@specific.dev/spectest 0.87.0 → 0.88.0

package/dist/components/supabase.js

@@ -50,6 +50,7 @@
 // (`sb.url`, `sb.dbUrl`) embeds it — a mismatch errors at load.
 import { createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
+import { excludeAllBut, functionsReach } from "./supabase-functions-reach.js";
 import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { serviceGroup, } from "../index.js";
@@ -137,6 +138,9 @@ function providerCredentials(providerName, declared, env) {
  * cache rides into the image as a layer — so at run time the worker resolves
  * those URLs locally and never reaches for the network.
  *
+ * The context is the module graph the functions can load (the functions
+ * directory and what its imports lead to, `functionsReach`), copied whole
+ * so a monorepo function's `../../packages/…` resolves at bundle time too.
  * One synthetic entrypoint imports every function, so the whole set is one
  * graph rather than one per function. Bundling is best-effort: a function that
  * fails to bundle (a type error, an import that only resolves at run time)
@@ -146,13 +150,13 @@ function providerCredentials(providerName, declared, env) {
 function functionsDockerfile(fnRelPath) {
     return `FROM ${IMAGES.functions}
 ENV DENO_DIR=${DENO_DIR}
-COPY ${fnRelPath} /warm/functions
+COPY . /warm/repo
 RUN set -eu; \
     : > /warm/all.ts; \
-    for d in /warm/functions/*/; do \
+    for d in /warm/repo/${fnRelPath}/*/; do \
       [ -f "$d/index.ts" ] || continue; \
       n=$(basename "$d"); \
-      printf 'import "./functions/%s/index.ts";\\n' "$n" >> /warm/all.ts; \
+      printf 'import "./repo/${fnRelPath}/%s/index.ts";\\n' "$n" >> /warm/all.ts; \
     done; \
     edge-runtime bundle --entrypoint /warm/all.ts --output /tmp/warm.eszip --quiet || true; \
     rm -rf /tmp/warm.eszip /warm
@@ -1247,6 +1251,10 @@ export function supabase(opts = {}) {
             ? `${REPO_MOUNT}/${fnDir.slice(root.length + 1)}`
             : `${REPO_MOUNT}/supabase/functions`;
     const migrationsPath = inDir("migrations");
+    // The directories the functions can load modules from: the functions
+    // directory and what its imports lead to (`supabase-functions-reach.ts`).
+    // The build context and the reach are narrowed to exactly these.
+    const fnReachDirs = withFunctions ? functionsReach(root, fnRelPath) : [];
     // ── config file (config.toml / config.json) ───────────────────────────
     // The CLI's own project config, mapped onto the stack. Read at build time:
     // the values become container config, so they must be in hand before the
@@ -1415,8 +1423,20 @@ export function supabase(opts = {}) {
             const realtimeHost = `realtime-dev.${g.key("realtime")}`;
             const parts = {};
             // ── db ──────────────────────────────────────────────────────────
+            // What the stack reads from the project: the Supabase folder
+            // (config.toml, migrations, seed, functions) and the mail templates,
+            // which may sit anywhere in the repo. Declared as inputs so a change
+            // to any of them is never taken as one that can affect no test; the
+            // migrations volume carries the folder too, but only when there is
+            // a migrations directory, and a config-only project must count as
+            // well.
+            const inputs = [
+                ...(opts.dir !== undefined && !opts.dir.startsWith("/") ? [opts.dir] : []),
+                ...templateBodies.map(([, spec]) => spec.path).filter((t) => !t.startsWith("/")),
+            ];
             const dbDef = {
                 image: { type: "registry", reference: opts.db?.image ?? IMAGES.db },
+                ...(inputs.length > 0 ? { inputs } : {}),
                 // `args` (not `command`): keep the image's docker-entrypoint.sh so it
                 // runs initdb + its baked init-scripts before starting.
                 args: [
@@ -1721,6 +1741,12 @@ export function supabase(opts = {}) {
                     image: {
                         type: "dockerfile",
                         content: functionsDockerfile(fnRelPath),
+                        // The root, narrowed to the module graph: only the functions
+                        // directory and what its imports lead to enter the context, so
+                        // a change anywhere else neither uploads nor counts as reaching
+                        // the functions.
+                        context: ".",
+                        exclude: excludeAllBut(fnReachDirs),
                     },
                     // The **project root**, mounted with the functions directory in its
                     // real position underneath. Mounting only `supabase/functions`
@@ -1729,8 +1755,10 @@ export function supabase(opts = {}) {
                     // (`../../../../packages/…`), and that only resolves if the
                     // directory sits where it sits in the repo. Read-only: the runtime
                     // only reads sources, and a function writing into its own directory
-                    // would be writing into the user's checkout.
-                    volumes: [{ source: projectRootPath(), target: REPO_MOUNT, readOnly: true }],
+                    // would be writing into the user's checkout. For the reach the
+                    // mount is exempt: what the functions can load is the module graph
+                    // above, which the build context already states.
+                    volumes: [{ source: projectRootPath(), target: REPO_MOUNT, readOnly: true, reachExempt: true }],
                     // Our router (see FUNCTIONS_MAIN_TS) sits outside that mount, so
                     // the project never has to carry a `main/` function of ours.
                     files: [{ path: "/home/deno/main/index.ts", content: FUNCTIONS_MAIN_TS }],

