ai-browser-toolkit 0.1.2__tar.gz

ai_browser_toolkit-0.1.2/.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git -C \"C:/Users/Dipto.SHAHARIARDIPTO/Documents/GitHub/aibrowsertoolkit\" log --oneline -10)",
+      "Bash(curl *)"
+    ]
+  }
+}

ai_browser_toolkit-0.1.2/.gitattributes

@@ -0,0 +1,9 @@
+# Line endings are load-bearing for the start scripts.
+#
+# This repo is developed on Windows with core.autocrlf=true, which would hand a
+# CRLF start-server.sh to anyone cloning on Linux or macOS -- where bash reads
+# the trailing \r as part of the command and every line fails. Pin each script
+# to the endings its interpreter needs, whatever the cloning machine prefers.
+* text=auto
+*.sh text eol=lf
+*.bat text eol=crlf

ai_browser_toolkit-0.1.2/.github/workflows/check-secrets.yml

@@ -0,0 +1,51 @@
+name: Check secrets
+
+# Answers one question definitively: which secrets can a workflow in this
+# repository actually see? An empty secret is not an error in Actions -- it
+# interpolates as nothing, and the tool downstream reports it as bad
+# credentials, which sends you looking in the wrong place. Every publisher
+# failure on v0.1.1 read that way.
+#
+# Prints only set/empty and a length. Never a value, so the log is safe to
+# paste anywhere.
+#
+# Worth knowing: Settings -> Secrets and variables has three separate stores
+# -- Actions, Dependabot and Codespaces. They look identical in the UI and
+# only the Actions one is visible here. Secrets attached to an *environment*
+# are also invisible to any job that does not declare that environment.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Report which secrets are visible
+        env:
+          TAP_TOKEN: ${{ secrets.TAP_TOKEN }}
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
+          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
+        run: |
+          for name in TAP_TOKEN WINGET_TOKEN AUR_SSH_KEY FURY_TOKEN; do
+            value="${!name}"
+            if [ -z "$value" ]; then
+              echo "$name: EMPTY -- not visible to Actions in this repository"
+            else
+              echo "$name: set, ${#value} characters"
+            fi
+          done
+
+      - name: Sanity-check the shapes
+        env:
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
+        run: |
+          # The most common AUR mistake is pasting the .pub half, which fails
+          # later with an unhelpful permission error rather than here.
+          case "$AUR_SSH_KEY" in
+            "") echo "AUR_SSH_KEY: empty, nothing to check" ;;
+            ssh-*) echo "AUR_SSH_KEY: looks like a PUBLIC key -- the private half is wanted" ; exit 1 ;;
+            *"BEGIN OPENSSH PRIVATE KEY"*) echo "AUR_SSH_KEY: looks like a private key" ;;
+            *) echo "AUR_SSH_KEY: set, but not in a shape I recognise" ;;
+          esac

ai_browser_toolkit-0.1.2/.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-latest, macos-14]
+        python: ["3.11", "3.13"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Deliberately not astral-sh/setup-uv here. uv is what the *bundle*
+      # build needs -- it knows how to fetch python-build-standalone -- but in
+      # a test job it introduces a second interpreter: setup-uv with a
+      # python-version creates and activates .venv, while `uv pip install
+      # --system` installs somewhere else, and the test step then reports
+      # "No module named pytest". One interpreter, named explicitly, end to
+      # end.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+
+      - name: Show what this machine has
+        # Dogfooding the dependency check, and the fastest way to read a
+        # browser-related failure below. Never fatal: doctor exits non-zero
+        # when no browser is present, which is information, not a broken job.
+        run: python -m abt doctor || true
+
+      - name: Test
+        # The live tests need a real browser on a real profile; everything
+        # else runs anywhere.
+        env:
+          # This runner is several times slower than a developer machine, and
+          # it blew a different budget each run: first a click timeout
+          # ("ElementHandle.click: Timeout 3000ms exceeded", already at
+          # "performing click action" -- slow, not stuck), then a settle grace
+          # that called a page idle mid-fetch and snapshotted the spinner.
+          # One multiplier scales them together rather than chasing each.
+          # Not a retry: a retry would hide a genuine hang just as well.
+          ABT_TEST_SLOWDOWN: "5"
+        run: >
+          python -m pytest -q
+          --deselect tests/test_lifecycle_live.py
+          --deselect tests/test_shots_live.py

