webhelm 1.0.24 → 1.0.26

package/README.md

@@ -39,7 +39,7 @@ The daemon-managed Chrome Extension is installed from the npm Runtime and does n
 
 The compact popup shows daemon connectivity and per-workspace capacity and Session counts, with confirmation before stopping a Session or clearing Sessions in one workspace. The popup does not include a global stop-all action. These actions are executed by the same Node daemon as the CLI, over the existing CDP-backed Extension RPC. No shell access or HTTP listener is granted to the Extension. The persistent ChatGPT queue is not deleted, and queued work may create new Sessions afterward.
 
-New installations use the default Chrome tab group `WebHelm` and the idle page `helm.html`. Idle URLs use only `workspace` and `role=idle`; Lease URLs use Chrome's actual `tabId` for initial CDP target discovery. There is no separate slot identity. Every newly created WebHelm-managed tab group (default and custom) is placed at the far right of its Chrome window. Existing groups retain their user-chosen position during restoration, legacy migration and Session allocation. Chrome-saved tab group shortcuts in the bookmarks bar are separate from active groups and cannot safely be deduplicated through the Extension API. Legacy `Harness` default groups migrate only when their tabs are idle. Custom workspace names are unchanged; the old `workspace.html` path and lease titles remain readable until their Sessions finish. Closing an allocated Session returns its managed tabs to the idle page, retaining physical Chrome targets, while unleased popup children are closed. Do not manually remove active managed tabs.
+New installations use the default Chrome tab group `WebHelm` and the idle page `helm.html`. Idle URLs use only `workspace` and `role=idle`; Lease URLs use Chrome's actual `tabId` for initial CDP target discovery. There is no separate slot identity. Every newly created WebHelm-managed tab group (default and custom) is placed at the far left of its Chrome window, immediately after pinned tabs. Existing groups retain their user-chosen position during restoration, legacy migration and Session allocation. Chrome-saved tab group shortcuts in the bookmarks bar are separate from active groups and cannot safely be deduplicated through the Extension API. Legacy `Harness` default groups migrate only when their tabs are idle. Custom workspace names are unchanged; the old `workspace.html` path and lease titles remain readable until their Sessions finish. Closing an allocated Session returns its managed tabs to the idle page, retaining physical Chrome targets, while unleased popup children are closed. Do not manually remove active managed tabs.
 
 For a real browser integration check on macOS, run `node test/e2e/extension-control.e2e.mjs`; it creates a temporary isolated Chrome profile and daemon and does not touch the current production Sessions.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webhelm",
-  "version": "1.0.24",
+  "version": "1.0.26",
   "description": "Agent browser automation in a visible managed Chrome with persistent JavaScript sessions",
   "type": "module",
   "bin": {

package/runtime/chatgpt/attachment-upload.mjs

@@ -0,0 +1,35 @@
+// Browser-side upload source for the existing WebHelm owned Session.
+// Pure string generation; JSON encoding protects filenames and selector quotes.
+const SELECTOR_JS = "(() => ['#upload-files','#upload-media','input[name=\"upload-media\"]','input[type=\"file\"]'].find(s=>document.querySelector(s))||null)()";
+const OPEN_JS = "(() => {const b=[...document.querySelectorAll('button')].find(b=>(b.getAttribute('aria-label')||'').trim()==='Add files and more');if(b)b.click();return !!b;})()";
+const STATE_JS = "(() => ({names:[...document.querySelectorAll('button[aria-label^=\"Remove \"]')].map(b=>(b.getAttribute('aria-label')||'').replace(/^Remove file\\s+\\d+:\\s*/,'').replace(/^Remove\\s+/,'')),pending:[...document.querySelectorAll('[role=\"progressbar\"],[aria-busy=\"true\"],[data-state=\"loading\"]')].some(e=>e.getClientRects().length>0)}))()";
+
+export function attachmentUploadScript(paths) {
+  if (!Array.isArray(paths) || !paths.length) return "({ready:true})";
+  return [
+    "return await (async()=>{",
+    "const files="+JSON.stringify(paths)+";",
+    "const locate=()=>js("+JSON.stringify(SELECTOR_JS)+");",
+    "let input=await locate();",
+    "if(!input){",
+    " await js("+JSON.stringify(OPEN_JS)+");",
+    " for(let i=0;i<40&&!input;i++){await sleep(150);input=await locate();}",
+    "}",
+    "if(!input)throw Error('ChatGPT file input unavailable');",
+    "const names=[];",
+    "for(const file of files){",
+    " await upload_file(input,file);",
+    " const name=file.split('/').pop();names.push(name);",
+    " const expected=names.filter(n=>n===name).length;",
+    " let ready=false;",
+    " for(let i=0;i<480;i++){",
+    "  const state=await js("+JSON.stringify(STATE_JS)+");",
+    "  if(!state.pending&&state.names.filter(n=>n===name).length>=expected){ready=true;break;}",
+    "  await sleep(250);",
+    " }",
+    " if(!ready)throw Error('ChatGPT attachment upload not confirmed: '+name);",
+    "}",
+    "return {ready:true,names};",
+    "})()",
+  ].join("\n");
+}

