peachsim 0.1.1641 → 0.1.1653

package/cli/drivers/playwright-sim-host.ts

@@ -1,825 +0,0 @@
-import {
-  acquireChromiumAdmission,
-  readChromiumQueue,
-} from '../../../../scripts/lib/chromium-admission'
-// the detached browser host, as CJS source.
-//
-// it resolves playwright from the absolute path the driver hands it, launches
-// Chrome for Testing, opens the target url, then keeps itself (and therefore
-// the browser) alive until the page asks it to close (`peach close`, or the
-// bridge reclaiming an idle sim for a queued chromium launch),
-// the browser disconnects, or its owning session exits. all inputs arrive
-// through the environment.
-//
-// it stays a source string rather than a module of its own: playwright is
-// resolved from the user's project at runtime and is not a dependency here, so
-// there are no types for any of this, and a typed rewrite would be `unknown`
-// casts end to end. cli/internal-child.ts runs it through node:vm with a real
-// require, in a child process the CLI spawns as itself.
-import {
-  chromeDisabledFeaturesSwitch,
-  LINUX_CHROME_SCOPE_ENV,
-  softwareChromeLaunchOptions,
-} from '../../../../scripts/lib/reap-browser'
-import { createBrowserPageTargetReader } from '../../../peach-engine/src/browser-page-target'
-import { captureBrowserAccessibility } from '../../../peach-engine/src/capture/browser-accessibility-host'
-import {
-  readBrowserCompositeCaptureRequest,
-  resolveBrowserCompositeCdpClip,
-} from '../../../peach-engine/src/capture/browser-composite'
-import { WEBVIEW_HOST_BOOTSTRAP_SOURCE } from '../../../peach-engine/src/components/native-ui/webview-frame-bridge'
-import { createBrowserPointerDispatcher } from '../../../peach-engine/src/render-worker/browser-pointer'
-import { automateWebAuthenticationSessions } from '../../../peach-engine/src/web-authentication-automation-host'
-import {
-  automateWebViewFrames,
-  WEBVIEW_HOST_BINDING,
-  WEBVIEW_INSTANCE_ATTRIBUTE,
-  WEBVIEW_SCHEME_NAVIGATION_EVENT,
-  WEBVIEW_NETWORK_NAVIGATION_EVENT,
-  WEBVIEW_LOAD_EVENT,
-  webViewAutomationHelpersSource,
-} from '../../../peach-engine/src/webview-automation-host'
-import { DISPOSABLE_BROWSER_CACHE_DIR_NAMES } from '../../src/browser-cache'
-import { listProcessChildren } from '../../src/process-group'
-
-// a person's tap on the device canvas is a trusted input, which gives the page
-// the user activation browsers require before media plays with sound, and an
-// AVAudioPlayer started from that tap sounds. the driver's taps are dispatched
-// inside the page and never activate it, so without this an app's play() is
-// refused where the same tap by a person plays (RAN:
-// scripts/debug/audiotap-probe.ts). ios needs no gesture for audio at all.
-// every proof that drives media in chromium launches with this one policy.
-export const DRIVER_AUTOPLAY_POLICY = '--autoplay-policy=no-user-gesture-required'
-
-export const PLAYWRIGHT_SIM_HOST = `
-const modulePath = process.env.SOOTSIM_PW_MODULE;
-const executablePath = process.env.SOOTSIM_PW_EXECUTABLE;
-// the shared libraries this host lacks, from peach's bundle. only the browser
-// gets them on its library path: the bundled builds are older than the system's.
-const libraryPath = process.env.SOOTSIM_PW_LIBRARY_PATH;
-if (!executablePath) throw new Error('SOOTSIM_PW_EXECUTABLE is not set');
-const url = process.env.SOOTSIM_PW_URL;
-// the WS bridge port the sim page must register with, injected below as
-// window.__sootsimBridgePort so the page skips its shell-port heuristic (which
-// assumes the default offset and breaks when the dev bridge drifted).
-const bridgePort = process.env.SOOTSIM_PW_BRIDGE_PORT || '';
-const fetchProxySpki = process.env.PEACH_PW_FETCH_PROXY_SPKI || '';
-const headless = process.env.SOOTSIM_PW_HEADLESS === '1';
-const callerUserDataDir = process.env.SOOTSIM_PW_USERDATADIR || '';
-// pid of the session that launched us (its topmost non-init ancestor). when
-// that process exits we tear Chrome down — see startOwnerWatch below. it is a
-// required lifetime bound: an invalid value aborts before Chrome launches.
-// SOOTSIM_PW_OWNER_POLL_MS is a test-only override of the 5s poll interval;
-// production never sets it.
-const ownerPid = Number(process.env.SOOTSIM_PW_OWNER_PID || 0);
-// the open command waiting for this host to connect; it may queue for the
-// browser slot and then be killed by its own caller's budget.
-const launcherPid = Number(process.env.SOOTSIM_PW_LAUNCHER_PID || 0);
-const ownerPollMs = Number(process.env.SOOTSIM_PW_OWNER_POLL_MS || 5000);
-// optional CDP port — exposes Chrome's remote-debugging endpoint so a
-// bridge-driven sim can also be cpu-profiled (peach perf cpu --cdp-port).
-// playwright keeps its own pipe connection; the port is an additional endpoint.
