From ea89f050cdb3a2fd9de1b008c3a0f6c7ef8ba9f8 Mon Sep 17 00:00:00 2001
From: Marc Bachmann <marc.brookman@gmail.com>
Date: Fri, 29 May 2026 20:20:46 +0200
Subject: [PATCH] Fix puppeteer `exposeFunction` end-to-end: real bindings,
 preload timing, URL coercion (#166)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(js): coerce URL constructor input/base to string

The polyfill at bootstrap.js called `base.match(...)` directly, which
threw `TypeError: base.match is not a function` whenever callers passed
a Location object (e.g. `new URL(href, window.location)`), a URL
instance, or any other non-string with a sensible toString. Per the
WHATWG URL Standard both `url` and `base` are stringified before
parsing.

Coerce explicitly so the existing regex paths keep working and the
constructor matches real-browser behaviour. AngularJS, jQuery, and
anything that resolves a relative URL against `window.location` now
loads under Obscura.

* fix(browser,cdp): run preload scripts before page scripts

`Page.addScriptToEvaluateOnNewDocument` was executed AFTER the page's
own scripts (and even after the load event), which silently broke
every CDP contract that depends on early injection — most visibly
puppeteer's `page.exposeFunction`, whose user-facing wrapper has to
override `globalThis[name]` before any `<script>` tag in the document
runs.

Move the registered preload sources onto `Page` and execute them
inside `navigate_single`, right after `__documentReadyState__ =
'loading'` and before the parser-discovered scripts. The CDP layer
hands the current preload set to the page via `set_preload_scripts`
before kicking off navigation, replacing the two post-navigate
`execute_preload_script` loops in `domains/page.rs` and `server.rs`.

* feat(cdp,js): emit Runtime.bindingCalled for addBinding shims

`Runtime.addBinding` was a no-op stub that installed an empty
`globalThis[name] = function () { return null; }` placeholder. Page JS
calls were silently swallowed and the Node-side callback registered
via puppeteer's `page.exposeFunction` never fired.

Wire the binding all the way through:

1. New `op_binding_called(name, payload)` op forwards every page-side
   call into a `pending_binding_calls` queue on `ObscuraState`.
2. `Page::take_pending_binding_calls` drains the queue.
3. `dispatch()` empties every page's queue after each CDP request and
   pushes one `Runtime.bindingCalled` event per entry into
   `ctx.pending_events`, so the writer task forwards them to the
   client like any other CDP event.
4. The `addBinding` handler installs a real shim that calls the op,
   registers it as a preload script (keyed `__obscura_binding__<name>`)
   so it survives navigations, and evaluates it now so the binding is
   usable on the current document.
5. Implement `removeBinding` to mirror `addBinding`.

The shim coerces non-string arguments via `JSON.stringify`, matching
the wire contract that puppeteer's `exposeFunction` wrapper depends
on (`Runtime.bindingCalled.params.payload` is always a string).

* fix(cdp): emit canAccessOpener in all TargetInfo payloads, add aarch64 cross-compile CI

Merges PR #165 and PR #172.

PR #165: The CDP spec marks canAccessOpener as a required boolean on
TargetInfo but Obscura was omitting it. Strict Rust clients like
chromiumoxide reject the event entirely and panic with "Created target
not present" when the field is absent. Added canAccessOpener: false
to every TargetInfo emitted by setDiscoverTargets, getTargets,
createTarget, attachToBrowserTarget, attachToTarget, and getTargetInfo.

PR #172: Added a cross-compile matrix entry for aarch64-unknown-linux-gnu
running on ubuntu-22.04 x86_64, producing obscura-aarch64-linux-cross.
This is a fallback for when GitHub ARM runners are unavailable without
removing the native ARM build.

* fix(cdp): keep HTTP control plane reachable while V8 JS evaluation blocks (#173)

fix(cdp): unblock HTTP control plane during synchronous V8 execution

Fixes #62.

Previously, the TCP accept loop and CDP processor shared a single-threaded
tokio LocalSet. Long synchronous JS evaluations starved the accept loop,
causing incoming connections to hang in the kernel backlog and effectively
killing the HTTP control plane.

This moves the TCP listener and `/json/*` endpoints to a dedicated OS
thread using `std::net::TcpListener`. HTTP requests are now handled
directly via blocking I/O on this thread, completely bypassing V8.

WebSocket connections are handed off to the LocalSet via a bounded mpsc
channel (capacity 128). If V8 stalls and the queue fills, new WS
connections are dropped (ECONNRESET) rather than buffering unboundedly
to prevent OOMs.

