sourcemonkey 0.0.0-stage → 0.5.0

package/dist/extension/concurrency.js

@@ -0,0 +1,186 @@
+// Bounded-concurrency fan-out.
+//
+// Every fan-out over a collection's scripts runs through here, because
+// the unbounded form is a crash rather than a slowdown. One promise per
+// scanned file means one simultaneous fetch per script, each holding a
+// decoded body plus any prefetched `@require` / `@resource` payloads;
+// across a few thousand scripts that peak is enough to take the whole
+// extension process down with an out-of-memory abort. Chrome surfaces
+// that only as "this extension crashed", with no JavaScript error
+// anywhere, so it is not a failure the logs will ever explain.
+//
+// Bounds the in-flight working set, not the total: callers still retain
+// every result, so a large enough collection is still a large enough
+// peak.
+// ---------- Refresh limits ----------
+//
+// These nest, so read them as a product. Refreshing one collection uses
+// only the inner limit; "Refresh All" runs the outer limit's worth of
+// collections, each with its own inner set:
+//
+//   worst-case fetches in flight
+//     = FETCH_COLLECTIONS_CONCURRENCY × FETCH_SCRIPTS_PER_COLLECTION_CONCURRENCY
+//
+// The balance leans on the inner one because that's the limit the
+// common cases actually hit: most profiles have one or a few
+// collections, and a per-collection Refresh button never engages the
+// outer limit at all. Making the outer limit the larger of the two
+// would only speed up a profile with many collections while capping the
+// single-collection case that everyone hits.
+// How many scripts a single collection's refresh fetches at once.
+//
+// Chosen for memory, not throughput: each in-flight entry can hold a
+// script body plus its dependency payloads, so the cap is what keeps
+// peak usage proportional to the limit instead of to the collection
+// size. Large enough to keep the network and the file reader busy. (For
+// an HTTP/1.1 host the browser's own ~6-per-host connection limit is a
+// second backstop in the same range, but that is not something to lean
+// on: an HTTP/2 host multiplexes and imposes no such bound, and file://
+// reads have no per-host limit at all.)
+export const FETCH_SCRIPTS_PER_COLLECTION_CONCURRENCY = 16;
+// How many collections a "Refresh All" pass works on at once.
+//
+// Deliberately the smaller of the pair — see the note above. It exists
+// to stop the product from exploding on a many-collection profile, not
+// to make that profile fast.
+export const FETCH_COLLECTIONS_CONCURRENCY = 2;
+// ---------- Directory-scan limits ----------
+//
+// A scan lists a directory, then lists each subdirectory it found. Those
+// siblings are independent, but walking them with an `await` in the loop
+// made the whole scan one round trip per directory — measured at 195ms
+// for a local tree of 78 directories, and 1151ms for a GitHub repo whose
+// listing needs four API calls. The depth cap means these nest at most
+// twice, so read each as a product with itself.
+// Sibling `file://` directories listed at once.
+//
+// The larger of the pair: a local listing is a cheap read with no
+// per-host connection limit to respect, and deep trees are the common
+// shape (a userscripts folder organised by site).
+export const SCAN_DIRS_CONCURRENCY = 12;
+// Sibling GitHub directories listed at once.
+//
+// Deliberately small, and NOT for memory: every listing is a request
+// against api.github.com, which applies a secondary limit to bursts of
+// concurrent requests from one client on top of the hourly quota. Being
+// throttled costs far more than the serialization this saves, and the
+// win here is mostly the first fan-out anyway — a repo needing four
+// calls goes from four round trips to two.
+export const SCAN_GITHUB_DIRS_CONCURRENCY = 4;
+// ---------- Update-probe limits ----------
+//
+// Their own pair rather than a reuse of the refresh limits above: the
+// scripts handed to one probe pass can span every collection, so neither
+// refresh limit describes the shape. Same nesting rule, though — read
+// them as a product.
+// How many scripts are probed for updates at once.
+//
+// This is the one that binds — a script yields at most two probe URLs,
+// so the inner limit never does.
