rea-agents 3.1.0 → 3.2.0

package/dist/browser/CdpElectronWorkers.js

@@ -1,8 +1,8 @@
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { boundedText, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { recordValue, recordsValue, stringValue } from "./CdpCaptureValues.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
-/** Inventory root-confined worker targets without attaching to them. */
+/** Inventory local worker targets without attaching to them. */
 export const captureElectronWorkers = async (input) => {
     const result = await optionalCdpCommand({
         connection: input.connection,
@@ -25,15 +25,11 @@ export const captureElectronWorkers = async (input) => {
             input.completeness.exclude("workers", "out_of_target_scope");
             continue;
         }
-        const path = await authorizedElectronFile(stringValue(target.url) ?? "", input.roots);
+        const path = await authorizedElectronFile(stringValue(target.url) ?? "");
         if (path === undefined) {
             input.completeness.exclude("workers", "out_of_target_scope");
             continue;
         }
-        if (workers.length >= input.request.limits.max_workers) {
-            input.completeness.truncate("workers");
-            continue;
-        }
         const targetId = boundedTargetField(target.targetId);
         if (targetId === null) {
             input.completeness.exclude("workers", "invalid_protocol_value");
@@ -41,7 +37,7 @@ export const captureElectronWorkers = async (input) => {
         }
         workers.push({
             target_id: targetId,
-            type: type.slice(0, 100),
+            type,
             file_path: path,
             attached: target.attached === true,
             opener_target_id: openerTargetId,
@@ -51,6 +47,6 @@ export const captureElectronWorkers = async (input) => {
     return workers.sort((left, right) => left.target_id.localeCompare(right.target_id));
 };
 const boundedTargetField = (value) => {
-    const field = boundedText(value, 256);
-    return field === null || field === "" ? null : field;
+    const field = stringValue(value);
+    return field === undefined || field === "" ? null : field;
 };

package/dist/browser/CdpEndpoint.js

@@ -1,31 +1,28 @@
 import { request } from "node:http";
 import { z } from "zod";
-import { AnalysisCancelledError, AnalysisError, AnalysisTimeoutError, BrowserObservationError, } from "../domain/errors.js";
+import { AnalysisCancelledError, AnalysisError, BrowserObservationError, } from "../domain/errors.js";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
-const HTTP_TIMEOUT_MS = 5_000;
-const MAX_VERSION_BYTES = 64 * 1_024;
-const MAX_TARGET_LIST_BYTES = 2 * 1_024 * 1_024;
 const endpointVersionSchema = z.object({
-    Browser: z.string().min(1).max(1_024),
-    "Protocol-Version": z.string().min(1).max(100),
-    "User-Agent": z.string().max(16_384),
-    "V8-Version": z.string().max(1_024),
-    "WebKit-Version": z.string().max(1_024),
-    webSocketDebuggerUrl: z.string().min(1).max(2_048),
+    Browser: z.string().min(1),
+    "Protocol-Version": z.string().min(1),
+    "User-Agent": z.string(),
+    "V8-Version": z.string(),
+    "WebKit-Version": z.string(),
+    webSocketDebuggerUrl: z.string().min(1),
 });
 const endpointTargetSchema = z.object({
-    id: z.string().min(1).max(256),
-    type: z.string().min(1).max(100),
-    title: z.string().max(16_384).default(""),
-    url: z.string().max(65_536),
+    id: z.string().min(1),
+    type: z.string().min(1),
+    title: z.string().default(""),
+    url: z.string(),
     attached: z.boolean().default(false),
-    webSocketDebuggerUrl: z.string().min(1).max(2_048).optional(),
+    webSocketDebuggerUrl: z.string().min(1).optional(),
 });
-const endpointTargetsSchema = z.array(endpointTargetSchema).max(1_000);
-/** Read bounded CDP discovery endpoints without following redirects. */
+const endpointTargetsSchema = z.array(endpointTargetSchema);
+/** Read CDP discovery endpoints without following redirects. */
 export const discoverCdpEndpoint = async (endpoint, operation, signal) => {
-    const versionInput = await readBoundedCdpJson(new URL("/json/version", endpoint), MAX_VERSION_BYTES, operation, signal);
