@petukhovart/agent-view 0.13.1 → 0.15.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "agent-view",
       "source": "./",
-      "description": "Visual verification CLI for desktop apps (Electron/Tauri/Browser) via Chrome DevTools Protocol. Inspect DOM, interact with UI, capture screenshots, and read WebGL scene graphs."
+      "description": "Visual verification CLI for Electron/Tauri/Chromium apps via Chrome DevTools Protocol. Ships with verify skill for easy and cheap checks against a live app, including heap-snapshot memory-leak debugging."
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,21 +1,21 @@
-{
-  "name": "agent-view",
-  "description": "Visual verification CLI for desktop apps (Electron/Tauri/Browser) via Chrome DevTools Protocol. Ships the verify skill: run DOM, screenshot, eval, watch, console and log-feed checks against a live app.",
-  "version": "0.13.0",
-  "keywords": [
-    "cdp",
-    "electron",
-    "tauri",
-    "desktop",
-    "testing",
-    "accessibility",
-    "screenshot",
-    "automation"
-  ],
-  "author": {
-    "name": "PetukhovArt"
-  },
-  "homepage": "https://github.com/PetukhovArt/agent-view",
-  "repository": "https://github.com/PetukhovArt/agent-view",
-  "license": "MIT"
-}
+{
+  "name": "agent-view",
+  "description": "Visual verification CLI for Electron/Tauri/Chromium apps via Chrome DevTools Protocol. Ships with verify skill for easy and cheap checks against a live app, including heap-snapshot memory-leak debugging.",
+  "version": "0.15.0",
+  "keywords": [
+    "cdp",
+    "electron",
+    "tauri",
+    "desktop",
+    "testing",
+    "accessibility",
+    "screenshot",
+    "automation"
+  ],
+  "author": {
+    "name": "PetukhovArt"
+  },
+  "homepage": "https://github.com/PetukhovArt/agent-view",
+  "repository": "https://github.com/PetukhovArt/agent-view",
+  "license": "MIT"
+}

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Artem Petukhov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Artem Petukhov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -31,7 +31,7 @@ Works with any agent that can run shell commands. There's a Claude Code plugin i
 
 - Reads state inside `SharedWorker`, `ServiceWorker`, and dedicated workers. Half of a modern app's state lives there, and most browser-automation tools don't follow it.
 - Every command takes `--window <id>`. Settings, tray, and detached windows in Electron and Tauri apps work the same as the main window.
-- Electron, Tauri (WebView2 and WebKit), and plain Chromium. One CLI, same commands.
+- Electron, Tauri on Windows (WebView2), and plain Chromium. One CLI, same commands. Tauri on macOS/Linux embeds WebKit, which has no Chrome DevTools Protocol, so it is out of reach.
 - `click`, `fill`, and `drag` fire real CDP input events. Vue `v-model`, React controlled inputs, and native fields actually accept the value; synthetic DOM events fail silently there.
 - `watch` emits RFC-6902 JSON-patches of any JS expression between two events. Answers "what mutated after the click?" without parsing screenshots.
 - `dom` returns the accessibility tree with `[ref=N]` handles. `--compact` cuts deep trees by 40–60%; `--diff`, `--count`, and `--max-lines` keep output bounded. `screenshot --crop` and WebP scaling do the same for vision tokens.
@@ -86,7 +86,7 @@ In `package.json`, wrap the dev script with [`cross-env`](https://www.npmjs.com/
 }
 ```
 
-Then `npm run dev` as usual. Devtools must be enabled in `tauri.conf.json` (default in `tauri dev`; for release builds, enable the `devtools` Cargo feature). macOS/Linux WebKit use different env vars; see [Enabling CDP](#enabling-cdp).
+Then `npm run dev` as usual. Devtools must be enabled in `tauri.conf.json` (default in `tauri dev`; for release builds, enable the `devtools` Cargo feature). Windows only: on macOS/Linux Tauri embeds WebKit, which speaks the WebKit Remote Inspector protocol, not CDP, so agent-view cannot attach there.
