browser_server.py

# Copyright © 2026 Doug Trier / Trier OS. All Rights Reserved.
# browser_server.py — Controlled Browser Execution Server
# =========================================================
# FastAPI server on port 7870. Provides a safe, constrained browser
# execution layer for AI agents. Phase 1: read-only operations only.
# Uses Playwright Python with Chromium in headless mode.
# Cookies and session tokens are NEVER returned to callers.

from fastapi import FastAPI, HTTPException, Body
from pydantic import BaseModel
import uvicorn
import asyncio
import time
import base64
import re
import os
import hashlib
import json
import random
from contextlib import asynccontextmanager
from playwright.async_api import async_playwright, Page, BrowserContext, Browser
try:
    from playwright_stealth import stealth_async as _stealth_async
    STEALTH_AVAILABLE = True
except ImportError:
    STEALTH_AVAILABLE = False
    _stealth_async = None

@asynccontextmanager
async def app_lifespan(_app: FastAPI):
    await startup_browser()
    try:
        yield
    finally:
        await shutdown_browser()

app = FastAPI(lifespan=app_lifespan)

CHROMIUM_LAUNCH_ARGS = [
    "--disable-blink-features=AutomationControlled",
    "--disable-dev-shm-usage",
    "--no-sandbox",
    "--disable-setuid-sandbox",
    "--disable-infobars",
    "--disable-extensions",
]

# CAT-5-002: Token auth middleware
import os as _os, sys as _sys
_SESSION_TOKEN = ""
for _i, _a in enumerate(_sys.argv):
    if _a == "--token" and _i + 1 < len(_sys.argv):
        _SESSION_TOKEN = _sys.argv[_i + 1]
        break

try:
    from starlette.middleware.base import BaseHTTPMiddleware
    from starlette.responses import Response as _SR
    class _TokenAuth(BaseHTTPMiddleware):
        async def dispatch(self, request, call_next):
            if _SESSION_TOKEN and request.headers.get("x-more-ai-token","") != _SESSION_TOKEN:
                return _SR("Unauthorized", status_code=401)
            return await call_next(request)
    app.add_middleware(_TokenAuth)
except Exception as exc:
    raise RuntimeError("Sidecar auth middleware is required") from exc

# Global state
_playwright = None
_browser: Browser = None
_contexts = {}  # session_id -> BrowserContext
_last_activity = {}  # session_id -> float (timestamp)
_ready = False

class OpenUrlRequest(BaseModel):
    session_id: str
    url: str

class SessionRequest(BaseModel):
    session_id: str

class ScreenshotRequest(BaseModel):
    session_id: str
    label: str

class ClickRequest(BaseModel):
    session_id: str
    element_index: int

class TypeTextRequest(BaseModel):
    session_id: str
    element_index: int
    text: str

class PressKeyRequest(BaseModel):
    session_id: str
    key: str

class ScrollRequest(BaseModel):
    session_id: str
    direction: str
    amount: int

class DownloadRequest(BaseModel):
    session_id: str
    element_index: int
    app_data_dir: str

class SaveSessionProfileRequest(BaseModel):
    profile_id: str
    session_id: str

class LoadSessionProfileRequest(BaseModel):
    profile_id: str
    session_id: str
    cookies_blob: str

async def get_context(session_id: str) -> BrowserContext:
    global _playwright, _browser, _contexts, _last_activity
    if session_id not in _contexts:
        if len(_contexts) >= 5:
            # simple eviction
            oldest = min(_last_activity.items(), key=lambda x: x[1])[0]
            if time.time() - _last_activity[oldest] > 30 * 60:
                old_ctx = _contexts.pop(oldest)
                _last_activity.pop(oldest, None)
                await old_ctx.close()
            else:
                raise Exception("Maximum concurrent browser sessions reached")
        
        class ExportTraceRequest(BaseModel):
            session_id: str
            app_data_dir: str
            
        ctx = await _browser.new_context(
            viewport={"width": 1366, "height": 768},
            user_agent=(
                "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                "AppleWebKit/537.36 (KHTML, like Gecko) "
                "Chrome/131.0.0.0 Safari/537.36"
            ),
            locale="en-US",
            timezone_id="America/New_York",
            ignore_https_errors=True,
            extra_http_headers={
                "Accept-Language": "en-US,en;q=0.9",
                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
                "sec-ch-ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
                "sec-ch-ua-mobile": "?0",
                "sec-ch-ua-platform": '"Windows"',
            }
        )
        await ctx.add_init_script("""
            Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
            Object.defineProperty(navigator, 'languages', { get: () => ['en-US', 'en'] });
            Object.defineProperty(navigator, 'plugins', { get: () => Array.from({length: 3}) });
            window.chrome = { runtime: {}, loadTimes: function(){}, csi: function(){} };
            delete navigator.__proto__.webdriver;
        """)
        await ctx.tracing.start(snapshots=True, screenshots=True, sources=True)
        _contexts[session_id] = ctx
    
