These three Browser methods were noops, so a CDP client could not change
what navigator.permissions.query() reports - it always returned "prompt".
Store permission state on the active Page (keyed by permission name) and
have navigator.permissions.query() read it back. grantPermissions sets each
listed permission to "granted", setPermission sets a single permission to an
explicit state, and resetPermissions clears them (query falls back to
"prompt"). State is scoped to the Page and resets on navigation.
Adds a CDP round-trip test exercising all three methods.
The schema walker returned raw attribute values, so `attr: "href"` /
`attr: "src"` yielded whatever the markup contained — usually a relative
URL. That is inconsistent with the links and structuredData tools (which
resolve against the document base) and with the DOM .href/.src
properties, and it makes the common extract-then-goto pattern fail on
sites with relative links, since goto needs an absolute URL.
Resolve href/src via `new URL(raw, document.baseURI)`, falling back to
the raw value on parse failure. Other attributes pass through unchanged;
absolute URLs are unaffected.
`--log-filter-scopes` previously took a comma-separated list of scopes to
suppress. Extend it with explicit include/exclude directives applied
left-to-right:
-X filter out scope X
X alias for -X (backward compatible)
+X filter in scope X
all target every scope
This makes "filter everything except one scope" expressible, e.g.
`-all,+cdp` suppresses all logs except `cdp`. Bare scope names keep their
old meaning, so existing invocations like `http,unknown_prop` are
unaffected.
Internally, the suppressed-scope list is replaced by a resolved per-scope
`scope_enabled` boolean array built via `log.resolveFilterScopes()`, so the
hot-path `enabled()` check is a single array index. Filtering remains
Debug-only, as before. `testing.LogFilter` is adapted to the new
representation; all existing call sites are unchanged.
Adds a unit test for resolveFilterScopes (default, backward-compat,
-all,+cdp, ordering) and updates the help text.
The agent already supports these providers (via zenai), but the agent
command's help text still listed only anthropic/openai/gemini/huggingface/
ollama. Bring --help in sync:
- Add vercel, mistral, and llama_cpp to the --provider allowed values
- Add AI_GATEWAY_API_KEY and MISTRAL_API_KEY to the auto-detect and
env-key lists
- Document llama.cpp as a keyless local server (base http://localhost:8080/v1)
- Note that a provider can set its own effort default (Mistral -> none)
This realigns --help with the docs at lightpanda.io/docs/usage/agent.
Updates the zenai dependency and resolves the agent's effort based on
the configured provider's default. Also dynamically updates the active
effort when switching providers.
window.postMessage and MessagePort.postMessage stashed the message
js.Value.Temp verbatim and handed it straight into the MessageEvent, with
no structuredClone on the path. The receiver got the literal object the
sender posted, so a mutation on either side was visible to the other; worse,
posting to a different same-origin frame exposed the source realm's object
directly into the target realm instead of minting a fresh one there. The
spec requires StructuredSerialize in postMessage and deserialize in the
destination realm.
The legacy testing.async(async() => {...}); was simple to use, but it only
worked in simple cases. Any microtasks which wasn't immediately resolve would
still fail.
The newer testing.async code is more robust and can handle any async scenario.
It's a bit more verbose and it's limited to 1 per <script type=module>. This
commit migrates all remaining legacy usages to the new flow. While the simpler
one was nice, having both approaches is confusing (to humans and ai).
Respect the user's configured reasoning effort during save synthesis
and user message processing. This prevents API errors on models that
do not support reasoning effort (like Mistral) when `.none` is set.
A unit test was hitting http://example.com/. As far as I can tell, there was no
good reason for this. Replaced it with hitting the local test server and the
test continues to pass.
Three reasons to avoid hitting an external resource in a unit test:
1 - it can be slow
2 - if it's flaky, it's outside our control
3 - since every zig build test generates a new binary, my firewall warns me
about a new outgoing connection every test
Expose BroadcastChannel to Worker. This change also enables actual broadcast
messages across frames/workers/poppus on the same origin. The key here is the
introduction of Page.executionsForOrigin(origin) which returns a list of
executions for a given origin. This allows the BroadcastChannel task to iterate
through _all_ candidate broadcast channels for the origin to find targets.
Also changed tests to use new/robust async testing. I'm going to do a follow
up PR to remove all the "legacy" variants of this.
Essentially makes it so that:
```
var w = iframe.contentWindow
iframe.src = 'spice.html';
w === iframe.contentWindow
```
Depends on https://github.com/lightpanda-io/zig-v8-fork/pull/182 and leverages
v8's own ability to re-use globals.
This uses v8
This commit re-uses the allocated *Window on frame/popup navigation. It's simple
to understand why this is needed:
```
var opener = window.open('page1.html');
opener.location = 'page2.html'
opener <-- should still be valid
```
What's harder to understand is why this mostly works and why it started to fail.
This mostly works because the *Window is allocated on the page's arena and thus
lives for the duration of the page AND, because we re-use the frame address,
`window._frame` always points to a valid/current Frame (as far as JS is
concerned).
Why is started to fail is because of the move to rust-url (1). On frame.deinit
we now free the underlying window._location._url._url rust-owned memory. So
while the window stays alive and most things work, getting that URL is a UAF.
By re-using the window, we don't change the lifetime of the rust-owned URL, but
we do give the existing window a new location + url. (Which is correct, as
opener.location should reflect the new URL post-navigation).
(1) https://github.com/lightpanda-io/browser/pull/2658
postMessage handed the same js.Value.Temp to every receiver's MessageEvent,
which broke two things:
1. No structured clone. Receivers got the literal object the sender posted,
so a mutation in one receiver was visible to the others and to the sender
(received === payload). The spec requires the message to be cloned for
each destination.
2. Shared temp freed after the first delivery (latent use-after-free). Events
are refcounted and deinit'd synchronously at the end of each dispatch, and
MessageEvent.deinit release()s its data value. With a shared temp, the first
receiver's teardown reset the v8 persistent slot, leaving later receivers
reading a dead handle.
Fix, following the Worker.postMessage precedent: StructuredSerialize the
message once, synchronously, in postMessage (so an unserializable value throws
a DataCloneError to the caller per spec, and cloning stays off the scheduler
tick). A TryCatch contains any v8 exception from a failed serialize so it is
re-raised as a clean DataCloneError. Delivery then re-clones the sanitized
snapshot per receiver, giving every MessageEvent its own independently owned
temp. The snapshot is released by the callback (cancelled finalizer covers the
dropped-task path).
Remove redundant `detectOllama` and `detectLlamaCpp` wrappers in
settings, calling `detectLocalProvider` directly instead. Also clean
up some logic in Agent.zig.
Allows tools like `/getEnv` with a single optional field to accept
positional arguments. Also adds autocompletion and ghost hints for
live `LP_*` environment variables.
Additionally, fixes a memory leak in `settings.zig` when parsing
invalid ZON configurations.
