[Bug]: Closing a desktop preview tab from the client skips its unload lifecycle #34923

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

Use a fresh clone at the commit named under Runtime or environment with the repository dependencies installed; the script needs vp from node_modules/.bin and rg on PATH. Save the script below as repro.sh at the clone root and run it as shown. It copies the existing apps/server/src/preview/ServerBrowser.test.ts fixture into one temporary focused test file, drives the production services through the repository's existing browser and channel doubles, isolates HOME, TMPDIR and T3CODE_HOME under a temporary fixture directory, and removes the copied test on exit.

tmp=$(mktemp -d)
VERIFY_SCRATCH_ROOT="$tmp" sh ./repro.sh
rm -rf "$tmp"

#!/bin/sh
set -eu
checkout=$(git rev-parse --show-toplevel)
scratch_root=${VERIFY_SCRATCH_ROOT:-${TMPDIR:-/tmp}}
fixture=$(mktemp -d "$scratch_root/verifier-unload.XXXXXX")
probe="$checkout/apps/server/src/preview/ServerBrowser.verifier.test.ts"
trap 'rm -f "$probe"; rm -rf "$fixture"' EXIT INT TERM
mkdir -p "$fixture/home" "$fixture/tmp" "$fixture/t3home"
export HOME="$fixture/home" TMPDIR="$fixture/tmp" T3CODE_HOME="$fixture/t3home"
export PATH="$checkout/node_modules/.bin:$PATH"
cp "$checkout/apps/server/src/preview/ServerBrowser.test.ts" "$probe"
cat >> "$probe" <<'TS'

it.live("verifier lifecycle: client close bypasses desktop unload", () =>
  Effect.scoped(Effect.gen(function* () {
    const broker = yield* Broker.PreviewAutomationBroker;
    const manager = yield* Manager.PreviewManager;
    yield* ServerBrowser.ServerBrowser;
    yield* Effect.yieldNow;
    desktopRendersNext = true;
    const opened = yield* broker.invoke<PreviewAutomationStatus>({ scope, operation: "open", input: { reuseExistingTab: false, open: false } });
    const tabId = PreviewTabId.make(opened.tabId!);
    const { context, browser } = desktopConnections[0]!;
    context.page.beforeUnload = "listen";
    // ws.ts previewClose calls this same public service with these fields.
    yield* manager.close({ threadId: testThread.threadId, tabId });
    yield* Effect.promise(() => desktopReleased.promise);
    const result = { pageCloseCalls: context.page.close.mock.calls.length, exposeFunctionCalls: context.page.exposeFunction.mock.calls.length, desktopDisconnects: browser.close.mock.calls.length, modeledUnloadEvents: context.page.unloadEvents, sessionCount: (yield* manager.list({ threadId: testThread.threadId })).sessions.length };
    console.log("CLIENT_CLOSE", JSON.stringify(result));
    expect(result).toEqual({ pageCloseCalls: 0, exposeFunctionCalls: 0, desktopDisconnects: 1, modeledUnloadEvents: [], sessionCount: 0 });
  })).pipe(Effect.provide(layer)),
);

it.live("verifier lifecycle: agent close control waits for desktop unload", () =>
  Effect.scoped(Effect.gen(function* () {
    const broker = yield* Broker.PreviewAutomationBroker;
    const manager = yield* Manager.PreviewManager;
    yield* ServerBrowser.ServerBrowser;
    yield* Effect.yieldNow;
    desktopRendersNext = true;
    const opened = yield* broker.invoke<PreviewAutomationStatus>({ scope, operation: "open", input: { reuseExistingTab: false, open: false } });
    const tabId = PreviewTabId.make(opened.tabId!);
    const { context, browser } = desktopConnections[0]!;
    const page = context.page;
    page.beforeUnload = "listen";
    yield* broker.invoke({ scope, tabId, operation: "close", input: {} });
    const result = { pageCloseCalls: page.close.mock.calls.length, exposeFunctionCalls: page.exposeFunction.mock.calls.length, desktopDisconnects: browser.close.mock.calls.length, modeledUnloadEvents: page.unloadEvents };
    console.log("AGENT_CONTROL", JSON.stringify(result));
    expect(result).toEqual({ pageCloseCalls: 1, exposeFunctionCalls: 1, desktopDisconnects: 1, modeledUnloadEvents: ["beforeunload", "pagehide", "visibilitychange"] });
  })).pipe(Effect.provide(layer)),
);