package/dist/daemon.js

@@ -28,8 +28,9 @@ import { COVERAGE_CONTAINER_DIR, coverageBundleRef, coverageHostDir, encodeCover
 import { configureBrowserCoverage } from "./browser-coverage.js";
 import { INVENTORY_REPORT, NODE_COVERAGE_MARKERS_SUBDIR, NODE_COVERAGE_SCRIPTS_SUBDIR, applyCoverageAdapters, coverageAdapters, coverageReportsMode, validateCoverage, } from "./coverage.js";
 import { serviceForHost as hostToService } from "./harness/browser-coverage.js";
-import { acquirePersistentBrowser, mobileKey } from "./browser.js";
+import { acquirePersistentBrowser, acquirePersistentDesktop, mobileKey } from "./browser.js";
 import { isMobileApp, openPersistentMobile } from "./mobile.js";
+import { isDesktopApp } from "./desktop.js";
 // Pure ingress hostname matching, ported out of this file (see
 // harness/hostmatch.ts). Keeping ONE implementation is the point: the
 // exact-then-longest-suffix rule and the one-label certificate rule are
@@ -3585,7 +3586,8 @@ async function computeProjectReachInner(all) {
     for (const svc of all) {
         const src = {
             service: svc.name,
-            volumeSources: (svc.volumes ?? []).flatMap((v) => (v.source ? [v.source] : [])),
+            volumeSources: (svc.volumes ?? []).flatMap((v) => (v.source && !v.reachExempt ? [v.source] : [])),
+            ...(svc.inputs && svc.inputs.length > 0 ? { inputs: [...svc.inputs] } : {}),
         };
         if (svc.image.type === "dockerfile") {
             try {
@@ -3753,6 +3755,7 @@ function newBrowserSession(testStart, idScope, frame = "browser", artifacts, nam
         record,
         recorder: {
             sessionId: record.sessionId,
+            frame,
             ...(name ? { sessionName: name } : {}),
             recordStep(step) {
                 if (closed)
@@ -3777,6 +3780,33 @@ function newBrowserSession(testStart, idScope, frame = "browser", artifacts, nam
         },
     };
 }
+/** Same desktop recording path for test runs and interactive evals. */
+function desktopOpener(start, scope, sessions, detaches, artifacts) {
+    const memo = new Map();
+    return async (app, options = {}) => {
+        if (!isDesktopApp(app))
+            throw new Error("ctx.desktop(app): pass ctx.svc.app from an electron() service");
+        const window = options.window ?? 0;
+        const key = JSON.stringify([app.endpoint, window]);
+        const existing = memo.get(key);
+        if (existing)
+            return existing;
+        const session = newBrowserSession(start, scope, "desktop", artifacts, window === 0 ? app.name : `${app.name} · window ${window + 1}`);
+        const { browser, detach, desktopChrome } = await acquirePersistentDesktop(app.endpoint, window, session.recorder);
+        session.record.desktopChrome = desktopChrome;
+        session.record.initialUrl = browser.url();
+        sessions.push(session);
+        detaches.push(async () => { await detach(); session.markClosed(); });
+        const close = browser.close.bind(browser);
+        browser.close = async () => {
+            await close();
+            if (memo.get(key) === browser)
+                memo.delete(key);
+        };
+        memo.set(key, browser);
+        return browser;
+    };
+}
 /** New terminal session bookkeeping for a single `ctx.terminal(...)` call. */
 function newTerminalSession(testStart, service, command, cols, rows, idScope) {
     const record = {
@@ -4648,6 +4678,7 @@ async function runOne(testCase) {
         openTerminal: recordedOpenTerminal,
         browser: trackedOpenBrowser,
         mobile: trackedOpenMobile,
+        desktop: desktopOpener(start, testCase.id, sessions, browserDetaches),
         mcp: openMcp,
         testName: testCase.name,
         parent,
@@ -5132,6 +5163,7 @@ async function evalCode(code, secrets) {
         openTerminal: evalOpenTerminal,
         browser: trackedOpenBrowser,
         mobile: trackedOpenMobile,
+        desktop: desktopOpener(start, "eval", sessions, browserDetaches, artifactCollector),
         mcp: openMcp,
         testName: "eval",
         parent: undefined,

