Introduce `Registry.resetFrame` to selectively evict nodes owned by
the replaced page's frame. This prevents invalidating node IDs of
sibling pages during concurrent navigations.
frameChildFrameCreated emitted Page.frameAttached with its payload wrapped
in an extra `.{ .params = ... }`. CDP.sendEvent already places the payload
into the event's `params` field, so this produced a malformed wire event
with double-nested params (`params.params.frameId`) — unlike every sibling
frame event in the same function, which passes its fields flat.
CDP clients (e.g. Playwright via connectOverCDP + page.route) parse
frameId/parentFrameId at the top level of params. With the fields one level
too deep the client never registers the child frame, so when that frame's
Fetch.requestPaused arrives it is bare-continued instead of matched against
a route. The result: request interception (page.route / Fetch) silently does
not apply to iframe (sub-frame) document navigations — the iframe loads from
the real network. The interception layer itself was never at fault; it does
emit requestPaused for sub-frames.
Drop the extra wrapper so the payload is flat. Add a regression test that
dispatches frame_child_frame_created and asserts Page.frameAttached carries
frameId/parentFrameId directly under params (fails on the double-nested shape).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a abortParked (to be used instead of abort for a parked transfer) which
guards against a double-free by setting the state to .completing BEFORE running
the requestFailed callback. Without this, requestFail could itself cause the
transfer to be cleared.
Also added a guard to try to catch double transfer deinit's in Debug. Because
the memory could get re-used between the first and second free, the lack of
failure doesn't prove there is no UAF. But it's cheap to do and debug only.
Follow up to https://github.com/lightpanda-io/browser/pull/2789 which adds
better multi-page support for runner. When waiting, callers have the choice
to wait for a specific frame, all current frames, or a given list of frames. The
last one, a given list of frames, is the most flexible, allowing callers to
provide an `until` per frame AND receive a per-frame result.
waitForSelector and waitForScript continue to be per frame (which is now
explicitly given).
Like 2789, while the changes aren't insignificant (Runner is doing important
work), a number of files were touched either purely because of changes in tests
or other superficial changes, e.g. `session.runner` is now infallible.
Cleanup sloppy tests, make sure pages are always closed after page tests - not
before and not never.
Fix a UAF in replaceRootImmediate..if a page is being retired, also retire its
replacement.
Give BrowserContext a Session.PageHandle rather than having a frame_id and re-
implementing PageHandle logic.
Replaces the 1 (+1 inflight) page design of session for an unlimited number of
pages. The main goal is to support a more efficient async goto (1). Without this
commit, async goto has two implementation: multiple browser, which is resource
intensive (thread + isolate per page), bolting it onto sub-frames (like iframe
or popups). The issue with the 2nd version (which I originally suggested) is
that most resources are tied to the Page. So even if an async goto "page" (which
would map to a Frame) is released, most things stay in memory, including the
DOM (page.factory) and the V8::Context.
This new approach adds multiple page support to sessions. The advantage is
pretty clear: the existing memory model (page-tied resources) becomes a strength
of the design, rather than a weakness.
This change is not tirivla, but the diff is inflated by 2 large mechanial
changes, so it isn't _that_ big either. That said, I'd divide this into four
parts.
1 - The old concept of _active/_pending is now baked into the Page itself. A
Page has a `replaces: ?*Page = null` and `replacement: ?*Page = null` field.
2 - Because of #1 above, the Session now just has an `pages: ArrayList(*Page)`.
As much as possible, single-page APIs, like `removePage` no longer exists. We're
trying to present a consistent multi-page API. See #3.
3 - References to *Page and *Frame have always been dangerous. For example,
`lightpanda.fetch` has a block to scope `frame`:
```zig
{
const frame = try session.createPage();
// frame isn't safe to use after navigate, it can be swapped out
_ = try frame.navigate(...)
}
```
While we still hand out *Page and *Frame (user-beware), some of the more
important APIs now take a frame_id which Session can resolve. Furthermore,
createPage now returns a PageHandle which is a safe wrapper around a page/frame.
4 - Two large mechanical changes were made:
a - Many tests were superficially changed to account for new naming or use
a new test-helper to preserve the single-page illusion (because 99% of
tests _are_ single-page)
b - Many CDP changes where `bc.session.currentFrame()` -> `bc.mainFrame()`).
This isn't to say CDP changes are meaningless, but it's mostly 1 change
about how the "main" target/frame_id is tracked (by CDP itself, rather
than the Session) that required a number of superficial changes to
accomodate
`Runner` remains largely single-page focused. Runner and some MCP/Agent tools
continue to be tied to the "currentFrame" or "primaryPage". The Runner is
something I want to address in a follow-up PR, but we need to figure out what
it means to "wait" for multiple pages.
As much as possible, Session becomes multi-page native and has no concept of
a special/first/primary/main page. Users of session become responsible for
tracking pages of interest.
This change is not trivial, but the diff is inflated by 2 large mechanical
changes:
1 - Many tests
(1) https://github.com/lightpanda-io/browser/pull/2759
innerText now uses the StyleManager's visibility check (isHidden) to skip
rendering children which are hidden.