-const cdpPort = process.env.SOOTSIM_PW_CDP_PORT || '';
-// the native desktop host's standalone command (a JSON array). it attaches to
-// this headless browser over CDP, composites the sim, and presents page frames
-// only when a capture asks (specs/peach-desktop-host/headless.md).
-const hostCommand = process.env.PEACH_PW_HOST_COMMAND ? JSON.parse(process.env.PEACH_PW_HOST_COMMAND) : null;
-if (hostCommand && (!headless || !cdpPort)) {
-  throw new Error('[playwright-driver] the desktop host attaches only to a headless browser with a CDP port');
-}
-// extra chromium launch args, space-separated. a linux GPU runner injects
-// '--use-angle=vulkan --enable-features=Vulkan' here so chrome binds the
-// real GPU instead of silently falling back to swiftshader software
-// rendering (which pegs cores and produces ~1fps canvas capture).
-const extraChromeArgs = (process.env.SOOTSIM_PW_CHROME_ARGS || '')
-  .split(' ')
-  .filter(Boolean);
-// A Mac always has a GPU, so a local macOS drive that lands on Playwright's
-// software renderer is a misconfiguration that pegs every core: it fails
-// closed unless the hardware-backed test browser is proven after launch. CI
-// and Linux or Windows hosts, which are often GPU-less servers, use the
-// bundled browser and render in software when no GPU is present.
-const hardwareGpuRequired =
-  process.platform === 'darwin' && process.env.CI !== '1' && process.env.CI !== 'true';
-const softwareRendererPattern = /swiftshader|software(?: rasterizer)?|llvmpipe|lavapipe|softpipe/i;
-// page viewport as '<w>x<h>'. the caller sizes it from the device profile;
-// the fallback is phone-shaped because the page hosts a phone sim — the
-// playwright default (1280x720 desktop) letterboxes the device frame.
-const viewportSpec = /^(\\d+)x(\\d+)$/.exec(process.env.SOOTSIM_PW_VIEWPORT || '');
-const viewport = viewportSpec
-  ? { width: Number(viewportSpec[1]), height: Number(viewportSpec[2]) }
-  : { width: 600, height: 900 };
-// host display pixels per css pixel; default to a retina Mac browser's 2.
-// medium renders at 2 and high at device native, independently of browser DPR.
-// low follows measured on-screen density, capped at device native.
-// SOOTSIM_PW_DSF changes browser DPR, not the selected render resolution.
-const deviceScaleFactor = Number(process.env.SOOTSIM_PW_DSF || 2);
-const closeTimeoutMs = Number(process.env.SOOTSIM_PW_CLOSE_TIMEOUT_MS || 2500);
-const connectAckFile = process.env.SOOTSIM_PW_CONNECTED_ACK_FILE || '';
-const admittedFile = process.env.SOOTSIM_PW_ADMITTED_FILE || '';
-const completionFile = process.env.PEACH_PW_COMPLETION_FILE || '';
-const disposableBrowserCacheDirs = new Set(${JSON.stringify(
-  DISPOSABLE_BROWSER_CACHE_DIR_NAMES,
-)});
-const { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } = require('fs');
-const { execSync, spawn, spawnSync } = require('child_process');
-const listProcessChildren = ${listProcessChildren.toString()};
-const { tmpdir } = require('os');
-const { join } = require('path');
-const createBrowserPointerDispatcher = ${createBrowserPointerDispatcher.toString()};
-const captureBrowserAccessibility = ${captureBrowserAccessibility.toString()};
-const automateWebViewFrames = ${automateWebViewFrames.toString()};
-const automateWebAuthenticationSessions = ${automateWebAuthenticationSessions.toString()};
-const webViewAutomationHelpers = ${webViewAutomationHelpersSource()};
-const readBrowserCompositeCaptureRequest = ${readBrowserCompositeCaptureRequest.toString()};
-const resolveBrowserCompositeCdpClip = ${resolveBrowserCompositeCdpClip.toString()};
-const acquireChromiumAdmission = ${acquireChromiumAdmission.toString()};
-const readChromiumQueue = ${readChromiumQueue.toString()};
-// chrome tree reaper — playwright's browser.close() and even SIGKILLing the
-// root chrome process do NOT reliably take down the helper tree (gpu, renderer,
-// network/storage utilities). they reparent to launchd/init and survive, each
-// one busy enough to peg CPU at 100%+. close() only reaches the root.
-//
-// the prior approach was \`pgrep -f ms-playwright/[c]hromium\`. it never matched
-// system Chrome, so the reaper was a no-op in the common case and every
-// aborted/closed \`peach open\` leaked a renderer + gpu helper burning 100%+
-// CPU until manually killed (multiple incidents 2026-06).
-//
-// a named profile can already belong to another host. its path finds browser
-// candidates; the unique launch environment proves which ones we may reap,
-// including helpers reparented after the browser root exits.
-const reapEnabled = process.platform !== 'win32';
-let profileDir = callerUserDataDir;
-let ephemeralProfile = false;
-if (!profileDir) {
-  profileDir = mkdtempSync(join(tmpdir(), 'peach-playwright-host-'));
-  ephemeralProfile = true;
-}
-// browser HTTP caches are acceleration data, not profile identity. give each
-// host a bounded temporary cache so persistent named profiles retain cookies
-// and storage without multiplying a private cache for every profile.
