Commit Graph

4903 Commits

Author SHA1 Message Date
Adrià Arrufat
71616046fb terminal: add slash command hints and help completions
Adds argument syntax hints (e.g. <req> [opt]) for slash commands in the
REPL and implements tab completion for /help command arguments.
2026-05-06 15:28:57 +02:00
Adrià Arrufat
36d40be2cf Merge branch 'main' into agent 2026-05-06 07:56:28 +02:00
Karl Seguin
0c87fd6771 Merge pull request #2370 from lightpanda-io/fix-a34-fetch-xhr-formdata-multipart
Fix a34 fetch xhr formdata multipart
2026-05-06 12:50:34 +08:00
Karl Seguin
7e0dc678c4 Improve BodyInit
Replace boundary allocation with a fixed-size buffer. Follow file naming for
non-struct-as-file file.
2026-05-06 12:06:54 +08:00
Karl Seguin
6136443764 Merge pull request #2369 from lightpanda-io/fix-a33-dispatch-listener-throw
Tweak: events: report listener exceptions instead of halting dispatch
2026-05-06 10:17:09 +08:00
Karl Seguin
bf7cac2b68 Extract repeated listener switch/execution into helper 2026-05-06 09:07:38 +08:00
Karl Seguin
00d0a9f3b0 Merge pull request #2366 from lightpanda-io/custom_element_callbacks_again
Protect DOM mutations against custom element callbacks.
2026-05-06 08:02:16 +08:00
Karl Seguin
ca4444e389 Merge pull request #2362 from lightpanda-io/slience_test_log
silence an unecessary test log
2026-05-06 07:53:40 +08:00
Karl Seguin
a3891c4f68 Merge pull request #2364 from lightpanda-io/response_double_free
Protect against response double-free
2026-05-06 07:53:26 +08:00
Karl Seguin
0ca3f2d8ec Merge pull request #2365 from lightpanda-io/dom_version_node_frame
Track DOM version based on the node's owning frame
2026-05-06 07:53:13 +08:00
Navid EMAD
b573e44fe1 events: report listener exceptions instead of halting dispatch
Per DOM §2.9 step 4 substep 8 ("Inner invoke"), an exception thrown by a
listener callback must be reported to the realm's global, not propagated
out of `dispatchEvent`. Subsequent listeners on the same target and the
rest of the capture/bubble walk must still run.

Both `EventManager.dispatchPhase` (DOM targets) and
`EventManagerBase.dispatchDirect` (Window/XHR/AbortSignal/etc.) wrapped
the V8 callback invocation in raw `try`, so a listener throw aborted the
whole dispatch and surfaced as an uncaught exception at the
`Runtime.evaluate` boundary. The inline-handler invocation a few lines
above already used `catch |err| log.warn(...)`; this just extends the
same shape to the listener switch.

Closes #2367
2026-05-05 18:16:52 +02:00
Karl Seguin
5112adc69f Protect DOM mutations against custom element callbacks.
Same issue as https://github.com/lightpanda-io/browser/pull/2313

DOM mutations have certain expectations that custom element callbacks can
violate.
2026-05-05 19:22:34 +08:00
Pierre Tachoire
b506e7998f Merge pull request #2360 from lightpanda-io/wp/mrdimidium/fix-crash
Fix v8 crash
2026-05-05 12:43:36 +02:00
Karl Seguin
becbd54f4e Track DOM version based on the node's owning frame
This fixes 2 separate issues, driven by the [very] broken
/dom/ranges/Range-insertNode.html WPT test.

The first, and simplest, is that when a script element is cloned, its executing
_executed and _force_async flags need to be copied. This prevents double-
execution.

The second is more complicated: dom version tracking (as a caching mechanism
used in various live collection) has to be against the node's owning frame, not
the frame that's executing the JavaScript. This includes both the version
checking and version change (on dom mutation). This introduces a relatively
expensive node -> document -> frame on every mutation and cache read. This is
potentially worth optimizing somehow, in a follow up PR. Two options come to
mind:

1 - Track a single dom version on the Page. Mutation in frame1 invalidates
    frame2.
2 - Optimize for the frame-less case. If a page has no frame, then the calling
    context should be equal to the owning document's frame.
2026-05-05 18:41:13 +08:00
Adrià Arrufat
32b3fb08fb agent: reduce allocations and reuse buffers 2026-05-05 11:22:12 +02:00
Adrià Arrufat
431e3d6a84 tools: use error unions for tool args and script replacements 2026-05-05 11:14:02 +02:00
Adrià Arrufat
749719fa66 agent: pass attachments explicitly to message processing 2026-05-05 11:04:10 +02:00
Adrià Arrufat
532dd593da agent: move tool ownership to ToolExecutor 2026-05-05 10:40:31 +02:00
Adrià Arrufat
f84d830ff6 agent: use enum tag for eval tool name 2026-05-05 10:36:46 +02:00
Adrià Arrufat
b3cd77b4b4 agent: unify LLM turn execution into runTurn 2026-05-05 09:44:56 +02:00
Adrià Arrufat
ee398df774 mcp: simplify handleCall parameter handling 2026-05-05 09:34:43 +02:00
Adrià Arrufat
0f2aa3c273 agent: simplify JSON parsing in extractEvalScript 2026-05-05 09:31:57 +02:00
Adrià Arrufat
58b0c1052a browser.tools: restrict env var substitution to LP_ prefix 2026-05-05 09:28:01 +02:00
Karl Seguin
8ee644d9bf Protect against response double-free
When Fetch.httpErrorCallback rejects the promise, microtasks are run. Those
microtasks could do anything, including triggering a frame shutdown (e.g. via
a navigation event). The result is that we end up with

