rea-agents 4.1.0 → 6.0.0

package/dist/browser/CdpPageCapture.js

@@ -48,7 +48,7 @@ const captureAuthorizedPage = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const attachedUrl = mainFrameUrl(frameResult) ?? "";
     const frameCapture = captureFrames(frameResult, allowedOrigins, undefined, state.events.completeness);
@@ -69,7 +69,7 @@ const captureAuthorizedPage = async (state) => {
         frameIds: new Set(frames.map((frame) => frame.frame_id)),
     });
     const workers = await captureWorkers({ context, allowedOrigins, limitations, events: state.events }, new Set(frames.map((frame) => frame.frame_id)));
-    const storageCapture = await captureStorage(context, frames[0]?.origin ?? new URL(attachedUrl).origin, limitations);
+    const storageCapture = await captureStorage(context, attachedUrl, limitations);
     if (!input.include_storage_keys)
         state.events.completeness.exclude("storage_keys", "not_approved", null);
     const completedFrameResult = await authorizedMainFrame({
@@ -77,7 +77,7 @@ const captureAuthorizedPage = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const completedUrl = mainFrameUrl(completedFrameResult) ?? "";
     if (state.events.originViolation)
@@ -125,7 +125,7 @@ const authorizeObservationWindow = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const mainFrame = captureFrames(initialFrameResult, allowedOrigins).items[0];
     if (mainFrame === undefined)

package/dist/browser/CdpPageCaptureScripts.js

@@ -1,5 +1,5 @@
 import { reconcileCapturedWebScript, stableWebScriptKey, } from "../domain/webInventory.js";
-import { requiredRecord, sourceExcluded, sourceResult, stringValue, } from "./CdpCaptureValues.js";
+import { requiredRecord, sourceExcluded, sourceResult, cdpStringValue, } from "./CdpCaptureValues.js";
 export const captureScripts = async (options) => {
     const { context, events, rawResources, resources, frameIds } = options;
     const state = {
@@ -43,7 +43,7 @@ const buildScriptDraft = async (script, state) => {
 const captureScriptSource = async (script, state) => {
     const { context } = state;
     const result = requiredRecord(await context.connection.send("Debugger.getScriptSource", { scriptId: script.scriptId }, context.sessionId, context.signal));
-    const content = stringValue(result.scriptSource) ?? "";
+    const content = cdpStringValue(result.scriptSource) ?? "";
     return sourceResult(content);
 };
 const keyAndBuildInventory = (drafts, scriptCount) => {

package/dist/browser/CdpPageCaptureWorkers.js

@@ -1,4 +1,4 @@
-import { allowedSanitizedUrl, isHttpUrl, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, isHttpUrl, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 export const captureWorkers = async (input, frameIds) => {
     const { context, allowedOrigins, limitations, events } = input;
@@ -8,11 +8,11 @@ export const captureWorkers = async (input, frameIds) => {
     if (result === undefined)
         completeness.unavailable("workers");
     for (const target of recordsValue(recordValue(result)?.targetInfos)) {
-        const type = stringValue(target.type) ?? "";
+        const type = cdpStringValue(target.type) ?? "";
         const url = allowedSanitizedUrl(target.url, allowedOrigins);
-        const relatedToPage = stringValue(target.openerId) === context.target.id ||
-            (stringValue(target.parentFrameId) !== undefined &&
-                frameIds.has(stringValue(target.parentFrameId) ?? ""));
+        const relatedToPage = cdpStringValue(target.openerId) === context.target.id ||
+            (cdpStringValue(target.parentFrameId) !== undefined &&
+                frameIds.has(cdpStringValue(target.parentFrameId) ?? ""));
         if (!type.includes("worker"))
             continue;
         if (!relatedToPage) {
@@ -20,7 +20,7 @@ export const captureWorkers = async (input, frameIds) => {
             continue;
         }
         if (url === undefined) {
-            const rawUrl = stringValue(target.url);
+            const rawUrl = cdpStringValue(target.url);
             completeness.exclude("workers", rawUrl === undefined || rawUrl === ""
                 ? "unattributed_origin"
                 : isHttpUrl(rawUrl)
@@ -29,13 +29,13 @@ export const captureWorkers = async (input, frameIds) => {
             continue;
         }
         items.push({
-            target_id: stringValue(target.targetId) ?? "",
+            target_id: cdpStringValue(target.targetId) ?? "",
             type,
             url: url.url,
             origin: url.origin,
             attached: target.attached === true,
-            opener_target_id: stringValue(target.openerId) ?? null,
-            parent_frame_id: stringValue(target.parentFrameId) ?? null,
+            opener_target_id: cdpStringValue(target.openerId) ?? null,
+            parent_frame_id: cdpStringValue(target.parentFrameId) ?? null,
         });
     }
     return items;

