One host-owned viewer socket for both browser providers; no CDP in the webview

[nedtwigg]

Both providers now stream through one host-owned viewer socket, so the webview never talks to a daemon directly and never holds CDP. Stacked on #777. Items C8 and D2 from the browser-stack deep dive.

One host-owned viewer socket (C8)

• One listener for everything. lib/src/host/browser-viewer.ts is a single loopback listener. Each upgrade needs the listener's own Host plus a single-use 60 s grant from the new view op (BrowserStreamGrants). There is one BrowserView per socket.
• agent-browser. The host dials the daemon stream (loopback only; the dial times out after 5 s), drops the daemon's ~20 Hz re-broadcast by raw Buffer.equals, and parses and decodes only changed frames.
• Playwright. It feeds the same view. Its per-viewer server is gone.
• One topology on all three hosts. Deleted: the VS Code TCP relay and its grant table (plus its loopback-lint exemption), and standalone's direct-to-daemon dial.
• Binary frames. Each frame is a 12-byte header (provisional/crisp, CSS viewport) plus the JPEG; state is sent as JSON text. The webview uses binaryType='arraybuffer' and decodes only the latest frame (one in flight plus one replaceable pending). The canvas stays at crisp size, so switching between provisional and crisp frames no longer reallocates it. Playwright acks are paced to 50 ms.
• Crisp capture moved into the host. The screenshot loop now runs host-side with the same pacing, input window, overdue, stale-drop and dedup rules. Each capture uses a fresh private file, read into memory and deleted however the capture ends (browser-capture.ts). Deleted:
  • Tauri browser_screenshot;
  • the sidecar file transport;
  • the dev harness readCapture;
  • the webview screenshot loop;
  • the screenshot / streamUrl / cdpUrl ops.
• Paste is input_text for both providers. The host expands it for agent-browser.
• Relaunch gating is host-local. While a launch or close of a browser runs, the host refuses every other op on it except close. agent-browser operations and captures run only on a daemon liveDaemon proves live: a pid file from this boot, a live process, and an accepting stream port. No host operation ever starts a daemon. A launch or close ends every viewer socket on that browser.

No CDP in the webview (D2)

• Deleted: startCdpObserver, reconcileCdp and the cdpUrl op.
• A headed agent-browser view reads get cdp-url host-side, bounded to 10 s and loopback only, and pushes page {url,title}.
• A browser that goes away on its own sends status {connected:false} and closes the socket, so auto-revert no longer waits out three reconnects.

Measurements

Measured 2026-09-24 on Node 24.18 with a synthetic 20 Hz daemon sending ~133 KB frames; the numbers are also recorded in the rationale.

Page	Host CPU, 1 / 4 / 8 panes	Sent to the webview
Static	1.3% / 3.4% / 4.7%	nothing
Animated	2.9% / 7.9% / 11.1%	~1.9 MB/s per pane

• Event-loop p99 delay stayed ≤ 12.7 ms, so no worker thread is needed.
• The old webview djb2 dedup cost 208 µs per frame; a raw compare costs ~2.5 µs.

Specs: new "Viewer Socket" section in docs/specs/dor-browser.md, with Browser Connection, Browser Host, the provider sections and Pop-Out rewritten. security-local.md swaps the relay FAIL IF line for a viewer-listener one. vscode.md, standalone.md and dor-cli.md are updated, plus the rationale files.

Testing

• Root pnpm test passes: lib 3929, vscode-ext 181, standalone, website, dor 190, and all lints, including loopback-lint, which detects the new listener with its guard.
• Argos passes in Chromium and WebKit (294/294 each).
• cargo check passes.
• Each of the 52 targeted reverts turns its test red.
• Runtime, in the innerdogfood harness: the view grant, the guarded upgrade from the real webview, tabs/status relay, navigation and the debug stats line are verified. Frames were not seen at runtime: no local agent-browser Chrome emitted screencast frames during the session, so frame relay is covered by tests and the synthetic benchmark only. The real-Playwright opt-in test was not run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NCV5Uq6FeZbBfzfpk3vrpe

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	7754d61
Status:	✅  Deploy successful!
Preview URL:	https://a8ed32c0.mouseterm.pages.dev
Branch Preview URL:	https://browser-viewer-socket.mouseterm.pages.dev

View logs

[dormouse-bot]

BrowserView.close limits the close reason to 120 characters, but ws limits it to 123 bytes. If the reason is longer than 123 bytes in UTF-8, WebSocket#close throws RangeError: The message must not be greater than 123 bytes synchronously. One caller passes arbitrary text: the rejection handler in openView ((error) => view.close(1011, messageOf(error))). That text can be playwright-cli stderr, a spawn error, or a message that names a path under a non-ASCII home directory. When it throws there:

• dispose() has already run, so the view is gone from views while the webview's socket stays open. The pane waits forever and never reconnects.
• The throw rejects the promise that .then(ok, err) returns, and nothing handles it. standalone/sidecar/main.js installs no unhandledRejection handler, so on Node's default --unhandled-rejections=throw the sidecar exits and takes every terminal with it.

The inline suggestion cuts the reason by byte length instead.

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
storybook-chromium (Inspect)	✅ No changes detected	-	Sep 24, 2026, 4:08 PM
storybook-webkit (Inspect)	👍 Approved by Ned Twigg	1 changed	Sep 24, 2026, 4:08 PM

Deployment	Status	Branch	Updated (UTC)
preview (Open)	Ready	browser-viewer-socket	Sep 24, 2026, 4:08 PM

[nedtwigg]

Restacked onto #777 after #776 landed on main. The close-reason fix from the resolved thread (was 24b5fad) is now 7754d61. No other changes.