Includes a new integration test to verify the control plane stays
responsive during a 5s JS loop, plus inline documentation clarifying
thread lifetime semantics and a minor test TOCTOU race.

* fix(js,dom): add Storage global, CharacterData ChildNode methods, fix remove/isConnected (#176)

fix(dom): add missing DOM/JS shims for modern frameworks

Closes #163.

Adds missing DOM and JS shims required by modern frameworks (Svelte 5,
Vue, Lit) and consent-management SDKs to execute without errors:

- Define the `Storage` global constructor to resolve `ReferenceError`s
  and fix `Storage.prototype` access.
- Apply standard ChildNode methods (`before`, `after`, `replaceWith`,
  `remove`) to `CharacterData.prototype`. This prevents `TypeError`s when
  frameworks call these on Text or Comment nodes during hydration.
- Update `Element.prototype.isConnected` to perform a genuine parent-walk
  rather than returning a hardcoded `true`.
- Fix `Element.prototype.remove` to properly clean up the internal ID
  index so removed elements are no longer queryable.
- Remove outdated no-op stubs on the `Element` class that were shadowing
  the proper polyfill implementations.

* feat(cli): add --dump assets to inventory page sub-resources (124) (#174)

feat: add `--dump assets` to enumerate page sub-resources

Adds a `--dump assets` flag to output all page-referenced sub-resources
(scripts, stylesheets, images, iframes, media, embeds, objects) as NDJSON,
allowing users to easily replay the asset graph.

- Output format: `{"url":"https://example.test/app.js","type":"script"}`
- URLs are resolved against the page origin (matching `--dump links`).
- The `type` tag is derived from the source element. `<link>` elements map
  their `rel` attribute to specific types (stylesheet, icon, manifest, preload,
  prefetch, modulepreload, dns-prefetch, preconnect, alternate), falling back
  to "link" if missing or unknown.
- Adds 7 tests covering URL resolution, rel-mapping, supported selectors,
  and empty-attribute skipping.
- Updates README dump-format table and examples.

* fix(cdp,js): playwright actionability stubs and objectId resolve (#178)

Playwright fails locator actions on Obscura for two avoidable reasons
that are separate from the missing layout engine. Both have trivial
fixes that unblock the actionability polling loop.

- Element.checkVisibility(opts) was undefined. Playwright >= 1.25 calls
  it before every input event and retries until its action timeout if
  the method isn't a function. Add a stub that returns true. Without a
  layout pass we can't compute it for real, but a permissive stub still
  beats the undefined-function path.

- ARIA reflection properties were missing on Element (role, ariaLabel,
  ariaSelected, ariaExpanded, ariaHidden, ariaChecked, ariaDisabled,
  ariaRoleDescription). Playwright's getByRole and getByLabel locators
  read them. Reflect through to the underlying aria-* attributes for
  both read and write.

- DOM.getBoxModel and DOM.getContentQuads ignored the objectId param.
  Playwright passes only objectId (from a prior DOM.resolveNode), and
  the handlers silently defaulted to node 0, so dispatchMouseEvent
  always clicked the wrong element. Extract a resolve_node_id helper
  that honors nodeId, backendNodeId, and objectId in that order.

- Page.captureScreenshot and Page.captureSnapshot now return a clear
  "not supported, use a real Chromium for the screenshot leg" error
  instead of the generic "Unknown Page method" fallback. Matches the
  pattern already in place for Page.printToPDF.

Partial fix for #45. The architectural blocker (no layout engine, so
multi-element click coordinates are wrong) is unchanged.

* fix(mcp): allow browser MCP clients through CORS preflight (#179)

The OPTIONS preflight hardcoded Access-Control-Allow-Headers to just
Content-Type. Any browser MCP client sending mcp-protocol-version (per
the MCP spec) or Authorization / X-API-Key (typical for hosted
deployments) failed the preflight and the browser blocked the actual
request.

Add those three to the allow-list and a 24h Max-Age so browsers don't
re-preflight every call. Adds an integration test that drives the
server with a real preflight request.

Closes #175.

* fix(js,dom): scope element queries, real timers, form/prepend/equal (#180)

- Element.querySelector / querySelectorAll scope to the receiver subtree
  via a new query_selector_scoped Rust op, not always document root.
  Same for DocumentFragment.
- setTimeout respects its delay argument via a new async op_sleep.
  setInterval is a real repeating timer instead of an alias to setTimeout.
- document.forms / images / links return live querySelectorAll results
  instead of hardcoded [].
- HTMLFormElement subclasses Element with .elements / .length, and form
  nodes are wrapped as HTMLFormElement so instanceof works. submit()
  stays on Element.prototype to preserve the existing submit-event
  dispatch and form-data navigation path.
- Element.prepend has a real implementation.
- Node.isEqualNode does a structural compare (nodeType, nodeName,
  nodeValue, attributes, recursive children) instead of nid identity.
- Fix long-standing insert_before arg-order bug: bootstrap.js was
  passing (parent, new, ref) but _dom only forwards two args, so ref
  was silently dropped. Pass (new, ref) directly. Same fix in
  replaceChild.

