buninu-browser 0.5.1 → 0.6.0

package/lib/renderer/compositor-channel.js

@@ -12,7 +12,7 @@ export function encodePacket(message, pixels = null) {
   const json = Buffer.from(JSON.stringify(message));
   const size = pixels?.byteLength ?? 0;
   if (json.length > MAX_JSON || size > MAX_PIXELS || json.length + size > MAX_QUEUE) throw Error('Compositor packet too large');
-  const packet = Buffer.allocUnsafe(8 + json.length + size);
+  const packet = Buffer.allocUnsafeSlow(8 + json.length + size);
   packet.writeUInt32LE(json.length, 0); packet.writeUInt32LE(size, 4);
   packet.set(json, 8); if (size) packet.set(pixels, 8 + json.length);
   return packet;
@@ -34,7 +34,7 @@ export class PacketReader {
         const binaryLength = this.header.readUInt32LE(4);
         const total = this.jsonLength + binaryLength;
         if (!this.jsonLength || this.jsonLength > MAX_JSON || binaryLength > MAX_PIXELS || total > this.limit) throw Error('Invalid compositor packet size');
-        this.packet = Buffer.allocUnsafe(total);
+        this.packet = Buffer.allocUnsafeSlow(total);
       } else {
         const packet = this.packet; this.packet = null;
         const message = JSON.parse(packet.subarray(0, this.jsonLength).toString());
@@ -45,21 +45,106 @@ export class PacketReader {
   }
 }
 
+// Serialize complete packets, including their two writes, so control messages
+// cannot land between an owned frame's header and pixels. Do not cork these
+// writes: Bun's node:net _writev joins chunks with Buffer.concat.
+export class PacketWriter {
+  constructor(socket, limit = MAX_QUEUE) {
+    this.socket = socket; this.limit = limit; this.queue = []; this.bytes = 0;
+    this.current = null; this.waiting = false; this.pumping = false; this.closed = false;
+    socket.on('error', () => this.close());
+    socket.once('close', () => {
+      this.close();
+      // A destroyed socket can still have a pending native write until its
+      // callback/close event. Only now is its last borrowed buffer disposable.
+      this.release(this.current); this.current = null;
+    });
+  }
+  release(entry) {
+    if (!entry || entry.released) return;
+    entry.released = true;
+    if (entry.queued) this.bytes -= entry.size;
+    for (const buffer of entry.buffers) buffer.transfer(0);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const entry of this.queue) this.release(entry);
+    this.queue.length = 0;
+    this.socket.destroy();
+  }
+  pump() {
+    if (this.pumping || this.waiting || this.closed) return;
+    this.pumping = true;
+    try {
+      while (!this.waiting && !this.closed) {
+        this.current ??= this.queue.shift();
+        const entry = this.current;
+        if (!entry) break;
+        if (entry.index === entry.parts.length) {
+          this.release(entry); this.current = null; continue;
+        }
+        this.waiting = true;
+        try {
+          this.socket.write(entry.parts[entry.index++], error => {
+            if (entry !== this.current || entry.released) return;
+            this.waiting = false;
+            if (error || this.closed || this.socket.destroyed) {
+              this.close(); this.release(entry); this.current = null;
+            } else this.pump();
+          });
+        } catch (error) {
+          // Some header bytes may already be on the wire. Closing is required
+          // even when write throws synchronously, or the next packet is corrupt.
+          this.close();
+          return error;
+        }
+      }
+    } finally { this.pumping = false; }
+  }
+  send(message, pixels, {takeOwnership = false} = {}) {
+    const entry = {parts:[], buffers:[], index:0, size:0, queued:false, released:false};
+    try {
+      if (takeOwnership) {
+        if (!(pixels instanceof Uint8Array) || !(pixels.buffer instanceof ArrayBuffer))
+          throw TypeError('Owned compositor pixels must have a private ArrayBuffer');
+        // The caller gives up this entire buffer, including on a rejected send.
+        entry.buffers.push(pixels.buffer);
+      }
+      if (this.closed || this.socket.destroyed) throw Error('Compositor channel closed');
+      const packet = encodePacket(message, takeOwnership ? null : pixels);
+      entry.buffers.push(packet.buffer);
+      entry.parts.push(packet);
+      if (takeOwnership) {
+        const size = pixels.byteLength;
+        if (size > MAX_PIXELS || packet.length - 8 + size > MAX_QUEUE) throw Error('Compositor packet too large');
+        packet.writeUInt32LE(size, 4);
+        if (size) entry.parts.push(pixels);
+      }
+      entry.size = entry.parts.reduce((size, part) => size + part.byteLength, 0);
+      if (this.bytes + entry.size > this.limit) {
+        this.close(); throw Error('Compositor channel backpressure limit');
+      }
+      entry.queued = true; this.bytes += entry.size; this.queue.push(entry);
+      const error = this.pump();
+      if (error) throw error;
+    } catch (error) {
+      if (!entry.queued) this.release(entry);
+      throw error;
+    }
+  }
+}
+
 function attach(socket, receive, closed, limit) {
   socket.setNoDelay(true);
   const reader = new PacketReader(receive, limit);
+  const writer = new PacketWriter(socket);
   socket.on('data', chunk => { try { reader.push(chunk); } catch { socket.destroy(); } });
-  socket.on('error', () => {});
   socket.once('close', closed);
   return {
     reader,
-    send(message, pixels) {
-      if (socket.destroyed) throw Error('Compositor channel closed');
-      const packet = encodePacket(message, pixels);
-      if (socket.writableLength + packet.length > MAX_QUEUE) { socket.destroy(); throw Error('Compositor channel backpressure limit'); }
-      socket.write(packet);
-    },
-    close() { socket.destroy(); },
+    send(message, pixels, options) { writer.send(message, pixels, options); },
+    close() { writer.close(); },
   };
 }
 

