[PR #6373] [CLOSED] fix(browser): record session load failures only for main-frame documents #7318

New issue

Closed

opened 2026-11-01 21:47:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented 2026-11-01 21:47:00 +00:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6373
Author: @Adolanium
Created: 10/22/2026
Status: ❌ Closed

Base: main ← Head: fix/observe-session-load-failures

---

📝 Commits (10+)

• dbd8aa3 fix(browser): record session load failures only for main-frame documents
• 1e48122 Merge upstream/main into fix/observe-session-load-failures
• a606416 test(browser): announce failed main-frame documents in observation window fixtures
• 1100ec5 fix(browser): stop tracking main-frame documents once they finish loading
• aceaa9c fix(browser): classify session load failures by the failure's resource type
• ab96b05 fix(browser): judge untyped load failures only inside the observation window
• 7395e1e fix(browser): keep an omitted request frame unknown for session load failures
• f8eab7c fix(browser): report possible document failures without a request ID as unknown
• 70c2de5 fix(browser): keep request ownership facts across redirect hops
• 868b36c fix(browser): keep child-frame request ownership across redirect hops

📊 Changes

7 files changed (+732 additions, -8 deletions)

View changed files

📝 docs/browser-observation.md (+1 -1)
📝 src/browser/CdpCaptureEventHelpers.ts (+4 -0)
📝 src/browser/CdpObservationSession.ts (+108 -4)
📝 tests/boundary/browser/cdpBrowserProvider.lifecycle_failures.test.ts (+3 -0)
📝 tests/boundary/browser/cdpObservationWindowBuffer.test.ts (+26 -2)
📝 tests/boundary/browser/cdpObservationWindowScope.test.ts (+562 -1)
📝 tests/fixtures/fakeCdpBrowserEvents.ts (+28 -0)

📄 Description

Summary

Fixes #6374.

observe_web_session was supposed to record only main-frame load failures, but its filter read a frameId that Chrome's Network.loadingFailed event does not carry. As a result, every failed request in the observed tab was recorded as a session load_failed event, including images, scripts, blocked trackers and iframe documents. A failure is now recorded only when its request was announced as a main-frame Document request.

Problem and expected behavior

In src/browser/CdpObservationSession.ts, TimelineCapture.#loadingFailed skipped a failure only when params.frameId was present and named another frame. CDP's Network.loadingFailed has requestId, timestamp, type, errorText and related fields, but no frameId. So the filter never excluded anything, and a blocked ad image (net::ERR_BLOCKED_BY_CLIENT) appeared in the session timeline beside a real document failure. The public docs describe the timeline as reload, navigation, redirect, failure and lifecycle metadata for the observed page.

Expected: a load failure appears in the timeline only when it belongs to a main-frame document request, the same scope #redirect already uses for redirects.

Change and scope

• TimelineCapture tracks the request IDs of possible main-frame Document requests from Network.requestWillBeSent: the type is absent or Document. For each, it records whether the request declared Document and the frame ID its hops named (parsed with cdpFrameId from CdpCaptureEventHelpers.ts, the same non-empty rule cdpFrameIdentity uses, so an empty ID counts as omitted), plus whether hops named different frames. The candidate also records whether that frame was the main frame when a hop first named it. Ownership (main frame, another frame, or unknown) is decided when the failure arrives: a request admitted under the main frame stays main after a root replacement, a request naming a root replacement that commits before the failure is attributed to the new main frame, and a conflict between hops stays unknown. A failure owned by another frame is filtered silently; only unknown ownership reports incomplete coverage. A redirect continues under the same request ID: a later hop that omits a fact keeps what an earlier hop established, and a hop that contradicts it makes that fact unknown. Redirect scoping is unchanged from main.
• #loadingFailed considers a failure only for a tracked request ID, and removes the ID. The failure's own type, which CDP requires on Network.loadingFailed, decides: only Document is recorded. When the failure omits it, the request's explicit Document type is used. When neither event declares a type, the request omitted its frame, or the failure has no usable requestId (so it cannot be joined to a frame), the failure is not recorded, and if it falls inside the observation window the timeline is marked incomplete with invalid_protocol_value, so a main-frame request that omitted its optional type is not treated as proof of a document. Network.loadingFinished removes the ID of a finished document. It is handled outside the timeline and never buffered, so subresource completions do not use the pre-arm buffer. Before arming, a finished document's request may still be waiting in that buffer, so its ID stays tracked; such IDs are limited by the buffer's size. Requests are tracked even when their requestWillBeSent event was buffered before the observation window was armed, so a document requested before arming whose failure arrives inside the window is still recorded. The window logic itself is unchanged.
• Docs: docs/browser-observation.md now says that main-frame document load failures are recorded and subresource load failures are not.
• Tests: the fake CDP browser's session timeline now sends a failed main-frame image request alongside the failed document. Two existing observation-window tests (cdpObservationWindowBuffer, cdpObservationWindowScope) sent Network.loadingFailed with a frameId and no preceding request. They now announce the failed request as a main-frame Document first and omit the frameId, matching CDP. Their timing and window assertions are unchanged.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Link the required maintainer scope decision for new providers or
capabilities involving target execution, injection, mutation, or protection
recovery; ordinary fixes within existing boundaries may state "not applicable".
Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contribution scope: not applicable. This is a fix inside the existing browser observation contract.