+//
+// It was 3, on the reasoning that a probe is an annotation nothing
+// waits on. That is true of the per-script caller, which fires and
+// forgets on the navigation path, and false of the collection ones: a
+// Refresh / Refresh All awaits the probe pass so the row is current
+// when the spinner stops. The limit sized for the caller that doesn't
+// wait was being paid by the two that do — measured at 1772ms for 30
+// probed scripts, ten serialized rounds of a couple-KB header fetch.
+//
+// So it is sized for the awaiting caller now. Still bounded, because
+// the pass can span every collection at once and the nesting rule below
+// still applies; a probe is also cheap in the way that matters here —
+// it holds one small response, not a script body plus its dependency
+// payloads, which is what forces the refresh limits to stay low.
+export const PROBE_SCRIPTS_CONCURRENCY = 10;
+// How many of ONE script's probe URLs are fetched at once.
+//
+// A guard rather than a working limit: `probeTargets` yields at most two
+// entries per script (`@updateURL` and `@downloadURL`, deduped by URL),
+// so the list never reaches this cap. It is here so that adding a third
+// probe target kind can't quietly turn the per-script step into an
+// unbounded fan-out — the failure this whole module exists to prevent.
+export const PROBE_URLS_PER_SCRIPT_CONCURRENCY = 4;
+// ---------- Parse-check limit ----------
+// How many rows the registration-time re-check compiles at once
+// (`verifyParseChecks`).
+//
+// The list this bounds is normally empty — a row keeps its verdict
+// until its content changes. The pass that isn't empty is the first
+// sync after a SourceMonkey update: `parseCheckKey` carries the
+// extension version (how we wrap the program decides what parses), so
+// an upgrade makes every stored row stale at once, and every compile
+// composes the body plus each `@require` in memory before shipping it
+// to the sandbox. Registration waits on the whole pass, so this is a
+// memory bound on a step that runs before any script is injected.
+export const PARSE_RECHECK_CONCURRENCY = 4;
+// Run `fn` over `items` with at most `limit` calls outstanding.
+//
+// Results come back in `items` order regardless of completion order, so
+// this is a drop-in replacement for `Promise.all(items.map(fn))`.
+//
+// Rejection behavior also matches `Promise.all`, in both halves — and
+// the second half is the subtle one:
+//
+//   - The first rejection rejects the whole call immediately. The caller
+//     does not wait out the rest of the list to hear about a failure.
+//   - Every item still RUNS. No work is cancelled (there is nothing to
+//     cancel it with); the pool keeps draining in the background after
+//     the caller has been rejected, and those results are discarded.
+//
+// The second half is why a worker swallows its item's rejection instead
+// of letting it break the loop. A throwing `fn` that killed its worker
+// would be fine for a one-off failure — the other workers drain the
+// list — but a SYSTEMIC failure (every item throws) would kill every
+// worker in turn and silently skip the tail of the list. That is the
+// case that matters here: an out-of-quota `chrome.storage.local` write
+// fails for every collection, not just one.
+//
+// Callers that need per-item failures to be survivable should return a
+// failure value rather than throwing, which is what the fetch paths do.
+export async function mapWithConcurrency(items, limit, fn) {
+    if (items.length === 0)
+        return [];
+    // A limit at or above the item count has no work to do beyond
+    // Promise.all, and a non-positive limit would deadlock the workers
+    // below — treat both as "no bound".
+    if (limit >= items.length || limit <= 0) {
+        return await Promise.all(items.map((item, i) => fn(item, i)));
+    }
+    const out = new Array(items.length);
+    // Rejects the caller the moment the first item fails, while the pool
+    // below carries on draining. Never resolves — on the success path the
+    // drain is what settles the race.
+    let failNow;
+    const firstFailure = new Promise((_, reject) => { failNow = reject; });
+    let failed = false;
+    // Shared cursor: each worker repeatedly claims the next unstarted
+    // index. Self-balancing — a worker that draws a slow item doesn't hold
+    // up items a free worker could be running, which a fixed chunked split
+    // would.