package/lib/renderer/compositor.js

@@ -11,7 +11,7 @@
  *   controller -> compositor  { id, method: "screenshot" | "scroll" | "scrollOffset", params }
  *                             (screenshot params: [{ format?: "png" | "jpeg" | "webp", quality? }])
  *   compositor -> controller  { id, result } | { id, error }
- *                             { type: "frame" }   (what the viewport shows changed)
+ *                             { type: "frame", scrollOffset: { x, y } }   (the viewport changed)
  *
  * Messages with the main thread (postMessage):
  *   main -> compositor  { type: "frame", serial, tile, viewport, content, scroll, scrollEpoch }
@@ -25,8 +25,8 @@ import { ScrollViewport } from "../layout/scroll-viewport.js";
 import { rawFrame, captureViewport, encodeImage, encodeImageBase64 } from "../paint/frame.js";
 import { FrameCaptureCache } from "../paint/frame-cache.js";
 import { FrameLeaseTracker } from "../paint/shared-frame-pool.js";
-import wasmpeg from "../../vendor/wasmpeg/src/js/index.js";
-import { VideoPresentation, compositeVideo } from "./video-presentation.js";
+import { startVideoChannel } from "./video-channel.js";
+import { compositeVideo, captureVideoViewport } from "./video-presentation.js";
 
 import {connectCompositor} from './compositor-channel.js';
 
@@ -36,9 +36,14 @@ let scrollEpoch = -1;
 let frameSerial = 0;
 const captures = new FrameCaptureCache();
 const frameLeases = new FrameLeaseTracker(serial => postMessage({ type: "frame-release", serial }));
-const video = new VideoPresentation(wasmpeg, () => {
+// Register before awaiting decoder startup: the parent's connect message may
+// arrive while the media worker is loading WASM.
+const endpointReady = new Promise(resolve => {
+  self.onmessage = ({data}) => { if (data?.type === 'connect') resolve(data.endpoint); };
+});
+const video = await startVideoChannel(() => {
   frameSerial++;
-  send({ type: "frame" });
+  notifyFrame();
 }, report => postMessage({ type: "video-report", ...report }));
 
