Debugger and CDB contract #10

Native upstream handoff readiness, 2026-10-04

Commit 8adbb19 retains native source/test candidates, exact receipts and draft descriptions. This is issue-scoped evidence work; it changes no SDK or production implementation. Verified pnpm backports continue to support the current examples while publications await specific owner approval.

Peer observations:
  host callbacks → createDevToolsHub → initHub → existing instance shell
  original native metadata/references; no wrapper, registry, auth or SDK target policy

Native CDB fixes:
  Fetch.enable in progress → subscription registered first → native event reaches listener
  replacement worker → normal attach/conflict → same-extension probe → fresh native attach
  detached child → demand already removed → existing disposal no-op → no Chrome command

Definition of Ready

• Current upstream source revisions verified: Devframe 72d917d5, DevTools cc09170e, CDB 4053273d.
• Frozen scoped installs pass with unchanged verification policies, manifests and lockfiles.
• Each independent candidate reproduces its native defect; native controls establish its boundary.
• Production diffs contain only native forwarding or corrections, with no downstream SDK/business implementation.
• Replay patches and prepared draft descriptions are committed and hash-verified.

Definition of Done for this handoff slice

• Peer source/test native lint and scoped types pass. DevTools types use the explicit callback-capable hub source; released-hub failure remains documented rather than hidden with copied types or casts.
• CDB activation passes changed-file native lint, source/focused-test types, core build and all 138 affected core tests.
• Worker and child candidates together pass all 106 native extension tests across 21 files, changed-file native lint, exact-hash cold source types, focused-test types and extension build.
• Four worker/child source/test patches independently apply to clean 4053273d source and recreate the recorded hashes. Raw native logs and check configurations remain exact archived evidence.
• An initially mislabeled type copy is explicitly corrected: it had baseline hashes. Final candidate type evidence verifies both fixed hashes before and after compilation. Earlier missing-global diagnostics did not reproduce; no compiler policy was changed to hide them.
• Maintained research formatting and staged hooks pass. Existing permission-test files remain byte-identical and outside this commit.

Peer handoffs, activation handoff, worker handoff, child handoff.

No new live-browser run or full upstream repository gate is claimed by this refresh; existing maintained browser receipts establish the byte-equivalent installed fixes. Full gates remain for CI. The broad debugger acceptance matrix, prompt child-command settlement and competing-manager arbitration remain open. Publication needs owner approval. Prefer the hub draft first and DevTools after a callback-capable hub release; opening both now leaves the DevTools dependency gate explicitly blocked. Devframe's linked contribution guide asks for the human contributor's own publication wording.

Pending child-command native acceptance, 2026-10-02

Commit 16f34a8 extends the existing child-session fixture to dispatch a real command before iframe removal. It changes test helpers, documentation and retained evidence. Existing command/identity readers move unchanged into a small helper for strict lint limits; SDK and production code stay unchanged.

Reproduction, ownership diagram, pinned Chromium source and retained diagnostics.

Native child Runtime.evaluate(awaitPromise) → actual started DOM marker
  → iframe removal → child discovery empty / new stale call rejected
  → existing root command succeeds / original lease remains live
  → already dispatched child call stays pending for measured 1,000ms interval
  → lease release / provider shutdown → REQUEST_CANCELLED

Raw chrome.debugger reproduces the pending behavior and rejects only when its root attachment is detached. The tested revision stores pending requests by request ID and forwards child-detach events without clearing them. Both native Devframe and DevTools backends match. This locates delayed settlement below CDB/Devframe; no transport target policy, timeout, replay or rejection shim is added.

Definition of Ready

• Existing successful/stale-child checks did not cover an already running command.
• DOM marker proves dispatch before removal; raw Chrome and both genuine native backends isolate ownership.
• A shorter bounded probe separates child detach from the unchanged 10s lease lifetime. The unsuccessful initial prototype was restored; its SuppressedError/LEASE_REQUIRED cause is documented.

Definition of Done for this slice

• Both maintained native commands pass on Chrome153.0.8010.12, revision971a7443b0c9b0a9b2860529b33331b76077ec62.
• Original lease remains live after the pending observation; root calls work while stale new child calls reject.
• Actual cleanup outcome is REQUEST_CANCELLED with native message. Final leases are zero, physical attachment is absent, host/page errors are empty, and owned browsers/new profiles are gone.
• Strict lint, TS7, formatting and all 26 affected unit tests pass.
• Retained maintained observations: Devframe pending1,017.6ms / cleanup1,088.0ms; DevTools pending1,012.9ms / cleanup1,081.1ms. Five raw/broker diagnostic receipts preserve detach events, live leases and actual outcomes.
• Full workspace/native CI passed. Downloaded Linux receipts independently verify pending child commands in both hosts, native REQUEST_CANCELLED cleanup, root usability and final zero ownership/errors. CI stdout independently confirms all 26 debugger unit cases passed; its pre-existing command omitted the JSON reporter, which is being corrected in Examples and API coverage contract. The executed inventory and all 41 references to 30 distinct native payloads verify 814/413 API paths, 34 gap groups and 232 exact checks.