Race-specific handling: the root-replacement cases need a cross-process root swap, which is uncommon because most Chrome navigations keep the main frame ID, while a document request is in flight. Without handling, a main-frame document failure is silently missing from the timeline. The handling added for it is one boolean per tracked request (admittedAsMain) and the classification at failure time. It was requested in review (Codex threads and baron's review); the uncommitted-replacement case was left out as a known limit because it needs pending-navigation correlation. No maintainer decision on this scope is recorded yet.

Contract and boundary impact

• Semantic owner and earliest changed stage: TimelineCapture event admission for Network.loadingFailed.
• Contribution scope fit and linked maintainer decision: not applicable.
• CLI and MCP/tool-catalog contract: no schema change. observe_web_session / rea observe-web-session timelines no longer contain load_failed events for subresources or iframe documents.
• Provider, bridge, target-format, or platform compatibility: Chrome DevTools Protocol event shape as documented. A failure whose requestWillBeSent was never observed, for example a request already in flight before the event subscription, is not recorded, because its frame cannot be established. The timeline is already reported as attach_limited from the start, which covers facts that depend on events before attachment. Known limits, each needing more than this filter can establish: a root-replacement Document request that fails before its navigation commits is treated as another frame's, because nothing at this boundary distinguishes it from a child frame without pending-navigation correlation; a request whose type is an unrecognized string counts as a non-document, since REA has no maintained ResourceType parser; and a redirect chain that changes resource type, combined with a failure that omits its required type, is reported as invalid_protocol_value rather than ignored.
• Evidence, artifact, provenance, or reconstruction contract: fewer unrelated events in the timeline; the recorded load_failed events keep their request ID, timestamp and safe error text.
• Target selection, authority, upstream behavior, and cleanup details (if applicable): none.
• Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated:
  • tests/boundary/browser/cdpBrowserProvider.lifecycle_failures.test.ts, "observes user-driven reload, SPA, redirect, failure, and lifecycle events", now also asserts that the timeline does not contain the subresource's ERR_BLOCKED_BY_CLIENT. The main-frame document failure is still recorded.
  • cdpObservationWindowScope, "records a load failure only for a main-frame document that has not finished": after arming, one document request finishes and then receives a stray failure, and another document request fails. Only the second is recorded. Without the loadingFinished cleanup, this test fails.
  • cdpObservationWindowScope, "uses the failure's resource type when a main-frame request omits its type": three main-frame requests without a type fail as Image, as Document, and with no type. Only the Document failure is recorded, and the timeline reports invalid_protocol_value. If an untyped request is treated as a document regardless of the failure's type, this test fails.
  • cdpObservationWindowScope, "does not report an untyped failure before the window as incomplete coverage": an untyped request and failure buffered before the window add no load_failed event and no exclusion. Applying the exclusion before the window check fails this test.
  • cdpObservationWindowScope, "reports a document failure whose request omitted its frame as unknown coverage": a Document request without a frameId and a child-frame Document request both fail. Neither is recorded. The frameless one adds exactly one invalid_protocol_value exclusion, and the child frame's adds none. Treating an omitted frame as another frame fails this test.
  • cdpObservationWindowScope, "reports a possible document failure without a request ID as unknown coverage": an Image failure and a Document failure without a requestId. Neither is recorded. Only the Document one adds a timeline invalid_protocol_value exclusion (count 1). Dropping it silently fails this test.
  • cdpObservationWindowScope, "keeps main-frame ownership across a redirect hop that omits its frame": a main-frame Document request is redirected under the same ID by a hop without a frameId, then fails. The failure is recorded. Letting the later hop overwrite the earlier facts fails this test.
  • cdpObservationWindowScope, "keeps child-frame ownership across a redirect hop that omits its frame": a child-frame Document request is redirected under the same ID by a hop without a frameId, then fails. The failure is not recorded and no exclusion is added. Not tracking the other-frame first hop fails this test.
  • cdpObservationWindowScope, "attributes a failure to a root replacement that commits after its request" and "keeps contradictory redirect ownership unknown after a later hop agrees again": the first records a Document failure whose request named the replacement frame before Page.frameNavigated committed it; the second sends hops naming the main frame, a child frame, then the main frame again, and reports the failure as unknown coverage instead of recording it. Classifying the frame when the request arrives fails the first; letting a later hop clear the conflict fails the second.
  • cdpObservationWindowScope, "keeps a former main-frame document failure after a root replacement commits": a Document request names frame-main, a root replacement commits replacement-main, then the request fails. The failure is recorded. Dropping the admission-time fact from #ownership fails this test only.
  • cdpObservationWindowScope, "treats an empty request frame ID as unknown ownership": a Document request with frameId: "" fails; nothing is recorded and the timeline reports invalid_protocol_value. Parsing the frame with cdpStringValue again fails this test.
  • cdpObservationWindowBuffer and cdpObservationWindowScope still pass with realistic events: failures before the window are dropped, failures inside it are kept, and a zero timestamp is preserved.
• Base reproduction or other evidence: with #loadingFailed restored to main's frameId filter, the lifecycle test above fails, because the blocked image is recorded. Each new test above also fails when its fix is reverted, as noted in its entry.
• User-visible CLI/MCP output (if applicable): subresource failures disappear from timeline.
• Remaining proof gaps: verified only against the fake CDP browser, not against a real Chrome session.

