Files
reverse-engineering-anything/src/browser/protocol/CdpEvents.ts
T
morluto abd36dd250 refactor(browser): parse Runtime and Debugger events once by registered schemas (#10742)
* refactor(browser): parse frame lifecycle events once by a registered event schema

CdpConnection admits each event through protocol/CdpEvents.ts, which parses
the five Page frame lifecycle events once into identity facts plus a frame
URL observation, like a frame-tree node. Screenshot, page capture, the
observation timeline, WebMCP, Electron inspection and the execution window
read those facts instead of re-parsing the raw payload; CdpFrameFacts no
longer carries the raw source record. Playwright CDP session subscriptions
name an event from Playwright's protocol table, and an architecture guard
counts the remaining raw event payload reads so they can only shrink.

* refactor(browser): parse Runtime and Debugger events once by registered schemas

Register Debugger.scriptParsed, Debugger.scriptFailedToParse,
Runtime.executionContextCreated, Runtime.executionContextDestroyed and
Runtime.consoleAPICalled. Script and context payloads carry both the
tolerant facts passive capture uses and the active runtime's strict
declaration, derived from one parse, plus the declaration's byte size for
the runtime retention budget. Page capture, Electron script capture, the
V8 Inspector provider and the runtime source inventory now read the
registered payload. The cdp-raw-event-params baseline drops from 20 to 7.

* refactor(browser): admit transport events through the registered-event owner

Remove the unused cdpFrameUrl wrapper; its fragment cases now exercise
observeCdpFrameUrl. Add a connection-level test that two subscribers share
one parsed payload and the raw params.

* fix(browser): report an unserializable event declaration's size instead of throwing

JSON.stringify can throw on a declaration JSON.parse accepted (nesting
deeper than the serializer's stack). The registry sized script and context
declarations inside the connection's WebSocket callback, so such an event
escaped as an uncaught exception. The size is now a Result; the runtime
source inventory raises the failure inside its own catch, as before.

* refactor(browser): parse Network events once by registered schemas (#10743)

* refactor(browser): parse Network events once by registered schemas

Register Network.requestWillBeSent, responseReceived, loadingFinished,
loadingFailed, webSocketCreated and webSocketFrameSent/Received. The
request payload carries the tolerant facts page capture and the timeline
read plus the active runtime's strict declaration. Page capture's network
and WebSocket handlers, the timeline's request tracking and the runtime
request inventory now read the registered payload. The
cdp-raw-event-params baseline drops from 7 to 5.

* refactor(browser): drop payload helpers the capture handlers no longer use

* refactor(browser): read every CDP event payload through the registry (#10745)

* refactor(browser): read every CDP event payload through the registry

Register Target.attachedToTarget, Target.detachedFromTarget,
Page.lifecycleEvent and WebMCP.toolsAdded/toolsRemoved, and carry a
requested navigation's reason and a commit's transition type in the
frame-event payload. The timeline no longer threads raw params into its
entries: each entry receives its timestamp, frame and loader identity
explicitly. WebMCP discovery, the service-worker policy blocker and the
target-event matcher read the registered payload. With no raw reads left,
the cdp-raw-event-params guard is enforced at zero instead of counted.

* refactor(browser): drop raw payload helpers the timeline and worker blocker no longer use

* refactor(browser): type Playwright CDP session events by the registry (#10751)

PlaywrightCdpSession.on subscribes only to registered events and hands
the listener the payload parsed by its registered schema, returning the
unsubscribe function. Private storage seeding reads registered payloads,
including the events of non-flat child sessions, and applies its strict
seeding policy to the parsed facts. Its local attach, detach, nested
message and pause schemas and the storage-only script/context schemas are
removed; Debugger.paused, Runtime.executionContextsCleared and
Target.receivedMessageFromTarget join the registry.

* test(browser): admit fake policy events through the event registry

The service-worker policy now reads event.registered, but the PlaywrightScenarioSession fake connection delivered raw events, so three detached-target tests never reached the policy. The fake now admits each event with receiveCdpEvent as CdpConnection does.