package/dist/desktop-recorder.d.ts

@@ -0,0 +1 @@
+export declare const DESKTOP_INPUT_SYNC_SCRIPT: string;

package/dist/desktop-recorder.js

@@ -0,0 +1,30 @@
+// A late recorder cannot interpose on setters React cached during mounting.
+// Reconcile controls at action boundaries, without changing the app's DOM or
+// descriptors. Normal rrweb Input events win; synthesize only missing changes.
+export const DESKTOP_INPUT_SYNC_SCRIPT = String.raw `(() => {
+  if (window.__spectestSyncInputs) return;
+  const known = new WeakMap();
+  window.__spectestSyncInputs = (timestamp = Date.now()) => {
+    const rec = window.__spectestRec;
+    const events = window.__spectestRrwebEvents;
+    if (!rec?.mirror || !events) return;
+    const inputs = new Map();
+    for (const event of events) {
+      if (event.type === 3 && event.data?.source === 5) inputs.set(event.data.id, event.data);
+    }
+    for (const element of document.querySelectorAll('input, textarea, select')) {
+      const type = element.hasAttribute('data-rr-is-password') ? 'password' : element.type?.toLowerCase();
+      if (type === 'file' || element.closest('.rr-block, .rr-ignore')) continue;
+      const id = rec.mirror.getId(element);
+      if (!(id > 0)) continue;
+      const text = type === 'password' ? '*'.repeat(element.value.length) : element.value;
+      const isChecked = (type === 'checkbox' || type === 'radio') ? element.checked : false;
+      const current = { text, isChecked };
+      const previous = inputs.get(id) ?? known.get(element);
+      known.set(element, current);
+      if (!previous || (previous.text === text && previous.isChecked === isChecked)) continue;
+      events.push({ type: 3, data: { source: 5, id, text, isChecked }, timestamp });
+    }
+  };
+  window.__spectestSyncInputs();
+})();`;

package/dist/desktop.d.ts

@@ -0,0 +1,42 @@
+import type { Browser } from "./browser.js";
+export declare const DESKTOP_APP: unique symbol;
+/** An Electron service handle produced by electron(). */
+export interface DesktopApp {
+    readonly [DESKTOP_APP]: true;
+    readonly endpoint: string;
+    readonly name: string;
+}
+/** Real renderer window: user input, locators, assertions, and replay capture.
+ * close() closes this window only. Native OS dialogs are outside DOM replay. */
+export interface Desktop extends Browser {
+}
+/** Observed window configuration at the start of a replay session. */
+export interface DesktopChrome {
+    titleBarStyle: string;
+    frame: boolean;
+    trafficLightPosition: {
+        x: number;
+        y: number;
+    } | null;
+    titleBarOverlay: boolean | {
+        height?: number;
+        color?: string;
+        symbolColor?: string;
+    };
+    roundedCorners: boolean;
+    buttonVisibility: boolean | null;
+    titlebarArea?: {
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+    };
+}
+export interface DesktopOptions {
+    /** Zero-based window creation order. Defaults to the first window.
+     * Open additional windows using the app UI before selecting them.
+     * A closed window keeps its index; other windows never change identity. */
+    window?: number;
+}
+export declare function desktopApp(endpoint: string, name: string): DesktopApp;
+export declare function isDesktopApp(value: unknown): value is DesktopApp;

