@push.rocks/smartpuppeteer 2.5.0 → 2.6.0

package/ts/smartpuppeteer.classes.livebrowsersession.ts

@@ -82,10 +82,12 @@ const maxProxySecuritySessions = 256;
 const maxTrackedProxyRequests = 1024;
 const maxTotalTrackedProxyRequests = 4096;
 const maxProxySecurityOperations = 2048;
+const maxTrackedServiceWorkerVersions = 512;
+const proxySecurityCommandTimeoutMs = 5000;
+const proxySecurityCommandOptions = { timeout: proxySecurityCommandTimeoutMs } as const;
 const proxySeedTargetTypes = new Set([
   'background_page',
   'page',
-  'service_worker',
   'shared_worker',
   'webview',
 ]);
@@ -99,6 +101,9 @@ type TProxyAuthRequiredEvent = plugins.puppeteer.Protocol.Fetch.AuthRequiredEven
 type TProxyRequestPausedEvent = plugins.puppeteer.Protocol.Fetch.RequestPausedEvent;
 type TNetworkLoadingFinishedEvent = plugins.puppeteer.Protocol.Network.LoadingFinishedEvent;
 type TNetworkLoadingFailedEvent = plugins.puppeteer.Protocol.Network.LoadingFailedEvent;
+type TServiceWorkerVersionUpdatedEvent = (
+  plugins.puppeteer.Protocol.ServiceWorker.WorkerVersionUpdatedEvent
+);
 
 interface IProxySecuritySession {
   session: plugins.puppeteer.CDPSession;
@@ -108,6 +113,7 @@ interface IProxySecuritySession {
   fetchEnabled: boolean;
   allowLiveTargetDetach: boolean;
   ownedByProxySecurity: boolean;
+  retireWhenIdle: boolean;
   attemptedAuthentications: Set<string>;
   requestIdsByNetworkId: Map<string, string>;
   authRequiredListener: (event: TProxyAuthRequiredEvent) => void;
@@ -146,7 +152,8 @@ interface IPrivateLiveBrowserTab {
   closing: boolean;
   stateUpdateQueued: boolean;
   stateUpdatePending: boolean;
-  navigationResetPending: boolean;
+  navigationResetRevision: number;
+  restoredNavigationRevision: number;
   evaluationExecutionContextId?: number;
   securityCdpSession?: plugins.puppeteer.CDPSession;
   cdpSession?: plugins.puppeteer.CDPSession;
@@ -396,8 +403,18 @@ export class LiveBrowserSession {
   private browserSecurityCdpSession?: plugins.puppeteer.CDPSession;
   private browserSecurityConnection?: plugins.puppeteer.Connection;
   private browserSecuritySessionAttachedListener?: (session: plugins.puppeteer.CDPSession) => void;
+  private browserSecurityOwnedSessionAttachedListener?: (
+    session: plugins.puppeteer.CDPSession,
+  ) => void;
   private browserSecuritySessionDetachedListener?: TCdpSessionDetachedListener;
+  private browserSecurityWorkerLifecycleCdpSession?: plugins.puppeteer.CDPSession;
+  private browserSecurityWorkerVersionUpdatedListener?: (
+    event: TServiceWorkerVersionUpdatedEvent,
+  ) => void;
   private readonly proxySecuritySessions = new Map<string, IProxySecuritySession>();
+  private readonly ownedProxySecuritySessions = new Set<plugins.puppeteer.CDPSession>();
+  private readonly browserSecurityParentOwnedSessions = new Set<plugins.puppeteer.CDPSession>();
+  private readonly serviceWorkerTargetIdsByVersionId = new Map<string, string>();
   private readonly proxySecurityOperations = new Set<Promise<void>>();
   private proxySecurityGeneration = 0;
   private proxySecurityStopping = false;
@@ -2276,7 +2293,10 @@ export class LiveBrowserSession {
       tab.securityCdpSession = undefined;
       if (securityCdpSession && !securityCdpSession.detached) {
         try {
-          await securityCdpSession.detach();
+          await this.detachCdpSessionWithTimeout(
+            securityCdpSession,
+            'page security session',
+          );
         } catch {
           // Browser lifetime cancellation may close the target before explicit detach settles.
