@buoy-gg/network 7.0.40 → 7.0.41

package/README.md

@@ -93,3 +93,9 @@ Each call keeps the profile selected when it starts. Offline takes precedence ov
 Conditions remain active when the panel is closed or its list is paused. They reset on a full JS reload or account access loss and are never persisted. Captured requests retain their condition stamp for saved snapshots, detail views and export. Desktop and MCP can control a connected device that advertises the conditions actions.
 
 Network conditions are a development preview. The native compatibility matrix across transports, runtimes and devices is still being worked through, so confirm the behaviour you rely on in your own build before you depend on it.
+
+## Web support (unreleased)
+
+Browser fetch and XHR use the shared capture, rules, conditions, and request panels. CORS still controls which response data the page can read. The browser build is available in this checkout and has not been published yet. See the [web setup guide](https://buoy.gg/buoy/latest/docs/web-preview) for registration, dependencies, and browser boundaries.
+
+The capture control reads “Pause network capture” while capture is enabled and “Resume network capture” while it is paused. Existing requests remain visible while capture is paused.

package/lib/commonjs/index.js

@@ -243,6 +243,12 @@ Object.defineProperty(exports, "splitPinned", {
     return _withPinnedFirst.splitPinned;
   }
 });
+Object.defineProperty(exports, "startNetworkCapture", {
+  enumerable: true,
+  get: function () {
+    return _startNetworkCapture.startNetworkCapture;
+  }
+});
 Object.defineProperty(exports, "subscribeNetworkConditions", {
   enumerable: true,
   get: function () {
@@ -298,6 +304,7 @@ Object.defineProperty(exports, "useTickEveryMinute", {
   }
 });
 var _preset = require("./preset");
+var _startNetworkCapture = require("./network/utils/startNetworkCapture");
 var _NetworkModal = require("./network/components/NetworkModal");
 var _NetworkEventDetailView = require("./network/components/NetworkEventDetailView");
 var _NetworkEventItemCompact = require("./network/components/NetworkEventItemCompact");

package/lib/commonjs/network/components/NetworkListScreen.js

@@ -12,7 +12,7 @@ var _NetworkUpgradeBanner = require("./NetworkUpgradeBanner");
 var _useNetworkEventList = require("../hooks/useNetworkEventList");
 var _useNetworkSaved = require("../hooks/useNetworkSaved");
 var _useOverrideRules = require("../hooks/useOverrideRules");
-var _matchRule = require("../overrides/matchRule");
+var _overriddenRows = require("../overrides/overriddenRows");
 var _withPinnedFirst = require("../utils/withPinnedFirst");
 var _jsxRuntime = require("react/jsx-runtime");
 /**
@@ -196,8 +196,7 @@ function NetworkListScreen({
   // Paused rules still populate the strip — that's how you find the thing you
   // paused in order to resume it. The header says PAUSED instead.
   const activeRules = rules.filter(rule => rule.enabled && !isRuleSpent(rule));
-  const isOverridden = event => activeRules.some(rule => (0, _matchRule.ruleMatches)(rule, event.url, String(event.method || "GET")));
-  const overridden = activeRules.length ? [...pinned, ...rest].filter(isOverridden) : [];
+  const overridden = (0, _overriddenRows.overriddenEvents)([...pinned, ...rest], activeRules);
   const overriddenIds = new Set(overridden.map(event => event.id));
   const pinnedRows = pinned.filter(event => !overriddenIds.has(event.id));
   const restRows = overriddenIds.size ? rest.filter(event => !overriddenIds.has(event.id)) : rest;