    _last_activity[session_id] = time.time()
    return _contexts[session_id]

async def get_page(session_id: str) -> Page:
    ctx = await get_context(session_id)
    pages = ctx.pages
    if not pages:
        page = await ctx.new_page()
        if STEALTH_AVAILABLE and _stealth_async:
            await _stealth_async(page)
        return page
    return pages[0]

async def startup_browser():
    global _playwright, _browser, _ready
    _playwright = await async_playwright().start()
    _browser = await launch_chromium_browser()
    _ready = True
    asyncio.create_task(cleanup_task())

async def launch_chromium_browser():
    try:
        return await _playwright.chromium.launch(
            headless=True,
            args=CHROMIUM_LAUNCH_ARGS,
        )
    except Exception as first_error:
        first_message = str(first_error)
        browser_missing = (
            "Executable doesn't exist" in first_message
            or "playwright install" in first_message
        )
        if not browser_missing:
            raise

        fallback_errors = []
        for label, channel in (("Google Chrome", "chrome"), ("Microsoft Edge", "msedge")):
            try:
                print(
                    f"[browser_server] Bundled Chromium unavailable; using {label}.",
                    flush=True,
                )
                return await _playwright.chromium.launch(
                    channel=channel,
                    headless=True,
                    args=CHROMIUM_LAUNCH_ARGS,
                )
            except Exception as fallback_error:
                fallback_errors.append(f"{label}: {fallback_error}")

        raise RuntimeError(
            "Playwright Chromium is unavailable and installed browser fallback failed. "
            f"Original error: {first_message}. Fallback errors: {' | '.join(fallback_errors)}"
        )

async def shutdown_browser():
    global _playwright, _browser
    if _browser:
        await _browser.close()
    if _playwright:
        await _playwright.stop()

async def cleanup_task():
    while True:
        await asyncio.sleep(60)
        now = time.time()
        stale = [sid for sid, ts in _last_activity.items() if now - ts > 1800]
        for sid in stale:
            ctx = _contexts.pop(sid, None)
            _last_activity.pop(sid, None)
            if ctx:
                await ctx.close()

@app.get("/health")
async def health():
    return {"status": "ok", "playwright_ready": _ready}

@app.post("/open_url")
async def open_url(req: OpenUrlRequest):
    try:
        if not req.url.startswith("http://") and not req.url.startswith("https://"):
            return {"success": False, "error": "Invalid URL format. Only http/https allowed."}
        
        page = await get_page(req.session_id)
        resp = await page.goto(req.url, timeout=25000, wait_until="domcontentloaded")
        # Settle delay — bot detectors check dwell time
        await asyncio.sleep(1.5 + random.random() * 2.0)
        try:
            await page.wait_for_load_state("networkidle", timeout=6000)
        except Exception:
            pass
        # Simulate a small mouse movement so JS event listeners fire
        try:
            await page.mouse.move(
                300 + random.randint(-50, 50),
                400 + random.randint(-50, 50)
            )
        except Exception:
            pass
        await asyncio.sleep(0.3 + random.random() * 0.4)

        return {
            "success": True,
            "url": page.url,
            "title": await page.title(),
            "status_code": resp.status if resp else 200,
            "error": None
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/observe_page")
async def observe_page(req: SessionRequest):
    try:
        page = await get_page(req.session_id)
        
        # Take screenshot
        screenshot_bytes = await page.screenshot(type="png", quality=None)
        screenshot_b64 = base64.b64encode(screenshot_bytes).decode('utf-8')
        