-    const targetsInput = await readBoundedCdpJson(new URL("/json/list", endpoint), MAX_TARGET_LIST_BYTES, operation, signal);
+    const versionInput = await readCdpJson(new URL("/json/version", endpoint), operation, signal);
+    const targetsInput = await readCdpJson(new URL("/json/list", endpoint), operation, signal);
     const version = parseCdpEndpointValue(endpointVersionSchema, versionInput, operation);
     const targets = parseCdpEndpointValue(endpointTargetsSchema, targetsInput, operation);
     return {
@@ -56,7 +53,7 @@ const sanitizeTargetTitle = (value, targetUrl) => {
         return sanitizeTargetUrlAlias(value, targetUrl);
     }
     return url.protocol === "http:" || url.protocol === "https:"
-        ? sanitizeBrowserUrl(value).url.slice(0, 16_384)
+        ? sanitizeBrowserUrl(value).url
         : sanitizeTargetUrlAlias(value, targetUrl);
 };
 const sanitizeTargetUrlAlias = (value, targetUrl) => {
@@ -71,9 +68,7 @@ const sanitizeTargetUrlAlias = (value, targetUrl) => {
     if (parsed.pathname !== "/")
         markers.push(parsed.pathname);
     const candidatePattern = new RegExp(`(?:${markers.map(escapeRegExp).join("|")})[^\\s<>"']*`, "gu");
-    return value
-        .replace(candidatePattern, (candidate) => sanitizeSameOriginTitleUrl(candidate, parsed))
-        .slice(0, 16_384);
+    return value.replace(candidatePattern, (candidate) => sanitizeSameOriginTitleUrl(candidate, parsed));
 };
 const sanitizeSameOriginTitleUrl = (candidate, target) => {
     let parsed;
@@ -145,19 +140,17 @@ const safeCdpWebSocketEndpoint = (endpoint, reported, operation) => {
         : { scope: "page", targetId: path.targetId, url: parsed.href };
 };
 const cdpWebSocketPath = (pathname) => {
-    const browserId = pathIdentifier(pathname, "/devtools/browser/", 1_024);
+    const browserId = pathIdentifier(pathname, "/devtools/browser/");
     if (browserId !== undefined)
         return { scope: "browser" };
-    const targetId = pathIdentifier(pathname, "/devtools/page/", 256);
+    const targetId = pathIdentifier(pathname, "/devtools/page/");
     return targetId === undefined ? undefined : { scope: "page", targetId };
 };
-const pathIdentifier = (pathname, prefix, maximumLength) => {
+const pathIdentifier = (pathname, prefix) => {
     if (!pathname.startsWith(prefix))
         return undefined;
     const identifier = pathname.slice(prefix.length);
-    return identifier.length > 0 &&
-        identifier.length <= maximumLength &&
-        !identifier.includes("/")
+    return identifier.length > 0 && !identifier.includes("/")
         ? identifier
         : undefined;
 };
@@ -174,8 +167,8 @@ const targetWebSocket = (endpoint, target, operation) => {
         return {};
     }
 };
-/** Read one bounded loopback CDP discovery document without redirects. */
-export const readBoundedCdpJson = async (url, maximumBytes, operation, signal) => await new Promise((resolve, reject) => {
+/** Read one loopback CDP discovery document without redirects. */
+export const readCdpJson = async (url, operation, signal) => await new Promise((resolve, reject) => {
     if (signal?.aborted === true) {
         reject(new AnalysisCancelledError(operation));
         return;
@@ -187,15 +180,7 @@ export const readBoundedCdpJson = async (url, maximumBytes, operation, signal) =
             return;
         }
         const chunks = [];
-        let bytes = 0;
-        response.on("data", (chunk) => {
-            bytes += chunk.length;
-            if (bytes > maximumBytes) {
-                response.destroy(new BrowserObservationError(operation, "payload_limit"));
-                return;
-            }
-            chunks.push(chunk);
-        });
+        response.on("data", (chunk) => chunks.push(chunk));
         response.on("end", () => {
             try {
                 resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
@@ -206,7 +191,6 @@ export const readBoundedCdpJson = async (url, maximumBytes, operation, signal) =
         });
         response.on("error", (cause) => reject(endpointFailure(cause, operation, signal)));
     });
-    request_.setTimeout(HTTP_TIMEOUT_MS, () => request_.destroy(new AnalysisTimeoutError(operation, HTTP_TIMEOUT_MS)));