         }
@@ -2346,11 +2366,18 @@ export class LiveBrowserSession {
     if (!proxyCredentials) {
       try {
         if (denyPermissions) {
-          await cdpSession.send('Browser.grantPermissions', { permissions: [] });
+          await cdpSession.send(
+            'Browser.grantPermissions',
+            { permissions: [] },
+            proxySecurityCommandOptions,
+          );
         }
       } finally {
         if (!cdpSession.detached) {
-          await cdpSession.detach();
+          await this.detachCdpSessionWithTimeout(
+            cdpSession,
+            'browser permission session',
+          );
         }
       }
       return;
@@ -2365,7 +2392,11 @@ export class LiveBrowserSession {
     this.browserSecurityCdpSession = cdpSession;
     try {
       if (denyPermissions) {
-        await cdpSession.send('Browser.grantPermissions', { permissions: [] });
+        await cdpSession.send(
+          'Browser.grantPermissions',
+          { permissions: [] },
+          proxySecurityCommandOptions,
+        );
       }
       const browserSecurityConnection = cdpSession.connection();
       if (!browserSecurityConnection) {
@@ -2373,13 +2404,69 @@ export class LiveBrowserSession {
       }
       this.browserSecurityConnection = browserSecurityConnection;
       this.browserSecuritySessionAttachedListener = (attachedSession) => {
+        const setupPromise = this.configureProxySecuritySession(attachedSession, generation);
+        queueMicrotask(() => {
+          const securityRecord = this.proxySecuritySessions.get(attachedSession.id());
+          if (
+            securityRecord?.generation === generation
+            && securityRecord.ownedByProxySecurity
+          ) {
+            return;
+          }
+          this.trackProxySecurityOperation(
+            setupPromise,
+            generation,
+            'proxy_security_session_setup_failed',
+          );
+        });
+      };
+      this.browserSecurityOwnedSessionAttachedListener = (attachedSession) => {
+        const securityRecord = this.proxySecuritySessions.get(attachedSession.id());
+        if (!securityRecord || securityRecord.generation !== generation) {
+          return;
+        }
+        securityRecord.ownedByProxySecurity = true;
+        this.ownedProxySecuritySessions.add(attachedSession);
+        this.browserSecurityParentOwnedSessions.add(attachedSession);
+        const setupPromise = securityRecord.setupPromise;
+        securityRecord.setupPromise = setupPromise.then(async () => {
+          try {
+            await attachedSession.send(
+              'Runtime.runIfWaitingForDebugger',
+              undefined,
+              proxySecurityCommandOptions,
+            );
+          } catch (error) {
+            this.removeProxySecuritySession(securityRecord);
+            if (attachedSession.detached) {
+              this.forgetOwnedProxySecuritySession(attachedSession);
+              return;
+            }
+            if (this.proxySecurityStopping || this.normalStopRequested) {
+              await this.detachOwnedProxySecuritySession(securityRecord);
+              return;
+            }
+            if (
+              securityRecord.targetId
+              && await this.waitForProxySecurityTargetCoverage(
+                securityRecord.targetId,
+                generation,
+              )
+            ) {
+              await this.detachOwnedProxySecuritySession(securityRecord);
+              return;
+            }
+            throw error;
+          }
+        });
         this.trackProxySecurityOperation(
-          this.configureProxySecuritySession(attachedSession, generation),
+          securityRecord.setupPromise,
           generation,
           'proxy_security_session_setup_failed',
         );
       };
       this.browserSecuritySessionDetachedListener = (detachedSession) => {
+        this.forgetOwnedProxySecuritySession(detachedSession);
         if (detachedSession === cdpSession) {
           this.handleProxySecurityFailure(
             'proxy_security_browser_session_detached',
@@ -2388,6 +2475,14 @@ export class LiveBrowserSession {
           );
           return;
         }
+        if (detachedSession === this.browserSecurityWorkerLifecycleCdpSession) {