Adds 3 selector unit tests and 6 runtime regression tests covering
the JS shim fixes.

Closes #105.

* fix(cdp): unblock puppeteer connect, bound Runtime.evaluate, full TargetInfo (#181)

Three independent gaps that hurt browser-based MCP clients connecting
to obscura's CDP endpoint:

- Runtime.enable returned "No page" when called before a session was
  attached. puppeteer-extra's FrameManager.initialize fires it on the
  browser-level WebSocket BEFORE any page target exists, so the
  standard puppeteer.connect / browser.newPage flow died on connect.
  Now reply with {} when no session is attached and let the next
  Target.attachToTarget emit executionContextCreated.

- Runtime.evaluate had no per-call timeout. A long synchronous JS
  expression held the global V8 lock indefinitely and starved every
  other CDP command on the session. Honor the CDP `timeout` parameter
  and default to 30s (Chrome's protocolTimeout). Returns a clear error
  on expiry so client-side deadlines fire cleanly instead of hanging.

- Target.getTargetInfo for the browser target omitted canAccessOpener.
  Strict CDP clients (chromiumoxide) panic when the field is missing.
  Fill it in (false for the browser target itself).

Partial fix for #122. The remaining items (networkIdle hard-deadline
on SPAs, /json/list hardcoded data, docs on cheap-vs-queued methods)
need bigger or non-code changes and are deferred.

* fix(net,browser): detect response charset, decode non-UTF-8 pages (#182)

obscura was calling String::from_utf8_lossy on every response body, which
silently corrupts every non-UTF-8 page (GBK, Big5, Shift-JIS, Windows-125x,
EUC-KR, ISO-8859-x). Whole language families came through as replacement
characters.

Add an encoding module (obscura-net::encoding) that picks the decoder
the way real browsers do per HTML5 § 8.2.2.4:

  1. HTTP Content-Type charset=... parameter (authoritative when present)
  2. <meta charset> or <meta http-equiv=Content-Type> sniffed from the
     first 1KB of the body (HTML only)
  3. UTF-8 fallback

Use it in:
  - obscura-net Response::text (signature changed: String, not Result)
  - obscura-browser page.rs HTML body decode (the primary scrape path)
  - obscura-browser page.rs JS body decode
  - obscura-browser page.rs CSS body decode

For JS / CSS we deliberately skip the meta sniff: those bodies are not
HTML and any '<meta charset=...>' substring inside them is not a charset
declaration.

Adds 7 unit tests for the encoding module covering header precedence,
quoted charset values, meta charset sniff, http-equiv form, the 1KB
sniff window, and a round-trip decode of GBK bytes. Adds a Python
feature test exercising file:// + meta charset and a live HTTP server
serving Shift_JIS with the wrong meta tag.

Closes #113.

* feat(cdp): implement Network.setCookie + deleteCookies, full field fidelity (#170)

* feat(cdp): implement Network.setCookie + deleteCookies, full field fidelity

Closes #168.

Adds the missing Network.setCookie (singular) and Network.deleteCookies
methods and upgrades the existing Network.setCookies/getCookies handlers
so sameSite, expires, httpOnly, secure, and the url-fallback parameter
all round-trip correctly.

Network and Storage cookie handlers share a single parse_cdp_cookie /
parse_delete_cookies_params helper to avoid drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cdp): fall back to default cookie jar, add Network.getAllCookies

Addresses @SGavrl review on PR #170:

- Network.{set,get,delete}Cookie(s)/clearBrowserCookies now resolve the
  cookie jar via a shared helper that prefers the session page's jar and
  falls back to ctx.default_context.cookie_jar when no target has been
  attached. Mirrors how Storage.setCookies already routes when there is
  no session, so Puppeteer/Playwright flows that issue cookie methods
  before Target.attachToTarget no longer hit "No page".
- Add Network.getAllCookies (separate CDP method per spec); aliases the
  existing getCookies handler so both arms return the full jar.

Tests: 6 new #[tokio::test] cases in domains::network::tests cover the
no-session fallback for set/get/setMany/delete/clear and the new
getAllCookies arm. RED on prod-reverted file (6/6 fail with "No page" /
"Unknown Network method: getAllCookies"), GREEN on patched
(22 -> 30 obscura-cdp lib tests, obscura-net 22/22 baseline preserved).