        # Extract interactive elements
        script = """
        () => {
            const elements = document.querySelectorAll('a, button, input, select, textarea, [role="button"], [role="link"], [tabindex]:not([tabindex="-1"])');
            const result = [];
            let index = 1;
            
            const isVisible = (el) => {
                const rect = el.getBoundingClientRect();
                return rect.width > 0 && rect.height > 0 && window.getComputedStyle(el).visibility !== 'hidden';
            };
            
            elements.forEach(el => {
                if (isVisible(el)) {
                    let text = el.innerText || el.value || el.placeholder || el.title || el.getAttribute('aria-label') || '';
                    text = text.trim().substring(0, 100);
                    
                    // Do not collect auth tokens, cookies, passwords
                    const tagName = el.tagName.toLowerCase();
                    if (tagName === 'input' && el.type === 'password') text = '***';
                    
                    if (text || tagName === 'input' || tagName === 'select' || tagName === 'textarea') {
                        el.setAttribute('data-ai-index', index);
                        result.push({
                            index: index++,
                            tag: tagName,
                            text: text,
                            visible: true
                        });
                    }
                }
            });
            return result;
        }
        """
        
        elements = await page.evaluate(script)
        
        return {
            "success": True,
            "screenshot_b64": screenshot_b64,
            "elements": elements,
            "url": page.url,
            "title": await page.title()
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/extract_text")
async def extract_text(req: SessionRequest):
    try:
        page = await get_page(req.session_id)
        
        script = """
        () => {
            const clone = document.body.cloneNode(true);
            // Strip noise: scripts, styles, nav, ads, cookie banners, footers, sidebars
            const noise = clone.querySelectorAll(
                'script, style, noscript, iframe, ' +
                'nav, header, footer, aside, ' +
                '[role="navigation"], [role="banner"], [role="complementary"], [role="dialog"], ' +
                '.nav, .navigation, .menu, .sidebar, .header, .footer, ' +
                '.ad, .ads, .advertisement, .cookie, .cookie-banner, .gdpr, ' +
                '#nav, #header, #footer, #sidebar, #menu, #cookie, ' +
                '[class*="nav"], [class*="menu"], [class*="cookie"], [class*="banner"], ' +
                '[class*="footer"], [class*="header"], [id*="nav"], [id*="footer"]'
            );
            noise.forEach(el => el.remove());
            // Prefer the semantic main content area if it exists
            const main = clone.querySelector(
                'main, [role="main"], #main, #mainContent, #srp-river-results, ' +
                '.main-content, .product-content, .search-results, .results, ' +
                'article, .article, [class*="result"], [class*="listing"]'
            );
            const target = main || clone;
            let text = (target.innerText || target.textContent || '').trim();
            // Collapse runs of whitespace/blank lines
            text = text.replace(/[ \\t]{2,}/g, ' ');
            text = text.replace(/\\n{3,}/g, '\\n\\n');
            // Drop very short lines (nav link fragments under 4 chars)
            text = text.split('\\n').filter(l => l.trim().length > 3 || l.trim() === '').join('\\n');
            return text.trim();
        }
        """
        text = await page.evaluate(script)
        text = text.strip()
        text = re.sub(r'\n{3,}', '\n\n', text)
        
        if len(text) > 50000:
            text = text[:50000] + "\n\n[TRUNCATED: Exceeded 50,000 character limit]"
            
        return {
            "success": True,
            "text": text,
            "char_count": len(text),
            "url": page.url
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/screenshot")
async def take_screenshot(req: ScreenshotRequest):
    try:
        page = await get_page(req.session_id)
        screenshot_bytes = await page.screenshot(type="png", full_page=True)
        screenshot_b64 = base64.b64encode(screenshot_bytes).decode('utf-8')
        
        return {
            "success": True,
            "screenshot_b64": screenshot_b64,
            "url": page.url,
            "title": await page.title()
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/extract_listings")
async def extract_listings(req: SessionRequest):
    try:
        page = await get_page(req.session_id)
        script = """
        () => {
            const items = [];

            // eBay search results
            // Filter ghost/nav items: only real product pages contain /itm/ in the URL
            const EBAY_SKIP = new Set(['shop on ebay', 'skip to main content', 'results matching fewer words']);
            const ebayItems = document.querySelectorAll('.s-item:not(.s-item--placeholder)');
            if (ebayItems.length > 0) {
                ebayItems.forEach(item => {
                    const title = item.querySelector('.s-item__title span[role="heading"], .s-item__title')?.innerText?.trim();
                    const price = item.querySelector('.s-item__price')?.innerText?.trim();
                    const url   = item.querySelector('.s-item__link')?.href || '';
                    const cond  = item.querySelector('.SECONDARY_INFO, .s-item__subtitle')?.innerText?.trim();
                    const ship  = item.querySelector('.s-item__shipping, .s-item__freeXDays')?.innerText?.trim();
                    if (title && !EBAY_SKIP.has(title.toLowerCase()) && url.includes('/itm/')) {
                        items.push({ title, price: price || '', url, condition: cond || '', shipping: ship || '' });
                    }
                });
                if (items.length > 0) return { site: 'ebay', items };
            }

