moonlighting 0.1.0__py3-none-any.whl

auth.py

@@ -0,0 +1,65 @@
+"""本地服务的访问令牌：挡住同机其他进程乱调。
+
+问题：8899 上跑着凭据代理，任何本机进程都能 `GET /inject_sel?handle=...` 让浏览器
+把密码填进一个 origin 相同的页面（同源伪造），8897/8765 同理能驱动浏览器和注入按键。
+
+做法：
+  * 首次启动生成 32 字节随机 token，写到 `<home>/token.txt`
+  * 所有**会改变状态**的接口要求 `X-Hermes-Token` 头（或 `?token=`）
+  * 只读接口（/snapshot、/status、/list 的元信息）不强制，方便看画面
+  * 客户端（cred_dialog、login_flow）自己从同一个文件读，用户无感
+
+环境变量 `HERMES_TOKEN` 优先，便于 CI/临时覆盖。
+"""
+import os
+import secrets
+
+HOME = os.environ.get("HERMES_BROWSER_HOME") or os.path.join(
+    os.environ.get("LOCALAPPDATA") or os.path.expanduser("~"), "hermes-browser")
+try:                                    # 装了 setup.py 就跟着它走
+    import ports as _ports
+    HOME = _ports.home()
+except Exception:  # noqa: BLE001
+    pass
+TOKEN_FILE = os.environ.get("HERMES_TOKEN_FILE") or os.path.join(HOME, "token.txt")
+
+
+def token():
+    env = os.environ.get("HERMES_TOKEN")
+    if env:
+        return env
+    try:
+        with open(TOKEN_FILE, encoding="utf-8") as f:
+            t = f.read().strip()
+        if t:
+            return t
+    except OSError:
+        pass
+    os.makedirs(os.path.dirname(TOKEN_FILE), exist_ok=True)
+    t = secrets.token_urlsafe(24)
+    with open(TOKEN_FILE, "w", encoding="utf-8") as f:
+        f.write(t)
+    try:
+        os.chmod(TOKEN_FILE, 0o600)
+    except OSError:
+        pass
+    return t
+
+
+def check(headers, query):
+    """headers: email.Message；query: dict[str, list[str]] 或 dict[str,str]"""
+    want = token()
+    got = headers.get("X-Hermes-Token") if headers is not None else None
+    if not got and query:
+        v = query.get("token")
+        got = (v[0] if isinstance(v, list) else v) if v else None
+    return bool(got) and secrets.compare_digest(str(got), want)
+
+
+def headers_for_client():
+    return {"X-Hermes-Token": token()}
+
+
+if __name__ == "__main__":
+    print("token 文件:", TOKEN_FILE)
+    print("token:", token()[:8] + "…（已写入文件，不完整打印）")

browser_daemon.py

@@ -0,0 +1,213 @@
+"""常驻浏览器驱动：一个 MCP 会话 + 本地 HTTP 接口，按 ref 操作，不用坐标和选择器。
+
+为什么这么做：
+- Playwright MCP 的 browser_snapshot 返回完整无障碍树，每个可交互元素带 [ref=e42]，
+  一次调用就能看清整页，不用逐个 querySelector 试。
+- ref 在「同一个 MCP 会话」里有效，所以必须常驻一个进程，不能每次动作都新起一个。
+
+启动:
+  python browser_daemon.py --cdp 18763 --port 8897
+
+接口:
+  GET /snap                     完整快照（含标签页列表、ref）
+  GET /click?target=e42&element=按钮描述
+  GET /type?target=e12&text=hello&element=输入框
+  GET /goto?url=https://example.com
+  GET /eval?js=location.href
+  GET /find?text=登录
+  GET /status
+"""
+import argparse
+import json
+import urllib.parse
+import urllib.request
+import subprocess
+import threading
+import time
+import os
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlparse, parse_qs
+
+try:
+    import auth as _auth
+except ImportError:                      # 单独拷走也能跑，只是没鉴权
+    class _auth:                          # noqa: N801
+        @staticmethod
+        def check(_h, _q):
+            return True
+
+        @staticmethod
+        def headers_for_client():
+            return {}
+
+LOCK = threading.Lock()
+PROC = None
+MID = [0]
+STATE = {"ready": False, "calls": 0, "started": 0.0}
+
+
+def _send(obj):
+    PROC.stdin.write(json.dumps(obj) + "\n")
+    PROC.stdin.flush()
+
+
+def _read(timeout=120):
+    end = time.time() + timeout
+    while time.time() < end:
+        line = PROC.stdout.readline()
+        if not line:
+            time.sleep(0.02)
+            continue
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            return json.loads(line)
+        except json.JSONDecodeError:
+            continue
+    return None
+
+
+def mcp(method, params, timeout=120):
+    """串行调用 MCP，返回 result 里的文本。"""
+    with LOCK:
+        MID[0] += 1
+        mid = MID[0]