Prompt child-detach settlement remains a native Chrome gap. The bounded observation does not mean a command can never settle. Nested frames, workers, same-process contexts, child Fetch interception and broader permission/recovery obligations remain open; the prepared peer-lifecycle drafts still await owner approval. This slice opens no new upstream publication.

Native DevTools child-session acceptance, 2026-10-02

Commit 944501a runs the existing child-session acceptance through a fresh actual native DevTools host as well as the original Devframe host. The helper now accepts its real native host explicitly; its browser assertions and CDB ownership stay unchanged. There is no new SDK target/session API, broker or dependency patch.

await checkChildSessions(await createNativeHost());
await checkChildSessions(await createNativeDevToolsHost());

Definition of Ready for this slice

• Actual native DevTools context/hub composition and peer lifecycle forwarding already implemented.
• Existing child-session fixture/assertions identified and reused instead of duplicating target routing.
• Shared host interface compiles under strict TypeScript 7 without casts or copied native types.

Definition of Done for this slice

• Chromium 153.0.8010.12 creates one out-of-process cross-origin iframe and discovers its native CDB child descriptor through the actual DevTools backend.
• Child-only console subscription filters the root event and receives the child event; the public CDB session ID differs from Chrome's raw session ID.
• Child evaluation changes/reads the child title and origin; root evaluation retains the independent parent title/origin.
• Removing the frame removes child discovery and rejects a stale child command with native CDP_COMMAND_FAILED, while root commands remain usable under the same lease.
• Lease release/provider disposal leave zero leases and no physical extension attachment; captured page and host errors stay empty.
• Both real backend commands pass: the existing DevTools command now includes the child checks, and the original standalone Devframe child command still passes.
• Strict scoped lint, types, formatting and all 26 debugger example tests pass.
• Retained native receipt includes the child observations and no authentication credentials. Existing CI runs the extended DevTools command.
• Full CI at this commit passed, including the extended native DevTools child-session command and all existing workspace/browser gates.

This proves one out-of-process iframe through both native backends. Nested frames, workers, same-process contexts, child Fetch interception, pending command/frame-removal races and the broader debugger permission/recovery matrix remain open. It does not claim commands through the DevTools UI. The prepared upstream peer-callback drafts still await owner approval.

Actual native DevTools backend, 2026-10-02

Commit 21ededa runs the same optional CDB definition and portable title contribution through the genuine DevTools kit context and hub. The existing Devframe backend remains covered. The only native dependency changes expose and forward existing peer lifecycle callbacks through initHub and createDevToolsHub; no SDK peer registry, authentication, debugger target model or backend wrapper was added. The exact pinned versions and all earlier native patches remain unchanged.

const context = await createDevToolsContext(viteConfig, undefined, nativeConfig);
await context.install(existingCdbDefinition);
const native = await createDevToolsHub({
  context,
  server: ownedHttpServer,
  onPeerConnect: existingCdbPeers.onPeerConnect,
  onPeerDisconnect: existingCdbPeers.onPeerDisconnect,
});

Native DevTools owns authentication, its origin gate, kit context, hub and RPC. CDB owns pairing, caller grants, target approval, attachments, scopes and leases. The portable provider/action keeps its existing execution identity and uses those native services. The example admits only its own disposable extension origin through DevTools' existing allowedOrigins option.

Ready for this slice

• Existing public native callback entry points and the concrete forwarding gap identified on both current upstream mains.
• Source candidates reviewed with seven added production lines per repository, existing callback types and original function references.
• Exact-version local patches registered without version upgrades or weaker dependency policy.
• The existing CDB definition, generic RPC provider and portable contribution are reused unchanged.

Done for this slice

• Real native WebSocket test proves rejection before native authentication, trusted RPC after native code exchange and final peer/resource cleanup.
• Actual DevTools browser test passes nine scenario groups on Chromium 153.0.8010.12, including explicit approval, portable action/caller authority, pending cancellation, worker restoration, ordinary RPC and final empty scope/lease sets.
• No captured page or native peer-cleanup errors. Retained native receipt.
• Original Devframe browser acceptance, frontend coexistence and child-session regression still pass.
• 26 debugger and 50 server tests, affected strict lint/types/format, tooling checks and packed native consumer pass.
• CI runs the actual DevTools backend command. Full CI passed, including the newly added actual DevTools backend browser command and every existing native browser suite.

This proves the actual DevTools backend composition. It does not establish child/session coverage through that backend, debugger commands through the DevTools UI or unpatched published-consumer compatibility. Opening the two prepared upstream drafts awaits owner approval; DevTools' draft must retain its callback-capable hub dependency prerequisite. The broad debugger matrix remains open. Reproduction and limits.