+          this.handleProxySecurityFailure(
+            'proxy_security_worker_lifecycle_detached',
+            new Error('Proxy security service-worker lifecycle session detached unexpectedly'),
+            generation,
+          );
+          return;
+        }
         this.trackProxySecurityOperation(
           this.verifyProxySecuritySessionDetached(detachedSession, generation),
           generation,
@@ -2398,11 +2493,30 @@ export class LiveBrowserSession {
         'sessionattached',
         this.browserSecuritySessionAttachedListener,
       );
+      cdpSession.on(
+        plugins.puppeteer.CDPSessionEvent.SessionAttached,
+        this.browserSecurityOwnedSessionAttachedListener,
+      );
       browserSecurityConnection.on(
         'sessiondetached',
         this.browserSecuritySessionDetachedListener,
       );
 
+      await cdpSession.send('Target.setAutoAttach', {
+        autoAttach: true,
+        waitForDebuggerOnStart: true,
+        flatten: true,
+        filter: [
+          { type: 'service_worker' },
+          { exclude: true },
+        ],
+      }, proxySecurityCommandOptions);
+      await Promise.all(
+        [...this.proxySecuritySessions.values()]
+          .filter((record) => record.generation === generation && record.ownedByProxySecurity)
+          .map((record) => record.setupPromise),
+      );
+
       for (const target of browser.targets()) {
         if (!proxySeedTargetTypes.has(target.type())) {
           continue;
@@ -2413,14 +2527,121 @@ export class LiveBrowserSession {
           throw new Error(`Proxy security did not observe session ${securitySession.id()}`);
         }
         securityRecord.ownedByProxySecurity = true;
+        this.ownedProxySecuritySessions.add(securitySession);
         await securityRecord.setupPromise;
       }
+      await this.configureProxySecurityWorkerLifecycle(cdpSession, generation);
     } catch (error) {
       await this.teardownProxySecurity();
       throw error;
     }
   }
 
+  private async configureProxySecurityWorkerLifecycle(
+    browserSecurityCdpSession: plugins.puppeteer.CDPSession,
+    generation: number,
+  ): Promise<void> {
+    const lifecycleUrl = `data:text/html,<title>smartpuppeteer-proxy-security-${generation}</title>`;
+    const { targetId } = await browserSecurityCdpSession.send('Target.createTarget', {
+      url: lifecycleUrl,
+      background: true,
+      hidden: true,
+    }, proxySecurityCommandOptions);
+    const attachedSessions = new Map<string, plugins.puppeteer.CDPSession>();
+    const captureAttachedSession = (session: plugins.puppeteer.CDPSession): void => {
+      attachedSessions.set(session.id(), session);
+    };
+    browserSecurityCdpSession.on(
+      plugins.puppeteer.CDPSessionEvent.SessionAttached,
+      captureAttachedSession,
+    );
+    let lifecycleSession: plugins.puppeteer.CDPSession;
+    try {
+      const { sessionId } = await browserSecurityCdpSession.send('Target.attachToTarget', {
+        targetId,
+        flatten: true,
+      }, proxySecurityCommandOptions);
+      const attachedSession = attachedSessions.get(sessionId);
+      if (!attachedSession) {
+        throw new Error('Proxy security did not observe its hidden lifecycle session');
+      }
+      lifecycleSession = attachedSession;
+    } finally {
+      browserSecurityCdpSession.off(
+        plugins.puppeteer.CDPSessionEvent.SessionAttached,
+        captureAttachedSession,
+      );
+    }
+
+    const securityRecord = this.proxySecuritySessions.get(lifecycleSession.id());
+    if (!securityRecord || !securityRecord.ownedByProxySecurity) {
+      throw new Error('Proxy security did not configure its hidden lifecycle session');
+    }
+    await securityRecord.setupPromise;
+    if (lifecycleSession.detached) {
+      throw new Error('Proxy security hidden lifecycle session detached during setup');
+    }
+
+    this.browserSecurityWorkerLifecycleCdpSession = lifecycleSession;
+    this.browserSecurityWorkerVersionUpdatedListener = (event) => {
+      const stoppedTargetIds = new Set<string>();
+      const redundantTargetIds = new Set<string>();
+      for (const version of event.versions) {
+        if (version.targetId) {
+          if (
+            !this.serviceWorkerTargetIdsByVersionId.has(version.versionId)
