@farmslot/adapter-web 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to `@farmslot/adapter-web` are tracked here.
 
 - Active-development baseline; add user-facing changes here before release or package publication.
 
+## 0.3.1 - 2026-10-06
+
+- Browser probes no longer leave Chrome for Testing running when the resolver is stopped mid-probe (a hook timeout, a signal, or the resolver killed outright): the probe browser and its temporary profile are removed.
+  - A resolver killed outright cannot clean up; the next probe by the same user stops its browser and removes its profile. `browser-resolver` exports that step as `reapOrphanedProbes(tmp?)`.
+
 ## 0.3.0 - 2026-10-05
 
 - Add `dapp`, the web3 layer for a dapp under test, moved from `@deeeed/metamask-harness`'s Web Terminal adapter: the strict EIP-1193 test wallet (`createStrictWallet`), the page script that wraps the app's provider and logs its wallet requests or injects a provider the host answers (`pageScriptSource`, `pageReadyExpression`), the host's side of its bindings (`createWalletRequestBinding`: frame and document attribution, `outside-app-frame` and `unattributed` records, refusals) and the wallet request log (`windowSinceCursor`, `resetWindow`, `evaluateSignatureLog`, `awaitSignatureLog`, `writeLogArtifact`). Product policy is passed in: the typed data to refuse (`refuseTypedData`), the injected wallet's EIP-6963 identity and the log entries and typed-data classes a product forbids. Page bindings are `__farmslotWallet{Log,Request,Resolve}` and the page marker `__farmslotDapp`.

package/dist/browser-resolver.d.cts

@@ -64,6 +64,7 @@ export function probeLaunch(executable: any, { launchMethod, display, settleMs,
     durationMs: number;
 }>;
 export function readProbeCache(cachePath: any): any;
+export function reapOrphanedProbes(tmp?: string): void;
 export function renderCheck(port: any): Promise<{
     ok: boolean;
     reason?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farmslot/adapter-web",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Web platform adapter for Farmslot recipes: resolve and launch an isolated Chromium, own its CDP port, load unpacked extensions, and keep macOS focus.",
   "type": "commonjs",
   "exports": {

package/src/browser-resolver.cjs

@@ -529,8 +529,12 @@ async function withProbeLock(
   }
 }
 
-// Probes in flight, so a CLI watchdog can stop their browsers before exiting.
-const activeProbeProfiles = new Set();
+// Probes in flight (profile -> spawned browser pid, or null for LaunchServices),
+// so a watchdog, a signal or process exit can stop their browsers first.
+const activeProbes = new Map();
+const PROBE_PROFILE_PREFIX = 'farmslot-browser-probe-';
+const PROBE_PROFILE_OWNER = new RegExp(`^${PROBE_PROFILE_PREFIX}(\\d+)-`, 'u');
+const PROBE_SIGNALS = ['SIGTERM', 'SIGINT', 'SIGHUP', 'SIGQUIT'];
 
 function profilePids(profile) {
   try {
@@ -556,6 +560,72 @@ function killProfile(profile) {
   }
 }
 