httpErrorCallback
  httpShutdownCallback

And the code simply isn't designed to handle that. httpErrorCallback now takes
control of the cleanup, capturing the `self._owns_response` in a local, and
disabling so that any nested `httpShutdownCallback` are noops.
2026-05-05 15:19:10 +08:00
Adrià Arrufat
f0a859514c agent: extract synthesis prompt and clean up comments 2026-05-05 09:13:03 +02:00
Adrià Arrufat
542cd33cf1 agent.mcp: simplify Transport doc comment 2026-05-05 09:04:53 +02:00
Adrià Arrufat
d5f9f12de8 agent: use zenai for provider defaults and api keys 2026-05-05 08:40:34 +02:00
Adrià Arrufat
976d188820 agent: use dupeMessages from zenai library 2026-05-05 08:33:43 +02:00
Adrià Arrufat
80075efd6b agent: centralize session and node registry resets 2026-05-05 08:16:01 +02:00
Adrià Arrufat
a00161f54c Merge branch 'main' into agent 2026-05-05 08:05:57 +02:00
Karl Seguin
bdc9013241 silence an unecessary test log 2026-05-05 07:52:37 +08:00
Karl Seguin
d360fcc07b Merge pull request #2352 from navidemad/fix-input-pattern-validation
forms: implement HTMLInputElement.pattern + patternMismatch validity
2026-05-05 07:49:18 +08:00
Karl Seguin
d1d85e9f5d Fix potential use-after-free by clearing worker AFTER frame context 2026-05-05 07:21:37 +08:00
Nikolay Govorov
e5a9f8ba2e Fix ony more crash 2026-05-04 18:12:47 +01:00
Nikolay Govorov
5cc8a0daff Fix v8 crash 2026-05-04 17:21:15 +01:00
Nikolay Govorov
9a312a4177 Refactor server/client/cdp structure 2026-05-04 16:41:22 +01:00
Adrià Arrufat
3b99796379 browser.tools: remove google from search fallback chain 2026-05-04 16:28:18 +02:00
Adrià Arrufat
dc441a85a1 browser.tools: add Tavily search support with scraping fallback
Integrates the Tavily Search API as the primary search provider when
TAVILY_API_KEY is set. Falls back to scraping Google and DuckDuckGo
on failure or if the key is missing. Updates zenai dependency.
2026-05-04 15:45:51 +02:00
Navid EMAD
a639ae2047 net: multipart-encode FormData bodies in fetch and XMLHttpRequest
Wire the existing multipart encoder (FormData.multipartEncode) into the
fetch and XHR body paths. Previously both entry points typed their body
parameter as ?[]const u8, so the JS->Zig bridge silently coerced any
FormData JSValue via toString() and emitted "[object FormData]" with
Content-Type: application/x-www-form-urlencoded.

Introduces a BodyInit tagged union covering FormData, URLSearchParams,
Blob, and bytes. A small extract() helper returns the serialized bytes
plus the spec-mandated default Content-Type (Fetch §6.5 step 8 / XHR
§4.7.6 step 4). Both Request.init and XMLHttpRequest.send apply the
default Content-Type only when the caller hasn't already set one.

Closes #2357
2026-05-04 15:08:52 +02:00
Pierre Tachoire
cf7dbc98de use v8 RegExp for Input.suffersPatternMismatch 2026-05-04 14:41:38 +02:00
Karl Seguin
112d4d1603 Merge pull request #2356 from lightpanda-io/cdp-audits
cdp: rename Audit into Audits
2026-05-04 19:03:35 +08:00
Pierre Tachoire
080e1e6415 cdp: rename Audit into Audits 2026-05-04 12:42:55 +02:00
Karl Seguin
d1bf44b686 Extract Window Scheduling and re-use it in Worker
Add worker.setInterval, clearInterval, setTimeout, clearTimeout by extracting
the scheduling logic from Window and making it use Execution rather than Frame.
2026-05-04 17:57:05 +08:00
Adrià Arrufat
8171868ced browser.tools: use startsWithIgnoreCase for LP_ check 2026-05-04 11:06:25 +02:00
Adrià Arrufat
c0491bd69e agent: clean up and optimize code
- Fix typo in REPL info message.
- Optimize Recorder to avoid unnecessary allocations.
- Simplify field type detection in SlashCommand using stringToEnum.
- Remove unused yellow ANSI constant in Terminal.
- Shorten log message in McpServer.
2026-05-04 10:51:41 +02:00
Adrià Arrufat
03d883b263 agent: improve script healing atomicity and error handling 2026-05-04 10:41:46 +02:00
Adrià Arrufat
a9b3b66802 agent.mcp: prevent path traversal in task attachments 2026-05-04 10:33:46 +02:00
Adrià Arrufat
804b596d5b agent: block navigation and eval during self-heal
Restricts self-heal turns to only allow page-local commands. Commands
like `goto` and `eval_js` are now ignored to prevent the model from
navigating away or executing arbitrary scripts during healing.
2026-05-04 10:21:31 +02:00
Adrià Arrufat
fba00e33cc agent: ensure atomic message pruning 2026-05-04 10:14:27 +02:00
Karl Seguin
116cc3aee7 Merge pull request #2350 from lightpanda-io/worker_importScripts
Worker.importScripts
2026-05-04 16:00:42 +08:00