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On Linux (WSL Ubuntu, Node 24.22.1) at 70d890280 (upstream/main 015414130 merged, including #4040), after npm ci and npm run build:cached:

• npx tsc -p . --noEmit passed.
• npx oxfmt --check on the changed files: clean. npx oxlint on the changed source and test files: 4 warnings, the same as on main.
• npm run docs:check passed.
• npx vitest run tests/boundary/browser src/browser: 1917 tests passed, 4 skipped, in two runs. Two tests failed in tests/boundary/browser/cdpScriptMetadata.test.ts ("keeps invalid protocol scripts out of policy filtering", "reports unsupported and invalid script exclusions separately"). They fail the same way on upstream/main 015414130 without this change; the failure sets are identical.
• The negative checks listed under Evidence each failed their test when run during development; the fix commits are 1100ec56c through 4dac93f6a.

At 8789ea7b1 (admission-time main-frame ownership), same environment: npx tsc -p . --noEmit passed; oxfmt --check clean and oxlint 4 warnings (unchanged) on the two changed files; npx vitest run tests/boundary/browser: 1091 passed, 4 skipped, in two runs, with the same two cdpScriptMetadata failures as main. Removing admittedAsMain from #ownership failed only the new test. docs:check and src/browser were not re-run for this commit.

Compatibility, safety, and release

• Breaking changes or migration steps: none. Consumers that counted subresource failures as session events will no longer see them.
• Real Hopper/Ghidra, browser, or OS coverage: none; fake CDP browser only.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: fewer recorded network failures; no new data is captured.