ai_browser_toolkit-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,448 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build and smoke-test everything, publish nothing"
+        type: boolean
+        default: true
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -e ".[dev]"
+      - env:
+          # Same multiplier as ci.yml. A release must not fail on a budget
+          # that only a loaded runner blows.
+          ABT_TEST_SLOWDOWN: "5"
+        run: >
+          python -m pytest -q
+          --deselect tests/test_lifecycle_live.py
+          --deselect tests/test_shots_live.py
+
+  wheel:
+    needs: test
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Read the version from pyproject
+        id: v
+        run: |
+          version=$(python -c "import tomllib,pathlib;print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "pyproject says $version"
+
+      - name: Guard the tag against the version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          if [ "$tag" != "${{ steps.v.outputs.version }}" ]; then
+            echo "tag $GITHUB_REF_NAME does not match pyproject version ${{ steps.v.outputs.version }}"
+            echo "bump pyproject.toml first, commit, then tag -- never the reverse."
+            exit 1
+          fi
+
+      - name: Build wheel and sdist
+        run: |
+          python -m pip install build
+          python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  bundle:
+    needs: wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: linux-x86_64
+            os: ubuntu-24.04
+          - target: linux-aarch64
+            os: ubuntu-24.04-arm
+          - target: macos-arm64
+            os: macos-14
+          # macos-x86_64 is deliberately absent. macos-13 is GitHub's last
+          # Intel image and is being retired, so it queues badly and held up
+          # every release behind it. bundle.py still knows the target, so an
+          # Intel Mac can build one locally; nothing ships it automatically.
+          # The Homebrew formula is arm64-only as a result -- see
+          # docs/packaging.md.
+          - target: windows-x86_64
+            os: windows-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # setup-python runs bundle.py; setup-uv supplies the `uv` binary the
+      # builder shells out to. Deliberately kept apart: setup-uv given a
+      # python-version creates and activates its own .venv, and then two
+      # interpreters disagree about what is installed.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Build the bundle
+        shell: bash
+        run: |
+          wheel=$(ls dist/*.whl)
+          python packaging/bundle.py \
+            --version "${{ needs.wheel.outputs.version }}" \
+            --target "${{ matrix.target }}" \
+            --wheel "$wheel" \
+            --dest dist/
+
+      - name: Smoke test
+        shell: bash
+        run: |
+          bash packaging/smoke.sh \
+            "dist/aibrowsertoolkit-${{ needs.wheel.outputs.version }}-${{ matrix.target }}"
+
+      # Named exactly, not globbed. `python -m build` puts an sdist .tar.gz in
+      # dist/ too, and this job downloads it -- so `dist/*.tar.gz` would sweep
+      # the sdist into all four Unix bundle artifacts, and the release job
+      # would then publish it five times over.
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bundle-${{ matrix.target }}
+          if-no-files-found: error
+          path: |
+            dist/aibrowsertoolkit-${{ needs.wheel.outputs.version }}-${{ matrix.target }}.tar.gz
+            dist/aibrowsertoolkit-${{ needs.wheel.outputs.version }}-${{ matrix.target }}.zip
+
+      # Built here rather than in a job of its own. GitHub Actions cannot
+      # depend on a single matrix cell, so `needs: bundle` waits for all five
+      # -- which left the Windows installer blocked behind the macOS builds
+      # despite consuming only the Windows tree. Inside the cell it is ready
+      # the moment Windows is.
+      #
+      # No unzip step either: bundle.py leaves the unpacked tree beside the
+      # archive, so Inno points straight at it.
+      - name: Compile the installer
+        if: matrix.target == 'windows-x86_64'
