Playwright disables normal background throttling, so a hidden 5chan page keeps
doing P2P and rendering work after a check finishes. Agents verifying in
parallel across worktrees stacked whole browser engines on one machine.
Add scripts/pw-session.sh, a wrapper that permits one active Playwright browser
at a time and records who holds it:
- The lock is machine-wide, not per-repository, because the contended resource
is RAM and CPU. Every worktree and checkout shares one slot.
- Acquisition is an atomic mkdir. Stale locks clear themselves: `open` reclaims
any slot whose recorded browser is no longer `status: open` in
`playwright-cli list --all`, so an interrupted workflow cannot strand the
budget. When that list cannot be read the lock is left alone, so a broken CLI
never silently disables the budget.
- `open` exits 75 when the slot is busy; `--wait[=SECONDS]` blocks instead.
- `close` always stops the browser, even when the lock was already lost, and
never releases a slot held by a different session.
- `status` reports the holder and whether its browser is still alive.
Agent policy now runs browser engines and profiler batches sequentially, uses
Chrome/Blink during iteration and the full engine matrix only for final
verification, and never uses `close-all` or `kill-all` while other agents may
own sessions.
Covered by scripts/pw-session.test.js.
Clears GHSA-wrjc-x8rr-h8h6 (open redirect via backslash in <Link>/useNavigate)
and GHSA-337j-9hxr-rhxg (arbitrary constructor injection in deserializeErrors),
neither of which has a 6.x backport. Drops the now-unused @remix-run/router
resolution, since v7 no longer depends on it.
Drop the pinned `model: sonnet` from the reasoning-heavy subagents so they
follow the session model instead of being forced down to Sonnet. Running an
Opus session now gets Opus subagents; deliberately dropping to a cheaper
session model is respected too.
Mechanical agents (browser-check, profiler, translator) keep their haiku pin
— that pin is a capability statement, not a stale default, and should hold
regardless of session model.
GitHub Projects are no longer used in this repo. Remove issue/project
finalization from review-and-merge-pr and the project-board step from
make-closed-issue in all three toolchain mirrors, record the surprise
in known-surprises.md, and regenerate llms files.
Fetch the comment community from the CID payload for initial useComment hints, and redirect directory thread URLs to the authoritative community instead of 404.
Gate document theme and favicon side effects behind GlobalLayout, restore the default favicon after leaving not-found, and treat valid mod and trailing-slash routes as recognized views.
TypeScript 7's own tsc is the Go-native compiler, so the separate tsgo
binary from the dev-preview package is redundant. yarn type-check now
runs tsc --noEmit. Bump tsconfig target to ES2018 and add types: [node]
to fix the pre-existing NodeJS namespace, global, and /s regex flag
errors that stable tsc reports but tsgo did not.
The unmaintained decompress package (<=4.2.1) allows archive extraction
outside the target directory. Migrate electron before-pack to the patched
@xhmikosr/decompress fork (11.1.3) to resolve Dependabot alert #301.
Tommaso Casaburi