@crouton-kit/capture 1.4.27 → 1.4.28

package/bin/capture

@@ -5654,8 +5654,12 @@ function forgetRecordFile(file) {
   }
 }
 function stillOurs(record5) {
+  return processOwnership(record5) === "ours";
+}
+function processOwnership(record5) {
   const observed = processPidBirthProvider.read(record5.pid);
-  return observed.status === "found" && sameBirth(observed.identity, record5.birth);
+  if (observed.status === "unknown") return "unknown";
+  return observed.status === "found" && sameBirth(observed.identity, record5.birth) ? "ours" : "gone";
 }
 function removeProfile(profileDir) {
   fs2.rmSync(assertUnderCaptureRoot(profileDir), { recursive: true, force: true });
@@ -5677,26 +5681,33 @@ async function reap(record5) {
   forgetRecordFile(recordPath(record5.token));
   removeProfile(record5.profileDir);
 }
-async function endpointAnswers(port) {
+async function probeEndpoint(port) {
   try {
     const response = await fetch(`http://${CDP_LOOPBACK_HOST}:${port}/json/version`, {
       signal: AbortSignal.timeout(ENDPOINT_PROBE_MS)
     });
-    return response.ok;
-  } catch {
-    return false;
+    return response.ok ? "up" : "down";
+  } catch (error4) {
+    const code = error4.cause?.code;
+    return code === "ECONNREFUSED" ? "down" : "unknown";
   }
 }
+async function endpointAnswers(port) {
+  return await probeEndpoint(port) === "up";
+}
 async function sweepOwnedBrowsers() {
   const reaped = [];
   for (const record5 of readOwnedBrowsers()) {
-    if (!stillOurs(record5)) {
+    const ownership2 = processOwnership(record5);
+    if (ownership2 === "unknown") continue;
+    if (ownership2 === "gone") {
       forgetRecordFile(recordPath(record5.token));
       removeProfile(record5.profileDir);
       reaped.push({ port: record5.port, pid: record5.pid, reason: "exited" });
       continue;
     }
-    if (record5.port === null || !await endpointAnswers(record5.port)) {
+    if (record5.port === null && Date.now() - Date.parse(record5.startedAt) <= READY_TIMEOUT_MS + ENDPOINT_PROBE_MS) continue;
+    if (record5.port === null || await probeEndpoint(record5.port) === "down") {
       await reap(record5);
       reaped.push({ port: record5.port, pid: record5.pid, reason: "unreachable" });
       continue;
@@ -10969,7 +10980,7 @@ function validateHarAppendBatch(value, source) {
   return { entries, incompleteLifecycles };
 }
 function captureVersion() {
-  const version = "1.4.27";
+  const version = "1.4.28";
   return typeof version === "string" && version.length > 0 ? version : "development";
 }
 function token() {
@@ -13071,7 +13082,7 @@ function wallTime(value) {
   }
 }
 function captureVersion2() {
-  const version = "1.4.27";
+  const version = "1.4.28";
   return typeof version === "string" && version.length > 0 ? version : "development";
 }
 function deepFreeze(value) {
@@ -230406,7 +230417,7 @@ function buildBrowserLaunchedResult(browser, swept) {
       line(text`mode `, data(browser.headless ? "headless" : "headed"))
     ])
   ];
-  if (swept > 0) sections.push(fact`swept ${swept} previously-launched browser(s) that had exited, stopped answering CDP, or gone idle.`);
+  if (swept > 0) sections.push(fact`swept ${swept} previously-launched browser(s) that had exited, refused CDP connections, or gone idle.`);
   return {
     tag: "browser-launched",
     attrs: { port: browser.port, pid: browser.pid, headless: browser.headless },
@@ -230454,7 +230465,7 @@ input:
   --headed        run with a visible window instead of headless
 
 output: <browser-launched port=\u2026 pid=\u2026> \u2014 the port to pass as --port (or CDP_PORT), the pid capture owns, and the executable that answered with its provenance (CAPTURE_BROWSER, puppeteer-cache, or system).
-effects: spawns a detached browser with a private profile under CAPTURE_ROOT, and registers it as capture-owned. Capture stops it on \`capture tab quit\`, or on the first later capture invocation once it has been unused for ${IDLE_REAP_MS / 6e4} minutes; a browser capture did not start is never signalled. Also sweeps previously-launched browsers that have exited, stopped answering CDP, or gone idle.`;
+effects: spawns a detached browser with a private profile under CAPTURE_ROOT, and registers it as capture-owned. Capture stops it on \`capture tab quit\`, or on the first later capture invocation once it has been unused for ${IDLE_REAP_MS / 6e4} minutes; a browser capture did not start is never signalled. Also sweeps previously-launched browsers that have exited, refused CDP connections, or gone idle.`;
   }
 });
 
