rea-agents 3.2.1 → 4.0.0

package/dist/artifacts/MachOSliceArtifactReader.js

@@ -1,7 +1,10 @@
 import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { Readable } from "node:stream";
 import { XcrunCommandRunner, } from "../native/CommandRunner.js";
 import { parseLipoArchitectures } from "../native/parsers/lipo.js";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
+import { streamChunkToBuffer } from "./StreamBytes.js";
 /** Read-only universal Mach-O slice reader backed by native lipo metadata. */
 export class MachOSliceArtifactReader {
     path;
@@ -24,9 +27,17 @@ export class MachOSliceArtifactReader {
             exit_code: captured.value.exitCode,
             effects: ["read"],
         };
+        const fileSize = (await stat(this.path)).size;
         for (const architecture of parseLipoArchitectures(captured.value.stdout)) {
             if (architecture.file_offset === null || architecture.size === null)
                 throw new ArtifactReaderFailure("integrity", "lipo omitted a universal slice byte range");
+            if (!Number.isSafeInteger(architecture.file_offset) ||
+                !Number.isSafeInteger(architecture.size) ||
+                architecture.file_offset < 0 ||
+                architecture.size <= 0 ||
+                !Number.isSafeInteger(architecture.file_offset + architecture.size) ||
+                architecture.file_offset + architecture.size > fileSize)
+                throw new ArtifactReaderFailure("integrity", `lipo reported an out-of-bounds Mach-O slice: ${architecture.name}`);
             yield {
                 path: `slices/${architecture.name}`,
                 kind: "slice",
@@ -42,17 +53,48 @@ export class MachOSliceArtifactReader {
             };
         }
     }
-    open(entry, signal) {
+    async open(entry, signal) {
         if (signal?.aborted === true)
             return Promise.reject(new ArtifactReaderFailure("cancelled", "Mach-O slice read cancelled"));
         const [offsetText, sizeText] = entry.adapterKey.split(":");
-        const offset = Number(offsetText);
-        const size = Number(sizeText);
+        const offset = parseSliceKeyInteger(offsetText);
+        const size = parseSliceKeyInteger(sizeText);
         if (!Number.isSafeInteger(offset) ||
             !Number.isSafeInteger(size) ||
+            offset === null ||
+            size === null ||
+            offset < 0 ||
             size <= 0)
-            return Promise.reject(new ArtifactReaderFailure("integrity", "Invalid Mach-O slice byte range"));
-        return Promise.resolve(createReadStream(this.path, { start: offset, end: offset + size - 1 }));
+            throw new ArtifactReaderFailure("integrity", "Invalid Mach-O slice byte range");
+        const fileSize = (await stat(this.path)).size;
+        if (!Number.isSafeInteger(offset + size) || offset + size > fileSize)
+            throw new ArtifactReaderFailure("integrity", `Mach-O slice range is outside the artifact: ${entry.path}`);
+        const source = createReadStream(this.path, {
+            start: offset,
+            end: offset + size - 1,
+            ...(signal === undefined ? {} : { signal }),
+        });
+        return Readable.from((async function* () {
+            let observedBytes = 0;
+            try {
+                for await (const raw of source) {
+                    const chunk = streamChunkToBuffer(raw);
+                    observedBytes += chunk.byteLength;
+                    if (observedBytes > size)
+                        throw new ArtifactReaderFailure("integrity", `Mach-O slice exceeded its reported size: ${entry.path}`);
+                    yield chunk;
+                }
+            }
+            catch (cause) {
+                if (cause instanceof ArtifactReaderFailure)
+                    throw cause;
+                if (signal?.aborted === true)
+                    throw new ArtifactReaderFailure("cancelled", "Mach-O slice read cancelled", { cause });
+                throw new ArtifactReaderFailure("integrity", `Could not read Mach-O slice range: ${entry.path}`, { cause });
+            }
+            if (observedBytes !== size)
+                throw new ArtifactReaderFailure("integrity", `Mach-O slice size disagrees with lipo metadata: ${entry.path}`);
+        })());
     }
     provenance() {
         return this.#command === undefined ? [] : [structuredClone(this.#command)];
@@ -61,3 +103,9 @@ export class MachOSliceArtifactReader {
         return Promise.resolve();
     }
 }
+const parseSliceKeyInteger = (value) => {
+    if (value === undefined || !/^\d+$/u.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+};