* fix(net): use bundled webpki roots in stealth client (#184) (#185)

set_default_paths only resolves OpenSSL's compile-time CA dirs, which
  exist on Linux but are empty on Windows. The stealth client's cert store
  ended up empty there and every TLS handshake failed with
  CERTIFICATE_VERIFY_FAILED inside BoringSSL handshake.cc.

  CertStore::default() uses wreq's bundled webpki-root-certs (Mozilla's
  trust list), which behaves the same on every platform and removes the
  dependency on a system CA store.

* fix(js): Element.attributes, on* event defaults, per-nid getBoundingClientRect (#45) (#186)

Three DOM-completeness gaps that broke jQuery 1.11.3 init and Playwright
  actionability:

  1. Element.attributes was undefined, so legacy IE feature-detect code
     like div.attributes[eventName].expando threw TypeError. Added a
     NamedNodeMap-like backed by a new attribute_names DOM op (length,
     numeric index, string name lookup, getNamedItem/setNamedItem,
     iterable).

  2. Standard on* event handler properties were missing from window, so
     ('on' + ev) in window returned false and forced jQuery into the
     legacy IE branch. Initialised the 79 HTML-spec on* handlers to null.

  3. getBoundingClientRect returned the same {x:8,y:8,width:100,height:20}
     literal for every element, so Playwright's hit-testing couldn't tell
     elements apart. Replaced with a deterministic synthesis from _nid
     mapped into a 12-column grid sized to a 1280x720 viewport. Still not
     pixel-accurate (no layout engine), but stable across reads and
     distinct per node.

* feat: cookie jar persistence + --storage-dir flag + fix HTTP cookie header filtering (#114)

* feat: cookie jar persistence + storage-dir + filtering fix (clean v4)

* fix: resolve build errors, add storage_dir param throughout server chain

* fix: storage_dir end-to-end, plus two test-literal field additions

  Five issues found while testing PR 114 end-to-end.

  Build fixes (two test literals out of sync with new struct fields):
  - crates/obscura-net/src/cookies.rs: CookieInfo literal in
    test_domain_matches_subdomain_without_leading_dot was missing the
    same_site and expires fields added in #170.
  - crates/obscura-cli/src/main.rs: Command::Fetch literal in
    matcher_still_uses_fetch_variant was missing the new storage_dir
    field. Without these cargo test --workspace would not compile.

  run_fetch was branching between BrowserContext::with_storage (which
  hardcodes proxy=None, stealth=false, user_agent=None) and
  with_options (which has no storage_dir slot), so --storage-dir +
  --proxy + --stealth silently dropped the proxy and stealth flags.
  Same bug SGavrl flagged on dispatch.rs in the previous round, just on
  the other code path. Switched to with_storage_full which carries all
  four. Verified the fetch now errors out against an invalid proxy.

  run_fetch --eval short-circuited the function before
  context.save_cookies() ran, so cookies set during an eval session
  were never persisted to {storage_dir}/cookies.json. Moved the save
  above the return.

  obscura serve loaded cookies on startup but never saved them
  anywhere, so a session that set cookies via Network.setCookie or
  navigation dropped them on shutdown. Subscribed to Ctrl-C once in
  put a single save_cookies() after the loop so both the Ctrl-C path
  and the channel-closed path persist cookies. Verified end-to-end.

---------

Co-authored-by: zhangyang-crazy-one <zhangyang.crazyone@gmail.com>
Co-authored-by: SGavrl <277843151+SGavrl@users.noreply.github.com>

* fix(cdp): page.goto returns Response over Puppeteer and Playwright (#189) (#190)

Two correlation invariants real Chrome holds were missing, so the
  nav Response was never attached to goto().

  requestId === loaderId for the main Document event. Both clients
  gate isNavigationRequest() on this; we were emitting a synthetic
  per-page id.

  Network.requestWillBeSent for the Document fires before
  Page.frameNavigated. Playwright's FrameManager needs the request
  present as pendingDocument before the frame commits, otherwise
  currentDocument lands with request=undefined.

  Subresource events and the Document's responseReceived /
  loadingFinished stay where they were.

  Verified end-to-end on both clients against example.com (200),
  google.com (200), httpbin/404 (404).

* fix(browser,cdp): run preloads on about:blank, tighten binding shim arity

Two follow-ups from PR #166 review:

- navigate_single's about: branch returned before any preload sources
  ran, so addScriptToEvaluateOnNewDocument scripts and the
  Runtime.addBinding shim never installed on about:blank. Puppeteer
  hits this every session: browser.newPage() lands on about:blank and
  exposeFunction is dead until the first real navigation. Now the
  about: branch runs the preload set after init_js(), guarded by the
  same 5s timeout as regular preloads.