 let channel;
@@ -46,16 +51,23 @@ function send(message) {
   const result = message.result;
   if (result?.pixels instanceof Uint8Array) {
     const {pixels,...metadata} = result;
-    channel.send({...message,result:metadata},pixels);
+    // This raw result is exclusively owned here. The transport borrows it
+    // directly, then releases it after the write completes (or the socket
+    // closes); do not detach bytes while a native socket may still use them.
+    channel.send({...message,result:metadata},pixels,{takeOwnership:true});
   } else channel.send(message);
 }
-const endpoint = await new Promise(resolve => {
-  self.onmessage = ({data}) => { if (data?.type === 'connect') resolve(data.endpoint); };
-});
+function notifyFrame() {
+  // Snapshot the compositor-owned position with its invalidation. A zero-area
+  // screencast needs no pixels and can use this without another socket request.
+  send({ type: "frame", scrollOffset: { x: viewport.x, y: viewport.y } });
+}
+const endpoint = await endpointReady;
 channel = await connectCompositor(endpoint, request => { void handleRequest(request); }, () => process.exit(1));
 
 self.onmessage = ({ data }) => {
   if (data?.type === "video-open") { void video.open(data); return; }
+  if (data?.type === "video-extend") { video.extend(data); return; }
   if (data?.type === "video-stop") { video.stop(data.id); frameSerial++; return; }
   if (data?.type === "video-bind") { video.bind(data.id, data.audioId, data.audioStart, data.time, data.endTime); return; }
   if (data?.type !== "frame") return;
@@ -75,33 +87,58 @@ self.onmessage = ({ data }) => {
       postMessage({ type: "scroll", x: viewport.x, y: viewport.y });
     }
   }
-  send({ type: "frame" });
+  notifyFrame();
   // Lets the main thread answer the call that produced this frame only once
   // screenshots taken after it will show it.
   postMessage({ type: "frame-ack", serial: data.serial });
 };
 
+// Only private composition/crop buffers are disposable. A full-width crop
+// may borrow the immutable raster tile, which remains protected by its lease.
+function releaseCapture(frame, composited, captured, retained = null) {
+  if (captured && captured.pixels.buffer !== retained && captured.pixels.buffer !== composited.pixels.buffer)
+    captured.pixels.buffer.transfer(0);
+  if (composited !== frame && composited.pixels.buffer !== retained) composited.pixels.buffer.transfer(0);
+}
+
 const methods = {
   async screenshot({ format = "png", quality = 80, optimizeForSpeed = false, clip } = {}) {
     if (!tile) return "";
     if (format === 'rgba' || format === 'bgra') {
       return frameLeases.capture(frame => {
-        const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
-        const {pixels,width,height} = captureViewport(composited,viewport.x,viewport.y,viewport.width,viewport.height,clip);
-        return rawFrame(pixels,width,height,format);
+        const visible = frame.videoLayer?.id === video.config?.id
+          ? captureVideoViewport(frame, video.frame, viewport.x, viewport.y, viewport.width, viewport.height, clip, format) : null;
+        if (visible) {
+          // This crop owns its bytes. The normal transport releases them
+          // after the socket write completes; the raster tile's lease stays intact.
+          try { return rawFrame(visible.pixels, visible.width, visible.height, format,
+            {takeOwnership: true, inputFormat: visible.pixelFormat}); }
+          catch (error) { visible.pixels.buffer.transfer(0); throw error; }
+        }
+        const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame, format) : frame;
+        let captured, result;
+        try {
+          captured = captureViewport(composited,viewport.x,viewport.y,viewport.width,viewport.height,clip);
+          const takeOwnership = captured.pixels.buffer !== frame.pixels.buffer;
+          result = rawFrame(captured.pixels,captured.width,captured.height,format,{takeOwnership,inputFormat:composited.pixelFormat ?? "rgba"});
+          return result;
+        } finally { releaseCapture(frame, composited, captured, result?.pixels.buffer); }
       });
     }
     const key = `${frameSerial}:${viewport.x}:${viewport.y}:${format}:${quality}:${optimizeForSpeed}:${JSON.stringify(clip)}`;
-    return captures.get(key, () => frameLeases.capture(frame => {
+    return captures.get(key, () => frameLeases.capture(async frame => {
       const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
-      const { pixels, width, height } = captureViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height,clip);
-      return encodeImageBase64(pixels, width, height, { format, quality, optimizeForSpeed });
+      let captured;
+      try {
+        captured = captureViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height,clip);
+        return await encodeImageBase64(captured.pixels, captured.width, captured.height, { format, quality, optimizeForSpeed });
+      } finally { releaseCapture(frame, composited, captured); }
     }));
   },
   scroll(deltaX, deltaY) {
     if (viewport.scrollBy(deltaX, deltaY)) {
       postMessage({ type: "scroll", x: viewport.x, y: viewport.y });
-      send({ type: "frame" });
+      notifyFrame();
     }
     return { x: viewport.x, y: viewport.y };
   },
@@ -128,5 +165,4 @@ async function handleRequest(request) {
 // renderer installs seccomp, which forbids opening files.
 await encodeImage(new Uint8Array(4), 1, 1);
 await encodeImage(new Uint8Array(4), 1, 1, { format: "jpeg" });
-await wasmpeg.load();
 postMessage({ type: "ready" });

