Playwright sends Browser.setDownloadBehavior at the browser level during
connection setup, before any target/context exists. Returning an error there
aborted the whole connection, failing every playwright demo-runner test.
Treat the no-context case as a success no-op, matching the prior behavior.
Browser.setDownloadBehavior was a noop, so Lightpanda had no file-download
path. A response with Content-Disposition: attachment is now streamed to disk
under downloadPath, and Page.downloadWillBegin / Browser.downloadProgress are
emitted when eventsEnabled.
Fixes#2701
Follow up to https://github.com/lightpanda-io/browser/pull/2742
Where 2742 dealt with window-reuse across navigation, this commit addresses
window lifetime after a .close() (so, specifically for popups). I was hoping for
a fancier solution which would let us maintain eager release with safety, but
instead opted for the much simpler "window lifetime is tied to the page".
There's a couple reasons for this. It _is_ more consistent with how everything
else works (Workers, and iframes), but the real reason is that we lack the
infrastructure to do this safely/cleanly.
This is purely mechanical and was driven almost entirely by Claude. The goal is
simply to break Frame.zig into small / more cohesive components. So instead of
having ~10 observer-specific methods on Frame, they now live in Frame.observers.
In general, our code always takes *Frame as the last parameter (a consequence
that this is the easiest / less ambiguous way to auto-inject a Frame into a
webapi). But, for these, I kept it as the first parameter because it's still
the "receiver" even though the dot syntax isn't applicable.
Address review: permissions set via Browser.grantPermissions / setPermission
now live on the Browser instead of the active Page, so they persist across
page navigations (previously a navigation dropped them) and match how Chrome
scopes permissions to the browser context. navigator.permissions.query() reads
the browser-level state. Also log not_implemented for the origin and
browserContextId params, which are accepted but not yet honored.
These three Browser methods were noops, so a CDP client could not change
what navigator.permissions.query() reports - it always returned "prompt".
Store permission state on the active Page (keyed by permission name) and
have navigator.permissions.query() read it back. grantPermissions sets each
listed permission to "granted", setPermission sets a single permission to an
explicit state, and resetPermissions clears them (query falls back to
"prompt"). State is scoped to the Page and resets on navigation.
Adds a CDP round-trip test exercising all three methods.
The schema walker returned raw attribute values, so `attr: "href"` /
`attr: "src"` yielded whatever the markup contained — usually a relative
URL. That is inconsistent with the links and structuredData tools (which
resolve against the document base) and with the DOM .href/.src
properties, and it makes the common extract-then-goto pattern fail on
sites with relative links, since goto needs an absolute URL.
Resolve href/src via `new URL(raw, document.baseURI)`, falling back to
the raw value on parse failure. Other attributes pass through unchanged;
absolute URLs are unaffected.
`--log-filter-scopes` previously took a comma-separated list of scopes to
suppress. Extend it with explicit include/exclude directives applied
left-to-right:
-X filter out scope X
X alias for -X (backward compatible)
+X filter in scope X
all target every scope
This makes "filter everything except one scope" expressible, e.g.
`-all,+cdp` suppresses all logs except `cdp`. Bare scope names keep their
old meaning, so existing invocations like `http,unknown_prop` are
unaffected.
Internally, the suppressed-scope list is replaced by a resolved per-scope
`scope_enabled` boolean array built via `log.resolveFilterScopes()`, so the
hot-path `enabled()` check is a single array index. Filtering remains
Debug-only, as before. `testing.LogFilter` is adapted to the new
representation; all existing call sites are unchanged.
Adds a unit test for resolveFilterScopes (default, backward-compat,
-all,+cdp, ordering) and updates the help text.
The agent already supports these providers (via zenai), but the agent
command's help text still listed only anthropic/openai/gemini/huggingface/
ollama. Bring --help in sync:
- Add vercel, mistral, and llama_cpp to the --provider allowed values
- Add AI_GATEWAY_API_KEY and MISTRAL_API_KEY to the auto-detect and
env-key lists
- Document llama.cpp as a keyless local server (base http://localhost:8080/v1)
- Note that a provider can set its own effort default (Mistral -> none)
This realigns --help with the docs at lightpanda.io/docs/usage/agent.
Updates the zenai dependency and resolves the agent's effort based on
the configured provider's default. Also dynamically updates the active
effort when switching providers.
window.postMessage and MessagePort.postMessage stashed the message
js.Value.Temp verbatim and handed it straight into the MessageEvent, with
no structuredClone on the path. The receiver got the literal object the
sender posted, so a mutation on either side was visible to the other; worse,
posting to a different same-origin frame exposed the source realm's object
directly into the target realm instead of minting a fresh one there. The
spec requires StructuredSerialize in postMessage and deserialize in the
destination realm.
The legacy testing.async(async() => {...}); was simple to use, but it only
worked in simple cases. Any microtasks which wasn't immediately resolve would
still fail.
The newer testing.async code is more robust and can handle any async scenario.
It's a bit more verbose and it's limited to 1 per <script type=module>. This
commit migrates all remaining legacy usages to the new flow. While the simpler
one was nice, having both approaches is confusing (to humans and ai).
Respect the user's configured reasoning effort during save synthesis
and user message processing. This prevents API errors on models that
do not support reasoning effort (like Mistral) when `.none` is set.
A unit test was hitting http://example.com/. As far as I can tell, there was no
good reason for this. Replaced it with hitting the local test server and the
test continues to pass.
Three reasons to avoid hitting an external resource in a unit test:
1 - it can be slow
2 - if it's flaky, it's outside our control
3 - since every zig build test generates a new binary, my firewall warns me
about a new outgoing connection every test
Expose BroadcastChannel to Worker. This change also enables actual broadcast
messages across frames/workers/poppus on the same origin. The key here is the
introduction of Page.executionsForOrigin(origin) which returns a list of
executions for a given origin. This allows the BroadcastChannel task to iterate
through _all_ candidate broadcast channels for the origin to find targets.
Also changed tests to use new/robust async testing. I'm going to do a follow
up PR to remove all the "legacy" variants of this.
Essentially makes it so that:
```
var w = iframe.contentWindow
iframe.src = 'spice.html';
w === iframe.contentWindow
```
Depends on https://github.com/lightpanda-io/zig-v8-fork/pull/182 and leverages
v8's own ability to re-use globals.
This uses v8
This commit re-uses the allocated *Window on frame/popup navigation. It's simple
to understand why this is needed:
```
var opener = window.open('page1.html');
opener.location = 'page2.html'
opener <-- should still be valid
```
What's harder to understand is why this mostly works and why it started to fail.
This mostly works because the *Window is allocated on the page's arena and thus
lives for the duration of the page AND, because we re-use the frame address,
`window._frame` always points to a valid/current Frame (as far as JS is
concerned).
Why is started to fail is because of the move to rust-url (1). On frame.deinit
we now free the underlying window._location._url._url rust-owned memory. So
while the window stays alive and most things work, getting that URL is a UAF.
By re-using the window, we don't change the lifetime of the rust-owned URL, but
we do give the existing window a new location + url. (Which is correct, as
opener.location should reflect the new URL post-navigation).
(1) https://github.com/lightpanda-io/browser/pull/2658
