@modelprofile.com/browser-runtime 5.4.1 → 5.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/browser-runtime",
-  "version": "5.4.1",
+  "version": "5.5.0",
   "private": false,
   "description": "Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.",
   "main": "dist_ts/index.js",
@@ -30,7 +30,7 @@
     "@push.rocks/smartagent": "^6.0.0",
     "@push.rocks/smartipc": "^2.6.0",
     "@push.rocks/smartmcp": "^0.3.0",
-    "@push.rocks/smartpuppeteer": "^2.12.0",
+    "@push.rocks/smartpuppeteer": "^2.12.1",
     "ipaddr.js": "^2.5.0"
   },
   "devDependencies": {

package/readme.md

@@ -30,7 +30,7 @@ Chrome DevTools UI.
 
 ## Native video viewers
 
-Human leases expose `openVideoPeer(options?)`, `answerVideoPeer(negotiationId, description, options?)`, `closeVideoPeer(options?)`, and `getVideoStatistics(options?)`. Each operation runs through the resource's bounded, authorized and audited operation queue. Peer IDs are private to the lease; offers expose the negotiation ID and exact tab/generation/viewport source identity. Agent leases cannot open media peers. Releasing or revoking a human lease closes only its peer, preserving other viewers and agent work. Failed peer cleanup remains owned for a subsequent release attempt.
+Human leases expose `openVideoPeer(options?)`, `answerVideoPeer(negotiationId, description, options?)`, `closeVideoPeer(options?)`, and `getVideoStatistics(options?)`. Each operation retains bounded authorization, auditing and cancellation. Statistics use an independent observation slot so a slow telemetry read cannot block input or media lifecycle work. Peer IDs are private to the lease; offers expose the negotiation ID and exact tab/generation/viewport source identity. Agent leases cannot open media peers. Releasing or revoking a human lease closes only its peer, preserving other viewers and agent work. Failed peer cleanup remains owned for a subsequent release attempt.
 
 Set `video` on `BrowserRuntime` for trusted host limits or ICE configuration. Defaults use direct connections with no external STUN/TURN service and automatic GPU support. The private capture extension is loaded without weakening ordinary page proxy, DNS, permission or WebRTC confinement. `state.videoAcceleration` and peer statistics report actual browser acceleration/encoder support.
 
@@ -162,7 +162,7 @@ by `maxCapabilities`. Hosts must stop scheduling renewal when their viewer disco
 
 Agent actions are exactly `navigate`, `snapshot`, `screenshot`, `click`, `fill`, and `press`. Agents can read or delete screenshots created by their exact lease using `readArtifact()` and `deleteArtifact()`. Human leases additionally expose tab lifecycle, viewport, raw input, frame subscription/acknowledgement and refresh, and exact-resource artifact reads/deletes. JavaScript evaluation is not public.
 
-All participants share a bounded resource queue. Up to four wheel operations may run concurrently, with authorization and native-send admission kept in order. Other input, viewport, and semantic operations remain barriers behind preceding wheel work. Dialog replies use one interrupt slot so a paused document operation cannot block its own response. `maxQueuedOperationsPerLease` defaults to 128 and accepts 1 through 1,024; each participant has that bound, and the resource queue is bounded by its product with `maxCapabilitiesPerResource`. Overflow fails with `QUOTA_EXCEEDED`. Releasing a participant cancels only its queued and active work. Resource termination and shutdown cancel everyone. Started uncertain work must quiesce or the exact incarnation is terminated before operation settlement.
+BrowserRuntime alone owns the bounded execution scheduler shared by all participants. Host transports submit operations in order without adding a second execution queue or performing asynchronous authorization ahead of admission. One statistics read may run independently of mutations; its preflight and completion cannot fence input, navigation, or dialog replies. Up to four wheel operations may run concurrently, with authorization and native-send admission kept in order. Other input, viewport, and semantic operations remain barriers behind preceding wheel work. Dialog replies use one interrupt slot so a paused document operation cannot block its own response. `maxQueuedOperationsPerLease` defaults to 128 and accepts 1 through 1,024; each participant has that bound, and the resource queue is bounded by its product with `maxCapabilitiesPerResource`. Overflow fails with `QUOTA_EXCEEDED`. Releasing a participant cancels only its queued and active work. Resource termination and shutdown cancel everyone. Started uncertain work must quiesce or the exact incarnation is terminated before operation settlement.
 
