[kernel-1116] Add CDP Monitor by archandatta · Pull Request #213 · kernel/kernel-images

archandatta · 2026-04-13T14:26:02Z

Introduces the foundational layer of the CDP monitor as a standalone reviewablechunk. No Monitor struct wiring, just the primitives that everything else builds on.

types.go: CDP wire format (cdpMessage), all event type constants, internal state structs (networkReqState, targetInfo, CDP param shapes).
util.go: Console arg extraction, MIME allow-list (isCapturedMIME), resource type filter (isTextualResource), per-MIME body size caps (bodyCapFor), UTF-8-safe body truncation (truncateBody).
computed.go: State machine for the three derived events: network_idle (500ms debounce after all requests finish), layout_settled (1s after page_load with no layout shifts), navigation_settled (fires once all three flags converge). Timer invalidation via navSeq prevents stale AfterFunc callbacks from publishing for a previous navigation.
domains.go: isPageLikeTarget predicate (pages and iframes get Page.* / PerformanceTimeline.*; workers don't), bindingName constant, interaction.js embed.
interaction.js: Injected script tracking clicks, keydowns, and scroll-settled events via the __kernelEvent CDP binding.

Note

High Risk
Adds a new always-on CDP WebSocket monitor that captures network/console/page events (including response bodies) and injects page JS, which is privacy- and stability-sensitive and could affect production telemetry and resource usage. Also introduces reconnect and timer-based state machines, increasing concurrency/edge-case risk.

Overview
Introduces a new cdpmonitor implementation that connects to Chrome DevTools over WebSocket, auto-attaches to targets, enables relevant domains, and dispatches CDP notifications into the existing event pipeline (console logs/errors, network request/response + optional truncated bodies, page lifecycle/navigation, target lifecycle, and layout shifts).

Adds synthetic page health signals (network_idle, layout_settled, navigation_settled) driven by debounce timers and navigation resets, plus injected JS (interaction.js) to emit click/key/scroll events with per-session rate limiting and suppression of sensitive keystrokes.

Implements operational behaviors: restart/reconnect handling on upstream URL changes (with backoff and lifecycle events), periodic eviction of stuck pending network requests, and a rate-limited screenshot publisher backed by ffmpeg (with downscaling). The API service is updated to construct the monitor with a slog logger, and the PR adds extensive fixture-based and integration-style tests for protocol round-tripping, handlers, computed state, lifecycle, reconnect, and screenshots.

^{Reviewed by Cursor Bugbot for commit 0605227. Bugbot is set up for automated code reviews on this repo. Configure here.}

…, interaction.js

firetiger-agent · 2026-04-13T14:56:09Z

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR adds new CDP monitor functionality but does not modify API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal) as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.

server/lib/cdpmonitor/computed.go

cursor · 2026-04-13T15:16:04Z

server/lib/cdpmonitor/util.go

+				return true
+			}
+		}
+	}


Suffix-based MIME check inconsistent between capture functions

Medium Severity

isCapturedMIME restricts the +json/+xml/+csv suffix check to only application/vnd.* types, while bodyCapFor applies the same suffix check to all MIME types. This means common structured content types like application/ld+json, application/hal+json, and application/problem+json will be rejected by the isCapturedMIME gatekeeper and never have their bodies captured — even though bodyCapFor was clearly designed to give them the full 8 KB cap. The bodyCapFor comment also incorrectly claims it matches isCapturedMIME's allow-list.

Additional Locations (1)

server/lib/cdpmonitor/util.go#L86-L91

^{Reviewed by Cursor Bugbot for commit d73793c. Configure here.}

hiroTamada

solid foundation overall — the computed event state machine and timer invalidation logic are well designed. one blocking concern around sensitive data capture in interaction.js.

hiroTamada · 2026-04-13T16:50:16Z

server/lib/cdpmonitor/interaction.js

+    }));
+  }, true);
+
+  document.addEventListener('keydown', function(e) {


the keydown listener captures every keystroke with no filtering — this is effectively a keylogger. since this gets injected into all browser VMs (including sessions where users type passwords via managed auth), sensitive input like passwords, credit card numbers, and SSNs will flow through the event pipeline and get persisted. at minimum, keystrokes in <input type="password"> fields should be redacted or skipped. worth also considering fields with autocomplete="cc-number", name="ssn", etc. the click listener's textContent capture has a similar (lesser) exposure. this has PCI/SOC2/GDPR implications if the data hits storage.