Should allow us to close
https://github.com/lightpanda-io/browser/pull/2741 and
https://github.com/lightpanda-io/browser/issues/2734
Note that ~1000 WPT test still fail because of other style-driven behavior, most
significantly is `white-space`. The isHidden change only fixes a couple WPT
cases, but I think, for end users, it's the more important change (and it's also
the simpler for us to implement). Having wrong spacing is usually less of a
problem than showing the wrong content.
Follow-up to #2664: move the Emulation.setDeviceMetricsOverride viewport
override from the Page to the Browser so it persists across page navigations
for the whole CDP connection, instead of being lost when the page is replaced.
Page.getViewport now delegates to Browser.getViewport, so every viewport
consumer keeps reading through a single path unchanged.
Now that #2694 centralized the default viewport, store an optional override
on the Page and have every viewport consumer read it through
Page.getViewport(): window.innerWidth/innerHeight, screen.width/height/
availWidth, visualViewport.width/height, Page.getLayoutMetrics, the
IntersectionObserver root rect, and matchMedia / the StyleManager media
cascade. This keeps the viewport consistent across all of them instead of
the split-brain a single-property override would create.
Emulation.setDeviceMetricsOverride writes the override (a 0 width or height
keeps that dimension, per the CDP default); clearDeviceMetricsOverride resets
to the default. Not-yet-emulated params (deviceScaleFactor, mobile, scale,
screenWidth/Height) are accepted but logged as not_implemented.
Playwright sends Browser.setDownloadBehavior at the browser level during
connection setup, before any target/context exists. Returning an error there
aborted the whole connection, failing every playwright demo-runner test.
Treat the no-context case as a success no-op, matching the prior behavior.
Browser.setDownloadBehavior was a noop, so Lightpanda had no file-download
path. A response with Content-Disposition: attachment is now streamed to disk
under downloadPath, and Page.downloadWillBegin / Browser.downloadProgress are
emitted when eventsEnabled.
Fixes#2701
This is purely mechanical and was driven almost entirely by Claude. The goal is
simply to break Frame.zig into small / more cohesive components. So instead of
having ~10 observer-specific methods on Frame, they now live in Frame.observers.
In general, our code always takes *Frame as the last parameter (a consequence
that this is the easiest / less ambiguous way to auto-inject a Frame into a
webapi). But, for these, I kept it as the first parameter because it's still
the "receiver" even though the dot syntax isn't applicable.
Address review: permissions set via Browser.grantPermissions / setPermission
now live on the Browser instead of the active Page, so they persist across
page navigations (previously a navigation dropped them) and match how Chrome
scopes permissions to the browser context. navigator.permissions.query() reads
the browser-level state. Also log not_implemented for the origin and
browserContextId params, which are accepted but not yet honored.
These three Browser methods were noops, so a CDP client could not change
what navigator.permissions.query() reports - it always returned "prompt".
Store permission state on the active Page (keyed by permission name) and
have navigator.permissions.query() read it back. grantPermissions sets each
listed permission to "granted", setPermission sets a single permission to an
explicit state, and resetPermissions clears them (query falls back to
"prompt"). State is scoped to the Page and resets on navigation.
Adds a CDP round-trip test exercising all three methods.
Move away from hard-coded 512KB (WS) and 4K (http) limits. Introduces two new
serve-specific command line arguments:
--cdp-max-message-size <INT>
Maximum allowed incoming websocket message size.
Defaults to 1048576 (1MB)
--cdp-max-http-message-size <INT>
Maximum allowed HTTP request size
Defaults to 4096 (maximum allowed: 16383)
--cdp-max-message-size has been bumped from 512KB to 1MB default.
Meant to provide a more robust solution than https://github.com/lightpanda-io/browser/pull/2717
This is a change to https://github.com/lightpanda-io/browser/pull/2706 which
applies the Config.validateUserAgent to CDP's network.setExtraHTTPHeaders. This
makes the CDP method consistent with all other forms of user-agent setting, i.e
not allowing 'mozilla'-container values.
console.log and console.warn were both dispatched as .info, so
Runtime.consoleAPICalled (and Console.messageAdded) reported type
"info" for all three of log/info/warn — clients filtering console
output by severity saw them collapsed into one bucket.
Add log/warning members to ConsoleMessageType (the protocol's wire
values — "warning", not "warn") and map console.log -> log,
console.warn -> warning. info/error/debug/trace already matched.
Closes#2730
A root navigation that fails before any response headers arrive
(connection refused, DNS failure, TLS error) never answered the
Page.navigate command: the success reply is only sent from the
response-header path (frame_navigated), and frameErrorCallback dropped
the stored cdp_id along with the pending Page. The CDP client awaiting
the response was left hanging forever.
Dispatch a frame_navigate_failed notification from frameErrorCallback
when no response headers were processed (_http_status == null guards
against double-answering mid-body failures), and answer the pending
command with {frameId, loaderId, errorText} — matching Chrome, where
errorText is "present if and only if navigation has failed".
Closes#2728
A caller-supplied User-Agent overrides the built-in default and goes out
on the wire, so reject non-printable values the same way
Emulation.setUserAgentOverride and the --user-agent flag do.
We deliberately do NOT apply validateUserAgent's reserved (Mozilla)
check here: unlike the Emulation override (kept Lightpanda-branded to
keep go-rod working), setExtraHTTPHeaders is the intended,
Chrome-compatible escape hatch for setting a real browser-like
User-Agent, which by definition contains Mozilla.
Refs #2704
