Commit Graph
9542 Commits
Author SHA1 Message Date
Karl Seguin 8ccb9b2948 Merge pull request #2922 from lightpanda-io/custom-element-extend-html-interfaces
webapi: Allow CustomElements to extend any HTMLElement interfaces.
2026-07-14 07:58:45 +08:00
Karl Seguin c5f26cd7a0 Merge pull request #2924 from lightpanda-io/xhr-tweaks
webapi, minor: XHR Response-Type and invalid JSON parsing tweaks
2026-07-14 07:58:18 +08:00
Karl Seguin 2d325ce8b3 Merge pull request #2926 from lightpanda-io/set-outerHTML-document-protection
minor, webapi: Prevent outerHTML of document's element's from being w…
2026-07-14 07:57:37 +08:00
Karl Seguin 70278c0091 'GB' -> 'GiB' 2026-07-14 07:57:11 +08:00
Adrià Arrufat fb36c20eb5 docs: fix typo in installation command for nightly build 2026-07-13 23:05:46 +02:00
Adrià Arrufat 830d90adc8 Merge pull request #2915 from lightpanda-io/agent-streaming
feat(agent): add assistant text streaming
2026-07-13 19:19:58 +02:00
Karl Seguin 1ae105f08f Merge pull request #2933 from lightpanda-io/fix-custom-element-recursion
fix: Custom-element constructor parser endless recursion
2026-07-13 23:40:36 +08:00
Karl Seguin d4da7e1352 Merge pull request #2931 from lightpanda-io/ResizeObserver-Observer-Default
webapi: ResizeObserver.observer box option default
2026-07-13 23:28:18 +08:00
Karl Seguin ca1e80a397 fix: Custom-element constructor parser endless recursion
In a custom element, when this.innerHTML = '....' is called, we need to be
careful to prevent endless recursion. The html5ever callback used to determine
the context element should not invoke the custom-element constructor, else we'll
enter an endless loop.

This also fixes an ungating problem added with the new HttpClient when a
waitForImport can block forever.

Both issues were see on a WooCommerce site - though the HttpClient is only
due to an earlier HttpClient refactor.
2026-07-13 23:23:00 +08:00
Adrià Arrufat 98b89250aa agent: add OSC 8 links, blockquotes, rules, escapes to REPL markdown
- Links now emit OSC 8 hyperlinks (clickable where supported) with a dim
  url fallback; a bare link (label == url) drops the redundant suffix.
- Blockquote lines (`> `) render with a dim bar.
- Horizontal rules (`---`/`***`/`___`) render as a dim line.
- Backslash escapes unescape only markdown-special chars, leaving e.g.
  C:\\Users intact.
2026-07-13 15:46:38 +02:00
Adrià Arrufat dd1fa4135c agent: render basic markdown in REPL output
Style the assistant's answer in the interactive agent REPL with ANSI
escapes: headings, bullet/numbered lists, bold/italic/inline-code/strike,
and links. Rendering is gated to the REPL on a real terminal, so
`--task`/piped output stays verbatim for programmatic consumption.

Adds src/agent/md_term.zig (markdown -> ANSI renderer) and wires it into
Terminal.printAssistant.
2026-07-13 15:37:01 +02:00
Adrià Arrufat f06681587d build: update zenai dependency 2026-07-13 14:47:09 +02:00
Adrià Arrufat 8c575e2dc8 Merge branch 'main' into agent-streaming 2026-07-13 14:38:38 +02:00
Karl Seguin 9f47b28666 webapi: ResizeObserver.observer box option default
This should default to "content-box". Not that the value is important, but
without the default, we fail if an empty object is passed.
2026-07-13 20:30:43 +08:00
Karl Seguin 43b55b8013 http: Change default max http size to 1GB (from unlimited) 2026-07-13 18:55:05 +08:00
Karl Seguin 24d1051b1a Merge pull request #2919 from lightpanda-io/mcp-multi-session
mcp: add HTTP transport and multi-session support
2026-07-13 18:53:51 +08:00
Karl Seguin 23f0d7e988 webapi: Improve popup window
When deciding what type of window to return, we compare the origin of the popup
to its opener. If they match, we return a full Window. For this to work properly
we need to store the origin as soon as the window is opened, and not wait until
the async response is received.

