rea-agents 6.4.0 → 6.5.0

package/dist/browser/CdpSafeMetadata.js

@@ -1,5 +1,5 @@
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
-import { numberValue, cdpStringValue, } from "./CdpCaptureValues.js";
+import { cdpStringValue } from "./CdpCaptureValues.js";
 /** Normalize an allowlisted subset of response metadata and discard raw headers. */
 export const safeResponseMetadata = (requestId, url, response, allowedOrigins) => {
     const headers = normalizedHeaders(response.headers);
@@ -17,7 +17,7 @@ export const safeResponseMetadata = (requestId, url, response, allowedOrigins) =
             request_id: requestId,
             url,
             mime_type: boundedHeader(cdpStringValue(response.mimeType)),
-            content_length: nonnegativeInteger(headers.get("content-length")),
+            content_length: contentLength(headers.get("content-length")),
             content_encoding: boundedHeader(headers.get("content-encoding")),
             csp,
             links,
@@ -270,9 +270,13 @@ const policyToken = (value) => {
     const token = (value ?? "").trim().toLowerCase();
     return /^[a-z][a-z0-9_.\x2d]*$/u.test(token) ? token : null;
 };
-const nonnegativeInteger = (value) => {
-    const number = numberValue(value === undefined ? undefined : Number(value));
-    return number === undefined ? null : Math.max(0, Math.trunc(number));
+// RFC 9110 section 8.6: Content-Length = 1*DIGIT. Other spellings declare no length.
+const contentLength = (value) => {
+    const token = (value ?? "").trim();
+    if (!/^[0-9]+$/u.test(token))
+        return null;
+    const length = Number(token);
+    return Number.isSafeInteger(length) ? length : null;
 };
 const boundedHeader = (value) => value === undefined ? null : value.trim().toLowerCase();
 const unquote = (value) => value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;

package/dist/browser/CdpScreenshot.js

@@ -6,6 +6,7 @@ import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { captureFrames } from "./CdpCaptureDocuments.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { decodeCanonicalBase64 } from "../domain/webScreenshot.js";
+import { readPngHeaderDimensions } from "../domain/pngHeader.js";
 /** Capture the current viewport without navigation, evaluation, or page mutation. */
 export const captureCdpScreenshot = async (context) => {
     const origins = new Set(context.input.allowed_origins);
@@ -46,8 +47,10 @@ export const captureCdpScreenshot = async (context) => {
     const encoded = cdpStringValue(result?.data);
     const bytes = encoded === undefined ? undefined : decodeCanonicalBase64(encoded);
     if (bytes === undefined)
-        throw new BrowserObservationError("inspect_web_page", "payload_limit");
-    const dimensions = pngDimensions(bytes);
+        throw new BrowserObservationError("inspect_web_page", "protocol_error");
+    const dimensions = readPngHeaderDimensions(bytes);
+    if (dimensions === undefined)
+        throw new BrowserObservationError("inspect_web_page", "protocol_error");
     if (navigation.leftScope)
         throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
     const afterUrl = mainFrameUrl(after);
@@ -96,15 +99,3 @@ const observeScreenshotNavigation = (event, mainFrameId, origins, state) => {
     if (allowedSanitizedUrl(frame?.url, origins) === undefined)
         state.leftScope = true;
 };
-const pngDimensions = (bytes) => {
-    if (bytes.byteLength < 24 ||
-        !bytes.subarray(0, 8).equals(PNG_SIGNATURE) ||
-        bytes.subarray(12, 16).toString("ascii") !== "IHDR")
-        throw new BrowserObservationError("inspect_web_page", "protocol_error");
-    const width = bytes.readUInt32BE(16);
-    const height = bytes.readUInt32BE(20);
-    if (width === 0 || height === 0)
-        throw new BrowserObservationError("inspect_web_page", "protocol_error");
-    return { width, height };
-};
-const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);