* fix(browser): fail the CDP session closed when an event listener throws (#10758)

* fix(browser): fail the CDP session closed when an event listener throws

An exception from a CDP event subscriber escaped CdpTransportCore's socket message callback uncaught (for example the service-worker blocker's protocol_error on a Target event without a sessionId). The transport now stops delivery, fails the connection as a protocol error whose cause is the listener's exception, rejects pending and later commands with it, and notifies protocol-failure subscribers. The Playwright CDP session relay applies the same rule to its event listeners.

* fix(browser): report a failed service-worker policy connection at the next policy check

The policy's event listener rejects a malformed Target event, which now fails its connection. With no policy command pending, nothing reported it and later iframe targets went unprotected. The policy records its connection's protocol failure and assertBlocked, run before each scenario step, rethrows it.

* fix(browser): keep cleanup commands available after a listener failure

A listener failure no longer marks the wire as broken. The transport still rejects pending commands, notifies protocol-failure subscribers, stops delivering events and refuses reuse, but it keeps reading replies and admits commands sent in cleanup grace. The service-worker policy can then remove its init scripts, restore the main realm, detach and release its socket. Wire-level protocol errors still refuse every later command. The PlaywrightScenarioSession policy fake gains onProtocolFailure, which the policy now subscribes to.

* refactor(browser): keep raw CDP event payloads out of the received event (#10764)

* refactor(browser): keep raw CDP event payloads out of the received event

CdpReceivedEvent and CdpTransportEvent no longer carry params: receiveCdpEvent hands the raw payload only to the registered schema, so a subscriber cannot read it by property access, destructuring or computed keys. This supersedes the event.params text guard in architecture-guards, which is removed.

* refactor(browser): read registered event payloads in the JavaScript verifiers

The runtime, storage and URL-userinfo verifiers subscribe to CdpConnection, which no longer hands subscribers raw params. They now read event.registered. A test scans every scripts/ onEvent callback for raw payload reads, since the TypeScript check does not cover them. The storage verifier's pause trace records a malformed pause instead of the unregistered reason member.

* refactor(browser): track the timeline's main frame with the document tracker (#10779)

TimelineCapture kept its own mutable main frame id and replaced it on a root replacement. It now holds the CdpDocumentTracker that CdpTargetSession owns and observes the replacement document through it; every main-frame check (lifecycle, navigation, document request, redirect) reads the tracker's current frame. A characterization test pins that the replaced root's lifecycle events are no longer recorded.

* refactor(browser): select CDP events only by their registered name (#10829)

CdpReceivedEvent carried the wire method as a plain string, so a subscriber
could compare it with a misspelt or unregistered name and the check compiled
but never matched. Three owners selected Inspector.targetCrashed, an
unregistered event, that way.

Register Inspector.targetCrashed and drop the wire method from the received
event. Subscribers select events by registered.method, whose type is the
registered event names. The capture coverage start keeps reading the
wire domain, now the event's domain field.

* fix(browser): retire a policy child session that CDP reports gone

After a listener failure the connection stops delivering events, so an
iframe's Target.detachedFromTarget never retires its policy target. Cleanup
then sent Page.removeScriptToEvaluateOnNewDocument to the dead session,
kept the stale child, and every retry failed before detaching the root.

The service-worker policy owner now treats CDP's session-not-found
rejection as proof that the child is gone and retires it. The classifier
moves from CdpTargetSession to CdpCommandRejection, its owner, and the
target-session detach path uses the same one.

* refactor(browser): route target events through one session owner (#10835)

* refactor(browser): route target events through one session owner

Page capture, WebMCP discovery, screenshot capture and the runtime sources
each compared the envelope session ID themselves, while the observation
window and execution collection used cdpTargetEventMatches, which also
routes the root Target.detachedFromTarget that names the target's session.

onCdpTargetEvent in CdpTargetEvents.ts now subscribes every target consumer
with that one rule; the matcher is private and the per-subscriber
comparisons are removed. Electron inspection keeps its own filter while
its capture isolation awaits a maintainer decision.

