assertify-mcp 0.6.3__py3-none-any.whl

assertify/native.py

@@ -0,0 +1,259 @@
+"""A login window in the user's own, un-automated Chrome.
+
+Google (and some other sign-in providers) refuse to sign in inside a browser that an automation tool
+is driving. So for logins Assertify starts the installed Chrome as a normal app, with a throwaway
+profile folder and a DevTools port on 127.0.0.1 (a pipe would make Chrome flag itself as automated,
+navigator.webdriver = true). While the user signs in,
+it only asks the browser for its cookie jar, which pages can't see. Pages are read (localStorage,
+which account is signed in) once, after the user says they are done. Then Chrome is closed and the
+throwaway profile is deleted.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import urllib.request
+from pathlib import Path
+
+import websockets
+
+
+def find_chrome() -> str | None:
+    """Path of an installed Chrome (or Chromium / Edge), or None."""
+    env = os.environ.get("ASSERTIFY_CHROME_PATH")
+    if env:
+        return env if Path(env).exists() else None
+    if sys.platform == "darwin":
+        names = ["Google Chrome", "Chromium", "Microsoft Edge"]
+        for base in ("/Applications", str(Path.home() / "Applications")):
+            for n in names:
+                p = Path(base) / f"{n}.app" / "Contents" / "MacOS" / n
+                if p.exists():
+                    return str(p)
+        return None
+    if sys.platform == "win32":
+        roots = [os.environ.get(k) for k in ("PROGRAMFILES", "PROGRAMFILES(X86)", "LOCALAPPDATA")]
+        for root in filter(None, roots):
+            for rel in (r"Google\Chrome\Application\chrome.exe", r"Microsoft\Edge\Application\msedge.exe"):
+                p = Path(root) / rel
+                if p.exists():
+                    return str(p)
+        return None
+    for n in ("google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "microsoft-edge"):
+        p = shutil.which(n)
+        if p:
+            return p
+    return None
+
+
+def _free_port() -> int:
+    with socket.socket() as sock:
+        sock.bind(("127.0.0.1", 0))
+        return sock.getsockname()[1]
+
+
+def _ws_url(port: int) -> str:
+    with urllib.request.urlopen(f"http://127.0.0.1:{port}/json/version", timeout=2) as r:
+        return json.loads(r.read())["webSocketDebuggerUrl"]
+
+
+async def isolated_eval(send, expression: str):
+    """Evaluate JS in a fresh "isolated world" of a tab's main frame, over a CDP `send(method, params)`.
+    The page's scripts don't share its globals: a site that deletes window.localStorage (Discord) or
+    replaces built-ins can't hide anything from it, and can't see that it ran."""
+    frame = (await send("Page.getFrameTree"))["frameTree"]["frame"]["id"]
+    ctx = (await send("Page.createIsolatedWorld", {"frameId": frame, "worldName": "assertify"}))["executionContextId"]
+    res = await send(
+        "Runtime.evaluate",
+        {"expression": expression, "contextId": ctx, "returnByValue": True, "awaitPromise": True},
+    )
+    if res.get("exceptionDetails"):
+        raise RuntimeError(res["exceptionDetails"].get("text", "script failed"))
+    return res.get("result", {}).get("value")
+
+
+def native_supported() -> bool:
+    """ASSERTIFY_LOGIN_WINDOW=playwright goes back to the automated login window."""
+    return os.environ.get("ASSERTIFY_LOGIN_WINDOW", "").lower() != "playwright"
+
+
+def _to_cdp(c: dict) -> dict:
+    out = {k: c[k] for k in ("name", "value", "domain", "path", "httpOnly", "secure") if k in c}
+    if c.get("expires", -1) not in (-1, None):
+        out["expires"] = c["expires"]
+    if c.get("sameSite") in ("Strict", "Lax", "None"):
+        out["sameSite"] = c["sameSite"]
+    return out
+
+
+def _from_cdp(c: dict) -> dict:
+    return {
+        "name": c["name"],
+        "value": c["value"],
+        "domain": c["domain"],
+        "path": c.get("path", "/"),
+        "expires": -1 if c.get("session") else c.get("expires", -1),
+        "httpOnly": bool(c.get("httpOnly")),
+        "secure": bool(c.get("secure")),
+        "sameSite": c.get("sameSite") if c.get("sameSite") in ("Strict", "Lax", "None") else "Lax",
+    }
+
+
+class NativeChrome:
+    """One Chrome process with a throwaway profile and a local DevTools port."""