Status reconciliation, 2026-10-02

Optional CDB composition works; the debugger acceptance matrix remains incomplete. CDB remains an optional capability/example integration, with its target/session/generation and grants owned by CDB. Embedded Chromium, authenticated native Devframe, Firefox unsupported behavior, native DevTools attachment orders, worker restoration and one detached out-of-process child-session case have maintained evidence. Remaining cases include pending commands during child removal, nested/worker/same-process session behavior and the same capability through an actual DevTools backend. The current generic SDK has no extra debugger target registry. These are debugger integration and acceptance tasks, not a prerequisite for generic provider routing.

Current full CI passed at 52bc770bde38ecb2042aa4713a32a1c87abc4c56 for all maintained scenarios; it does not certify the unimplemented or untested cases above. Earlier dated checkpoints record their historical state.

Native child-session routing and cleanup, 2026-10-02

The child-session evidence and commit 6be773b add one real cross-site iframe to the authenticated native example. Child-selected commands/events, filtering a root event, removal while a lease retains child demands, stale-child rejection and root continuity pass. Final cleanup leaves zero leases/errors and releases the physical attachment.

The example reproduced a native CDB cleanup bug. Its exact-version patch reorders the existing demand/idempotence check before missing-child resolution. Missing-child activation and commands still reject; no SDK target API or recovery layer was added. Four focused public-publisher tests establish the regression and controls. All 25 units, three builds, strict checks and final Chromium/Firefox commands pass locally. One earlier embedded lifecycle timeout remains unexplained after unchanged passing reruns. Full CI failed in the Firefox development check while reading a reloading DevTools panel. The new debugger scenarios and preceding workspace checks passed. The narrow Firefox observation correction is now on main. Full CI passed at ce546ce68e7df120a1adec6141768a8ca44a24d0, including the full workspace checks, production browser suites, concurrent development transitions and executed API-evidence gate. The detailed evidence retains remaining child/host cases; this ticket remains open.

Maintained native DevTools coexistence, 2026-10-02

The measured behavior and validation now cover both native DevTools attachment orders in the optional CDB composition. Commit 7064021 adds the actual-browser tests, receipt, screenshot and CI artifact retention. SDK/runtime code, dependencies and native ownership are unchanged.

On Chromium 153.0.8010.12, the real Console frontend renders while CDB retains its subscription and portable title action. Closing DevTools preserves the same target; explicit extension-provider disposal releases attachment and rejects stale access while ordinary authenticated RPC remains usable. Both cases report zero host/browser errors after cleanup. The owning evidence comment states the precise limits, including no independent DevTools UI command assertion.

Three builds, 21 unit tests, strict lint/types/format and the maintained native browser command pass locally. Full CI passed. The remaining contract and human confirmation stay open.

Native MV3 worker restoration, 2026-09-29

Commit 25e6f27 adds real worker-termination acceptance and a narrow exact-version @dvcol/cdb-extension@0.3.0 patch. It follows native CDB ownership and restoration; no SDK restart controller, authentication layer or new public API was added.

The unpatched maintained test reproduced a concrete failure: Chrome retains this extension's debugger attachment after its worker is force-stopped. After explicit native reauthentication, CDB's restored publisher tries to attach again, receives the exact already-attached error and cannot restore the active grant. A harmless native command from the same extension proved attachment ownership. The unpatched browser test timed out at restoration.

saved native scope/target -> actual worker termination
  -> broker: provider/grant recovering, zero leases
replacement wake -> no connection
explicit native setup -> authenticated peer + retained pairing
native restored-target attach -> exact attachment conflict
  -> verify ownership through Runtime.getIsolateId
  -> detach verified owned session, then attach afresh
  -> existing native restoration publishes same target ID at next generation

The native source candidate is 14 added lines and two changed lines. Normal attachment runs first. Only the exact conflict for a persisted target permits the ownership probe. Unrelated errors, absent recovery identity, failed ownership checks, detach errors and fresh-attach errors propagate. A fresh session matches the new publisher's empty domain-demand/child-session bookkeeping. No command is replayed. Chrome proves extension ownership, not arbitration between competing managers inside that extension; the existing single CDB owner remains the boundary.

Native source candidate and replay · Exact dependency patch · Maintained worker check · Browser receipt · Diagnosis and ownership limits.

All 21 debugger tests, strict TypeScript 7, type-aware Oxlint, formatting, three bundle targets, actual Chromium worker/caller acceptance and existing Chromium debugger/interception scenarios pass locally. Ten focused cases run against the real native provider at its Chrome/connection I/O boundaries. Released source passes six controls and fails four recovery cases; candidate source and installed patch pass all ten. Source-map equivalence and hashes are recorded. Initial full CI failed because the isolated SDK consumer copied the example-only CDB-extension patch without installing that dependency. Correction 282f757 excludes that patch from this consumer, preserving unused-patch validation. The actual packed-consumer check, strict tooling types, lint and format pass locally. Full CI on the correction passed, including all workspace gates, Chromium/Firefox acceptance and native development transitions.