package/dist/desktop.js

@@ -0,0 +1,10 @@
+export const DESKTOP_APP = Symbol.for("spectest.desktopApp");
+export function desktopApp(endpoint, name) {
+    return { [DESKTOP_APP]: true, endpoint, name };
+}
+export function isDesktopApp(value) {
+    return typeof value === "object" && value !== null &&
+        value[DESKTOP_APP] === true &&
+        typeof value.endpoint === "string" &&
+        typeof value.name === "string";
+}

package/dist/harness/reach.d.ts

@@ -25,6 +25,10 @@ export interface ReachSource {
     /** Volume sources, project-relative; an absolute source is not a
      *  project path and is skipped. */
     volumeSources?: string[];
+    /** The service's declared `inputs`: project files or directories it
+     *  consumes some other way (packaged at setup, read at load). A
+     *  directory covers its subtree. */
+    inputs?: string[];
 }
 /**
  * The project's reach: every project file (`files`, project-relative)

package/dist/harness/reach.js

@@ -142,7 +142,7 @@ export function projectReach(files, sources) {
             if (rel)
                 out.add(rel);
         }
-        for (const v of s.volumeSources ?? []) {
+        for (const v of [...(s.volumeSources ?? []), ...(s.inputs ?? [])]) {
             if (v.startsWith("/"))
                 continue;
             const src = normRel(v);
@@ -236,7 +236,7 @@ export function sourceOf(sources, path) {
         for (const e of s.extraFiles ?? [])
             if (normRel(e) === p)
                 return s;
-        for (const v of s.volumeSources ?? []) {
+        for (const v of [...(s.volumeSources ?? []), ...(s.inputs ?? [])]) {
             if (v.startsWith("/"))
                 continue;
             const src = normRel(v);

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export type { UrlPattern } from "./url-match.js";
 import type { UrlPattern } from "./url-match.js";
 export type { Mobile, MobileApp } from "./mobile.js";
 import type { Mobile, MobileApp } from "./mobile.js";
+export type { Desktop, DesktopApp, DesktopOptions } from "./desktop.js";
+import type { Desktop, DesktopApp, DesktopOptions } from "./desktop.js";
 export type { Terminal, TerminalOpts, TerminalResult } from "./terminal.js";
 import type { Terminal, TerminalOpts, TerminalResult } from "./terminal.js";
 export { type CoverageAdapter, type CoverageCaptureContext, type CoverageConfigureInfo, type CoverageLoadContext, type ServiceCoverage, } from "./coverage.js";
@@ -141,6 +143,13 @@ export interface ServiceConfig {
     tls?: readonly ServiceTls[];
     /** Bind-mounted volumes for state that survives snapshot/fork. */
     volumes?: readonly VolumeMount[];
+    /**
+     * @internal Spectest's own components only: project files or
+     * directories the service consumes outside its build context and
+     * volumes (a lambda's `source`, Supabase's folder). Project-relative; a
+     * directory covers its subtree. The reach counts them.
+     */
+    inputs?: readonly string[];
     /**
      * Opt this service in to **code coverage collection** (experimental).
      *
@@ -841,6 +850,13 @@ export interface VolumeMount {
      * so unlike a volume directory it is never created or wiped by spectest.
      */
     source?: string;
+    /**
+     * @internal Spectest's own components only. The mount does not count
+     * for the project's reach: what the service can load from it is stated
+     * some other way (a narrowed build context, `inputs`). Never set this
+     * for a mount the service reads freely.
+     */
+    reachExempt?: boolean;
     /** Container path. */
     target: string;
     readOnly?: boolean;
@@ -1295,6 +1311,16 @@ export interface TestContext<P = undefined, S extends ServicesMap = ServicesMap,
      * like named desktop browsers.
      */
     mobile(app: MobileApp, name?: string): Promise<Mobile>;
+    /** Drive a real Electron renderer window through locators and user input.
+     * Acquires the app started by electron(); keeps its live state across forks.
+     * Each test gets a self-contained graphical replay. Selecting another window
+     * does not create a new app or isolate its storage from sibling windows.
+     *
+     * const app = await ctx.desktop(ctx.svc.app);
+     * await app.getByRole("textbox", { name: "New note" }).fill("Hello");
+     * await app.getByRole("button", { name: "Add note" }).click();
+     */
+    desktop(app: DesktopApp, options?: DesktopOptions): Promise<Desktop>;
     /** The test's display name. */
     readonly testName: string;
     /**