package/runtime/chatgpt/chatgpt-probe.mjs

@@ -2,22 +2,26 @@ export function targetUrl(projectId, threadId, message) {
   if (!threadId || !message) {
     throw new Error("thread_id and message are required");
   }
-  const prefix = projectId ? `/g/${encodeURIComponent(projectId)}` : "";
-  return `https://chatgpt.com${prefix}/c/${
-    encodeURIComponent(threadId)
-  }?${new URLSearchParams({ prompt: message })}`;
+  // A thread identity is global; ChatGPT may redirect /c/id to a
+  // Project-scoped /g/project-id[-slug]/c/id. Use the ordinary URL.
+  return "https://chatgpt.com/c/" + encodeURIComponent(threadId) +
+    "?" + new URLSearchParams({ prompt: message });
 }
 export const PROBE_JS =
   `(() => { const visible=e=>!!e&&!!e.getClientRects().length&&getComputedStyle(e).visibility!=='hidden'; const body=(document.body?.innerText||'').toLowerCase(); if(body.includes('could not load this chatgpt conversation'))return {state:'BLOCKED',error:'thread_load_failed'}; if(body.includes('log in to chatgpt')||body.includes('sign in to chatgpt'))return {state:'BLOCKED',error:'authentication_required'}; const stop=[...document.querySelectorAll('button')].some(b=>{if(!visible(b))return false;const l=(b.getAttribute('aria-label')||'').trim().toLowerCase(),t=(b.getAttribute('title')||'').trim().toLowerCase(),d=(b.getAttribute('data-testid')||'').trim().toLowerCase();return ['stop generating','stop answering','stop response','stop'].includes(l)||['stop generating','stop answering'].includes(t)||['stop-button','stop-generating-button'].includes(d)}); if(stop)return {state:'RUNNING',stop_visible:true}; const e=document.querySelector('#prompt-textarea,[contenteditable="true"][data-lexical-editor="true"],[role="textbox"][contenteditable="true"],textarea'); const editable=e?.getAttribute?.('contenteditable')==='true'; return {state:visible(e)?'READY':'NOT_READY',stop_visible:false,composer_text:e?(editable?(e.textContent||''):(e.value||e.textContent||e.innerText||'')):''}; })()`;
 export function classifyProbe(observedUrl, expectedUrl, state) {
   const actual = new URL(observedUrl), expected = new URL(expectedUrl);
-  if (
-    actual.protocol !== "https:" || actual.host !== "chatgpt.com" ||
-    actual.pathname.replace(/\/$/, "") !== expected.pathname.replace(/\/$/, "")
-  ) return "BLOCKED";
+  const thread = url => {
+    const match = url.pathname.split('/c/')[1]?.split('/')[0] || null;
+    return match ? decodeURIComponent(match) : null;
+  };
+  if (actual.protocol !== "https:" || actual.host !== "chatgpt.com" ||
+      !thread(actual) || thread(actual) !== thread(expected)) return "BLOCKED";
   if (["RUNNING", "BLOCKED"].includes(state?.state)) return state.state;
-  if (actual.search) return "NOT_READY";
-  return state?.state === "READY" && String(state.composer_text || "").trim()
+  const prompt = expected.searchParams.get("prompt") || "";
+  const normalize = text => String(text || "").replace(/\s+/g, " ").trim();
+  if (actual.search && actual.searchParams.get("prompt") !== prompt) return "NOT_READY";
+  return state?.state === "READY" && normalize(state.composer_text) === normalize(prompt)
     ? "READY"
     : "NOT_READY";
 }

package/runtime/chatgpt/chatgpt-queue.mjs

@@ -1,9 +1,11 @@
 import { DatabaseSync } from "node:sqlite";
-import { mkdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { mkdirSync, existsSync, statSync } from "node:fs";
+import { join, resolve, isAbsolute } from "node:path";
+import { attachmentUploadScript } from "./attachment-upload.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { classifyProbe, PROBE_JS, targetUrl } from "./chatgpt-probe.mjs";
-import { CLICK_SEND_JS, SEND_ENABLED_JS } from "./lifecycle-common.mjs";
+import { SEND_ENABLED_JS } from "./lifecycle-common.mjs";
+import { submissionScript } from "./submission-script.mjs";
 import { DurableQueueCore } from "../durable-queue-core.mjs";
 
