[release/13.3] Add BrowserLogs tracked browser sessions#16637
Merged
joperezr merged 13 commits intorelease/13.3from May 1, 2026
Merged
[release/13.3] Add BrowserLogs tracked browser sessions#16637joperezr merged 13 commits intorelease/13.3from
joperezr merged 13 commits intorelease/13.3from
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Switch owned tracked-browser launches to a private CDP pipe, keep WebSocket adoption as an opt-in seam, and add session/persistent process lifetime configuration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
BrowserLogs pipe-launched browsers are always session scoped because Chromium exits when the CDP pipe closes. Remove the public lifetime option and mark public BrowserLogs types experimental. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move platform-specific native launch logic into Windows and Unix partial classes while keeping the shared launcher entry points in the common file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace the managed fork/exec launcher with posix_spawn file actions so Chromium still receives CDP pipe fds 3 and 4 without running managed code in a forked child. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the BrowserLogs capability from the Hosting assembly scanner snapshot now that BrowserLogs lives in Aspire.Hosting.Browsers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stop relying on InternalsVisibleTo for the Browsers package and its tests by source-sharing the BrowserLogs implementation into the test assembly and replacing Hosting-internal runtime dependencies with public-compatible behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add a public CustomResourceSnapshot helper for publishing health reports without InternalsVisibleTo and use it to restore BrowserLogs session and last-error health report rows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add translator comments for BrowserLogs resource strings with format placeholders and regenerate XLF files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Fix null-forgiveness on screenshot Data property to throw InvalidOperationException instead of ArgumentNullException - Guard _stopCts.Cancel() against ObjectDisposedException when MonitorAsync cleanup races with StopAsync - Block '..' path traversal in SanitizePathSegment Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
aspire-repo-bot
Bot
requested review from
JamesNK,
danegsta,
davidfowl,
karolz-ms and
mitchdenny
as code owners
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16637Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16637" |
Contributor
|
🎬 CLI E2E Test Recordings — 66 recordings uploaded (commit View all recordings
📹 Recordings uploaded automatically from CI run #25203674502 |
joperezr
approved these changes
May 1, 2026
Contributor
Author
|
No documentation PR is required for this change. The [
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #16565 to release/13.3
/cc @davidfowl
Customer Impact
Customers targeting release/13.3 get BrowserLogs as an isolated prerelease hosting package and with tracked Chromium sessions using a private CDP pipe instead of an exposed browser debugging WebSocket/TCP endpoint. Without this backport, the release/13.3 BrowserLogs implementation would miss the package split and the pipe transport security mitigation, leaving the feature more likely to expose or reuse a browser debugging socket across AppHost runs. The feature enables dashboard-opened tracked browser sessions to capture browser console/runtime/network diagnostics, screenshots, and browser-session health reports.
Testing
Source PR validation included targeted BrowserLogs build/test coverage, Aspire.Hosting health report test coverage, TypeScript codegen capability tests, multi-language code generation snapshot tests, package creation for Aspire.Hosting.Browsers, and BrowserTelemetry playground E2E validation via
aspire start --isolated,open-tracked-browser, andaspire logs web-browser-logsconfirming CDP pipe sessions, network/console logs, health reports, and cleanup on stop. I also smoke-tested BrowserTelemetry on Windows from this branch after merge with tracked Edge launch, private CDP pipe session state, network log capture, healthy BrowserLogs state, and screenshot capture.Risk
Medium. The change is opt-in and isolated to the experimental BrowserLogs surface and prerelease Aspire.Hosting.Browsers package, and it improves security posture by replacing exposed browser debugging WebSocket/TCP endpoints with private CDP pipes that are scoped to the tracked browser session. It still touches public API, package factoring, resource commands, platform-specific browser process launch/cleanup logic, CDP transport, dashboard-observable state, and localized resources.
Regression?
No - the source PR describes experimental feature factoring and security hardening for BrowserLogs rather than a regression fix.