenomBrowserBridgeServer {
     }
     if (msg.type === 'hello') {
       console.log(`[Bridge] Extension handshake: ${msg.client} v${msg.version}`);
+      if (safeCompare(msg.token, WS_AUTH_TOKEN)) {
+        ws.authenticated = true;
+        clearTimeout(ws.authTimeout);
+        this.safeSend(ws, { type: 'auth_ok' });
+      } else {
+        this.safeSend(ws, { type: 'auth_fail' });
+        setTimeout(() => ws.close(4001, 'Unauthorized'), 100);
+      }
       return;
     }
 
+    if (!ws.authenticated) return; // Drop messages from unauthenticated sockets
+
     // Command response
     if (msg.id && this.pending.has(msg.id)) {
       const entry = this.pending.get(msg.id);
@@ -400,9 +578,14 @@ class VenomBrowserBridgeServer {
   }
 
   // ─── Send command to extension ───────────────────────────────────────────
-  sendToExtension(command, params = {}, tabId = null, timeoutMs = CMD_TIMEOUT) {
-    if (!this.isConnected()) {
-      return Promise.reject(new Error('Extension not connected'));
+  async sendToExtension(command, params = {}, tabId = null, timeoutMs = CMD_TIMEOUT) {
+    if (!this.isConnected() || !this.extensionWs.authenticated) {
+      console.log(`[Bridge] Extension not ready. Waiting for reconnection (max 10s)...`);
+      try {
+        await this.waitForConnection(10000);
+      } catch (err) {
+        throw err;
+      }
     }
 
     const id = uuidv4();
@@ -425,6 +608,25 @@ class VenomBrowserBridgeServer {
     });
   }
 
+  waitForConnection(timeoutMs) {
+    return new Promise((resolve, reject) => {
+      if (this.isConnected() && this.extensionWs.authenticated) return resolve();
+      
+      const checkInterval = setInterval(() => {
+        if (this.isConnected() && this.extensionWs.authenticated) {
+          clearInterval(checkInterval);
+          clearTimeout(timeoutTimer);
+          resolve();
+        }
+      }, 500);
+
+      const timeoutTimer = setTimeout(() => {
+        clearInterval(checkInterval);
+        reject(new Error('Timed out waiting for extension to connect'));
+      }, timeoutMs);
+    });
+  }
+
   rejectAll(reason) {
     for (const { reject, timer } of this.pending.values()) {
       clearTimeout(timer);
@@ -466,6 +668,7 @@ process.on('unhandledRejection', (reason) => {
 // ─── Start ────────────────────────────────────────────────────────────────
 console.log('🚀 Starting VenomBrowser Bridge Server v4.1.0...');
 const server = new VenomBrowserBridgeServer();
+server.start();
 console.log(`📡 WebSocket : ws://localhost:${WS_PORT}`);
 console.log(`🌐 HTTP API  : http://127.0.0.1:${PORT}/command`);
 console.log(`📋 Status    : http://127.0.0.1:${PORT}/status`);

package/src/connect.js

@@ -185,9 +185,17 @@ function connect() {
   const registered = [];
 
   for (const { name, path: configPath, format } of configs) {
+    // If the file doesn't exist, create it so we can auto-configure
     if (!fs.existsSync(configPath)) {
-      console.log(`   ⏭️  ${name}: config not found, skipping`);
-      continue;
+      try {
+        const dir = path.dirname(configPath);
+        if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(configPath, '{}', 'utf8');
+        console.log(`   ✨ ${name}: created missing config file`);
+      } catch (err) {
+        console.log(`   ⏭️  ${name}: could not create config (${err.message})`);
+        continue;
+      }
     }
 
     const result = format === 'mcp'

package/src/mcp-server.js

@@ -20,12 +20,15 @@ const { BrowserBridge } = require('./bridge-client');
 const { getMcpToolDefinitions, executeTool } = require('./tools/browser-tools');
 
 class VenomBrowserMcpServer {
-  constructor() {
+  constructor(options = {}) {
+    this.onBeforeCommand = options.onBeforeCommand || null;
     const host = process.env.BRIDGE_HOST || '127.0.0.1';
     const port = parseInt(process.env.BRIDGE_PORT || '10086', 10);
     const session = process.env.BRIDGE_SESSION || 'mcp-session';
 
-    this.bridge = new BrowserBridge({ host, port, session });
+    const apiKey = process.env.REST_API_KEY;
+
+    this.bridge = new BrowserBridge({ host, port, session, apiKey });
 
     this.server = new Server(
       { name: 'venombrowser', version: '4.0.0' },
@@ -45,6 +48,10 @@ class VenomBrowserMcpServer {
       const { name, arguments: args } = request.params;
 
       try {
+        if (this.onBeforeCommand) {
+          await this.onBeforeCommand(name);
+        }
+
         const result = await executeTool(this.bridge, name, args || {});
 
         // Special handling for screenshots — return as MCP image content