package/dist/artifacts/ZipArtifactReader.js

@@ -80,11 +80,27 @@ export class ZipArtifactReader {
 }
 const extractStream = (entry, signal) => {
     const output = new PassThrough();
+    const controller = new AbortController();
+    const onAbort = () => {
+        controller.abort(signal?.reason);
+        // AbortSignal listeners dispatch synchronously, so this destroy wins the race
+        // against `getData` rejecting with its own AbortError. That ordering is what
+        // keeps the caller-visible failure typed as `cancelled`.
+        output.destroy(new ArtifactReaderFailure("cancelled", "ZIP operation cancelled"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    // `close` covers both a consumer walking away mid-entry and normal completion
+    // after `end()`; aborting then is harmless because `getData` has already
+    // resolved, and it releases the producer in the abandoned-consumer case.
+    output.once("close", () => {
+        signal?.removeEventListener("abort", onAbort);
+        controller.abort();
+    });
     const writable = new WritableStream({
         write: async (chunk) => {
             abortIfNeeded(signal);
             if (!output.write(Buffer.from(chunk)))
-                await once(output, "drain");
+                await once(output, "drain", { signal: controller.signal });
         },
         close: () => {
             output.end();
@@ -95,6 +111,7 @@ const extractStream = (entry, signal) => {
     });
     void entry
         .getData(writable, {
+        signal: controller.signal,
         checkSignature: true,
         checkOverlappingEntry: true,
         onprogress: () => abortIfNeeded(signal),

package/dist/browser/BrowserScenarioSecrets.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { sanitizeBrowserUrl, } from "../domain/browserObservation.js";
 const REDACTION_PREFIX = "[REDACTED:";
 /** Resolved secret values kept only for one in-memory scenario session. */
 export class BrowserScenarioSecrets {
@@ -10,7 +11,8 @@ export class BrowserScenarioSecrets {
         const values = new Map();
         for (const declaration of scenario.secrets) {
             const value = environment[declaration.environment_variable];
-            if (value === undefined)
+            if (!Object.hasOwn(environment, declaration.environment_variable) ||
+                typeof value !== "string")
                 return undefined;
             values.set(declaration.secret_id, value);
         }
@@ -39,6 +41,31 @@ export class BrowserScenarioSecrets {
                 output = output.replaceAll(secret, `${REDACTION_PREFIX}${id}]`);
         return output;
     }
+    /** Remove only declared secret values from one URL and report that action. */
+    sanitizeUrl(value) {
+        let output = value;
+        const replacements = [...this.values].sort(([leftId, left], [rightId, right]) => right.length - left.length ||
+            (leftId < rightId ? -1 : leftId > rightId ? 1 : 0));
+        for (const [id, secret] of replacements) {
+            if (secret === "")
+                continue;
+            const marker = `${REDACTION_PREFIX}${id}]`;
+            const searchParamsValue = new URLSearchParams([["value", secret]])
+                .toString()
+                .slice("value=".length);
+            for (const candidate of new Set([
+                secret,
+                encodeURIComponent(secret),
+                searchParamsValue,
+            ]))
+                output = output.replaceAll(candidate, marker);
+        }
+        const sanitized = sanitizeBrowserUrl(output);
+        return {
+            ...sanitized,
+            redacted: sanitized.redacted || output !== value,
+        };
+    }
     fingerprint(value) {
         for (const secret of this.values.values())
             if (secret !== "" && value.includes(secret))