package/dist/browser/CdpSnapshotStrings.js

@@ -0,0 +1,21 @@
+import { numberValue } from "./CdpCaptureValues.js";
+// DOMSnapshot interns an empty or null string as index -1 instead of a table
+// entry. Chrome uses it for element node values and empty attribute values.
+const CDP_EMPTY_STRING_INDEX = -1;
+/** Resolve a DOMSnapshot name index, which must reference a string entry. */
+export const cdpSnapshotString = (strings, index) => {
+    const integer = numberValue(index);
+    if (integer === undefined || !Number.isSafeInteger(integer) || integer < 0)
+        return undefined;
+    return strings[integer];
+};
+/** Resolve a DOMSnapshot value index, where -1 is the protocol's empty string. */
+export const cdpSnapshotValueString = (strings, index) => numberValue(index) === CDP_EMPTY_STRING_INDEX
+    ? ""
+    : cdpSnapshotString(strings, index);
+/** Whether flattened name/value attribute indexes all resolve. */
+export const cdpSnapshotAttributesResolve = (strings, attributes) => attributes.length % 2 === 0 &&
+    attributes.every((attribute, offset) => attribute !== undefined &&
+        (offset % 2 === 0
+            ? cdpSnapshotString(strings, attribute)
+            : cdpSnapshotValueString(strings, attribute)) !== undefined);

package/dist/browser/CdpTargetSession.js

@@ -1,13 +1,40 @@
 import { BrowserObservationError } from "../domain/browserObservationError.js";
-import {} from "../domain/browserObservationErrors.js";
 import { CdpConnection } from "./CdpConnection.js";
-import { cdpTargetWebSocket, } from "./CdpEndpoint.js";
+import { cdpTargetWebSocket, discoverCdpBrowserSocket, discoverCdpEndpoint, withCdpDiscoveryDeadline, } from "./CdpEndpoint.js";
+/**
+ * Discover one passive browser endpoint through its selected transport. A
+ * browser socket's handshake and discovery share one discovery deadline.
+ */
+export const openCdpEndpoint = async (endpoint, operation, signal, timeoutMs) => {
+    if (endpoint.transport === "http_discovery")
+        return {
+            discovery: await discoverCdpEndpoint(endpoint.url, operation, signal),
+            connection: undefined,
+        };
+    return await withCdpDiscoveryDeadline(operation, signal, async (deadlineSignal) => {
+        const connection = await CdpConnection.connect(endpoint.url, operation, deadlineSignal);
+        try {
+            return {
+                discovery: await discoverCdpBrowserSocket(connection, endpoint.url, operation, deadlineSignal),
+                connection,
+            };
+        }
+        catch (cause) {
+            await connection.close();
+            throw cause;
+        }
+    }, timeoutMs);
+};
 /** Open one authorized target through its supported browser or page transport. */
 export const openCdpTargetSession = async (discovery, target, operation, signal, limits) => {
     const webSocket = cdpTargetWebSocket(discovery, target, operation);
     const connection = await CdpConnection.connect(webSocket.url, operation, signal, limits);
     if (webSocket.scope === "page")
         return { connection, sessionId: undefined };
+    return await attachCdpTargetSession(connection, target, operation, signal);
+};
+/** Attach one target through an open browser socket, which the session then owns. */
+export const attachCdpTargetSession = async (connection, target, operation, signal) => {
     try {
         const attached = await connection.send("Target.attachToTarget", { targetId: target.id, flatten: true }, undefined, signal);
         return { connection, sessionId: attachedSessionId(attached, operation) };