package/lib/commonjs/network/components/NetworkListScreen.web.js

@@ -9,7 +9,7 @@ var _NetworkEventItemCompact = require("./NetworkEventItemCompact.web");
 var _useNetworkEventList = require("../hooks/useNetworkEventList");
 var _useNetworkSaved = require("../hooks/useNetworkSaved");
 var _useOverrideRules = require("../hooks/useOverrideRules");
-var _matchRule = require("../overrides/matchRule");
+var _overriddenRows = require("../overrides/overriddenRows");
 var _withPinnedFirst = require("../utils/withPinnedFirst");
 var _jsxRuntime = require("react/jsx-runtime");
 /**
@@ -387,8 +387,7 @@ function NetworkListScreen({
   // Hoist anything an active rule covers. Done after `splitPinned` so a request
   // that is both pinned and overridden appears once, in the louder section.
   const activeRules = rules.filter(rule => rule.enabled && !isRuleSpent(rule));
-  const isOverridden = event => activeRules.some(rule => (0, _matchRule.ruleMatches)(rule, event.url, String(event.method || "GET")));
-  const overridden = activeRules.length ? [...pinned, ...rest].filter(isOverridden) : [];
+  const overridden = (0, _overriddenRows.overriddenEvents)([...pinned, ...rest], activeRules);
   const overriddenIds = new Set(overridden.map(event => event.id));
   const pinnedRows = pinned.filter(event => !overriddenIds.has(event.id));
   const restRows = overriddenIds.size ? rest.filter(event => !overriddenIds.has(event.id)) : rest;

package/lib/commonjs/network/components/NetworkModal.js

@@ -501,7 +501,7 @@ function NetworkModalInner({
         }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(_sharedUi.PowerToggleButton, {
           isEnabled: !paused,
           onToggle: () => setPaused(prev => !prev),
-          accessibilityLabel: "Pause network list",
+          accessibilityLabel: paused ? "Resume network capture" : "Pause network capture",
           testID: "buoy-network-power"
         }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_NetworkHeaderLive.NetworkClearButton, {
           paused: paused

package/lib/commonjs/network/conditions/xhr.js

@@ -7,7 +7,32 @@ exports.runConditionXhr = runConditionXhr;
 var _applyToXhr = require("../overrides/applyToXhr");
 /** Active simulation uses a send-to-completion deadline, including the wait. */
 function runConditionXhr(target, url, condition, outcome, dispatch) {
-  if (!(0, _applyToXhr.canSynthesize)(target)) throw new Error("Network conditions require React Native XMLHttpRequest.");
+  if (!(0, _applyToXhr.canSynthesize)(target)) {
+    const rule = {
+      id: "condition",
+      enabled: true,
+      urlPattern: url,
+      kind: "delay",
+      hits: 0,
+      seen: 0,
+      createdAt: Date.now()
+    };
+    const simulation = condition.profile === "offline" ? {
+      kind: "fail",
+      rule,
+      failKind: "network",
+      delayMs: 0
+    } : outcome ? {
+      ...outcome,
+      delayMs: condition.delayMs + outcome.delayMs
+    } : {
+      kind: "delay",
+      rule,
+      delayMs: condition.delayMs
+    };
+    if (!(0, _applyToXhr.runOverride)(target, url, simulation, dispatch)) throw new Error("Network conditions are unavailable for this XMLHttpRequest implementation.");
+    return;
+  }
   const xhr = target;
   if (xhr.readyState !== 1 || xhr._sent) throw new Error("Request is not open or has already been sent.");
   const started = Date.now();