it.live("verifier lifecycle: capacity eviction bypasses desktop unload", () =>
  Effect.scoped(Effect.gen(function* () {
    const broker = yield* Broker.PreviewAutomationBroker;
    const manager = yield* Manager.PreviewManager;
    yield* ServerBrowser.ServerBrowser;
    yield* Effect.yieldNow;
    const now = vi.spyOn(Date, "now").mockReturnValue(0);
    yield* Effect.addFinalizer(() => Effect.sync(() => now.mockRestore()));
    const open = (session: string, at: number) => {
      now.mockReturnValue(at); desktopRendersNext = true;
      return broker.invoke<PreviewAutomationStatus>({ scope: asSession(session), operation: "open", input: { reuseExistingTab: false, open: false } });
    };
    const ids: string[] = [];
    for (let index = 0; index < 32; index++) ids.push((yield* open(`owner-${Math.floor(index / 8)}`, index)).tabId!);
    const { context, browser } = desktopConnections[0]!;
    context.page.beforeUnload = "listen";
    const replacement = yield* open("new-owner", 31 * 60 * 1000);
    yield* Effect.promise(() => desktopReleased.promise);
    const { sessions } = yield* manager.list({ threadId: testThread.threadId });
    const result = { pageCloseCalls: context.page.close.mock.calls.length, exposeFunctionCalls: context.page.exposeFunction.mock.calls.length, desktopDisconnects: browser.close.mock.calls.length, modeledUnloadEvents: context.page.unloadEvents, evictedMissing: !sessions.some(session => session.tabId === ids[0]), replacementPresent: sessions.some(session => session.tabId === replacement.tabId), releasedCount: releasedDesktopTabs.length };
    console.log("CAPACITY_EVICTION", JSON.stringify(result));
    expect(result).toEqual({ pageCloseCalls: 0, exposeFunctionCalls: 0, desktopDisconnects: 1, modeledUnloadEvents: [], evictedMissing: true, replacementPresent: true, releasedCount: 1 });
  })).pipe(Effect.provide(layer)),
);
TS
vp test run apps/server/src/preview/ServerBrowser.verifier.test.ts -t 'verifier lifecycle' --silent=false --disableConsoleIntercept > "$fixture/test.log" 2>&1 || { cat "$fixture/test.log"; exit 1; }
sed -E 's/\x1b\[[0-9;]*[A-Za-z]//g' "$fixture/test.log" | rg 'CLIENT_CLOSE|AGENT_CONTROL|CAPACITY_EVICTION|Tests '
rg -q 'CLIENT_CLOSE' "$fixture/test.log"
rg -q 'AGENT_CONTROL' "$fixture/test.log"
rg -q 'CAPACITY_EVICTION' "$fixture/test.log"
echo 'PASS: production client-close and capacity paths skip unload requests; agent-close control requests and waits for unload.'

The first case opens one desktop-rendered tab through the real automation broker, then calls the exported PreviewManager.close({ threadId, tabId }) service with the same fields the previewClose RPC handler passes. It needs no idle threshold, full tab budget, pending action, dialog or timeout. The second case closes the same kind of tab with the owning agent's broker close operation as a working control. The third opens 32 hidden desktop tabs across four owners, advances the fixture clock beyond 30 minutes, and opens a tab from a fifth owner to trigger capacity reclamation.