package/dist/browser/CdpBrowserProvider.js

@@ -23,7 +23,7 @@ export const CDP_BROWSER_PROVIDER_IDENTITY = Object.freeze({
 });
 const IDENTITY = CDP_BROWSER_PROVIDER_IDENTITY;
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"];
-/** Passive, origin-scoped browser observation through a user-owned CDP endpoint. */
+/** Passive browser observation through a selected user-owned CDP endpoint. */
 export class CdpBrowserProvider {
     identity() {
         return IDENTITY;
@@ -31,14 +31,17 @@ export class CdpBrowserProvider {
     async listTargets(input, options = {}) {
         try {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, "list_browser_targets", options.signal);
-            const allowedOrigins = new Set(input.allowed_origins);
-            const selected = selectTargets(discovery, allowedOrigins);
+            const selected = selectTargets(discovery, input.allowed_origins.length === 0
+                ? undefined
+                : new Set(input.allowed_origins));
             return ok(browserTargetListSchema.parse({
                 browser: discovery.version,
                 targets: selected.allowed,
                 excluded: selected.excluded,
                 limitations: [
-                    "Only page targets whose current URL matches an approved exact origin are listed.",
+                    input.allowed_origins.length === 0
+                        ? "All page targets with supported HTTP(S) URLs are listed."
+                        : "Only page targets whose current URL matches an explicitly requested exact origin are listed.",
                     ...(selected.unconnectable === 0
                         ? []
                         : [
@@ -64,7 +67,12 @@ export class CdpBrowserProvider {
         try {
             const captured = await this.#capture(input, options, "analyze_web_bundle");
             const sourceMaps = input.fetch_source_maps
-                ? await fetchWebSourceMaps(captured.sourceMapRequests, input, options.signal)
+                ? await fetchWebSourceMaps(captured.sourceMapRequests, {
+                    ...input,
+                    allowed_origins: input.allowed_origins.length > 0
+                        ? input.allowed_origins
+                        : [captured.inspection.target.origin],
+                }, options.signal)
                 : undefined;
             return ok(webBundleAnalysisSchema.parse(analyzeCapturedWebBundle(captured.inspection, sourceMaps)));
         }
@@ -77,13 +85,14 @@ export class CdpBrowserProvider {
         try {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, "observe_web_session", options.signal);
             const target = authorizeTarget(discovery, input);
+            const scopedInput = scopeToTargetOrigin(input, target);
             targetSession = await openCdpTargetSession(discovery, target, "observe_web_session", options.signal);
             return ok(webObservationSessionSchema.parse(await observeCdpSession({
                 connection: targetSession.connection,
                 sessionId: targetSession.sessionId,
                 discovery,
                 target,
-                input,
+                input: scopedInput,
                 ...(options.signal === undefined ? {} : { signal: options.signal }),
                 ...(options.progress === undefined
                     ? {}
@@ -95,7 +104,7 @@ export class CdpBrowserProvider {
         }
         finally {
             if (targetSession !== undefined)
-                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS);
+                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS, options.signal);
         }
     }
     async discoverWebMcpTools(input, options = {}) {
@@ -103,13 +112,14 @@ export class CdpBrowserProvider {
         try {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, "discover_webmcp_tools", options.signal);
             const target = authorizeTarget(discovery, input);
+            const scopedInput = scopeToTargetOrigin(input, target);
             targetSession = await openCdpTargetSession(discovery, target, "discover_webmcp_tools", options.signal);
             return ok(webMcpDiscoverySchema.parse(await discoverWebMcp({
                 connection: targetSession.connection,
                 sessionId: targetSession.sessionId,
                 discovery,
                 target,
-                input,
+                input: scopedInput,
                 ...(options.signal === undefined ? {} : { signal: options.signal }),
                 ...(options.progress === undefined
                     ? {}
@@ -121,7 +131,7 @@ export class CdpBrowserProvider {
         }
         finally {
             if (targetSession !== undefined)
-                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS);
+                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS, options.signal);
         }
     }
     async compareCaptures(input) {
@@ -137,13 +147,14 @@ export class CdpBrowserProvider {
         try {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, "capture_web_screenshot", options.signal);
             const target = authorizeTarget(discovery, input);
+            const scopedInput = scopeToTargetOrigin(input, target);
             targetSession = await openCdpTargetSession(discovery, target, "capture_web_screenshot", options.signal);
             return ok(webScreenshotSchema.parse(await captureCdpScreenshot({
                 connection: targetSession.connection,
                 sessionId: targetSession.sessionId,
                 discovery,
                 target,
-                input,
+                input: scopedInput,
                 ...(options.signal === undefined ? {} : { signal: options.signal }),
                 ...(options.progress === undefined
                     ? {}
@@ -155,7 +166,7 @@ export class CdpBrowserProvider {
         }
         finally {
             if (targetSession !== undefined)
-                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS);
+                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS, options.signal);
         }
     }
     async compareScreenshots(input) {
@@ -171,6 +182,7 @@ export class CdpBrowserProvider {
         try {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, operation, options.signal);
             const target = authorizeTarget(discovery, input);
+            const scopedInput = scopeToTargetOrigin(input, target);
             targetSession = await openCdpTargetSession(discovery, target, operation, options.signal);
             return await capturePage({
                 connection: targetSession.connection,
@@ -178,7 +190,7 @@ export class CdpBrowserProvider {
                 operation,
                 discovery,
                 target,
-                input,
+                input: scopedInput,
                 ...(options.signal === undefined ? {} : { signal: options.signal }),
                 ...(options.progress === undefined
                     ? {}
@@ -187,7 +199,7 @@ export class CdpBrowserProvider {
         }
         finally {
             if (targetSession !== undefined)
-                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS);
+                await closeCdpTargetSession(targetSession, CLEANUP_DOMAINS, options.signal);
         }
     }
 }
@@ -207,7 +219,7 @@ const selectTargets = (discovery, allowedOrigins) => {
             unsupportedUrl += 1;
             continue;
         }
-        if (!allowedOrigins.has(url.origin)) {
+        if (allowedOrigins !== undefined && !allowedOrigins.has(url.origin)) {
             disallowedOrigin += 1;
             continue;
         }
@@ -242,10 +254,19 @@ const authorizeTarget = (discovery, input) => {
     const origin = sanitizeBrowserUrl(target.url).origin;
     if (target.type !== "page" ||
         origin === null ||
-        !input.allowed_origins.includes(origin))
+        (input.allowed_origins.length > 0 &&
+            !input.allowed_origins.includes(origin)))
         throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
     return target;
 };
+const scopeToTargetOrigin = (input, target) => {
+    if (input.allowed_origins.length > 0)
+        return input;
+    const origin = sanitizeBrowserUrl(target.url).origin;
+    if (origin === null)
+        throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
+    return { ...input, allowed_origins: [origin] };
+};
 const providerError = (cause, operation) => cause instanceof BrowserObservationError && cause.operation !== operation
     ? new BrowserObservationError(operation, cause.reason, { cause })
     : cause instanceof AnalysisError