- The Runtime.addBinding shim used JSON.stringify on non-string args
  and silently accepted any arity. Chromium's V8InspectorImpl rejects
  calls without exactly one argument and ToString-coerces that arg
  before emitting Runtime.bindingCalled. Match that: guard on
  arguments.length and use String(arg) for the non-string branch.
  Single-string calls (the path puppeteer's exposeFunction wrapper
  uses) round-trip unchanged.

* fix(cdp): allocate fresh execution context ids per isolated world (#192) (#200)

Page.createIsolatedWorld and do_navigate both hardcoded context id 100
  for every isolated world emission. After the second navigation Playwright
  expected a fresh incrementing id (101, 102) while obscura kept re-using
  100. Runtime.evaluate then failed with 'Cannot find context with
  specified id: 101' because the id was never registered in
  valid_context_ids and the client's bookkeeping had diverged from the
  server's.

  Added next_isolated_context_id counter on CdpContext (starts at 100) and
  a next_isolated_context() helper that claims an id, registers it in
  valid_context_ids, and increments. Both call sites now use it.

* feat(cli): default V8 heap to 4 GB on 64-bit so heavy SPAs don't OOM (#199) (#202)

V8 embedded defaults to ~1.4 GB max-old-space on 64-bit. Pages with
  heavy fingerprinting or analytics bundles (e.g. demo.fingerprint.com/
  web-scraping) blow past it and the worker dies with
  'Fatal JavaScript out of memory' and SIGTRAP, taking the CDP session
  with it.

  Always set --max-old-space-size=4096 (1024 on 32-bit targets) before
  V8 startup, matching headless Chrome's default. User-supplied
  --v8-flags are appended after the default so they win (V8 parses
  left-to-right and the last value wins), which keeps the existing
  escape hatch intact for memory-constrained environments.

---------

Co-authored-by: SGavrl <277843151+SGavrl@users.noreply.github.com>
Co-authored-by: Ben Younes <benyounes.ousama@gmail.com>
Co-authored-by: zhangyang-crazy-one <740884666@qq.com>
---
 crates/obscura-browser/src/page.rs        | 44 +++++++++++++++++++
 crates/obscura-cdp/src/dispatch.rs        | 46 ++++++++++++++++++++
 crates/obscura-cdp/src/domains/page.rs    | 11 +++--
 crates/obscura-cdp/src/domains/runtime.rs | 53 ++++++++++++++++++-----
 crates/obscura-cdp/src/server.rs          |  9 ++--
 crates/obscura-js/js/bootstrap.js         |  6 +++
 crates/obscura-js/src/ops.rs              | 16 +++++++
 crates/obscura-js/src/runtime.rs          |  4 ++
 8 files changed, 167 insertions(+), 22 deletions(-)

diff --git a/crates/obscura-browser/src/page.rs b/crates/obscura-browser/src/page.rs
index a3e2b43..dd72551 100644
--- a/crates/obscura-browser/src/page.rs
+++ b/crates/obscura-browser/src/page.rs
@@ -137,6 +137,11 @@ pub struct Page {
     pub intercept_enabled: bool,
     pub intercept_block_patterns: Vec<String>,
     intercept_tx: Option<tokio::sync::mpsc::UnboundedSender<obscura_js::ops::InterceptedRequest>>,
+    // Scripts to execute in the page's JS context BEFORE any of the page's
+    // own scripts run — the CDP `Page.addScriptToEvaluateOnNewDocument`
+    // contract. Includes `Runtime.addBinding` shims so puppeteer's
+    // `exposeFunction` bindings exist before inline `<script>` tags execute.
+    preload_scripts: Vec<String>,
     #[cfg(feature = "stealth")]
     pub stealth_client: Option<Arc<StealthHttpClient>>,
 }
@@ -181,6 +186,7 @@ impl Page {
             intercept_enabled: false,
             intercept_block_patterns: Vec::new(),
             intercept_tx: None,
+            preload_scripts: Vec::new(),
             #[cfg(feature = "stealth")]
             stealth_client,
         }
@@ -416,6 +422,20 @@ impl Page {
             let _ = js.execute_script("<ready-state>", "globalThis.__documentReadyState__ = 'loading';");
         }
 