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            try {
+                out[i] = await fn(items[i], i);
+            }
+            catch (err) {
+                // Reported, not rethrown: a worker that died here would stop
+                // claiming items, and if every item fails that skips the tail of
+                // the list entirely. See the note on rejection above.
+                if (!failed) {
+                    failed = true;
+                    failNow(err);
+                }
+            }
+        }
+    };
+    const drained = Promise.all(Array.from({ length: limit }, () => worker()));
+    // Workers never reject, so `drained` can only resolve — the race
+    // settles on `firstFailure` for a failure and on `drained` otherwise,
+    // and neither branch leaves an unhandled rejection behind.
+    await Promise.race([drained, firstFailure]);
+    return out;
+}

package/dist/extension/connect-grants.js

@@ -0,0 +1,109 @@
+// What the user has told SourceMonkey about the hosts a script's
+// `GM_xmlhttpRequest` may reach beyond its `@connect` rules: the
+// answers to the connection prompt (`connect-prompt.ts`), read by the
+// worker before it asks and by the script's page, which lists them
+// under Network access and can take them back.
+//
+// - Allowed and denied hosts persist in one row per script
+//   (`chrome.storage.local`), across refreshes and updates of the
+//   script, until reset on the script's page. The row goes when the
+//   script is removed.
+//
+// Hosts are `URL.hostname`s, lowercased: one host each, no subdomains,
+// any port (as `@connect` matches hosts).
+import { assertWorkerContext } from '../run-context.js';
+// The prompt window's page, and what it sends the worker: the answer,
+// and while it waits, a message every so often so the worker isn't
+// stopped for being idle (pending work alone doesn't count) and lose
+// the requests waiting on it. Here rather than in `connect-prompt.ts`
+// so the page needn't load the worker's side.
+export const CONNECT_PROMPT_PAGE = 'connect-prompt.html';
+export const CONNECT_ANSWER_MESSAGE = 'sm:connect-answer';
+export const CONNECT_PROMPT_ALIVE_MESSAGE = 'sm:connect-prompt-alive';
+// Each change reads the row and writes it back, so two at once (two
+// prompts answered together) would lose one. Within one context they
+// take turns; the worker and a script's page changing the same script
+// in the same moment is left to chance.
+let queue = Promise.resolve();
+function serialized(fn) {
+    const run = queue.then(fn, fn);
+    queue = run.catch(() => undefined);
+    return run;
+}
+const GRANTS_PREFIX = 'connectGrants:';
+export function connectGrantsKey(scriptId) {
+    return GRANTS_PREFIX + scriptId;
+}
+export async function getConnectGrants(scriptId) {
+    const key = connectGrantsKey(scriptId);
+    const row = (await chrome.storage.local.get(key))[key];
+    return {
+        hosts: Array.isArray(row?.hosts) ? row.hosts : [],
+        ...(row?.allHosts ? { allHosts: true } : {}),
+        ...(Array.isArray(row?.denied) && row.denied.length > 0 ? { denied: row.denied } : {}),
+    };
+}
+// The user's standing answer about `host` for this script, if any. A
+// host is never both allowed and denied (each answer clears the other),
+// and "all sites" clears all denials.
+export async function connectAnswer(scriptId, host) {
+    const grants = await getConnectGrants(scriptId);
+    if (grants.denied?.includes(host))
+        return 'deny';
+    if (grants.allHosts || grants.hosts.includes(host))
+        return 'allow';
+    return null;
+}
+// Allow `host`, or with `host` null, all hosts. Clears a denial of it
+// (of all of them, for all hosts).
+export async function allowConnectHost(scriptId, host) {
+    return change(scriptId, (grants) => {
+        if (host === null) {
+            grants.allHosts = true;
+            delete grants.denied;
+            return;
+        }
+        if (!grants.hosts.includes(host))
+            grants.hosts.push(host);
+        grants.denied = grants.denied?.filter((h) => h !== host);
+    });
+}
+// Deny `host`. Clears an allowance of it.