Author readiness

Human owner: @Adolanium

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6373 **Author:** [@Adolanium](https://github.com/Adolanium) **Created:** 10/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/observe-session-load-failures` --- ### 📝 Commits (10+) - [`dbd8aa3`](https://github.com/morluto/rea/commit/dbd8aa345a910bd8896bc23044338235c32a7f5f) fix(browser): record session load failures only for main-frame documents - [`1e48122`](https://github.com/morluto/rea/commit/1e48122ad95fa403f221463a4d396dcf4c3a2027) Merge upstream/main into fix/observe-session-load-failures - [`a606416`](https://github.com/morluto/rea/commit/a606416365112f47966e90cac4a43e45a4ddb7b7) test(browser): announce failed main-frame documents in observation window fixtures - [`1100ec5`](https://github.com/morluto/rea/commit/1100ec56cb4061ec64d5006b67574b430cb11c5b) fix(browser): stop tracking main-frame documents once they finish loading - [`aceaa9c`](https://github.com/morluto/rea/commit/aceaa9cc7d7df0e594bff71972d3aa64138d7982) fix(browser): classify session load failures by the failure's resource type - [`ab96b05`](https://github.com/morluto/rea/commit/ab96b0506d0f4dbf21eccccf2fcdfdc55ea587fe) fix(browser): judge untyped load failures only inside the observation window - [`7395e1e`](https://github.com/morluto/rea/commit/7395e1ed8c9ccd4292b6f3f618a1eb4c9697c3f1) fix(browser): keep an omitted request frame unknown for session load failures - [`f8eab7c`](https://github.com/morluto/rea/commit/f8eab7c650e85b58ebf4a28ab490590ee03d4ca6) fix(browser): report possible document failures without a request ID as unknown - [`70c2de5`](https://github.com/morluto/rea/commit/70c2de56fb0e896df1579b06121ac809c7eed6ab) fix(browser): keep request ownership facts across redirect hops - [`868b36c`](https://github.com/morluto/rea/commit/868b36c4b6a960de08608efa2946ae32a5a1c29d) fix(browser): keep child-frame request ownership across redirect hops ### 📊 Changes **7 files changed** (+732 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+1 -1) 📝 `src/browser/CdpCaptureEventHelpers.ts` (+4 -0) 📝 `src/browser/CdpObservationSession.ts` (+108 -4) 📝 `tests/boundary/browser/cdpBrowserProvider.lifecycle_failures.test.ts` (+3 -0) 📝 `tests/boundary/browser/cdpObservationWindowBuffer.test.ts` (+26 -2) 📝 `tests/boundary/browser/cdpObservationWindowScope.test.ts` (+562 -1) 📝 `tests/fixtures/fakeCdpBrowserEvents.ts` (+28 -0) </details> ### 📄 Description ## Summary Fixes #6374. `observe_web_session` was supposed to record only main-frame load failures, but its filter read a `frameId` that Chrome's `Network.loadingFailed` event does not carry. As a result, every failed request in the observed tab was recorded as a session `load_failed` event, including images, scripts, blocked trackers and iframe documents. A failure is now recorded only when its request was announced as a main-frame Document request. ## Problem and expected behavior In `src/browser/CdpObservationSession.ts`, `TimelineCapture.#loadingFailed` skipped a failure only when `params.frameId` was present and named another frame. CDP's `Network.loadingFailed` has `requestId`, `timestamp`, `type`, `errorText` and related fields, but no `frameId`. So the filter never excluded anything, and a blocked ad image (`net::ERR_BLOCKED_BY_CLIENT`) appeared in the session timeline beside a real document failure. The public docs describe the timeline as reload, navigation, redirect, failure and lifecycle metadata for the observed page. Expected: a load failure appears in the timeline only when it belongs to a main-frame document request, the same scope `#redirect` already uses for redirects. ## Change and scope - `TimelineCapture` tracks the request IDs of possible main-frame Document requests from `Network.requestWillBeSent`: the `type` is absent or `Document`. For each, it records whether the request declared `Document` and the frame ID its hops named (parsed with `cdpFrameId` from `CdpCaptureEventHelpers.ts`, the same non-empty rule `cdpFrameIdentity` uses, so an empty ID counts as omitted), plus whether hops named different frames. The candidate also records whether that frame was the main frame when a hop first named it. Ownership (main frame, another frame, or unknown) is decided when the failure arrives: a request admitted under the main frame stays main after a root replacement, a request naming a root replacement that commits before the failure is attributed to the new main frame, and a conflict between hops stays unknown. A failure owned by another frame is filtered silently; only unknown ownership reports incomplete coverage. A redirect continues under the same request ID: a later hop that omits a fact keeps what an earlier hop established, and a hop that contradicts it makes that fact unknown. Redirect scoping is unchanged from main. - `#loadingFailed` considers a failure only for a tracked request ID, and removes the ID. The failure's own `type`, which CDP requires on `Network.loadingFailed`, decides: only `Document` is recorded. When the failure omits it, the request's explicit `Document` type is used. When neither event declares a type, the request omitted its frame, or the failure has no usable `requestId` (so it cannot be joined to a frame), the failure is not recorded, and if it falls inside the observation window the timeline is marked incomplete with `invalid_protocol_value`, so a main-frame request that omitted its optional type is not treated as proof of a document. `Network.loadingFinished` removes