-const diskCacheDir = mkdtempSync(join(tmpdir(), 'peach-playwright-cache-'));
-let profileLaunched = false;
-// [pid, command line] for every process on the profile. linux reads /proc,
-// since minimal and rootless images ship no ps.
-const profileProcesses = () => {
-  if (!reapEnabled) return [];
-  try {
-    // match the whole --user-data-dir argument: a pattern search also found
-    // browsers whose profile path merely starts with this one.
-    const flag = ' --user-data-dir=' + profileDir + ' ';
-    const rows = process.platform === 'linux'
-      ? readdirSync('/proc').filter((name) => /^\\d+$/.test(name)).map((name) => {
-          let command = '';
-          // a process can exit between the listing and this read
-          try { command = readFileSync('/proc/' + name + '/cmdline', 'utf8').split('\\0').join(' ').trim(); } catch {}
-          return [Number(name), command];
-        })
-      : execSync('ps -axo pid=,command=', {
-          stdio: ['ignore', 'pipe', 'ignore'],
-          maxBuffer: Infinity,
-        })
-          .toString().split('\\n').map((line) => line.trim().match(/^(\\d+)\\s+(.*)$/))
-          .filter(Boolean).map((row) => [Number(row[1]), row[2]]);
-    return rows.filter(([pid, command]) => pid && pid !== process.pid && (' ' + command + ' ').includes(flag));
-  } catch (error) {
-    throw new Error('[playwright-driver] cannot establish browser profile ownership: ' + String(error));
-  }
-};
-const chromePidsByProfile = () => profileProcesses().map(([pid]) => pid);
-const chromeCommandsByProfile = () => profileProcesses().map(([, command]) => command);
-const assertNoUnsafeSwiftShaderFlag = () => {
-  if (!hardwareGpuRequired) return;
-  const unsafe = chromeCommandsByProfile().find((command) =>
-    command.includes('--enable-unsafe-swiftshader') ||
-    /--use-angle=(?:swiftshader|swiftshader-webgl)(?:\\s|$)/i.test(command)
-  );
-  if (unsafe) {
-    throw new Error(
-      '[playwright-driver] refused software-rendering Chrome: launched process contains a SwiftShader flag'
-    );
-  }
-};
-const killTree = (pid) => {
-  let kids = [];
-  try {
-    kids = listProcessChildren([pid]);
-  } catch {}
-  for (const k of kids) killTree(k);
-  try { process.kill(pid, 'SIGKILL'); } catch {}
-};
-const reapChrome = () => {
-  try {
-    for (const pid of chromePidsByProfile()) {
-      let owned = false;
-      if (process.platform === 'linux') {
-        try {
-          owned = readFileSync('/proc/' + pid + '/environ', 'utf8').split('\\0')
-            .includes('PEACH_PW_BROWSER_OWNER=' + diskCacheDir);
-        } catch {}
-      } else {
-        const plain = spawnSync('ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8' });
-        const withEnv = spawnSync('ps', ['eww', '-o', 'command=', '-p', String(pid)], { encoding: 'utf8' });
-        const argv = (plain.stdout || '').trimEnd();
-        const full = (withEnv.stdout || '').trimEnd();
-        owned = plain.status === 0 && withEnv.status === 0 && full.startsWith(argv) &&
-          (full.slice(argv.length) + ' ').includes(' PEACH_PW_BROWSER_OWNER=' + diskCacheDir + ' ');
-      }
-      if (owned) killTree(pid);
-    }
-  } catch (error) {
-    process.stderr.write('[playwright-driver] browser teardown refused: ' + String(error) + '\\n');
-  }
-};
-const removeDisposableCaches = (root) => {
-  let children = [];
-  try { children = readdirSync(root, { withFileTypes: true }); } catch { return; }
-  for (const child of children) {
-    if (!child.isDirectory() || child.isSymbolicLink()) continue;
-    const childPath = join(root, child.name);
-    if (disposableBrowserCacheDirs.has(child.name)) {
-      try { rmSync(childPath, { recursive: true, force: true }); } catch {}
-      continue;
-    }
-    removeDisposableCaches(childPath);
-  }
-};
-// chrome treats a SingletonLock whose recorded hostname differs from the
-// current one as held by another machine, and macOS renames the host with the
-// network, so a lock left by a killed host blocks every relaunch of a named
-// profile. no process runs this profile here, so its lock files are stale.