 </details>
 
 <details>
@@ -154,6 +154,9 @@ The daemon is why `dom → click → dom` runs in ~17ms total: one persistent CD
 | `console`     | `console.log` + `Log.entryAdded` per page **and per worker**, with `--follow --until <pattern>`. |
 | `logs`        | Durable file feed of page + worker console, surviving reloads and worker restarts. `tail --grep/--since/--level`, `clear`, plus re-injecting `--probe` scripts. |
 | `network`     | Request/response timeline, headers, timing, bodies, and WebSocket/SSE frames. Filters: `--url`, `--method`, `--status`, `--type`. Captures page-load traffic. |
+| `coverage`    | Which functions ran since the last `--clear`. Turns "does any action reach this code?" into a positive answer. Filters: `--filter`, `--file`, `--count`. |
+| `listeners`   | Event handlers bound to a node, each with the `file:line` it was declared at.            |
+| `heap`        | Named heap snapshots diffed by class: what grew after repeating an action, how many are detached DOM nodes, and what retains them. |
 | `upload`      | Puts files into a file input — no picker opens. `--selector` reaches the hidden inputs that have no ref. |
 | `dialog`      | JS modals are answered automatically so they cannot freeze the run; sets the answer, and pre-answers native file pickers with `arm`. |
 | `wait`        | Block until an element appears (default 10s).                                            |
@@ -264,7 +267,7 @@ npx electron-vite dev -- --remote-debugging-port=9876
 
 | Runtime              | Setup                                      |
 |----------------------|--------------------------------------------|
-| **Tauri**            | CDP via devtools configuration             |
+| **Tauri (Windows)**  | `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`, see above. WebKit builds (macOS/Linux) are not supported |
 | **Any Chromium app** | `--remote-debugging-port=9876` launch flag |
 
 ### Verify CDP is working
@@ -375,6 +378,7 @@ Clicks a DOM element by ref ID or coordinates.
 agent-view click 5                  # By ref from dom output
 agent-view click --pos 100,200      # By coordinates (for canvas)
 agent-view click 5 --double         # Double-click (fires dblclick handlers)
+agent-view click 5 --right          # Right-click (fires contextmenu)
 ```
 
 ### `fill`
@@ -586,6 +590,81 @@ agent-view network --clear                       # drop in-memory ring
 
 Sensitive headers (`Authorization`, `Cookie`, `Set-Cookie`, `X-Api-Key`, …) are redacted by default; `--raw-headers` reveals them. Request/response **bodies** stay off until the project owner sets `"captureBody": true` (bodies can carry tokens/PII). WebSocket frame payloads are visible by default — seeing them is the point — capped per frame. `--follow` and `--until` mirror `console`. `--target` / `--window` scope to one target.
 
+### `coverage`
+
+Reports which JavaScript functions ran since the last `--clear`, grouped by script URL. Answers the one question the DOM and the store cannot: *does any user action actually reach this code?* Built on the V8 precise-coverage delta — `--clear` resets the counters, the next call reads and resets them again.
+
+```bash
+agent-view coverage --clear                     # open a window: counters reset, counting starts
+agent-view coverage                             # what ran since --clear (and reset again)
+agent-view coverage --file "OrderForm"          # only scripts whose URL contains this
+agent-view coverage --filter "onSubmit"         # function name, or script URL, contains this
+agent-view coverage --count                     # just the number of executed functions
+agent-view coverage --all                       # include node_modules / runtime / url-less scripts
+agent-view coverage --max-lines 40              # cap the output, tail `… N more lines`
+agent-view coverage --target bench-worker       # a worker's own coverage window
+```
+
+The workflow is `clear → act → check`, the same shape as `console` and `network`:
+
+```bash
+agent-view coverage --clear   && agent-view click --filter "Save"   && agent-view coverage --file "OrderForm"
+```
+
+**Every read is also a reset.** Two `coverage` calls in a row report different things: the second one covers only what happened between them. That is what makes a single click attributable.
+
+**Only positive answers are cheap.** A function in the output proves that this action executed it. An empty result — `(no code executed since --clear)` — proves only that *this* action did not reach the code, never that nothing can. Exit code stays 0: it is an answer, not a failure.