the ID of a finished document. It is handled outside the timeline and never buffered, so subresource completions do not use the pre-arm buffer. Before arming, a finished document's request may still be waiting in that buffer, so its ID stays tracked; such IDs are limited by the buffer's size. Requests are tracked even when their `requestWillBeSent` event was buffered before the observation window was armed, so a document requested before arming whose failure arrives inside the window is still recorded. The window logic itself is unchanged. - Docs: `docs/browser-observation.md` now says that main-frame document load failures are recorded and subresource load failures are not. - Tests: the fake CDP browser's session timeline now sends a failed main-frame image request alongside the failed document. Two existing observation-window tests (`cdpObservationWindowBuffer`, `cdpObservationWindowScope`) sent `Network.loadingFailed` with a `frameId` and no preceding request. They now announce the failed request as a main-frame Document first and omit the `frameId`, matching CDP. Their timing and window assertions are unchanged. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Link the required maintainer scope decision for new providers or capabilities involving target execution, injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state "not applicable". Draft PRs may leave the scope decision pending and the readiness and merge checklists unchecked. Maintainers can help resolve open questions. Contribution scope: not applicable. This is a fix inside the existing browser observation contract. Race-specific handling: the root-replacement cases need a cross-process root swap, which is uncommon because most Chrome navigations keep the main frame ID, while a document request is in flight. Without handling, a main-frame document failure is silently missing from the timeline. The handling added for it is one boolean per tracked request (`admittedAsMain`) and the classification at failure time. It was requested in review (Codex threads and baron's review); the uncommitted-replacement case was left out as a known limit because it needs pending-navigation correlation. No maintainer decision on this scope is recorded yet. ## Contract and boundary impact - Semantic owner and earliest changed stage: `TimelineCapture` event admission for `Network.loadingFailed`. - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: no schema change. `observe_web_session` / `rea observe-web-session` timelines no longer contain `load_failed` events for subresources or iframe documents. - Provider, bridge, target-format, or platform compatibility: Chrome DevTools Protocol event shape as documented. A failure whose `requestWillBeSent` was never observed, for example a request already in flight before the event subscription, is not recorded, because its frame cannot be established. The timeline is already reported as `attach_limited` from the start, which covers facts that depend on events before attachment. Known limits, each needing more than this filter can establish: a root-replacement Document request that fails before its navigation commits is treated as another frame's, because nothing at this boundary distinguishes it from a child frame without pending-navigation correlation; a request whose `type` is an unrecognized string counts as a non-document, since REA has no maintained `ResourceType` parser; and a redirect chain that changes resource type, combined with a failure that omits its required `type`, is reported as `invalid_protocol_value` rather than ignored. - Evidence, artifact, provenance, or reconstruction contract: fewer unrelated events in the timeline; the recorded `load_failed` events keep their request ID, timestamp and safe error text. - Target selection, authority, upstream behavior, and cleanup details (if applicable): none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `tests/boundary/browser/cdpBrowserProvider.lifecycle_failures.test.ts`, "observes user-driven reload, SPA, redirect, failure, and lifecycle events", now also asserts that the timeline does not contain the subresource's `ERR_BLOCKED_BY_CLIENT`. The main-frame document failure is still recorded. - `cdpObservationWindowScope`, "records a load failure only for a main-frame document that has not finished": after arming, one document request finishes and then receives a stray failure, and another document request fails. Only the second is recorded. Without the `loadingFinished` cleanup, this test fails. - `cdpObservationWindowScope`, "uses the failure's resource type when a main-frame request omits its type": three main-frame requests without a type fail as `Image`, as `Document`, and with no type. Only the `Document` failure is recorded, and the timeline reports `invalid_protocol_value`. If an untyped request is treated as a document regardless of the failure's type, this test fails. - `cdpObservationWindowScope`, "does not report an untyped failure before the window as incomplete coverage": an untyped request and failure buffered before the window add no `load_failed` event and no exclusion. Applying the exclusion before the window check fails this test. - `cdpObservationWindowScope`, "reports a document failure whose request omitted its frame as unknown coverage": a Document request without a `frameId` and a child-frame Document request both fail. Neither is recorded. The frameless one adds exactly one `invalid_protocol_value` exclusion, and