package/lib/commonjs/network/overrides/applyToXhr.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.canSynthesize = canSynthesize;
 exports.canSynthesizeStandard = canSynthesizeStandard;
 exports.completeNativeOverride = completeNativeOverride;
+exports.hasPendingStandardRequest = hasPendingStandardRequest;
 exports.runOverride = runOverride;
 /**
  * Perform an override outcome against an XMLHttpRequest — React Native's OR a
@@ -286,6 +287,7 @@ function respondStandard(xhr, url, outcome, isAborted) {
   setStandardReadyState(xhr, LOADING);
   if (isAborted()) return;
   setStandardReadyState(xhr, DONE);
+  if (isAborted()) return;
   fireEvent(xhr, "load");
   fireEvent(xhr, "loadend");
 }
@@ -314,60 +316,115 @@ function failStandard(xhr, outcome) {
  * `delay` pass-through hands the request to the real network, where the
  * prototype `abort()` must be reachable again.
  */
+const pendingStandardRequests = new WeakMap();
+function hasPendingStandardRequest(xhr) {
+  return pendingStandardRequests.has(xhr);
+}
 function runStandardOverride(xhr, url, outcome, passThrough) {
-  let timer = null;
-  let aborted = false;
+  const started = Date.now();
+  const generation = {};
+  let timer;
+  let deadline;
   let settled = false;
-  const restoreAbort = () => {
-    try {
-      delete xhr.abort;
-    } catch {
-      // Non-configurable shadow can't happen (we define it configurable), but
-      // never let cleanup throw into app code.
+  let aborted = false;
+  let dispatched = false;
+  let timeout = xhr.timeout;
+  const originalAbort = xhr.abort;
+  const originalOpen = xhr.open;
+  const names = ['abort', 'open', 'timeout', 'readyState', 'status', 'statusText', 'response', 'responseText', 'responseURL', 'getAllResponseHeaders', 'getResponseHeader'];
+  const descriptors = new Map(names.map(name => [name, Object.getOwnPropertyDescriptor(xhr, name)]));
+  let prototype = Object.getPrototypeOf(xhr);
+  let nativeTimeout;
+  while (prototype && !nativeTimeout) {
+    nativeTimeout = Object.getOwnPropertyDescriptor(prototype, 'timeout');
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  const finish = () => {
+    settled = true;
+    if (pendingStandardRequests.get(xhr) === generation) pendingStandardRequests.delete(xhr);
+    clearTimeout(timer);
+    clearTimeout(deadline);
+    xhr.removeEventListener('loadend', finish);
+  };
+  const restore = () => {
+    finish();
+    for (const [name, descriptor] of descriptors) {
+      if (descriptor) Object.defineProperty(xhr, name, descriptor);else delete xhr[name];
     }
+    xhr.timeout = timeout;
   };
-  Object.defineProperty(xhr, "abort", {
+  const scheduleDeadline = () => {
+    clearTimeout(deadline);
+    if (dispatched) {
+      nativeTimeout?.set?.call(xhr, timeout > 0 ? Math.max(1, timeout - (Date.now() - started)) : 0);
+    } else if (timeout > 0) {
+      deadline = setTimeout(() => {
+        if (settled) return;
+        clearTimeout(timer);
+        failStandard(xhr, {
+          ...outcome,
+          kind: 'fail',
+          failKind: 'timeout'
+        });
+        finish();
+      }, Math.max(0, timeout - (Date.now() - started)));
+    }
+  };
+  Object.defineProperty(xhr, 'timeout', {
+    configurable: true,
+    get: () => timeout,
+    set: value => {
+      timeout = Math.max(0, Number(value) || 0);
+      scheduleDeadline();
+    }
+  });
+  Object.defineProperty(xhr, 'open', {
+    configurable: true,
+    value: (...args) => {
+      restore();
+      return Reflect.apply(originalOpen, xhr, args);
+    }
+  });
+  Object.defineProperty(xhr, 'abort', {
     configurable: true,
-    writable: true,
     value: () => {
-      if (settled || aborted) return;
-      aborted = true;
-      settled = true;
-      if (timer !== null) {
-        clearTimeout(timer);
-        timer = null;
+      if (dispatched || settled) {
+        restore();
+        originalAbort.call(xhr);
+        return;
       }
-      restoreAbort();
-      // The in-flight abort sequence: DONE, then 'abort', then 'loadend' —
-      // whatwg's request-error steps, which is also what RN's setReadyState
-      // dispatches off `_aborted`.
+      aborted = true;
+      clearTimeout(timer);
       setStandardReadyState(xhr, DONE);
-      fireEvent(xhr, "abort");
-      fireEvent(xhr, "loadend");
+      fireEvent(xhr, 'abort');
+      fireEvent(xhr, 'loadend');
+      finish();
+      if (!pendingStandardRequests.has(xhr)) defineOwn(xhr, 'readyState', 0);
     }
   });
-  const fire = () => {
-    timer = null;
-    if (aborted) return;
-    if (outcome.kind === "delay") {
-      // The real request is about to be genuinely in flight — put the
-      // prototype `abort()` back FIRST so cancelling reaches the network.
-      restoreAbort();
-      passThrough();
+  pendingStandardRequests.set(xhr, generation);
+  xhr.addEventListener('loadend', finish);
+  scheduleDeadline();
+  timer = setTimeout(() => {
+    if (settled || aborted) return;
+    if (outcome.kind === 'delay') {
+      dispatched = true;
+      scheduleDeadline();
+      try {
+        passThrough();
+      } catch {
+        failStandard(xhr, {
+          ...outcome,
+          kind: 'fail',
+          failKind: 'network'
+        });
+        finish();
+      }
       return;
     }
-    if (outcome.kind === "fail") {
-      failStandard(xhr, outcome);
-    } else {
-      respondStandard(xhr, url, outcome, () => aborted);
-    }
-    settled = true;
-    restoreAbort();
-  };
-
-  // ALWAYS asynchronous, even at 0ms — same contract as the RN path: callers
-  // legitimately attach handlers after `send()` returns (axios does).
-  timer = setTimeout(fire, outcome.delayMs);
+    if (outcome.kind === 'fail') failStandard(xhr, outcome);else respondStandard(xhr, url, outcome, () => aborted || pendingStandardRequests.get(xhr) !== generation);
+    finish();
+  }, outcome.delayMs);
   return true;
 }
 