            // Google Shopping results
            const gShopItems = document.querySelectorAll('.sh-dgr__content, .sh-pr__product-results-grid .sh-dlr__list-result, [data-sh-dgr]');
            if (gShopItems.length > 0) {
                gShopItems.forEach(item => {
                    const title = item.querySelector('h3, .tAxDx, .sh-np__product-title')?.innerText?.trim();
                    const price = item.querySelector('.a8Pemb, .OFFNJ, [data-price]')?.innerText?.trim();
                    const merchant = item.querySelector('.aULzUe, .IuHnof, .sh-np__seller-name')?.innerText?.trim();
                    const linkEl = item.querySelector('a[href]');
                    const url = linkEl?.href || '';
                    if (title && url) {
                        items.push({ title, price: price || '', url, condition: merchant || '', shipping: '' });
                    }
                });
                if (items.length > 0) return { site: 'google_shopping', items };
            }

            // Google Shopping list view (alternate layout)
            const gShopRows = document.querySelectorAll('.mnr-c, .g .sh-dlr__list-result');
            if (gShopRows.length > 0) {
                gShopRows.forEach(item => {
                    const title = item.querySelector('h3, h4')?.innerText?.trim();
                    const price = item.querySelector('[data-price], .e10twf')?.innerText?.trim();
                    const linkEl = item.querySelector('a[href]');
                    const url = linkEl?.href || '';
                    if (title && url) {
                        items.push({ title, price: price || '', url, condition: '', shipping: '' });
                    }
                });
                if (items.length > 0) return { site: 'google_shopping', items };
            }

            // Amazon search results
            const amznItems = document.querySelectorAll('[data-component-type="s-search-result"]');
            if (amznItems.length > 0) {
                amznItems.forEach(item => {
                    const title = item.querySelector('h2 a span')?.innerText?.trim();
                    const price = item.querySelector('.a-price .a-offscreen')?.innerText?.trim();
                    const linkEl = item.querySelector('h2 a');
                    let url = linkEl?.href || '';
                    try { url = new URL(url).origin + new URL(url).pathname; } catch {}
                    const rating = item.querySelector('.a-icon-alt')?.innerText?.trim();
                    if (title && url) {
                        items.push({ title, price: price || '', url, condition: rating || '', shipping: '' });
                    }
                });
                return { site: 'amazon', items };
            }

            // Generic fallback — collect visible product-like links
            const seen = new Set();
            document.querySelectorAll('a[href]').forEach(a => {
                const url = a.href;
                const text = a.innerText?.trim();
                if (text && text.length > 8 && !seen.has(url) && url.startsWith('http')) {
                    seen.add(url);
                    items.push({ title: text, price: '', url, condition: '', shipping: '' });
                }
            });
            return { site: 'generic', items: items.slice(0, 60) };
        }
        """
        data = await page.evaluate(script)
        items = data.get("items", [])
        return {
            "success": True,
            "site": data.get("site", "generic"),
            "items": items,
            "count": len(items),
            "text": json.dumps(items),  # stored as result_text in DB
            "url": page.url,
            "title": await page.title()
        }
    except Exception as e:
        return {"success": False, "error": str(e), "text": ""}

@app.post("/close_browser")
async def close_browser(req: SessionRequest):
    try:
        global _contexts, _last_activity
        ctx = _contexts.pop(req.session_id, None)
        _last_activity.pop(req.session_id, None)
        
        if ctx:
            await ctx.clear_cookies()
            await ctx.close()
            
        return {"success": True}
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/click")
async def click_element(req: ClickRequest):
    try:
        page = await get_page(req.session_id)
        locator = page.locator(f"[data-ai-index='{req.element_index}']")
        if await locator.count() == 0:
            return {"success": False, "error": "Element not found"}
        await locator.click()
        try:
            await page.wait_for_load_state("networkidle", timeout=1000)
        except:
            pass
        return {
            "success": True, "url": page.url, "title": await page.title(), "page_changed": True
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/type_text")
async def type_text(req: TypeTextRequest):
    try:
        page = await get_page(req.session_id)
        locator = page.locator(f"[data-ai-index='{req.element_index}']")
        if await locator.count() == 0:
            return {"success": False, "error": "Element not found"}
        input_type = await locator.get_attribute("type")
        if input_type == "password":
            print(f"Warning: typing into password field in session {req.session_id}")
        await locator.fill(req.text)
        return {"success": True}
    except Exception as e:
        return {"success": False, "error": str(e)}