the child frame's adds none. Treating an omitted frame as another frame fails this test. - `cdpObservationWindowScope`, "reports a possible document failure without a request ID as unknown coverage": an `Image` failure and a `Document` failure without a `requestId`. Neither is recorded. Only the Document one adds a `timeline` `invalid_protocol_value` exclusion (count 1). Dropping it silently fails this test. - `cdpObservationWindowScope`, "keeps main-frame ownership across a redirect hop that omits its frame": a main-frame Document request is redirected under the same ID by a hop without a `frameId`, then fails. The failure is recorded. Letting the later hop overwrite the earlier facts fails this test. - `cdpObservationWindowScope`, "keeps child-frame ownership across a redirect hop that omits its frame": a child-frame Document request is redirected under the same ID by a hop without a `frameId`, then fails. The failure is not recorded and no exclusion is added. Not tracking the other-frame first hop fails this test. - `cdpObservationWindowScope`, "attributes a failure to a root replacement that commits after its request" and "keeps contradictory redirect ownership unknown after a later hop agrees again": the first records a Document failure whose request named the replacement frame before `Page.frameNavigated` committed it; the second sends hops naming the main frame, a child frame, then the main frame again, and reports the failure as unknown coverage instead of recording it. Classifying the frame when the request arrives fails the first; letting a later hop clear the conflict fails the second. - `cdpObservationWindowScope`, "keeps a former main-frame document failure after a root replacement commits": a Document request names `frame-main`, a root replacement commits `replacement-main`, then the request fails. The failure is recorded. Dropping the admission-time fact from `#ownership` fails this test only. - `cdpObservationWindowScope`, "treats an empty request frame ID as unknown ownership": a Document request with `frameId: ""` fails; nothing is recorded and the timeline reports `invalid_protocol_value`. Parsing the frame with `cdpStringValue` again fails this test. - `cdpObservationWindowBuffer` and `cdpObservationWindowScope` still pass with realistic events: failures before the window are dropped, failures inside it are kept, and a zero timestamp is preserved. - Base reproduction or other evidence: with `#loadingFailed` restored to main's `frameId` filter, the lifecycle test above fails, because the blocked image is recorded. Each new test above also fails when its fix is reverted, as noted in its entry. - User-visible CLI/MCP output (if applicable): subresource failures disappear from `timeline`. - Remaining proof gaps: verified only against the fake CDP browser, not against a real Chrome session. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed On Linux (WSL Ubuntu, Node 24.22.1) at 70d890280 (upstream/main 015414130 merged, including #4040), after `npm ci` and `npm run build:cached`: - `npx tsc -p . --noEmit` passed. - `npx oxfmt --check` on the changed files: clean. `npx oxlint` on the changed source and test files: 4 warnings, the same as on main. - `npm run docs:check` passed. - `npx vitest run tests/boundary/browser src/browser`: 1917 tests passed, 4 skipped, in two runs. Two tests failed in `tests/boundary/browser/cdpScriptMetadata.test.ts` ("keeps invalid protocol scripts out of policy filtering", "reports unsupported and invalid script exclusions separately"). They fail the same way on upstream/main 015414130 without this change; the failure sets are identical. - The negative checks listed under Evidence each failed their test when run during development; the fix commits are 1100ec56c through 4dac93f6a. At 8789ea7b1 (admission-time main-frame ownership), same environment: `npx tsc -p . --noEmit` passed; `oxfmt --check` clean and `oxlint` 4 warnings (unchanged) on the two changed files; `npx vitest run tests/boundary/browser`: 1091 passed, 4 skipped, in two runs, with the same two `cdpScriptMetadata` failures as main. Removing `admittedAsMain` from `#ownership` failed only the new test. `docs:check` and `src/browser` were not re-run for this commit. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Consumers that counted subresource failures as session events will no longer see them. - Real Hopper/Ghidra, browser, or OS coverage: none; fake CDP browser only. - Package or release metadata impact: none. - Security, privacy, process, or containment review: fewer recorded network failures; no new data is captured. ## Author readiness <!-- The human owner completes these declarations before requesting review. The PR author is the owner by default. A different owner must explicitly accept ownership on this PR. AI agents must leave these declarations to a human to dictate to them or there could be catastrophic consequences for many users of REA. Draft PRs may leave them unchecked. These declarations record initial readiness when opening the PR for review; later pushes do not require a new human sign-off. Keep the description and validation evidence current as the work changes. See CONTRIBUTING.md#pull-request-ownership-and-readiness. --> Human owner: @Adolanium - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge <!-- Draft PRs may leave pending items unchecked. Resolve material scope and authority questions before integration. --> - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