 const transitions = new Set([
@@ -23,19 +25,26 @@ const chatgptQueuePolicy = {
   one(db, sql, ...args) { return db.prepare(sql).get(...args) || null; },
   rows(db) { return db.prepare("SELECT * FROM turns ORDER BY seq").all(); },
   enqueue(db, request = {}, now) {
-    const {thread_id, message, idempotency_key, idempotencyKey, project_id=null, mergeable=false} = request;
+    const {thread_id, message, idempotency_key, idempotencyKey, project_id=null, mergeable=false, file=[]} = request;
+    if (!Array.isArray(file) || file.length > 4 ||
+        file.some(p => typeof p !== "string" || !isAbsolute(p) ||
+          !existsSync(p) || !statSync(p).isFile())) {
+      throw new TypeError("file must contain at most 4 existing absolute file paths");
+    }
+    if (file.length && mergeable) throw new TypeError("attachment turns cannot merge");
+    const filesJson = JSON.stringify(file);
     const key=idempotency_key ?? idempotencyKey;
-    if (!thread_id || !message || !key) throw new TypeError("thread_id, message, idempotency_key required");
+    if (!thread_id || (!message && !file.length) || !key) throw new TypeError("thread_id, message, idempotency_key required");
     if (typeof mergeable !== "boolean") throw new TypeError("mergeable must be a boolean");
     const merged=this.one(db, "SELECT * FROM merged_requests WHERE idem_key=?", key);
     if (merged) {
-      if (merged.thread_id!==thread_id || merged.message!==message || merged.project_id!==project_id) throw new Error("idempotency key reused with different payload");
+      if (merged.thread_id!==thread_id || merged.message!==message || merged.project_id!==project_id || filesJson!=="[]") throw new Error("idempotency key reused with different payload");
       const row=this.one(db, "SELECT * FROM turns WHERE id=?", merged.queue_id);
       return {ok:true,status:"queued",queue_id:row.id,thread_id:row.thread_id,state:row.state};
     }
     const same=this.one(db, "SELECT * FROM turns WHERE idem_key=?", key);
     if (same) {
-      if (same.thread_id!==thread_id || same.message!==message || same.project_id!==project_id) throw new Error("idempotency key reused with different payload");
+      if (same.thread_id!==thread_id || same.message!==message || same.project_id!==project_id || (same.files_json||"[]")!==filesJson) throw new Error("idempotency key reused with different payload");
       return {ok:true,status:"queued",queue_id:same.id,thread_id:same.thread_id,state:same.state};
     }
     const tail=mergeable ? this.one(db, "SELECT * FROM turns WHERE thread_id=? ORDER BY seq DESC LIMIT 1", thread_id) : null;
@@ -49,7 +58,7 @@ const chatgptQueuePolicy = {
       return {ok:true,status:"queued",queue_id:row.id,thread_id:row.thread_id,state:row.state};
     }
     const id=randomUUID();
-    db.prepare("INSERT INTO turns(id,idem_key,project_id,thread_id,message,state,next_check_at,created_at,mergeable) VALUES(?,?,?,?,?,'QUEUED',?,?,?)").run(id,key,project_id,thread_id,message,now,now,mergeable?1:0);
+    db.prepare("INSERT INTO turns(id,idem_key,project_id,thread_id,message,state,next_check_at,created_at,mergeable,files_json) VALUES(?,?,?,?,?,'QUEUED',?,?,?,?)").run(id,key,project_id,thread_id,message,now,now,mergeable?1:0,filesJson);
     return {ok:true,status:"queued",queue_id:id,thread_id,state:"QUEUED"};
   },
   claim(db, owner, now, leaseSeconds) {
@@ -115,6 +124,9 @@ export class ChatGPTQueue extends DurableQueueCore {