+            && this.serviceWorkerTargetIdsByVersionId.size >= maxTrackedServiceWorkerVersions
+          ) {
+            this.handleProxySecurityFailure(
+              'proxy_security_worker_tracking_capacity_exceeded',
+              new Error(
+                `Proxy security exceeded ${maxTrackedServiceWorkerVersions} service-worker versions`,
+              ),
+              generation,
+            );
+            return;
+          }
+          this.serviceWorkerTargetIdsByVersionId.set(version.versionId, version.targetId);
+        }
+        const knownTargetId = version.targetId
+          ?? this.serviceWorkerTargetIdsByVersionId.get(version.versionId);
+        if (version.status === 'redundant' && knownTargetId) {
+          redundantTargetIds.add(knownTargetId);
+        }
+        if (version.runningStatus === 'stopped') {
+          if (knownTargetId) {
+            stoppedTargetIds.add(knownTargetId);
+          }
+          this.serviceWorkerTargetIdsByVersionId.delete(version.versionId);
+        }
+      }
+      for (const workerSecurityRecord of [...this.proxySecuritySessions.values()]) {
+        if (
+          !workerSecurityRecord.ownedByProxySecurity
+          || workerSecurityRecord.targetType !== 'service_worker'
+          || !workerSecurityRecord.targetId
+          || !this.browserSecurityParentOwnedSessions.has(workerSecurityRecord.session)
+        ) {
+          continue;
+        }
+        if (stoppedTargetIds.has(workerSecurityRecord.targetId)) {
+          this.retireOwnedProxySecuritySession(workerSecurityRecord, true);
+        } else if (redundantTargetIds.has(workerSecurityRecord.targetId)) {
+          this.retireOwnedProxySecuritySession(workerSecurityRecord, false);
+        }
+      }
+    };
+    lifecycleSession.on(
+      'ServiceWorker.workerVersionUpdated',
+      this.browserSecurityWorkerVersionUpdatedListener,
+    );
+    await lifecycleSession.send(
+      'ServiceWorker.enable',
+      undefined,
+      proxySecurityCommandOptions,
+    );
+  }
+
   private configureProxySecuritySession(
     session: plugins.puppeteer.CDPSession,
     generation: number,
@@ -2483,7 +2704,7 @@ export class LiveBrowserSession {
         session.send('Fetch.continueWithAuth', {
           requestId: event.requestId,
           authChallengeResponse,
-        }).then(() => undefined),
+        }, proxySecurityCommandOptions).then(() => undefined),
         generation,
         'proxy_security_protocol_failed',
       );
@@ -2516,7 +2737,11 @@ export class LiveBrowserSession {
         }
       }
       this.trackProxySecurityOperation(
-        session.send('Fetch.continueRequest', { requestId: event.requestId }).then(() => undefined),
+        session.send(
+          'Fetch.continueRequest',
+          { requestId: event.requestId },
+          proxySecurityCommandOptions,
+        ).then(() => undefined),
         generation,
         'proxy_security_protocol_failed',
       );
@@ -2528,6 +2753,13 @@ export class LiveBrowserSession {
       }
       requestIdsByNetworkId.delete(networkId);
       attemptedAuthentications.delete(requestId);
+      if (
+        proxySecuritySession.retireWhenIdle
+        && attemptedAuthentications.size === 0
+        && requestIdsByNetworkId.size === 0
+      ) {
+        this.retireOwnedProxySecuritySession(proxySecuritySession, false);
+      }
     };
     const loadingFinishedListener = (event: TNetworkLoadingFinishedEvent): void => {
       forgetAuthentication(event.requestId);
@@ -2546,6 +2778,7 @@ export class LiveBrowserSession {
       fetchEnabled: false,
       allowLiveTargetDetach: false,
       ownedByProxySecurity: false,
+      retireWhenIdle: false,
       attemptedAuthentications,
       requestIdsByNetworkId,
       authRequiredListener,
@@ -2554,12 +2787,20 @@ export class LiveBrowserSession {
       loadingFailedListener,
       setupPromise: Promise.resolve(),
     };
-    const targetInfoPromise = session.send('Target.getTargetInfo');
-    const networkEnablePromise = session.send('Network.enable');
+    const targetInfoPromise = session.send(
+      'Target.getTargetInfo',
+      undefined,
+      proxySecurityCommandOptions,
+    );
+    const networkEnablePromise = session.send(
+      'Network.enable',