This does not choose automatic credential/startup UX, prove natural idle or browser restart, fix same-peer reattachment, or establish multiple-manager coexistence. No upstream PR was opened. Patch removal requires the focused and real-browser regressions to pass on a released native dependency. The broader debugger contract and pending renderer/interception choices remain open.

Pending caller authority changes, 2026-09-29

Commit 984e91f adds live acceptance for actual caller disconnect and grant revocation during an in-flight remote title action. Production SDK contracts, adapters and dependencies are unchanged.

Each scenario approves a separate authenticated caller, starts the unchanged portable title action and holds its real Chrome evaluation on the fixture HTTP server. Before changing authority, the test verifies one pending request and one lease matching the caller principal and exact target ID/generation. No native command or CDB method is mocked.

caller -> portable title action -> native CDB -> Chrome document.title
                                                   -> held fixture HTTP response
peer.close() or broker.revokeGrant(callerGrant.id)
  -> native operation rejects; caller lease disappears
  -> recipe's final release rejects under the same caller authority
fixture releases response -> Chrome finishes and records a page marker
other caller -> same target and generation -> successful title action

Both calls reject and leases reach zero before the HTTP response is released. Chrome subsequently completes the already-dispatched evaluation. A zero lease count is therefore not a claim that browser execution has stopped. The existing unconditional release in finally replaces the original command error with the release error; this slice records that behavior instead of introducing another failure or authorization policy.

Other callers retain their original grants, the same target and successful action access. Scenario cleanup explicitly calls native revokeScope and proves baseline grants/scopes are restored. Actual peer-disconnect callbacks settle without errors. The retained receipt reports no browser errors.

Maintained test · Real Chromium receipt · Native semantics and limits.

Validation: affected remote bundle, strict TypeScript 7, type-aware Oxlint, formatting, all 11 debugger tests and the final actual Chromium 153.0.8010.12 run pass locally. Full CI passed for this exact commit, including full workspace checks and all maintained Chromium/Firefox browser suites.

Same-peer reconnect, MV3/permission transitions, child sessions, native DevTools ordering, renderer integration and the full debugger contract remain open. No new patch or upstream PR was needed. Pending renderer/interception owner choices are unchanged.

Live cooperative cancellation, 2026-09-29

Commit fc1c48d adds an actual in-flight Chrome acceptance check on top of the caller-aware title contribution. Production contracts, adapters and dependencies are unchanged.

The owned page temporarily defines a title getter that waits synchronously for an HTTP response from its own fixture server. The test invokes the unchanged portable action, waits until the HTTP request reaches the server, and only then disables the contribution. At that point the native command is demonstrably pending; neither native commands nor the CDB service are mocked.

portable caller -> native CDB -> Chrome evaluates document.title
                                    -> owned HTTP request waits
host disables title service -> stopping; invocation and disable still pending; lease still owned
fixture releases response -> Chrome finishes and records page marker
                          -> recipe releases lease
                          -> runtime discards late result as cancelled; disable completes

Assertions establish pending work before disable, preserved lease ownership during stopping, actual Chrome completion, exact host cancellation diagnostics, zero final leases and successful reactivation. Cleanup restores the getter and releases any held response even on failure. Existing native grant isolation, exact-generation rejection and final disposal checks still pass.

Live source, receipt.

Strict TS7 Bundler/NodeNext, type-aware Oxlint, Oxfmt and the strengthened real Chromium command pass locally. This follow-on changes only the fixture/tests and evidence; the preceding implementation's 11 package tests and full CI passed. Full CI passed, including workspace validation and every maintained Chromium/Firefox browser check.

This proves the settled cooperative contract, not immediate interruption of Chrome. Actual peer disconnect and revocation during remote execution still need separate live acceptance. No cancellation protocol, SDK enforcement layer, package patch or upstream PR was added.

Native caller authority for remote contributions, 2026-09-29

Commit 2eb91bd replaces the example's host-local title recipe with an actual caller-aware service. It exposes the existing title action through public createRpcProvider on the existing native Devframe host. The embedded implementation and shared contract remain unchanged.

extension-page caller: one authenticated peer for portable client + CDB client
  -> exposed readPageTitleAction({ id, generation })
  -> native current RPC session, read at invocation time
  -> CdbDevframeService.invoke(session, acquire / raw_cdp / release)
  -> native caller identity, grant, target-generation and lease checks
  -> separate background Chrome provider peer -> actual document.title

The maintained Chromium test proves:

• Missing current native caller rejects. No fixed host principal is substituted.
• Authentication does not authorize another principal's approved target: the exact native host cause is CAPABILITY_DENIED.
• The caller's own explicit approval produces two principal-bound grants for one unchanged native target. The title then returns through the portable action.
• A different positive generation rejects with native TARGET_GENERATION_STALE; success and failure leave no lease.
• Settled disable rejects further action use; enable restores it. Contribution disposal preserves the native target, grants and ordinary authenticated RPC.
• Existing provider/client disposal and actual peer cleanup still pass. The full nine-group receipt has no observed browser errors.