package/dist/browser/CdpCaptureDocuments.js

@@ -2,11 +2,13 @@ import { allowedSanitizedUrl, numberValue, recordValue, recordsValue, requiredRe
 import { exclusionReasonForUrl } from "./CdpCaptureEventHelpers.js";
 /** Normalize every allowed frame, optionally selecting a leading frame. */
 export const captureFrames = (result, allowedOrigins, maximum, completeness) => {
-    const root = recordValue(requiredRecord(result).frameTree);
-    if (root === undefined)
+    const root = recordValue(recordValue(result)?.frameTree);
+    if (root === undefined) {
+        completeness?.exclude("frames", "invalid_protocol_value");
         return { items: [] };
+    }
     const items = [];
-    for (const tree of walkFrameTrees(root)) {
+    for (const tree of walkFrameTrees(root, () => completeness?.exclude("frames", "invalid_protocol_value"))) {
         const frame = recordValue(tree.frame);
         const frameId = stringValue(frame?.id);
         const sanitized = allowedSanitizedUrl(frame?.url, allowedOrigins);
@@ -33,11 +35,13 @@ export const captureFrames = (result, allowedOrigins, maximum, completeness) =>
 export const mainFrameUrl = (result) => stringValue(recordValue(recordValue(requiredRecord(result).frameTree)?.frame)?.url);
 /** Normalize every allowed resource. */
 export const captureResources = (result, allowedOrigins, completeness) => {
-    const root = recordValue(requiredRecord(result).frameTree);
-    if (root === undefined)
+    const root = recordValue(recordValue(result)?.frameTree);
+    if (root === undefined) {
+        completeness?.exclude("resources", "invalid_protocol_value");
         return { items: [] };
+    }
     const items = [];
-    for (const tree of walkFrameTrees(root)) {
+    for (const tree of walkFrameTrees(root, () => completeness?.exclude("resources", "invalid_protocol_value"))) {
         for (const resource of recordsValue(tree.resources)) {
             const url = allowedSanitizedUrl(resource.url, allowedOrigins);
             if (url === undefined || url.origin === null) {
@@ -57,13 +61,23 @@ export const captureResources = (result, allowedOrigins, completeness) => {
     }
     return { items };
 };
-const walkFrameTrees = function* (root) {
+export const walkFrameTrees = function* (root, onMalformedChild) {
     const pending = [root];
     while (pending.length > 0) {
         const tree = pending.pop();
         if (tree === undefined)
             return;
-        const children = recordsValue(tree.childFrames);
+        const rawChildren = tree.childFrames;
+        if (rawChildren !== undefined && !Array.isArray(rawChildren))
+            onMalformedChild?.();
+        const children = Array.isArray(rawChildren)
+            ? rawChildren.flatMap((child) => {
+                const parsed = recordValue(child);
+                if (parsed === undefined)
+                    onMalformedChild?.();
+                return parsed === undefined ? [] : [parsed];
+            })
+            : [];
         for (let index = children.length - 1; index >= 0; index -= 1) {
             const child = children[index];
             if (child !== undefined)