+        _send({"jsonrpc": "2.0", "id": mid, "method": method, "params": params})
+        while True:
+            m = _read(timeout)
+            if m is None:
+                return None
+            if m.get("id") == mid:
+                return m
+
+
+def tool(name, args, timeout=120):
+    r = mcp("tools/call", {"name": name, "arguments": args}, timeout)
+    if not r:
+        return "MCP 超时"
+    if "error" in r:
+        return f"MCP 错误: {r['error']}"
+    res = r.get("result", {})
+    text = "\n".join(c.get("text", "") for c in (res.get("content") or []) if isinstance(c, dict))
+    if res.get("isError"):
+        return "工具报错:\n" + text
+    return text
+
+
+def start(cdp, extra):
+    global PROC
+    # snapshot-mode=none：动作后不再附带整页快照（GitHub 这种大页面能省 2s）；
+    # timeout-settle=250：动作后只等 250ms 让页面安定。需要看状态时我自己调 /snap。
+    cmd = ["npx.cmd", "-y", "@playwright/mcp@latest",
+           "--cdp-endpoint", f"http://127.0.0.1:{cdp}",
+           "--snapshot-mode", "none", "--timeout-settle", "250"] + extra
+    PROC = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                            stderr=subprocess.DEVNULL, text=True, encoding="utf-8",
+                            errors="replace", bufsize=1)
+    r = mcp("initialize", {"protocolVersion": "2024-11-05", "capabilities": {},
+                           "clientInfo": {"name": "hermes-browser", "version": "1.0"}}, 90)
+    if not r or "result" not in r:
+        raise SystemExit(f"初始化失败: {r}")
+    _send({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}})
+    STATE["ready"] = True
+    STATE["started"] = time.time()
+
+
+def sync_preview(url):
+    """让推流页面跟着我操作的标签走（私有桌面上无法真正切换可见标签）。"""
+    try:
+        import ports as _p
+        host = (url or "").split("//")[-1].split("/")[0]
+        if not host:
+            return
+        q = urllib.parse.urlencode({"url": host, "token": _auth.token() if hasattr(_auth, "token") else ""})
+        urllib.request.urlopen(f"http://127.0.0.1:{_p.port_of('stream')}/focus?{q}", timeout=3).read()
+    except Exception:  # noqa: BLE001
+        pass
+
+
+class H(BaseHTTPRequestHandler):
+    def log_message(self, *a):
+        pass
+
+    def _out(self, text, code=200):
+        body = text.encode("utf-8", "replace")
+        self.send_response(code)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        u = urlparse(self.path)
+        q = {k: v[0] for k, v in parse_qs(u.query).items()}
+        # 除 /status 外都要 token：这个进程能直接驱动浏览器
+        if u.path != "/status" and not _auth.check(self.headers, q):
+            return self._out("401 unauthorized: 缺少或错误的 X-Hermes-Token", 401)
+        t0 = time.time()
+        try:
+            if u.path == "/status":
+                return self._out(json.dumps({"ready": STATE["ready"], "calls": STATE["calls"],
+                                             "uptime": round(time.time() - STATE["started"], 1)}))
+            if u.path == "/snap":
+                text = tool("browser_snapshot", {})
+            elif u.path == "/click":
+                text = tool("browser_click", {"target": q.get("target", ""),
+                                              "element": q.get("element", "")})
+            elif u.path == "/type":
+                text = tool("browser_type", {"target": q.get("target", ""),
+                                             "text": q.get("text", ""),
+                                             "element": q.get("element", "")})
+            elif u.path == "/goto":
+                text = tool("browser_navigate", {"url": q.get("url", "")})
+                sync_preview(q.get("url", ""))
+            elif u.path == "/eval":
+                text = tool("browser_evaluate", {"function": q.get("js", "() => 1")})