Recipe, live caller test, receipt.

Validation: affected graph build, strict TS7 Bundler and NodeNext, type-aware Oxlint, Oxfmt, all 11 package tests and the real Chromium acceptance pass locally. Full CI passed, including full workspace validation and the maintained Chromium/Firefox browser checks.

No SDK identity map, extra authorization layer, protocol, dependency patch or upstream PR was added. The host demo principal remains confined to an independent test operation. Native CDB still owns grants and peer disconnect. Contribution cancellation remains cooperative because native service invocation has no external signal option. In-flight cancellation is the next acceptance slice; same-peer reconnect, product credential policy and the remaining debugger contract are not marked complete.

Shared title contract on the native broker, 2026-09-29

Commit ca41b2b adds a second example implementation of the existing page-title capability/action. The host-local devserver provider uses the native broker; the embedded webext provider keeps its current implementation. Both consume the same imported contract and native CDB ID/generation. No public contract, routing API, identity map, dependency or patch changed.

provider.invoke(readPageTitleAction, { id, generation })
  -> remote title service + actual broker in local native context
  -> browser.acquire(exact ID/generation, Runtime.evaluate)
  -> browser.raw_cdp(fixed document.title expression, operation signal)
  -> browser.release in finally, independently of cancellation

CDB's public Standard Schema validators check native targets, leases and command results. The recipe uses an explicit demo agent owned by the host; it exposes no fixed-principal contribution to remote callers. This preserves native grant/lease ownership and does not translate pinned identity into a latest-generation semantic reference.

The maintained authenticated browser command now passes nine steps. The added step returns the actual owned page title through the portable runtime, leaves zero leases, rejects a different positive generation with operation-failed and native TARGET_GENERATION_STALE, reports the expected diagnostic, and retains the target/scope after contribution disposal. Subsequent native browser control and ordinary RPC still work. Review tightened the error assertion so an unrelated failure cannot satisfy this check.

Service implementation · Live contribution check · Receipt · Composition and boundaries.

Strict TS7 Bundler/NodeNext, Oxlint, formatting and the real Chromium command pass locally. Full CI passed, including workspace validation and all maintained Chromium/Firefox production and development browser checks. Per-caller remote contribution exposure, cancellation during remote execution, same-peer reconnect, renderer integration and the broader debugger lifecycle remain open. Native cancellation timing is preserved; this slice makes no stronger cancellation guarantee.

Authenticated native CDB example, 2026-09-29

Commit 07c13b5 promotes the native extension-to-server proof into maintained strict TypeScript and browser CI. It adds only the example dependency on released @dvcol/cdb-devframe@0.3.0; the existing patched Devframe/CDB graph is preserved. No SDK authentication layer, debugger transport, new patch or upstream PR was added.

host-owned agent -> native CDB service/broker
  -> authenticated Devframe RPC
  -> native CDB client + Chrome provider in MV3 worker
  -> explicitly approved fixture tab

The host installs createCdbService() through initDevframe with default interactive auth enabled and forwards native peer callbacks. The worker composes connectDevframe, createCdbClient, native pairing storage/identity and createChromeProvider. An actual extension-owned control document approves exactly the owned fixture tab. The host calls public broker.invoke(agent, 'browser.evaluate', input) and observes the real DOM change.

Run pnpm --filter @devkit/example-debugger test:devframe after building the affected example graph. Maintained recipe and boundaries · Typed driver · Non-secret receipt · CI run.

Full CI passed, including all workspace checks, the new authenticated CDB browser test, both production browser suites and concurrent native development transitions. Fixture-only pairing confirmation and broad debug approval are not product defaults. The same-peer createCdbConnection reattachment failure remains unchanged. Remote portable title-action integration, remote agent clients, cancellation/revocation during execution, MV3 recovery, child sessions, permission changes and DevTools attachment ordering remain open. This completes direct-composition feasibility, not the complete debugger contract.

Live lifecycle and native peer integration checkpoint, 2026-09-29

Commit 5bd9c24 adds three maintained Chromium lifecycle scenarios without changing production APIs. Each reads an owned tab's title, navigates to a new document and reads its changed title through the same portable action and native CDB target reference. It then opens a pending native subscription and exercises publisher revocation, actual tab closure or unsupported-page navigation.

Maintained recipe and caveats · Exact lifecycle receipt.