package/dist/browser/CdpCaptureEventHandlers.js

@@ -1,9 +1,8 @@
 import { inferJsonShape } from "../domain/jsonShape.js";
 import { safeResponseMetadata } from "./CdpSafeMetadata.js";
-import { redactSensitiveText } from "./SensitiveTextCapture.js";
 import { allowedSanitizedUrl, isHttpUrl, numberValue, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
 import { requestBodyShape } from "./CdpCaptureEventBodyShapes.js";
-import { consolePrimitive, decodeBase64, exclusionReasonForUrl, executionContextKey, firstCallFrame, initiatorLocation, integerOrNull, } from "./CdpCaptureEventHelpers.js";
+import { consolePrimitive, decodeBase64, exclusionReasonForUrl, executionContextKey, firstCallFrame, initiatorLocation, integerOrNull, isMainFrameNavigation, } from "./CdpCaptureEventHelpers.js";
 export const handleExecutionContextCreated = (state, params) => {
     const context = recordValue(params.context);
     const identifier = numberValue(context?.id);
@@ -182,7 +181,7 @@ const captureConsoleText = (state, arguments_) => {
         const primitive = consolePrimitive(argument);
         if (primitive === undefined)
             continue;
-        const text = redactSensitiveText(primitive.text);
+        const text = primitive.text;
         values.push({
             argument_index: argumentIndex,
             type: primitive.type,
@@ -261,10 +260,20 @@ export const handleWebSocketCreated = (state, params) => {
 };
 export const handleFrameNavigated = (state, params) => {
     const frame = recordValue(params.frame);
-    if (stringValue(frame?.id) !== state.mainFrameId)
+    if (state.mainFrameId === undefined)
+        return;
+    if (!isMainFrameNavigation({ method: "Page.frameNavigated", params }, state.mainFrameId))
         return;
-    state.navigationDuringCapture = true;
     const rawUrl = stringValue(frame?.url);
+    const loaderId = stringValue(frame?.loaderId);
+    // `frameNavigated` re-fires for a document already reported (same URL and
+    // loader). Treating that as a navigation aborted a valid capture with
+    // `target_changed`, which is a false claim that the target moved.
+    const document = `${String(loaderId ?? "")}\0${String(rawUrl ?? "")}`;
+    if (state.committedDocument === document)
+        return;
+    state.committedDocument = document;
+    state.navigationDuringCapture = true;
     if (isHttpUrl(rawUrl) &&
         allowedSanitizedUrl(rawUrl, state.allowedOrigins) === undefined)
         state.originViolation = true;

package/dist/browser/CdpCaptureEventHelpers.js

@@ -1,4 +1,17 @@
 import { isHttpUrl, numberValue, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+/** Identify a top-level navigation event from its untrusted CDP envelope. */
+export const isMainFrameNavigation = (event, mainFrameId) => {
+    const params = recordValue(event.params);
+    if (params === undefined)
+        return false;
+    const frameId = event.method === "Page.frameNavigated"
+        ? stringValue(recordValue(params.frame)?.id)
+        : event.method === "Page.frameRequestedNavigation" ||
+            event.method === "Page.navigatedWithinDocument"
+            ? stringValue(params.frameId)
+            : undefined;
+    return frameId === mainFrameId;
+};
 export const firstCallFrame = (value) => recordsValue(value?.callFrames)[0];
 export const initiatorLocation = (initiator) => {
     let stack = recordValue(initiator?.stack);

package/dist/browser/CdpCaptureEvents.js

@@ -24,6 +24,7 @@ export class CdpCaptureEvents {
     originViolation = false;
     navigationDuringCapture = false;
     mainFrameId = undefined;
+    committedDocument = undefined;
     input;
     allowedOrigins;
     constructor(input, allowedOrigins) {
@@ -34,6 +35,7 @@ export class CdpCaptureEvents {
         this.mainFrameId = frameId;
         this.originViolation = false;
         this.navigationDuringCapture = false;
+        this.committedDocument = undefined;
         this.scripts.clear();
         this.executionContextFrames.clear();
         this.network.clear();
@@ -52,7 +54,14 @@ export class CdpCaptureEvents {
     }
     beginFinalCapture(frameId) {
         this.mainFrameId = frameId;
-        this.navigationDuringCapture = false;
+        // Deliberately does not clear `navigationDuringCapture`. A main-frame
+        // navigation observed during the observation window means the page never
+        // settled, and clearing the flag here reported the capture as clean while
+        // carrying pre-navigation scripts, network and console into the inventory
+        // of the new document. The caller now reports `target_changed` instead.
+        // `committedDocument` is dropped so the new document's frame events are
+        // compared against itself rather than the document we just left.
+        this.committedDocument = undefined;
     }
     ingest(event) {
         const params = recordValue(event.params);

