[PR #2068] feat(browser): retain worker source and runtime evidence #5003

New issue

Open

opened 2026-10-31 00:57:53 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:57:53 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2068
Author: @cyanseek
Created: 10/12/2026
Status: 🔄 Open

Base: main ← Head: codex/browser-worker-evidence

📝 Commits (10+)

8545827 feat(browser): retain worker source and runtime evidence
4d490b3 fix(browser): preserve unknown worker client relationships
10b3850 chore: merge main with synchronized documentation
7d3296f Merge remote-tracking branch 'origin/main' into codex/browser-worker-evidence
629e43d fix(browser): preserve worker transitions and capture scope
6c8c0df test(browser): await worker fixture navigation before evaluation
8646906 chore: merge main and retain discriminated browser inputs
ec6c988 fix(browser): isolate worker capture and retain completeness
117a05f fix(browser): preserve worker export coverage and exclusions
d445115 test(release): select the runnable preflight job

📊 Changes

53 files changed (+6483 additions, -607 deletions)

View changed files

📝 docs/browser-observation.md (+76 -1)
📝 docs/website-script-export.md (+6 -0)
📝 scripts/ci/scopes.mjs (+9 -1)
➕ scripts/fixtures/browser-worker-site.mjs (+45 -0)
📝 scripts/lib/browser-popup-e2e.mjs (+1 -0)
📝 scripts/lib/browser-screenshot-e2e.mjs (+33 -6)
📝 scripts/lib/browser-socket-e2e.mjs (+6 -1)
📝 scripts/lib/browser-verifier-assertions.mjs (+43 -0)
➕ scripts/lib/browser-worker-e2e.mjs (+501 -0)
📝 scripts/verify-browser-runtime.mjs (+8 -1)
📝 scripts/verify-real-browser.mjs (+8 -4)
📝 src/application/BrowserEvidence.ts (+3 -0)
📝 src/browser/CdpCaptureEventHandlers.ts (+2 -0)
📝 src/browser/CdpCaptureEvents.redirectBodyShape.test.ts (+58 -0)
📝 src/browser/CdpCaptureEvents.ts (+5 -0)
📝 src/browser/CdpNetworkEventFacts.ts (+15 -0)
📝 src/browser/CdpPageCapture.ts (+13 -8)
➖ src/browser/CdpPageCaptureWorkers.test.ts (+0 -272)
➖ src/browser/CdpPageCaptureWorkers.ts (+0 -84)
➕ src/browser/CdpWorkerCapture.ts (+996 -0)

...and 33 more files

📄 Description

Summary

Fixes #883. inspect_web_page retains worker sources and runtime evidence with explicit ownership, selection and coverage. Matching URLs do not establish ownership: dedicated workers use observed page/frame attachment, Service Workers use observed controlled clients, and explicitly selected shared/unrelated workers retain unknown ownership.

Change and scope

One capture owner manages worker/frame sessions, lifecycle, source reads and cleanup. Separate serialized lifecycle and source queues bound in-flight work; queued work rechecks detach/ownership and stops on cancellation or failure.
Preserve ordered Service Worker client history across attachment/version order, missing updates and client detachment. Unresolved previously controlled targets keep discovery incomplete. Historical relationships do not grant ongoing collection authority.
Retain worker console/WebSocket data with caller-selected content policy and budgets, normalized safe response metadata and untrusted agent hints. Missing domains and revoked control retain coverage gaps.
Validate retained page/worker selection, source approval, sanitized URLs and origin scope before reconciliation or export. Page-related ownership requires a dedicated worker; service-worker-client ownership requires a Service Worker. Unknown ownership cannot manufacture page selection.
Keep opaque target/script/context identities and exact source digests. Non-JavaScript scripts retain metadata without being retrieved or exported as JavaScript. Missing-session source failures are cached per session; individual script errors and other sessions remain independent.
Keep main's page-script/source-map comparison and directional network completeness rules. Observed excess can establish a difference against a complete peer; an incomplete inventory cannot establish absence. Worker script comparisons retain their own identity and coverage. Successful discovery alone does not prove complete code inventory or that an unobserved script was not loaded.
Integrate main 69bf61f7c, using its shared worker-target, network-event and script-source parsers, navigation/cancellation guards and cleanup owners. Empty relationship identifiers are rejected before ownership policy; opaque nonempty identifiers are preserved exactly.

Contract and boundary impact

Additive worker_target_ids / --worker-target-ids, optional worker observations/metadata, response-source facts and export coverage. Historical captures remain readable.
Static bundle capture remains page-only and rejects worker selection. Explicit selection does not bypass origins or manufacture ownership.
REA owns its passive sessions and releases them on success/failure/cancellation. It does not evaluate, pause, start or terminate target workers. No new dependency, installer, version or generated-output commit.
Read existing files or captured data.
Launch or attach to a process.
Contact network services.