package/dist/browser/CdpWebMcpDiscovery.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { digestCanonicalValue } from "../domain/canonicalDigest.js";
-import { compositeKey } from "../domain/unicodeCodePointOrder.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../domain/unicodeCodePointOrder.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
@@ -289,6 +289,23 @@ const normalizeTool = (value, input, frames, completeness) => {
     }
     const description = cdpStringValue(value.description) ?? "";
     const annotations = recordValue(value.annotations);
+    const malformedAnnotations = Object.hasOwn(value, "annotations") && annotations === undefined;
+    if (malformedAnnotations)
+        completeness.exclude("webmcp_tools", "invalid_protocol_value");
+    const annotation = (key) => {
+        if (annotations === undefined || !Object.hasOwn(annotations, key))
+            return null;
+        const hint = annotations[key];
+        if (typeof hint === "boolean")
+            return hint;
+        completeness.exclude("webmcp_tools", "invalid_protocol_value");
+        return null;
+    };
+    const consequential = annotation("consequential");
+    const unknownConsequential = malformedAnnotations ||
+        (annotations !== undefined &&
+            Object.hasOwn(annotations, "consequential") &&
+            typeof annotations.consequential !== "boolean");
     const declaration = jsonValueSchema.safeParse(value.inputSchema);
     if (!declaration.success)
         completeness.exclude("webmcp_tools", "invalid_protocol_value");
@@ -308,9 +325,10 @@ const normalizeTool = (value, input, frames, completeness) => {
             ? digestCanonicalValue(schema)
             : null,
         annotations: {
-            read_only: booleanOrNull(annotations?.readOnly),
-            untrusted_content: booleanOrNull(annotations?.untrustedContent),
-            autosubmit: booleanOrNull(annotations?.autosubmit),
+            read_only: annotation("readOnly"),
+            untrusted_content: annotation("untrustedContent"),
+            ...(unknownConsequential ? {} : { consequential }),
+            autosubmit: annotation("autosubmit"),
         },
         registration_source: registrationSource(recordValue(value.stackTrace), new Set(input.allowed_origins)),
         trust: "page-declared-untrusted",
@@ -341,7 +359,7 @@ const buildWebMcpResult = (options) => {
         status: available ? "available" : "unavailable",
         tools: {
             total: tools.size + completeness.droppedTotal,
-            items: [...tools.values()].sort((left, right) => left.tool_key.localeCompare(right.tool_key)),
+            items: [...tools.values()].sort((left, right) => compareUnicodeCodePoints(left.tool_key, right.tool_key)),
         },
         completeness: completeness.snapshot(),
         limitations,
@@ -354,7 +372,6 @@ const toolKey = (frameUrl, frameId, name) =>
 `webmcp_${createHash("sha256")
     .update(compositeKey([frameUrl, frameId, name]))
     .digest("hex")}`;
-const booleanOrNull = (value) => typeof value === "boolean" ? value : null;
 const integerOrNull = (value) => {
     const number = numberValue(value);
     return number === undefined ? null : Math.max(0, Math.trunc(number));

package/dist/browser/PlaywrightBrowserScenarioProvider.js

@@ -89,7 +89,7 @@ const executeStep = async (input) => {
             eventEnd: session.lastEventSequence(),
             artifacts: unavailableArtifacts(requested, "action was not executed after an earlier failure"),
         });
-    const actionStartedAt = Date.now();
+    const actionStartedAt = performance.now();
     session.setStep(stepIndex);
     const requestCancelled = () => signal?.aborted === true;
     let outcome = {
@@ -118,7 +118,7 @@ const executeStep = async (input) => {
         stepId: action.step_id,
         action: action.action,
         ...outcome,
-        elapsedMs: Date.now() - actionStartedAt,
+        elapsedMs: Math.max(0, Math.round(performance.now() - actionStartedAt)),
         beforeUrl,
         afterUrl: session.sanitizeUrl(session.currentUrl()),
         eventStart,
@@ -138,7 +138,7 @@ const globalCompleteness = (scenario, session, steps) => {
 const runScenario = async (openSession, scenario, options, retainCleanup) => {
     if (options.signal?.aborted === true)
         throw new BrowserObservationError(OPERATION, "cancelled");
-    const startedAt = Date.now();
+    const startedAt = performance.now();
     const session = await openSession(scenario, {
         ...(options.signal === undefined ? {} : { signal: options.signal }),
         retainCleanup,
@@ -149,7 +149,7 @@ const runScenario = async (openSession, scenario, options, retainCleanup) => {
         steps.push(await initialStep({
             session,
             scenario,
-            elapsedMs: Date.now() - startedAt,
+            elapsedMs: Math.max(0, Math.round(performance.now() - startedAt)),
             signal: options.signal,
         }));
         let failed = false;