* fix(browser): report WebMCP subframe tools whose document is unverified (#10839)

* fix(browser): report WebMCP subframe tools whose document is unverified

A committed subframe navigation kept the frame's tools silently when CDP
reported no loader at the same URL, and removed them on any URL change even
when the loader proved the same document.

Each frame now carries a CdpDocumentTracker, the session's document
identity owner. Only a proven change removes the frame's tools. An unknown
comparison keeps them visible, marks webmcp_tools attach-limited and names
the frames whose document identity could not be established.

* test(browser): prove an unverified live subframe limits WebMCP coverage

* fix(browser): key a WebMCP registration by its frame and tool name

A subframe tool kept across a committed navigation that changed the URL
but not the loader was stored under a key built from the old URL, so a
later toolsAdded for the same frame and name added a second entry.
Registrations are now keyed by frame and name; tool_key still records the
registering frame URL.

* test(browser): deliver fake CDP events through the transport's admission (#10840)

Event fakes each rebuilt the received event: CdpAgentHints typed its
listeners as raw wire events behind an unknown cast, and the Electron,
scenario-session and routing tests each wrapped receiveCdpEvent by hand.

fakeCdpEvents (tests/fixtures) is a CdpConnection.onEvent fake whose emit
admits each raw event with receiveCdpEvent and the wire byte count, so a
change to the received event shape fails at the fake instead of silently
not exercising subscribers.

* refactor(browser): own the selected page generation in one target document tracker (#10860)

* refactor(browser): own the selected page generation in one target document tracker

Page capture, screenshot, the observation window, the runtime session and
the execution window each built a document tracker or rule of their own
from root-frame navigation events. CdpTargetDocument now follows the target
session's root-frame events and the frame-tree replies its consumers read,
classifies root identity once, and reports each navigation to consumers
that decide only what it means for their evidence.

* fix(browser): report a lost scenario policy connection before the next step (#10864)

* fix(browser): report a lost scenario policy connection before the next step

The service-worker policy recorded only protocol failures. When its CDP
socket closed or its page session detached, later documents lost the
blocking script, but the scenario learned of it only when a frame check
found an unprotected realm. The owner now records the disconnect or
detach when CDP reports it; the next policy check and the next step's
action report it first.

* fix(browser): refuse an unregistered CDP command before it reaches the browser (#10868)

JavaScript verifiers can name any command, and the send owners refused an
unregistered one only when its reply arrived, after the browser had acted
on it. CdpConnection and the Playwright session now refuse the name before
sending, and the Playwright session refuses an unregistered event name
instead of subscribing to events no listener receives. The verifier text
scan stays as an early warning and documents what it cannot see.

* fix(browser): keep a proven root change and the loaderless selection's uncertainty

Two review findings on the target document owner. A root event naming
another frame with a malformed loader set `changed` but was announced as
unidentified, so the execution window failed with protocol_error and
dropped what it had collected; the owner now announces it as the proven
change it is. The runtime session compared each frame-tree reply with the
tracker's current document, which can learn a loader from an event, so a
loaderless selection followed by an event and a reply with that loader
compared as same; it now compares the reply with the selected document
through the owner, and reports target_changed as before.

* test(browser): refuse the next scenario step after the policy session detaches

* refactor(browser): read WebMCP document identity from the target document owner (#10884)

* refactor(browser): read WebMCP document identity from the target document owner

WebMCP discovery compared the first and last frame-tree roots itself and
kept a document tracker per subframe. CdpTargetDocument now follows the
selected root and each committed subframe for it: the final frame tree
feeds the owner, a root change proven by a navigation event during
discovery is target_changed as in page capture, and a subframe whose
committed document changed loses its tools. A subframe navigation without
a loader still keeps the tools and reports them as unverified.

* fix(browser): start a subframe first seen within its document with an unknown loader

A subframe absent from the initial frame tree and first seen through Page.navigatedWithinDocument had no document tracker, so a later commit started a fresh one and the tools it registered meanwhile lost the unverified-document limitation. The owner now starts such a subframe with an unknown loader.