package/lib/commonjs/network/overrides/matchRule.js

@@ -57,7 +57,13 @@ function compilePattern(pattern) {
   // Anchored, like Chrome's `^${...}$` — a pattern describes the whole URL, so
   // `pokeapi.co` matches nothing and `*pokeapi.co*` matches everything on that
   // host. Predictable beats clever; the rule editor writes full URLs for you.
-  const regex = new RegExp(`^${escapeRegex(pattern)}$`);
+  //
+  // One exception: a pattern that starts with `/` is a PATH. Anchored to the
+  // full URL it could never match anything (every URL starts with a scheme),
+  // so it means "this path on any origin" — `/api/rewards` matches
+  // `http://localhost:3002/api/rewards`, and `/api/rewards*` also its queries.
+  const source = pattern.startsWith("/") ? `[a-zA-Z][a-zA-Z0-9+.-]*://[^/]*${escapeRegex(pattern)}` : escapeRegex(pattern);
+  const regex = new RegExp(`^${source}$`);
   // Unbounded growth isn't possible in practice (patterns come from a capped
   // rule list), but a user editing a pattern character by character churns
   // entries, so keep the cache from becoming a leak.

package/lib/commonjs/network/overrides/overriddenRows.js

@@ -0,0 +1,37 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.overriddenEvents = overriddenEvents;
+var _matchRule = require("./matchRule");
+/**
+ * Which captured requests belong in the list's OVERRIDDEN strip.
+ *
+ * A row belongs there when an active rule actually changed it (it carries the
+ * rule's override mark) or matched it after the rule existed (while overrides
+ * are paused those pass through, and the strip is how you find the rule again).
+ * Before a rule existed nothing overrode anything, so older matching requests
+ * are real server responses and stay in the list, with one exception: the
+ * newest of them, which is the request the rule was built from. That one hoists
+ * right away, so creating a rule shows where it points without waiting for the
+ * endpoint to be called again.
+ */
+function overriddenEvents(events, activeRules) {
+  if (activeRules.length === 0) return [];
+  const activeIds = new Set(activeRules.map(rule => rule.id));
+  const picked = new Set();
+  for (const rule of activeRules) {
+    let source;
+    for (const event of events) {
+      if (event.override && activeIds.has(event.override.ruleId)) {
+        picked.add(event.id);
+        continue;
+      }
+      if (!(0, _matchRule.ruleMatches)(rule, event.url, String(event.method || "GET"))) continue;
+      if (event.timestamp >= rule.createdAt) picked.add(event.id);else if (!source || event.timestamp > source.timestamp) source = event;
+    }
+    if (source) picked.add(source.id);
+  }
+  return events.filter(event => picked.has(event.id));
+}

package/lib/commonjs/network/utils/networkEventStore.js

@@ -140,9 +140,8 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
     }
 
     // If no other listeners exist, stop the network interceptor
-    const listener = (0, _networkListener.networkListener)();
-    if (listener.listenerCount === 0) {
-      listener.stopListening();
+    if ((0, _networkListener.getNetworkListenerCount)() === 0) {
+      (0, _networkListener.stopNetworkListener)();
     }
   }
 