     request_.on("error", (cause) => reject(endpointFailure(cause, operation, signal)));
     request_.end();
 });

package/dist/browser/CdpObservationSession.js

@@ -1,17 +1,24 @@
 import { AnalysisCancelledError, BrowserObservationError, } from "../domain/errors.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { allowedSanitizedUrl, delayWithCancellation, isHttpUrl, numberValue, recordValue, stringValue, } from "./CdpCaptureValues.js";
+import { authorizedMainFrame } from "./CdpAuthorizedMainFrame.js";
+import { allowedSanitizedUrl, isHttpUrl, numberValue, recordValue, stringValue, } from "./CdpCaptureValues.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 /** Observe external user actions without rejecting approved same-origin navigation. */
 export const observeCdpSession = async (context) => {
     const allowedOrigins = new Set(context.input.allowed_origins);
-    const initial = await authorizedFrame(context, allowedOrigins);
+    const initial = await authorizedMainFrame({
+        connection: context.connection,
+        sessionId: context.sessionId,
+        signal: context.signal,
+        allowedOrigins,
+        delayOperation: "observe_web_session",
+    });
     const initialUrl = mainFrameUrl(initial) ?? "";
     const mainFrameId = frameId(initial);
     if (mainFrameId === undefined)
         throw new BrowserObservationError("inspect_web_page", "protocol_error");
-    const capture = new TimelineCapture(context.input.max_timeline_events, allowedOrigins, mainFrameId, initialUrl);
+    const capture = new TimelineCapture(allowedOrigins, mainFrameId, initialUrl);
     const removeListener = context.connection.onEvent((event) => {
         if (observationEventMatches(event, context.sessionId))
             capture.ingest(event);
@@ -19,7 +26,7 @@ export const observeCdpSession = async (context) => {
     const removeDisconnectListener = context.connection.onDisconnect(() => capture.targetTerminated());
     try {
         await context.connection.send("Page.enable", {}, context.sessionId, context.signal);
-        await context.connection.send("Network.enable", { maxTotalBufferSize: 1_024 * 1_024 }, context.sessionId, context.signal);
+        await context.connection.send("Network.enable", {}, context.sessionId, context.signal);
         await context.connection.send("Page.setLifecycleEventsEnabled", { enabled: true }, context.sessionId, context.signal);
         const armedAt = new Date().toISOString();
         await context.progress?.report({
@@ -39,7 +46,6 @@ export const observeCdpSession = async (context) => {
             terminal: true,
         });
         return {
-            schema_version: 1,
             browser: context.discovery.version,
             target: {
                 target_id: context.target.id,
@@ -67,7 +73,6 @@ export const observeCdpSession = async (context) => {
     }
 };
 class TimelineCapture {
-    maximum;
     allowedOrigins;
     mainFrameId;
     timeline = [];
@@ -77,8 +82,7 @@ class TimelineCapture {
     #pendingReload = false;
     #endReason;
     #listeners = new Set();
-    constructor(maximum, allowedOrigins, mainFrameId, initialUrl) {
-        this.maximum = maximum;
+    constructor(allowedOrigins, mainFrameId, initialUrl) {
         this.allowedOrigins = allowedOrigins;
         this.mainFrameId = mainFrameId;
         this.finalUrl =
@@ -246,10 +250,6 @@ class TimelineCapture {
     #add(options) {
         const { type, params, rawUrl = null, requestId = null, detail = null, } = options;
         const destination = rawUrl == null ? null : scopedUrl(rawUrl, this.allowedOrigins);
-        if (this.timeline.length >= this.maximum) {
-            this.completeness.drop("timeline_events");
-            return;
-        }
         this.#sequence += 1;
         this.timeline.push({
             sequence: this.#sequence,
@@ -257,7 +257,7 @@ class TimelineCapture {
             timestamp: Math.max(0, numberValue(params.timestamp) ?? 0),
             frame_id: boundedId(params.frameId),
             loader_id: boundedId(params.loaderId),
-            request_id: requestId?.slice(0, 256) ?? null,