+
+Granularity is the function, not the line, so no source map is involved: in a dev build the module URL already is the file path. Unnamed functions (arrows, module top level) print as `<anonymous>@<byte-offset>`, which keeps two of them apart in the same file.
+
+`--target` gives a worker its own window — the only way to prove that SharedWorker code ran. Coverage lives in the V8 isolate, so `location.reload()` wipes it: open a new window after a reload. Reading before any `--clear` is a usage error, not an empty result.
+
+By default `node_modules`, runtime bundles (`node:`, `chrome-extension://`), and scripts with no URL at all (`eval`, `new Function`) are hidden, with a `… N scripts hidden (--all to show)` tail. `--count` prints a single integer. `--max-lines <n>` caps the output and appends `… N more lines`, as on `dom` and `network`.
+
+### `listeners`
+
+Lists the event listeners bound to a DOM node, each with the file and line its handler was declared at. Answers "what is wired to this button" without reading the source.
+
+```bash
+agent-view listeners --filter "Save"    # node by accessible name, as in `click --filter`
+agent-view listeners --ref 12           # node by ref from `dom`
+agent-view listeners --selector "#save" # node by CSS — reaches nodes the AX tree never exposes
+agent-view listeners --depth -1         # include the whole subtree (CDP depth; default 0)
+```
+
+Positions are printed 1-based (`file.vue:88:14`), so they paste straight into an editor or a review comment. When the handler's script cannot be resolved to a URL — code injected after the last scan, or `eval`'d code, which has no URL at all — the location falls back to `scriptId:7:88:14`.
+
+A node with no handlers prints `(no listeners on this node)` and exits 0. A `--filter` that matches nothing is an error with the usual `No element found matching "<text>"`.
+
+`--selector` is the escape hatch for a node the AX tree never exposes — a hidden or `aria-hidden` element has no `[ref=N]` at all, so no other flag can address it. A selector matching nothing is an error: `No element matches selector "<css>"`.
+
+### `heap`
+
+Takes named V8 heap snapshots and compares them by class. Answers "does repeating this action leak memory, and what holds the leaked objects?" without the multi-hundred-MB `.heapsnapshot` ever reaching the agent: the server parses it and keeps only the class table and the graph.
+
+```bash
+agent-view heap take --name baseline            # full GC, then snapshot
+# … repeat the suspected action ~10 times with click / fill / eval …
+agent-view heap take --name target
+agent-view heap diff baseline target            # per-class growth, largest first
+agent-view heap diff --detached                 # detached DOM nodes only
+agent-view heap retainers "Detached <div class=\"row\">"   # who holds them, one hop up
+agent-view heap summary --filter "OrderRow"     # one snapshot's classes by size
+agent-view heap list                            # snapshots the server holds
+agent-view heap clear
+```
+
+```
+baseline → target (page:Orders): +3,201 nodes, +2.4 MB, detached +240 (+960 KB)
+class                          Δcount     Δsize   count
+Detached <div class="row">       +240  +960 KB     252
+OrderRowVM                        +10   +12 KB      10
+```
+
+A `Δcount` that is a multiple of the repetition count is the leak; `+3` is noise. `retainers` names the object and property holding the instances (`Array []`, `RowRegistry .el`), counting distinct instances and skipping weak edges. One hop only: retained sizes, dominators and full retaining paths are not computed, and for those the app's own DevTools Memory panel shows the same class names on the same CDP port.
+
+Snapshots live in the lazy server and vanish when it idles out (5 min) or on `clear`. `--target <worker>` snapshots a worker's own heap. The full method, with a table of what each diff shape usually means, is in [`skills/verify/references/memory-leaks.md`](skills/verify/references/memory-leaks.md).
+
 ### `watch`
 
 Polls a JS expression and streams JSON-patch (RFC 6902) diffs as it changes. Closes the "what changed between click and final state?" gap that screenshots and DOM dumps can't cover. **Requires `"allowEval": true`** (same gate as `eval`).

