feat: harden reliability, remove global mutable state, fix test flakiness

- Remove configureDevtools global singleton; pass DevtoolsOptions through
  call sites to eliminate shared mutable state
- Cap __PING_DEVTOOLS_STATE__ at 500 entries to prevent memory leaks
- Guard localStorage/cookie access with try-catch for privacy modes
- Pin GitHub Actions to commit SHAs for supply-chain security
- Replace waitForTimeout with Playwright toPass/expect retries in e2e tests
- Fix CORS credentials-mismatch false positive when no credentials sent
- Remove hard-coded PKCE challengeMethod from token annotator
- Add origin check to content relay for defense-in-depth
- Fix service worker rehydration (module-eval vs activate lifecycle)
- Add defensive guards for snapshot loading and event-store hydration
- Clean up CDP client disconnect (reject pending calls, clear state)
- Properly dispose ManagedRuntime on VS Code extension deactivate
- Add devtools-core and vscode-extension to root tsconfig references
- Fix devtools-ui ports export to use .ts source

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ryanbas21

.github/workflows/publish-extension.yml

@@ -27,7 +27,7 @@ jobs:
         run: cd dist && zip -r ../extension-chrome.zip .
 
       - name: Upload to Chrome Web Store
-        uses: mnao305/chrome-extension-upload@v5.0.0
+        uses: mnao305/chrome-extension-upload@4008e29e13c144d0f6725462cbd49b7c291b4928 # v5.0.0
         with:
           file-path: packages/devtools-extension/extension-chrome.zip
           extension-id: ${{ secrets.CHROME_EXTENSION_ID }}
@@ -65,7 +65,7 @@ jobs:
         run: zip -r source.zip . -x 'node_modules/*' '*/node_modules/*' '*/dist/*' '.git/*' '*.zip'
 
       - name: Upload to Firefox Add-ons
-        uses: trmcnvn/firefox-addon@v1
+        uses: trmcnvn/firefox-addon@0d05671269b82c69c3f22ed86d8e772e89d47cf4 # v1
         with:
           uuid: oidc-devtool@wolfcola
           xpi: packages/devtools-extension/extension-firefox.zip

.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
 
       - name: Publish Chrome extension to testers
         if: inputs.extension
-        uses: mnao305/chrome-extension-upload@v5.0.0
+        uses: mnao305/chrome-extension-upload@4008e29e13c144d0f6725462cbd49b7c291b4928 # v5.0.0
         with:
           file-path: packages/devtools-extension/extension-chrome.zip
           extension-id: ${{ secrets.CHROME_EXTENSION_ID }}
@@ -77,7 +77,7 @@ jobs:
 
       - name: Publish Firefox extension (unlisted)
         if: inputs.extension
-        uses: trmcnvn/firefox-addon@v1
+        uses: trmcnvn/firefox-addon@0d05671269b82c69c3f22ed86d8e772e89d47cf4 # v1
         with:
           uuid: oidc-devtool@wolfcola
           xpi: packages/devtools-extension/extension-firefox.zip
@@ -108,7 +108,7 @@ jobs:
         run: pnpm build
 
       - name: Create release PR or publish
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           publish: pnpm release
           version: pnpm run version

e2e/fixtures/extension.ts

@@ -72,7 +72,7 @@ export const test = base.extend<TestFixtures>({
   mockServer: async ({}, use) => {
     const result = await createMockOidcServer(0);
     await use(result);
-    result.server.close();
+    await new Promise<void>((resolve) => result.server.close(() => resolve()));
   },
 });
 

e2e/tests/network-capture.test.ts

@@ -29,14 +29,13 @@ test.describe('network capture pipeline', () => {
       });
     }, `${mockServer.baseUrl}/.well-known/openid-configuration`);
 
-    await panelPage.waitForTimeout(1000);
-
-    await panelPage.reload();
-    await panelPage.waitForSelector('.toolbar', { state: 'visible' });
-    await panelPage.waitForTimeout(500);
-
-    const eventCount = await getEventCount(panelPage);
-    expect(eventCount).toBeGreaterThanOrEqual(1);
+    // Wait for the service worker to persist the event, then reload to verify
+    await expect(async () => {
+      await panelPage.reload();
+      await panelPage.waitForSelector('.toolbar', { state: 'visible' });
+      const eventCount = await getEventCount(panelPage);
+      expect(eventCount).toBeGreaterThanOrEqual(1);
+    }).toPass({ timeout: 5000 });
 
     await panelPage.close();
   });
@@ -75,8 +74,6 @@ test.describe('network capture pipeline', () => {
       });
     }, `${mockServer.baseUrl}/.well-known/openid-configuration`);
 
-    await panelPage.waitForTimeout(500);
-
     await panelPage.evaluate((url) => {
       chrome.runtime.sendMessage({
         type: 'NETWORK_EVENT',
@@ -104,13 +101,13 @@ test.describe('network capture pipeline', () => {
       });
     }, `${mockServer.baseUrl}/token`);
 