+            request_id: requestId ?? null,
             url: destination?.scope === "approved" ? destination.url : null,
             destination_scope: destination?.scope ?? null,
             detail,
@@ -296,18 +296,6 @@ const waitForWindow = async (durationMs, capture, signal) => await new Promise((
     if (signal?.aborted === true)
         onAbort();
 });
-const authorizedFrame = async (context, allowedOrigins) => {
-    for (let attempt = 0; attempt < 80; attempt += 1) {
-        const result = await context.connection.send("Page.getFrameTree", {}, context.sessionId, context.signal);
-        const url = mainFrameUrl(result);
-        if (allowedSanitizedUrl(url, allowedOrigins) !== undefined)
-            return result;
-        if (isHttpUrl(url))
-            throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-        await delayWithCancellation(25, "observe_web_session", context.signal);
-    }
-    throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-};
 const captureFinalUrl = async (context, capture, allowedOrigins) => {
     const result = await context.connection.send("Page.getFrameTree", {}, context.sessionId, context.signal);
     const url = mainFrameUrl(result);
@@ -329,7 +317,7 @@ const scopedUrl = (value, allowedOrigins) => {
         ? { url: null, scope: "outside_policy" }
         : { url: null, scope: "unsupported" };
 };
-const boundedId = (value) => stringValue(value)?.slice(0, 256) ?? null;
+const boundedId = (value) => stringValue(value) ?? null;
 const safeDetail = (value) => {
     const detail = stringValue(value)?.toLowerCase();
     return detail !== undefined && /^[a-z0-9_.:-]{1,100}$/u.test(detail)

package/dist/browser/CdpPageCapture.js

@@ -2,10 +2,11 @@ import { BrowserObservationError, } from "../domain/errors.js";
 import { stableWebResources } from "../domain/webInventory.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { CdpCaptureEvents } from "./CdpCaptureEvents.js";
+import { authorizedMainFrame } from "./CdpAuthorizedMainFrame.js";
 import { captureStorage } from "./CdpCaptureStorage.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 import { captureAccessibility, captureDom, captureFrames, captureResources, mainFrameUrl, } from "./CdpCaptureDocuments.js";
-import { allowedSanitizedUrl, delayWithCancellation, isHttpUrl, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, delayWithCancellation, } from "./CdpCaptureValues.js";
 import { captureScripts } from "./CdpPageCaptureScripts.js";
 import { captureWorkers } from "./CdpPageCaptureWorkers.js";
 /** Capture and normalize one attached page without evaluating page JavaScript. */
@@ -23,7 +24,7 @@ export const capturePage = async (context) => {
         allowedOrigins,
         limitations: [
             "Observation starts when REA attaches; prior network and console activity is unavailable.",
-            "Raw network headers, bodies, cookies, storage values, console objects, and WebSocket payloads are never retained; separately approved captures retain only bounded redacted text or value-free shapes.",
+            "Raw network headers, bodies, cookies, storage values, console objects, and WebSocket payloads are never retained; separately approved captures retain only redacted text or value-free shapes.",
             "Source maps are reported only as declarative URLs and are not fetched.",
             "URL-less scripts and console events without an allowed source URL are excluded because their origin cannot be proven.",
         ],
@@ -41,26 +42,24 @@ const captureAuthorizedPage = async (state) => {
     const { connection, sessionId, input, signal } = context;
     await authorizeObservationWindow(state);
     await captureJsonResponseBodies(state);
-    const frameResult = await authorizedFrameTree(context, allowedOrigins);
+    const frameResult = await authorizedMainFrame({
+        connection: context.connection,
+        sessionId: context.sessionId,
+        signal: context.signal,
+        allowedOrigins,
+        delayOperation: context.operation,
+    });
     const attachedUrl = mainFrameUrl(frameResult) ?? "";
-    const frameCapture = captureFrames(frameResult, allowedOrigins, input.limits.max_frames, state.events.completeness);