package/dist/browser/CdpSafeMetadata.js

@@ -1,5 +1,5 @@
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
-import { numberValue, stringValue, } from "./CdpCaptureValues.js";
+import { numberValue, cdpStringValue, } from "./CdpCaptureValues.js";
 /** Normalize an allowlisted subset of response metadata and discard raw headers. */
 export const safeResponseMetadata = (requestId, url, response, allowedOrigins) => {
     const headers = normalizedHeaders(response.headers);
@@ -16,7 +16,7 @@ export const safeResponseMetadata = (requestId, url, response, allowedOrigins) =
         response: {
             request_id: requestId,
             url,
-            mime_type: boundedHeader(stringValue(response.mimeType)),
+            mime_type: boundedHeader(cdpStringValue(response.mimeType)),
             content_length: nonnegativeInteger(headers.get("content-length")),
             content_encoding: boundedHeader(headers.get("content-encoding")),
             csp,
@@ -25,7 +25,7 @@ export const safeResponseMetadata = (requestId, url, response, allowedOrigins) =
                 coop: policyToken(headers.get("cross-origin-opener-policy")),
                 coep: policyToken(headers.get("cross-origin-embedder-policy")),
                 corp: policyToken(headers.get("cross-origin-resource-policy")),
-                referrer_policy: policyToken(headers.get("referrer-policy")),
+                referrer_policy: referrerPolicy(headers.get("referrer-policy")),
                 x_content_type_options: policyToken(headers.get("x-content-type-options")),
                 permissions_policy_features: permissionFeatures(headers.get("permissions-policy")),
             },
@@ -156,25 +156,40 @@ const parseLinks = (value, baseUrl, allowedOrigins) => {
     }
     return links;
 };
-const splitLinkHeader = (value) => {
+const splitLinkHeader = (value, delimiter = ",") => {
     const entries = [];
     let start = 0;
     let quoted = false;
+    let escaped = false;
+    let target = false;
     for (let index = 0; index < value.length; index += 1) {
         const character = value[index];
-        if (character === '"' && value[index - 1] !== "\\")
-            quoted = !quoted;
-        if (character !== "," || quoted)
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (character === "\\")
+                escaped = true;
+            else if (character === '"')
+                quoted = false;
             continue;
-        entries.push(value.slice(start, index));
-        start = index + 1;
+        }
+        if (character === '"' && !target)
+            quoted = true;
+        else if (delimiter === "," && character === "<")
+            target = true;
+        else if (delimiter === "," && character === ">")
+            target = false;
+        else if (character === delimiter && !target) {
+            entries.push(value.slice(start, index));
+            start = index + 1;
+        }
     }
     entries.push(value.slice(start));
     return entries;
 };
 const linkParameters = (value) => {
     const parameters = new Map();
-    for (const raw of value.split(";").slice(1)) {
+    for (const raw of splitLinkHeader(value, ";").slice(1)) {
         const separator = raw.indexOf("=");
         const name = (separator < 0 ? raw : raw.slice(0, separator))
             .trim()
@@ -228,6 +243,29 @@ const agentHint = (mechanism, declaration, url) => ({
     trust: "page-declared-untrusted",
 });
 const isAgentRel = (value) => ["mcp", "model-context", "ai-plugin", "service-desc"].includes(value);
+const referrerPolicies = new Set([
+    "no-referrer",
+    "no-referrer-when-downgrade",
+    "same-origin",
+    "origin",
+    "strict-origin",
+    "origin-when-cross-origin",
+    "strict-origin-when-cross-origin",
+    "unsafe-url",
+]);
+const referrerPolicy = (value) => {
+    let policy = null;
+    for (const raw of (value ?? "").split(",")) {
+        const token = raw.trim().toLowerCase();
+        if (token === "")
+            continue;
+        if (!/^[a-z-]+$/u.test(token))
+            return null;
+        if (referrerPolicies.has(token))
+            policy = token;
+    }
+    return policy;
+};
 const policyToken = (value) => {
     const token = (value ?? "").trim().toLowerCase();
     return /^[a-z][a-z0-9_.-]*$/u.test(token) ? token : null;

