[PR #524] [MERGED] fix(browser): keep subresource redirects out of page navigation scope #2050

New issue

Closed

opened 2026-10-16 21:13:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/524
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: fix/browser-subresource-redirect-20261004

📝 Commits (1)

9737d4c fix(browser): keep subresource redirects out of page navigation scope

📊 Changes

4 files changed (+61 additions, -0 deletions)

View changed files

📝 src/browser/CdpObservationSession.ts (+2 -0)
➕ tests/boundary/browser/cdpObservationResourceTypes.test.ts (+57 -0)
📝 tests/fixtures/fakeCdpBrowserEvents.ts (+1 -0)
📝 tests/fixtures/fakeCdpBrowserTypes.ts (+1 -0)

📄 Description

Change

Summary

Ignore explicitly identified non-document redirects when recording the observed page's navigation timeline. Keep existing handling for Document redirects and transports that omit the optional resource type.

A Fetch or Script redirect issued by the main frame currently ends observation with target_left_scope when its resource destination is outside the approved page origin, even though the selected page has not navigated. This prematurely stops collection of later page navigation evidence.

Verification

Real headless Chrome 154.0.8037.94, fresh owned profiles and two owned loopback sites: before Fetch/Script redirects fail while Document outside-/same-origin controls pass (2 fail / 2 pass); after all four pass with actual Chrome redirect receipts.
Deterministic real HTTP/WebSocket CDP boundary: before 2 failed / 2 passed; after 14 passed including existing lifecycle controls.
Pinned build, TypeScript and official repository lint pass.
Required repository/package and matching browser-lane results are recorded below.

The CDP requestWillBeSent contract identifies resource type separately from frameId. Actual recorded Fetch and Script events have the selected main frame's ID, so frame ID alone does not establish a document navigation.

Reproduction and verification

Actual Chrome154 with fresh owned profiles and two loopback servers: Fetch/Script regressions2fail and genuine document navigation2controls pass before; all4pass after, with actual CDP resource-type receipts and unchanged main-page URL. Controlled transport regressions separately total14passing cases.

npm run check:pr: passed (Test Files 353 passed (353); Tests 1802 passed | 2 skipped (1804)).
npm run check:ci: passed.
npm run verify:package: passed installed-tarball CLI/MCP verification, including optional-dependency degradation.
npm pack --dry-run: passed.
Matching npm run verify:browser: passed the native verification lane.
Exact lockfile installation on Node 24.18.0 and npm 11.16.0.

actualheadlessChrome freshownedprofiles+loopbacksites; no userappsprofiles/externalcalls

Prepared with AI assistance; the reproductions and verification commands above were executed locally.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/524 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/browser-subresource-redirect-20261004` --- ### 📝 Commits (1) - [`9737d4c`](https://github.com/morluto/rea/commit/9737d4c10b223b4e84b660ad151c76d18adcbf4f) fix(browser): keep subresource redirects out of page navigation scope ### 📊 Changes **4 files changed** (+61 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/CdpObservationSession.ts` (+2 -0) ➕ `tests/boundary/browser/cdpObservationResourceTypes.test.ts` (+57 -0) 📝 `tests/fixtures/fakeCdpBrowserEvents.ts` (+1 -0) 📝 `tests/fixtures/fakeCdpBrowserTypes.ts` (+1 -0) </details> ### 📄 Description ## Change ## Summary Ignore explicitly identified non-document redirects when recording the observed page's navigation timeline. Keep existing handling for Document redirects and transports that omit the optional resource type. A Fetch or Script redirect issued by the main frame currently ends observation with target_left_scope when its resource destination is outside the approved page origin, even though the selected page has not navigated. This prematurely stops collection of later page navigation evidence. ## Verification - Real headless Chrome 154.0.8037.94, fresh owned profiles and two owned loopback sites: before Fetch/Script redirects fail while Document outside-/same-origin controls pass (2 fail / 2 pass); after all four pass with actual Chrome redirect receipts. - Deterministic real HTTP/WebSocket CDP boundary: before 2 failed / 2 passed; after 14 passed including existing lifecycle controls. - Pinned build, TypeScript and official repository lint pass. - Required repository/package and matching browser-lane results are recorded below. The [CDP requestWillBeSent contract](https://chromedevtools.github.io/devtools-protocol/tot/Network/#event-requestWillBeSent) identifies resource type separately from frameId. Actual recorded Fetch and Script events have the selected main frame's ID, so frame ID alone does not establish a document navigation. ## Reproduction and verification Actual Chrome154 with fresh owned profiles and two loopback servers: Fetch/Script regressions2fail and genuine document navigation2controls pass before; all4pass after, with actual CDP resource-type receipts and unchanged main-page URL. Controlled transport regressions separately total14passing cases. - `npm run check:pr`: passed (Test Files 353 passed (353); Tests 1802 passed | 2 skipped (1804)). - `npm run check:ci`: passed. - `npm run verify:package`: passed installed-tarball CLI/MCP verification, including optional-dependency degradation. - `npm pack --dry-run`: passed. Matching `npm run verify:browser`: passed the native verification lane. - Exact lockfile installation on Node 24.18.0 and npm 11.16.0. actualheadlessChrome freshownedprofiles+loopbacksites; no userappsprofiles/externalcalls Prepared with AI assistance; the reproductions and verification commands above were executed locally. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:45 +00:00