+        shell: bash
+        env:
+          # `shell: bash` on a Windows runner is Git Bash, which rewrites any
+          # argument beginning with `/` into a Windows path. That turns
+          # ISCC's own switches -- /DAppVersion, /DPayloadDir, /O -- into
+          # filenames, and it fails with the wonderfully misleading "You may
+          # not specify more than one script filename". Found by compiling
+          # locally in Git Bash, which reproduces the runner exactly.
+          MSYS2_ARG_CONV_EXCL: "*"
+        run: |
+          # Forward slashes throughout: Win32 accepts them, and cmd-style
+          # backslashes in YAML are a quoting trap for no benefit.
+          iscc="/c/Program Files (x86)/Inno Setup 6/ISCC.exe"
+          if [ ! -x "$iscc" ]; then iscc=$(command -v iscc || true); fi
+          if [ -z "$iscc" ]; then echo "Inno Setup not found on this runner"; exit 1; fi
+          root=$(pwd -W)
+          tree="$root/dist/aibrowsertoolkit-${{ needs.wheel.outputs.version }}-windows-x86_64"
+          "$iscc" "/DAppVersion=${{ needs.wheel.outputs.version }}" "/DPayloadDir=$tree" "/O$root/out" packaging/windows/abt.iss
+
+      - name: Upload the installer
+        if: matrix.target == 'windows-x86_64'
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer
+          if-no-files-found: error
+          path: out/*.exe
+
+  release:
+    needs: [wheel, bundle]
+    # Both halves matter. The ref check keeps a branch dispatch from
+    # publishing; the dry_run check keeps a *tag* dispatch from publishing
+    # when the person running it asked for a rehearsal. Without the second,
+    # the input would be decorative and the surprise would be a real release.
+    if: startsWith(github.ref, 'refs/tags/') && github.event.inputs.dry_run != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: staging
+
+      - name: Collect every artifact into one directory
+        run: |
+          set -eu
+          mkdir -p out
+          find staging -type f \( -name '*.tar.gz' -o -name '*.zip' \
+            -o -name '*.whl' -o -name '*.exe' \) -exec cp -n {} out/ \;
+          ls -l out
+          # Four bundles + wheel + sdist + installer. A missing one means a job
+          # was skipped, and shipping a partial release is worse than failing
+          # here -- the publishers downstream would each pin a URL that never
+          # gets an asset.
+          count=$(ls out | wc -l)
+          if [ "$count" -lt 7 ]; then
+            echo "expected at least 7 artifacts, found $count"
+            exit 1
+          fi
+
+      - name: Checksums
+        # Generated before the attestation so checksums.txt is itself attested.
+        run: cd out && sha256sum * > checksums.txt && cat checksums.txt
+
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: "out/*"
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: out/*
+          generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') }}
+
+  pypi:
+    needs: release
+    if: startsWith(github.ref, 'refs/tags/') && github.event.inputs.dry_run != 'true'
+    runs-on: ubuntu-24.04
+    # Trusted Publishing: no API token is stored anywhere. The environment
+    # name and workflow filename below must match the pending publisher
+    # registered on PyPI exactly, or this fails with "not a trusted
+    # publisher" -- and that can only be found by releasing, which is what
+    # the dry_run input exists to avoid doing twice.
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  # ---------------------------------------------------------------------
+  # Publishers. Independent by design: each reads the finished release, so
+  # one failing channel leaves the other five shipped and the fix is a
+  # re-run of a single job rather than of the release.
+  # ---------------------------------------------------------------------
+
+  winget:
+    needs: [wheel, release]
+    # Release candidates are excluded: the winget community repository does
+    # not want them.
+    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-rc')
+    runs-on: ubuntu-24.04
+    # winget-releaser only *updates* an identifier that already exists in