@@ -155,9 +154,8 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
   disableCapture() {
     this.mirrorMode = true;
     this.takeBootBuffer();
-    const listener = (0, _networkListener.networkListener)();
-    if (listener.listenerCount === 0 && listener.isActive) {
-      listener.stopListening();
+    if ((0, _networkListener.getNetworkListenerCount)() === 0) {
+      (0, _networkListener.stopNetworkListener)();
     }
     super.disableCapture();
   }
@@ -204,6 +202,8 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
       request
     } = event;
     if (event.type === "request") {
+      // Replayed request notifications must not reset a completed row or add a second key.
+      if (this.events.some(item => item.id === request.id)) return;
       // Build full URL with query params if present
       const queryString = request.params ? `?${new URLSearchParams(request.params).toString()}` : "";
       const fullUrl = `${request.url}${queryString}`;
@@ -242,6 +242,24 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
       this.events = [networkEvent, ...this.events].slice(0, this.maxEvents);
       this.notify(networkEvent);
       this.notifyArrayListeners();
+    } else if (event.type === "request-body") {
+      const current = this.events.find(item => item.id === request.id);
+      if (!current) return;
+      const updated = {
+        ...current,
+        requestData: request.data,
+        requestSize: this.getDataSize(request.data)
+      };
+      if (request.client === "graphql") {
+        updated.operationName = (0, _extractOperationName.extractOperationName)(request.data) || undefined;
+        const variables = request.data?.variables;
+        if (variables && typeof variables === "object") updated.graphqlVariables = variables;
+      }
+      this.events = this.events.map(item => item.id === request.id ? updated : item);
+      if (this.pendingRequests.has(request.id)) this.pendingRequests.set(request.id, updated);
+      _networkSavedStore.networkSavedStore.syncFromLive(updated);
+      this.notify(updated);
+      this.notifyArrayListeners();
     } else if (event.type === "response" || event.type === "error") {
       const index = this.events.findIndex(e => e.id === request.id);
       if (index !== -1) {

package/lib/commonjs/network/utils/networkListener.js

@@ -4,6 +4,8 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.stopNetworkListener = exports.startNetworkListener = exports.removeAllNetworkListeners = exports.networkListener = exports.isNetworkListening = exports.isNetworkInterceptionLive = exports.getNetworkListenerCount = exports.addNetworkListener = exports.BUOY_XHR_INTERCEPTOR_FLAG = exports.BUOY_FETCH_INTERCEPTOR_FLAG = void 0;
+var _resolveRequestUrl = require("./resolveRequestUrl");
+var _requestId = require("./requestId");
 var _xhr = require("../conditions/xhr");
 var _store = require("../conditions/store");
 var _wait = require("../conditions/wait");
@@ -17,6 +19,59 @@ var _httpCompletion = require("./httpCompletion");
  * Simple and reliable network interception for React Native
  */
 
+let devOrigin;
+
+/**
+ * Headers another Buoy tool adds to a request inside our wrapper.
+ *
+ * Impersonate patches fetch/XHR at boot, so this listener usually wraps it
+ * and records the request before the impersonation header is added. The
+ * request on the wire carried the header and the Network row did not. Tools
+ * that add headers register a function here, keyed by URL, so the row shows
+ * what was actually sent.
+ */
+function injectedHeaders(url) {
+  const injectors = globalThis.__buoyHeaderInjectors;
+  if (!injectors || injectors.length === 0) return undefined;
+  let out;
+  for (const inject of injectors) {
+    try {
+      const h = inject(url);
+      if (h) out = {
+        ...out,
+        ...h
+      };
+    } catch {
+      /* a broken injector must not break capture */
+    }
+  }
+  return out;
+}
+
+/**
+ * Origin of the Metro dev server this JS bundle was loaded from, read once from
+ * the bundle URL React Native reports. `null` in release builds (the bundle is
+ * a file) and anywhere react-native isn't present.
+ */
+function devServerOrigin() {
+  if (devOrigin !== undefined) return devOrigin;
+  devOrigin = null;
+  try {
+    if (typeof __DEV__ !== "undefined" && !__DEV__) return devOrigin;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const rn = require("react-native");
+    const sc = rn?.NativeModules?.SourceCode;
+    const url = sc?.getConstants?.().scriptURL ?? sc?.scriptURL;
+    if (typeof url === "string" && /^https?:\/\//.test(url)) {
+      const u = new URL(url);
+      devOrigin = `${u.protocol}//${u.host}`;
+    }
+  } catch {
+    devOrigin = null;
+  }
+  return devOrigin;
+}
+
 /**
  * True only while `originalFetch` is being CALLED (not awaited).
  *
@@ -122,7 +177,6 @@ function isInternalBuoyHost(url) {
 class NetworkListener {
   listeners = [];
   isListening = false;
-  requestCounter = 1000;
 