+    const frameCapture = captureFrames(frameResult, allowedOrigins, undefined, state.events.completeness);
     const frames = frameCapture.items;
-    if (frameCapture.total > frames.length)
-        state.events.completeness.truncate("frames");
     const captureFrame = frames[0];
     if (captureFrame === undefined)
         throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
     state.events.beginFinalCapture(captureFrame.frame_id);
-    const resourceCapture = captureResources(await connection.send("Page.getResourceTree", {}, sessionId, signal), allowedOrigins, input.limits.max_resources, state.events.completeness);
-    if (resourceCapture.total > resourceCapture.items.length)
-        state.events.completeness.truncate("resources");
+    const resourceCapture = captureResources(await connection.send("Page.getResourceTree", {}, sessionId, signal), allowedOrigins, state.events.completeness);
     const resources = stableWebResources(resourceCapture.items.map(publicResource));
     const dom = await capturePageDom(state);
-    if (dom.total > dom.nodes.length)
-        state.events.completeness.truncate("dom");
     const accessibility = await accessibilityForFrames(state, frames);
-    if (accessibility.total > accessibility.nodes.length)
-        state.events.completeness.truncate("accessibility");
     const scripts = await captureScripts({
         context,
         events: state.events,
@@ -68,15 +67,17 @@ const captureAuthorizedPage = async (state) => {
         resources,
         frameIds: new Set(frames.map((frame) => frame.frame_id)),
     });
-    const workerCapture = await captureWorkers({ context, allowedOrigins, limitations, events: state.events }, new Set(frames.map((frame) => frame.frame_id)));
-    if (workerCapture.total > workerCapture.items.length)
-        state.events.completeness.truncate("workers");
+    const workers = await captureWorkers({ context, allowedOrigins, limitations, events: state.events }, new Set(frames.map((frame) => frame.frame_id)));
     const storageCapture = await captureStorage(context, frames[0]?.origin ?? new URL(attachedUrl).origin, limitations);
-    if (storageCapture.truncated)
-        state.events.completeness.truncate("storage_keys");
     if (!input.include_storage_keys)
         state.events.completeness.exclude("storage_keys", "not_approved", null);
-    const completedFrameResult = await authorizedFrameTree(context, allowedOrigins);
+    const completedFrameResult = await authorizedMainFrame({
+        connection: context.connection,
+        sessionId: context.sessionId,
+        signal: context.signal,
+        allowedOrigins,
+        delayOperation: context.operation,
+    });
     const completedUrl = mainFrameUrl(completedFrameResult) ?? "";
     if (state.events.originViolation)
         throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
@@ -91,7 +92,7 @@ const captureAuthorizedPage = async (state) => {
             accessibility,
             scripts: scripts.inventory,
             resources,
-            workers: workerCapture.items,
+            workers,
             storage: storageCapture.value,
         }),
         sourceMapRequests: scripts.sourceMapRequests,
@@ -118,9 +119,14 @@ const authorizeObservationWindow = async (state) => {
     const { connection, sessionId, signal } = context;
     await report(context.progress, 1, "Enabling passive CDP domains");
     await connection.send("Page.enable", {}, sessionId, signal);
-    const initialFrameResult = await authorizedFrameTree(context, allowedOrigins);
-    const mainFrame = captureFrames(initialFrameResult, allowedOrigins, 1)
-        .items[0];
+    const initialFrameResult = await authorizedMainFrame({
+        connection: context.connection,
+        sessionId: context.sessionId,
+        signal: context.signal,
+        allowedOrigins,
+        delayOperation: context.operation,
+    });
+    const mainFrame = captureFrames(initialFrameResult, allowedOrigins).items[0];
     if (mainFrame === undefined)
         throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
     events.beginAuthorizedFrame(mainFrame.frame_id);
@@ -140,7 +146,6 @@ const capturePageDom = async (state) => {