package/dist/browser/PlaywrightElectronActiveActions.js

@@ -42,7 +42,7 @@ const windowMetadataSchema = z.strictObject({
 export const runElectronActions = async (application, input, options) => {
     const actions = [];
     for (const action of input.actions) {
-        const actionStartedAt = Date.now();
+        const actionStartedAt = performance.now();
         const windowIndex = actionWindowIndex(action);
         let selectedWindow;
         try {
@@ -73,7 +73,7 @@ export const runElectronActions = async (application, input, options) => {
                 window_index: windowIndex,
                 target: selectedWindow === undefined ? null : `window:${String(windowIndex)}`,
                 status: "completed",
-                elapsed_ms: Date.now() - actionStartedAt,
+                elapsed_ms: Math.max(0, Math.round(performance.now() - actionStartedAt)),
                 error: null,
             });
         }
@@ -84,7 +84,7 @@ export const runElectronActions = async (application, input, options) => {
                 window_index: windowIndex,
                 target: selectedWindow === undefined ? null : `window:${String(windowIndex)}`,
                 status: options.signal?.aborted ? "cancelled" : "failed",
-                elapsed_ms: Date.now() - actionStartedAt,
+                elapsed_ms: Math.max(0, Math.round(performance.now() - actionStartedAt)),
                 error: safeActionErrorMessage(cause),
             });
             break;
@@ -233,7 +233,7 @@ export const runWithExecutionLimits = async (operation, signal, deadline) => {
     const interruptions = [];
     if (deadline !== undefined)
         interruptions.push(new Promise((_, reject) => {
-            timer = setTimeout(() => reject(new BrowserObservationError(OPERATION, "timeout")), Math.max(1, deadline - Date.now()));
+            timer = setTimeout(() => reject(new BrowserObservationError(OPERATION, "timeout")), Math.max(1, deadline - performance.now()));
         }));
     if (signal !== undefined)
         interruptions.push(new Promise((_, reject) => {

package/dist/browser/PlaywrightElectronActiveProjection.js

@@ -37,14 +37,13 @@ const eventFamily = (kind, processType) => {
         return processType === "renderer" ? "renderer-ipc" : "ipc";
     return ipcEventKinds.has(kind) ? "ipc" : kind;
 };
-const createCoverage = (hookSnapshot) => {
+const normalizeObservations = (hookSnapshot) => {
     const observedEventFamilies = [
         ...new Set([
             ...hookSnapshot.events.map(({ kind, process_type }) => eventFamily(kind, process_type)),
             ...hookSnapshot.dropped_event_families.map(({ family }) => family),
         ]),
     ].sort();
-    const unavailableEventFamilies = new Set(observableEventFamilies.filter((family) => !observedEventFamilies.includes(family)));
     const observedRoles = [
         ...new Set([
             ...hookSnapshot.events.flatMap(({ process_type, kind }) => [
@@ -63,6 +62,11 @@ const createCoverage = (hookSnapshot) => {
             ...hookSnapshot.dropped_event_roles.map(({ role }) => role),
         ]),
     ].sort();
+    return { observedEventFamilies, observedRoles };
+};
+const createCoverage = (hookSnapshot, observations) => {
+    const { observedEventFamilies, observedRoles } = observations;
+    const unavailableEventFamilies = new Set(observableEventFamilies.filter((family) => !observedEventFamilies.includes(family)));
     if (!observedRoles.includes("preload"))
         unavailableEventFamilies.add("preload");
     if (!observedRoles.includes("renderer"))
@@ -75,9 +79,12 @@ const createCoverage = (hookSnapshot) => {
         pre_capture_activity: "unavailable",
     };
 };
+const hasUnattributedDroppedPreloadFamily = (hookSnapshot) => hookSnapshot.dropped_event_families.some(({ family, count }) => family === "preload" && count > 0);
+const hasObservedPreloadConfiguration = (observations) => observations.observedEventFamilies.includes("preload-configuration");
 /** Project one provider hook snapshot into the canonical public result. */
 export const projectElectronActiveCapture = (paths, actions, state) => {
     const { hookSnapshot } = state;
+    const observations = normalizeObservations(hookSnapshot);
     const ipcEvents = hookSnapshot.events.filter(({ kind }) => ipcEventKinds.has(kind));
     return electronActiveObservationResultSchema.parse({
         application: {
@@ -115,17 +122,22 @@ export const projectElectronActiveCapture = (paths, actions, state) => {
             observed_runtime: hookSnapshot.observed_runtime,
             dropped_runtime: hookSnapshot.dropped_runtime,
         },
-        coverage: createCoverage(hookSnapshot),
+        coverage: createCoverage(hookSnapshot, observations),
         limitations: [
             "IPC payloads are represented by value shapes; payload values are never retained.",
             "IPC direction and sender/receiver identifiers are observed only where Electron exposes them at the hooked boundary.",
             "The runtime timeline records lifecycle, navigation, shell, permission, popup, download, protocol, preload, native-addon, process, and IPC events; activity before hook installation is unavailable.",
             "The preload and renderer process contexts are not instrumented by the main-process -r hook; preload configuration and contextBridge API-shape events are main-boundary observations, not proof of renderer-side execution.",
-            ...(!hookSnapshot.events.some(({ kind }) => kind === "preload")
+            ...(!hasObservedPreloadConfiguration(observations)
                 ? [
                     "Preload configuration was not exposed by the observed Electron window metadata. Preload paths and execution remain unavailable.",
                 ]
                 : []),
+            ...(hasUnattributedDroppedPreloadFamily(hookSnapshot)
+                ? [
+                    "Dropped preload-family events were not attributed to preload configuration; independently aggregated event families and roles cannot establish that relationship.",
+                ]
+                : []),
             "Process metrics are an Electron API snapshot and do not prove hostile-local-user isolation.",
             ...(hookSnapshot.dropped > 0
                 ? [

