Brandon LiandClaude Opus 5
54221bbc0c
Builds the pipeline the autobuyer needs: see the page, find an element, click it. extension/ — MV3 Chromium extension. Polls /api/autobuyer/status and, while on, scrapes the target tab's HTML and posts it back. Also serves locate requests: focuses the window, scrolls the element into view, and reports its position. host_permissions is scoped to tradeify plus localhost so it cannot read other sites — an empty target pattern would otherwise capture whatever tab happened to be active, including banking or mail. app/api/autobuyer/ — status toggle, capture store, and the locate request queue. CORS is open because the extension's origin changes every time an unpacked extension is reloaded. app/autobuyer/page.tsx — ON switch, source view (default) and a rendered view. The render uses sandbox="allow-scripts" without allow-same-origin: the page's own JS is needed because sites ship content at opacity:0 and fade it in, but the frame must not reach the dashboard's same-origin API routes, which serve firm credentials. clicker/ — Python CLI. Asks the extension where a selector is, adds the element rect to the window's screen position and the browser chrome height to get desktop coordinates, then clicks with a human motion model (curved path, eased velocity, occasional overshoot, dwell before press). Raises the browser application first, since macOS consumes a click on an unfocused window rather than delivering it. Refuses to click when the element is covered by an overlay, when the coordinates fall off-screen, or when the browser cannot be confirmed frontmost. Verified: API round-trips, capture pruning, locate claim-once semantics, motion geometry and timing, and focus activation — the last two against stubs, since pyautogui and pyobjc are not installed here. NOT verified end to end: Chrome is still running a stale build of the extension, so a locate request has never completed against a real page and no real click has been sent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
20 lines
840 B
TypeScript
20 lines
840 B
TypeScript
import { NextResponse } from 'next/server';
|
|
|
|
/** The Chromium extension calls these routes from a background service worker,
|
|
* whose Origin is `chrome-extension://<id>`. The id changes every time the
|
|
* unpacked extension is reloaded, so we allow any origin — these routes are
|
|
* only ever reachable on the LAN behind the port-3000 firewall rule. */
|
|
export const CORS_HEADERS = {
|
|
'Access-Control-Allow-Origin': '*',
|
|
'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
|
|
'Access-Control-Allow-Headers': 'Content-Type',
|
|
} as const;
|
|
|
|
export function corsJson(body: unknown, init?: { status?: number }) {
|
|
return NextResponse.json(body, { status: init?.status ?? 200, headers: CORS_HEADERS });
|
|
}
|
|
|
|
export function corsPreflight() {
|
|
return new NextResponse(null, { status: 204, headers: CORS_HEADERS });
|
|
}
|