+export async function denyConnectHost(scriptId, host) {
+    return change(scriptId, (grants) => {
+        grants.hosts = grants.hosts.filter((h) => h !== host);
+        if (!grants.denied?.includes(host))
+            grants.denied = [...grants.denied ?? [], host];
+    });
+}
+// Take back an allowance: one host, or with `host` null, "all sites".
+export async function revokeConnectHost(scriptId, host) {
+    return change(scriptId, (grants) => {
+        if (host === null)
+            delete grants.allHosts;
+        else
+            grants.hosts = grants.hosts.filter((h) => h !== host);
+    });
+}
+// Forget a denial, so the next request asks again.
+export async function forgetDeniedHost(scriptId, host) {
+    return change(scriptId, (grants) => {
+        grants.denied = grants.denied?.filter((h) => h !== host);
+    });
+}
+// Read the row, apply `edit`, and write it back (or remove it once
+// nothing is left in it).
+function change(scriptId, edit) {
+    return serialized(async () => {
+        const grants = await getConnectGrants(scriptId);
+        edit(grants);
+        if (grants.denied?.length === 0)
+            delete grants.denied;
+        const key = connectGrantsKey(scriptId);
+        assertWorkerContext('write storage');
+        if (grants.hosts.length === 0 && !grants.allHosts && !grants.denied)
+            await chrome.storage.local.remove(key);
+        else
+            await chrome.storage.local.set({ [key]: grants });
+    });
+}

package/dist/extension/connect-prompt-page.js

@@ -0,0 +1,70 @@
+// The connection prompt window (`connect-prompt.html`): asks whether a
+// script may reach a host its `@connect` rules don't cover. The worker
+// opens it with everything it shows in the query string
+// (`connect-prompt.ts`), and the answer goes back by message. Closing
+// the window instead cancels, which the worker sees for itself.
+import { CONNECT_ANSWER_MESSAGE, CONNECT_PROMPT_ALIVE_MESSAGE, } from './connect-grants.js';
+// Under the worker's 30-second idle limit.
+const ALIVE_INTERVAL_MS = 20_000;
+const params = new URLSearchParams(location.search);
+const promptId = params.get('prompt') ?? '';
+const scriptId = params.get('script') ?? '';
+const host = params.get('host') ?? '';
+function byId(id) {
+    return document.getElementById(id);
+}
+// What the request was, without its query string or fragment: those
+// often hold keys or session tokens, and the host and path are what the
+// question is about.
+function withoutQuery(url) {
+    try {
+        const u = new URL(url);
+        return `${u.origin}${u.pathname}`;
+    }
+    catch {
+        return url;
+    }
+}
+const link = byId('script');
+link.textContent = params.get('name') || 'This script';
+link.href = chrome.runtime.getURL(`userscript.html?script=${encodeURIComponent(scriptId)}`);
+// The site, linked at its root. The request itself is in the tooltip.
+const site = byId('site');
+const url = params.get('url') ?? '';
+site.textContent = host;
+try {
+    site.href = `${new URL(url).origin}/`;
+}
+catch {
+    site.removeAttribute('href');
+}
+site.title = `${params.get('method') ?? 'GET'} ${withoutQuery(url)}`;
+// Each button's id is the choice it sends.
+const BUTTONS = ['once', 'cancel', 'allow', 'deny', 'allow-all'];
+async function answer(choice) {
+    for (const id of BUTTONS)
+        byId(id).disabled = true;
+    const message = { type: CONNECT_ANSWER_MESSAGE, promptId, scriptId, host, choice };
+    let ok = false;
+    try {
+        ok = await chrome.runtime.sendMessage(message) === true;
+    }
+    catch {
+        // Reported below.
+    }
+    if (ok) {
+        // The worker closes the window; this is for when it can't.
+        window.close();
+        return;
+    }
+    const error = byId('error');
+    error.textContent = 'SourceMonkey could not save this answer. Close this window and try the request again.';
+    error.hidden = false;
+}
+for (const id of BUTTONS)
+    byId(id).addEventListener('click', () => void answer(id));
+// No button starts focused: the window takes focus as it opens, and a
+// key pressed for the page underneath mustn't answer it.