* fix(browser): refuse a verifier's unregistered CDP event name at subscription (#10885)

JavaScript verifiers subscribed to every event with CdpConnection.onEvent
and compared registered.method with a string literal. A misspelt or
unregistered name never matched and the verifier waited until its timeout.
CdpConnection.onRegisteredEvent now takes one event name, refuses an
unregistered one before subscribing (the same registry check the Playwright
session applies), and hands the listener only that event's registered
parse. The verifiers subscribe only through it, and the evaluation test
rejects a raw onEvent subscription in scripts.

* fix(browser): keep subframe documents by frame and loader without their URLs
2026-11-15 19:54:17 +08:00

324 lines
11 KiB
TypeScript

import type { CDPSession } from "playwright-core";
import { z } from "zod";
import { BrowserObservationError } from "../../domain/browserObservationError.js";
import type { BrowserObservationOperation } from "../../domain/browserObservationErrors.js";
import { err, ok, type Result } from "../../domain/result.js";
import {
observeCdpFrameUrl,
type CdpFrameUrlObservation,
} from "../CdpCaptureDocuments.js";
import { topCallFrame } from "../CdpCaptureEventHelpers.js";
import {
admitRecords,
cdpStringValue,
numberValue,
recordValue,
} from "../CdpCaptureValues.js";
import {
cdpFrameEventPayloadFacts,
type CdpFrameEventKind,
type CdpFrameFacts,
} from "../CdpFrameIdentity.js";
import {
readCdpLoadingFailed,
readCdpLoadingFinished,
readCdpRequestWillBeSent,
readCdpResponseReceived,
readCdpWebSocketCreated,
readCdpWebSocketFrame,
runtimeRequestSchema,
} from "../CdpNetworkEventFacts.js";
import {
readCdpExecutionContextCreated,
readCdpExecutionContextDestroyed,
readCdpScriptParsed,
runtimeContextSchema,
runtimeScriptParsedSchema,
} from "../CdpScriptContextFacts.js";
// Playwright ships the generated protocol event table only through the
// generic `CDPSession.on` overload, which precedes its `'close'` and
// `'event'` session overloads.
type ProtocolEventOverload<On> = On extends {
(event: infer Event, listener: never): unknown;
(event: "close", listener: never): unknown;
(event: "event", listener: never): unknown;
}
? Event
: never;
/** Every event name in the protocol version Playwright ships. */
export type CdpProtocolEvent = Exclude<
ProtocolEventOverload<CDPSession["on"]>,
symbol
>;
/**
* One frame lifecycle event, parsed once at the connection. It has the same
* shape as a frame-tree node: identity facts plus the frame URL observation.
* Malformed identity stays in `facts` as explicit issues, never as absence.
*/
export interface CdpFrameEvent {
readonly facts: CdpFrameFacts;
/** `missing` for attach and detach events, which carry no URL. */
readonly url: CdpFrameUrlObservation;
/** The reported reason of a requested navigation. */
readonly reason: string | undefined;
/** The committed frame's reported transition type. */
readonly transitionType: string | undefined;
}
const frameEvent = (kind: CdpFrameEventKind) =>
z.unknown().transform((params): CdpFrameEvent => {
const record = recordValue(params);
const urlSource =
kind === "navigated"
? recordValue(record?.frame)
: kind === "within_document" || kind === "requested"
? record
: undefined;
return {
facts: cdpFrameEventPayloadFacts(kind, params),
url: observeCdpFrameUrl(urlSource),
reason: kind === "requested" ? cdpStringValue(record?.reason) : undefined,
transitionType:
kind === "navigated"
? cdpStringValue(recordValue(record?.frame)?.transitionType)
: undefined,
};
});
/**
* UTF-8 JSON size of a declaration as the producer sent it, for retention
* budgets. Serialization can fail on input that parsed (for example, nesting
* deeper than the serializer's stack); that failure is a fact for the budget
* owner to report, never an exception in the connection's event callback.
*/