package/dist/browser/CdpScreenshot.js

@@ -1,7 +1,7 @@
 import { createWebScreenshotArtifact } from "../domain/webScreenshot.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { isMainFrameNavigation } from "./CdpCaptureEventHelpers.js";
-import { allowedSanitizedUrl, recordValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, recordValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { captureFrames } from "./CdpCaptureDocuments.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
@@ -27,7 +27,7 @@ export const captureCdpScreenshot = async (context) => {
         changed: false,
         leftScope: false,
         url: beforeUrl,
-        loaderId: stringValue(initialFrame?.loaderId),
+        loaderId: cdpStringValue(initialFrame?.loaderId),
     };
     const removeListener = context.connection.onEvent((event) => {
         if (event.sessionId !== context.sessionId)
@@ -43,7 +43,7 @@ export const captureCdpScreenshot = async (context) => {
     finally {
         removeListener();
     }
-    const encoded = stringValue(result?.data);
+    const encoded = cdpStringValue(result?.data);
     const bytes = encoded === undefined ? undefined : decodeCanonicalBase64(encoded);
     if (bytes === undefined)
         throw new BrowserObservationError("inspect_web_page", "payload_limit");
@@ -89,8 +89,8 @@ const observeScreenshotNavigation = (event, mainFrameId, origins, state) => {
     if (event.method === "Page.frameNavigated" &&
         state.loaderId !== undefined &&
         state.loaderId !== "" &&
-        stringValue(frame?.loaderId) === state.loaderId &&
-        stringValue(frame?.url) === state.url)
+        cdpStringValue(frame?.loaderId) === state.loaderId &&
+        cdpStringValue(frame?.url) === state.url)
         return;
     state.changed = true;
     if (allowedSanitizedUrl(frame?.url, origins) === undefined)

package/dist/browser/CdpTargetEvents.js

@@ -0,0 +1,8 @@
+import { cdpStringValue, recordValue } from "./CdpCaptureValues.js";
+/** Match ordinary session envelopes and root detachment's parameter-scoped session identity. */
+export const cdpTargetEventMatches = (event, sessionId) => {
+    if (event.method !== "Target.detachedFromTarget")
+        return event.sessionId === sessionId;
+    return (sessionId !== undefined &&
+        cdpStringValue(recordValue(event.params)?.sessionId) === sessionId);
+};

package/dist/browser/CdpTargetSession.js

@@ -3,9 +3,9 @@ import {} from "../domain/browserObservationErrors.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { cdpTargetWebSocket, } from "./CdpEndpoint.js";
 /** Open one authorized target through its supported browser or page transport. */
-export const openCdpTargetSession = async (discovery, target, operation, signal) => {
+export const openCdpTargetSession = async (discovery, target, operation, signal, limits) => {
     const webSocket = cdpTargetWebSocket(discovery, target, operation);
-    const connection = await CdpConnection.connect(webSocket.url, operation, signal);
+    const connection = await CdpConnection.connect(webSocket.url, operation, signal, limits);
     if (webSocket.scope === "page")
         return { connection, sessionId: undefined };
     try {