+setInterval(() => {
+    chrome.runtime.sendMessage({ type: CONNECT_PROMPT_ALIVE_MESSAGE }).catch(() => undefined);
+}, ALIVE_INTERVAL_MS);

package/dist/extension/connect-prompt.js

@@ -0,0 +1,266 @@
+// The connection prompt, worker side: what happens when a script's
+// `GM_xmlhttpRequest` goes to a host its `@connect` rules don't cover
+// and the user hasn't answered for yet (`connect-grants.ts`).
+//
+// - A small popup window (`connect-prompt.html`) asks: allow this host,
+//   allow all sites, or deny. A window of the extension's own, rather
+//   than something drawn in the page, so the page can neither fake nor
+//   click it.
+// - One window per (script, host). Requests that arrive while it is up
+//   wait on the same answer, rather than each opening another.
+// - Each request waits `CONNECT_PROMPT_WAIT_MS` at most, then fails.
+//   The limit sits under the page's own 5-minute give-up
+//   (`XHR_PAGE_SIDE_TTL_MS`), so the request fails with a message that
+//   says why rather than as silence.
+// - A prompt with no request left waiting on it (timed out, aborted, or
+//   its tab closed) closes. Otherwise it would stay up asking about
+//   nothing, and its pings would keep the worker running.
+// - At most `MAX_PROMPTS_PER_SCRIPT` windows are open for one script; a
+//   request for another site fails at once. A script looping over many
+//   hosts would otherwise bury the user in windows.
+// - Cancel, or closing the window, refuses just the requests waiting
+//   on it and keeps nothing, so the next request asks again.
+// - The answer travels with the script id and host, so it is saved even
+//   when the worker restarted in between and lost track of the window.
+//
+// sm-dev sees each prompt (`connect-prompt` events) and can answer it
+// (`answerConnectPrompt`), since an agent can't click the window.
+import { allowConnectHost, connectAnswer, CONNECT_PROMPT_PAGE, denyConnectHost } from './connect-grants.js';
+import { appendScriptLog } from './script-log.js';
+import { emitSmDevEvent } from './sm-dev-link.js';
+export const CONNECT_PROMPT_WAIT_MS = 4 * 60 * 1000;
+export const MAX_PROMPTS_PER_SCRIPT = 3;
+const pending = new Map();
+let nextPromptId = 1;
+function pendingKey(scriptId, host) {
+    return `${scriptId}\n${host}`;
+}
+// Whether the request may go: the user's standing answer, or the one
+// they give the prompt this opens (or one already open for this host).
+export async function askConnect(info) {
+    const standing = await connectAnswer(info.scriptId, info.host);
+    if (standing === 'deny')
+        logStandingDenial(info);
+    if (standing)
+        return standing;
+    if (info.signal?.aborted)
+        return 'aborted';
+    const key = pendingKey(info.scriptId, info.host);
+    let entry = pending.get(key);
+    if (!entry) {
+        const open = [...pending.values()].filter((p) => p.scriptId === info.scriptId).length;
+        if (open >= MAX_PROMPTS_PER_SCRIPT)
+            return 'too-many';
+        entry = {
+            promptId: `cp${nextPromptId++}-${Math.random().toString(36).slice(2, 8)}`,
+            scriptId: info.scriptId,
+            host: info.host,
+            tabId: info.tabId,
+            windowId: null,
+            waiters: new Set(),
+        };
+        pending.set(key, entry);
+        const opened = entry;
+        void openPromptWindow(opened, info).then((windowId) => {
+            // Answered (by sm-dev) before the window was even up.
+            if (pending.get(key) !== opened) {
+                if (windowId !== null)
+                    void chrome.windows.remove(windowId).catch(() => undefined);
+                return;
+            }
+            opened.windowId = windowId;
+        });
+        emitSmDevEvent({
+            kind: 'connect-prompt', op: 'shown', promptId: entry.promptId, scriptId: info.scriptId,
+            tabId: info.tabId, host: info.host, url: info.url, method: info.method,
+        });
+        void appendScriptLog(info.scriptId, {
+            level: 'info',
+            source: 'gm-xhr',
+            tabId: info.tabId,
+            message: `Opened permission request window for connection to ${info.host} (${info.method} ${withoutQuery(info.url)})`,
+            // sm-dev prints its own line for the prompt, which also says how
+            // to answer it.