+        // CDP `Page.addScriptToEvaluateOnNewDocument` contract: preload
+        // sources must run BEFORE any of the page's own scripts. This is
+        // also where puppeteer's `exposeFunction` wrapper installs itself —
+        // if preload runs after page scripts, every early binding call
+        // hits an undefined function and silently no-ops.
+        let preload_sources = self.preload_scripts.clone();
+        if let Some(js) = &mut self.js {
+            for source in &preload_sources {
+                if let Err(e) = js.execute_script_guarded("<preload>", source.as_str()) {
+                    tracing::debug!("Preload script error: {}", e);
+                }
+            }
+        }
+
         for (i, script) in all_to_execute.iter().enumerate() {
             if script.src.is_some() {
                 if let Some((url, code, resp)) = fetched.remove(&i) {
@@ -616,6 +636,18 @@ impl Page {
         if url.scheme() == "about" {
             self.navigate_blank();
             self.init_js();
+            // Preloads (Page.addScriptToEvaluateOnNewDocument, the
+            // Runtime.addBinding shim) must run on about:blank too —
+            // puppeteer's `browser.newPage()` lands on about:blank and
+            // a follow-up `exposeFunction` is unusable otherwise.
+            let preload_sources = self.preload_scripts.clone();
+            if let Some(js) = &mut self.js {
+                for source in &preload_sources {
+                    if let Err(e) = js.execute_script_guarded("<preload>", source.as_str()) {
+                        tracing::debug!("Preload script error on about:blank: {}", e);
+                    }
+                }
+            }
             return Ok(());
         }
 
@@ -1023,6 +1055,18 @@ impl Page {
         }
     }
 
+    pub fn take_pending_binding_calls(&self) -> Vec<(String, String)> {
+        if let Some(js) = &self.js {
+            js.take_pending_binding_calls()
+        } else {
+            Vec::new()
+        }
+    }
+
+    pub fn set_preload_scripts(&mut self, scripts: Vec<String>) {
+        self.preload_scripts = scripts;
+    }
+
     pub async fn process_pending_navigation(&mut self) -> Result<bool, PageError> {
         if let Some((url, method, body)) = self.take_pending_navigation() {
             self.navigate_with_wait_post(
diff --git a/crates/obscura-cdp/src/dispatch.rs b/crates/obscura-cdp/src/dispatch.rs
index 3c89f5c..cbc8797 100644
--- a/crates/obscura-cdp/src/dispatch.rs
+++ b/crates/obscura-cdp/src/dispatch.rs
@@ -272,6 +272,8 @@ pub async fn dispatch(req: &CdpRequest, ctx: &mut CdpContext) -> CdpResponse {
         _ => Err(format!("Unknown domain: {}", domain)),
     };
 
+    drain_binding_calls(ctx);
+
     match result {
         Ok(value) => CdpResponse::success(req.id, value, req.session_id.clone()),
         Err(msg) => {
@@ -281,6 +283,50 @@ pub async fn dispatch(req: &CdpRequest, ctx: &mut CdpContext) -> CdpResponse {
     }
 }
 
+// Drain every page's binding-call queue (filled by op_binding_called when
+// page JS invokes a `Runtime.addBinding` shim) and turn each entry into a
+// Runtime.bindingCalled CDP event that the writer task forwards to the
+// connected client. Called after every dispatch — binding calls only land
+// in the queue while V8 is running inside a CDP handler, so there is no
+// window in which they could pile up without a draining opportunity.
+fn drain_binding_calls(ctx: &mut CdpContext) {
+    // page_id -> session_id (any one session that holds this page).
+    let page_to_session: HashMap<String, String> = ctx
+        .sessions
+        .iter()
+        .map(|(sid, pid)| (pid.clone(), sid.clone()))
+        .collect();
+
+    let mut events: Vec<CdpEvent> = Vec::new();
+    for page in &mut ctx.pages {
+        let calls = page.take_pending_binding_calls();
+        if calls.is_empty() {
+            continue;
+        }
+        let Some(session_id) = page_to_session.get(&page.id).cloned() else {
+            // No session attached — drop the calls; there is no client to
+            // deliver them to.
+            continue;
+        };
+        for (name, payload) in calls {
+            events.push(CdpEvent {
+                method: "Runtime.bindingCalled".into(),
+                // Use executionContextId=2: the default main-frame context
+                // emitted post-navigation (see domains/page.rs phase1).
+                // Puppeteer matches on session_id + binding name and
+                // tolerates any registered context id.
+                params: json!({
+                    "name": name,
+                    "payload": payload,
+                    "executionContextId": 2,
+                }),
+                session_id: Some(session_id.clone()),
+            });
+        }
+    }
+    ctx.pending_events.extend(events);
+}
+
 async fn dispatch_send_message_to_target(req: &CdpRequest, ctx: &mut CdpContext) -> CdpResponse {
     let session_id = req
         .params
diff --git a/crates/obscura-cdp/src/domains/page.rs b/crates/obscura-cdp/src/domains/page.rs
index 5751fca..4c1ab3c 100644
--- a/crates/obscura-cdp/src/domains/page.rs
+++ b/crates/obscura-cdp/src/domains/page.rs
@@ -50,6 +50,11 @@ async fn do_navigate(
         let frame_id = page.frame_id.clone();
         let loader_id = format!("loader-{}", uuid::Uuid::new_v4());
 