@@ -230632,7 +230643,7 @@ input:
   --port <port>   probe one endpoint only, instead of discovering every localhost CDP endpoint; an active session's endpoint does not narrow it (CDP_PORT still pins one endpoint)
 
 output: <tabs endpoints=\u2026 tabs=\u2026> \u2014 one section per reachable endpoint (port, app, page-tab count, preferred marker, and a capture-owned pid marker on any browser \`tab launch\` started) listing each page tab's target id (first 8 chars, enough for --target), title, and url; an endpoint that failed the tab fetch is an endpoints-unreachable fact, never a silent omission.
-effects: probes local CDP endpoints over HTTP/WebSocket; no page-observable writes. Also sweeps capture-launched browsers, stopping any that have exited, stopped answering CDP, or gone idle \u2014 browsers capture did not start are never signalled.`;
+effects: probes local CDP endpoints over HTTP/WebSocket; no page-observable writes. Also sweeps capture-launched browsers, stopping any that have exited, refused CDP connections, or gone idle \u2014 browsers capture did not start are never signalled.`;
     ARC_ENDPOINT_NOTE = text`  note: Arc exposes only tabs opened over CDP as page targets; the tabs in its windows are not listed. Open one with "capture tab open <url> --port <port>", then "capture session start --port <port> --target <id>".`;
   }
 });
@@ -267641,7 +267652,7 @@ I/O contract: flags and positionals on input; one rendered prose block on stdout
 A CDP-enabled browser must be running; \`capture tab list\` is the probe, and \`capture tab launch\` starts one capture owns and reaps when nothing is (never hand-roll a detached browser \u2014 nothing reaps that). Capture never signals a browser it did not start, so attaching to your own with --port is unchanged. CDP_PORT / CDP_TARGET pin the browser + tab for target-selecting commands \u2014 precedence: explicit flag > active session > env. \`session start\` adopts only an explicit --target. When CRTR_NODE_ID is set (a crtr agent node), a browser command with no --port, no --target and no active session of that node is refused instead of falling back to CDP_PORT, CDP_TARGET or localhost discovery, because the browser found could belong to another node: run \`capture session start --url <url>\`, or pass --port or --target. \`capture tab list\` and commands that only read a recorded artifact are not refused.`;
 }
 function printVersion() {
-  const declared = "1.4.27";
+  const declared = "1.4.28";
   if (declared) {
     console.log(declared);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/capture",
-  "version": "1.4.27",
+  "version": "1.4.28",
   "description": "Browser automation and UI validation via CDP — session-based screenshots, HAR, a11y, click/type, and JS exec",
   "bin": {
     "capture": "./bin/capture"

package/src/cdp/browser-process.ts

@@ -191,8 +191,16 @@ function forgetRecordFile(file: string): void {
  * ONLY gate that authorizes a signal; an `unknown` read (a provider that could
  * not answer) is deliberately NOT a kill authorization. */
 function stillOurs(record: OwnedBrowser): boolean {
+  return processOwnership(record) === 'ours';
+}
+
+/** `gone` — the process exited, or its pid was recycled by a stranger; `unknown` —
+ * the provider could not answer (e.g. its `sysctl` read timed out on a loaded
+ * host), which says nothing about whether the browser is alive. */
+function processOwnership(record: OwnedBrowser): 'ours' | 'gone' | 'unknown' {
   const observed = processPidBirthProvider.read(record.pid);
-  return observed.status === 'found' && sameBirth(observed.identity, record.birth);
+  if (observed.status === 'unknown') return 'unknown';
+  return observed.status === 'found' && sameBirth(observed.identity, record.birth) ? 'ours' : 'gone';
 }
 
 /**
@@ -229,17 +237,26 @@ async function reap(record: OwnedBrowser): Promise<void> {
   removeProfile(record.profileDir);
 }
 
-async function endpointAnswers(port: number): Promise<boolean> {
+/** `up` — answered; `down` — the connection was refused or the answer was an
+ * error, so nothing is serving CDP there; `unknown` — no answer within the probe
+ * window or the request failed some other way. A browser starved of CPU on a
+ * loaded host answers slowly, so `unknown` is never evidence it is unusable. */
+async function probeEndpoint(port: number): Promise<'up' | 'down' | 'unknown'> {
   try {
     const response = await fetch(`http://${CDP_LOOPBACK_HOST}:${port}/json/version`, {
       signal: AbortSignal.timeout(ENDPOINT_PROBE_MS),
     });
-    return response.ok;
-  } catch {
-    return false;
+    return response.ok ? 'up' : 'down';
+  } catch (error) {
+    const code = (error as { cause?: { code?: unknown } }).cause?.code;
+    return code === 'ECONNREFUSED' ? 'down' : 'unknown';
   }
 }
 
