[PR #1604] [MERGED] fix(browser): fold loopback spellings into one attach admission key #3000

Closed
opened 2026-10-17 21:12:45 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1604
Author: @akushonkamen
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: fix/1497-loopback-lock-key


📝 Commits (1)

  • 3361ad1 fix(browser): fold loopback spellings into one attach admission key

📊 Changes

2 files changed (+94 additions, -2 deletions)

View changed files

📝 src/browser/PlaywrightScenarioBrowser.test.ts (+85 -0)
📝 src/browser/PlaywrightScenarioBrowser.ts (+9 -2)

📄 Description

Summary

Fixes #1497. A single CDP browser serves every loopback stack on one port, but the attach admission lock was keyed by the endpoint origin string, so two concurrent connect-mode captures naming the same browser as http://127.0.0.1:9222 and http://[::1]:9222 took two admissions and the browser rejected the second client.

Note on issue state: #1497 was closed as resolved by b4db35f (#1513). That change keyed admission on the normalized /json/version discovery URL, which fixed trailing-slash spellings but kept the origin string as the basis, so the bracketed-IPv6 spelling still produced a second key. The regression tests below fail on current main for exactly that spelling and pass with this change.

Problem and expected behavior

  • Smallest trigger: two connect scenarios with cdp_endpoint http://127.0.0.1:9222 and http://[::1]:9222, same target_id, started concurrently.
  • Violated invariant: one CDP browser → one admission and one cleanup owner. browserEndpointSchema normalizes the endpoint to url.origin (src/domain/browserObservation.ts:36-38), and attachedScenarioLeaseKey serialized that origin (src/browser/PlaywrightScenarioBrowser.ts:190), so the two spellings yielded two lease keys and passed admission in parallel — matching @CassieFox23's reproduction where the browser refuses the second CDP client.

Change and scope

attachedScenarioLeaseKey (src/browser/PlaywrightScenarioBrowser.ts:190-201) folds a literal loopback hostname to 127.0.0.1 before serializing the key, using the existing domain helper isLiteralLoopbackHostname (src/domain/browserObservation.ts:42-43). The port and target_id remain partition keys, so distinct ports and targets still get distinct admissions. Endpoint schema validation and rejection behavior are unchanged; no cleanup semantics change beyond both spellings now sharing a single admission owner.

Contract and boundary impact

  • Semantic owner and earliest changed stage: browser scenario attach admission (adapters, PlaywrightScenarioBrowser).
  • CLI and MCP/tool-catalog contract: none.
  • Provider, bridge, target-format, or platform compatibility: none.
  • Evidence, artifact, provenance, or reconstruction contract: none.
  • Process execution, authorization, cleanup, or containment impact: attached scenarios reaching one loopback browser through different loopback spellings now share one admission and one cleanup owner instead of opening two CDP connections.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

  • Tests added or updated:
    • "locks one attached browser across loopback spellings of one endpoint" — attachedScenarioLeaseKey("http://127.0.0.1:9222", "page-1") equals attachedScenarioLeaseKey("http://[::1]:9222", "page-1"), while different targets and different ports still differ.
    • "serializes concurrent attach across loopback spellings of one browser" — drives the public openPlaywrightScenarioBrowser entry twice (127.0.0.1 then [::1]) with a suspended first connection; asserts the second attach stays queued (does not settle within 100 ms) and connectOverCDP was dialed once, then verifies both dials carry the original spellings. No real browser needed.
  • Base reproduction or other evidence: without the fix the two new tests fail on the affected base revision (2 failed | 7 passed, red cause as in the issue: connectOverCDP called twice / keys unequal) — observed on 6d8f95e3 and re-observed on the rebased base 603d04ee (which contains b4db35f). With the fix: 9 passed (9).
  • User-visible CLI/MCP output: not applicable (no output change).
  • Remaining proof gaps: no real-browser lane run; concurrency is covered through the launcher stub.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • timeout 300 npx vitest run src/browser/PlaywrightScenarioBrowser.test.ts — 9 passed (9); on base 603d04ee without the fix: 2 failed | 7 passed.
  • timeout 300 npx vitest run src/browser src/domain --reporter=dot — 1745 passed | 2 failed; both failures (javascriptSemanticAnalysis.member_depth, PlaywrightBrowserScenarioProvider cleanup retry) also fail on pristine 603d04ee.
  • timeout 600 npm run test:fast — 3896 passed | 12 failed | 7 skipped; pristine 603d04ee baseline: 3894 passed | 12 failed | 7 skipped; the 12-item failure set is identical (JS semantic analysis / process capture / Electron / Hopper conformance, unrelated to the attach lock; +2 passed = the new tests).
  • npm run typecheck (tsc --noEmit) — passes.
  • npx oxlint — 0 errors (the 1 warning in the touched files is the pre-existing max-params warning on openAttachedScenarioBrowser).
  • npm run format:check (oxfmt) — passes.
  • npm run verify:module-boundaries — 1409 files checked.
  • git diff --check — clean.

Compatibility, safety, and release

  • Breaking changes or migration steps: none.
  • Real Hopper/Ghidra, browser, or OS coverage: no real-browser run; attach serialization covered through the stubbed launcher (launcher-independent, no browser install required).
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: removes a duplicate-connection and duplicate-cleanup-owner path on one loopback browser; no new processes, privileges, or endpoints admitted — loopback-only endpoint validation is untouched.

Review checklist

  • This PR addresses a concrete problem or an agreed enhancement.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Claim and root-cause analysis were posted on the issue before this PR; no competing PR touched the attach admission key at submission time. AI-assisted (Claude Code).