+        // Preloads (addBinding shims, addScriptToEvaluateOnNewDocument sources)
+        // must run BEFORE the page's own scripts (CDP contract). Hand them to
+        // the page so navigate_single can inject them at the right point.
+        page.set_preload_scripts(preload_scripts);
+
         let nav_method = params.get("__method").and_then(|v| v.as_str()).unwrap_or("GET");
         let nav_body = params.get("__body").and_then(|v| v.as_str()).unwrap_or("");
         if nav_method == "POST" && !nav_body.is_empty() {
@@ -58,12 +63,6 @@ async fn do_navigate(
             page.navigate_with_wait(url, wait_until).await.map_err(|e| e.to_string())?;
         }
 
-        for source in &preload_scripts {
-            if let Err(e) = page.execute_preload_script(source) {
-                tracing::debug!("Preload script error: {}", e);
-            }
-        }
-
         let reached_network_idle = page.lifecycle.is_network_idle();
         let network_events: Vec<_> = page.network_events.drain(..).collect();
         let page_url = page.url_string();
diff --git a/crates/obscura-cdp/src/domains/runtime.rs b/crates/obscura-cdp/src/domains/runtime.rs
index 3d9c55d..0e801dc 100644
--- a/crates/obscura-cdp/src/domains/runtime.rs
+++ b/crates/obscura-cdp/src/domains/runtime.rs
@@ -211,19 +211,50 @@ pub async fn handle(
             Ok(json!({}))
         }
         "addBinding" => {
+            let name = params.get("name").and_then(|v| v.as_str()).unwrap_or("");
+            if !name.is_empty()
+                && name.chars().all(|c| c.is_alphanumeric() || c == '_' || c == '$')
+                && !name.chars().next().unwrap_or('0').is_ascii_digit()
+            {
+                // The shim forwards every call back to Rust through
+                // op_binding_called; the CDP dispatcher then drains the
+                // queue and emits Runtime.bindingCalled events the same
+                // way Chromium does. Chromium's V8InspectorImpl rejects
+                // calls without exactly one argument and ToString-coerces
+                // that argument before emitting it as the payload — we
+                // match the coercion (`String(arg)`) and silently drop
+                // calls with wrong arity, which is what Chrome does.
+                let shim = format!(
+                    "globalThis['{name}'] = function (arg) {{\
+                        if (arguments.length !== 1) return;\
+                        try {{\
+                            const payload = typeof arg === 'string' ? arg : String(arg);\
+                            Deno.core.ops.op_binding_called('{name}', payload);\
+                        }} catch (e) {{ /* swallow: binding must not throw into page */ }}\
+                    }};",
+                    name = name,
+                );
+                // Re-install on every navigation: globalThis is wiped on
+                // each new document, and puppeteer registers bindings
+                // once-per-page rather than once-per-document.
+                let key = format!("__obscura_binding__{}", name);
+                ctx.preload_scripts.retain(|(k, _)| k != &key);
+                ctx.preload_scripts.push((key, shim.clone()));
+                // Install on the current page so the binding is usable
+                // immediately, without waiting for the next navigation.
+                if let Some(page) = ctx.get_session_page_mut(session_id) {
+                    page.evaluate(&shim);
+                }
+            }
+            Ok(json!({}))
+        }
+        "removeBinding" => {
             let name = params.get("name").and_then(|v| v.as_str()).unwrap_or("");
             if !name.is_empty() {
-                if name.chars().all(|c| c.is_alphanumeric() || c == '_' || c == '$')
-                    && !name.chars().next().unwrap_or('0').is_ascii_digit() {
-                    if let Some(page) = ctx.get_session_page_mut(session_id) {
-                        let code = format!(
-                            "if (typeof globalThis.{name} === 'undefined') {{\
-                                globalThis.{name} = function() {{ return null; }};\
-                            }}",
-                            name = name,
-                        );
-                        page.evaluate(&code);
-                    }
+                let key = format!("__obscura_binding__{}", name);
+                ctx.preload_scripts.retain(|(k, _)| k != &key);
+                if let Some(page) = ctx.get_session_page_mut(session_id) {
+                    page.evaluate(&format!("delete globalThis['{}'];", name));
                 }
             }
             Ok(json!({}))
diff --git a/crates/obscura-cdp/src/server.rs b/crates/obscura-cdp/src/server.rs
index 194c85d..a0501f0 100644
--- a/crates/obscura-cdp/src/server.rs
+++ b/crates/obscura-cdp/src/server.rs
@@ -548,12 +548,11 @@ async fn process_with_interception(
         // CDP messages via `dispatch` (which also acquires this lock); both
         // sides must coordinate or V8 aborts the process at concurrency >= 5.
         let _v8_guard = obscura_js::v8_lock::global().lock().await;
+        // Preloads (addBinding shims, addScriptToEvaluateOnNewDocument sources)
+        // must run BEFORE the page's own scripts (CDP contract). Hand them
+        // to the page so navigate_single can inject them at the right point.
+        page.set_preload_scripts(preload_scripts);
         let result = page.navigate_with_wait(&url_owned, wait_until).await.map_err(|e| e.to_string());
-        for source in &preload_scripts {
-            if let Err(e) = page.execute_preload_script(source) {
-                tracing::debug!("Preload script error: {}", e);
-            }
-        }
         drop(_v8_guard);
         let _ = nav_done_tx.send((page, result)).await;
     });
diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index d4a2069..1c8352a 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -1691,6 +1691,12 @@ _markNative(XMLHttpRequest.prototype.getAllResponseHeaders);
 if (typeof URL === 'undefined' || !URL.prototype) {
   globalThis.URL = class URL {
     constructor(url, base) {
+      // Per WHATWG URL spec, both arguments are stringified — callers
+      // routinely pass `window.location` (Location object) or a URL
+      // instance as `base`. Coerce explicitly so the regex .match() calls
+      // below don't blow up on non-strings.
+      url = String(url);
+      if (base !== undefined && base !== null) base = String(base);
       let full = url;
       if (base && !url.includes('://')) {
         var bm = base.match(/^(https?:\/\/[^\/\?#]+)(\/[^?#]*)?/);
diff --git a/crates/obscura-js/src/ops.rs b/crates/obscura-js/src/ops.rs
index 2438a65..ff17981 100644
--- a/crates/obscura-js/src/ops.rs
+++ b/crates/obscura-js/src/ops.rs
@@ -49,6 +49,10 @@ pub struct ObscuraState {
     pub intercept_tx: Option<tokio::sync::mpsc::UnboundedSender<InterceptedRequest>>,
     pub intercept_counter: u64,
     pub intercept_enabled: bool,
+    // Queue of (binding_name, payload) calls made by page JS via the
+    // `op_binding_called` op. Drained by the CDP layer after each dispatch
+    // and emitted as `Runtime.bindingCalled` events.
+    pub pending_binding_calls: Vec<(String, String)>,
 }
 