package/dist/browser/PlaywrightElectronActiveProvider.js

@@ -1,8 +1,5 @@
-import { realpath } from "node:fs/promises";
-import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
-import { _electron as electron } from "playwright-core";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
@@ -20,7 +17,9 @@ const hookPath = fileURLToPath(new URL("../../scripts/electron-active-hook.cjs",
 export class PlaywrightElectronActiveProvider {
     environment;
     launch;
-    constructor(environment, launch = (options) => electron.launch(options)) {
+    constructor(environment, 
+    // Load Playwright only when a capture launches; MCP startup stays off its module graph.
+    launch = async (options) => (await import("playwright-core"))._electron.launch(options)) {
         this.environment = environment;
         this.launch = launch;
     }
@@ -41,18 +40,23 @@ export class PlaywrightElectronActiveProvider {
             if (options.signal?.aborted === true)
                 throw new BrowserObservationError(OPERATION, "cancelled");
             await prepareProcessOwnershipInspection(options.signal);
-            const startupDeadline = Date.now() + STARTUP_TIMEOUT_MS;
-            paths = await canonicalPaths(input);
+            const startupDeadline = performance.now() + STARTUP_TIMEOUT_MS;
+            paths = {
+                executable: input.executable_path,
+                application: input.application_path,
+                root: input.application_root,
+            };
             const captureBaseline = await systemProcessOwnershipHost.captureBaseline?.(options.signal);
             if (options.signal?.aborted)
                 throw new BrowserObservationError(OPERATION, "cancelled");
-            application = await this.launch({
+            const launchOptions = {
                 executablePath: paths.executable,
                 cwd: paths.root,
                 env: safeElectronEnvironment(this.environment, runId),
                 args: ["-r", hookPath, paths.application, ...input.args],
-                timeout: Math.max(1, startupDeadline - Date.now()),
-            });
+                timeout: Math.max(1, startupDeadline - performance.now()),
+            };
+            application = await containLaunchRejections(() => this.launch(launchOptions));
             const leaderPid = application.process().pid;
             if (typeof leaderPid !== "number" ||
                 !Number.isSafeInteger(leaderPid) ||
@@ -70,7 +74,7 @@ export class PlaywrightElectronActiveProvider {
             lineage = await observeOwnedProcessLineage(ownership);
             initialState = await readApplicationState(application);
             actions = await runElectronActions(application, input, options);
-            const state = await runWithExecutionLimits(readApplicationState(application), undefined, options.signal?.aborted ? Date.now() + 5_000 : undefined);
+            const state = await runWithExecutionLimits(readApplicationState(application), undefined, options.signal?.aborted ? performance.now() + 5_000 : undefined);
             capture = projectElectronActiveCapture(paths, actions, state);
             outcome = options.signal?.aborted
                 ? err(new BrowserObservationError(OPERATION, "cancelled", {
@@ -82,20 +86,18 @@ export class PlaywrightElectronActiveProvider {
                 : ok(capture);
         }
         catch (cause) {
-            if (options.signal?.aborted &&
-                paths !== undefined &&
-                initialState !== undefined) {
+            if (paths !== undefined && initialState !== undefined) {
                 const retainedCapture = projectElectronActiveCapture(paths, actions, initialState);
                 capture = {
                     ...retainedCapture,
                     limitations: [
                         ...retainedCapture.limitations,
-                        `Final Electron state was unavailable after cancellation: ${cause instanceof Error ? cause.message : String(cause)}. Windows, metrics, IPC, and timeline are the snapshot collected before actions and may omit their effects.`,
+                        `Capture stopped after the initial pre-action snapshot: ${cause instanceof Error ? cause.message : String(cause)}. Final Windows, metrics, IPC, and timeline state is unknown; the retained snapshot may omit action effects.`,
                     ],
                 };
             }
-            outcome = err(options.signal?.aborted === true
-                ? new BrowserObservationError(OPERATION, "cancelled", {
+            if (options.signal?.aborted === true)
+                outcome = err(new BrowserObservationError(OPERATION, "cancelled", {
                     cause,
                     ...(capture === undefined
                         ? {}
@@ -105,8 +107,16 @@ export class PlaywrightElectronActiveProvider {
                                 capture,
                             },