package/lib/renderer/document-cookies.js

@@ -0,0 +1,87 @@
+import { CookieJar } from "../network/cookie-jar.js";
+
+/** Shared by the document and its same-origin frames; the controller remains authoritative. */
+export class DocumentCookies {
+  #jar;
+  #now;
+  #send;
+  #nextSequence = 1;
+  #revision = -1;
+  #acknowledged = 0;
+  #pending = new Map();
+  #legacyCookie = "";
+
+  constructor(send = () => {}, now = () => Date.now()) {
+    this.#send = send;
+    this.#now = now;
+    this.#jar = new CookieJar({ now });
+  }
+
+  get(url) {
+    return this.#revision < 0 ? this.#legacyCookie : this.#jar.documentCookie(url);
+  }
+
+  set(url, value) {
+    const assignment = String(value);
+    // The controller imposes the same IPC limit; rejected writes cannot
+    // temporarily create a cookie which the controller will never accept.
+    if (assignment.length > 4096) return;
+    const sequence = this.#nextSequence++;
+    // Legacy embedders need not acknowledge setters. Only retain mutations
+    // after the controller has established the versioned snapshot protocol.
+    if (this.#revision < 0) {
+      this.#legacyCookie = mergeLegacyCookie(this.#legacyCookie, assignment, this.#now());
+    } else {
+      const mutation = { sequence, url, value: assignment, receivedAt: this.#now() };
+      this.#pending.set(sequence, mutation);
+      this.#jar.store(url, [assignment], { fromScript: true, receivedAt: mutation.receivedAt });
+    }
+    this.#send(assignment, url, sequence);
+  }
+
+  accept(state) {
+    if (!state || !Number.isSafeInteger(state.revision) || state.revision <= this.#revision
+        || !Number.isSafeInteger(state.acknowledged) || state.acknowledged < this.#acknowledged
+        || !Array.isArray(state.cookies)) return false;
+    this.#revision = state.revision;
+    this.#acknowledged = state.acknowledged;
+    this.#legacyCookie = "";
+    for (const sequence of this.#pending.keys()) {
+      if (sequence <= state.acknowledged) this.#pending.delete(sequence);
+    }
+    this.#jar.replaceScriptSnapshot(state.cookies);
+    // A response may have been queued before a newer synchronous setter ran.
+    // Replay only those setters, retaining unrelated server cookies and the
+    // original Max-Age start time rather than extending it on each snapshot.
+    for (const mutation of this.#pending.values()) {
+      this.#jar.store(mutation.url, [mutation.value], { fromScript: true, receivedAt: mutation.receivedAt });
+    }
+    return true;
+  }
+
+  /** Compatibility for embedders providing only the old documentCookie string. */
+  seed(url, value, replace = false) {
+    if (this.#revision >= 0 || typeof value !== "string") return;
+    // A header has no Path/Domain metadata, so preserve it verbatim instead of
+    // inventing records (which would collapse legitimate duplicate names).
+    // An embedded about:blank initial load must not erase its parent's value.
+    if (replace || value) this.#legacyCookie = value;
+  }
+}
+
+/** Preserve the string-only embedder API until a controller snapshot arrives. */
+function mergeLegacyCookie(current, assignment, now) {
+  const [pair, ...attributes] = assignment.split(";");
+  const equals = pair.indexOf("=");
+  if (equals < 1) return current;
+  const name = pair.slice(0, equals).trim();
+  const value = pair.slice(equals + 1).trim();
+  const expired = attributes.some(attribute => {
+    const [key, argument = ""] = attribute.split("=").map(part => part.trim().toLowerCase());
+    return (key === "max-age" && Number(argument) <= 0)
+      || (key === "expires" && Date.parse(argument) <= now);
+  });
+  const entries = current ? current.split("; ").filter(entry => !entry.startsWith(`${name}=`)) : [];
+  if (!expired) entries.push(`${name}=${value}`);
+  return entries.join("; ");
+}