The client caller chain is apps/web/src/components/preview/PreviewView.tsx → closePreviewSession (

A separate real-Chromium check, below, imports the production ServerBrowserContexts class, connects with its connectDesktopPage, and closes that connection the way production teardown does. Run it with Node from the clone root, passing the clone root as its argument: node real-cdp.mjs "$PWD". It uses playwright-core's Chromium unless CHROMIUM_EXECUTABLE is set, and serves a local page on 127.0.0.1.

import fs from 'node:fs/promises';
import path from 'node:path';
import http from 'node:http';
import { once } from 'node:events';
import { createRequire } from 'node:module';
import { pathToFileURL } from 'node:url';
import assert from 'node:assert/strict';
const checkout = process.argv[2];
if (!checkout) throw new Error('Pass checkout root as first argument');
const require = createRequire(path.join(checkout, 'apps/server/package.json'));
const { chromium } = require('playwright-core');
const executablePath = process.env.CHROMIUM_EXECUTABLE ?? chromium.executablePath();
const root = await fs.mkdtemp(path.join(process.env.VERIFY_SCRATCH_ROOT ?? process.env.TMPDIR ?? '/tmp', 'real-cdp-unload.'));
for (const dir of ['home', 'tmp', 't3home']) await fs.mkdir(path.join(root, dir));
process.env.HOME = path.join(root, 'home');
process.env.TMPDIR = path.join(root, 'tmp');
process.env.T3CODE_HOME = path.join(root, 't3home');
const server = http.createServer((req, res) => { res.setHeader('Content-Type','text/html'); res.end('<button>activate</button>'); });
server.listen(0, '127.0.0.1'); await once(server, 'listening');
const url = `http://127.0.0.1:${server.address().port}`;
let context;
try {
  const { ServerBrowserContexts } = await import(pathToFileURL(path.join(checkout, 'apps/server/src/preview/ServerBrowserContexts.ts')));
  context = await chromium.launchPersistentContext(path.join(root, 'profile'), { executablePath, headless: true, args: ['--remote-debugging-port=0'] });
  const [port, wsPath] = (await fs.readFile(path.join(root, 'profile/DevToolsActivePort'), 'utf8')).trim().split('\n');
  const endpoint = `ws://127.0.0.1:${port}${wsPath}`;
  const owner = new ServerBrowserContexts({ profilesDir: path.join(root, 'unused'), executable: async () => executablePath });
  const install = async (page, key) => {
    await page.goto(url);
    await page.evaluate(key => {
      localStorage.setItem(key, '[]');
      for (const name of ['beforeunload','pagehide','visibilitychange']) addEventListener(name, () => {
        const events = JSON.parse(localStorage.getItem(key)); events.push(name); localStorage.setItem(key, JSON.stringify(events));
      });
    }, key);
    await page.locator('button').click();
  };
  const observed = context.pages()[0];
  await install(observed, 'disconnect');
  const disconnected = await owner.connectDesktopPage(endpoint);
  await disconnected.browser.close();
  const failure = { stillOpen: !observed.isClosed(), events: await observed.evaluate(() => JSON.parse(localStorage.getItem('disconnect'))) };
  console.log('REAL_CDP_DISCONNECT', JSON.stringify(failure));
  assert.deepEqual(failure, { stillOpen: true, events: [] });
  const controlConnection = await owner.connectDesktopPage(endpoint);
  await install(controlConnection.page, 'graceful');
  const closed = observed.waitForEvent('close');
  await controlConnection.page.close({ runBeforeUnload: true });
  await closed;
  const inspector = await context.newPage(); await inspector.goto(url);
  const control = { stillOpen: !observed.isClosed(), events: await inspector.evaluate(() => JSON.parse(localStorage.getItem('graceful'))) };
  console.log('REAL_PAGE_CLOSE_CONTROL', JSON.stringify(control));
  assert.equal(control.stillOpen, false);
  assert(control.events.includes('beforeunload'));
  assert(control.events.includes('pagehide'));
  console.log('RUNTIME', JSON.stringify({ node: process.version, platform: process.platform, arch: process.arch, playwright: require('playwright-core/package.json').version, chromium: context.browser().version() }));
  await controlConnection.browser.close();
  await owner.close();
  console.log('PASS: production connectDesktopPage disconnect leaves real page open with zero lifecycle writes; graceful-close control writes beforeunload and pagehide.');
} finally {
  await context?.close();
  await new Promise((resolve,reject) => server.close(error => error ? reject(error) : resolve()));
  await fs.rm(root, { recursive: true, force: true });
}