+
+    def __init__(self) -> None:
+        self.proc: subprocess.Popen | None = None
+        self.user_dir: str | None = None
+        self._ws = None
+        self._reader_task: asyncio.Task | None = None
+        self._next = 0
+        self._waiting: dict[int, asyncio.Future] = {}
+        self.closed = asyncio.Event()
+
+    async def start(self, chrome: str, url: str, cookies: list[dict] | None) -> None:
+        self.user_dir = tempfile.mkdtemp(prefix="assertify-login-")  # 0700: only this user can read it
+        port = _free_port()
+        self.proc = subprocess.Popen(
+            [
+                chrome,
+                f"--user-data-dir={self.user_dir}",
+                "--remote-debugging-address=127.0.0.1",
+                # A fixed port: with port 0 or a pipe Chrome marks itself as automated (navigator.webdriver).
+                f"--remote-debugging-port={port}",
+                "--no-first-run",
+                "--no-default-browser-check",
+                "--new-window",
+                "about:blank",
+            ],
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        ws_url = None
+        for _ in range(150):
+            if self.proc.poll() is not None:
+                raise RuntimeError("Chrome exited right after starting.")
+            try:
+                ws_url = await asyncio.to_thread(_ws_url, port)
+                break
+            except OSError:
+                await asyncio.sleep(0.1)
+        if not ws_url:
+            raise RuntimeError("Chrome didn't open its DevTools port.")
+        self._ws = await websockets.connect(ws_url, max_size=None, open_timeout=10)
+        self._reader_task = asyncio.create_task(self._reader())
+
+        if cookies:
+            await self.send("Storage.setCookies", {"cookies": [_to_cdp(c) for c in cookies]})
+        blank = [t["targetId"] for t in await self.page_targets()]
+        await self.send("Target.createTarget", {"url": url})
+        for tid in blank:  # drop the empty first tab
+            await self.send("Target.closeTarget", {"targetId": tid})
+
+    async def _reader(self) -> None:
+        try:
+            async for msg in self._ws:
+                try:
+                    data = json.loads(msg)
+                except ValueError:
+                    continue
+                fut = self._waiting.pop(data.get("id"), None)
+                if fut and not fut.done():
+                    if "error" in data:
+                        fut.set_exception(RuntimeError(data["error"].get("message", "CDP error")))
+                    else:
+                        fut.set_result(data.get("result", {}))
+        except Exception:
+            pass
+        self.closed.set()
+        for fut in self._waiting.values():
+            if not fut.done():
+                fut.set_exception(RuntimeError("The browser was closed."))
+        self._waiting.clear()
+
+    async def send(self, method: str, params: dict | None = None, session: str | None = None) -> dict:
+        if self.closed.is_set() or self._ws is None:
+            raise RuntimeError("The browser was closed.")
+        self._next += 1
+        msg = {"id": self._next, "method": method, "params": params or {}}
+        if session:
+            msg["sessionId"] = session
+        fut = asyncio.get_running_loop().create_future()
+        self._waiting[self._next] = fut
+        try:
+            await self._ws.send(json.dumps(msg))
+        except Exception as e:
+            self._waiting.pop(self._next, None)
+            raise RuntimeError("The browser was closed.") from e
+        return await asyncio.wait_for(fut, timeout=15)
+
+    # ---- while the user signs in: browser-level calls only, nothing a page can notice ----
+
+    async def cookies(self) -> list[dict]:
+        res = await self.send("Storage.getCookies")
+        return [_from_cdp(c) for c in res.get("cookies", [])]
+
+    async def page_targets(self) -> list[dict]:
+        res = await self.send("Target.getTargets")
+        return [t for t in res.get("targetInfos", []) if t.get("type") == "page"]
+
+    async def bring_to_front(self) -> None:
+        pages = await self.page_targets()
+        if pages:
+            await self.send("Target.activateTarget", {"targetId": pages[-1]["targetId"]})
+
+    async def user_agent(self) -> str:
+        return (await self.send("Browser.getVersion")).get("userAgent", "")
+
+    # ---- after the user is done ----
+
+    async def evaluate_pages(self, expression: str, skip=None) -> list[tuple[str, object]]:
+        """Run JS in every open web tab, except those `skip(url)` picks: [(url, value)].
+        It runs in a separate world of the page, so the page's own scripts can't see it or get in its way."""