 `setViewport()` stores the viewer's preferred width, height and device scale factor and returns `IBrowserRuntimeViewportResult` with the effective `viewport` and `viewportRevision`. The effective values are the componentwise minima across active viewers that have supplied a preference. Unchanged effective sizes do not restart the stream. Removing a viewer recomputes the viewport in the resource FIFO. Held keys and buttons are tracked per participant; leaving releases only inputs that no other participant holds. Viewport and tab/navigation transitions clear held input before changing the target. Resource-owned departure cleanup is bounded and audited as `releaseParticipant`; it does not call the external `beforeOperation` gate after the participant has lost access.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/browser-runtime',
-  version: '5.4.1',
+  version: '5.5.0',
   description: 'Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.'
 }

package/ts/classes.operationscheduler.ts

@@ -0,0 +1,81 @@
+interface IQueuedBrowserOperation {
+  action: string;
+  state: 'queued' | 'starting' | 'active' | 'settled';
+  signal: AbortSignal;
+  onQueuedAbort?: () => void;
+  resolve(value: unknown): void;
+  reject(error: unknown): void;
+}
+
+/** Resource-owned execution order. Telemetry never owns a mutation slot. */
+export class BrowserOperationScheduler<T extends IQueuedBrowserOperation> {
+  public readonly pending: T[] = [];
+  private readonly active = new Set<T>();
+  private admitting?: T;
+  private draining = false;
+
+  constructor(private execute: (operation: T, dispatched: () => void) => Promise<unknown>) {}
+
+  public enqueue(operation: T): void {
+    this.pending.push(operation);
+    this.drain();
+  }
+
+  public remove(operation: T): void {
+    const index = this.pending.indexOf(operation);
+    if (index >= 0) this.pending.splice(index, 1);
+    this.drain();
+  }
+
+  public canStart(action: string, active: readonly { action: string }[]): boolean {
+    if (action === 'getVideoStatistics') {
+      return !active.some(operation => operation.action === 'getVideoStatistics');
+    }
+    const mutations = active.filter(operation => operation.action !== 'getVideoStatistics');
+    if (action === 'respondToDialog') {
+      return !mutations.some(operation => operation.action === 'respondToDialog');
+    }
+    return mutations.length === 0 || action === 'dispatchWheel' && mutations.length < 4
+      && mutations.every(operation => operation.action === 'dispatchWheel');
+  }
+
+  private nextIndex(): number {
+    const active = [...this.active];
+    // A paused page cannot service its queue until the dialog is answered.
+    const dialog = this.pending.findIndex(operation => operation.action === 'respondToDialog');
+    if (dialog >= 0 && this.canStart('respondToDialog', active)) return dialog;
+    const mutation = this.pending.findIndex(operation => operation.action !== 'getVideoStatistics');
+    if (!this.admitting && mutation >= 0 && this.canStart(this.pending[mutation]!.action, active)) return mutation;
+    const telemetry = this.pending.findIndex(operation => operation.action === 'getVideoStatistics');
+    return telemetry >= 0 && this.canStart('getVideoStatistics', active) ? telemetry : -1;
+  }
+
+  private drain(): void {
+    if (this.draining) return;
+    this.draining = true;
+    try {
+      for (let index = this.nextIndex(); index >= 0; index = this.nextIndex()) {
+        const operation = this.pending.splice(index, 1)[0]!;
+        if (operation.state === 'settled') continue;
+        operation.state = 'starting';
+        this.active.add(operation);
+        if (operation.action !== 'getVideoStatistics' && operation.action !== 'respondToDialog') {
+          this.admitting = operation;
+        }
+        const dispatched = () => {
+          if (this.admitting === operation) this.admitting = undefined;
+          this.drain();
+        };
+        void this.execute(operation, dispatched).then(result => {
+          if (operation.state !== 'settled') { operation.state = 'settled'; operation.resolve(result); }
+        }, error => {
+          if (operation.state !== 'settled') { operation.state = 'settled'; operation.reject(error); }
+        }).finally(() => {
+          if (operation.onQueuedAbort) operation.signal.removeEventListener('abort', operation.onQueuedAbort);
+          this.active.delete(operation);
+          dispatched();
+        });
+      }
+    } finally { this.draining = false; }
+  }
+}