package/dist/browser/CdpElectronInspection.js

@@ -2,6 +2,7 @@ import { BrowserObservationError } from "../domain/errors.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { canonicalJsonDigest } from "./CdpCanonicalJsonDigest.js";
 import { delayWithCancellation, numberValue, recordValue, recordsValue, requiredRecord, stringValue, } from "./CdpCaptureValues.js";
+import { walkFrameTrees } from "./CdpCaptureDocuments.js";
 import { ingestElectronScriptEvent, } from "./CdpElectronScriptEvents.js";
 import { captureElectronScripts } from "./CdpElectronScripts.js";
 import { captureElectronWorkers } from "./CdpElectronWorkers.js";
@@ -15,7 +16,7 @@ export const inspectCdpElectronPage = async (context) => {
         limitations: [
             "Local file paths exposed by the selected CDP target are retained in the observation.",
             "REA does not evaluate renderer JavaScript, invoke Electron APIs, navigate, click, or close the page.",
-            "Script contents require separate source-capture approval.",
+            "Select include_script_sources to retain script contents.",
         ],
         mainFrameId: undefined,
         navigationDuringCapture: false,
@@ -132,13 +133,9 @@ const captureFrames = async (result, completeness) => {
     const frameTree = recordValue(requiredRecord(result).frameTree);
     if (frameTree === undefined)
         throw new BrowserObservationError("inspect_web_page", "protocol_error");
-    const pending = [{ tree: frameTree, parent: null }];
     const frames = [];
-    while (pending.length > 0) {
-        const current = pending.shift();
-        if (current === undefined)
-            break;
-        const frame = recordValue(current.tree.frame);
+    for (const tree of walkFrameTrees(frameTree, () => completeness.exclude("frames", "invalid_protocol_value"))) {
+        const frame = recordValue(tree.frame);
         const frameId = stringValue(frame?.id);
         const path = await authorizedElectronFile(stringValue(frame?.url) ?? "");
         if (frameId === undefined || path === undefined) {
@@ -147,11 +144,9 @@ const captureFrames = async (result, completeness) => {
         }
         frames.push({
             frame_id: frameId,
-            parent_frame_id: current.parent,
+            parent_frame_id: stringValue(frame?.parentId) ?? null,
             file_path: path,
         });
-        for (const child of recordsValue(current.tree.childFrames))
-            pending.push({ tree: child, parent: frameId });
     }
     return frames;
 };

package/dist/browser/CdpElectronProvider.js

@@ -91,11 +91,7 @@ export class CdpElectronProvider {
         }
         finally {
             if (targetSession !== undefined)
-                await closeCdpTargetSession(targetSession, [
-                    "Debugger",
-                    "Runtime",
-                    "Page",
-                ]);
+                await closeCdpTargetSession(targetSession, ["Debugger", "Runtime", "Page"], options.signal);
         }
     }
 }

package/dist/browser/CdpElectronScripts.js

@@ -51,7 +51,7 @@ const captureScriptSource = async (input, script) => {
         return {
             source: {
                 included: false,
-                reason: "source capture was not approved",
+                reason: "source capture was not selected",
             },
         };
     const result = requiredRecord(await input.connection.send("Debugger.getScriptSource", { scriptId: script.scriptId }, input.sessionId, input.signal));

package/dist/browser/CdpEndpoint.js

@@ -82,8 +82,9 @@ const sanitizeSameOriginTitleUrl = (candidate, target) => {
     catch {
         return candidate;
     }
-    return parsed.origin === target.origin && parsed.search !== ""
-        ? sanitizeBrowserUrl(parsed.href).url
+    return parsed.origin === target.origin &&
+        (parsed.username !== "" || parsed.password !== "")
+        ? sanitizeBrowserUrl(candidate).url
         : candidate;
 };
 const escapeRegExp = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");