bsakaguchi 2026-11-01 21:47:00 +00:00

• closed this issue
• added the
  pull-request
  label

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

codex/procedure-reference-stacked

release-please--branches--main--components--rea-agents

release-please--branches--main--components--rea-agents--release-notes

codex/kuna-independent-retry

codex/byte-search-overlay-coverage

codex/open-failure-target-receipt

codex/kuna-xref-evidence

codex/ghidra-ambiguous-procedure-recovery

codex/function-source-bundle

codex/trace-function-integration-prototype

codex/snapshot-source-closure

codex/recorded-evidence-array-pages

codex/evidence-recovery-redesign

codex/trace-feature-address-scope

codex/call-discovery-scope

codex/ghidra-literal-candidate-evidence

codex/decompile-directory-independent-retry

codex/retry-provenance-base

codex/value-flow-capability-experiment

codex/ghidra-containing-instruction

cursor/readme-discord-button-ef9f

dependabot/github_actions/actions/setup-node-7.1.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df

codex/kuna-1989

fix/8559-native-ui-fixture-ownership

fix/8555-go-verifier-mcp-ownership

codex/provider-capability-recovery

fix/8642-rizin-target-stdin

codex/ghidra-memory-effect-scope

codex/ghidra-annotation-entry-selector

codex/ghidra-readonly-recovery

codex/ghidra-regex-verifier-recovery

codex/evidence-discovery-view-guidance

fix/8545-bulk-append-overflow

fix/8428-navigation-refusal-alternatives

codex/address-context-recovery

codex/matching-member-limitations

codex/unknown-scope-contract

codex/evidence-view-guidance

feat/8373-native-trace-views

codex/ghidra-snapshot-verifier-binding

codex/elf-export-visibility

codex/evidence-view-recovery

codex/native-reference-cli-help

codex/provider-candidate-observation-scope

codex/kuna-session-verification

codex/ghidra-switch-lifetime-guidance

codex/pseudocode-paging-discovery

codex/clarify-evidence-view-support

codex/kuna-xrefs-selector-recovery

codex/context-capacity-recovery

codex/evidence-closure-large-links

codex/same-function-evidence-identity

codex/ghidra-verifier-inspected-jdk

codex/audit-guided-workflows

codex/crash-prompt-retained-dossiers

codex/analysis-view-error-recovery

codex/kuna-verifier-target-selection

codex/ghidra-selected-project-call-coverage

codex/docs-native-analysis-scope

codex/ghidra-java-socket-boundary

codex/ghidra-retained-snapshot-verifier

codex/ghidra-search-inventory-facts

fix/8284-zero-argument-parameter-bindings

fix/8198-ui-action-handler-offset

fix/8257-elf-entry-label-identity

fix/8304-deferred-output-schema-projection

fix/8277-call-path-computed-target-uncertainty

fix/pr-8089-conflicts

fix/ci-static-duplicate-export

dependabot/npm_and_yarn/lint-staged-17.6.0

dependabot/github_actions/actions/download-artifact-8.0.2

dependabot/npm_and_yarn/write-file-atomic-8.0.0

dependabot/npm_and_yarn/canonicalize-5.1.0

dependabot/github_actions/actions/cache/restore-6.1.0

dependabot/npm_and_yarn/toon-format/toon-4.4.0

dependabot/github_actions/actions/deploy-pages-5.0.1

codex/review-fixes-pr-2403

codex/review-fixes-pr-2400

codex/process-terminal-width

codex/test-brittleness-cleanup

verify/7167-browser-connect-macos

fix/7167-browser-connect

feat/native-matching-allowance-setting

feat/browser-scenario-dry-run

test/managed-caller-parameters-20261024

codex/parser-fortythird-boundaries

fix/6926-pinvoke-platform-decorations-20261023

fix/6889-har-body-encoding-20261023

fix/6888-sqlite-schema-budget-20261023

fix/dependency-security-gates-6708

cursor/evidence-overwrite-rebase-b4ac

feat/4057-verify-native-exports

fix/windows-acl-observer-overhead-20261022

cursor/erlang-beam-restack-4476

cursor/pe-certificate-review-bf32

fix/6116-javascript-application-fs-errors

fix/6061-unmapped-runtime-script-unknown

feat/browser-scenario-summary

fix/pe-certificates

codex/verify-3407

cursor/rebase-5699

cursor/rebase-5352

cursor/rebase-5600

cursor/fix-cli-schema-omission-10a8

codex/audit-hopper-shutdown-reasons-20261021

fix/demangle-swift-omitted-record

fix/nib-boolean-value-types

cursor/cancellation-partial-observation-a5ac

fix/ib-object-limit-reasons

fix/electron-fuse-limit-advice

fix/kuna-doctor-dangling-cache

fix/fixed-budget-refusal-advice

fix/js-ipc-listener-dedup

fix/js-return-member-provenance

fix/dmg-integrity-retry-advice

fix/ida-doctor-readiness

fix/kuna-version-probe-output-drain

fix/legacy-swift-runtime-name-matching

fix/dylib-lazy-load-commands

fix/browser-scenario-startup-cancel

fix/swift-nested-punycode-classification

fix/compare-unselected-scopes

fix/objc-method-budget-coverage

fix/dmg-mounted-root-observations

audit/ci-tests-20261019-round2

release/6.7.0

fix/wabt-cleanup-retry-resolution

fix/electron-fuse-elf-pe-architecture

fix/native-plist-descriptor-ownership

fix/kuna-caller-cleanup-ownership

experiment/atomic-codemode-20261016

review/first-contributor-3776

fix/call-resolution-full-read-cycles

fix/member-mutation-selection-repeat

experiment/atomic-re-tools-20261015

perf/member-mutation-lazy-origins

perf/static-network-mutation-index

fix/hopper-startup-lifecycle

audit/3050-windows-proof-20261015

feat/windows-window-capture-2183

audit/3049-windows-proof-20261015