+      undefined,
+      proxySecurityCommandOptions,
+    );
     const fetchEnablePromise = session.send('Fetch.enable', {
       handleAuthRequests: true,
       patterns: [{ urlPattern: '*' }],
-    });
+    }, proxySecurityCommandOptions);
     const commandResultsPromise = Promise.allSettled([
       targetInfoPromise,
       networkEnablePromise,
@@ -2590,10 +2831,28 @@ export class LiveBrowserSession {
         proxySecuritySession.fetchEnabled = true;
       } catch (error) {
         this.removeProxySecuritySession(proxySecuritySession);
-        if (session.detached || this.proxySecurityStopping || this.normalStopRequested) {
+        if (session.detached) {
+          this.forgetOwnedProxySecuritySession(session);
           return;
         }
-        throw error;
+        if (this.proxySecurityStopping || this.normalStopRequested) {
+          await this.detachOwnedProxySecuritySession(proxySecuritySession);
+          return;
+        }
+        if (
+          proxySecuritySession.targetId
+          && await this.waitForProxySecurityTargetCoverage(
+            proxySecuritySession.targetId,
+            generation,
+          )
+        ) {
+          await this.detachOwnedProxySecuritySession(proxySecuritySession);
+          return;
+        }
+        throw new Error(
+          `Proxy security ${proxySecuritySession.ownedByProxySecurity ? 'owned' : 'observed'} session setup failed for ${proxySecuritySession.targetType ?? 'unknown'} target ${proxySecuritySession.targetId ?? 'unknown'}: ${normalizeErrorMessage(error)}`,
+          { cause: error },
+        );
       }
     })();
     proxySecuritySession.setupPromise = setupPromise;
@@ -2619,6 +2878,18 @@ export class LiveBrowserSession {
     if (!proxySecuritySession.targetId) {
       throw new Error(`Proxy security session detached before target identification: ${session.id()}`);
     }
+    if (await this.waitForProxySecurityTargetCoverage(proxySecuritySession.targetId, generation)) {
+      return;
+    }
+    throw new Error(
+      `Proxy security detached from live target ${proxySecuritySession.targetId}`,
+    );
+  }
+
+  private async waitForProxySecurityTargetCoverage(
+    targetId: string,
+    generation: number,
+  ): Promise<boolean> {
     for (let attempt = 0; attempt < 3; attempt += 1) {
       const generationSessions = [...this.proxySecuritySessions.values()].filter((candidate) => (
         candidate.generation === generation
@@ -2626,12 +2897,12 @@ export class LiveBrowserSession {
       await Promise.allSettled(generationSessions.map((candidate) => candidate.setupPromise));
       const hasReplacement = [...this.proxySecuritySessions.values()].some((candidate) => (
         candidate.generation === generation
-        && candidate.targetId === proxySecuritySession.targetId
+        && candidate.targetId === targetId
         && candidate.fetchEnabled
         && !candidate.session.detached
       ));
       if (hasReplacement) {
-        return;
+        return true;
       }
       if (attempt < 2) {
         await delay(25);
@@ -2641,12 +2912,12 @@ export class LiveBrowserSession {
     if (!browserSecurityCdpSession || browserSecurityCdpSession.detached) {
       throw new Error('Browser security CDP session detached unexpectedly');
     }
-    const { targetInfos } = await browserSecurityCdpSession.send('Target.getTargets');
-    if (targetInfos.some((targetInfo) => targetInfo.targetId === proxySecuritySession.targetId)) {
-      throw new Error(
-        `Proxy security detached from live target ${proxySecuritySession.targetId}`,
-      );
-    }
+    const { targetInfos } = await browserSecurityCdpSession.send(
+      'Target.getTargets',
+      undefined,
+      proxySecurityCommandOptions,
+    );
+    return !targetInfos.some((targetInfo) => targetInfo.targetId === targetId);
   }
 
   private removeProxySecuritySession(proxySecuritySession: IProxySecuritySession): void {
@@ -2668,6 +2939,113 @@ export class LiveBrowserSession {
     this.proxySecuritySessions.delete(proxySecuritySession.session.id());
   }
 
+  private async detachOwnedProxySecuritySession(
+    proxySecuritySession: IProxySecuritySession,
+  ): Promise<void> {
+    if (!proxySecuritySession.ownedByProxySecurity) {
+      return;
+    }