addressed -> a62c403

rgarcia

can you combine all the prs into one? I'm finding it hard to review this since most of the code is unused

server/lib/cdpmonitor/types.go

rgarcia · 2026-04-13T17:19:42Z

server/lib/cdpmonitor/types.go

+// on the root session (sessionID="") before navigation has been recorded.
+const mainSessionUnset = "\x00unset"
+
+// Event type constants for all events published by the cdpmonitor.


i think this constant block would be a lot easier to reason about with some cosmetic structure: group the names into direct-ish CDP-derived monitor events, computed/synthetic events from computed.go, injected page-side interaction events, and monitor lifecycle/internal events, and add short godoc comments for each group (or for the less obvious constants). right now they're all in one flat list, which makes it hard to tell which names are grounded in protocol counterparts vs introduced locally by the monitor.

rgarcia · 2026-04-13T17:19:42Z

server/lib/cdpmonitor/types.go

+	addedAt      time.Time // for TTL eviction
+}
+
+// cdpConsoleArg is a single Runtime.consoleAPICalled argument.


i'd like for this first decode layer to be much closer to the CDP protocol / PDL types, and then have a second translation step into monitor-specific event shapes. right now things like cdpConsoleArg / cdpConsoleParams are custom projections of Runtime.RemoteObject / Runtime.consoleAPICalled, which makes it harder to audit against the source of truth and easier to accidentally drop fields we may want later. i think mirroring the protocol more directly at the boundary would make this foundation easier to reason about, with the domain-specific simplification happening after decode. the upstream source of truth here is the CDP spec / PDL, e.g. js_protocol.pdl.

Submitted a plan for the changes -> #216

addressed -> 0605227

Second layer of the CDP monitor split. Adds the full Monitor struct, all lifecycle machinery, and the test infrastructure. dispatchEvent is a no-op stub - event handlers land in #213  --- > [!NOTE] > **Medium Risk** > Adds substantial new WebSocket lifecycle/reconnect and command routing logic with multiple goroutines/locks; regressions could impact capture stability and leak resources. Tests mitigate but concurrency and reconnect edge cases remain moderately risky. > > **Overview** > Implements the core `cdpmonitor.Monitor` lifecycle: establishes a CDP WebSocket connection, routes command responses via `send()`, starts the init sequence (`Target.setAutoAttach` + attach to existing targets), and adds a `Health()` snapshot for operational visibility. > > Adds automatic reconnect on upstream URL changes with backoff, state reset/unblocking of in-flight commands, and lifecycle events (`monitor_disconnected`, `monitor_reconnected`, `monitor_reconnect_failed`, `monitor_init_failed`). > > Introduces screenshot capture/publishing with rate limiting and optional ffmpeg downscaling, plus a comprehensive test harness (fake WS server/upstream, event collector) and new unit tests covering lifecycle, reconnect, screenshot behavior, and pending-command unblocking. Domain enablement/script injection is factored into `domains.go`, and `dispatchEvent` is stubbed pending the follow-up handlers PR. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit bfb6cd7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

server/lib/cdpmonitor/interaction.js

cursor · 2026-04-13T18:21:03Z

server/lib/cdpmonitor/monitor.go

+					m.computed.onLoadingFinished() // keep netPending consistent
+				}
+			}
+			m.pendReqMu.Unlock()


Sweep calls onLoadingFinished while holding pendReqMu

Medium Severity

sweepPendingRequests calls m.computed.onLoadingFinished() inside a loop while holding pendReqMu. Each call acquires computed.mu, decrements netPending, and may restart the network idle timer. When multiple entries expire in one sweep, netPending can be decremented below the actual count (since the sweep-evicted requests were never tracked via onRequest), and the timer is needlessly restarted on each iteration. The onLoadingFinished calls here assume a 1:1 pairing with prior onRequest calls that may never have occurred for stale entries.