     db.exec(
       `CREATE TABLE IF NOT EXISTS turns(seq INTEGER PRIMARY KEY AUTOINCREMENT,id TEXT NOT NULL UNIQUE,idem_key TEXT NOT NULL UNIQUE,project_id TEXT,thread_id TEXT NOT NULL,message TEXT NOT NULL,state TEXT NOT NULL,lease_owner TEXT,lease_until REAL,next_check_at REAL NOT NULL,created_at REAL NOT NULL,attempts INTEGER NOT NULL DEFAULT 0,receipt TEXT,mergeable INTEGER NOT NULL DEFAULT 0); CREATE INDEX IF NOT EXISTS turns_thread_order ON turns(thread_id,seq); CREATE TABLE IF NOT EXISTS merged_requests(idem_key TEXT PRIMARY KEY,project_id TEXT,thread_id TEXT NOT NULL,message TEXT NOT NULL,queue_id TEXT NOT NULL);`,
     );
+    if (!db.prepare("PRAGMA table_info(turns)").all().some(row => row.name === "files_json")) {
+      db.exec("ALTER TABLE turns ADD COLUMN files_json TEXT NOT NULL DEFAULT '[]'");
+    }
     super(db, chatgptQueuePolicy, now, {
       concurrency: Math.min(4, Math.max(1, Number(concurrency) || 4)), intervalMs,
     });
@@ -211,7 +223,7 @@ export class ChatGPTQueue extends DurableQueueCore {
     let state = "NOT_READY";
     while (Date.now() < deadline) {
       const source =
-        `await (async()=>{ const page=await page_info(); const state=await js(${
+        `return await (async()=>{ const page=await page_info(); const state=await js(${
           JSON.stringify(PROBE_JS)
         }); if(state?.state==='READY' && !(await js(${
           JSON.stringify(SEND_ENABLED_JS)
@@ -226,20 +238,12 @@ export class ChatGPTQueue extends DurableQueueCore {
   async _send(item) {
     const sid = this.sessions.get(item.id);
     if (!sid) throw new Error("missing prepared browser session");
-    const expected =
-      targetUrl(item.project_id, item.thread_id, item.message).split("?")[0];
-    const source = `await (async()=>{ const gate=await js(${
-      JSON.stringify(PROBE_JS)
-    }); const gateUrl=(await page_info()).url||''; let receipt={diagnostic:'pre_send_gate_not_ready'}; if(gate?.state==='READY' && await js(${
-      JSON.stringify(SEND_ENABLED_JS)
-    }) && Boolean((gate.composer_text||'').trim()) && gateUrl===${
-      JSON.stringify(expected)
-    } && await js(${
-      JSON.stringify(CLICK_SEND_JS)
-    })){ const until=Date.now()+30000; let disabled=false; while(Date.now()<until){ disabled=!(await js(${
-      JSON.stringify(SEND_ENABLED_JS)
-    })); if(disabled) break; await new Promise(resolve=>setTimeout(resolve,200)); } receipt=disabled?{verified_by:'send-button-disabled'}:{diagnostic:'post_submit_send_state_unverified'}; } return receipt; })()`;
-    return this._exec(sid, source);
+    const attachments = JSON.parse(item.files_json || "[]");
+    if (attachments.length) {
+      const upload = await this._exec(sid, attachmentUploadScript(attachments));
+      if (!upload?.ready) throw new Error("ChatGPT attachments not ready for Send");
+    }
+    return this._exec(sid, submissionScript(item));
   }
   async _finish(id) {
     const sid = this.sessions.get(id);
@@ -293,7 +297,7 @@ export class ChatGPTQueue extends DurableQueueCore {
       }
       this.transition(item.id, owner, "CHECKING", "SENDING");
       const receipt = await this._send(item);
-      if (receipt?.verified_by !== "send-button-disabled") {
+      if (!["send-button-disabled", "user-turn"].includes(receipt?.verified_by)) {
         this.transition(item.id, owner, "SENDING", "UNCERTAIN", {
           receipt: receipt?.diagnostic || "missing_user_turn_receipt",
         });