package/ts/classes.runtime.ts

@@ -3,6 +3,7 @@ import { validateAgentAction } from './actions.js';
 import { BrowserArtifactStore } from './classes.artifactstore.js';
 import { BrowserEgressProxy } from './classes.egressproxy.js';
 import { BrowserRuntimeOwnership } from './classes.runtimeownership.js';
+import { BrowserOperationScheduler } from './classes.operationscheduler.js';
 import { runProductionConfinementProbe } from './confinement.js';
 import { BrowserRuntimeError } from './errors.js';
 import {
@@ -263,10 +264,8 @@ interface IResourceSlot {
   unsubscribeSession?: () => void;
   leases: Map<string, ILeaseRecord>;
   operations: Set<IOperationRecord>;
-  activeQueuedOperations: Set<IQueuedOperationRecord>;
   inputCleanup?: { session: ILiveBrowserSessionLike; incarnationGeneration: number; promise: Promise<void> };
-  operationQueue: IQueuedOperationRecord[];
-  operationSchedulerRunning: boolean;
+  operationScheduler: BrowserOperationScheduler<IQueuedOperationRecord>;
   frameSubscriptions: Map<string, IFrameSubscriptionRecord>;
   frameCaptureEnabled?: boolean;
   highestFrameSequence: number;
@@ -746,9 +745,7 @@ export class BrowserRuntime {
       highestFrameSequence: 0,
       producerAcknowledgements: new Set(),
       operations: new Set(),
-      activeQueuedOperations: new Set(),
-      operationQueue: [],
-      operationSchedulerRunning: false,
+      operationScheduler: new BrowserOperationScheduler((operation, dispatched) => this.executeQueuedOperation(operation, dispatched)),
       lifecycleTail: Promise.resolve(),
       lifecycleOperationCount: 0,
       terminationRequestGeneration: 0,
@@ -2371,9 +2368,9 @@ export class BrowserRuntime {
     this.requireQueuedLease(lease, participantCleanup);
     this.assertSlotAvailable(slot);
     if (!participantCleanup && (
-      slot.operationQueue.filter((entry) => entry.lease === lease).length
+      slot.operationScheduler.pending.filter((entry) => entry.lease === lease).length
         >= this.options.maxQueuedOperationsPerLease
-      || slot.operationQueue.length >= this.options.maxQueuedOperationsPerLease
+      || slot.operationScheduler.pending.length >= this.options.maxQueuedOperationsPerLease
         * this.options.maxCapabilitiesPerResource
     )) {
       throw new BrowserRuntimeError('QUOTA_EXCEEDED');
@@ -2406,8 +2403,7 @@ export class BrowserRuntime {
       const onQueuedAbort = (): void => {
         if (queued.state !== 'queued' && queued.state !== 'starting') return;
         if (queued.state === 'queued') {
-          const index = slot.operationQueue.indexOf(queued);
-          if (index >= 0) slot.operationQueue.splice(index, 1);
+          slot.operationScheduler.remove(queued);
         }
         queued.state = 'settled';
         signal.removeEventListener('abort', onQueuedAbort);
@@ -2427,49 +2423,10 @@ export class BrowserRuntime {
         onQueuedAbort();
         return;
       }
-      slot.operationQueue.push(queued);
-      this.drainOperationQueue(slot);
+      slot.operationScheduler.enqueue(queued);
     });
   }
 
-  private drainOperationQueue(slot: IResourceSlot): void {
-    if (slot.operationSchedulerRunning) return;
-    slot.operationSchedulerRunning = true;
-    void (async () => {
-      try {
-        while (slot.operationQueue.length > 0) {
-          // Dialog replies must unblock a page operation already waiting on Chrome.
-          const dialogIndex = slot.operationQueue.findIndex(entry => entry.classification === 'dialog');
-          const index = dialogIndex >= 0 ? dialogIndex : 0;
-          const queued = slot.operationQueue[index]!;
-          const active = [...slot.activeQueuedOperations];
-          if (queued.classification === 'dialog') {
-            if (active.some(entry => entry.classification === 'dialog')) break;
-          } else if (active.length > 0 && !(queued.action === 'dispatchWheel'
-            && active.length < 4 && active.every(entry => entry.action === 'dispatchWheel'))) break;
-          slot.operationQueue.splice(index, 1);
-          if (queued.state === 'settled') continue;
-          queued.state = 'starting';
-          slot.activeQueuedOperations.add(queued);
-          let dispatched!: () => void;
-          const admission = new Promise<void>(resolve => { dispatched = resolve; });
-          void this.executeQueuedOperation(queued, dispatched).then(result => {
-            if (queued.state !== 'settled') { queued.state = 'settled'; queued.resolve(result); }
-          }, error => {
-            if (queued.state !== 'settled') { queued.state = 'settled'; queued.reject(error); }
-          }).finally(() => {
-            dispatched();
-            if (queued.onQueuedAbort) queued.signal.removeEventListener('abort', queued.onQueuedAbort);
-            slot.activeQueuedOperations.delete(queued);
-            this.drainOperationQueue(slot);
-          });
-          // Preserve authorization and native-send order without waiting for wheel ACKs.
-          await admission;
-        }
-      } finally { slot.operationSchedulerRunning = false; }
-    })();
-  }
-
   private async executeQueuedOperation(queued: IQueuedOperationRecord, dispatched: () => void): Promise<unknown> {
     const { lease, action, classification } = queued;
     const slot = lease.slot;
@@ -2491,9 +2448,7 @@ export class BrowserRuntime {
       this.requireQueuedLease(lease, queued.participantCleanup);
       this.assertSlotAvailable(slot);
       const active = [...slot.operations];
-      if (classification === 'dialog' ? active.some(operation => operation.action === 'respondToDialog')
-        : active.length > 0 && !(action === 'dispatchWheel' && active.length < 4
-          && active.every(operation => operation.action === 'dispatchWheel'))) {
+      if (!slot.operationScheduler.canStart(action, active)) {
         throw new BrowserRuntimeError('BUSY');
       }
       session = slot.session!;
@@ -2571,7 +2526,9 @@ export class BrowserRuntime {
           if (classification === 'navigation' || classification === 'tab') {
             await this.releaseAllParticipantInput(slot, session);
           }
-          if (classification !== 'dialog') await this.releaseStaleParticipantInput(slot, session);
+          if (classification !== 'dialog' && action !== 'getVideoStatistics') {
+            await this.releaseStaleParticipantInput(slot, session);
+          }
           combinedSignal.throwIfAborted();
           const result = queued.execute(combinedSignal, session);
           dispatched();