+    # microsoft/winget-pkgs; it cannot create one. Until the first version is
+    # submitted by hand with `wingetcreate new`, this fails with "Package
+    # skssmd.AIBrowserToolkit does not exist in the winget-pkgs repository".
+    #
+    # Non-fatal so one manual prerequisite does not colour every release red.
+    # REMOVE THIS LINE once the package exists upstream -- leaving it there
+    # would hide a genuine winget failure later.
+    continue-on-error: true
+    steps:
+      # Reads the finished release and derives the three manifests from the
+      # installer asset. WINGET_TOKEN must be a *classic* PAT with
+      # public_repo -- this action does not work with fine-grained tokens.
+      - uses: vedantmgoyal9/winget-releaser@main
+        with:
+          identifier: skssmd.AIBrowserToolkit
+          version: ${{ needs.wheel.outputs.version }}
+          installers-regex: '-setup\.exe$'
+          fork-user: skssmd
+          token: ${{ secrets.WINGET_TOKEN }}
+
+  scoop:
+    needs: [wheel, release]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: bundle-windows-x86_64
+          path: dl
+
+      - name: Render the manifest
+        run: |
+          set -eu
+          version="${{ needs.wheel.outputs.version }}"
+          hash=$(sha256sum dl/*.zip | cut -d' ' -f1)
+          sed -e "s/@VERSION@/$version/g" -e "s/@HASH@/$hash/g" \
+            packaging/scoop/manifest.json.template > aibrowsertoolkit.json
+          cat aibrowsertoolkit.json
+
+      - name: Push to the bucket
+        env:
+          TOKEN: ${{ secrets.TAP_TOKEN }}
+        run: |
+          set -eu
+          git clone "https://x-access-token:$TOKEN@github.com/skssmd/scoop-bucket.git" bucket
+          mkdir -p bucket/bucket
+          cp aibrowsertoolkit.json bucket/bucket/aibrowsertoolkit.json
+          cd bucket
+          git config user.name "skssmd"
+          git config user.email "skssmd78475@gmail.com"
+          git add bucket/aibrowsertoolkit.json
+          git diff --cached --quiet && exit 0
+          git commit -m "aibrowsertoolkit: ${{ needs.wheel.outputs.version }}"
+          # Graft's release workflow writes to this repo too; a simultaneous
+          # release would otherwise lose this push to a non-fast-forward.
+          # Push first, rebase only when the push is rejected. `git pull
+          # --rebase` fails outright against a repository with no commits --
+          # "no such ref was fetched" -- which is exactly the state a freshly
+          # created bucket is in, so pulling first meant the very first
+          # release could never land. The rebase still covers the real case
+          # it was written for: a concurrent write to a shared repo.
+          for attempt in 1 2 3; do
+            git push -u origin HEAD:main && exit 0
+            git pull --rebase origin main || true
+            sleep 5
+          done
+          exit 1
+
+  brew:
+    needs: [wheel, release]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: bundle-macos-arm64
+          path: dl
+
+      - name: Render the formula
+        run: |
+          set -eu
+          version="${{ needs.wheel.outputs.version }}"
+          arm=$(sha256sum dl/*.tar.gz | cut -d' ' -f1)
+          sed -e "s/@VERSION@/$version/g" -e "s/@SHA_ARM@/$arm/g" \
+            packaging/homebrew/formula.rb.template > aibrowsertoolkit.rb
+          cat aibrowsertoolkit.rb
+
+      - name: Push to the tap
+        env:
+          TOKEN: ${{ secrets.TAP_TOKEN }}
+        run: |
+          set -eu
+          git clone "https://x-access-token:$TOKEN@github.com/skssmd/homebrew-tap.git" tap
+          mkdir -p tap/Formula
+          cp aibrowsertoolkit.rb tap/Formula/aibrowsertoolkit.rb
+          cd tap
+          git config user.name "skssmd"
+          git config user.email "skssmd78475@gmail.com"
+          git add Formula/aibrowsertoolkit.rb
+          git diff --cached --quiet && exit 0
+          git commit -m "aibrowsertoolkit ${{ needs.wheel.outputs.version }}"
+          # Graft writes Formula/graft.rb in this same repo.
+          # Push first, rebase only when the push is rejected. `git pull
+          # --rebase` fails outright against a repository with no commits --