-    await panelPage.waitForTimeout(1000);
-    await panelPage.reload();
-    await panelPage.waitForSelector('.toolbar', { state: 'visible' });
-    await panelPage.waitForTimeout(500);
-
-    const eventCount = await getEventCount(panelPage);
-    expect(eventCount).toBeGreaterThanOrEqual(2);
+    // Wait for both events to be persisted, then reload to verify
+    await expect(async () => {
+      await panelPage.reload();
+      await panelPage.waitForSelector('.toolbar', { state: 'visible' });
+      const eventCount = await getEventCount(panelPage);
+      expect(eventCount).toBeGreaterThanOrEqual(2);
+    }).toPass({ timeout: 5000 });
 
     await panelPage.close();
   });

e2e/tests/panel-renders-events.test.ts

@@ -34,13 +34,13 @@ test.describe('panel renders events', () => {
       makeSdkEvent('test-sdk-1', 'test-flow-sdk-1'),
     );
 
-    await panelPage.waitForTimeout(500);
-    await panelPage.reload();
-    await panelPage.waitForSelector('.toolbar', { state: 'visible' });
-    await panelPage.waitForTimeout(500);
-
-    const after = await panelPage.locator('.tl-row').count();
-    expect(after).toBeGreaterThan(before);
+    // Wait for the event to be persisted, then reload to verify
+    await expect(async () => {
+      await panelPage.reload();
+      await panelPage.waitForSelector('.toolbar', { state: 'visible' });
+      const after = await panelPage.locator('.tl-row').count();
+      expect(after).toBeGreaterThan(before);
+    }).toPass({ timeout: 5000 });
 
     await panelPage.close();
   });
@@ -56,22 +56,19 @@ test.describe('panel renders events', () => {
       makeSdkEvent('test-sdk-clear', 'test-flow-clear'),
     );
 
-    await panelPage.waitForTimeout(500);
-    await panelPage.reload();
-    await panelPage.waitForSelector('.toolbar', { state: 'visible' });
-    await panelPage.waitForTimeout(500);
-
-    let rows = await panelPage.locator('.tl-row').count();
-    expect(rows).toBeGreaterThan(0);
+    // Wait for event to appear
+    await expect(async () => {
+      await panelPage.reload();
+      await panelPage.waitForSelector('.toolbar', { state: 'visible' });
+      const rows = await panelPage.locator('.tl-row').count();
+      expect(rows).toBeGreaterThan(0);
+    }).toPass({ timeout: 5000 });
 
     const clearBtn = panelPage.locator('.tb-btn', { hasText: 'Clear' });
-    if (await clearBtn.isVisible()) {
-      await clearBtn.click();
-      await panelPage.waitForTimeout(500);
+    await expect(clearBtn).toBeVisible();
+    await clearBtn.click();
 
-      rows = await panelPage.locator('.tl-row').count();
-      expect(rows).toBe(0);
-    }
+    await expect(panelPage.locator('.tl-row')).toHaveCount(0, { timeout: 3000 });
 
     await panelPage.close();
   });

packages/devtools-bridge/src/index.ts

@@ -4,10 +4,5 @@ export { attachJourneyBridge } from './lib/journey-bridge.js';
 export type { JourneyBridgeHandle } from './lib/journey-bridge.js';
 export { attachOidcBridge } from './lib/oidc-bridge.js';
 export type { OidcBridgeHandle } from './lib/oidc-bridge.js';
-export {
-  DEVTOOLS_EVENT_NAME,
-  emitAuthEvent,
-  emitConfigEvent,
-  configureDevtools,
-} from './lib/emit.js';
+export { DEVTOOLS_EVENT_NAME, emitAuthEvent, emitConfigEvent } from './lib/emit.js';
 export type { DevtoolsOptions } from './lib/emit.js';

packages/devtools-bridge/src/lib/bridge.ts

@@ -1,7 +1,7 @@
 import { Schema, Option, pipe } from 'effect';
 import type { SdkData } from '@wolfcola/devtools-types';
 import { SdkErrorSchema, SdkAuthorizationSchema } from '@wolfcola/devtools-types';
-import { emitAuthEvent, emitConfigEvent, configureDevtools } from './emit.js';
+import { emitAuthEvent, emitConfigEvent } from './emit.js';
 import type { DevtoolsOptions } from './emit.js';
 
 interface Subscribable {
@@ -95,51 +95,68 @@ interface SessionSnapshot {
 
 function snapshotSession(): SessionSnapshot {
   const storage: Record<string, string> = {};
-  for (let i = 0; i < localStorage.length; i++) {
-    const k = localStorage.key(i);
-    if (k) storage[k] = localStorage.getItem(k) ?? '';
+  try {
+    for (let i = 0; i < localStorage.length; i++) {
+      const k = localStorage.key(i);
+      if (k) storage[k] = localStorage.getItem(k) ?? '';
+    }
+  } catch {
+    // localStorage access blocked (e.g. privacy mode, opaque origin)
+  }
+  let cookie = '';
+  try {
+    cookie = document.cookie;
+  } catch {
+    // cookie access blocked
   }
-  return { cookie: document.cookie, storage };
+  return { cookie, storage };
 }
 