+    await this.detachTrackedOwnedProxySecuritySession(proxySecuritySession.session);
+  }
+
+  private forgetOwnedProxySecuritySession(session: plugins.puppeteer.CDPSession): void {
+    this.ownedProxySecuritySessions.delete(session);
+    this.browserSecurityParentOwnedSessions.delete(session);
+  }
+
+  private async detachCdpSessionWithTimeout(
+    session: plugins.puppeteer.CDPSession,
+    description: string,
+  ): Promise<void> {
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    const timeoutPromise = new Promise<never>((_resolve, reject) => {
+      timeout = setTimeout(() => {
+        reject(new Error(
+          `${description} did not detach within ${proxySecurityCommandTimeoutMs}ms`,
+        ));
+      }, proxySecurityCommandTimeoutMs);
+    });
+    try {
+      await Promise.race([session.detach(), timeoutPromise]);
+    } finally {
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+    }
+  }
+
+  private retireOwnedProxySecuritySession(
+    proxySecuritySession: IProxySecuritySession,
+    force: boolean,
+  ): void {
+    if (
+      !proxySecuritySession.ownedByProxySecurity
+      || this.proxySecuritySessions.get(proxySecuritySession.session.id())
+        !== proxySecuritySession
+    ) {
+      return;
+    }
+    proxySecuritySession.retireWhenIdle = true;
+    if (
+      !force
+      && (
+        proxySecuritySession.attemptedAuthentications.size > 0
+        || proxySecuritySession.requestIdsByNetworkId.size > 0
+      )
+    ) {
+      return;
+    }
+    if (proxySecuritySession.targetId) {
+      for (const [versionId, targetId] of this.serviceWorkerTargetIdsByVersionId) {
+        if (targetId === proxySecuritySession.targetId) {
+          this.serviceWorkerTargetIdsByVersionId.delete(versionId);
+        }
+      }
+    }
+    proxySecuritySession.allowLiveTargetDetach = true;
+    this.removeProxySecuritySession(proxySecuritySession);
+    this.trackProxySecurityOperation(
+      this.detachOwnedProxySecuritySession(proxySecuritySession),
+      proxySecuritySession.generation,
+      'proxy_security_worker_retirement_failed',
+    );
+  }
+
+  private async detachTrackedOwnedProxySecuritySession(
+    session: plugins.puppeteer.CDPSession,
+  ): Promise<void> {
+    if (session.detached) {
+      this.forgetOwnedProxySecuritySession(session);
+      return;
+    }
+    try {
+      if (this.browserSecurityParentOwnedSessions.has(session)) {
+        const browserSecurityCdpSession = this.browserSecurityCdpSession;
+        if (!browserSecurityCdpSession || browserSecurityCdpSession.detached) {
+          throw new Error('Browser security parent session is unavailable');
+        }
+        await browserSecurityCdpSession.send('Target.detachFromTarget', {
+          sessionId: session.id(),
+        }, proxySecurityCommandOptions);
+      } else {
+        await this.detachCdpSessionWithTimeout(session, 'proxy security session');
+      }
+      this.forgetOwnedProxySecuritySession(session);
+    } catch (error) {
+      if (session.detached) {
+        this.forgetOwnedProxySecuritySession(session);
+        return;
+      }
+      if (this.proxySecurityStopping || this.normalStopRequested) {
+        return;
+      }
+      throw new Error(
+        `Failed to detach an owned proxy security session: ${normalizeErrorMessage(error)}`,
+        { cause: error },
+      );
+    }
+  }
+
   private allowOperationalCdpSessionDetach(session: plugins.puppeteer.CDPSession): void {
     const proxySecuritySession = this.proxySecuritySessions.get(session.id());
     if (proxySecuritySession) {
@@ -2730,12 +3108,51 @@ export class LiveBrowserSession {
 
   private async teardownProxySecurity(): Promise<void> {
     this.proxySecurityStopping = true;
+    this.serviceWorkerTargetIdsByVersionId.clear();
+    const browserSecurityCdpSession = this.browserSecurityCdpSession;
+    if (browserSecurityCdpSession && !browserSecurityCdpSession.detached) {
+      try {
+        await browserSecurityCdpSession.send('Target.setAutoAttach', {
+          autoAttach: false,
+          waitForDebuggerOnStart: false,
+          flatten: true,
+        }, proxySecurityCommandOptions);
+      } catch {
+        // Browser shutdown may detach the browser target before auto-attach is disabled.