package/lib/renderer/font-loading.js

@@ -3,6 +3,7 @@
 // every document and iframe.
 const encoder = new TextEncoder();
 const MAX_FONT_BYTES = 32 * 1024 * 1024;
+const MAX_RANKED_FONT_CHOICES = 128;
 
 export function registerTypeface(CanvasKit, provider, typeface, family) {
   const bytes = encoder.encode(`${family}\0`);
@@ -37,7 +38,13 @@ function weightRank(face, wanted) {
 }
 
 function covers(face, point) {
-  return (face.unicodeRanges ?? [[0, 0x10ffff]]).some(([from, to]) => from <= point && point <= to);
+  const ranges = face.unicodeRanges;
+  if (!ranges) return 0 <= point && point <= 0x10ffff;
+  for (let index = 0; index < ranges.length; index++) {
+    const range = ranges[index];
+    if (range[0] <= point && point <= range[1]) return true;
+  }
+  return false;
 }
 
 function stretchRank(face, wanted) {
@@ -61,20 +68,37 @@ export function neededFontFaces(faces, textRuns, availableFamilies = new Set())
     if (!families.has(key)) families.set(key, []);
     families.get(key).push(face);
   }
+  return neededFacesFromIndex(families, new Map(), textRuns, availableFamilies);
+}
+
+function orderedFontFaces(families, choices, name, weight, style, stretch) {
+  const definitions = families.get(name);
+  if (!definitions) return null;
+  const key = JSON.stringify([name, weight, style, stretch]);
+  let ordered = choices.get(key);
+  if (!ordered) {
+    // Ranking is independent of Unicode coverage; stable sorting preserves
+    // the CSS face order even when a character filters out other subsets.
+    ordered = ranked(definitions, weight, style, stretch);
+    if (choices.size >= MAX_RANKED_FONT_CHOICES) choices.clear();
+    choices.set(key, ordered);
+  }
+  return ordered;
+}
+
+function neededFacesFromIndex(families, choices, textRuns, availableFamilies) {
   const needed = new Set();
-  const choices = new Map();
   for (const { text, style } of textRuns) {
     if (!text || !style) continue;
     const points = new Set([...text].map(character => character.codePointAt(0)));
     for (const family of style.fontFamily ?? []) {
-      const definitions = families.get(family.toLowerCase());
-      if (!definitions) {
-        if (availableFamilies.has(family.toLowerCase())) break;
+      const name = family.toLowerCase();
+      const ordered = orderedFontFaces(families, choices, name,
+        style.fontWeight ?? 400, style.fontStyle ?? "normal", style.fontStretch ?? 100);
+      if (!ordered) {
+        if (availableFamilies.has(name)) break;
         continue;
       }
-      const key = `${family.toLowerCase()}\n${style.fontWeight ?? 400}/${style.fontStyle ?? "normal"}/${style.fontStretch ?? 100}`;
-      let ordered = choices.get(key);
-      if (!ordered) choices.set(key, ordered = ranked(definitions, style.fontWeight ?? 400, style.fontStyle ?? "normal", style.fontStretch ?? 100));
       for (const point of points) {
         const face = ordered.find(face => covers(face, point));
         if (face) { needed.add(face); points.delete(point); }
@@ -94,7 +118,9 @@ export class DocumentFonts {
   #error;
   #provider = null;
   #collection = null;
-  #faces = [];
+  #families = new Map();
+  #faceKeys = new WeakMap();
+  #rankedFaces = new Map();
   #records = new Map();
   #sources = new Map();
   #pending = new Set();
@@ -119,7 +145,16 @@ export class DocumentFonts {
   get hasUnicodeRanges() { return this.#hasUnicodeRanges; }
 
