wb-browser-runtime 0.5.1 → 0.5.3

package/README.md

@@ -25,9 +25,12 @@ specific run.
 - `BROWSERBASE_API_KEY`
 - `BROWSERBASE_PROJECT_ID`
 
-Verb arguments support `{{ env.NAME }}` substitution at dispatch time, so any
-secrets your runbook needs (e.g. `HACKERNEWS_PASSWORD`) get pulled from the
-sidecar process env without ever appearing on stdout.
+Verb arguments support two substitutions at dispatch time:
+
+- `{{ env.NAME }}` — reads `process.env.NAME`. Use for static secrets injected via Doppler / the agent's env.
+- `{{ artifacts.NAME }}` — reads `$WB_ARTIFACTS_DIR/NAME.txt` (falling back to `$WB_ARTIFACTS_DIR/NAME`). Use for dynamic values produced by an earlier bash cell — OTPs, magic-link URLs, export IDs, anything polled from an external system mid-run. Each read happens per-verb with no caching, so writes land immediately.
+
+Both forms are redacted in stdout summaries — only the verb name + selector make it into the log.
 
 ## Optional: anti-detection
 

package/bin/wb-browser-runtime.js

@@ -14,9 +14,13 @@
 //   BROWSERBASE_API_KEY
 //   BROWSERBASE_PROJECT_ID
 //
-// Verb args support `{{ env.NAME }}` substitution, expanded recursively
-// against process.env at dispatch time. Credentials passed this way never
-// hit stdout — only the verb name + selector make it into the summary.
+// Verb args support two substitutions, expanded recursively at dispatch time:
+//   {{ env.NAME }}        → process.env.NAME
+//   {{ artifacts.NAME }}  → contents of $WB_ARTIFACTS_DIR/NAME.txt (or .../NAME)
+// The artifacts form lets an earlier bash cell compute a value — OTP, magic
+// link, export id — and feed it into a later browser verb without a sidecar
+// round-trip. Credentials passed via either form never hit stdout — only the
+// verb name + selector make it into the summary.
 
 import readline from "node:readline";
 import { chromium } from "playwright-core";
@@ -45,7 +49,7 @@ const SUPPORTS = [
 ];
 
 const BB_BASE = "https://api.browserbase.com";
-const VERSION = "0.5.0";
+const VERSION = "0.5.3";
 
 // --- Recording config -------------------------------------------------------
 //
@@ -576,22 +580,44 @@ function sanitize(s) {
   return String(s || "default").replace(/[^A-Za-z0-9_-]+/g, "_");
 }
 
-// --- {{ env.X }} substitution ----------------------------------------------
+// --- {{ env.X }} / {{ artifacts.X }} substitution --------------------------
 
 const ENV_RE = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+const ARTIFACT_RE = /\{\{\s*artifacts\.([A-Za-z_][A-Za-z0-9_.-]*)\s*\}\}/g;
+
+function readArtifact(name) {
+  const dir = (process.env.WB_ARTIFACTS_DIR || "").trim();
+  if (!dir) {
+    log(`[warn] artifacts.${name} referenced but WB_ARTIFACTS_DIR is not set`);
+    return "";
+  }
+  // Per-verb read (no cache) so a bash cell that writes the artifact between
+  // slices is always picked up by the next browser verb.
+  for (const p of [path.join(dir, `${name}.txt`), path.join(dir, name)]) {
+    try {
+      return readFileSync(p, "utf8").trimEnd();
+    } catch {
+      // try next candidate
+    }
+  }
+  log(`[warn] artifact ${name} not found in ${dir}; leaving placeholder`);
+  return "";
+}
 
 function expand(value) {
   if (typeof value === "string") {
-    return value.replace(ENV_RE, (_, name) => {
-      const v = process.env[name];
-      if (v === undefined) {
-        // Leave the placeholder visible so failures surface in stderr summaries
-        // instead of silently turning into empty strings.
-        log(`[warn] env var ${name} is not set; leaving placeholder`);
-        return "";
-      }
-      return v;
-    });
+    return value
+      .replace(ENV_RE, (_, name) => {
+        const v = process.env[name];
+        if (v === undefined) {
+          // Leave the placeholder visible so failures surface in stderr
+          // summaries instead of silently turning into empty strings.
+          log(`[warn] env var ${name} is not set; leaving placeholder`);
+          return "";
+        }
+        return v;
+      })
+      .replace(ARTIFACT_RE, (_, name) => readArtifact(name));
   }
   if (Array.isArray(value)) return value.map(expand);
   if (value && typeof value === "object") {
@@ -656,9 +682,16 @@ async function runVerb(page, verb, index, ctx) {
       return `${selector} (${state})`;
     }
     case "screenshot": {
-      const path = a.path ?? `screenshot-${Date.now()}.png`;
-      await page.screenshot({ path, fullPage: !!a.full_page });
-      return `→ ${path}`;
+      // Relative paths resolve into $WB_ARTIFACTS_DIR so wb's main-loop
+      // `artifacts.sync()` picks them up and uploads to R2. Absolute paths
+      // are respected as-is (escape hatch for one-off local dumps).
+      const requested = a.path ?? `screenshot-${Date.now()}.png`;
+      const artifactsDir = (process.env.WB_ARTIFACTS_DIR || "").trim();
+      const full = path.isAbsolute(requested)
+        ? requested
+        : path.join(artifactsDir || ".", requested);
+      await page.screenshot({ path: full, fullPage: !!a.full_page });
+      return `→ ${requested}`;
     }
     case "extract": {
       // Pull structured rows out of the page. Each `field` entry is either:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wb-browser-runtime",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Browser sidecar runtime for wb — Browserbase + Playwright over the wb-sidecar/1 line-framed JSON protocol.",
   "bin": {
     "wb-browser-runtime": "bin/wb-browser-runtime.js"