+      }
+    }
+    const workerLifecycleCdpSession = this.browserSecurityWorkerLifecycleCdpSession;
+    if (workerLifecycleCdpSession && !workerLifecycleCdpSession.detached) {
+      try {
+        await workerLifecycleCdpSession.send(
+          'ServiceWorker.disable',
+          undefined,
+          proxySecurityCommandOptions,
+        );
+      } catch {
+        // Browser shutdown can close the hidden lifecycle target first.
+      }
+    }
+    if (workerLifecycleCdpSession && this.browserSecurityWorkerVersionUpdatedListener) {
+      workerLifecycleCdpSession.off(
+        'ServiceWorker.workerVersionUpdated',
+        this.browserSecurityWorkerVersionUpdatedListener,
+      );
+    }
+    this.browserSecurityWorkerVersionUpdatedListener = undefined;
+    this.browserSecurityWorkerLifecycleCdpSession = undefined;
     if (this.browserSecurityConnection && this.browserSecuritySessionAttachedListener) {
       this.browserSecurityConnection.off(
         'sessionattached',
         this.browserSecuritySessionAttachedListener,
       );
     }
+    if (browserSecurityCdpSession && this.browserSecurityOwnedSessionAttachedListener) {
+      browserSecurityCdpSession.off(
+        plugins.puppeteer.CDPSessionEvent.SessionAttached,
+        this.browserSecurityOwnedSessionAttachedListener,
+      );
+    }
     if (this.browserSecurityConnection && this.browserSecuritySessionDetachedListener) {
       this.browserSecurityConnection.off(
         'sessiondetached',
@@ -2743,28 +3160,31 @@ export class LiveBrowserSession {
       );
     }
     this.browserSecuritySessionAttachedListener = undefined;
+    this.browserSecurityOwnedSessionAttachedListener = undefined;
     this.browserSecuritySessionDetachedListener = undefined;
     this.browserSecurityConnection = undefined;
-    const ownedSessions = [...this.proxySecuritySessions.values()]
-      .filter((record) => record.ownedByProxySecurity)
-      .map((record) => record.session);
+    const ownedSessions = [...this.ownedProxySecuritySessions];
     for (const proxySecuritySession of [...this.proxySecuritySessions.values()]) {
       this.removeProxySecuritySession(proxySecuritySession);
     }
     for (const ownedSession of ownedSessions) {
       if (!ownedSession.detached) {
         try {
-          await ownedSession.detach();
+          await this.detachTrackedOwnedProxySecuritySession(ownedSession);
         } catch {
           // Browser shutdown can close a target before explicit detach settles.
         }
       }
     }
-    const browserSecurityCdpSession = this.browserSecurityCdpSession;
+    this.ownedProxySecuritySessions.clear();
+    this.browserSecurityParentOwnedSessions.clear();
     this.browserSecurityCdpSession = undefined;
     if (browserSecurityCdpSession && !browserSecurityCdpSession.detached) {
       try {
-        await browserSecurityCdpSession.detach();
+        await this.detachCdpSessionWithTimeout(
+          browserSecurityCdpSession,
+          'browser security session',
+        );
       } catch {
         // Browser shutdown can detach the browser target first.