An initial test incorrectly waited for onDetach after calling raw chrome.debugger.detach. That native call did not produce the expected event. Explicit teardown now follows the existing publisher owner; no repair watcher or dependency patch was added. Native generation here represents target authority, not a promise of document identity. Child sessions, worker restart, permissions, in-flight cancellation and native DevTools ordering remain open.

Commit ef2b0ee records the existing public CDB Devframe composition and a separately reproduced same-peer registration failure. The real installed Devframe collector rejects CDB connection.attach(peer), disconnected(), attach(theSamePeer) with DF0021. Distinct-peer and retained direct-client controls pass. This is a registration-boundary proof, not an authenticated transport/reconnect claim. No second CDB patch or PR was created. Integration report and exact reproduction.

The authenticated acceptance described above now supersedes this next-step note. The higher-level same-peer reattachment defect and the remaining debugger contract are still open.

Subscription activation correction, 2026-09-29

Commit 9615001 applies an exact-version pnpm patch to CDB 0.3.0 and adds a maintained installed-package regression. A real Chromium Fetch response can pause while subscribe() awaits domain activation; released CDB has not registered the subscriber yet and loses the event. The patch registers first, removes the subscriber on setup failure, and releases completed activation through its original executor if the subscription was invalidated meanwhile. No SDK broker, new public API or domain scheduling layer was added.

sequenceDiagram
  participant Client
  participant Broker as Native CDB broker
  participant Chrome
  Client->>Broker: subscribe
  Note over Broker: Register subscriber before activation
  Broker->>Chrome: enable domain
  Chrome-->>Broker: event during pending activation
  Note over Broker: Buffer event
  Chrome-->>Broker: activation completes
  Broker-->>Client: ready subscription yields event

Mechanism, exact source/receipts and limits. The browser test controls completion ordering of a real native call; it does not estimate the race's natural frequency. In-flight body reads, other simultaneous demand, child sessions, overload and failed asynchronous teardown remain acceptance work. The native public teardown semantics are unchanged.

Follow-up commit 7bd8929 scopes the CDB patch out of the isolated packed-adapter consumer, which does not install CDB. The first CI run exposed that integration mistake; the corrected consumer passes locally without disabling pnpm validation. Passing full CI for the corrected commit.

The upstream candidate changes 14 added / 5 removed production lines. Its source and tests plus a prepared draft description are ready. No CDB PR is open; owner approval is pending. The local patch is already authorized and installed. This issue remains open.

Maintained CDB contribution and configured Fetch evidence, 2026-09-29

Implementation commit 4ad83e0 adds the private examples/debugger package. It uses released CDB 0.3.0 and the existing portable declarations/provider lifecycle. No SDK debugger facade, broker, domain scheduler or dependency patch was added.

flowchart LR
  Action[Portable read-page-title action] --> Service[Page-title capability]
  Service --> Client[Native embedded CDB client / lease]
  Client --> Broker[Native CDB broker]
  Broker --> Publisher[Selected-tab publisher]
  Publisher --> Chrome[chrome.debugger]
  Chrome --> Lifecycle[Native selected-tab lifecycle]
  Lifecycle --> Publisher

The shared contract consumes CDB's own target ID/generation. Chrome tab IDs and the raw bridge stay in the local native context. The example evaluates a fixed page-title expression. The trusted host owns publisher/broker lifetime independently of contributions; raw native access in the test deliberately bypasses CDB leases. This establishes no remote or untrusted-page grant policy.

README and ownership details, Chromium receipt, Firefox receipt. Browser fixtures and scripts are maintained and run in CI.

A separate research commit 710c4f8 proves fixed response-stage Fetch configuration through the existing public ChromeDebuggerPort. The port supplies parameters only when CDB invokes Fetch.enable, retaining one native owner. A real selected response is read/fulfilled, an unmatched response passes unchanged, and a later matching request returns its original body after cleanup. One attach/detach and one successful Fetch enable/disable are recorded. Subscription close alone keeps lease-owned demand; lease release initiates asynchronous disable, whose actual completion the test observes at the port. Report, exact source, receipts and limitations.

This removes the blanket assumption that configured Fetch requires an upstream patch. It does not settle dynamic pattern sharing or the full transform contract. Setup timing, paused-request cancellation, overflow and child-session cleanup still need evidence. A follow-up is investigating the setup/cancellation cases before any fix is proposed.

The broad debugger DoD remains open: authenticated remote peers, worker/permission/navigation/child-session behavior, native DevTools attachment orders and complete API/host conformance are not claimed. The renderer routing choice remains a separate owner decision in Renderer and surface contract.