package/dist/browser/CdpWebMcpDiscovery.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { inferJsonShape } from "../domain/jsonShape.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
-import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { captureFrames, mainFrameUrl, walkFrameTrees, } from "./CdpCaptureDocuments.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 /** Discover WebMCP registrations without evaluating or invoking page code. */
@@ -96,10 +96,13 @@ const initialFrameScope = (frameTree, frames, completeness) => {
         return scoped;
     for (const tree of walkFrameTrees(root, () => completeness.exclude("webmcp_tools", "invalid_protocol_value"))) {
         const frame = recordValue(tree.frame);
-        const frameId = stringValue(frame?.id);
+        const frameId = cdpStringValue(frame?.id);
         const prior = frameId === undefined ? undefined : scoped.get(frameId);
         if (frameId !== undefined && prior !== undefined)
-            scoped.set(frameId, { ...prior, loaderId: stringValue(frame?.loaderId) });
+            scoped.set(frameId, {
+                ...prior,
+                loaderId: cdpStringValue(frame?.loaderId),
+            });
     }
     return scoped;
 };
@@ -119,7 +122,7 @@ const ingestFrameScopeEvent = (event, state) => {
     }
 };
 const handleFrameDetached = (params, state) => {
-    const frameId = stringValue(params.frameId);
+    const frameId = cdpStringValue(params.frameId);
     if (frameId === undefined) {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
@@ -134,12 +137,12 @@ const handleFrameUpdate = (frame, state, documentCommitted) => {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
     }
-    const frameId = stringValue(frame?.id) ?? stringValue(frame?.frameId);
+    const frameId = cdpStringValue(frame?.id) ?? cdpStringValue(frame?.frameId);
     if (frameId === undefined) {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
     }
-    const rawUrl = stringValue(frame?.url);
+    const rawUrl = cdpStringValue(frame?.url);
     // Chromium can briefly commit an inherited, empty document while replacing
     // a subframe. That intermediate URL says nothing about the frame's eventual
     // scope or its registered tools; wait for the next committed URL (or the
@@ -164,7 +167,7 @@ const updateFrameScope = (frame, frameId, state, documentCommitted) => {
         return;
     }
     const previous = state.frames.get(frameId);
-    const loaderId = stringValue(frame?.loaderId);
+    const loaderId = cdpStringValue(frame?.loaderId);
     if (hasNewDocument(documentCommitted, previous, url.url, loaderId))
         removeFrameTools(frameId, state.tools);
     if (documentCommitted && state.transientFrames.has(frameId))
@@ -173,7 +176,7 @@ const updateFrameScope = (frame, frameId, state, documentCommitted) => {
         url: url.url,
         origin: url.origin,
         ...(loaderId === undefined ? {} : { loaderId }),
-        parentFrameId: (stringValue(frame?.parentId) ??
+        parentFrameId: (cdpStringValue(frame?.parentId) ??
             state.frames.get(frameId)?.parentFrameId ??
             "") ||
             null,
@@ -223,8 +226,8 @@ const ingestWebMcpEvent = (options) => {
         return;
     if (event.method === "WebMCP.toolsRemoved") {
         for (const removed of recordsValue(params.tools)) {
-            const name = stringValue(removed.name);
-            const frameId = stringValue(removed.frameId);
+            const name = cdpStringValue(removed.name);
+            const frameId = cdpStringValue(removed.frameId);
             if (name === undefined || frameId === undefined)
                 continue;
             for (const [key, tool] of tools)
@@ -236,7 +239,7 @@ const ingestWebMcpEvent = (options) => {
     if (event.method !== "WebMCP.toolsAdded")
         return;
     for (const declared of recordsValue(params.tools)) {
-        const frameId = stringValue(declared.frameId);
+        const frameId = cdpStringValue(declared.frameId);
         if (frameId !== undefined && transientFrames.has(frameId)) {
             if (!resolvedTransientFrames.has(frameId))
                 continue;
@@ -250,8 +253,8 @@ const ingestWebMcpEvent = (options) => {
     }
 };
 const normalizeTool = (value, input, frames, completeness) => {
-    const frameId = stringValue(value.frameId);
-    const name = stringValue(value.name);
+    const frameId = cdpStringValue(value.frameId);
+    const name = cdpStringValue(value.name);
     const frame = frameId === undefined ? undefined : frames.get(frameId);
     if (frameId === undefined ||
         name === undefined ||
@@ -260,10 +263,10 @@ const normalizeTool = (value, input, frames, completeness) => {
         completeness.exclude("webmcp_tools", "out_of_target_scope");
         return undefined;
     }
-    const description = stringValue(value.description) ?? "";
+    const description = cdpStringValue(value.description) ?? "";
     const annotations = recordValue(value.annotations);
     return {
-        tool_key: toolKey(frame.url, name),
+        tool_key: toolKey(frame.url, frameId, name),
         name,
         description,
         frame_id: frameId,
@@ -322,7 +325,10 @@ const buildWebMcpResult = (options) => {
         limitations,
     };
 };
-const toolKey = (frameUrl, name) => `webmcp_${createHash("sha256").update(`${frameUrl}\0${name}`).digest("hex")}`;
+const toolKey = (frameUrl, frameId, name) => 
+// Registrations without a known admitted frame are excluded above, so the
+// frame ID here always distinguishes owners and keys cannot collapse.
+`webmcp_${createHash("sha256").update(`${frameUrl}\0${frameId}\0${name}`).digest("hex")}`;
 const booleanOrNull = (value) => typeof value === "boolean" ? value : null;
 const integerOrNull = (value) => {
     const number = numberValue(value);