package/dist/cdp/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/cdp/transport.ts"],"names":[],"mappings":"AAEA,OAAO,EAaL,KAAK,SAAS,EAId,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAWjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AA4BhD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAmCD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAkBpE;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQ9E;AAoqBD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA2BhG;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,WAAW,CAAC,CA2StB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/cdp/transport.ts"],"names":[],"mappings":"AAEA,OAAO,EAaL,KAAK,SAAS,EAId,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAcjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AA4BhD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAmCD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAkBpE;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQ9E;AAyyBD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA+BhG;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,WAAW,CAAC,CAqVtB"}

package/dist/cdp/transport.js

@@ -627,6 +627,100 @@ function attachDisconnectSubscription(client) {
         handlers.add(handler);
     };
 }
+/**
+ * Coverage is a delta, not a total: `takePreciseCoverage` resets the counters, so
+ * the window between two takes is attributable to exactly what happened in it.
+ * `detailed: false` keeps the granularity at the function — enough to name a
+ * handler, and free of the source-map remapping that byte ranges would need.
+ */
+function attachCoverage(client) {
+    const Profiler = client.Profiler;
+    let started = false;
+    return {
+        async start() {
+            if (!started) {
+                await Profiler.enable();
+                await Profiler.startPreciseCoverage({ callCount: true, detailed: false });
+                started = true;
+            }
+            await Profiler.takePreciseCoverage(); // discarded — this take *is* the clear
+        },
+        async take() {
+            if (!started)
+                return null;
+            const { result } = await Profiler.takePreciseCoverage();
+            const scripts = [];
+            for (const script of result) {
+                const functions = [];
+                for (const fn of script.functions) {
+                    const count = Math.max(0, ...fn.ranges.map((r) => r.count));
+                    if (count === 0)
+                        continue;
+                    functions.push({ name: fn.functionName, offset: fn.ranges[0]?.startOffset ?? 0, count });
+                }
+                if (functions.length > 0)
+                    scripts.push({ scriptId: script.scriptId, url: script.url, functions });
+            }
+            return scripts;
+        },
+    };
+}
+/** Chunks arrive before the command resolves, so subscribing first and joining after is the whole protocol. */
+async function takeHeapSnapshotImpl(client) {
+    const HeapProfiler = client.HeapProfiler;
+    const chunks = [];
+    const unsubscribe = HeapProfiler.addHeapSnapshotChunk(({ chunk }) => { chunks.push(chunk); });
+    try {
+        await HeapProfiler.takeHeapSnapshot({ reportProgress: false, captureNumericValue: false });
+    }
+    finally {
+        unsubscribe();
+    }
+    return chunks.join('');
+}
+/** Bounds the wait for the `scriptParsed` replay when an id is still missing. */
+const SCRIPT_PARSED_DEADLINE_MS = 1_000;
+const SCRIPT_PARSED_POLL_MS = 20;
+/**
+ * `Debugger.scriptParsed` is replayed for every already-parsed script the moment
+ * `Debugger.enable` lands, and it is the only CDP event carrying scriptId → URL.
+ * The domain is enabled only for the length of that replay: leaving it on keeps
+ * V8 deoptimized for every other command on the session, and nothing here needs
+ * a breakpoint.
+ *
+ * The map accumulates, so ids already known cost nothing and a scan runs only
+ * when one misses. The wait is a gate on the ids actually asked for, not a fixed
+ * pause — a fixed pause is either too short on a large app (missing URLs) or
+ * wasted on every call. An id still missing at the deadline stays unresolved,
+ * which the formatter prints as a raw `scriptId`.
+ */
+function attachScriptUrls(client) {
+    const urls = new Map();
+    // Subscribe before any enable, per the transport-wide rule.