+        out = []
+        for t in await self.page_targets():
+            if not t.get("url", "").startswith("http") or (skip and skip(t["url"])):
+                continue
+            try:
+                sid = (await self.send("Target.attachToTarget", {"targetId": t["targetId"], "flatten": True}))[
+                    "sessionId"
+                ]
+                try:
+                    value = await isolated_eval(lambda m, p=None, sid=sid: self.send(m, p, session=sid), expression)
+                finally:
+                    await self.send("Target.detachFromTarget", {"sessionId": sid})
+                out.append((t["url"], value))
+            except Exception:
+                continue
+        return out
+
+    async def close(self) -> None:
+        if self.proc and self.proc.poll() is None:
+            try:
+                await self.send("Browser.close")
+            except Exception:
+                pass
+            for _ in range(30):
+                if self.proc.poll() is not None:
+                    break
+                await asyncio.sleep(0.1)
+            if self.proc.poll() is None:
+                self.proc.kill()
+        if self._ws is not None:
+            try:
+                await self._ws.close()
+            except Exception:
+                pass
+        if self._reader_task:
+            self._reader_task.cancel()
+        if self.user_dir:  # the throwaway profile holds the session in plain form: remove it
+            await asyncio.to_thread(shutil.rmtree, self.user_dir, True)
+            self.user_dir = None

assertify/prompt.py

@@ -0,0 +1,75 @@
+"""A small window where the user types things the agent must never see: the username and
+password for a site's browser sign-in box (HTTP Basic/NTLM), and whether to trust its certificate."""
+
+from __future__ import annotations
+
+import asyncio
+import html
+import string
+
+FORM = string.Template("""<!doctype html><html><head><meta charset="utf-8"><title>Assertify: browser sign-in</title>
+<style>
+ body { font: 15px -apple-system, system-ui, sans-serif; margin: 32px auto; max-width: 440px; color: #222; }
+ h1 { font-size: 19px; margin: 0 0 6px; } p { color: #555; margin: 0 0 18px; line-height: 1.4; }
+ label { display: block; margin: 14px 0 4px; font-weight: 600; }
+ input[type=text], input[type=password] { width: 100%; padding: 8px; font-size: 15px; box-sizing: border-box; }
+ .check { display: flex; gap: 8px; align-items: flex-start; font-weight: 400; margin-top: 18px; }
+ .warn { color: #8a5300; font-size: 13px; margin: 4px 0 0 24px; }
+ .buttons { margin-top: 24px; display: flex; gap: 10px; }
+ button { padding: 8px 18px; font-size: 15px; }
+</style></head><body>
+<h1>Browser settings for $site</h1>
+<p>Only for sites that show the browser's own sign-in box, or use a certificate your browser doesn't trust
+(common for company intranets and devices). The AI agent can't see what you type here; it's saved
+encrypted with the login <b>$profile</b>.</p>
+<form id="f">
+ <label for="u">Username</label><input type="text" id="u" autocomplete="off" value="$user">
+ <label for="p">Password</label><input type="password" id="p" autocomplete="off"
+   placeholder="$placeholder">
+ <label class="check"><input type="checkbox" id="c" $checked> Trust this site's certificate even if it
+   isn't valid (self-signed)</label>
+ <div class="warn">Only tick this for a site you control or your company runs. It turns off the check that
+   stops someone pretending to be the site.</div>
+ <div class="buttons"><button type="submit">Save</button><button type="button" id="x">Cancel</button></div>
+</form>
+<script>
+ document.getElementById('f').onsubmit = (e) => { e.preventDefault(); window.__done = {
+   save: true, user: document.getElementById('u').value, password: document.getElementById('p').value,
+   trust: document.getElementById('c').checked }; };
+ document.getElementById('x').onclick = () => { window.__done = {save: false}; };
+</script></body></html>""")
+
+
+async def ask(pw, launch, profile: str, site: str, user: str, has_password: bool, trusted: bool) -> dict | None:
+    """Show the form and wait for the user. Returns their answers, or None if they cancelled or closed it."""
+    browser = await launch(pw, headless=False)
+    page = await browser.new_page(viewport={"width": 560, "height": 560})
+    try:
+        await page.set_content(
+            FORM.substitute(
+                site=html.escape(site),
+                profile=html.escape(profile),
+                user=html.escape(user, quote=True),
+                placeholder="(unchanged, leave empty to keep it)" if has_password else "",
+                checked="checked" if trusted else "",
+            )
+        )
+        await page.bring_to_front()
+        closed = asyncio.get_running_loop().create_future()
+        page.on("close", lambda _: closed.done() or closed.set_result(None))
+        answer = asyncio.ensure_future(page.wait_for_function("window.__done", timeout=600_000))
+        done, _ = await asyncio.wait([answer, closed], return_when=asyncio.FIRST_COMPLETED)
+        if answer not in done:
+            answer.cancel()
+            return None
+        result = await (await answer).json_value()
+        return result if result.get("save") else None
+    except Exception as e:
+        if page.is_closed() or not browser.is_connected():  # the user closed the window mid-way
+            return None
+        raise RuntimeError(f"The settings window failed: {str(e).splitlines()[0]}") from e
+    finally:
+        try:
+            await browser.close()
+        except Exception:
+            pass