-const clearStaleSingletonLock = () => {
-  if (chromePidsByProfile().length > 0) return;
-  for (const name of ['SingletonLock', 'SingletonSocket', 'SingletonCookie']) {
-    try { rmSync(join(profileDir, name), { force: true }); } catch {}
-  }
-};
-const cleanupProfile = () => {
-  try { rmSync(diskCacheDir, { recursive: true, force: true }); } catch {}
-  if (ephemeralProfile) {
-    try { rmSync(profileDir, { recursive: true, force: true }); } catch {}
-    return;
-  }
-  if (profileLaunched) removeDisposableCaches(profileDir);
-};
-(async () => {
-  const pw = require(modulePath);
-  let context;
-  let keepAlive = null;
-  let connectTimer = null;
-  let connectAckPoll = null;
-  let ownerWatch = null;
-  let connected = false;
-  let shuttingDown = false;
-  let desktopHost = null;
-  // the host runs the tenant's workers in its realms, where the browser cannot see them; it
-  // evaluates there over node ipc and answers each realm's value as it settles, null where one
-  // throws. only that page's target is inspected; the first value that is not null answers,
-  // or null once no realm in that page is pending
-  const hostEvaluations = new Map();
-  let hostEvaluation = 0;
-  const readPageTarget = (${createBrowserPageTargetReader.toString()})();
-  const hostRealms = (page) => ({
-    evaluate: async (fn, args) => {
-      const targetId = await readPageTarget(page);
-      return new Promise((resolve) => {
-        const id = ++hostEvaluation;
-        hostEvaluations.set(id, resolve);
-        desktopHost.send({ t: 'evaluate', id, targetId, expression: '(' + fn + ')(' + JSON.stringify(args) + ')' });
-      });
-    },
-  });
-  const stopDesktopHost = async () => {
-    if (!desktopHost || desktopHost.exitCode !== null || desktopHost.signalCode !== null) return;
-    const exited = new Promise((resolve) => desktopHost.once('exit', resolve));
-    desktopHost.kill('SIGTERM');
-    await exited;
-  };
-  // the host's ready line follows its CDP auto-attach registration, so every
-  // page this browser opens afterwards is composited by it
-  const startDesktopHost = async () => {
-    // the persistent context's token changes on relaunch; its stores belong to the browser profile.
-    const profileSession = await context.newCDPSession(context.pages()[0]);
-    let profileContext;
-    try {
-      const { targetInfo } = await profileSession.send('Target.getTargetInfo');
-      profileContext = targetInfo.browserContextId;
-      if (!profileContext) throw new Error('[playwright-driver] persistent browser context has no identity');
-    } finally {
-      await profileSession.detach();
-    }
-    desktopHost = spawn(
-      hostCommand[0],
-      [...hostCommand.slice(1), '--port', '0', '--browser', 'http://127.0.0.1:' + cdpPort, '--headless',
-        '--profile', join(profileDir, 'peach-node'), '--profile-context', profileContext],
-      { stdio: ['ignore', 'ignore', 'pipe', 'ipc'] },
-    );
-    desktopHost.on('message', (m) => {
-      if (m.value === null && m.pending > 0) return;
-      hostEvaluations.get(m.id)?.(m.value);
-      hostEvaluations.delete(m.id);
-    });
-    let log = '';
-    const hostUrl = await new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error('[playwright-driver] desktop host did not start within 30s: ' + log)), 30000);
-      desktopHost.once('error', (error) => { clearTimeout(timer); reject(error); });
-      desktopHost.once('exit', (code) => { clearTimeout(timer); reject(new Error('[playwright-driver] desktop host exited during startup (' + code + '): ' + log)); });
-      desktopHost.stderr.on('data', (data) => {
-        process.stderr.write(data);
-        if (log.length < 65536) log += String(data);
-        const ready = /peach host on (http:\\/\\/127\\.0\\.0\\.1:\\d+\\/)/.exec(log);
-        if (ready) { clearTimeout(timer); resolve(ready[1]); }
-      });
-    });
-    desktopHost.removeAllListeners('exit');
-    desktopHost.once('exit', (code) => {
-      process.stderr.write('[playwright-driver] desktop host exited (' + code + ')\\n');
-      void shutdown(3);
-    });
-    process.stderr.write('[playwright-driver] desktop host attached on ' + hostUrl + '\\n');
-  };
-  const clearConnectTimer = () => {
-    if (connectTimer) {
-      clearTimeout(connectTimer);
-      connectTimer = null;
-    }
-    if (connectAckPoll) {
-      clearInterval(connectAckPoll);
-      connectAckPoll = null;
-    }
-  };
-  const markConnected = () => {
-    connected = true;
-    clearConnectTimer();
-  };
-  const ackFileExists = () => {
-    if (!connectAckFile) return false;
-    try { return existsSync(connectAckFile); } catch { return false; }
-  };
-  const bounded = async (label, work, timeoutMs) => {
-    let timer = null;
-    try {
-      const timeout = new Promise((resolve) => {
-        timer = setTimeout(() => resolve({ timedOut: true }), timeoutMs);
-      });
-      if (typeof timer.unref === 'function') timer.unref();
-      const result = await Promise.race([
-        Promise.resolve().then(work).then(
-          () => ({ timedOut: false }),
-          (error) => ({ timedOut: false, error }),
-        ),
-        timeout,
-      ]);
-      if (result && result.timedOut) {
-        process.stderr.write('[shutdown-timeout] ' + label + ' exceeded ' + timeoutMs + 'ms\\n');
-        return false;
-      }
-      if (result && result.error) {
-        process.stderr.write('[shutdown-error] ' + label + ': ' + String((result.error && result.error.message) || result.error) + '\\n');
-        return false;
-      }
-      return true;
-    } finally {
-      if (timer) clearTimeout(timer);
-    }
-  };
-  const browserProcess = () => {
-    if (context && typeof context.browser === 'function') {
-      try {
-        const b = context.browser();
-        if (b && typeof b.process === 'function') return b.process();
-      } catch {}
-    }
-    return null;
-  };
-  const processIsAlive = (proc) => {
-    if (!proc || !proc.pid) return false;
-    try {
-      process.kill(proc.pid, 0);
-      return true;
-    } catch (err) {
-      return err && err.code === 'EPERM';
-    }
-  };
-  const terminateBrowserProcess = async () => {
-    const proc = browserProcess();
-    if (!proc || !proc.pid || !processIsAlive(proc)) return;
-    try { proc.kill('SIGTERM'); } catch {}
-    await bounded('browser process exit after SIGTERM', async () => {
-      while (processIsAlive(proc)) {
-        await new Promise((resolve) => setTimeout(resolve, 50));
-      }
-    }, 600);
-    if (!processIsAlive(proc)) return;
-    try { proc.kill('SIGKILL'); } catch {}
-  };
-  const shutdown = async (code = 0) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    clearConnectTimer();
-    if (keepAlive) clearInterval(keepAlive);
-    if (ownerWatch) clearInterval(ownerWatch);
-    const timeoutMs = Number.isFinite(closeTimeoutMs) && closeTimeoutMs > 0 ? closeTimeoutMs : 2500;
-    if (desktopHost) desktopHost.removeAllListeners('exit');
-    await bounded('desktop host stop', stopDesktopHost, timeoutMs);
-    if (context) await bounded('context.close', () => context.close(), timeoutMs);
-    await terminateBrowserProcess();
-    // close() can leave reparented helpers; reap only this launch's browser
-    // and helpers, even if another host now uses the same named profile.