                         }),
-                })
-                : providerError(cause));
+                }));
+            else {
+                const error = providerError(cause);
+                if (capture !== undefined)
+                    error.retainPartialObservation({
+                        kind: "electron-active-observation",
+                        capture,
+                    });
+                outcome = err(error);
+            }
         }
         if (application !== undefined) {
             if (ownership !== undefined) {
@@ -116,7 +126,7 @@ export class PlaywrightElectronActiveProvider {
             }
             let closeError;
             try {
-                await runWithExecutionLimits(application.close(), undefined, Date.now() + 5_000);
+                await runWithExecutionLimits(application.close(), undefined, performance.now() + 5_000);
             }
             catch (cause) {
                 closeError = cause;
@@ -257,17 +267,7 @@ export const cleanupElectronProcesses = async (ownership, lineage, host = {
             }),
     };
 };
-const canonicalPaths = async (input) => {
-    const [executable, application] = await Promise.all([
-        realpath(input.executable_path),
-        realpath(input.application_path),
-    ]);
-    const root = input.application_root === undefined
-        ? dirname(application)
-        : await realpath(input.application_root);
-    return { executable, application, root };
-};
-const safeElectronEnvironment = (environment, runId) => Object.fromEntries([
+export const safeElectronEnvironment = (environment, runId, platform = process.platform) => Object.fromEntries([
     ...[
         "HOME",
         "LANG",
@@ -277,11 +277,84 @@ const safeElectronEnvironment = (environment, runId) => Object.fromEntries([
         "USER",
         "DISPLAY",
         "WAYLAND_DISPLAY",
+        ...(platform === "win32"
+            ? [
+                "SYSTEMROOT",
+                "TEMP",
+                "APPDATA",
+                "LOCALAPPDATA",
+                "USERPROFILE",
+                "COMSPEC",
+                "PATHEXT",
+                "PROGRAMDATA",
+                "ALLUSERSPROFILE",
+                "USERNAME",
+                "SYSTEMDRIVE",
+                "HOMEDRIVE",
+                "HOMEPATH",
+            ]
+            : []),
     ]
         .map((name) => [name, environment[name]])
         .filter((entry) => entry[1] !== undefined),
     ["REA_PROCESS_RUN_ID", runId],
 ]);
+const PLAYWRIGHT_INTERNAL_FRAME = /playwright-core[\\/]lib[\\/]/;
+const activeLaunches = new Set();
+const heldLaunchRejections = new Map();
+const holdLaunchRejection = (reason, promise) => {
+    if (!(reason instanceof Error) ||
+        !PLAYWRIGHT_INTERNAL_FRAME.test(reason.stack ?? ""))
+        throw reason;
+    if (!heldLaunchRejections.has(promise))
+        heldLaunchRejections.set(promise, {
+            reason,
+            candidates: new Set(activeLaunches),
+            hadExternalListener: process
+                .listeners("unhandledRejection")
+                .some((listener) => listener !== holdLaunchRejection),
+        });
+};
+const forwardLaunchRejection = (reason, hadExternalListener) => {
+    // Listeners present at the original event already observed it. When the
+    // holding listener was the only listener, restore Node's fatal behavior.
+    if (!hadExternalListener)
+        process.nextTick(() => {
+            throw reason;
+        });
+};
+/** Playwright leaves rejected launch promises unhandled; absorb only those that repeat this launch's failure. */
+const containLaunchRejections = async (launch) => {
+    const scope = {};
+    if (activeLaunches.size === 0)
+        process.on("unhandledRejection", holdLaunchRejection);
+    activeLaunches.add(scope);
+    try {
+        return await launch();
+    }
+    catch (cause) {
+        scope.failure = cause;
+        throw cause;
+    }
+    finally {
+        await new Promise((resolve) => setImmediate(resolve));
+        activeLaunches.delete(scope);
+        if (activeLaunches.size === 0)
+            process.off("unhandledRejection", holdLaunchRejection);
+        for (const [promise, { reason, candidates, hadExternalListener },] of heldLaunchRejections) {
+            if (!candidates.delete(scope))
+                continue;
+            if (scope.failure instanceof Error &&
+                reason.message !== "" &&
+                scope.failure.message.includes(reason.message))
+                heldLaunchRejections.delete(promise);
+            else if (candidates.size === 0) {
+                heldLaunchRejections.delete(promise);
+                forwardLaunchRejection(reason, hadExternalListener);
+            }
+        }
+    }
+};
 const providerError = (cause) => cause instanceof AnalysisError
     ? cause
     : new ProviderAdapterError(PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY.id, OPERATION, {