   // Store original methods
 
@@ -170,6 +224,11 @@ class NetworkListener {
       if ((parsed.hostname === "buoy.gg" || parsed.hostname === "www.buoy.gg") && parsed.pathname.startsWith("/api/license")) return true;
       const local = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "10.0.2.2";
       if (local && ["8081", "8802"].includes(parsed.port)) return true;
+      // The dev server this bundle actually came from, whatever its host and
+      // port (a LAN address, --port 8082…): Metro's own traffic — symbolicate,
+      // logs, HMR, the bundle — is not the app's.
+      const dev = devServerOrigin();
+      if (dev && `${parsed.protocol}//${parsed.host}` === dev) return true;
     } catch {
       return false;
     }
@@ -625,7 +684,7 @@ class NetworkListener {
     this.originalFetch = globalThis.fetch;
     const generation = ++this.fetchGeneration;
     const wrappedFetch = async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      const url = (0, _resolveRequestUrl.resolveRequestUrl)(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
 
       // A newer install supersedes this wrapper. If it is still stranded in
       // another tool's chain it must pass through silently, or one request
@@ -639,7 +698,7 @@ class NetworkListener {
         return passthroughFetch(input, init);
       }
       const startTime = Date.now();
-      const requestId = `fetch_${++self.requestCounter}`;
+      const requestId = (0, _requestId.nextRequestId)("fetch");
       const inputRequest = typeof input === "object" && "method" in input ? input : undefined;
       const method = init?.method ?? inputRequest?.method ?? "GET";
       const signal = init?.signal !== undefined ? init.signal : inputRequest?.signal;
@@ -663,9 +722,12 @@ class NetworkListener {
             requestHeaders[key] = value;
           });
         } else {
-          requestHeaders = headers;
+          requestHeaders = {
+            ...headers
+          };
         }
       }
+      Object.assign(requestHeaders, injectedHeaders(url));
 
       // Parse request body
       // Explicitly typed: the late emit for a streamed reply reads this from
@@ -714,6 +776,35 @@ class NetworkListener {
         override,
         condition
       });
+
+      // Clone before dispatch; inspect the body without delaying or consuming the app's upload.
+      if (init?.body === undefined && inputRequest?.body && !inputRequest.bodyUsed) {
+        try {
+          const bodyCopy = inputRequest.clone();
+          void self.readStreamedBody(bodyCopy).then(({
+            body
+          }) => {
+            try {
+              requestData = JSON.parse(body);
+            } catch {
+              requestData = body;
+            }
+            self.emit({
+              type: "request-body",
+              timestamp: new Date(),
+              request: {
+                id: requestId || "unknown",
+                url: cleanUrl,
+                method,
+                data: requestData,
+                client: clientType
+              }
+            });
+          }).catch(() => {});
+        } catch {
+          // An unreadable body must not prevent the app's request.
+        }
+      }
       try {
         if (condition || outcome) await (0, _wait.waitBeforeDispatch)((condition?.delayMs ?? 0) + (outcome?.delayMs ?? 0), signal);
         (0, _wait.throwIfAborted)(signal);
@@ -912,9 +1003,9 @@ class NetworkListener {
       if (generation === self.xhrGeneration) {
         pendingCapture.get(this)?.();
         const xhr = this;
-        xhr._buoyRequestId = `xhr_${++self.requestCounter}`;
+        xhr._buoyRequestId = (0, _requestId.nextRequestId)("xhr");
         xhr._method = method;
-        xhr._url = url;
+        xhr._url = (0, _resolveRequestUrl.resolveRequestUrl)(url);
         xhr._buoyStartTime = Date.now();
         xhr._requestHeaders = {};
       }
@@ -936,6 +1027,7 @@ class NetworkListener {
       if (generation !== self.xhrGeneration || insideFetchHandoff) {
         return passthroughSend.call(this, data);
       }
+      if ((0, _applyToXhr.hasPendingStandardRequest)(this)) throw new DOMException("The request has already been sent.", "InvalidStateError");
       if (this.readyState !== 1 || this._sent) {
         return passthroughSend.call(this, data);
       }
@@ -947,6 +1039,7 @@ class NetworkListener {
       xhr._buoyStartTime = startTime;
       xhr._buoyTtfb = undefined;
       const requestHeaders = xhr._requestHeaders || {};
+      Object.assign(requestHeaders, injectedHeaders(url));
 