-    reapChrome();
-    cleanupProfile();
-    if (connectAckFile) {
-      try { unlinkSync(connectAckFile); } catch {}
-    }
-    if (admittedFile) {
-      try { unlinkSync(admittedFile); } catch {}
-    }
-    process.exit(code);
-  };
-  process.once('SIGTERM', () => { void shutdown(0); });
-  process.once('SIGINT', () => { void shutdown(0); });
-  // the launch-failure path at the bottom of this script exits without going
-  // through shutdown(); the exit hook (sync sweep) still reaps the tree.
-  process.on('exit', (code) => {
-    if (desktopHost && desktopHost.exitCode === null) desktopHost.kill('SIGKILL');
-    reapChrome();
-    cleanupProfile();
-    if (completionFile) {
-      try {
-        writeFileSync(completionFile, JSON.stringify({ code, pid: process.pid, completedAt: Date.now() }) + '\\n');
-      } catch (error) {
-        process.stderr.write('[completion-error] ' + String(error) + '\\n');
-      }
-    }
-  });
-  // owner-liveness watchdog — the load-bearing fix for leaked Chrome hosts.
-  // we are spawned detached + unref'd so \`peach open\` returns immediately,
-  // which means nothing in the OS process tree ties Chrome's lifetime to the
-  // session that asked for it. once the sim connects, the connect-timeout
-  // safety net is cleared, so absent an explicit \`peach close\` (or the
-  // daemon's idle reaper closing the sim socket) the host would hold Chrome
-  // open forever after its owner exits. poll the owning session's pid and tear
-  // down when it's gone. ESRCH (kill throws) = owner exited; EPERM = alive but
-  // not signalable by us, which still counts as alive.
-  const startOwnerWatch = () => {
-    if (!Number.isInteger(ownerPid) || ownerPid < 1) {
-      throw new Error('[playwright-driver] missing valid owning process; refusing unsupervised browser host');
-    }
-    const intervalMs = Number.isFinite(ownerPollMs) && ownerPollMs > 0 ? ownerPollMs : 5000;
-    const gone = (pid) => {
-      try {
-        process.kill(pid, 0);
-        return false;
-      } catch (err) {
-        return !(err && err.code === 'EPERM');
-      }
-    };
-    ownerWatch = setInterval(() => {
-      if (gone(ownerPid)) {
-        process.stderr.write('[owner-gone] owning process ' + ownerPid + ' exited; closing playwright host\\n');
-        void shutdown(0);
-        return;
-      }
-      // until the sim connects, the open command is the only one waiting for
-      // it; once that command is gone nobody receives the sim.
-      if (!connected && !ackFileExists() && Number.isInteger(launcherPid) && launcherPid > 1 && gone(launcherPid)) {
-        process.stderr.write('[launcher-gone] open command ' + launcherPid + ' exited before the sim connected; closing playwright host\\n');
-        void shutdown(2);
-      }
-    }, intervalMs);
-    if (typeof ownerWatch.unref === 'function') ownerWatch.unref();
-  };
-  startOwnerWatch();
-  // Local rendering uses Playwright's full Chrome for Testing app. On macOS its
-  // com.google.chrome.for.testing identity cannot intercept open/quit events for
-  // the user's com.google.Chrome browser. CI and non-Mac hosts use
-  // chromium_headless_shell; local Mac rendering fails closed because that
-  // shell has no GPU and silently chooses SwiftShader. NOTE: this is NOT enough to make \`peach perf cpu\`
-  // work — that profiles the tenant *worker*, and the JS Self-Profiler API
-  // cannot be constructed in a dedicated worker (see
-  // worker-handlers/cpu-profile.ts). cpu-profile needs a CDP-based profiler
-  // instead.
-  if (
-    hardwareGpuRequired &&
-    extraChromeArgs.some((arg) =>
-      arg === '--enable-unsafe-swiftshader' ||
-      /^--use-angle=(?:swiftshader|swiftshader-webgl)$/i.test(arg)
-    )
-  ) {
-    throw new Error('[playwright-driver] refused SwiftShader launch arguments');
-  }
-  // one browser path per environment: the full, separately identified test app
-  // on a local Mac; the bundled chromium everywhere else. never launch a
-  // branded user browser.