Real embedded CDB worker proof, 2026-09-29

#10 commit 922dc95 proves the released CDB 0.3.0 composition inside an actual Manifest V3 worker. c85a50f retains the execution and validation logs. This is research evidence, not a completed maintained contribution or debugger contract.

flowchart LR
  Client[Trusted embedded client] --> Broker[Native CDB broker]
  Broker --> Publisher[Native selected-tab publisher]
  Publisher --> Port[Injected ChromeDebuggerPort]
  Port --> Chrome[Actual extension debugger attachment]
  Chrome --> Events[Native onEvent forwarding]
  Events --> Publisher
  Native[Trusted local native consumer] --> Port

The public APIs compose directly: createEmbeddedChromeDebuggerBridge(), createSelectedTabPublisher(), broker publication callbacks, and bridge.registerTargetExecutor. There is no debugger daemon, SDK broker, command facade, domain scheduler, new upstream hook or repository dependency change in this research commit.

The native debug capability level is broad; its allow list adds methods rather than narrowing that level. The fixture's trusted-local grant is not a proposed remote/page approval policy. Raw native commands deliberately bypass CDB leases and never mutate attachment/domain ownership.

The host owns publisher/broker resources independently of each client. Revoke must happen before broker disposal, because it still needs the broker callback. Native publisher revoke catches detach errors, so its resolved promise alone does not prove physical cleanup. The test also verifies that the extension's own post-revoke command is rejected. Chrome's global getTargets().attached flag remains true for Playwright's separate observer and is not an extension-ownership assertion.

Tested browser: Chromium 153.0.8010.12, Playwright 1.63.0. Exact CDB/core/extension/broker 0.3.0 public tarballs and integrity records are retained in the report; all exceed the release-age threshold. Browser bundling rejects Node builtins and leaves no external imports. Syntax, bundle and real-browser execution pass. Applying maintained type-aware lint directly to untyped scratch scripts fails; the validation record preserves that limitation. No strict-TypeScript implementation readiness is claimed.

Full report, ownership sequence, exact source and receipts.

The next slice promotes this native composition into a maintained typed contribution example under the settled host/client ownership rules. Firefox unavailability, full contribution lifecycle, navigation/target closure, worker termination, permissions, cancellation, child sessions, native DevTools orders and remote authenticated peers remain unproved here. Configured Fetch demand is still unresolved: managed activation sends no enable parameters, and raw Fetch.enable must not compete with CDB ownership. Keep #10 open; the broad DoD and human confirmation are not satisfied by this bounded experiment.

Part of Design a portable contribution SDK and WebExtension runtime.

Upstream integration boundary, 2026-09-27

Use the published optional CDB embedded bridge/extension publisher and its injected ChromeDebuggerPort, or the browser native API where appropriate. Keep one attachment/domain owner. Do not implement another broker, lease engine, CDP scheduler or general command facade. Add only the adapter required for accepted contribution ownership and browser availability.

See the implementation and map review. This narrows implementation mechanisms without dropping the accepted feature or real-host coverage requirements.

Question

How should the SDK expose native debugger access and an optional Chrome Debugger Bridge adapter while maintaining one target-session owner? Decide the extension-only composition, public lifecycle, and evidence needed to prove CDB and native access work together.

Context and current behavior

The debugger requirement permits native chrome.debugger access and a pluggable Chrome Debugger Bridge integration. CDB is transport-neutral. Its core createEmbeddedChromeDebuggerBridge supplies an in-process broker, client, executor registration, and disposal. Its extension createSelectedTabPublisher accepts ChromeDebuggerPort with attach, detach, and sendCommand, plus publication and event callbacks. Their runtime imports and injection boundaries suggest a packaged-extension composition without a daemon; the combined path still requires a real service-worker integration experiment.

The inspected CDB revision was 89bdf211e8e21d86aba70051c366bb03b38d43d8, on dvcol/webmcp, one commit ahead of its remote at inspection. The later upstream reuse audit established pinned CDB 0.3.0 published artifacts and their public exports without claiming full source-tarball identity. Use that consumable baseline and recheck it when upgrading.

The higher-level createChromeProvider expects a ProviderConnection with grant claims, approvals, reconciliation, state observation, and protocol messaging. Existing Devframe integration supplies that contract through an authenticated peer. Its Node-hosted broker is an optional composition, not a core requirement. See CDB's architecture and embedded example.

At the inspected revision, source anchors include packages/core/src/embedded.ts:createEmbeddedChromeDebuggerBridge, packages/extension/src/selected-tab-publisher.ts:ChromeDebuggerPort and createSelectedTabPublisher, packages/extension/src/provider-connection.ts:ProviderConnection, and reserved methods in packages/core/src/cdp-catalogue.generated.ts. These exact paths describe the inspected checkout; the linked main-branch documentation may differ.

CDB manages attachment, child sessions, domain activation, authorization, and leases. It reserves Fetch.enable and currently activates managed domains without configuration parameters. Response-stage filtering and custom Fetch patterns therefore need investigation before CDB becomes a transform backend.