   setFaces(faces) {
-    this.#faces = faces;
+    this.#families.clear();
+    this.#faceKeys = new WeakMap();
+    this.#rankedFaces.clear();
+    for (const face of faces) {
+      const family = face.family.toLowerCase();
+      let definitions = this.#families.get(family);
+      if (!definitions) this.#families.set(family, definitions = []);
+      definitions.push(face);
+      this.#faceKeys.set(face, JSON.stringify(face));
+    }
     this.#hasUnicodeRanges = faces.some(face => face.unicodeRanges?.length
       && !(face.unicodeRanges.length === 1 && face.unicodeRanges[0][0] === 0 && face.unicodeRanges[0][1] === 0x10ffff));
   }
@@ -127,8 +162,8 @@ export class DocumentFonts {
   update(faces, textRuns) {
     if (this.#closed) return;
     this.setFaces(faces);
-    for (const face of neededFontFaces(faces, textRuns, this.#availableFamilies)) {
-      const key = JSON.stringify(face);
+    for (const face of neededFacesFromIndex(this.#families, this.#rankedFaces, textRuns, this.#availableFamilies)) {
+      const key = this.#faceKeys.get(face);
       if (this.#records.has(key)) continue;
       const record = { face, alias: null };
       this.#records.set(key, record);
@@ -141,9 +176,16 @@ export class DocumentFonts {
 
   /** Available faces in CSS fallback order; unicode-subset files share a family. */
   resolve(family, weight = 400, style = "normal", point = null, stretch = 100) {
-    const definitions = this.#faces.filter(face => face.family.toLowerCase() === family.toLowerCase()
-      && (point === null || covers(face, point)));
-    return ranked(definitions, weight, style, stretch).map(face => this.#records.get(JSON.stringify(face))?.alias).filter(Boolean);
+    const ordered = orderedFontFaces(this.#families, this.#rankedFaces, family.toLowerCase(), weight, style, stretch);
+    if (!ordered) return [];
+    const aliases = [];
+    for (const face of ordered) {
+      if (point !== null && !covers(face, point)) continue;
+      // Read the live record: a face may finish loading after it was ranked.
+      const alias = this.#records.get(this.#faceKeys.get(face))?.alias;
+      if (alias) aliases.push(alias);
+    }
+    return aliases;
   }
 
   async ready() {
@@ -222,6 +264,8 @@ export class DocumentFonts {
     for (const source of this.#sources.values()) source.then(typeface => typeface?.delete(), () => {});
     this.#sources.clear();
     this.#records.clear();
-    this.#faces = [];
+    this.#families.clear();
+    this.#faceKeys = new WeakMap();
+    this.#rankedFaces.clear();
   }
 }