+// Synchronous, so it also runs from 'exit' and signal handlers. The browser is
+// outside the caller's process group (LaunchServices parents it; a spawned
+// probe is detached), so a group kill of the caller never reaches it.
+function stopProbe(profile) {
+  const pid = activeProbes.get(profile);
+  try {
+    if (pid) process.kill(-pid, 'SIGKILL');
+  } catch {
+    // Already exited.
+  }
+  killProfile(profile);
+  fs.rmSync(profile, { recursive: true, force: true });
+  activeProbes.delete(profile);
+}
+
+function stopActiveProbes() {
+  for (const profile of [...activeProbes.keys()]) stopProbe(profile);
+}
+
+// A hook timeout sends SIGTERM to the caller's process group. Stop the probe
+// browsers, then let the signal end the process as it would have; a host with
+// its own handler for that signal (a `once` handler is already gone by now, so
+// it is noted at install) keeps control of the exit.
+function onProbeSignal(signal) {
+  stopActiveProbes();
+  const hostHandles = hostSignals.has(signal) || process.listenerCount(signal) > 1;
+  setProbeExitHandlers(false);
+  if (!hostHandles) process.kill(process.pid, signal);
+}
+
+let probeExitHandlers = false;
+let hostSignals = new Set();
+
+function setProbeExitHandlers(on) {
+  if (probeExitHandlers === on) return;
+  probeExitHandlers = on;
+  if (on) hostSignals = new Set(PROBE_SIGNALS.filter((signal) => process.listenerCount(signal)));
+  for (const signal of PROBE_SIGNALS) {
+    if (on) process.on(signal, onProbeSignal);
+    else process.off(signal, onProbeSignal);
+  }
+  if (on) process.on('exit', stopActiveProbes);
+  else process.off('exit', stopActiveProbes);
+}
+
+function trackProbe(profile, pid = null) {
+  activeProbes.set(profile, pid);
+  setProbeExitHandlers(true);
+}
+
+// A resolver killed outright (SIGKILL) cannot clean up. Its profile name
+// carries its pid, so the next probe by the same user stops that browser and
+// removes the profile. Another user's profiles (a shared /tmp) are left alone.
+function reapOrphanedProbes(tmp = os.tmpdir()) {
+  for (const name of fs.readdirSync(tmp)) {
+    const owner = PROBE_PROFILE_OWNER.exec(name);
+    if (!owner || Number(owner[1]) === process.pid || pidAlive(Number(owner[1]))) continue;
+    const profile = path.join(tmp, name);
+    // Another resolver's reaper may have removed it already.
+    const stat = fs.lstatSync(profile, { throwIfNoEntry: false });
+    if (!stat || stat.uid !== process.getuid()) continue;
+    killProfile(profile);
+    fs.rmSync(profile, { recursive: true, force: true });
+  }
+}
+
 // `--version` succeeds even for a build that crashes at startup, so a browser
 // is accepted only when a start answers on DevTools, paints a frame, and
 // survives a settle without dying. The Chrome for Testing crash on macOS 26+
@@ -574,8 +644,9 @@ async function probeLaunch(
   } = {},
 ) {
   const method = effectiveLaunchMethod(executable, launchMethod);
-  const profile = fs.mkdtempSync(path.join(os.tmpdir(), 'farmslot-browser-probe-'));
-  activeProbeProfiles.add(profile);
+  reapOrphanedProbes();
+  const profile = fs.mkdtempSync(path.join(os.tmpdir(), `${PROBE_PROFILE_PREFIX}${process.pid}-`));
+  trackProbe(profile);
   const startedAt = Date.now();
   const verdict = (ok, reason, transient = false) => ({
     ok,
@@ -589,6 +660,8 @@ async function probeLaunch(
   let exited = null;
   try {
     const port = await freePort();
+    // A host that survives a signal resumes here after stopProbe ran.
+    if (!activeProbes.has(profile)) return verdict(false, 'probe stopped by its caller', true);
     // A headful probe starts like the slot browsers (the launchers and the
     // library autolaunch): in the background with no startup window (Chrome
     // activates itself when it opens one); renderCheck opens a background
@@ -615,6 +688,7 @@ async function probeLaunch(
       });
     } else {
       child = spawn(executable, args, { detached: true, stdio: 'ignore' });
+      if (child.pid) trackProbe(profile, child.pid);
       child.on('exit', (code, signal) => {
         exited = signal ?? `code ${code}`;
       });
@@ -624,12 +698,16 @@ async function probeLaunch(
     }
     const alive = () =>
       method === LAUNCH_SERVICES ? profilePids(profile).length > 0 : exited === null;
+    // stopProbe removes the profile: the caller stopped the browser, so its
+    // exit says nothing about the binary.
     const died = (when) =>
-      verdict(
-        false,
-        `exited ${when}${exited ? ` (${exited})` : ''}`,
-        String(exited).startsWith('spawn failed'),
-      );
+      activeProbes.has(profile)
+        ? verdict(
+            false,
+            `exited ${when}${exited ? ` (${exited})` : ''}`,
+            String(exited).startsWith('spawn failed'),
+          )
+        : verdict(false, 'probe stopped by its caller', true);
     let up = false;
     while (!up && Date.now() - startedAt < startupMs) {
       if (exited) return died('during startup');
@@ -655,7 +733,9 @@ async function probeLaunch(
       if (!alive()) return died('after DevTools started');
       await sleep(250);
     }
-    if (await devtoolsAnswers(port)) return verdict(true, 'started and rendered');
+    const answers = await devtoolsAnswers(port);
+    if (!activeProbes.has(profile)) return verdict(false, 'probe stopped by its caller', true);
+    if (answers) return verdict(true, 'started and rendered');
     // Only a proven exit is a property of the binary.
     return alive()
       ? verdict(false, 'DevTools stopped answering after the settle', true)
@@ -663,15 +743,11 @@ async function probeLaunch(
   } catch (error) {
     return verdict(false, `launch failed: ${error.message}`, true);
   } finally {
-    try {
-      if (child?.pid) process.kill(-child.pid, 'SIGKILL');
-    } catch {
-      // Already exited.
-    }
-    killProfile(profile);
+    stopProbe(profile);
+    if (activeProbes.size === 0) setProbeExitHandlers(false);
+    // A dying browser can still write into its profile; remove it once more.
     await sleep(300);
     fs.rmSync(profile, { recursive: true, force: true });
-    activeProbeProfiles.delete(profile);
   }
 }
 
@@ -1093,10 +1169,7 @@ async function main(argv) {
   }
   const args = parseCliArgs(rest);
   const watchdog = setTimeout(() => {
-    for (const profile of activeProbeProfiles) {
-      killProfile(profile);
-      fs.rmSync(profile, { recursive: true, force: true });
-    }
+    stopActiveProbes();
     process.stderr.write(
       `browser-resolver ${command} did not finish within ${CLI_DEADLINE_MS}ms.\n`,
     );
@@ -1200,6 +1273,7 @@ module.exports = {
   probeCacheKey,
   probeLaunch,
   readProbeCache,
+  reapOrphanedProbes,
   renderCheck,
   resolveBrowser,
   withProbeLock,