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1604 **Author:** [@akushonkamen](https://github.com/akushonkamen) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/1497-loopback-lock-key` --- ### 📝 Commits (1) - [`3361ad1`](https://github.com/morluto/rea/commit/3361ad1161c42b34b58df164d147b0b8f96b1e96) fix(browser): fold loopback spellings into one attach admission key ### 📊 Changes **2 files changed** (+94 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/PlaywrightScenarioBrowser.test.ts` (+85 -0) 📝 `src/browser/PlaywrightScenarioBrowser.ts` (+9 -2) </details> ### 📄 Description ## Summary Fixes #1497. A single CDP browser serves every loopback stack on one port, but the attach admission lock was keyed by the endpoint origin string, so two concurrent connect-mode captures naming the same browser as `http://127.0.0.1:9222` and `http://[::1]:9222` took two admissions and the browser rejected the second client. Note on issue state: #1497 was closed as resolved by b4db35f (#1513). That change keyed admission on the normalized `/json/version` discovery URL, which fixed trailing-slash spellings but kept the origin string as the basis, so the bracketed-IPv6 spelling still produced a second key. The regression tests below fail on current `main` for exactly that spelling and pass with this change. ## Problem and expected behavior - Smallest trigger: two `connect` scenarios with `cdp_endpoint` `http://127.0.0.1:9222` and `http://[::1]:9222`, same `target_id`, started concurrently. - Violated invariant: one CDP browser → one admission and one cleanup owner. `browserEndpointSchema` normalizes the endpoint to `url.origin` (`src/domain/browserObservation.ts:36-38`), and `attachedScenarioLeaseKey` serialized that origin (`src/browser/PlaywrightScenarioBrowser.ts:190`), so the two spellings yielded two lease keys and passed admission in parallel — matching @CassieFox23's reproduction where the browser refuses the second CDP client. ## Change and scope `attachedScenarioLeaseKey` (`src/browser/PlaywrightScenarioBrowser.ts:190-201`) folds a literal loopback hostname to `127.0.0.1` before serializing the key, using the existing domain helper `isLiteralLoopbackHostname` (`src/domain/browserObservation.ts:42-43`). The port and `target_id` remain partition keys, so distinct ports and targets still get distinct admissions. Endpoint schema validation and rejection behavior are unchanged; no cleanup semantics change beyond both spellings now sharing a single admission owner. ## Contract and boundary impact - Semantic owner and earliest changed stage: browser scenario attach admission (adapters, `PlaywrightScenarioBrowser`). - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: none. - Process execution, authorization, cleanup, or containment impact: attached scenarios reaching one loopback browser through different loopback spellings now share one admission and one cleanup owner instead of opening two CDP connections. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: - "locks one attached browser across loopback spellings of one endpoint" — `attachedScenarioLeaseKey("http://127.0.0.1:9222", "page-1")` equals `attachedScenarioLeaseKey("http://[::1]:9222", "page-1")`, while different targets and different ports still differ. - "serializes concurrent attach across loopback spellings of one browser" — drives the public `openPlaywrightScenarioBrowser` entry twice (`127.0.0.1` then `[::1]`) with a suspended first connection; asserts the second attach stays queued (does not settle within 100 ms) and `connectOverCDP` was dialed once, then verifies both dials carry the original spellings. No real browser needed. - Base reproduction or other evidence: without the fix the two new tests fail on the affected base revision (`2 failed | 7 passed`, red cause as in the issue: `connectOverCDP` called twice / keys unequal) — observed on `6d8f95e3` and re-observed on the rebased base `603d04ee` (which contains b4db35f). With the fix: `9 passed (9)`. - User-visible CLI/MCP output: not applicable (no output change). - Remaining proof gaps: no real-browser lane run; concurrency is covered through the launcher stub. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `timeout 300 npx vitest run src/browser/PlaywrightScenarioBrowser.test.ts` — 9 passed (9); on base `603d04ee` without the fix: 2 failed | 7 passed. - `timeout 300 npx vitest run src/browser src/domain --reporter=dot` — 1745 passed | 2 failed; both failures (`javascriptSemanticAnalysis.member_depth`, `PlaywrightBrowserScenarioProvider` cleanup retry) also fail on pristine `603d04ee`. - `timeout 600 npm run test:fast` — 3896 passed | 12 failed | 7 skipped; pristine `603d04ee` baseline: 3894 passed | 12 failed | 7 skipped; the 12-item failure set is identical (JS semantic analysis / process capture / Electron / Hopper conformance, unrelated to the attach lock; +2 passed = the new tests). - `npm run typecheck` (`tsc --noEmit`) — passes. - `npx oxlint` — 0 errors (the 1 warning in the touched files is the pre-existing max-params warning on `openAttachedScenarioBrowser`). - `npm run format:check` (oxfmt) — passes. - `npm run verify:module-boundaries` — 1409 files checked. - `git diff --check` — clean. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: no real-browser run; attach serialization covered through the stubbed launcher (launcher-independent, no browser install required). - Package or release metadata impact: none. - Security, privacy, process, or containment review: removes a duplicate-connection and duplicate-cleanup-owner path on one loopback browser; no new processes, privileges, or endpoints admitted — loopback-only endpoint validation is untouched. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. Claim and root-cause analysis were posted on the issue before this PR; no competing PR touched the attach admission key at submission time. AI-assisted (Claude Code). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-17 21:12:45 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3000
No description provided.