+async function endpointAnswers(port: number): Promise<boolean> {
+  return (await probeEndpoint(port)) === 'up';
+}
+
 /**
  * Reconciles the registry with reality and reaps what no longer earns its
  * memory. Run at the top of every `tab` leaf that touches owned browsers — this
@@ -249,7 +266,12 @@ async function endpointAnswers(port: number): Promise<boolean> {
 export async function sweepOwnedBrowsers(): Promise<ReapedBrowser[]> {
   const reaped: ReapedBrowser[] = [];
   for (const record of readOwnedBrowsers()) {
-    if (!stillOurs(record)) {
+    const ownership = processOwnership(record);
+    // An unreadable process identity proves nothing: removing the profile of a
+    // browser that is in fact running would pull its user-data-dir out from
+    // under it. Leave the record for a sweep that can read it.
+    if (ownership === 'unknown') continue;
+    if (ownership === 'gone') {
       // Crashed, or SIGKILLed by someone else. Nothing to signal — just drop
       // the claim and the profile it left behind.
       forgetRecordFile(recordPath(record.token));
@@ -257,7 +279,11 @@ export async function sweepOwnedBrowsers(): Promise<ReapedBrowser[]> {
       reaped.push({ port: record.port, pid: record.pid, reason: 'exited' });
       continue;
     }
-    if (record.port === null || !(await endpointAnswers(record.port))) {
+    // A record with no port is a launch in flight in another capture process
+    // (the registry is shared by every agent on the host), not a dead browser —
+    // until the launch's own readiness deadline has passed.
+    if (record.port === null && Date.now() - Date.parse(record.startedAt) <= READY_TIMEOUT_MS + ENDPOINT_PROBE_MS) continue;
+    if (record.port === null || (await probeEndpoint(record.port)) === 'down') {
       await reap(record);
       reaped.push({ port: record.port, pid: record.pid, reason: 'unreachable' });
       continue;

package/src/cdp/commands/tab/launch.ts

@@ -21,7 +21,7 @@ input:
   --headed        run with a visible window instead of headless
 
 output: <browser-launched port=… pid=…> — the port to pass as --port (or CDP_PORT), the pid capture owns, and the executable that answered with its provenance (CAPTURE_BROWSER, puppeteer-cache, or system).
-effects: spawns a detached browser with a private profile under CAPTURE_ROOT, and registers it as capture-owned. Capture stops it on \`capture tab quit\`, or on the first later capture invocation once it has been unused for ${IDLE_REAP_MS / 60000} minutes; a browser capture did not start is never signalled. Also sweeps previously-launched browsers that have exited, stopped answering CDP, or gone idle.`;
+effects: spawns a detached browser with a private profile under CAPTURE_ROOT, and registers it as capture-owned. Capture stops it on \`capture tab quit\`, or on the first later capture invocation once it has been unused for ${IDLE_REAP_MS / 60000} minutes; a browser capture did not start is never signalled. Also sweeps previously-launched browsers that have exited, refused CDP connections, or gone idle.`;
 
 /** Pure `<browser-launched>` result builder — exported for tests. */
 export function buildBrowserLaunchedResult(
@@ -34,7 +34,7 @@ export function buildBrowserLaunchedResult(
       line(text`mode `, data(browser.headless ? 'headless' : 'headed')),
     ]),
   ];
-  if (swept > 0) sections.push(fact`swept ${swept} previously-launched browser(s) that had exited, stopped answering CDP, or gone idle.`);
+  if (swept > 0) sections.push(fact`swept ${swept} previously-launched browser(s) that had exited, refused CDP connections, or gone idle.`);
   return {
     tag: 'browser-launched',
     attrs: { port: browser.port, pid: browser.pid, headless: browser.headless },

package/src/cdp/commands/tab/list.ts

@@ -33,7 +33,7 @@ input:
   --port <port>   probe one endpoint only, instead of discovering every localhost CDP endpoint; an active session's endpoint does not narrow it (CDP_PORT still pins one endpoint)
 
 output: <tabs endpoints=… tabs=…> — one section per reachable endpoint (port, app, page-tab count, preferred marker, and a capture-owned pid marker on any browser \`tab launch\` started) listing each page tab's target id (first 8 chars, enough for --target), title, and url; an endpoint that failed the tab fetch is an endpoints-unreachable fact, never a silent omission.
-effects: probes local CDP endpoints over HTTP/WebSocket; no page-observable writes. Also sweeps capture-launched browsers, stopping any that have exited, stopped answering CDP, or gone idle — browsers capture did not start are never signalled.`;
+effects: probes local CDP endpoints over HTTP/WebSocket; no page-observable writes. Also sweeps capture-launched browsers, stopping any that have exited, refused CDP connections, or gone idle — browsers capture did not start are never signalled.`;
 
 export interface TabRow {
   id: string;