       }
@@ -2927,7 +3347,8 @@ export class LiveBrowserSession {
       closing: false,
       stateUpdateQueued: false,
       stateUpdatePending: false,
-      navigationResetPending: false,
+      navigationResetRevision: 0,
+      restoredNavigationRevision: 0,
       removeListeners: [],
     };
     this.tabs.set(tab.id, tab);
@@ -2939,11 +3360,11 @@ export class LiveBrowserSession {
         tab.securityCdpSession = securityCdpSession;
         await securityCdpSession.send('Page.enable', {
           enableFileChooserOpenedEvent: true,
-        });
+        }, proxySecurityCommandOptions);
         await securityCdpSession.send('Page.setInterceptFileChooserDialog', {
           enabled: true,
           cancel: true,
-        });
+        }, proxySecurityCommandOptions);
       }
       await this.ensureTabViewport(tab);
       await this.refreshTab(tab);
@@ -3078,7 +3499,10 @@ export class LiveBrowserSession {
     } catch (error) {
       if (tab.securityCdpSession && !tab.securityCdpSession.detached) {
         try {
-          await tab.securityCdpSession.detach();
+          await this.detachCdpSessionWithTimeout(
+            tab.securityCdpSession,
+            'page security session',
+          );
         } catch {
           // The page may have closed while security setup was failing.
         }
@@ -3117,31 +3541,58 @@ export class LiveBrowserSession {
       return;
     }
     tab.stateUpdatePending = true;
-    tab.navigationResetPending ||= navigationReset;
+    if (navigationReset) {
+      tab.navigationResetRevision += 1;
+    }
     if (tab.stateUpdateQueued) {
       return;
     }
     tab.stateUpdateQueued = true;
     const wasScheduled = this.scheduleOperation(async () => {
       try {
-        const shouldResetNavigation = tab.navigationResetPending;
+        const navigationResetRevision = tab.navigationResetRevision;
+        const shouldResetNavigation = (
+          tab.restoredNavigationRevision < navigationResetRevision
+        );
         tab.stateUpdatePending = false;
-        tab.navigationResetPending = false;
         if (!this.tabs.has(tab.id) || tab.closing) {
           return;
         }
         if (shouldResetNavigation && this.activeTabId === tab.id) {
           await this.stopScreencast(tab);
         }
-        await this.refreshTab(tab);
-        this.emitState();
+        let stateUpdateError: unknown;
+        try {
+          await this.refreshTab(tab);
+          this.emitState();
+        } catch (error) {
+          stateUpdateError = error;
+        }
         if (
           shouldResetNavigation
           && this.activeTabId === tab.id
           && this.status === 'running'
           && tab.status === 'open'
         ) {
-          await this.startScreencast(tab);
+          try {
+            await this.startScreencast(tab);
+          } catch (error) {
+            throw stateUpdateError
+              ? new AggregateError(
+                  [stateUpdateError, error],
+                  'Page state refresh and screencast restart failed',
+                )
+              : error;
+          }
+        }
+        if (shouldResetNavigation) {
+          tab.restoredNavigationRevision = Math.max(
+            tab.restoredNavigationRevision,
+            navigationResetRevision,
+          );
+        }
+        if (stateUpdateError) {
+          throw stateUpdateError;
         }
       } finally {
         tab.stateUpdateQueued = false;
@@ -3346,15 +3797,32 @@ export class LiveBrowserSession {
     } finally {
       tab.navigationInProgress = false;
       if (this.tabs.has(tab.id) && !tab.page.isClosed()) {
-        await this.refreshTab(tab);
-        this.emitState();
+        let stateUpdateError: unknown;
+        try {
+          await this.refreshTab(tab);
+          this.emitState();
+        } catch (error) {
+          stateUpdateError = error;
+        }
         if (
           isActive
           && this.activeTabId === tab.id
           && this.status === 'running'
           && tab.status === 'open'
         ) {
-          await this.startScreencast(tab);
+          try {
+            await this.startScreencast(tab);
+          } catch (error) {
+            throw stateUpdateError
+              ? new AggregateError(
+                  [stateUpdateError, error],
+                  'Navigation state refresh and screencast restart failed',
+                )
+              : error;
+          }
+        }
+        if (stateUpdateError) {
+          throw stateUpdateError;
         }
       }
     }