+    client.on('Debugger.scriptParsed', ((p) => {
+        urls.set(p.scriptId, p.url ?? '');
+    }));
+    const allKnown = (wanted) => wanted.every((id) => urls.has(id));
+    return async (wanted) => {
+        if (allKnown(wanted))
+            return urls;
+        const Debug = client.Debugger;
+        try {
+            await Debug.enable();
+            const deadline = Date.now() + SCRIPT_PARSED_DEADLINE_MS;
+            while (!allKnown(wanted) && Date.now() < deadline) {
+                await new Promise((r) => setTimeout(r, SCRIPT_PARSED_POLL_MS));
+            }
+        }
+        finally {
+            try {
+                await Debug.disable();
+            }
+            catch { /* target went away mid-scan */ }
+        }
+        return urls;
+    };
+}
 export async function connectToRuntime(port, target) {
     if (process.env.AV_DEBUG_CONSOLE) {
         // eslint-disable-next-line no-console
@@ -637,6 +731,7 @@ export async function connectToRuntime(port, target) {
     const consoleSub = attachConsoleSubscription(client);
     const networkSub = attachNetworkSubscription(client.Network);
     const onDisconnect = attachDisconnectSubscription(client);
+    const coverage = attachCoverage(client);
     await bringUpSession(client, target, async () => {
         await client.Runtime.enable();
         await client.Log.enable();
@@ -649,6 +744,9 @@ export async function connectToRuntime(port, target) {
         onNetwork: (handler) => networkSub.add(handler),
         enableNetwork: () => networkSub.enable(),
         getResponseBody: (requestId) => networkSub.getResponseBody(requestId),
+        startCoverage: () => coverage.start(),
+        takeCoverage: () => coverage.take(),
+        takeHeapSnapshot: () => takeHeapSnapshotImpl(client),
         async close() {
             await client.close();
         },
@@ -664,6 +762,7 @@ export async function connectToPage(port, target, cache) {
     }
     const client = await openClient(port, target);
     const { Runtime, Accessibility, Page, DOM, Input } = client;
+    const DOMDebugger = client.DOMDebugger;
     const cacheKey = `${port}:${target.id}`;
     // Subscribe BEFORE enable so we catch buffered console/log entries emitted at enable-time.
     const consoleSub = attachConsoleSubscription(client);
@@ -677,6 +776,8 @@ export async function connectToPage(port, target, cache) {
         });
     }, consoleSub.emit);
     const onDisconnect = attachDisconnectSubscription(client);
+    const coverage = attachCoverage(client);
+    const scanScriptUrls = attachScriptUrls(client);
     let documentBackendNodeId = 0;
     await bringUpSession(client, target, async () => {
         await Page.enable();
@@ -703,15 +804,16 @@ export async function connectToPage(port, target, cache) {
     });
     async function dispatchClick(x, y, opts) {
         const clicks = Math.max(1, opts?.clicks ?? 1);
+        const button = opts?.button ?? MouseButton.Left;
         if (clicks === 1) {
-            const pressed = Input.dispatchMouseEvent({ type: 'mousePressed', x, y, button: 'left', clickCount: 1 });
-            const released = Input.dispatchMouseEvent({ type: 'mouseReleased', x, y, button: 'left', clickCount: 1 });
+            const pressed = Input.dispatchMouseEvent({ type: 'mousePressed', x, y, button, clickCount: 1 });
+            const released = Input.dispatchMouseEvent({ type: 'mouseReleased', x, y, button, clickCount: 1 });
             await Promise.all([pressed, released]);
             return;
         }
         for (let i = 1; i <= clicks; i++) {
-            await Input.dispatchMouseEvent({ type: 'mousePressed', x, y, button: 'left', clickCount: i });
-            await Input.dispatchMouseEvent({ type: 'mouseReleased', x, y, button: 'left', clickCount: i });
+            await Input.dispatchMouseEvent({ type: 'mousePressed', x, y, button, clickCount: i });
+            await Input.dispatchMouseEvent({ type: 'mouseReleased', x, y, button, clickCount: i });
         }
     }
     async function dispatchDrag(from, to, opts) {
@@ -753,10 +855,10 @@ export async function connectToPage(port, target, cache) {
         const { object } = await DOM.resolveNode({ backendNodeId });
         const climbed = await Runtime.callFunctionOn({
             objectId: object.objectId,
-            functionDeclaration: `function(levels) {