const declarationBytes = (params: unknown): Result<number, unknown> => {
try {
return ok(Buffer.byteLength(JSON.stringify(params) ?? ""));
} catch (cause: unknown) {
return err(cause);
}
};
/**
* A script declaration has two admission policies: passive capture keeps
* tolerant facts and records gaps, while the active runtime requires the
* complete declaration. Both are derived here, once.
*/
const scriptEvent = z.unknown().transform((params) => ({
facts: readCdpScriptParsed(params),
runtime: runtimeScriptParsedSchema.safeParse(params),
declarationBytes: declarationBytes(params),
}));
const executionContextCreated = z.unknown().transform((params) => ({
facts: readCdpExecutionContextCreated(params),
runtime: runtimeContextSchema.safeParse(params),
declarationBytes: declarationBytes(params),
}));
/**
* The console call site, argument inventory, timestamp and type. A malformed
* stack stays a failure; malformed arguments keep their positions so
* retained siblings keep their CDP argument indices.
*/
const consoleApiCalled = z.unknown().transform((params) => {
const record = recordValue(params);
return {
topFrame: topCallFrame(record?.stackTrace),
arguments: admitRecords(record?.args)?.map((argument) =>
recordValue(argument),
),
timestamp: numberValue(record?.timestamp),
type: cdpStringValue(record?.type),
};
});
/** Passive capture and the timeline read tolerant facts; the active runtime requires the declaration. */
const requestWillBeSent = z.unknown().transform((params) => ({
facts: readCdpRequestWillBeSent(params),
runtime: runtimeRequestSchema.safeParse(params),
}));
/** The flat session a target event names; undefined when missing or malformed. */
const targetDetached = z.unknown().transform((params) => ({
sessionId: cdpStringValue(recordValue(params)?.sessionId),
}));
const targetAttached = z.unknown().transform((params) => {
const record = recordValue(params);
const targetInfo = recordValue(record?.targetInfo);
return {
sessionId: cdpStringValue(record?.sessionId),
targetId: cdpStringValue(targetInfo?.targetId),
targetType: cdpStringValue(targetInfo?.type),
};
});
/** A non-flat child session's protocol message, still JSON text. */
const targetMessage = z.unknown().transform((params) => {
const record = recordValue(params);
return {
sessionId: cdpStringValue(record?.sessionId),
message: cdpStringValue(record?.message),
};
});
/**
* A pause's call frames. Resuming is target-wide, so a consumer that resumes
* needs every frame's identity; the declaration is kept as one parse result.
*/
const debuggerPaused = z.unknown().transform((params) =>
z
.object({
callFrames: z.array(
z.object({
callFrameId: z.string(),
location: z.object({ scriptId: z.string() }),
}),
),
})
.safeParse(params),
);
/** A frame lifecycle milestone; the timeline decides frame selection and time policy. */
const lifecycleEvent = z.unknown().transform((params) => {
const record = recordValue(params);
return {
frameId: cdpStringValue(record?.frameId),
loaderId: cdpStringValue(record?.loaderId),
name: cdpStringValue(record?.name),
timestamp: numberValue(record?.timestamp),
};
});
/**
* Declared WebMCP tools. A missing or non-list inventory is undefined, never
* empty; malformed entries keep their positions as undefined.
*/
const webMcpTools = z.unknown().transform((params) => ({
tools: admitRecords(recordValue(params)?.tools)?.map((tool) =>
recordValue(tool),
),
}));
/**
* One payload schema per subscribed event. The connection parses each
* registered event once, before any subscriber sees it. A schema never
* rejects: malformed members become explicit facts that each subscriber
* reports as a protocol failure or a recorded coverage gap.
*/
const CDP_EVENT_PAYLOADS = {
"Page.frameAttached": frameEvent("attached"),
"Page.frameDetached": frameEvent("detached"),
"Page.frameNavigated": frameEvent("navigated"),