package/dist/index.js

@@ -322,6 +322,11 @@ function validateEnvironmentConfig(config) {
             }
         }
         validateCoverage(name, svc.coverage);
+        for (const input of svc.inputs ?? []) {
+            if (typeof input !== "string" || input.trim() === "" || input.startsWith("/") || input.split("/").includes("..")) {
+                throw new Error(`service "${name}" has an invalid \`inputs\` entry ${JSON.stringify(input)} — a project-relative file or directory path`);
+            }
+        }
         for (const raw of svc.hostnames ?? []) {
             const h = raw.toLowerCase();
             if (!HOSTNAME_RE.test(hostPatternBody(h))) {

package/dist/recorder.d.ts

@@ -464,6 +464,8 @@ export interface BrowserEvent extends BaseEvent {
      * bundle to look the session up in.
      */
     sessionName?: string;
+    /** Presentation kind; Electron and mobile share the browser event transport. */
+    frame?: "browser" | "mobile" | "desktop";
     /**
      * Wall-clock `Date.now()` captured at the moment this op *finished*.
      * Lives in the same time base as rrweb's `event.timestamp` fields,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser.ts

@@ -1,8 +1,8 @@
 // Headless browser handle for tests. Thin wrapper around playwright-core
 // driving the guest's system Chromium (pipe transport — `chromium.launch`
-// with an explicit `executablePath`; `connectOverCDP` is off-limits, its
-// bundled `ws` client hangs under Bun). The wrapper keeps the public
-// surface stable (we swapped from Bun.WebView to Playwright without
+// with an explicit `executablePath`). Electron attaches to the app-owned
+// Chromium over CDP instead; its client also lives inside the VM. The wrapper
+// keeps the public surface stable (we swapped from Bun.WebView to Playwright without
 // changing tests) and routes every call through the recorder so browser
 // actions show up in a test's event log alongside exec/fetch/assertion
 // events. Playwright's client state (browser/context/page objects, the
@@ -34,6 +34,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { generateId } from "./ids.js";
+import { rawFetch } from "./harness/raw-fetch.js";
+import { DESKTOP_INPUT_SYNC_SCRIPT } from "./desktop-recorder.js";
+import type { DesktopChrome } from "./desktop.js";
 import { recordBrowser, reserveBackdated, reserveEvent, truncateUtf8 } from "./recorder.js";
 import { wrap } from "./inspect.js";
 import type { Wrapped } from "./inspect.js";
@@ -150,6 +153,7 @@ export interface BrowserSessionRecorder {
    * from the persisted events alone, with no replay bundle).
    */
   readonly sessionName?: string;
+  readonly frame?: "browser" | "mobile" | "desktop";
   /** Called for each drained chunk of rrweb events. */
   recordStep(step: BrowserSessionStep): void;
   /** Optional: called whenever `Browser.goto(url)` is invoked. */
@@ -1144,7 +1148,7 @@ const PAGE_INIT_SCRIPT = RRWEB_BUNDLE
 // snapshot keeps steady-state steps (clicks/types on an unchanged page,
 // or navigations where `load` already fired) from bloating the stream
 // with redundant snapshots.
-function drainExpr(forceFullIfMissing: boolean): string {
+function drainExpr(forceFullIfMissing: boolean, timestamp = Date.now()): string {
   return `(function () {
   try {
     var rec = window.__spectestRec;
@@ -1159,6 +1163,9 @@ function drainExpr(forceFullIfMissing: boolean): string {
       if (!hasFull) rec.takeFullSnapshot();
     }
   } catch (e) { /* recording inactive or DOM detached — drain what's there. */ }
+  if (typeof window.__spectestSyncInputs === "function") {
+    window.__spectestSyncInputs(${timestamp});
+  }
   var buf = window.__spectestRrwebEvents;
   if (!buf || !buf.length) return [];
   window.__spectestRrwebEvents = [];
@@ -1551,6 +1558,92 @@ export async function acquirePersistentMobileBackend(
   return { browser: backend, attached: existing !== undefined, detach };
 }
 