^{Reviewed by Cursor Bugbot for commit 348243a. Configure here.}

… projection

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 4 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0605227. Configure here.}

cursor · 2026-04-14T14:20:58Z

server/lib/cdpmonitor/handlers.go

+		"stack_trace": p.StackTrace,
+	})
+	m.publishEvent(EventConsoleLog, events.CategoryConsole, events.Source{Kind: events.KindCDP}, "Runtime.consoleAPICalled", data, sessionID)
+}


Console handler ignores event type, mislabels errors

Medium Severity

handleConsole unconditionally publishes every Runtime.consoleAPICalled event as EventConsoleLog, regardless of p.Type. The constant comments explicitly state EventConsoleError is for "Runtime.consoleAPICalled (type=error)", but no code path maps console.error() calls to that event type. Downstream consumers filtering on event type console_error will miss all JS console.error() output. Additionally, the comment on EventConsoleLog incorrectly references "Runtime.exceptionThrown" which is actually handled by handleExceptionThrown and published as EventConsoleError.

Additional Locations (1)

server/lib/cdpmonitor/types.go#L17-L30

^{Reviewed by Cursor Bugbot for commit 0605227. Configure here.}

cursor · 2026-04-14T14:20:58Z

server/lib/cdpmonitor/monitor.go

+		PendingRequests: pendReqs,
+		Sessions:        sessions,
+	}
+}


Exported Health and MonitorHealth are unused

Low Severity

Health() and MonitorHealth are exported but have no callers anywhere in the codebase outside their own definitions. This adds unused public API surface to the package.

Additional Locations (1)

server/lib/cdpmonitor/types.go#L76-L83

^{Reviewed by Cursor Bugbot for commit 0605227. Configure here.}

feat: add cdpmonitor foundation — types, util, computed state machine…

85d570a

…, interaction.js

archandatta mentioned this pull request Apr 13, 2026

[kernel-1116] CDP monitor core #214

Merged

self review

bed53f8

archandatta marked this pull request as ready for review April 13, 2026 14:56

cursor bot reviewed Apr 13, 2026

View reviewed changes

server/lib/cdpmonitor/computed.go Outdated Show resolved Hide resolved

server/lib/cdpmonitor/computed.go Show resolved Hide resolved

review: cursor feedback

d73793c

cursor bot reviewed Apr 13, 2026

View reviewed changes

archandatta requested review from Sayan-, hiroTamada and rgarcia April 13, 2026 15:18

hiroTamada requested changes Apr 13, 2026

View reviewed changes

hiroTamada reviewed Apr 13, 2026

View reviewed changes

rgarcia requested changes Apr 13, 2026

View reviewed changes

cursor bot reviewed Apr 13, 2026

View reviewed changes

archandatta changed the title ~~[kernel-1116] Setup CDP Monitor Foundation~~ [kernel-1116] Add CDP Monitor Apr 13, 2026

archandatta added 2 commits April 14, 2026 13:03

review: update types and sensitive interaction data

a62c403

feat: add two-layer CDP decode, protocol-faithful types, then monitor…

0605227

… projection

archandatta requested review from hiroTamada and rgarcia April 14, 2026 14:17

cursor bot reviewed Apr 14, 2026

View reviewed changes

Conversation

archandatta commented Apr 13, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

firetiger-agent bot commented Apr 13, 2026

Uh oh!

Uh oh!

Uh oh!

cursor bot Apr 13, 2026

Choose a reason for hiding this comment

Suffix-based MIME check inconsistent between capture functions

Uh oh!

hiroTamada left a comment

Choose a reason for hiding this comment

Uh oh!

hiroTamada Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

archandatta Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

rgarcia left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rgarcia Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

archandatta Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

rgarcia Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

archandatta Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

archandatta Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot Apr 13, 2026

Choose a reason for hiding this comment

Sweep calls onLoadingFinished while holding pendReqMu

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Apr 14, 2026

Choose a reason for hiding this comment

Console handler ignores event type, mislabels errors

Uh oh!

cursor bot Apr 14, 2026

Choose a reason for hiding this comment

Exported Health and MonitorHealth are unused

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

archandatta commented Apr 13, 2026 •

edited by cursor bot

Loading

Sweep calls `onLoadingFinished` while holding `pendReqMu`

Exported `Health` and `MonitorHealth` are unused