package/lib/renderer/host.js

@@ -70,6 +70,8 @@ export class RendererHost {
   // The document this host asked its renderer to load: the trusted origin
   // for everything the renderer requests.
   #documentUrl = "about:blank";
+  #cookieSequence = 0;
+  #cookieRevision = 0;
   #child = null;
   #ready = null;
   #pending = new Map();
@@ -100,7 +102,7 @@ export class RendererHost {
    *   onNavigate?: (url: string, downloadName: string | null, fragmentFrom: { x: number, y: number } | null,
    *     post: { method: "POST", body: Uint8Array, contentType: string, referrer: string } | null) => void,
    *   onDownload?: (payload: { url: string, name: string, data: Uint8Array }) => void,
-   *   onFrame?: () => void,
+   *   onFrame?: (frame?: { scrollOffset: { x: number, y: number } }) => void,
    *   onLifecycle?: (name: "DOMContentLoaded" | "load", generation: number) => void,
    *   compositor?: boolean,
    *   fetch?: typeof fetch,
@@ -108,7 +110,7 @@ export class RendererHost {
    * }} options
    */
   constructor({
-    entry = DEFAULT_ENTRY, args = [], timeout = 30_000, onRestart = null, onNavigate = null, onDownload = null,
+    entry = DEFAULT_ENTRY, args = [], timeout = 0, onRestart = null, onNavigate = null, onDownload = null,
     fetch: fetchImpl = fetch,
     network = new NetworkService({ fetch: fetchImpl }), onFrame = null, onLifecycle = null,
     // A dedicated loopback socket works independently of the main thread on all platforms.
@@ -172,13 +174,11 @@ export class RendererHost {
           if (message?.type === "ready") {
             this.#sandbox = sanitizeSandboxReport(message.sandbox);
             this.#rejectStartup=null;
-            clearTimeout(startupTimer);
             resolveReady();
           }
           else this.#handleMessage(child, message);
         },
         onExit: (_process, exitCode, signalCode) => {
-          clearTimeout(startupTimer);
           this.#closeChannel(channel);
           this.#closeSockets(child);
           this.#closeAudio(child);
@@ -194,9 +194,10 @@ export class RendererHost {
         },
       });
       this.#child = child;
-      const startupTimer = setTimeout(() => {
-        this.#closeChannel(channel); child.kill(9); rejectReady(Error('Renderer startup timed out'));
-      }, this.#timeout);
+      this.#cookieSequence = 0;
+      // Startup has no deadline: compiling WASM on a slow machine can take
+      // arbitrarily long. Exit and explicit close still reject the wait.
+      // Interactive method watchdogs start only after the renderer is ready.
       if (logging) {
         pipeToLog(child.stdout, `renderer ${child.pid}`, (chunk) => process.stdout.write(chunk));
         pipeToLog(child.stderr, `renderer ${child.pid}`, (chunk) => process.stderr.write(chunk));
@@ -270,16 +271,22 @@ export class RendererHost {
       catch(error) { channel.pending.get(id).reject(error); channel.pending.delete(id); }
     });
     if (channel.closed || this.#child !== child) throw Error("Renderer closed during capture");
-    const sanitized = this.#captureResult(method, result, params);
+    const sanitized = this.#captureResult(method, result, params, true);
     if (method === "scroll") this.#pendingScroll = sanitized;
     return sanitized;
   }
 
