用 Agent 自动操作内部 OA：从加密登录到低代码表单写入，我踩的 9 个坑

打开列表 → 翻页 → 找到目标行 → 点「修改」 → 等表单渲染 → 定位字段 → 改值 → 保存 → 关抽屉

<html><head></head><body></body></html>

# 在你自己的桌面终端里执行一次；独立配置目录，不动日常浏览器
microsoft-edge-stable \
  --remote-debugging-port=9222 \
  --user-data-dir="$HOME/.config/edge-agent" \
  --no-first-run --no-default-browser-check

// Node ≥ 22 自带全局 WebSocket，零依赖
const list = await (await fetch('http://127.0.0.1:9222/json/list')).json();
const page = list.filter(t => t.type === 'page')
                 .find(t => t.url.includes('oa.example.internal'));
const ws = new WebSocket(page.webSocketDebuggerUrl);
let id = 0;
const send = (method, params = {}) => new Promise((res) => {
  const myId = ++id;
  const onMsg = (e) => {
    const m = JSON.parse(e.data);
    if (m.id === myId) { ws.removeEventListener('message', onMsg); res(m.result); }
  };
  ws.addEventListener('message', onMsg);
  ws.send(JSON.stringify({ id: myId, method, params }));
});
const evaluate = async (expr, awaitPromise = false) => {
  const r = await send('Runtime.evaluate',
    { expression: expr, returnByValue: true, awaitPromise });
  if (r.exceptionDetails) throw new Error(r.exceptionDetails.text);   // 别漏这行
  return r.result.value;
};

// des-encrypt.mjs —— node --openssl-legacy-provider des-encrypt.mjs "明文" "种子"
import crypto from 'node:crypto';
const [plain, seed] = process.argv.slice(2);

// OpenSSL 的 EVP_BytesToKey(MD5, 1 次迭代)：用"种子+盐"反复 MD5 凑够 key 和 iv
const salt = crypto.randomBytes(8);
const d = [];
let prev = Buffer.alloc(0);
while (Buffer.concat(d).length < 16) {
  prev = crypto.createHash('md5')
    .update(Buffer.concat([prev, Buffer.from(seed), salt])).digest();
  d.push(prev);
}
const keyiv = Buffer.concat(d);
const cipher = crypto.createCipheriv('des-cbc', keyiv.subarray(0, 8), keyiv.subarray(8, 16));
const out = Buffer.concat([Buffer.from('Salted__'), salt,
                           cipher.update(Buffer.from(plain, 'utf8')), cipher.final()]);
console.log(out.toString('base64'));

// 必须在页面上下文里执行；由于用到 Promise，evaluate 时要 awaitPromise: true
const r = await send('Runtime.evaluate', {
  expression: `(async () => {
    const res  = await fetch('/verifyCodeImage.jpg?v=' + Date.now());
    const blob = await res.blob();
    return await new Promise(ok => {
      const fr = new FileReader();
      fr.onload = () => ok(fr.result.split(',')[1]);   // base64
      fr.readAsDataURL(blob);
    });
  })()`,
  awaitPromise: true, returnByValue: true
});
require('node:fs').writeFileSync('captcha.png', Buffer.from(r.result.value, 'base64'));

{"url":"/cap4/businessTemplateController.do?method=...","name":"..."}

import re, json, requests
html = session.get(PORTAL_URL).text
menus = re.findall(r'\{"url":"(/cap4/[^"]+)","name":"([^"]+)"\}', html)
open('menus.json', 'w', encoding='utf8').write(
    json.dumps(dict(menus), ensure_ascii=False, indent=2))
print(f'抓到 {len(menus)} 个业务列表入口')

文档序 TR 索引：表头 TR0，数据 TR1..TR200，操作 TR201..TR400
所以：操作行 TR 索引 = 201 + (数据行 TR 索引 − 1)

// 取全部数据行文本（与表头一一对应）
const doc = frames[0].document;
const rows = [...doc.querySelectorAll('tr.v-easy-table-row')];
const texts = rows.map(tr => tr.innerText.split('\n'));
console.log(texts.length, '行');            // 200

主文档
└── frames[0]                       列表页（数据在这）
    └── iframe#targetFrame          抽屉里的表单外壳
        └── 再嵌一层 form 页面        真正的表单 DOM  ★ 字段在这里

const L3 = () => frames[0].document
                         .getElementById('targetFrame').contentWindow
                         .document.querySelector('iframe').contentWindow;
// 等它渲染出来：轮询 L3().document.querySelectorAll('input,textarea').length > 0

// ❌ 抛 "not a valid selector"，因为 | 在 CSS 里是命名空间分隔符
d.querySelector('.cap-field.formmain_1399|field0152');
// ✅ 用属性包含匹配
d.querySelector('[class*="field0152"]');

const w = L3();
const inp = w.document.querySelector('[class*="field0152"] input');
const setter = Object.getOwnPropertyDescriptor(
  w.HTMLInputElement.prototype, 'value').set;
setter.call(inp, '新值');
for (const type of ['input', 'change', 'blur']) {
  inp.dispatchEvent(new w.Event(type, { bubbles: true }));
}

const btn = [...w.document.querySelectorAll('span')]
  .filter(e => e.children.length === 0 && e.innerText.trim() === '保存并关闭')
  .map(e => e.closest('button') || e)[0];
btn.click();

window.opener === null
getA8ParentWindow() → Cannot read properties of undefined (reading 'isCtpTop')