Validation performed

Commit 6c780baf3, incorporating main 69bf61f7c, on Node 24.22.1:

Linux: 2,795 passing checks across 151 files, with one configured skip, in the browser, Inspector, capture-diff, runtime reconciliation/load-state, public ownership and JEB selection. The complete selection passes on the pushed source. All 198 worker boundary cases pass on Windows and Linux, including malformed relationships, scoped metadata, attachment queues and lost-session behavior.
Real Chromium 151.0.7922.34: runtime verifier passes 14 worker scenarios and eight public runtime cases, covering dedicated/module/shared workers, safe response metadata, explicit origins, exact source exports, OOPIFs, cancellation/recovery and cleanup. Run 3d5038a3-7644-4a8b-abc0-83da70172106 has no surviving owned descendants.
Complete real-browser verifier passes: run 3a7ce606-d7d4-4159-ba4e-57eb11e5c53d, including CLI/MCP, popup/network/source/scenario boundaries, Service Workers, cancellation/restoration and cleanup. The 9,331,405-byte PNG matches independent native CDP bytes and survives full export. The fixture sets native content size instead of per-session viewport emulation; production viewport-change rejection remains covered at scale factors 1 and 2. No surviving owned descendants.
Full Linux check:ci, build, Windows typecheck/lint/format/module-boundary checks, generated-document checks and git diff --check pass. Source hashes match the committed PR files. Hosted checks run against this new head.

Worker observation remains attach-limited and does not prove prior activity or unobserved execution. Command concurrency is directly checked; no end-to-end speedup or total-memory improvement is claimed. Caller-selected JavaScript remains unexecuted by this passive observation path.