Requirements and scope

• Native debugger access remains available through the local discriminated context where the browser supplies it. The optional CDB adapter must be proved alongside that access.
• Packaged extension operation must not require a local daemon, external broker, MCP server, or fixed network port. External Devframe transport remains an optional integration.
• Define one owner for attachment, child-session routing, managed domains, detachment, and recovery on each target. Explain how native callers coordinate with that owner.
• Preserve CDB's target generation, principal, lease, and cancellation rules when using CDB. Do not project raw browser handles into serializable RPC contracts.
• Represent browser absence and runtime unavailability explicitly. Firefox capability gaps must not disable unrelated modules.
• This decision specifies adapters and obligations; it does not implement a debugger, rebuild CDB, or promise unrestricted CDP access that Chrome itself does not expose.

Options and recommendation

Exposing only chrome.debugger minimizes SDK code but leaves every contribution to solve shared ownership. Making CDB mandatory introduces its authority model into deployments that only need native debugging. Independent CDB and native attachments create conflicting lifecycle owners.

First prove direct composition of the native debugger and existing optional CDB session APIs; add a portable ownership contract only where their public APIs leave a demonstrated gap. Native context remains a documented local escape hatch. SDK-owned consumers coordinate through the same owner, and conflicting raw lifecycle changes become observable failures. Own the SDK adapter in devkit-extension, as agreed. Identify any required CDB extension points separately and prove a viable composition without assuming an upstream change will be accepted.

Proposed API or experiment

The experiment starts at native/CDB entry points; these steps describe ownership, not approved wrapper factories:

create the optional embedded CDB bridge using its public factory
create its extension publisher using the public ChromeDebuggerPort seam
exercise native commands and CDB commands through the same attachment owner
subscribe, navigate, revoke permission and disconnect
await each native/publisher/bridge disposal according to actual ownership

The experiment must prove the actual seam required by CDB's injected ChromeDebuggerPort before introducing another adapter factory. Use the embedded core and publisher first. Then repeat with an existing Devframe peer. Exercise CDB commands containing target ID, generation, lease ID, operation ID, method, JSON parameters, and optional child-session ID. Transport subscription events and cancellation explicitly; keep async iterators and native objects local.

Measure attach/detach and domain enable/disable calls. Require predictable behavior when one consumer disposes while another remains active. Investigate configurable Fetch.enable demands without bypassing CDB's ownership rules.

Scenarios and acceptance criteria

• A real packaged Chromium extension executes native and CDB-backed operations against one fixture tab in sequence and while subscriptions overlap.
• Disposing CDB preserves a native consumer's valid session; final disposal releases attachment and listeners exactly once.
• Navigation, child frames, target closure, permission loss, worker restart, cancellation, stale generations, and conflicting control produce documented outcomes.
• Native DevTools is opened before and after attachment. Chrome's reference describes opening DevTools after attachment, while its sample opens DevTools before attachment. The maintained Chromium acceptance now proves a rendered native frontend plus CDB commands/events in both attachment orders for the tested version; broader DevTools interactions remain outside that result.
• Runnable examples exercise every public debugger API, hook, and adapter feature automatically on every supported host. Firefox asserts unsupported behavior. Devframe and DevTools examples use the same contract. Raw API tests cover SDK-owned exposure and lifecycle, not every vendor command.
• Compilation, mocked transports, and stubbed CDP responses cannot establish integration completion.

Dependencies

Depends on Contribution and realm contract for local context and module lifecycle; Upstream reuse audit for the supported CDB seam and consumable revision; and Browser capability audit for browser limits and coexistence evidence. These decisions prevent inventing a second incompatible debugger abstraction.

Definition of Ready

• Prove the public CDB injection seam and exact attachment owner before designing an SDK wrapper; compare every proposed method with existing CDB/native calls.

• Dependency resolutions identify context ownership, supported browsers, and reusable CDB exports.

• A specific consumable CDB revision is recorded, with local versus published differences stated.

• A fixture can run native debugger and embedded CDB paths in a real extension.

• The owner can capture attachment, subscription, and disposal behavior without external application dependencies.

Definition of Done

• Native and CDB integration tests preserve upstream lease/domain semantics; any configured Fetch gap is explicit and does not bypass its owner.

• The adapter contract, package ownership, local raw-context boundary, and target-session owner are decided.

• Extension-only and optional external compositions have evidence-backed feasibility conclusions.

• Native/CDB coexistence and the Fetch configuration gap are resolved or explicit blockers prevent claiming those features.

• Every public API and lifecycle hook has a named runnable example and host-specific automated acceptance obligation, including unsupported and failure paths.

• The resolution separates completed decision experiments from subsequent production implementation.

• The human has confirmed the resolution through discussion; the agent has not supplied the human side of the decision.

Resolution record

Record the accepted interface, exact upstream revision, composition experiments, lifecycle rules, remaining blockers, and rejected alternatives in a resolution comment. The parent map links the comment by this issue's title.