package/dist/browser/PlaywrightBrowserScenarioProvider.js

@@ -11,11 +11,8 @@ const lazyPlaywrightFactory = {
         return (await defaultFactory).open(scenario, options);
     },
 };
-export const PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-playwright-browser-scenario",
-    name: "REA Playwright browser scenario capture provider",
-    version: "1",
-});
+export { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const SNAPSHOT_KINDS = [
     "screenshot",
     "dom",
@@ -189,6 +186,7 @@ const runScenario = async (factory, scenario, options) => {
             start_origin: new URL(scenario.start_url.url).origin,
             action_count: scenario.actions.length,
             secret_references: scenario.secrets.map(({ secret_id: id }) => id).sort(),
+            network_content: scenario.capture.network,
         },
         duration_ms: Date.now() - startedAt,
         steps,
@@ -196,7 +194,10 @@ const runScenario = async (factory, scenario, options) => {
         completeness,
         limitations: [
             "Event sequence records provider receipt order; simultaneous browser causality is not inferred.",
-            "Response bodies are not retained.",
+            "Network content is retained only when selected; response bytes are browser-decoded, not compressed wire bytes.",
+            "Request bytes are limited to what Playwright exposes; not_exposed does not establish body absence or multipart file coverage.",
+            "Network content reads settle within 5 seconds each and never wait for unfinished responses or refetch them.",
+            "Playwright scenario events do not expose request initiator stacks; receipt order does not prove causality.",
             "Storage values are hashed only after declared-secret redaction.",
             ...(session.eventLimitations?.() ?? []),
             ...(session.mode === "connect"