+            elif u.path == "/find":
+                text = tool("browser_find", {"query": q.get("text", "")})
+            elif u.path == "/key":
+                text = tool("browser_press_key", {"key": q.get("key", "Enter")})
+            elif u.path == "/tool":
+                args = json.loads(q.get("args", "{}"))
+                text = tool(q.get("name", ""), args)
+            elif u.path == "/back":
+                text = tool("browser_navigate_back", {})
+            elif u.path == "/tabs":
+                text = tool("browser_snapshot", {})
+                text = text.split("### Page")[0]
+            else:
+                return self._out("未知接口", 404)
+            STATE["calls"] += 1
+            dt = (time.time() - t0) * 1000
+            return self._out(f"[{dt:.0f}ms]\n{text}")
+        except Exception as e:  # noqa: BLE001
+            return self._out(f"异常: {e}", 500)
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--cdp", type=int, default=int(os.environ.get("HERMES_CDP_PORT", "18763")))
+    ap.add_argument("--port", type=int, default=int(os.environ.get("HERMES_DRIVER_PORT", "8897")))
+    ap.add_argument("--snapshot-boxes", action="store_true", help="快照里带坐标框")
+    a = ap.parse_args()
+    extra = ["--snapshot-boxes"] if a.snapshot_boxes else []
+    start(a.cdp, extra)
+    print(f"[browser] MCP 已连上 CDP {a.cdp}，接口 http://127.0.0.1:{a.port}/snap", flush=True)
+    # 端口被占就自动换（直接启动也要有这层）
+    port = a.port
+    try:
+        srv = ThreadingHTTPServer(("127.0.0.1", port), H)
+    except OSError:
+        import socket as _s
+        with _s.socket() as probe:
+            probe.bind(("127.0.0.1", 0))
+            port = probe.getsockname()[1]
+        print(f"[port] {a.port} 已被占用，改用 {port}", flush=True)
+        srv = ThreadingHTTPServer(("127.0.0.1", port), H)
+    srv.serve_forever()
+
+
+if __name__ == "__main__":
+    main()

cdp_click.py

@@ -0,0 +1,160 @@
+"""按文字点击页面元素（CDP 真实鼠标事件 + 光标同步）。
+
+用法: python cdp_click.py <port> "<文字>"
+先跑 AX/DOM 找到元素 → 换算窗口坐标 → /cursor 画光标 → 派发 mouseMoved/Pressed/Released
+"""
+import os
+import asyncio
+import ctypes
+import ctypes.wintypes as w
+import json
+import sys
+import urllib.parse
+import urllib.request
+
+import websockets
+
+PORT = int(sys.argv[1])
+TEXT = sys.argv[2]
+STREAM = os.environ.get("HERMES_STREAM", "http://127.0.0.1:8765")
+DESKTOP = os.environ.get("HERMES_DESK", "HermesDesk")
+
+FIND_JS = """
+(() => {
+  const t = %s;
+  const hits = [];
+  const rec = (root) => {
+    for (const el of root.querySelectorAll('*')) {
+      if (el.shadowRoot) rec(el.shadowRoot);
+      const txt = (el.textContent || '').trim();
+      if (!txt || !txt.includes(t)) continue;
+      const r = el.getBoundingClientRect();
+      const st = getComputedStyle(el);
+      if (r.width < 8 || r.height < 8) continue;
+      if (st.visibility === 'hidden' || st.display === 'none' || st.pointerEvents === 'none') continue;
+      hits.push({tag: el.tagName, x: r.left + r.width / 2, y: r.top + r.height / 2,
+                 w: Math.round(r.width), h: Math.round(r.height)});
+    }
+  };
+  rec(document);
+  hits.sort((a, b) => (a.w * a.h) - (b.w * b.h));
+  return hits;
+})()
+"""
+
+user32 = ctypes.WinDLL("user32", use_last_error=True)
+user32.OpenDesktopW.restype = w.HANDLE
+user32.OpenDesktopW.argtypes = [w.LPCWSTR, w.DWORD, w.BOOL, w.DWORD]
+user32.GetWindowRect.argtypes = [w.HWND, ctypes.POINTER(w.RECT)]
+
+
+def window_rect():
+    h = user32.OpenDesktopW(DESKTOP, 0, False, 0x10000000)
+    best = [None]
+    proc = ctypes.WINFUNCTYPE(w.BOOL, w.HWND, w.LPARAM)
+
+    def cb(hwnd, _):
+        n = user32.GetWindowTextLengthW(hwnd)
+        b = ctypes.create_unicode_buffer(n + 1)
+        user32.GetWindowTextW(hwnd, b, n + 1)