-        let el = this.nodeType === Node.TEXT_NODE ? this.parentElement : this;
-        for (let i = 0; i < levels && el.parentElement; i++) el = el.parentElement;
-        return el;
+            functionDeclaration: `function(levels) {
+        let el = this.nodeType === Node.TEXT_NODE ? this.parentElement : this;
+        for (let i = 0; i < levels && el.parentElement; i++) el = el.parentElement;
+        return el;
       }`,
             arguments: [{ value: levels }],
         });
@@ -778,6 +880,22 @@ export async function connectToPage(port, target, cache) {
         const minY = Math.min(...ys);
         return { x: minX, y: minY, width: Math.max(...xs) - minX, height: Math.max(...ys) - minY };
     }
+    async function listenersOn(objectId, depth) {
+        const { listeners } = await DOMDebugger.getEventListeners({ objectId, depth });
+        if (listeners.length === 0)
+            return [];
+        const urls = await scanScriptUrls(listeners.map((l) => l.scriptId));
+        return listeners.map((l) => ({
+            type: l.type,
+            useCapture: Boolean(l.useCapture),
+            passive: Boolean(l.passive),
+            once: Boolean(l.once),
+            scriptId: l.scriptId,
+            url: urls.get(l.scriptId) ?? '',
+            lineNumber: l.lineNumber ?? 0,
+            columnNumber: l.columnNumber ?? 0,
+        }));
+    }
     return {
         target,
         evaluate: (expression, opts) => evaluateImpl(client, expression, opts),
@@ -786,6 +904,27 @@ export async function connectToPage(port, target, cache) {
         onNetwork: (handler) => networkSub.add(handler),
         enableNetwork: () => networkSub.enable(),
         getResponseBody: (requestId) => networkSub.getResponseBody(requestId),
+        startCoverage: () => coverage.start(),
+        takeCoverage: () => coverage.take(),
+        takeHeapSnapshot: () => takeHeapSnapshotImpl(client),
+        async getEventListeners(backendDOMNodeId, depth = 0) {
+            const { object } = await DOM.resolveNode({ backendNodeId: backendDOMNodeId });
+            return listenersOn(object.objectId, depth);
+        },
+        async getEventListenersBySelector(selector, depth = 0) {
+            // objectId, not nodeId: `DOM.querySelector` needs a document nodeId, which is
+            // renumbered on every navigation. Same reasoning as `uploadBySelector`.
+            const { result, exceptionDetails } = await Runtime.evaluate({
+                expression: `document.querySelector(${JSON.stringify(selector)})`,
+                returnByValue: false,
+            });
+            // A malformed selector throws a DOMException that arrives as a valid RemoteObject.
+            if (exceptionDetails)
+                return null;
+            if (!result.objectId || result.subtype === 'null')
+                return null;
+            return listenersOn(result.objectId, depth);
+        },
         onJsDialog: (handler) => jsDialogSub.add(handler),
         answerJsDialog: (accept, promptText) => jsDialogSub.answer(accept, promptText),
         setJsDialogPolicy: (policy) => jsDialogSub.setPolicy(policy),
@@ -907,13 +1046,13 @@ export async function connectToPage(port, target, cache) {
             await DOM.focus({ backendNodeId });
             await Runtime.callFunctionOn({
                 objectId: object.objectId,
-                functionDeclaration: `function(val) {
-          const nativeSetter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value')?.set
-            || Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, 'value')?.set;
-          if (nativeSetter) nativeSetter.call(this, val);
-          else this.value = val;
-          this.dispatchEvent(new Event('input', { bubbles: true }));
-          this.dispatchEvent(new Event('change', { bubbles: true }));
+                functionDeclaration: `function(val) {
+          const nativeSetter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value')?.set
+            || Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, 'value')?.set;
+          if (nativeSetter) nativeSetter.call(this, val);
+          else this.value = val;
+          this.dispatchEvent(new Event('input', { bubbles: true }));
+          this.dispatchEvent(new Event('change', { bubbles: true }));
         }`,
                 arguments: [{ value }],
             });