package/runtime/chatgpt/submission-script.mjs

@@ -0,0 +1,37 @@
+import { PROBE_JS } from "./chatgpt-probe.mjs";
+import { SEND_ENABLED_JS } from "./lifecycle-common.mjs";
+
+/** Source executed inside a caller-owned WebHelm Session, never a separate tab. */
+export function submissionScript(item) {
+  const prompt = item.message.slice(0, 120);
+  const selectorJS = "(() => {for(const s of ['button[aria-label=\"Send\"]','button[data-testid=\"send-button\"]','button[aria-label=\"Send prompt\"]']){const b=document.querySelector(s);if(b&&b.getClientRects().length&&!b.disabled)return s;}return null;})()";
+  const userTurnsJS = "(() => [...document.querySelectorAll('h4[data-conversation-role=\"user\"]')].filter(h=>(h.parentElement?.innerText||'').includes(" +
+    JSON.stringify(prompt) + ")).length)()";
+  return [
+    "return await (async()=>{",
+    "const gate=await js("+JSON.stringify(PROBE_JS)+");",
+    "const url=new URL((await page_info()).url);",
+    "const actualId=url.pathname.split('/c/')[1]?.split('/')[0]||'';",
+    "if(decodeURIComponent(actualId)!=="+JSON.stringify(item.thread_id)+
+      ")return {diagnostic:'thread_redirect_mismatch'};",
+    "if(gate?.state!=='READY'||!(await js("+JSON.stringify(SEND_ENABLED_JS)+")))",
+    "  return {diagnostic:'pre_send_gate_not_ready'};",
+    "if((gate.composer_text||'').replace(/\\s+/g,' ').trim()!=="+
+      JSON.stringify(item.message.replace(/\s+/g,' ').trim())+")",
+
+    "  return {diagnostic:'pre_send_gate_not_ready'};",
+    "const selector=await js("+JSON.stringify(selectorJS)+");",
+    "if(!selector)return {diagnostic:'send_control_not_found'};",
+    "const before=(await js("+JSON.stringify(userTurnsJS)+"))||0;",
+    "await click(selector);",
+    "for(let i=0;i<140;i++){",
+    " const count=(await js("+JSON.stringify(userTurnsJS)+"))||0;",
+    " if(count>before)return {verified_by:'user-turn'};",
+    " if(!(await js("+JSON.stringify(SEND_ENABLED_JS)+")))",
+    "   return {verified_by:'send-button-disabled'};",
+    " await sleep(250);",
+    "}",
+    "return {diagnostic:'post_submit_user_turn_not_confirmed_no_resend'};",
+    "})()",
+  ].join("\n");
+}

package/runtime/cli.mjs

@@ -58,7 +58,8 @@ async function runPlatform(args) {
   if (sid && auto) throw Error('--session-id and --auto-session are mutually exclusive');
   if (platform === 'chatgpt' && action === 'new-turn' && mode === 'async') {
     if (sid || auto) throw Error('async new-turn cannot use browser session options');
-    if (!config.thread_id || !config.message) throw Error('thread_id and message required');
+    if (!config.thread_id || (!config.message && !config.file?.length)) throw Error('thread_id and message or file required');
+    if (config.file !== undefined && (!Array.isArray(config.file) || config.file.length > 4 || config.file.some(f => typeof f !== 'string' || !path.isAbsolute(f) || !fs.existsSync(f)))) throw Error('file must contain at most 4 existing absolute paths');
     if (typeof config.mergeable !== 'undefined' && typeof config.mergeable !== 'boolean') throw Error('mergeable must be a boolean');
     const receipt = await request({op:'chatgpt-new-turn-enqueue', config: {...config, idempotency_key: config.idempotency_key || randomUUID(), mode}});
     if (!receipt.ok || !receipt.queue_id || receipt.thread_id !== String(config.thread_id)) throw Error('ChatGPT queue returned an invalid acceptance receipt');

package/runtime/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "WebHelm",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Own named Chrome tab-group workspaces and lazy reusable tab pools for browser agents.",
   "permissions": [
     "storage",

package/runtime/extension/workspace-manager.mjs

@@ -242,10 +242,14 @@ export class WorkspaceManager {
     return await this.chrome.tabs.query({ groupId });
   }
 
-  // New groups belong at the right edge, regardless of Chrome's new-tab
-  // insertion policy. Never reorder existing groups on restore or lease.
-  async positionNewGroupRightmost(groupId) {
-    await this.chrome.tabGroups.move(groupId, { index: -1 });
+  // New groups belong immediately after pinned tabs, regardless of Chrome's
+  // insertion policy. Existing groups keep their order on restore and lease.
+  async positionNewGroupLeftmost(groupId) {
+    const groupTabs = await this.groupTabs(groupId);
+    if (!groupTabs.length) return;
+    const windowTabs = await this.chrome.tabs.query({ windowId: groupTabs[0].windowId });
+    const firstUnpinned = windowTabs.filter(tab => tab.pinned).length;
+    await this.chrome.tabGroups.move(groupId, { index: firstUnpinned });
   }
 
   tabUrl(tab) {
@@ -497,7 +501,7 @@ export class WorkspaceManager {
     for (const tab of created) this.markOwned(tab.id);
     const groupId = await this.chrome.tabs.group({ tabIds: created.map((tab) => tab.id) });
     await this.chrome.tabGroups.update(groupId, { title: name, collapsed: true });
-    await this.positionNewGroupRightmost(groupId);
+    await this.positionNewGroupLeftmost(groupId);
     for (const tab of created) await this.waitForIdleTab(tab.id, name);
     return await this.status(name);
   }