package/dist/browser/PlaywrightElectronActiveProvider.js

@@ -3,23 +3,20 @@ import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { _electron as electron } from "playwright-core";
-import { electronActiveObservationResultSchema, } from "../domain/electronActiveObservation.js";
+import { electronActiveObservationResultSchema, } from "../domain/javascript/electronActiveObservation.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err, ok } from "../domain/result.js";
 import { cleanupOwnedProcessGroup, cleanupWindowsProcessTree, verifyNoTokenOwnedProcesses, } from "../process/ProcessOwnership.js";
-import { observeOwnedProcessLineage } from "../process/ProcessOwnershipObservation.js";
+import { observeOwnedProcessLineage, prepareProcessOwnershipInspection, systemProcessOwnershipHost, } from "../process/ProcessOwnershipObservation.js";
 import { selectCapturedProcessGroupIds } from "../process/ProcessOwnershipProcessTree.js";
 import { runElectronActions, readApplicationState, runWithExecutionLimits, } from "./PlaywrightElectronActiveActions.js";
 const OPERATION = "capture_electron_scenario";
 const STARTUP_TIMEOUT_MS = 60_000;
 /** Public identity for provider-owned Electron runtime experiments. */
-export const PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-playwright-electron-active",
-    name: "REA Playwright active Electron observation provider",
-    version: "1",
-});
+export { PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const hookPath = fileURLToPath(new URL("../../scripts/electron-active-hook.cjs", import.meta.url));
 const observableEventFamilies = [
     "app-lifecycle",
@@ -104,8 +101,12 @@ export class PlaywrightElectronActiveProvider {
         try {
             if (options.signal?.aborted === true)
                 throw new BrowserObservationError(OPERATION, "cancelled");
+            await prepareProcessOwnershipInspection(options.signal);
             const startupDeadline = Date.now() + STARTUP_TIMEOUT_MS;
             const paths = await canonicalPaths(input);
+            const captureBaseline = await systemProcessOwnershipHost.captureBaseline?.(options.signal);
+            if (options.signal?.aborted)
+                throw new BrowserObservationError(OPERATION, "cancelled");
             application = await electron.launch({
                 executablePath: paths.executable,
                 cwd: paths.root,
@@ -125,13 +126,18 @@ export class PlaywrightElectronActiveProvider {
                 expectedParentPid: process.pid,
                 expectedCommand: paths.executable,
                 sweepTokenOwnedProcesses: true,
+                ...(captureBaseline === undefined ? {} : { captureBaseline }),
             };
             const actions = await runElectronActions(application, input, options);
             const state = await runWithExecutionLimits(readApplicationState(application), options.signal);
             outcome = ok(createResult(paths, input, actions, state));
         }
         catch (cause) {
-            outcome = err(providerError(cause));
+            outcome = err(options.signal?.aborted === true &&
+                (cause === options.signal.reason ||
+                    (cause instanceof Error && cause.name === "AbortError"))
+                ? new BrowserObservationError(OPERATION, "cancelled", { cause })
+                : providerError(cause));
         }
         if (application !== undefined) {
             if (ownership !== undefined)
@@ -203,7 +209,7 @@ const cleanupElectronProcesses = async (ownership, lineage) => {
             return result;
         signaled ||= result.signaled;
     }
-    const remaining = await verifyNoTokenOwnedProcesses(ownership.runId);
+    const remaining = await verifyNoTokenOwnedProcesses(ownership.runId, undefined, ownership.captureBaseline);
     if (!remaining.cleaned)
         return remaining;
     return { cleaned: true, signaled };