ALLOWED_KEYS = {"Enter", "Tab", "Escape", "ArrowUp", "ArrowDown", "ArrowLeft", "ArrowRight", "Backspace", "Delete", "Home", "End", "PageUp", "PageDown"} | {f"F{i}" for i in range(1, 13)}

@app.post("/press_key")
async def press_key(req: PressKeyRequest):
    if req.key not in ALLOWED_KEYS:
        return {"success": False, "error": f"Key {req.key} not allowed"}
    try:
        page = await get_page(req.session_id)
        await page.keyboard.press(req.key)
        try:
            await page.wait_for_load_state("networkidle", timeout=1000)
        except:
            pass
        return {"success": True}
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/scroll")
async def scroll(req: ScrollRequest):
    try:
        page = await get_page(req.session_id)
        dx, dy = 0, 0
        if req.direction == "up": dy = -req.amount
        elif req.direction == "down": dy = req.amount
        elif req.direction == "left": dx = -req.amount
        elif req.direction == "right": dx = req.amount
        await page.mouse.wheel(dx, dy)
        return {"success": True}
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/download_file")
async def download_file(req: DownloadRequest):
    try:
        page = await get_page(req.session_id)
        locator = page.locator(f"[data-ai-index='{req.element_index}']")
        if await locator.count() == 0:
            return {"success": False, "error": "Element not found"}
        
        async with page.expect_download() as download_info:
            await locator.click()
        download = await download_info.value
        
        save_dir = os.path.join(req.app_data_dir, "browser_downloads", req.session_id)
        os.makedirs(save_dir, exist_ok=True)
        filename = download.suggested_filename
        file_path = os.path.join(save_dir, filename)
        
        await download.save_as(file_path)
        
        sha256_hash = hashlib.sha256()
        with open(file_path, "rb") as f:
            for byte_block in iter(lambda: f.read(4096), b""):
                sha256_hash.update(byte_block)
                
        return {
            "success": True,
            "filename": filename,
            "file_path": file_path,
            "sha256": sha256_hash.hexdigest(),
            "size_bytes": os.path.getsize(file_path)
        }
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/save_session_profile")
async def save_session_profile(req: SaveSessionProfileRequest):
    try:
        ctx = await get_context(req.session_id)
        cookies = await ctx.cookies()
        cookies_json = json.dumps(cookies)
        # Obfuscate via base64 for over-the-wire
        cookies_blob = base64.b64encode(cookies_json.encode('utf-8')).decode('utf-8')
        return {"success": True, "cookies_blob": cookies_blob}
    except Exception as e:
        return {"success": False, "error": str(e)}

@app.post("/load_session_profile")
async def load_session_profile(req: LoadSessionProfileRequest):
    try:
        ctx = await get_context(req.session_id)
        cookies_json = base64.b64decode(req.cookies_blob).decode('utf-8')
        cookies = json.loads(cookies_json)
        await ctx.add_cookies(cookies)
        return {"success": True}
    except Exception as e:
        return {"success": False, "error": str(e)}

class ExportTraceRequest(BaseModel):
    session_id: str
    app_data_dir: str

@app.post("/export_trace")
async def export_trace(req: ExportTraceRequest):
    try:
        ctx = await get_context(req.session_id)
        save_dir = os.path.join(req.app_data_dir, "browser_traces")
        os.makedirs(save_dir, exist_ok=True)
        file_path = os.path.join(save_dir, f"{req.session_id}_trace.zip")
        await ctx.tracing.stop(path=file_path)
        # Restart tracing in case they continue
        await ctx.tracing.start(snapshots=True, screenshots=True, sources=True)
        return {"success": True, "trace_path": file_path}
    except Exception as e:
        return {"success": False, "error": str(e)}

if __name__ == "__main__":
    uvicorn.run(app, host="127.0.0.1", port=7870)