Also, expand CrossOriginWindow to expose more methods, most notably: close.
2026-07-13 18:46:27 +08:00
Karl Seguin 6484161e2b Merge pull request #2928 from lightpanda-io/Dont-Log-JsException
ops: Reduce logging of JsException on event dispatch
2026-07-13 18:13:50 +08:00
Karl Seguin 77ec7d83e9 Merge pull request #2927 from lightpanda-io/Dont-Log-TryCatchRethrow
ops: Don't log TryCatchRethrow errors
2026-07-13 18:13:40 +08:00
Karl Seguin fae6389bca Merge pull request #2889 from lightpanda-io/httpclient-pipeline-and-transfer-queue
refactor: HttpClient
2026-07-13 17:02:57 +08:00
Adrià Arrufat 3e801fb83b script: generate the PandaScript skill from the tool schemas
The /save script documentation lived as a hand-maintained string in
Agent.zig whose primitives table drifted whenever a tool changed. Move
it to src/script/skill.zig and render the reference (signatures, option
lists, enums, defaults, per-parameter descriptions) from Schema.all()
at first use, keeping the curated per-tool notes behind an exhaustive
switch on Tool so a new or renamed tool is a compile error until its
doc entry exists.

The rendered skill is shared by three consumers:
- the /save and revision system prompts (built lazily in Agent.zig)
- a new mcp://skill/pandascript resource
- `zig build skills`, which writes zig-out/skills/<name>/SKILL.md with
  Claude Code frontmatter via a registry-based generator exe, so
  future Lightpanda skills are one registry entry each

Schema.FieldEntry now retains per-parameter schema descriptions, which
previously existed only in the raw JSON.
2026-07-13 10:54:13 +02:00
Adrià Arrufat 2c4803b1cf mcp: ensure clean http server shutdown
Track active connections and shut down sockets during deinit to unblock
pending reads. Drain the job queue properly before stopping the worker.
Also fix `--http-port` references to `--port` in docs and errors.
2026-07-13 10:07:37 +02:00
Adrià ArrufatandKarl Seguin 6039bc82b8 docs: correct --host description
Co-authored-by: Karl Seguin <karlseguin@users.noreply.github.com>
2026-07-13 09:28:25 +02:00
Karl Seguin df0473420c ops: Reduce logging of JsException on event dispatch
Event dispatch using a try/catch (tryCallWithThis) so that the EventManager can
decide how to handle the error. Previously, using the `callWithThis` would
result in always logging the error. Now, the EventManager can skip logging
JsExceptions.
2026-07-13 13:20:01 +08:00
Karl Seguin f4da23da2e ops: Don't log TryCatchRethrow errors
error.TryCatchRethrow is used as a control flow (sorry). It signals that an
error has already been throw in v8 and that the method should exit (ultimately,
it ends up being the return value passed to our v8 bridge, which knows to ignore
it). We shouldn't log this as a WARN, it's completely normal that it happens AND
it really contains no meaningful information as-is.
2026-07-13 12:59:29 +08:00
Karl Seguin e4387bf7fa minor, webapi: Prevent outerHTML of document's element's from being written
Captured by WPT test: /domparsing/outerhtml-01.html
2026-07-13 12:52:38 +08:00
Karl Seguin f7f8869ed3 webapi, minor: XHR Response-Type and invalid JSON parsing tweaks
Add an explicit 'default' ResponseType, which mostly behaves like `text`, but
can be used do discriminate between an explicit text and the default value.

Also, on JSON parse error, return null, not an exception.
2026-07-13 12:28:59 +08:00
Karl Seguin 7b8ea39164 webapi: Improve DOMRect
We had a basic DORect implementation (which probably covered more cases). This
commit extends the implementation to be more complete:

- Add DOMRectReadOnly (which DOMRect inherits from)
- Add StructuredClone support to DOMRect and DOMRectReadOnly
- Make DOMRect and DOMRectReadOnly usable from Worker

DOMRect can be on the hot path with IntersectionObserver, so we maintain a
value-based data object (DOMRect.Data) for internal use (things returned to js
always have to be heap allocated (and always were, we're just more explicit
about this part now)).
2026-07-13 12:03:52 +08:00
Karl Seguin 5e2615850d webapi: Allow CustomElements to extend any HTMLElement interfaces.
Pervious, extension was limited to HtmlElement. CustomElements can now extend
any html element interface.

The implementation isn't great. This is a special case, and rather than coming
up with some abstract way to define this in bridge, we make the Snapshot
aware of this specific case directly.
2026-07-13 11:13:49 +08:00
Karl Seguin 0ff08420c8 Merge pull request #2917 from lightpanda-io/svg
webapi: Add various SVG types
2026-07-13 07:49:18 +08:00
Karl Seguin a3dd3f254d mem: Make Request, URLSearchParams finalized
Also, fix potential UAF in FormData iterator
2026-07-13 07:36:16 +08:00
Karl Seguin f444f2cf6d Merge pull request #2898 from lightpanda-io/js_global_rework
refactor: Rework how v8::Globals are managed
2026-07-13 07:20:37 +08:00
Adrià Arrufat 08eecfbbac cli: add run command for script replay
`lightpanda agent <script>` replays a saved script token-free (no LLM),
but running it under `agent` reads wrong. Add `run` as a dedicated,
script-only command: `lightpanda run <script>`.