package/dist/browser/PlaywrightScenarioEvents.js

@@ -1,4 +1,5 @@
 import { browserScenarioEventSchema, } from "../domain/browserScenarioCapture.js";
+import { PlaywrightScenarioNetwork } from "./network/PlaywrightScenarioNetwork.js";
 /** Arrival-ordered Playwright event capture with current-step attribution. */
 export class PlaywrightScenarioEvents {
     items = [];
@@ -9,8 +10,18 @@ export class PlaywrightScenarioEvents {
     ownsContext;
     pages = new Set();
     incompleteFamilies = new Set();
+    network;
+    stopNetwork;
+    sealed = false;
     constructor(options) {
-        this.enabled = options.enabled;
+        const network = options.network ?? {
+            request_body: false,
+            response_body: false,
+            header_values: false,
+        };
+        this.enabled = new Set(options.enabled);
+        if (network.request_body || network.response_body || network.header_values)
+            this.enabled = new Set([...this.enabled, "network"]);
         this.secrets = options.secrets;
         this.ownsContext = options.ownsContext === true;
         this.pages.add(options.page);
@@ -18,6 +29,13 @@ export class PlaywrightScenarioEvents {
             (options.context ?? options.page.context()).on("page", (page) => this.popup(page));
         if (this.enabled.has("network")) {
             const context = options.context ?? options.page.context();
+            const collector = new PlaywrightScenarioNetwork({
+                selection: network,
+                secrets: options.secrets,
+                emit: (event) => this.push(event),
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
+            });
+            this.network = collector;
             const inScope = (request) => {
                 if (this.ownsContext)
                     return true;
@@ -31,18 +49,32 @@ export class PlaywrightScenarioEvents {
                     return false;
                 }
             };
-            context.on("request", (request) => {
+            const onRequest = (request) => {
                 if (inScope(request))
-                    this.request("request", request);
-            });
-            context.on("response", (response) => {
+                    collector.request(request);
+            };
+            const onResponse = (response) => {
                 if (inScope(response.request()))
-                    this.response(response);
-            });
-            context.on("requestfailed", (request) => {
+                    collector.response(response);
+            };
+            const onFailed = (request) => {
                 if (inScope(request))
-                    this.request("request-failed", request);
-            });
+                    collector.failed(request);
+            };
+            const onFinished = (request) => {
+                if (inScope(request))
+                    collector.finished(request);
+            };
+            context.on("request", onRequest);
+            context.on("response", onResponse);
+            context.on("requestfailed", onFailed);
+            context.on("requestfinished", onFinished);
+            this.stopNetwork = () => {
+                context.off("request", onRequest);
+                context.off("response", onResponse);
+                context.off("requestfailed", onFailed);
+                context.off("requestfinished", onFinished);
+            };
         }
         this.observePage(options.page);
     }
@@ -55,15 +87,27 @@ export class PlaywrightScenarioEvents {
     lastSequence() {
         return this.sequence;
     }
+    /** Drain selected network content and freeze the result before browser teardown. */
+    async finish() {
+        this.stopNetwork?.();
+        this.stopNetwork = undefined;
+        try {
+            await this.network?.finish();
+        }
+        finally {
+            this.sealed = true;
+        }
+    }
     /** Report selected popup event families with unrecoverable pre-discovery gaps. */
     limitations() {
         const popupGaps = [...this.incompleteFamilies].map((family) => `Popup ${family} events before Page discovery are unavailable; later events are retained.`);
+        const gaps = [...popupGaps, ...(this.network?.limitations() ?? [])];
         return this.enabled.has("network") && !this.ownsContext
             ? [
                 "Shared-context network capture excludes requests without a known root or descendant Page frame.",
-                ...popupGaps,
+                ...gaps,
             ]
-            : popupGaps;
+            : gaps;
     }
     result() {
         return {
@@ -73,6 +117,8 @@ export class PlaywrightScenarioEvents {
         };
     }
     push(event) {
+        if (this.sealed)
+            return this.sequence;
         this.sequence += 1;
         const parsed = browserScenarioEventSchema.parse({
             ...event,
@@ -80,6 +126,7 @@ export class PlaywrightScenarioEvents {
             step_index: this.stepIndex,
         });
         this.items.push(parsed);
+        return this.sequence;
     }
     observePage(page) {
         if (this.enabled.has("console"))
@@ -120,45 +167,6 @@ export class PlaywrightScenarioEvents {
             url: location.url === "" ? null : this.safeUrl(location.url),
         });
     }
-    request(kind, request) {
-        const observation = {
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(request.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            header_names: Object.keys(request.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-        };
-        if (kind === "request-failed") {
-            this.push({
-                ...observation,
-                kind,
-                status: null,
-                failure: this.secrets.redact(request.failure()?.errorText ?? "unknown"),
-            });
-            return;
-        }
-        this.push({
-            ...observation,
-            kind,
-            status: null,
-            failure: null,
-        });
-    }
-    response(response) {
-        const request = response.request();
-        this.push({
-            kind: "response",
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(response.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            status: response.status(),
-            header_names: Object.keys(response.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-            failure: null,
-        });
-    }
     webSocket(socket) {
         const url = this.safeUrl(socket.url());
         this.push({ kind: "websocket-opened", url });