       // Skip ignored URLs
       if (self.shouldIgnoreUrl(url)) {
@@ -1209,7 +1302,7 @@ const startNetworkListener = () => getNetworkListener().startListening();
  * Stop network traffic monitoring
  */
 exports.startNetworkListener = startNetworkListener;
-const stopNetworkListener = () => getNetworkListener().stopListening();
+const stopNetworkListener = () => _networkListener?.stopListening();
 
 /**
  * Add a listener for network events
@@ -1234,7 +1327,7 @@ const addNetworkListener = listener => getNetworkListener().addListener(listener
  * Remove all registered network event listeners
  */
 exports.addNetworkListener = addNetworkListener;
-const removeAllNetworkListeners = () => getNetworkListener().removeAllListeners();
+const removeAllNetworkListeners = () => _networkListener?.removeAllListeners();
 
 /**
  * Check if network monitoring is currently active
@@ -1242,7 +1335,7 @@ const removeAllNetworkListeners = () => getNetworkListener().removeAllListeners(
  * @returns True if currently intercepting network traffic
  */
 exports.removeAllNetworkListeners = removeAllNetworkListeners;
-const isNetworkListening = () => getNetworkListener().isActive;
+const isNetworkListening = () => _networkListener?.isActive ?? false;
 
 /**
  * Get the number of registered network event listeners
@@ -1250,7 +1343,7 @@ const isNetworkListening = () => getNetworkListener().isActive;
  * @returns Number of active listeners
  */
 exports.isNetworkListening = isNetworkListening;
-const getNetworkListenerCount = () => getNetworkListener().listenerCount;
+const getNetworkListenerCount = () => _networkListener?.listenerCount ?? 0;
 
 /**
  * Whether both interceptors are actually reachable through the live global
@@ -1258,5 +1351,5 @@ const getNetworkListenerCount = () => getNetworkListener().listenerCount;
  * even after another tool re-assigns `globalThis.fetch` over the wrapper).
  */
 exports.getNetworkListenerCount = getNetworkListenerCount;
-const isNetworkInterceptionLive = () => getNetworkListener().isInterceptionLive();
+const isNetworkInterceptionLive = () => _networkListener?.isInterceptionLive() ?? false;
 exports.isNetworkInterceptionLive = isNetworkInterceptionLive;

package/lib/commonjs/network/utils/networkSavedStore.js

@@ -22,10 +22,10 @@ var _sharedUi = require("@buoy-gg/shared-ui");
  * A record exists while either flag is true and is dropped when both go false,
  * so all four states fall out without special cases.
  *
- * IDENTITY WARNING: `networkListener` mints request IDs from a per-runtime
- * counter (`fetch_1`, `xhr_2`), so after an app reload `fetch_1` is a
- * DIFFERENT request. Records are therefore keyed on a generated `key`, carry
- * the `sessionId` that captured them, and only trust `liveId` while that
+ * Request IDs include a runtime session and a counter. Saved records also
+ * track their owning session because live rows disappear on app reload.
+ * Records use a generated `key`, carry the `sessionId` that captured them,
+ * and only trust `liveId` while that
  * session is the current one. Snapshots restored from an earlier session get
  * their event `id` rewritten to `saved:<key>` so a restored pin can never
  * resolve to (or dedupe against) an unrelated live request.

package/lib/commonjs/network/utils/requestId.js

@@ -0,0 +1,16 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.nextRequestId = nextRequestId;
+const runtime = globalThis;
+
+// Keep identity across Fast Refresh; distinguish requests from earlier app runs.
+function nextRequestId(client) {
+  const sequence = runtime.__BUOY_NETWORK_REQUEST_SEQUENCE__ ??= {
+    session: `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`,
+    next: 0
+  };
+  return `${client}_${sequence.session}_${++sequence.next}`;
+}