     return captureDom(result, allowedOrigins, context.input, state.events.completeness);
 };
 const normalizedInspection = (state, captured) => ({
-    schema_version: 2,
     browser: state.context.discovery.version,
     target: normalizedTarget(state.context.target, captured.attachedUrl, state.allowedOrigins),
     capture_window: {
@@ -183,32 +188,17 @@ const normalizedInspection = (state, captured) => ({
     storage: captured.storage,
     limitations: state.limitations,
 });
-const authorizedFrameTree = async (context, allowedOrigins) => {
-    for (let attempt = 0; attempt < 80; attempt += 1) {
-        const result = await context.connection.send("Page.getFrameTree", {}, context.sessionId, context.signal);
-        const currentUrl = mainFrameUrl(result);
-        if (allowedSanitizedUrl(currentUrl, allowedOrigins) !== undefined)
-            return result;
-        if (isHttpUrl(currentUrl))
-            throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-        await delayWithCancellation(25, context.operation, context.signal);
-    }
-    throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-};
 const enableObservationDomains = async (connection, sessionId, signal) => {
     await connection.send("Runtime.enable", {}, sessionId, signal);
-    await connection.send("Debugger.enable", { maxScriptsCacheSize: 4 * 1_024 * 1_024 }, sessionId, signal);
-    await connection.send("Network.enable", {
-        maxTotalBufferSize: 4 * 1_024 * 1_024,
-        maxResourceBufferSize: 1_024 * 1_024,
-    }, sessionId, signal);
+    await connection.send("Debugger.enable", {}, sessionId, signal);
+    await connection.send("Network.enable", {}, sessionId, signal);
 };
 const accessibilityForFrames = async (state, frames) => {
     const { context, limitations, events } = state;
     const results = [];
     let unavailable = false;
     for (const frame of frames) {
-        const result = await optionalCdpCommand(context, "Accessibility.getFullAXTree", { depth: 32, frameId: frame.frame_id }, limitations);
+        const result = await optionalCdpCommand(context, "Accessibility.getFullAXTree", { frameId: frame.frame_id }, limitations);
         if (result === undefined)
             unavailable = true;
         else
@@ -216,16 +206,12 @@ const accessibilityForFrames = async (state, frames) => {
     }
     if (unavailable)
         events.completeness.unavailable("accessibility");
-    const capture = captureAccessibility(results, context.input.limits.max_ax_nodes, {
+    const capture = captureAccessibility(results, {
         includeText: context.input.include_accessibility_text,
-        maximumFieldBytes: context.input.limits.max_ax_text_field_bytes,
-        maximumTotalBytes: context.input.limits.max_total_ax_text_bytes,
         ...(results.length === 0 && unavailable ? { unavailable: true } : {}),
     });
     if (!context.input.include_accessibility_text)
         events.completeness.exclude("accessibility", "not_approved", capture.textCapture.excluded_fields);
-    if (capture.textCapture.status === "truncated")
-        events.completeness.truncate("accessibility");
     if (capture.treeIncomplete)
         events.completeness.truncate("accessibility");
     return capture;
@@ -246,7 +232,7 @@ const normalizedTarget = (target, currentUrl, allowedOrigins) => {
     return {
         target_id: target.id,
         type: target.type,
-        title: target.title.slice(0, 16_384),
+        title: target.title,
         url: url?.url ?? "[unsupported-url]",
         origin: url?.origin ?? "",
         attached: target.attached,

package/dist/browser/CdpPageCaptureScripts.js

@@ -8,7 +8,6 @@ export const captureScripts = async (options) => {
         frameIds,
         rawResources,
         resources,
-        totalSourceBytes: 0,
     };
     const drafts = [];
     for (const script of events.scripts.values())
@@ -42,26 +41,9 @@ const buildScriptDraft = async (script, state) => {
     };
 };
 const captureScriptSource = async (script, state) => {
-    const { context, events } = state;
-    if (script.length > context.input.limits.max_script_source_bytes) {
-        events.completeness.truncate("script_sources");