+            fromReport: true,
+        }).catch(() => undefined);
+    }
+    const waiting = entry;
+    return new Promise((resolve) => {
+        const done = (outcome) => {
+            clearTimeout(timer);
+            info.signal?.removeEventListener('abort', onAbort);
+            waiting.waiters.delete(done);
+            resolve(outcome);
+            // Given up on rather than answered: the last one out closes it.
+            if ((outcome === 'unanswered' || outcome === 'aborted') && waiting.waiters.size === 0)
+                dropPrompt(waiting);
+        };
+        const onAbort = () => done('aborted');
+        info.signal?.addEventListener('abort', onAbort);
+        const timer = setTimeout(() => done('unanswered'), CONNECT_PROMPT_WAIT_MS);
+        waiting.waiters.add(done);
+    });
+}
+// Script, document and host of each request a standing denial has
+// refused and logged, so a script that retries logs once per site for
+// each page it runs on. Kept for the worker's lifetime, and cleared when
+// it grows past `LOGGED_DENIALS_MAX`, which at worst logs a repeat.
+const loggedDenials = new Set();
+const LOGGED_DENIALS_MAX = 1000;
+function logStandingDenial(info) {
+    const key = `${info.scriptId}\n${info.documentId ?? `tab ${info.tabId}`}\n${info.host}`;
+    if (loggedDenials.has(key))
+        return;
+    if (loggedDenials.size >= LOGGED_DENIALS_MAX)
+        loggedDenials.clear();
+    loggedDenials.add(key);
+    void appendScriptLog(info.scriptId, {
+        level: 'warning',
+        source: 'gm-xhr',
+        tabId: info.tabId,
+        message: `Blocked a request to ${info.host}, which was denied for this script. `
+            + "Manage permissions on the script's page. Later requests to it from the same page are blocked without a log entry.",
+    }).catch(() => undefined);
+}
+// A URL without its query string or fragment, for the log: those often
+// hold keys or session tokens.
+function withoutQuery(url) {
+    try {
+        const u = new URL(url);
+        return `${u.origin}${u.pathname}`;
+    }
+    catch {
+        return url;
+    }
+}
+// Close a prompt nobody is waiting on any more, without an answer.
+function dropPrompt(entry) {
+    const key = pendingKey(entry.scriptId, entry.host);
+    if (pending.get(key) !== entry)
+        return;
+    pending.delete(key);
+    if (entry.windowId !== null)
+        void chrome.windows.remove(entry.windowId).catch(() => undefined);
+    emitSmDevEvent({
+        kind: 'connect-prompt', op: 'closed', promptId: entry.promptId, scriptId: entry.scriptId,
+        tabId: entry.tabId, host: entry.host,
+    });
+}
+// For tests: close all prompts, and forget which denials were logged.
+export function resetConnectPromptsForTests() {
+    for (const entry of [...pending.values()])
+        dropPrompt(entry);
+    loggedDenials.clear();
+}
+async function openPromptWindow(entry, info) {
+    const params = new URLSearchParams({
+        prompt: entry.promptId,
+        script: info.scriptId,
+        name: info.scriptName,
+        host: info.host,
+        url: info.url,
+        method: info.method,
+    });
+    const width = 520;
+    const height = 350;
+    // Over the window the request came from, when there is one to place
+    // it by.
+    let place = {};
+    try {
+        const tab = await chrome.tabs.get(info.tabId);
+        const win = await chrome.windows.get(tab.windowId);
+        if (win.left !== undefined && win.top !== undefined && win.width !== undefined) {
+            // Not clamped at 0: a screen left of the primary one has negative
+            // coordinates.
+            place = { left: win.left + Math.round((win.width - width) / 2), top: win.top + 80 };
+        }
+    }
+    catch {
+        // Placed where Chrome likes.