+/** Live CDP clients and window identities ride the harness snapshot. */
+const ELECTRON_APPS = new Map<string, Promise<{
+  browser: PlaywrightBrowser;
+  context: BrowserContext;
+  windows: Page[];
+  holders: Map<Page, ViewHolder>;
+}>>();
+
+/** Attach the shared locator/recorder backend to an actual Electron window.
+ * Never navigate, reload, emulate a viewport, or replace its renderer. */
+export async function acquirePersistentDesktop(
+  endpoint: string,
+  windowIndex: number,
+  recorder: BrowserSessionRecorder | null,
+): Promise<PersistentBrowser & { desktopChrome?: DesktopChrome }> {
+  if (!Number.isInteger(windowIndex) || windowIndex < 0) {
+    throw new Error("ctx.desktop(): window must be a non-negative integer (creation order)");
+  }
+  let pending = ELECTRON_APPS.get(endpoint);
+  if (!pending) {
+    pending = (async () => {
+      const response = await rawFetch(new URL("/json/version", endpoint), {
+        signal: AbortSignal.timeout(15_000),
+      });
+      if (!response.ok) throw new Error(`Electron debugger discovery failed: HTTP ${response.status}`);
+      const info = await response.json() as { webSocketDebuggerUrl: string };
+      const websocket = new URL(info.webSocketDebuggerUrl);
+      websocket.host = new URL(endpoint).host;
+      const browser = await chromium.connectOverCDP(websocket.toString(), { timeout: 15_000 });
+      const context = browser.contexts()[0];
+      if (!context) { await browser.close(); throw new Error("Electron has no renderer context"); }
+      const windows = context.pages().filter(page => !page.url().startsWith("devtools:"));
+      context.on("page", page => { if (!page.url().startsWith("devtools:")) windows.push(page); });
+      browser.on("disconnected", () => { ELECTRON_APPS.delete(endpoint); });
+      return { browser, context, windows, holders: new Map<Page, ViewHolder>() };
+    })();
+    ELECTRON_APPS.set(endpoint, pending);
+    pending.catch(() => { if (ELECTRON_APPS.get(endpoint) === pending) ELECTRON_APPS.delete(endpoint); });
+  }
+  const app = await pending;
+  const deadline = Date.now() + 15_000;
+  while (!app.windows[windowIndex]) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error(`Electron window ${windowIndex} did not open`);
+    await app.context.waitForEvent("page", { timeout: remaining });
+  }
+  const page = app.windows[windowIndex];
+  if (page.isClosed()) throw new Error(`Electron window ${windowIndex} is closed; window indices retain creation order`);
+  await page.waitForLoadState("domcontentloaded");
+  // The main-process observer publishes only window presentation options.
+  // A popup created internally by Chromium might not pass through BrowserWindow.
+  await page.waitForFunction(() => Boolean((window as any).__spectestElectronChrome), null, { timeout: 3000 }).catch(() => {});
+  const desktopChrome = await page.evaluate(() => {
+    const chrome = (window as any).__spectestElectronChrome;
+    if (!chrome) return undefined;
+    const overlay = (navigator as any).windowControlsOverlay;
+    return { ...chrome, ...(overlay?.visible ? { titlebarArea: overlay.getTitlebarAreaRect().toJSON() } : {}) };
+  }) as DesktopChrome | undefined;
+  let holder = app.holders.get(page);
+  const attached = holder !== undefined;
+  if (!holder) {
+    const cdp = await app.context.newCDPSession(page);
+    await cdp.send("Page.enable");
+    if (!PAGE_INIT_SCRIPT) throw new Error("Electron replay recorder bundle is missing");
+    const init = `${PAGE_INIT_SCRIPT};\n${DESKTOP_INPUT_SYNC_SCRIPT}`;
+    await cdp.send("Page.addScriptToEvaluateOnNewDocument", { source: init });
+    // The app owns navigation and may already have loaded. Start on its live
+    // DOM, without losing drafts or replaying any application startup effects.
+    await page.evaluate(init);
+    const size = await page.evaluate(() => ({ width: innerWidth, height: innerHeight }));
+    holder = {
+      context: app.context, page, cdp, lastTitle: await page.title(),
+      recordingInstalled: true, device: null, width: size.width, height: size.height,
+      safeAreaInsets: null, initScripts: [],
+    };
+    app.holders.set(page, holder);
+    page.on("close", () => { app.holders.delete(page); });
+  }
+  await attachReset(holder);
+  const { backend, detach } = buildBackend(holder, recorder, {
+    persistent: false, ownsContext: false,
+    onDestroy: () => { app.holders.delete(page); },
+  });
+  return { browser: backend, attached, detach, desktopChrome };
+}
+
 /** True when a navigation failed on Chromium name resolution. */
 function isNameNotResolved(err: unknown): boolean {
   return String((err as Error)?.message ?? err).includes("ERR_NAME_NOT_RESOLVED");
@@ -1617,6 +1710,8 @@ interface BackendBuildOptions {
   /** Called when close() destroys the underlying view — the acquire
    *  functions use it to drop the holder from the shared registry. */
   onDestroy?: () => void;
+  /** Electron windows share an app context; closing one must leave siblings alive. */
+  ownsContext?: boolean;
 }
 