-        return sourceExcluded("declared script length exceeds per-script limit");
-    }
-    if (state.totalSourceBytes + script.length >
-        context.input.limits.max_total_script_source_bytes) {
-        events.completeness.truncate("script_sources");
-        return sourceExcluded("total script source limit reached");
-    }
+    const { context } = state;
     const result = requiredRecord(await context.connection.send("Debugger.getScriptSource", { scriptId: script.scriptId }, context.sessionId, context.signal));
     const content = stringValue(result.scriptSource) ?? "";
-    const bytes = Buffer.byteLength(content);
-    if (bytes > context.input.limits.max_script_source_bytes ||
-        state.totalSourceBytes + bytes >
-            context.input.limits.max_total_script_source_bytes) {
-        events.completeness.truncate("script_sources");
-        return sourceExcluded("actual source exceeds configured byte limits");
-    }
-    state.totalSourceBytes += bytes;
     return sourceResult(content);
 };
 const keyAndBuildInventory = (drafts, scriptCount) => {

package/dist/browser/CdpPageCaptureWorkers.js

@@ -1,11 +1,10 @@
-import { allowedSanitizedUrl, boundedText, isHttpUrl, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, isHttpUrl, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 export const captureWorkers = async (input, frameIds) => {
     const { context, allowedOrigins, limitations, events } = input;
     const completeness = events.completeness;
     const result = await optionalCdpCommand({ ...context, sessionId: undefined }, "Target.getTargets", {}, limitations);
     const items = [];
-    let total = 0;
     if (result === undefined)
         completeness.unavailable("workers");
     for (const target of recordsValue(recordValue(result)?.targetInfos)) {
@@ -29,18 +28,15 @@ export const captureWorkers = async (input, frameIds) => {
                     : "unsupported_url");
             continue;
         }
-        total += 1;
-        if (items.length >= context.input.limits.max_workers)
-            continue;
         items.push({
-            target_id: (stringValue(target.targetId) ?? "").slice(0, 256),
-            type: type.slice(0, 100),
+            target_id: stringValue(target.targetId) ?? "",
+            type,
             url: url.url,
             origin: url.origin,
             attached: target.attached === true,
-            opener_target_id: boundedText(target.openerId, 256) ?? null,
-            parent_frame_id: boundedText(target.parentFrameId, 256) ?? null,
+            opener_target_id: stringValue(target.openerId) ?? null,
+            parent_frame_id: stringValue(target.parentFrameId) ?? null,
         });
     }
-    return { total, items };
+    return items;
 };

package/dist/browser/CdpSafeMetadata.js

@@ -37,15 +37,15 @@ const normalizedHeaders = (value) => {
     if (typeof value !== "object" || value === null || Array.isArray(value))
         return new Map();
     const headers = new Map();
-    for (const [name, raw] of Object.entries(value).slice(0, 500)) {
-        const normalized = name.toLowerCase().slice(0, 256);
+    for (const [name, raw] of Object.entries(value)) {
+        const normalized = name.toLowerCase();
         const header = typeof raw === "string"
             ? raw
             : typeof raw === "number" && Number.isFinite(raw)
                 ? String(raw)
                 : undefined;
         if (header !== undefined)
-            headers.set(normalized, header.slice(0, 65_536));
+            headers.set(normalized, header);
     }
     return headers;
 };
@@ -53,13 +53,13 @@ const parseCsp = (value, baseUrl, allowedOrigins) => {
     const directives = [];
     let nonceCount = 0;
     let hashCount = 0;
-    for (const rawDirective of (value ?? "").split(";").slice(0, 100)) {
+    for (const rawDirective of (value ?? "").split(";")) {
         const [rawName, ...tokens] = rawDirective.trim().split(/\s+/u);
         const name = (rawName ?? "").toLowerCase();
-        if (!/^[a-z][a-z0-9-]{0,99}$/u.test(name))
+        if (!/^[a-z][a-z0-9-]*$/u.test(name))
             continue;
         const sources = [];