 function emitSessionDiffs(
   before: SessionSnapshot,
   after: SessionSnapshot,
   flowId: string | null,
+  options?: DevtoolsOptions,
 ): void {
   if (before.cookie !== after.cookie) {
-    emitAuthEvent({
-      id: crypto.randomUUID(),
-      timestamp: performance.now(),
-      type: 'session:cookie',
-      source: 'session',
-      flowId,
-      causedBy: null,
-      data: {
-        _tag: 'session',
-        key: 'document.cookie',
-        before: before.cookie || undefined,
-        after: after.cookie || undefined,
+    emitAuthEvent(
+      {
+        id: crypto.randomUUID(),
+        timestamp: performance.now(),
+        type: 'session:cookie',
+        source: 'session',
+        flowId,
+        causedBy: null,
+        data: {
+          _tag: 'session',
+          key: 'document.cookie',
+          before: before.cookie || undefined,
+          after: after.cookie || undefined,
+        },
+        flags: { isCors: false, isError: false, isAuthRelated: true },
       },
-      flags: { isCors: false, isError: false, isAuthRelated: true },
-    });
+      options,
+    );
   }
 
   const allKeys = new Set([...Object.keys(before.storage), ...Object.keys(after.storage)]);
   for (const key of allKeys) {
     const beforeVal = before.storage[key];
     const afterVal = after.storage[key];
     if (beforeVal !== afterVal) {
-      emitAuthEvent({
-        id: crypto.randomUUID(),
-        timestamp: performance.now(),
-        type: 'session:storage',
-        source: 'session',
-        flowId,
-        causedBy: null,
-        data: { _tag: 'session', key, before: beforeVal, after: afterVal },
-        flags: { isCors: false, isError: false, isAuthRelated: true },
-      });
+      emitAuthEvent(
+        {
+          id: crypto.randomUUID(),
+          timestamp: performance.now(),
+          type: 'session:storage',
+          source: 'session',
+          flowId,
+          causedBy: null,
+          data: { _tag: 'session', key, before: beforeVal, after: afterVal },
+          flags: { isCors: false, isError: false, isAuthRelated: true },
+        },
+        options,
+      );
     }
   }
 }
@@ -148,21 +165,24 @@ function emitSessionDiffs(
 // Event builders
 // ---------------------------------------------------------------------------
 
-function emitNodeChange(data: SdkData): void {
-  emitAuthEvent({
-    id: crypto.randomUUID(),
-    timestamp: performance.now(),
-    type: 'sdk:node-change',
-    source: 'sdk',
-    flowId: data.interactionId ?? null,
-    causedBy: null,
-    data,
-    flags: {
-      isCors: false,
-      isError: data.nodeStatus === 'error' || data.nodeStatus === 'failure',
-      isAuthRelated: true,
+function emitNodeChange(data: SdkData, options?: DevtoolsOptions): void {
+  emitAuthEvent(
+    {
+      id: crypto.randomUUID(),
+      timestamp: performance.now(),
+      type: 'sdk:node-change',
+      source: 'sdk',
+      flowId: data.interactionId ?? null,
+      causedBy: null,
+      data,
+      flags: {
+        isCors: false,
+        isError: data.nodeStatus === 'error' || data.nodeStatus === 'failure',
+        isAuthRelated: true,
+      },
     },
-  });
+    options,
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -187,10 +207,6 @@ export function attachDevToolsBridge(
     return { detach: () => undefined };
   }
 
-  if (devtoolsOptions) {
-    configureDevtools(devtoolsOptions);
-  }
-
   let previousStatus: string | undefined;
   let configEmitted = false;
   let lastSnapshot: SessionSnapshot = snapshotSession();
@@ -212,14 +228,19 @@ export function attachDevToolsBridge(
       Option.map((data) => {
         if (config && !configEmitted) {
           configEmitted = true;
-          emitConfigEvent(config);
+          emitConfigEvent(config, devtoolsOptions);
         }
-        emitNodeChange(data);
+        emitNodeChange(data, devtoolsOptions);
         // Snapshot before deferring so mutations in the same call stack are captured.
         const snapshotBefore = lastSnapshot;
         setTimeout(() => {
           const snapshotAfter = snapshotSession();
-          emitSessionDiffs(snapshotBefore, snapshotAfter, data.interactionId ?? null);
+          emitSessionDiffs(
+            snapshotBefore,
+            snapshotAfter,
+            data.interactionId ?? null,
+            devtoolsOptions,
+          );
           lastSnapshot = snapshotAfter;
         }, 0);
       }),