`run` exposes only a required [SCRIPT] positional plus the common
options; its LLM-session flags (--task/--save/--list-models/REPL) are
absent, so they're rejected at parse time. `parseArgs` normalizes a
`run` invocation to an `.agent` command, reusing the existing token-free
replay path unchanged, so nothing downstream needs a `.run` case.

`agent <script>` keeps working. Telemetry records `run` as its own mode
code (R) via a new Config.command field, so its adoption is measurable
separately from agent script replay (AR).
2026-07-12 23:37:23 +02:00
Adrià Arrufat bdb122cdce Merge branch 'main' into agent-streaming 2026-07-12 22:56:54 +02:00
Adrià Arrufat 70b5d400fa build: bump zenai dependency 2026-07-12 22:56:27 +02:00
Adrià Arrufat 46be87f2ca test(agent): cover resolveStream precedence and stream round-trip
Verify the stream default is on, that a remembered value wins, and that
the field parses from (and is absent-safe in) .lp-agent.zon.
2026-07-12 22:13:49 +02:00
Adrià Arrufat fa2dc02721 fix(agent): reset stream_active at turn start
`stream_active` relied on every runTools exit path balancing pause with
`endStreamedText`. If one is ever missed, a stale-true flag skips the
spinner pause on the next turn, interleaving frames with streamed text.
Reset it alongside `streamed_text` so the invariant is local.
2026-07-12 22:10:29 +02:00
Adrià Arrufat 2e8e0d1a6f docs(agent): note why the streamed_text guard is turn-wide safe
Document the invariant that lets a single per-turn flag suppress the
buffered reprint without risking a dropped final answer.
2026-07-12 22:10:11 +02:00
Adrià Arrufat a64ced0ccc fix(agent): stream assistant text only in the REPL
Streaming defaulted on for every mode, so one-shot `--task` and script
runs interleaved intermediate assistant commentary into stdout, which
wrappers treat as the answer. Gate the stream hook on `Terminal.isRepl`
so non-interactive modes keep the buffered final answer.
2026-07-12 22:09:48 +02:00
Adrià Arrufat 5abae593d8 fix(agent): keep streaming off for suppressed turns
Streaming wrote assistant deltas straight to stdout regardless of
`suppress_answer`, so `--save`/capture turns (which set it to hide the
answer) leaked model text past the `runTurn` guard. Pass a null stream
hook when the turn's answer is suppressed.
2026-07-12 22:09:25 +02:00
Adrià Arrufat f66f0c191d mcp: add HTTP transport and multi-session support
Introduces an HTTP transport option to serve multipleagents from a
single process. Each connection is routed to its own isolated
browsing session using the `Mcp-Session-Id` header.

Also adds new session management tools (`session_new`, `session_list`,
`session_close`) and refactors the MCP server to support multiple V8
isolates with parking.
2026-07-12 15:27:20 +02:00
Karl Seguin 2649b4c6cf Merge pull request #2841 from lightpanda-io/indexeddb
webapi: IndexedDB base
2026-07-12 07:31:37 +08:00
Karl Seguin 1967be7e54 webapi: Add various SVG types
Rather than having a generic SVG type (which gets us past parsing, but even the
slightest JS usage is likely to fail), this adds concrete types for a number of
known SVG types. A lot of these are empty (but even that's enough to pass
something like `instanceof SVGAElement`), but a handful of the more important
accessors and methods are implemented (e.g. I ran into a site that made
extensive use of SVGSVGElement.getElementById).
2026-07-11 18:31:09 +08:00
Karl Seguin ca927adff2 Merge pull request #2916 from lightpanda-io/attribute-frame
fix: When mutating attributes, use element's owner frame
2026-07-11 09:29:58 +08:00
Karl Seguin d43d11a641 Merge pull request #2912 from lightpanda-io/agent-repl-fixes
agent: multi-line slash commands and --save .js extension
2026-07-11 07:26:29 +08:00
Karl Seguin c2d4dbebc2 fix: When mutating attributes, use element's owner frame
Currently, we use the calling frame when mutating an element's attributes (e.g.
add/delete). This commit changes it to the element's owning frame. This should
fix both some errors and potential uaf.
2026-07-11 07:20:58 +08:00
Adrià Arrufat 40b902fed5 build: update zenai dependency 2026-07-11 00:52:58 +02:00
Adrià Arrufat 049c5f08f2 feat(agent): add assistant text streaming 2026-07-11 00:50:01 +02:00
Francis BouvierandClaude Fable 5 15a8a81e64 js: support definer/descriptor interceptors; fix HTMLCollection expandos
Fixes the remaining WPT /dom/collections failures around setting,
defining and describing HTMLCollection properties:

- HTMLCollection-own-props.html: assigning to a supported named property
  or to any array index must fail (TypeError in strict mode), while
  expandos for unsupported names must keep working.
- HTMLCollection-supported-property-indices.html: indexed property
  descriptors must be {enumerable: true, configurable: true, writable:
  false}, Object.defineProperty on any array index must throw, and
  deleting a supported index must fail.
- HTMLCollection-supported-property-names.html: named property
  descriptors must be {enumerable: false, configurable: true, writable:
  false} ([LegacyUnenumerableNamedProperties]) and defineProperty on a
  supported name must throw.

Bridge changes, mirroring the existing interceptor callbacks:

- bridge.Indexed gains a definer callback; bridge.NamedIndexed gains
  definer and descriptor callbacks, exposed through new indexedFull and
  namedIndexedFull builders so existing indexed/indexedReadWrite/
  namedIndexed call sites are untouched. Definer and descriptor
  handlers reuse the deleter (name -> bool) and getter (name -> value)
  calling shapes. The stale void-returning definer/descriptor typedefs
  in the v8 binding are bridged with @ptrCast; v8 actually reads the
  returned u32 as v8::Intercepted.
- Caller's query helpers (shared queryReturn) now accept, besides the
  existing bool shape, query callbacks returning the
  v8.PropertyAttribute bits directly (e.g. ReadOnly), with
  error.NotHandled falling through to the ordinary lookup.

HTMLCollection registers:

- an indexed setter and definer that always fail (no indexed setter in
  Web IDL), and an indexed query reporting ReadOnly for supported
  indices;
- a named definer that fails for supported names, and a named
  *descriptor* (not query) reporting {writable: false, enumerable:
  false, configurable: true}. Using the descriptor callback instead of
  query is deliberate: the ordinary [[Set]] path does not consult it, so
  assigning through a derived object (HTMLCollection-as-prototype.html)
  still creates an expando on the receiver, as the spec's
  ignore-named-props rule requires, while direct assignments fail via
  the definer.

Coverage: /dom/collections is now fully green (53/53):
- HTMLCollection-own-props.html 4/8 -> 8/8
- HTMLCollection-supported-property-indices.html 4/7 -> 7/7
- HTMLCollection-supported-property-names.html 5/6 -> 6/6
- HTMLCollection-as-prototype.html stays 2/2

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:34:13 +02:00
Francis BouvierandClaude Fable 5 809b36d96a webapi: enumerate collection supported properties for ownPropertyNames
Fixes the Object.getOwnPropertyNames related failures in WPT
/dom/collections:

- HTMLCollection-live-mutations.window.html: "ownPropertyNames" case
- HTMLCollection-supported-property-names.html: 3 getOwnPropertyNames cases
- namednodemap-supported-property-names.html: all 3 cases
- domstringmap-supported-property-names.html: all 5 cases

Object.getOwnPropertyNames returned no interceptor-backed properties
because these collections registered no enumerator callbacks.

Using the bridge's existing indexed and named enumerator support:

- HTMLCollection registers an indexed enumerator (the supported
  indices) and a named enumerator implementing the spec's supported
  property names: for each element in tree order, its non-empty id and,
  for HTML elements, its non-empty name attribute, without duplicates.
- NamedNodeMap registers indexed and named enumerators (attribute
  qualified names in order, via List.getNames).
- DOMStringMap registers a named enumerator (camel-cased data-*
  attribute names). The previously unused kebabToCamel helper is fixed
  to follow the spec conversion: only a '-' followed by an ASCII
  lowercase letter is folded to an uppercase letter, a bare "data-"
  attribute maps to the empty name, and a trailing '-' is preserved.

(As originally written, this commit also added named enumerator
interceptor support to the js bridge; main gained equivalent support
independently, so the rebase keeps main's bridge API.)

Coverage:
- /dom/collections/HTMLCollection-live-mutations.window.html 4/5 -> 5/5
- /dom/collections/HTMLCollection-supported-property-names.html 2/6 -> 5/6
- /dom/collections/namednodemap-supported-property-names.html 0/3 -> 3/3
- /dom/collections/domstringmap-supported-property-names.html 0/5 -> 5/5

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:19:19 +02:00