-        for (const token of tokens.slice(0, 100)) {
+        for (const token of tokens) {
             const lower = token.toLowerCase();
             if (lower.startsWith("'nonce-")) {
                 nonceCount += 1;
@@ -80,9 +80,9 @@ const parseCsp = (value, baseUrl, allowedOrigins) => {
 const cspSource = (token, baseUrl, allowedOrigins) => {
     const lower = token.toLowerCase();
     if (/^'[a-z0-9-]+'$/u.test(lower))
-        return { kind: "keyword", value: lower.slice(0, 100) };
+        return { kind: "keyword", value: lower };
     if (/^[a-z][a-z0-9+.-]*:$/u.test(lower))
-        return { kind: "scheme", value: lower.slice(0, 100) };
+        return { kind: "scheme", value: lower };
     try {
         const parsed = new URL(token, baseUrl);
         return allowedOrigins.has(parsed.origin)
@@ -95,8 +95,8 @@ const cspSource = (token, baseUrl, allowedOrigins) => {
 };
 const parseLinks = (value, baseUrl, allowedOrigins) => {
     const links = [];
-    for (const entry of splitLinkHeader(value ?? "").slice(0, 100)) {
-        const match = /^\s*<([^>]{1,4096})>(.*)$/u.exec(entry);
+    for (const entry of splitLinkHeader(value ?? "")) {
+        const match = /^\s*<([^>]*)>(.*)$/u.exec(entry);
         if (match === null)
             continue;
         const parameters = linkParameters(match[2] ?? "");
@@ -107,8 +107,7 @@ const parseLinks = (value, baseUrl, allowedOrigins) => {
             rel: (parameters.get("rel") ?? "")
                 .toLowerCase()
                 .split(/\s+/u)
-                .filter(Boolean)
-                .slice(0, 32),
+                .filter(Boolean),
             as: boundedHeader(parameters.get("as")),
             type: boundedHeader(parameters.get("type")),
             crossorigin: boundedHeader(parameters.get("crossorigin")),
@@ -134,15 +133,15 @@ const splitLinkHeader = (value) => {
 };
 const linkParameters = (value) => {
     const parameters = new Map();
-    for (const raw of value.split(";").slice(1, 50)) {
+    for (const raw of value.split(";").slice(1)) {
         const separator = raw.indexOf("=");
         const name = (separator < 0 ? raw : raw.slice(0, separator))
             .trim()
             .toLowerCase();
-        if (!/^[a-z][a-z0-9-]{0,99}$/u.test(name))
+        if (!/^[a-z][a-z0-9-]*$/u.test(name))
             continue;
         const parameter = separator < 0 ? "" : raw.slice(separator + 1).trim();
-        parameters.set(name, unquote(parameter).slice(0, 1_024));
+        parameters.set(name, unquote(parameter));
     }
     return parameters;
 };
@@ -163,10 +162,8 @@ const permissionFeatures = (value) => [
     ...new Set((value ?? "")
         .split(",")
         .map((entry) => entry.split("=", 1)[0]?.trim().toLowerCase() ?? "")
-        .filter((feature) => /^[a-z][a-z0-9-]{0,99}$/u.test(feature))),
-]
-    .sort()
-    .slice(0, 200);
+        .filter((feature) => /^[a-z][a-z0-9-]*$/u.test(feature))),
+].sort();
 const wellKnownHint = (url) => {
     try {
         const path = new URL(url).pathname.toLowerCase();
@@ -180,20 +177,20 @@ const wellKnownHint = (url) => {
 };
 const agentHint = (mechanism, declaration, url) => ({
     mechanism,
-    declaration: declaration.slice(0, 256),
+    declaration,
     url,
     trust: "page-declared-untrusted",
 });
 const isAgentRel = (value) => ["mcp", "model-context", "ai-plugin", "service-desc"].includes(value);
 const policyToken = (value) => {
     const token = (value ?? "").trim().toLowerCase();
-    return /^[a-z][a-z0-9_.-]{0,99}$/u.test(token) ? token : null;
+    return /^[a-z][a-z0-9_.-]*$/u.test(token) ? token : null;
 };
 const nonnegativeInteger = (value) => {
     const number = numberValue(value === undefined ? undefined : Number(value));
     return number === undefined ? null : Math.max(0, Math.trunc(number));
 };
-const boundedHeader = (value) => value === undefined ? null : value.trim().toLowerCase().slice(0, 256);
+const boundedHeader = (value) => value === undefined ? null : value.trim().toLowerCase();
 const unquote = (value) => value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
 const agentHeaderNames = ["x-model-context", "x-webmcp", "mcp-server"];
 const wellKnownAgentPaths = new Set([