-  const channelsToTry = hardwareGpuRequired ? ['chromium'] : [null];
-  const launchWith = async (channel) => {
-    const opts = channel
-      ? { headless, channel, viewport, deviceScaleFactor }
-      : { headless, viewport, deviceScaleFactor };
-    opts.env = { ...process.env, PEACH_PW_BROWSER_OWNER: diskCacheDir };
-    opts.executablePath = executablePath;
-    if (libraryPath) {
-      opts.env = {
-        ...opts.env,
-        LD_LIBRARY_PATH: [libraryPath, process.env.LD_LIBRARY_PATH].filter(Boolean).join(':'),
-      };
-    }
-    // keep the browser main process with its children in the caller's cgroup.
-    // otherwise chromium moves only main into a systemd app scope over dbus.
-    if (process.platform === 'linux') {
-      opts.env = { ...process.env, ...opts.env, ...${JSON.stringify(LINUX_CHROME_SCOPE_ENV)} };
-    }
-    // playwright injects --force-color-profile=srgb by default, which reads
-    // visibly washed-out next to a normal chrome window on a wide-gamut mac
-    // display. strip it so driver-launched sims color-match the user's own
-    // browser (real incident 2026-07-09: "low res and whitewashed" sim).
-    opts.ignoreDefaultArgs = ['--force-color-profile=srgb'];
-    // headless chromium backgrounds/occludes the renderer and throttles rAF +
-    // timers to ~1fps, which silently starves combined/video frame capture
-    // (was 47 frames over 63s -> frozen-looking mp4). keep the render loop at
-    // full rate so the recorder captures real motion. document.hidden stays
-    // false in headless, so assertTabVisibleForCapture never caught this — it
-    // has to be fixed at the launch flags.
-    opts.args = [
-      '--disk-cache-dir=' + diskCacheDir,
-      '--disk-cache-size=67108864',
-      '--disable-background-timer-throttling',
-      '--disable-backgrounding-occluded-windows',
-      '--disable-renderer-backgrounding',
-      ${JSON.stringify(DRIVER_AUTOPLAY_POLICY)},
-    ];
-    if (channel) {
-      // the full test browser can bind the real platform GPU — force the native
-      // ANGLE backend and strip playwright's --enable-unsafe-swiftshader
-      // default arg. without both, headless chrome silently falls back to
-      // swiftshader software rendering for the CanvasKit/WebGL canvas and
-      // pegs every core. SOOTSIM_PW_CHROME_ARGS is appended later, so an
-      // env-injected --use-angle=... still overrides (last flag wins).
-      const angle = process.platform === 'darwin' ? 'metal'
-        : process.platform === 'linux' ? 'vulkan' : 'default';
-      opts.args.unshift(
-        '--use-angle=' + angle,
-        '--enable-gpu',
-        '--enable-gpu-rasterization',
-        '--enable-zero-copy',
-        '--ignore-gpu-blocklist',
-        '--enable-unsafe-webgpu',
-      );
-      opts.ignoreDefaultArgs.push('--enable-unsafe-swiftshader');
-    } else if (hostCommand) {
-      // the attached desktop host draws every surface on its own device, so the
-      // page composites only dom and the frames a capture presents: chromium's
-      // software compositor does that without a gpu process emulated on the cpu
-      opts.args.push('--disable-gpu');
-    } else {
-      // the shared software launch owns the webgpu canvas backing and watchdog
-      // flags too; an adapter alone does not prove a canvas can present.
-      opts.args.push(...${JSON.stringify(softwareChromeLaunchOptions({}).args)});
-    }
-    opts.args.push(${JSON.stringify(chromeDisabledFeaturesSwitch())});
-    if (fetchProxySpki) opts.args.push('--ignore-certificate-errors-spki-list=' + fetchProxySpki);
-    if (cdpPort) opts.args.push('--remote-debugging-port=' + cdpPort);
-    if (extraChromeArgs.length) opts.args.push(...extraChromeArgs);
-    // headed: size the OS window to the (phone-shaped) viewport too, plus
-    // room for chrome's own toolbar, so the window isn't desktop-shaped
-    // around a letterboxed page.
-    if (!headless) opts.args.push('--window-size=' + viewport.width + ',' + (viewport.height + 88));
-    const launched = await pw.chromium.launchPersistentContext(profileDir, opts);
-    profileLaunched = true;
-    return launched;
-  };
-  // the host-wide chromium slot is held for this host's life; its exit frees it
-  await acquireChromiumAdmission({
-    fs: require('fs'),
-    os: require('os'),
-    path: require('path'),
-    childProcess: require('child_process'),
-    label: 'peach sim host ' + profileDir,
-    readQueue: readChromiumQueue,
-  });
-  // the launcher's connect wait starts here: time queued for the slot is not
-  // time the sim had to connect.