+    }
+    try {
+        const win = await chrome.windows.create({
+            url: chrome.runtime.getURL(`${CONNECT_PROMPT_PAGE}?${params}`),
+            type: 'popup',
+            width,
+            height,
+            focused: true,
+            ...place,
+        });
+        return win?.id ?? null;
+    }
+    catch (err) {
+        // No window means no answer can come: fail the requests waiting,
+        // and leave nothing behind for the next one to join.
+        dropPrompt(entry);
+        const failed = err instanceof Error ? err.message : String(err);
+        for (const waiter of [...entry.waiters])
+            waiter({ failed });
+        return null;
+    }
+}
+// Record the user's answer and let the waiting requests go (or fail).
+// `promptId` names the prompt answered; the answer is saved by script
+// and host whether or not the worker still knows that prompt.
+export async function answerConnect(scriptId, host, choice, how) {
+    if (choice === 'deny')
+        await denyConnectHost(scriptId, host);
+    else if (choice === 'allow' || choice === 'allow-all')
+        await allowConnectHost(scriptId, choice === 'allow-all' ? null : host);
+    const key = pendingKey(scriptId, host);
+    const entry = pending.get(key);
+    const others = choice === 'allow-all'
+        ? [...pending.values()].filter((p) => p.scriptId === scriptId && p !== entry)
+        : [];
+    for (const settled of entry ? [entry, ...others] : others) {
+        pending.delete(pendingKey(settled.scriptId, settled.host));
+        const outcome = choice === 'deny' ? 'deny' : choice === 'cancel' ? 'cancelled' : 'allow';
+        // "All sites" settles this script's other prompts too; "once" only this one.
+        for (const waiter of [...settled.waiters])
+            waiter(outcome);
+        if (how !== 'closed' && settled.windowId !== null) {
+            void chrome.windows.remove(settled.windowId).catch(() => undefined);
+        }
+        emitSmDevEvent({
+            kind: 'connect-prompt', op: 'answered', promptId: settled.promptId, scriptId,
+            tabId: settled.tabId, host: settled.host, answer: choice,
+        });
+    }
+    const where = how === 'sm-dev' ? ' from sm-dev' : '';
+    const message = choice === 'allow-all' ? `Allowed this script to connect to all sites${where}`
+        : choice === 'allow' ? `Allowed this script to connect to ${host}${where}`
+            : choice === 'once' ? `Allowed this script to connect to ${host} once${where}. The requests waiting on the permission prompt were sent, and the next one asks again.`
+                : choice === 'deny' ? `Denied this script connecting to ${host}${where}. Manage permissions on the script's page.`
+                    : how === 'closed' ? `The permission prompt about connecting to ${host} was closed, which cancels it. The requests waiting on it were blocked, and the next one asks again.`
+                        : `Cancelled the permission prompt about connecting to ${host}${where}. The requests waiting on it were blocked, and the next one asks again.`;
+    await appendScriptLog(scriptId, {
+        level: choice === 'deny' || choice === 'cancel' ? 'warning' : 'info',
+        source: 'gm-xhr',
+        ...(entry ? { tabId: entry.tabId } : {}),
+        message,
+    }).catch(() => undefined);
+}
+// A prompt window closed. Without an answer first, that cancels it.
+export function onConnectPromptWindowRemoved(windowId) {
+    for (const entry of pending.values()) {
+        if (entry.windowId === windowId) {
+            void answerConnect(entry.scriptId, entry.host, 'cancel', 'closed');
+            return;
+        }
+    }
+}
+// sm-dev's answer to a prompt it was told about. False when no such
+// prompt is waiting.
+export async function answerConnectPrompt(promptId, choice) {
+    for (const entry of pending.values()) {
+        if (entry.promptId === promptId) {
+            await answerConnect(entry.scriptId, entry.host, choice, 'sm-dev');
+            return true;
+        }
+    }
+    return false;
+}
+// The prompts waiting, for sm-dev to list.
+export function pendingConnectPrompts() {
+    return [...pending.values()].map(({ promptId, scriptId, tabId, host }) => ({ promptId, scriptId, tabId, host }));
+}