package/dist/browser/PlaywrightExecutionBoundary.js

@@ -8,11 +8,11 @@ export const withPlaywrightExecutionBoundary = (work, timeoutMs, signal) => {
     return new Promise((resolve, reject) => {
         let settled = false;
         let timer;
-        const deadline = timeoutMs === undefined ? undefined : Date.now() + timeoutMs;
+        const deadline = timeoutMs === undefined ? undefined : performance.now() + timeoutMs;
         const scheduleTimeout = () => {
             if (deadline === undefined)
                 return;
-            const remaining = deadline - Date.now();
+            const remaining = deadline - performance.now();
             if (remaining <= 0) {
                 fail(new AnalysisTimeoutError(OPERATION, timeoutMs ?? 0));
                 return;

package/dist/browser/PlaywrightScenarioBrowser.js

@@ -1,12 +1,14 @@
 import { chmod, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { chromium, } from "playwright-core";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { isLiteralLoopbackHostname } from "../domain/browserObservation.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { withPlaywrightExecutionBoundary } from "./PlaywrightExecutionBoundary.js";
 const OPERATION = "capture_browser_scenario";
+// Closing a real Chrome persistent context can take several seconds even when
+// it succeeds. The shorter operation deadline must not misreport cleanup.
+const CLEANUP_CONFIRMATION_TIMEOUT_MS = 30_000;
 const throwIfScenarioCancelled = (signal) => {
     if (signal?.aborted === true)
         throw new BrowserObservationError(OPERATION, "cancelled");
@@ -26,7 +28,7 @@ export class PlaywrightScenarioBrowserCleanupOwner {
     get browserClosed() {
         return this.#browserClosed;
     }
-    close(finishEvents, signal) {
+    close(finishEvents) {
         const cleanup = this.#closePromise ?? this.#closeResources(finishEvents);
         if (this.#closePromise === undefined) {
             this.#closePromise = cleanup;
@@ -36,11 +38,11 @@ export class PlaywrightScenarioBrowserCleanupOwner {
                 this.resources.onSettled?.(this.#browserClosed);
             });
         }
-        return this.#awaitCleanup(cleanup, signal);
+        return this.#awaitCleanup(cleanup);
     }
-    async #awaitCleanup(cleanup, signal) {
+    async #awaitCleanup(cleanup) {
         try {
-            await withPlaywrightExecutionBoundary(() => cleanup, 1_000, signal);
+            await withPlaywrightExecutionBoundary(() => cleanup, CLEANUP_CONFIRMATION_TIMEOUT_MS);
         }
         catch (cause) {
             throw new BrowserObservationError(OPERATION, "cleanup_failed", {
@@ -334,7 +336,8 @@ const openAttachedScenarioBrowser = async (browserRequest, environment, launcher
 };
 /** Launch or attach using the caller-selected environment and browser engine. */
 export const openPlaywrightScenarioBrowser = async (scenario, environment, options = {}) => {
-    const launcher = options.launcher ?? chromium;
+    // Load Playwright only when a scenario opens; MCP startup stays off its module graph.
+    const launcher = options.launcher ?? (await import("playwright-core")).chromium;
     if (scenario.browser.mode === "connect")
         return openAttachedScenarioBrowser(scenario.browser, scenario.environment, launcher, options.signal, options.retainCleanup);
     const profilePath = await mkdtemp(join(tmpdir(), "rea-browser-scenario-"));