-  if (admittedFile) {
-    try { writeFileSync(admittedFile, JSON.stringify({ admittedAt: Date.now(), pid: process.pid }) + '\\n'); } catch {}
-  }
-  clearStaleSingletonLock();
-  let launchErr = null;
-  let launchedChannel = null;
-  for (const channel of channelsToTry) {
-    try {
-      context = await launchWith(channel);
-      launchedChannel = channel || 'chromium';
-      launchErr = null;
-      break;
-    } catch (err) {
-      launchErr = err;
-      const msg = err && err.message ? String(err.message) : '';
-      const isMissingChannel =
-        /not found at/i.test(msg) ||
-        /not installed/i.test(msg) ||
-        /Chromium distribution/i.test(msg);
-      if (!isMissingChannel) throw err; // unexpected failure: bubble up
-      if (channel) {
-        const next = hardwareGpuRequired
-          ? '; bundled Chromium is disabled for local GPU work\\n'
-          : ', falling back to bundled chromium\\n';
-        process.stderr.write('[playwright-driver] channel "' + channel + '" not available' + next);
-      }
-    }
-  }
-  if (launchErr) throw launchErr;
-  if (launchedChannel) {
-    process.stderr.write('[playwright-driver] launched ' + launchedChannel + '\\n');
-  }
-  if (hostCommand) await startDesktopHost();
-  // grant camera up front so the sim's Camera app reaches the host webcam
-  // through getUserMedia, mirroring a real iOS simulator where the camera just
-  // works. without this the unhandled chrome permission prompt auto-denies and
-  // CameraApp renders its "Camera Access Required" placeholder.
-  // location does NOT follow the same rule: a real iOS simulator never reads
-  // the host Mac's real position, it reports a simulated device location
-  // (simctl location / engine/geolocation-source.ts). granting chrome's
-  // geolocation here would leak the operator's real position into the tenant
-  // and its backend, so host-service-main.ts never reaches navigator.geolocation.
-  await context.grantPermissions(['camera']);
-  const hostMeta = {
-    sootsimHostDriver: 'playwright',
-    peachRenderer: hostCommand ? 'native' : 'chromium',
-    peachHostExecutable: hostCommand ? hostCommand[0] : null,
-    sootsimHostPid: process.pid,
-    sootsimHostOwnerPid: ownerPid,
-    sootsimHostStartedAt: Date.now(),
-  };
-  // inject the resolved bridge port (numeric literal) BEFORE the page runs, so
-  // the shell/engine talk to the daemon this driver owns. addInitScript runs
-  // ahead of every page script, and the vite dev plugin only fills the value in
-  // when it is still unset, so this one wins. plain assignment, NOT
-  // defineProperty: other injectors also assign to it, and a non-writable
-  // property would throw at that assignment and crash boot.
-  const bridgePortInject = bridgePort
-    ? 'window.__sootsimBridgePort = ' + Number(bridgePort) + ';'
-    : '';
-  await context.addInitScript({
-    content: 'Object.defineProperty(window, "__sootsimHostMeta", { value: ' + JSON.stringify(hostMeta) + ', configurable: true });' + bridgePortInject,
-  });
-  // react-native-webview's frames: the bridge at document start of every
-  // document, CSP-proof injection, source.headers, no framing refusals and
-  // app-scheme navigations, as a WKWebView gives its page.
-  const webViewTimingName = 'peachwv' + require('crypto').randomBytes(12).toString('hex');
-  await automateWebViewFrames(
-    context,
-    {
-      hostBinding: ${JSON.stringify(WEBVIEW_HOST_BINDING)},
-      instanceAttribute: ${JSON.stringify(WEBVIEW_INSTANCE_ATTRIBUTE)},
-      schemeNavigationEvent: ${JSON.stringify(WEBVIEW_SCHEME_NAVIGATION_EVENT)},
-      networkNavigationEvent: ${JSON.stringify(WEBVIEW_NETWORK_NAVIGATION_EVENT)},
-      loadEvent: ${JSON.stringify(WEBVIEW_LOAD_EVENT)},
-      configTimingName: webViewTimingName,
-      bootstrapSource: '(' + ${JSON.stringify(WEBVIEW_HOST_BOOTSTRAP_SOURCE)} + ')(' + JSON.stringify(webViewTimingName) + ');',
-    },
-    webViewAutomationHelpers,
-    hostCommand ? (page) => [hostRealms(page)] : (page) => page.workers(),
-  );
-  await context.exposeBinding('__sootsimHostClose', async () => {
-    await shutdown(0);
-  });
-  const pointerHosts = new WeakMap();
-  await context.exposeBinding('__peachHostAccessibility', (source, instanceIds) =>
-    captureBrowserAccessibility(source.page, instanceIds));
-  await context.exposeBinding('__sootsimHostPointer', async (source, value) => {
-    let pending = pointerHosts.get(source.page);
-    if (!pending) {
-      pending = source.page.context().newCDPSession(source.page).then(session =>
-        createBrowserPointerDispatcher((method, params) => session.send(method, params)));
-      pointerHosts.set(source.page, pending);
-    }
-    await (await pending)(value);
-  });
-  await context.exposeBinding('__sootsimHostCapture', async (source, value) => {
-    const request = readBrowserCompositeCaptureRequest(value);
-    // a headless desktop host presents page frames only for a capture
-    if (desktopHost) await source.page.evaluate(() => window.__peachNative.prepareCapture());
-    const session = await source.page.context().newCDPSession(source.page);
-    try {
-      const { clip, originX, originY } = resolveBrowserCompositeCdpClip(
-        request,
-        await session.send('Page.getLayoutMetrics'),