audit/3735-macos-fixtures-20261015

fix/batch-decompile-null-pseudocode

fix/kuna-inventory-honors-jobs

experiment/browser-codemode-tool-design-20261015

fix/hopper-clean-runtime-argv

codex/review-2049-27f1b367

review-fixes/pr-2787-routing

fix/3360-scoped-this-emitters

fix/3367-replaced-global-effects

fix/3838-compact-any-value-items

test/hopper-download-probe-20261015

codex/windows-runtime-creation-red-green-20261015

codex/windows-readonly-root-red-green-20261015

codex/windows-root-share-red-green-20261015

codex/exp-1685-win-mcp-startup

codex/bug-sweep-20261015

investigate/2190-windows-package-phases

investigate/3543-macos-cli-deadline

perf/3281-reverse-tools-feedback-quality

fix/3406-hopper-doctor-fixture

fix/3341-wrapper-require-test-context

fix/3301-owned-uninstall-fixtures

fix/3164-compiler-input-ownership

fix/pcap-cleanup-stdout-newline-20261014

perf/interface-builder-summary

codex/review-fixes-pr-1977

fix/ghidra-effective-jvm-platform

fix/docs-turkish-rust-link-20261013

fix/main-maintenance-ci-20261010

fix/recover-binary-session-process-effects

codex/review-fixes-pr-2457

codex/ci-required-cancellation-gate

fix/main-format-baseline-20261013

fix/setup-preserve-entry-fields

cursor/restore-main-checks-1ffc

fix/ghidra-bridge-hashmap-import

codex/shared-ci-jadx-json-default-20261013

codex/shared-ci-ghidra-test-groups-20261013

codex/shared-ci-java-fixture-format-20261013

codex/fix-intrinsic-invocation-boundaries

test/release-preflight-reusable-jobs

test/js-parameter-provenance-expectation

fix/linux-hopper-verification-current

test/2419-ghidra-elf-probe-size

followup/pr-1544-native-ida

codex/fold-pr-2230-contribution

docs/readme-responsible-use

fix/issue-2064

fix/issue-2050

fix/issue-2053

fix/issue-1968

fix/issue-1945

experiment/codemode-bridge-20261011

fix/tool-effects-negative-wording-1904-20261012

fix/1842-electron-interop-provenance

feat/recover-javascript-multi-input

refactor/website-i18n-prep

fix/nativeaot-pe-virtual-extent

fix/browser-verifier-ci-hang

fix/pe-resources-input-selection

docs/beginner-friendly-guides

docs/beginner-setup-guide

fix/javascript-analysis-worker-1563

fix/1649-ghidra-duplicate-names

fix/javascript-export-keys-integration-1369

test/maintenance-boundary-contracts-20261011

review/javascript-export-keys-1369

review/process-live-progress-1483

test/javascript-1495-growth-ratio

fix/ci-escape-timing

docs/normalized-terminal-geometry-1450

release/6.3.0

archive/release-6.3.0-pr1381

release/6.2.0

fix/electron-preload-dynamic-override

fix/javascript-self-referential-bundler-edges

release/6.1.0

cursor/grok-client-cherry-pick-0b56

feat/signature-posture

feat/dyld-shared-cache

feat/artifact-integrity-policy

feat/pkg-inventory

release/6.0.0

chore/sync-release-5.0.0

release/5.0.0

cursor/cloud-agent-node-787e

fix/javascript-xhr-open-endpoints

review/pr-711-realpath-fallback-wording

cleanup/replay-confinement

codex/test-suite-performance

codex/issue-foundations

codex/address-open-issues-2026-07-20

agent/javascript-vite-rollup-esbuild-adapters

agent/process-cleanup

agent/triage-integration

agent/unknown-commands-registry

feat/mcp-identity-metadata

morlvps/issue_cleanup

codex/installer-redesign

morl/roadmap-investigation-core

morl/roadmap-investigation-docs

release-please--branches--main--components--rea

rea-agents-6.8.0

rea-agents-6.7.0

rea-agents-6.6.0

experiment/atomic-codemode-wait-runtime-20261016

rea-agents-6.5.0

rea-agents-6.4.0

rea-agents-6.3.0

rea-agents-6.2.0

rea-agents-6.1.0

rea-agents-6.0.0

rea-agents-5.0.0

rea-agents-4.1.0

rea-agents-4.0.1

rea-agents-4.0.0

rea-agents-3.2.1

rea-agents-3.2.0

rea-agents-3.1.0

rea-agents-3.0.0

rea-agents-2.7.0

rea-agents-2.6.0

rea-agents-2.5.1

rea-agents-2.5.0

rea-agents-2.4.0

rea-agents-2.3.0

rea-agents-2.2.0

rea-agents-2.1.0

rea-agents-2.0.0

rea-agents-1.7.0

rea-agents-1.6.0

rea-agents-1.5.0

rea-agents-1.4.0

rea-agents-1.3.0

rea-agents-1.2.0

rea-agents-1.1.0

rea-agents-1.0.0

rea-agents-0.5.0

rea-agents-0.4.0

rea-agents-0.3.0

rea-0.2.1

rea-0.2.0

Labels

Clear labels   

area: bridge

  

area: bridge

  

area: build

  

area: build

  

area: build

  

area: cli

  

area: domain

  

area: evidence

  

area: mcp

  

area: native

  

area: providers

  

area: runtime

  

area: server

  

area: setup

  

area: tests

  

bug

  

design

  

documentation

  

enhancement

  

enhancement

  

enhancement

  

experiment

  

help wanted

  

i18n

  

invalid

  

P0: critical

  

P1: high

  

P2: medium

  

P2: medium

  

P2: medium

  

P3: low

  

performance

  

provider-request

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

roadmap

  

triage

No labels

area: bridge

area: bridge

area: build

area: build

area: build

area: cli

area: domain

area: evidence

area: mcp

area: native

area: providers

area: runtime

area: server

area: setup

area: tests

bug

design

documentation

enhancement

enhancement

enhancement

experiment

help wanted

i18n

invalid

P0: critical

P1: high

P2: medium

P2: medium

P2: medium

P3: low

performance

provider-request

pull-request

question

roadmap

triage

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7318

No description provided.