+        if b.value and "Chrome" in b.value:
+            r = w.RECT()
+            user32.GetWindowRect(hwnd, ctypes.byref(r))
+            area = (r.right - r.left) * (r.bottom - r.top)
+            if best[0] is None or area > best[0][0]:
+                best[0] = (area, r.left, r.top)
+        return True
+
+    user32.SetThreadDesktop(h)
+    user32.EnumDesktopWindows(h, proc(cb), 0)
+    return best[0][1], best[0][2]
+
+
+def set_cursor(x, y, click=False):
+    q = urllib.parse.urlencode({"x": int(x), "y": int(y), "click": 1 if click else 0})
+    try:
+        urllib.request.urlopen(f"{STREAM}/cursor?{q}", timeout=4).read()
+    except Exception:  # noqa: BLE001
+        pass
+
+
+class CDP:
+    def __init__(self, ws):
+        self.ws = ws
+        self.n = 0
+
+    async def call(self, method, **params):
+        self.n += 1
+        mid = self.n
+        await self.ws.send(json.dumps({"id": mid, "method": method, "params": params}))
+        while True:
+            m = json.loads(await self.ws.recv())
+            if m.get("id") == mid:
+                if "error" in m:
+                    raise RuntimeError(f"{method}: {m['error']}")
+                return m.get("result", {})
+
+    async def js(self, expr):
+        r = await self.call("Runtime.evaluate", expression=expr,
+                            returnByValue=True, awaitPromise=True)
+        return r.get("result", {}).get("value")
+
+
+async def main():
+    raw = urllib.request.urlopen(f"http://127.0.0.1:{PORT}/json", timeout=5).read()
+    targets = json.loads(raw)
+    tab = None
+    for kw in ("ses.html", "popup.html"):
+        for t in targets:
+            if kw in t.get("url", "") and t.get("webSocketDebuggerUrl"):
+                tab = t
+                break
+        if tab:
+            break
+    if not tab:
+        print("没有扩展页面标签")
+        return
+    print(f"[tab] {tab['url'][:90]}")
+
+    async with websockets.connect(tab["webSocketDebuggerUrl"], max_size=20000000) as ws:
+        cdp = CDP(ws)
+        await cdp.call("Runtime.enable")
+        await cdp.call("Page.enable")
+
+        left, top = window_rect()
+        ox = (await cdp.js("window.screenX") - left) + max(0, (await cdp.js("window.outerWidth - window.innerWidth")) // 2)
+        oy = (await cdp.js("window.screenY") - top) + await cdp.js("window.outerHeight - window.innerHeight")
+
+        hits = await cdp.js(FIND_JS % json.dumps(TEXT))
+        print(f"[find] {TEXT!r} -> {hits}")
+        if not hits:
+            print("没找到可点元素")
+            return
+        h = hits[0]
+        wx, wy = h["x"] + ox, h["y"] + oy
+        print(f"[click] {h['tag']} 视口({h['x']:.0f},{h['y']:.0f}) 窗口({wx:.0f},{wy:.0f})")
+        set_cursor(wx, wy)
+        await asyncio.sleep(0.4)
+        set_cursor(wx, wy, click=True)
+        for t in ("mouseMoved", "mousePressed", "mouseReleased"):
+            await cdp.call("Input.dispatchMouseEvent", type=t, x=h["x"], y=h["y"],
+                           button="none" if t == "mouseMoved" else "left",
+                           clickCount=0 if t == "mouseMoved" else 1)
+            await asyncio.sleep(0.08)
+
+        await asyncio.sleep(2.0)
+        print("[url]", await cdp.js("location.href"))
+        ax = await cdp.call("Accessibility.getFullAXTree")
+        names = []
+        for n in ax.get("nodes", []):
+            if n.get("ignored"):
+                continue
+            nm = (n.get("name", {}) or {}).get("value") or ""
+            role = (n.get("role", {}) or {}).get("value") or ""
+            if nm.strip() and role not in ("StaticText", "InlineTextBox", "generic"):
+                names.append(f"{role}:{nm.strip()[:40]}")
+        print("[screen]", names[:22])
+
+
+if __name__ == "__main__":
+    asyncio.run(main())