-      );
-      const result = await session.send('Page.captureScreenshot', {
-        format: 'png',
-        fromSurface: true,
-        captureBeyondViewport: true,
-        clip,
-      });
-      return { dataUrl: 'data:image/png;base64,' + result.data, originX, originY };
-    } finally {
-      await session.detach();
-    }
-  });
-  const connectTimeoutMs = Number(process.env.SOOTSIM_PW_CONNECT_TIMEOUT_MS || 120000);
-  if (connectAckFile) {
-    connectAckPoll = setInterval(() => {
-      if (ackFileExists()) markConnected();
-    }, 500);
-    if (typeof connectAckPoll.unref === 'function') connectAckPoll.unref();
-  }
-  connectTimer = setTimeout(() => {
-    if (ackFileExists()) {
-      markConnected();
-      return;
-    }
-    if (connected) return;
-    process.stderr.write('[connect-timeout] sim did not register with the bridge within ' + connectTimeoutMs + 'ms; closing playwright host\\n');
-    void shutdown(2);
-  }, Number.isFinite(connectTimeoutMs) && connectTimeoutMs > 0 ? connectTimeoutMs : 120000);
-  if (typeof connectTimer.unref === 'function') connectTimer.unref();
-  const page = await context.newPage();
-  await automateWebAuthenticationSessions(context, '__peachWebAuthenticationHost', page, !headless);
-  if (hardwareGpuRequired) {
-    assertNoUnsafeSwiftShaderFlag();
-    const gpu = await page.evaluate(() => {
-      const canvas = document.createElement('canvas');
-      const gl =
-        canvas.getContext('webgl2', { powerPreference: 'high-performance' }) ||
-        canvas.getContext('webgl', { powerPreference: 'high-performance' });
-      if (!gl) return { renderer: null, vendor: null };
-      const info = gl.getExtension('WEBGL_debug_renderer_info');
-      return {
-        renderer: info ? String(gl.getParameter(info.UNMASKED_RENDERER_WEBGL)) : null,
-        vendor: info ? String(gl.getParameter(info.UNMASKED_VENDOR_WEBGL)) : null,
-      };
-    });
-    if (!gpu.renderer) {
-      throw new Error(
-        '[playwright-driver] could not prove a hardware WebGL renderer; refusing local render-heavy launch'
-      );
-    }
-    if (softwareRendererPattern.test(gpu.renderer)) {
-      throw new Error('[playwright-driver] refused software WebGL renderer: ' + gpu.renderer);
-    }
-    assertNoUnsafeSwiftShaderFlag();
-    process.stderr.write(
-      '[playwright-driver] hardware WebGL renderer: ' + gpu.renderer +
-      (gpu.vendor ? ' (' + gpu.vendor + ')' : '') + '\\n'
-    );
-  }
-  // surface page-side failures (engine boot crash, failed WS registration)
-  // to stderr so a sim that never connects produces a real diagnostic
-  // instead of a silent "timed out waiting for opened sim to connect".
-  page.on('pageerror', (e) => {
-    process.stderr.write('[pageerror] ' + ((e && e.stack) || e) + '\\n');
-  });
-  page.on('console', (m) => {
-    if (m.type() === 'error') {
-      process.stderr.write('[console.error] ' + m.text() + '\\n');
-      if (hostCommand && m.text().includes('[compositor] worker lost:')) void shutdown(1);
-    }
-  });
-  // a crashed renderer never runs the page's bridge close path, so nothing
-  // would ever close this host.
-  page.on('crash', () => {
-    process.stderr.write('[page] renderer crashed; closing playwright host\\n');
-    void shutdown(1);
-  });
-  try {
-    await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 60000 });
-  } catch (err) {
-    const message = String((err && err.message) || err);
-    process.stderr.write('[goto] ' + message + '\\n');
-    // nothing serves this url: the page is a dead error document that can
-    // never register, and nothing re-navigates — waiting out the connect
-    // timeout burns 125s proving it (peach test on an unserved shell). exit
-    // now so the caller fails fast. a goto TIMEOUT keeps waiting (a
-    // slow-but-alive server may still finish loading the page); only
-    // connection-level failures, where no server exists at all, are fatal.
-    if (/ERR_CONNECTION_REFUSED|ERR_ADDRESS_UNREACHABLE|ERR_NAME_NOT_RESOLVED/.test(message)) {
-      process.stderr.write('[unserved] nothing serves ' + url + '; closing playwright host\\n');
-      void shutdown(3);
-    }
-  }
-  keepAlive = setInterval(() => {}, 1 << 30);
-  // browser disconnect (e.g. user killed chrome from outside) → tear down.
-  // we are persistent-only now, so .browser() is the only handle to it.
-  try {
-    const b = context.browser && context.browser();
-    if (b && typeof b.on === 'function') b.on('disconnected', () => { void shutdown(0); });
-  } catch {}
-  context.on('close', () => { void shutdown(0); });
-  page.on('close', () => { void shutdown(0); });
-})().catch((err) => {
-  const detail = String((err && err.stack) || err);
-  process.stderr.write(detail + '\\n');
-  // chrome's own error ("Missing X server") says what is wrong on a linux
-  // box with no display, not what to do about it.
-  if (
-    process.platform === 'linux' &&
-    !headless &&
-    !process.env.DISPLAY &&
-    !process.env.WAYLAND_DISPLAY &&
-    /missing x server|cannot open display|x server|x11/i.test(detail)
-  ) {
-    process.stderr.write('hint: linux without DISPLAY/WAYLAND_DISPLAY — rerun without --headed (or add --headless) to run playwright headless.\\n');
-  }
-  process.exit(1);
-});
-`