Author readiness

Human owner: @cyanseek

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2068 **Author:** [@cyanseek](https://github.com/cyanseek) **Created:** 10/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/browser-worker-evidence` --- ### 📝 Commits (10+) - [`8545827`](https://github.com/morluto/rea/commit/85458276127a0917fdf4e03da4e679d5602681b6) feat(browser): retain worker source and runtime evidence - [`4d490b3`](https://github.com/morluto/rea/commit/4d490b3ad0b7c00a2f15f127c6833d3e67ac2e12) fix(browser): preserve unknown worker client relationships - [`10b3850`](https://github.com/morluto/rea/commit/10b385039155c5e9b80025e09860434fa970a691) chore: merge main with synchronized documentation - [`7d3296f`](https://github.com/morluto/rea/commit/7d3296f191fad1054415cf9109a4f4e93507b3d8) Merge remote-tracking branch 'origin/main' into codex/browser-worker-evidence - [`629e43d`](https://github.com/morluto/rea/commit/629e43d3ff625c570aa3058adc84641f06752a38) fix(browser): preserve worker transitions and capture scope - [`6c8c0df`](https://github.com/morluto/rea/commit/6c8c0dfff0ed03044714f1758d7c57bcb8b896cc) test(browser): await worker fixture navigation before evaluation - [`8646906`](https://github.com/morluto/rea/commit/8646906cc3bc010f60a9741d4bb932f4a40ccdc8) chore: merge main and retain discriminated browser inputs - [`ec6c988`](https://github.com/morluto/rea/commit/ec6c9887a94be1741853573c3146caca9c4d726a) fix(browser): isolate worker capture and retain completeness - [`117a05f`](https://github.com/morluto/rea/commit/117a05f1228e05435990a5bc534e0da228154620) fix(browser): preserve worker export coverage and exclusions - [`d445115`](https://github.com/morluto/rea/commit/d4451150c35f8f2a8bfec3a9da5dd303650eeaaf) test(release): select the runnable preflight job ### 📊 Changes **53 files changed** (+6483 additions, -607 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+76 -1) 📝 `docs/website-script-export.md` (+6 -0) 📝 `scripts/ci/scopes.mjs` (+9 -1) ➕ `scripts/fixtures/browser-worker-site.mjs` (+45 -0) 📝 `scripts/lib/browser-popup-e2e.mjs` (+1 -0) 📝 `scripts/lib/browser-screenshot-e2e.mjs` (+33 -6) 📝 `scripts/lib/browser-socket-e2e.mjs` (+6 -1) 📝 `scripts/lib/browser-verifier-assertions.mjs` (+43 -0) ➕ `scripts/lib/browser-worker-e2e.mjs` (+501 -0) 📝 `scripts/verify-browser-runtime.mjs` (+8 -1) 📝 `scripts/verify-real-browser.mjs` (+8 -4) 📝 `src/application/BrowserEvidence.ts` (+3 -0) 📝 `src/browser/CdpCaptureEventHandlers.ts` (+2 -0) 📝 `src/browser/CdpCaptureEvents.redirectBodyShape.test.ts` (+58 -0) 📝 `src/browser/CdpCaptureEvents.ts` (+5 -0) 📝 `src/browser/CdpNetworkEventFacts.ts` (+15 -0) 📝 `src/browser/CdpPageCapture.ts` (+13 -8) ➖ `src/browser/CdpPageCaptureWorkers.test.ts` (+0 -272) ➖ `src/browser/CdpPageCaptureWorkers.ts` (+0 -84) ➕ `src/browser/CdpWorkerCapture.ts` (+996 -0) _...and 33 more files_ </details> ### 📄 Description ## Summary Fixes #883. `inspect_web_page` retains worker sources and runtime evidence with explicit ownership, selection and coverage. Matching URLs do not establish ownership: dedicated workers use observed page/frame attachment, Service Workers use observed controlled clients, and explicitly selected shared/unrelated workers retain unknown ownership. ## Change and scope - One capture owner manages worker/frame sessions, lifecycle, source reads and cleanup. Separate serialized lifecycle and source queues bound in-flight work; queued work rechecks detach/ownership and stops on cancellation or failure. - Preserve ordered Service Worker client history across attachment/version order, missing updates and client detachment. Unresolved previously controlled targets keep discovery incomplete. Historical relationships do not grant ongoing collection authority. - Retain worker console/WebSocket data with caller-selected content policy and budgets, normalized safe response metadata and untrusted agent hints. Missing domains and revoked control retain coverage gaps. - Validate retained page/worker selection, source approval, sanitized URLs and origin scope before reconciliation or export. Page-related ownership requires a dedicated worker; service-worker-client ownership requires a Service Worker. Unknown ownership cannot manufacture page selection. - Keep opaque target/script/context identities and exact source digests. Non-JavaScript scripts retain metadata without being retrieved or exported as JavaScript. Missing-session source failures are cached per session; individual script errors and other sessions remain independent. - Keep main's page-script/source-map comparison and directional network completeness rules. Observed excess can establish a difference against a complete peer; an incomplete inventory cannot establish absence. Worker script comparisons retain their own identity and coverage. Successful discovery alone does not prove complete code inventory or that an unobserved script was not loaded. - Integrate main **69bf61f7c**, using its shared worker-target, network-event and script-source parsers, navigation/cancellation guards and cleanup owners. Empty relationship identifiers are rejected before ownership policy; opaque nonempty identifiers are preserved exactly. ## Contract and boundary impact - Additive `worker_target_ids` / `--worker-target-ids`, optional worker observations/metadata, response-source facts and export coverage. Historical captures remain readable. - Static bundle capture remains page-only and rejects worker selection. Explicit selection does not bypass origins or manufacture ownership. - REA owns its passive sessions and releases them on success/failure/cancellation. It does not evaluate, pause, start or terminate target workers. No new dependency, installer, version or generated-output commit. - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Contact network services. ## Validation performed Commit **6c780baf3**, incorporating main **69bf61f7c**, on Node **24.22.1**: - Linux: **2,795 passing checks across 151 files**, with one configured skip, in the browser, Inspector, capture-diff, runtime reconciliation/load-state, public ownership and JEB selection. The complete selection passes on the pushed source. All **198 worker boundary cases** pass on Windows and Linux, including malformed relationships, scoped metadata, attachment queues and lost-session behavior. - Real Chromium **151.0.7922.34**: runtime verifier passes **14 worker scenarios and eight public runtime cases**, covering dedicated/module/shared workers, safe response metadata, explicit origins, exact source exports, OOPIFs, cancellation/recovery and cleanup. Run `3d5038a3-7644-4a8b-abc0-83da70172106` has no surviving owned descendants. - Complete real-browser verifier passes: run `3a7ce606-d7d4-4159-ba4e-57eb11e5c53d`, including CLI/MCP, popup/network/source/scenario boundaries, Service Workers, cancellation/restoration and cleanup. The **9,331,405-byte** PNG matches independent native CDP bytes and survives full export. The fixture sets native content size instead of per-session viewport emulation; production viewport-change rejection remains covered at scale factors 1 and 2. No surviving owned descendants. - Full Linux `check:ci`, build, Windows typecheck/lint/format/module-boundary checks, generated-document checks and `git diff --check` pass. Source hashes match the committed PR files. Hosted checks run against this new head. Worker observation remains attach-limited and does not prove prior activity or unobserved execution. Command concurrency is directly checked; no end-to-end speedup or total-memory improvement is claimed. Caller-selected JavaScript remains unexecuted by this passive observation path. ## Author readiness  Human owner: @cyanseek - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 00:57:53 +00:00

bsakaguchi referenced this issue

2026-11-01 21:42:34 +00:00

[PR #5003] [CLOSED] fix(plist): ignore processing instructions between values #6723