"Page.frameRequestedNavigation": frameEvent("requested"),
"Page.navigatedWithinDocument": frameEvent("within_document"),
"Debugger.scriptParsed": scriptEvent,
"Debugger.scriptFailedToParse": scriptEvent,
"Runtime.executionContextCreated": executionContextCreated,
"Runtime.executionContextDestroyed": z
.unknown()
.transform(readCdpExecutionContextDestroyed),
"Runtime.consoleAPICalled": consoleApiCalled,
"Runtime.executionContextsCleared": z.unknown().transform(() => ({})),
"Inspector.targetCrashed": z.unknown().transform(() => ({})),
"Debugger.paused": debuggerPaused,
"Target.receivedMessageFromTarget": targetMessage,
"Network.requestWillBeSent": requestWillBeSent,
"Network.responseReceived": z.unknown().transform(readCdpResponseReceived),
"Network.loadingFinished": z.unknown().transform(readCdpLoadingFinished),
"Network.loadingFailed": z.unknown().transform(readCdpLoadingFailed),
"Network.webSocketCreated": z.unknown().transform(readCdpWebSocketCreated),
"Network.webSocketFrameSent": z.unknown().transform(readCdpWebSocketFrame),
"Target.attachedToTarget": targetAttached,
"Target.detachedFromTarget": targetDetached,
"Page.lifecycleEvent": lifecycleEvent,
"WebMCP.toolsAdded": webMcpTools,
"WebMCP.toolsRemoved": webMcpTools,
"Network.webSocketFrameReceived": z
.unknown()
.transform(readCdpWebSocketFrame),
} as const satisfies {
readonly [E in CdpProtocolEvent]?: z.ZodType<unknown, unknown>;
};
export type CdpEventName = keyof typeof CDP_EVENT_PAYLOADS;
export type CdpEventPayload<E extends CdpEventName> = z.output<
(typeof CDP_EVENT_PAYLOADS)[E]
>;
/** A registered event with its parsed payload, discriminated by method. */
export type CdpRegisteredEvent = {
readonly [E in CdpEventName]: {
readonly method: E;
readonly payload: CdpEventPayload<E>;
};
}[CdpEventName];
/** The registered event of one method (distributes over a union of methods). */
export type CdpRegisteredEventOf<E extends CdpEventName> = Extract<
CdpRegisteredEvent,
{ readonly method: E }
>;
/** Whether a payload schema is registered for this event name. */
export const isCdpEvent = (method: string): method is CdpEventName =>
Object.hasOwn(CDP_EVENT_PAYLOADS, method);
/**
* Refuse a subscription to an event without a registered payload schema: no
* event of that name could reach the listener. TypeScript callers cannot name
* one; JavaScript verifiers can.
*/
export function assertCdpEvent(
method: string,
operation: BrowserObservationOperation,
): asserts method is CdpEventName {
if (!isCdpEvent(method))
throw new BrowserObservationError(operation, "protocol_error", {
detail: `REA refused to subscribe to CDP event ${JSON.stringify(method)}: no payload schema is registered for it.`,
});
}
/** Parse one event's payload by its registered schema, or undefined when unregistered. */
export const registeredCdpEvent = (
method: string,
params: unknown,
): CdpRegisteredEvent | undefined => {
if (!isCdpEvent(method)) return undefined;
const schema: z.ZodType<unknown, unknown> = CDP_EVENT_PAYLOADS[method];
return {
method,
payload: schema.parse(params),
} as CdpRegisteredEvent;
};
const FRAME_EVENTS = [
"Page.frameAttached",
"Page.frameDetached",
"Page.frameNavigated",
"Page.frameRequestedNavigation",
"Page.navigatedWithinDocument",
] as const satisfies readonly CdpEventName[];
type CdpFrameEventName = (typeof FRAME_EVENTS)[number];
const FRAME_EVENT_NAMES: ReadonlySet<string> = new Set(FRAME_EVENTS);
const isFrameEvent = (
event: CdpRegisteredEvent,
): event is Extract<CdpRegisteredEvent, { method: CdpFrameEventName }> =>
FRAME_EVENT_NAMES.has(event.method);
/** The parsed frame lifecycle payload of a registered frame event. */
export const cdpFrameEvent = (event: {
readonly registered: CdpRegisteredEvent | undefined;
}): CdpFrameEvent | undefined =>
event.registered !== undefined && isFrameEvent(event.registered)
? event.registered.payload
: undefined;