+          # "no such ref was fetched" -- which is exactly the state a freshly
+          # created bucket is in, so pulling first meant the very first
+          # release could never land. The rebase still covers the real case
+          # it was written for: a concurrent write to a shared repo.
+          for attempt in 1 2 3; do
+            git push -u origin HEAD:main && exit 0
+            git pull --rebase origin main || true
+            sleep 5
+          done
+          exit 1
+
+  aur:
+    needs: [wheel, release]
+    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-rc')
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: bundle-linux-*
+          path: dl
+
+      - name: Render the PKGBUILD
+        run: |
+          set -eu
+          version="${{ needs.wheel.outputs.version }}"
+          x86=$(sha256sum dl/bundle-linux-x86_64/*.tar.gz | cut -d' ' -f1)
+          arm=$(sha256sum dl/bundle-linux-aarch64/*.tar.gz | cut -d' ' -f1)
+          mkdir -p aurpkg
+          sed -e "s/@VERSION@/$version/g" -e "s/@SHA_X86@/$x86/g" -e "s/@SHA_ARM@/$arm/g" \
+            packaging/aur/PKGBUILD.template > aurpkg/PKGBUILD
+          cp packaging/aur/aibrowsertoolkit-bin.install aurpkg/
+          cat aurpkg/PKGBUILD
+
+      - uses: KSXGitHub/github-actions-deploy-aur@v3
+        with:
+          pkgname: aibrowsertoolkit-bin
+          pkgbuild: aurpkg/PKGBUILD
+          assets: aurpkg/aibrowsertoolkit-bin.install
+          commit_username: skssmd
+          commit_email: skssmd78475@gmail.com
+          ssh_private_key: ${{ secrets.AUR_SSH_KEY }}
+          commit_message: "aibrowsertoolkit-bin ${{ needs.wheel.outputs.version }}"
+
+  fury:
+    needs: [wheel, release]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: bundle-linux-*
+          path: dl
+
+      - name: Install nfpm
+        env:
+          # Pinned on purpose: a release pipeline that silently picks up a new
+          # packaging tool is one that breaks on a day you changed nothing.
+          NFPM_VERSION: "2.41.3"
+        run: |
+          set -eu
+          curl -fsSL -o nfpm.tar.gz \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
+          tar xf nfpm.tar.gz nfpm && sudo mv nfpm /usr/local/bin/
+          nfpm --version
+
+      - name: Build and push every package
+        env:
+          PKG_VERSION: ${{ needs.wheel.outputs.version }}
+          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
+        run: |
+          set -eu
+          chmod +x packaging/postinstall.sh packaging/preremove.sh
+          mkdir -p out
+          for pair in "x86_64:amd64" "aarch64:arm64"; do
+            target="${pair%%:*}"
+            PKG_ARCH="${pair##*:}"
+            export PKG_ARCH
+            rm -rf payload && mkdir payload
+            tar xzf dl/bundle-linux-$target/*.tar.gz -C payload --strip-components=1
+            for fmt in deb rpm apk; do
+              nfpm pkg --config packaging/nfpm.yaml --packager "$fmt" --target out/
+            done
+          done
+          ls -l out
+          for pkg in out/*; do
+            echo "pushing $pkg"
+            curl -fsS -F package=@"$pkg" "https://$FURY_TOKEN@push.fury.io/skssmd/"
+          done

ai_browser_toolkit-0.1.2/.gitignore

@@ -0,0 +1,31 @@
+.venv/
+# Browser profiles. One directory per named profile, and every one of them
+# holds live logins -- see docs/superpowers/specs on profile sessions.
+profiles/
+logs/
+.e2e-profile/
+.demo-profile/
+logs-demo/
+.e2e.log
+.e2e.err
+server.log
+server.err
+server-*.log
+server-*.err
+demo.log
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+build/
+dist/
+/guidelines/onehr
+
+# OneHr client material. The playbooks and session write-ups name a real
+# organisation, its routes and its staff records, so they stay on disk and out
+# of the repo. Name-matched rather than path-matched so a new write-up is
+# covered the moment it is created, not the next time someone remembers.
+# Case variants because git's ignore matching is case-sensitive by default.
+*onehr*
+*OneHr*
+*ONEHR*

ai_browser_toolkit-0.1.2/.sheet-url

@@ -0,0 +1 @@
+https://docs.google.com/spreadsheets/d/1-y9x7VJLL7bTN4rSnazxMB8DRdZtOpX8_YlW8PKHZQM/edit?gid=0#gid=0