[fix]: close popups that violate domain policy

[seanmcguire12]

why

domain policy enforcement currently relies on Fetch.requestPaused, but popups opened with window.open() can reach their destination before Fetch interception is installed on the new target. in that race, the blocked popup may successfully open, & therefore break the domain policy

what changed

this PR adds a fallback close path for popup targets whose URL violates the active domain policy:

• this PR adds listening for Target.targetCreated, Target.targetInfoChanged, and attach-time target metadata for popup targets
• if a popup reaches a blocked/disallowed domain before request interception catches it, the popup gets closed via Target.closeTarget`

test plan

• added unit coverage for closing popup targets that already reached a blocked domain, including popups whose opener target is not locally tracked
• added unit coverage for duplicate and late target events so a successfully closed popup is not closed/logged repeatedly
• added unit coverage for the attach race where a targetCreated close is still in flight when attached handling runs; attach now continues if the close fails
• added unit coverage for close failures, including treating No target with given id found as a successful already-closed outcome for this domain-policy fallback only
• added integration coverage using the existing external popup fixture to verify a window.open() popup that reaches news.ycombinator.com is closed and not retained in context.pages()

---

Summary by cubic

Fixes a race where window.open() popups could reach blocked domains before interception by closing them immediately when their URL violates the active domain policy. Prevents blocked popups from appearing or lingering in context.pages().

• Bug Fixes

  • Listen to Target.targetCreated, Target.targetInfoChanged, and at attach-time; close popup via Target.closeTarget if its URL is disallowed.
  • Deduplicate close attempts across events and let attach wait for an in-flight close; continue attach if the close fails.
  • Treat “No target with given id found” as a successful already-closed outcome for this fallback; improve logging with rule reason and source.
  • Skip non-popup targets and persist successful close dedupe across late events.

• Dependencies

  • Add changeset to publish a patch for @browserbasehq/stagehand.

^{Written for commit a0dae3b. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: a0dae3b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@browserbasehq/stagehand	Patch
@browserbasehq/stagehand-evals	Patch
@browserbasehq/stagehand-server-v3	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[seanmcguire12]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@seanmcguire12 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 4 files

Confidence score: 4/5

• In packages/core/tests/integration/context-domain-policy.spec.ts, waitForTargetUrlDestroyed may miss popups opened directly at a blocked URL because it doesn’t subscribe to Target.targetCreated, which can leave targetId null and cause timeout-based failures; this is mainly a test reliability and coverage risk rather than a runtime break. Add handling for Target.targetCreated (alongside targetInfoChanged) before merging to de-flake this path and ensure the blocked-popup scenario is actually validated.

Architecture diagram

sequenceDiagram
    participant Browser as Browser / Page
    participant CDP as Chrome DevTools Protocol
    participant V3C as V3Context
    participant Policy as Domain Policy
    participant Logger

    Note over Browser,Logger: NEW: Popup domain policy fallback close

    Browser->>CDP: window.open(url)
    CDP-->>V3C: Target.targetCreated(targetInfo)
    V3C->>V3C: Check if popup (openerId/openerFrameId)
    alt Popup detected
        V3C->>Policy: getDomainPolicyDecision(url)
        alt Decision = "block"
            V3C->>V3C: Dedupe check (domainPolicyClosingTargets)
            Note over V3C: NEW: Launch close attempt
            V3C->>V3C: Store in-flight promise in domainPolicyClosePromises
            V3C->>CDP: Target.closeTarget(targetId)
            alt Close succeeds
                CDP-->>V3C: OK
                V3C->>V3C: Add to domainPolicyClosingTargets
                V3C->>Logger: Log popup closed
            else Close fails (not missing target)
                CDP-->>V3C: Error
                V3C->>V3C: Remove in-flight promise (allow retry)
                V3C->>Logger: Log failure
            else Close fails with "No target with given id found"
                CDP-->>V3C: Error
                V3C->>V3C: Treat as already closed (success)
                V3C->>V3C: Add to domainPolicyClosingTargets
            end
        else Decision = "continue"
            V3C-->>V3C: No action
        end
    end

    Note over Browser,V3C: Later events (if popup still alive)

    CDP-->>V3C: Target.targetInfoChanged(updatedInfo)
    V3C->>V3C: Check dedupe (domainPolicyClosingTargets)
    alt Not already closed
        V3C->>Policy: getDomainPolicyDecision(url)
        alt Decision = "block"
            V3C->>CDP: Target.closeTarget(targetId)
            Note over V3C: Same close flow as above
        end
    else Already closed
        V3C-->>V3C: Skip (dedup)
    end

    CDP-->>V3C: Target.attached(targetInfo, sessionId)
    V3C->>V3C: Check if in-flight close promise exists
    alt In-flight close exists
        V3C->>V3C: Await existing close promise
        alt Close succeeded
            V3C-->>V3C: Skip normal page setup (return early)
        else Close failed
            V3C->>V3C: Continue with normal attach
        end
    else No in-flight close
        V3C->>Policy: getDomainPolicyDecision(url)
        alt Decision = "block"
            V3C->>CDP: Target.closeTarget(targetId)
            Note over V3C: Same close flow, then return early
        else Decision = "continue"
            V3C->>V3C: Normal attached handling (page setup)
        end
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>