-  #captureResult(method,result,params) {
+  #captureResult(method,result,params,ownsPacket=false) {
     if (method === 'screenshot' && ['rgba','bgra'].includes(params[0]?.format)) {
-      if (result?.format !== params[0].format) throw Error('Raw screenshot format mismatch');
-      this.#rawFrames ??= new RawFrames();
-      return this.#rawFrames.write(result.pixels,result.width,result.height,result.format);
+      try {
+        if (result?.format !== params[0].format) throw Error('Raw screenshot format mismatch');
+        this.#rawFrames ??= new RawFrames();
+        return this.#rawFrames.write(result.pixels,result.width,result.height,result.format);
+      } finally {
+        // PacketReader owns a standalone allocation; write() above is sync.
+        // Main-thread IPC fallback buffers have a different ownership contract.
+        if (ownsPacket && result?.pixels instanceof Uint8Array) result.pixels.buffer.transfer(0);
+      }
     }
     return sanitizeCompositorResult(method,result);
   }
@@ -287,7 +294,12 @@ export class RendererHost {
   #handleCompositorMessage(channel, message, pixels) {
     if (channel.closed || typeof message !== "object" || message === null) return;
     if (message.type === "frame") {
-      if (this.#channel === channel) this.#onFrame?.();
+      if (this.#channel === channel) {
+        const offset = message.scrollOffset;
+        const frame = Number.isFinite(offset?.x) && Number.isFinite(offset?.y)
+          ? { scrollOffset: { x: offset.x, y: offset.y } } : undefined;
+        this.#onFrame?.(frame);
+      }
     } else if (Number.isInteger(message.id) && channel.pending.has(message.id)) {
       const pending = channel.pending.get(message.id);
       channel.pending.delete(message.id);
@@ -329,9 +341,17 @@ export class RendererHost {
     const child = this.#child;
     if (method === 'click' || method === 'press') this.#clipboardUntil = Date.now()+5000;
     if (method === 'loadDocument') this.#clipboardUntil = 0;
+    if (method === 'loadDocument' && params[0]) {
+      params = [{ ...params[0], cookieState: this.#cookieState() }, ...params.slice(1)];
+    }
     const id = this.#nextId++;
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
+      // Navigation, including its final fragment positioning, can include
+      // expensive layout/script work. Close/exit cancels it, not a time limit.
+      const navigating = method === 'loadDocument' || method === 'showFragment';
+      // A watchdog is opt-in: elapsed time alone cannot distinguish a slow
+      // renderer from a hung one, including title queries during page loading.
+      const timer = navigating || !(timeout > 0) ? null : setTimeout(() => {
         this.#pending.delete(id);
         // Watchdog: a renderer that misses its deadline is killed outright.
         this.#child = null;
@@ -457,7 +477,12 @@ export class RendererHost {
     } else if (message.type === "lifecycle" && LIFECYCLE_NAMES.has(message.name) && Number.isInteger(message.generation)) {
       this.#onLifecycle?.(message.name, message.generation);
     } else if (message.type === "cookie" && typeof message.value === "string" && message.value.length <= 4096) {
-      this.#network.setDocumentCookie(this.#documentUrl, message.value);
+      const url = typeof message.url === "string" ? message.url : this.#documentUrl;
+      if (sameOrigin(url, this.#documentUrl)) this.#network.setDocumentCookie(url, message.value);
+      if (Number.isSafeInteger(message.sequence) && message.sequence > this.#cookieSequence) {
+        this.#cookieSequence = message.sequence;
+      }
+      child.send({ type: "cookie-state", state: this.#cookieState() });
     } else if (message.type === "navigate" && typeof message.url === "string") {
       // A page asked to navigate (location.href = ...): validate before obeying.
       let target;
@@ -652,7 +677,7 @@ export class RendererHost {
                 url: event.url || target.href,
                 contentType: event.contentType ?? "",
                 contentLength: event.contentLength ?? null,
-                documentCookie: this.#network.documentCookie(this.#documentUrl),
+                documentCookie: this.#network.documentCookie(this.#documentUrl), cookieState: this.#cookieState(),
               },
             });
           } else if (event.type === "chunk" && event.data instanceof Uint8Array) {
@@ -683,7 +708,7 @@ export class RendererHost {
           url: response.url || target.href,
           contentType: response.contentType,
           body: response.body,
-          documentCookie: this.#network.documentCookie(this.#documentUrl),
+          documentCookie: this.#network.documentCookie(this.#documentUrl), cookieState: this.#cookieState(),
         },
       });
     } catch (error) {
@@ -711,7 +736,7 @@ export class RendererHost {
           if (event.type === "head") {
             streamHead = true;
             child.send({ type: "page-fetch-head", id, result: {
-              ...event.result, documentCookie: this.#network.documentCookie(this.#documentUrl),
+              ...event.result, documentCookie: this.#network.documentCookie(this.#documentUrl), cookieState: this.#cookieState(),
             } });
           }
           else if (event.type === "chunk") child.send({ type: "page-fetch-chunk", id, data: event.data });
@@ -724,7 +749,7 @@ export class RendererHost {
       }
       const { rawHeaders, ...result } = response;
       logFetch(sanitized, `${response.status} ${response.body?.byteLength ?? 0}B`, started);
-      reply({ result: { ...result, documentCookie: this.#network.documentCookie(this.#documentUrl) } });
+      reply({ result: { ...result, documentCookie: this.#network.documentCookie(this.#documentUrl), cookieState: this.#cookieState() } });
     } catch (error) {
       logFetch(sanitized ?? request, `failed: ${error?.message ?? error}`, started);
       if (streamHead && this.#child === child) {
@@ -734,6 +759,10 @@ export class RendererHost {
       if (this.#pageFetches.get(id) === entry) this.#pageFetches.delete(id);
     }
   }
+  #cookieState() {
+    return { revision: ++this.#cookieRevision, acknowledged: this.#cookieSequence,
+      cookies: this.#network.cookies.scriptSnapshot(this.#documentUrl) };
+  }
 }
 
 /** With BUNINU_LOG, one line per page fetch()/XMLHttpRequest: method, URL (shortened), outcome, time. */