 function buildBackend(
@@ -1678,15 +1773,16 @@ function buildBackend(
     return {
       sessionId: recorder.sessionId,
       sessionTimestamp: endT,
+      ...(recorder.frame ? { frame: recorder.frame } : {}),
       ...(recorder.sessionName ? { sessionName: recorder.sessionName } : {}),
     };
   }
 
-  async function drain(action: BrowserAction | "close"): Promise<void> {
+  async function drain(action: BrowserAction | "close", timestamp = Date.now()): Promise<void> {
     if (!holder.recordingInstalled || !recorder || recordingEnded) return;
     try {
       const urlChanged = holder.page.url() !== lastDrainUrl;
-      const events = (await holder.page.evaluate(drainExpr(urlChanged))) as unknown[];
+      const events = (await holder.page.evaluate(drainExpr(urlChanged, timestamp))) as unknown[];
       lastDrainUrl = holder.page.url();
       if (Array.isArray(events) && events.length > 0) {
         recorder.recordStep({
@@ -1731,7 +1827,7 @@ function buildBackend(
         ...sessionFields(endT),
         durationMs: endT - t,
       }, resv);
-      await drain(action);
+      await drain(action, endT);
       // Fold this page's V8 counters into the per-service totals now — a
       // navigation to another origin replaces the renderer and its
       // counters, so harvesting per op is what keeps them.
@@ -1766,7 +1862,7 @@ function buildBackend(
       }, resv);
       // Still try to drain — the failure itself may have produced
       // useful rrweb events (mutations from a half-loaded page, etc.).
-      await drain(action);
+      await drain(action, endT);
       throw err;
     }
   }
@@ -2067,7 +2163,7 @@ function buildBackend(
       // The context, not the page, holds the cookies and storage — closing
       // only the page would leave the next session signed in as this one.
       try {
-        await holder.context.close();
+        if (buildOpts.ownsContext !== false) await holder.context.close();
       } catch {
         /* context already gone (browser died) */
       }
@@ -2149,7 +2245,7 @@ function buildBackend(
       }, reserveBackdated(waitedMs));
       // Drain the rrweb the page buffered while the matcher waited into this
       // step's chunk, so `settledTarget` has bounds to seek into.
-      await drain(action);
+      await drain(action, endT);
       return seq;
     },
     pageOp<T>(

package/src/components/aws.ts

@@ -249,6 +249,12 @@ export function aws(opts: AwsOptions = {}) {
       LAMBDA_DOCKER_NETWORK: SPECTEST_NETWORK,
     },
     volumes: [{ source: DOCKER_SOCKET, target: DOCKER_SOCKET }],
+    // Each lambda's code is packaged from the project at setup: no build
+    // context or volume carries it, so it is declared as an input and a
+    // change to it is never taken as one that can affect no test.
+    ...(Object.keys(lambdas).length > 0
+      ? { inputs: Object.values(lambdas).map((l) => l.source).filter((s) => typeof s === "string" && s.trim() !== "") }
+      : {}),
     ports: [AWS_PORT],
     readyCheck: {
       type: "http" as const,