 impl ObscuraState {
@@ -64,6 +68,7 @@ impl ObscuraState {
             intercept_tx: None,
             intercept_counter: 0,
             intercept_enabled: false,
+            pending_binding_calls: Vec::new(),
         }
     }
 }
@@ -770,6 +775,16 @@ async fn op_sleep(#[number] millis: u64) {
     tokio::time::sleep(std::time::Duration::from_millis(millis)).await;
 }
 
+// Records a binding call from page JS. The CDP layer drains this queue
+// after every dispatch and emits one `Runtime.bindingCalled` event per
+// entry — that's how puppeteer's `page.exposeFunction` callbacks fire.
+#[op2(fast)]
+fn op_binding_called(state: &OpState, #[string] name: &str, #[string] payload: &str) {
+    let gs = state.borrow::<SharedState>().clone();
+    let mut gs = gs.borrow_mut();
+    gs.pending_binding_calls.push((name.to_string(), payload.to_string()));
+}
+
 pub fn build_extension() -> Extension {
     Extension {
         name: "obscura_dom",
@@ -781,6 +796,7 @@ pub fn build_extension() -> Extension {
             op_set_cookie(),
             op_navigate(),
             op_sleep(),
+            op_binding_called(),
         ]),
         ..Default::default()
     }
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index f6e49dc..be03557 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -97,6 +97,10 @@ impl ObscuraJsRuntime {
         self.state.borrow_mut().pending_navigation.take()
     }
 
+    pub fn take_pending_binding_calls(&self) -> Vec<(String, String)> {
+        std::mem::take(&mut self.state.borrow_mut().pending_binding_calls)
+    }
+
     pub fn set_intercept_tx(&self, tx: tokio::sync::mpsc::UnboundedSender<crate::ops::InterceptedRequest>) {
         let mut state = self.state.borrow_mut();
         state.intercept_tx = Some(tx);