Expected behavior

Closing a desktop-rendered preview session should request its unload lifecycle before the desktop removes the webview, consistently with agent close. The unload helper unloadDesktopPage and its contract comment (

Actual behavior

Summary. Closing a desktop-rendered preview tab through the client close route (previewClose, which closePreviewSession uses) removes the session and disconnects the tab's CDP connection without ever requesting the page's unload: no page.close({ runBeforeUnload: true }) call and no pagehide binding. The explicit agent close (t3_preview_close) on the same kind of tab does request and wait for unload, as #23537 made it do. Automatic capacity reclamation (freeIdleAgentSlot) takes the same bypass under narrower conditions. A page that relies on unload handlers for final writes or telemetry therefore gets no graceful close request on these paths. This is a service-level reproduction plus a real-Chromium disconnect check; no native Electron run was made and no actual user data loss was reproduced.

Observed in the service reproduction: client close removes the session and disconnects its desktop browser once, while calling page.close zero times and installing no pagehide binding (exposeFunction zero times). The agent-close control calls page.close({ runBeforeUnload: true }) once and installs the binding, and the browser double records beforeunload, pagehide and visibilitychange. Capacity reclamation shows the same zero-call bypass, but needs the narrower preconditions: a full 32-tab server budget, a caller below its per-owner limit of eight, and a hidden agent-owned tab idle for more than 30 minutes. The double's event list is modeled evidence; the call counts are direct observations of the production services.

Source path: the manager close implementation (

Observed in the real-Chromium check: after the production connection's browser.close(), the page is still open and its lifecycle localStorage record is empty. Reconnecting and calling page.close({ runBeforeUnload: true }) closes it and records beforeunload, pagehide and visibilitychange. The disconnect itself therefore supplies no graceful unload. Native Electron guest removal was not exercised; that step rests on the production lifecycle chain and the contract comment above. The client also removes the session optimistically before the RPC result, and the desktop renders webviews only for current sessions.

Hypothesis, not verified: unload coordination lives only in the explicit agent-close operation, while the other desktop session-close callers still use generic teardown.

Evidence

• Expected source: apps/server/src/preview/ServerBrowser.ts lines 769-789 (unloadDesktopPage and its contract comment), the desktop agent-close test at apps/server/src/preview/ServerBrowser.test.ts lines 1268-1306, and the scope question in [Bug]: Closing a server preview tab never fires beforeunload or pagehide #23513.
• Failure source: observed output of repro.sh and real-cdp.mjs above, and the call path ws.ts previewClose → PreviewManager.close (apps/server/src/preview/Manager.ts lines 394-425) → dropTab desktop branch (ServerBrowser.ts lines 791-824) → browser.close() (ServerBrowser.ts lines 852-858), with capacity reclamation at ServerBrowser.ts lines 1504-1522.
• Evidence provenance: observed
• Local verification: reproduced
• Reproduction completeness: complete

The service reproduction uses the repository's existing browser and channel doubles; the real-Chromium check covers CDP disconnect semantics only. No native Electron, packaged app or real UI click run was made, and no actual draft or login loss was reproduced. The pre-existing delayed-unload desktop agent-close test also passes at the baseline (1 passed, 68 skipped).

Runtime or environment: commit d9805b2 (version 0.1.9); macOS arm64, Node v26.12.1, playwright-core 1.64.1, Chrome for Testing 158.0.8127.18 (Playwright build 1254). On current main the server close chain, ServerBrowserContexts.ts, ws.ts, ElectronBrowserHost.tsx, the client-runtime preview state and closePreviewSession.ts are unchanged; HostedBrowserWebview.tsx and PreviewView.tsx changed only in mouse back/forward and webview focus handling.

Restoration check

With the repro above, the client-close case passes when closing the desktop tab through PreviewManager.close requests the page's unload (page.close with runBeforeUnload: true or an equivalent that delivers pagehide) and waits for it before the desktop connection is torn down, and the capacity-reclamation case does the same for the evicted tab. The agent-close control must keep requesting and waiting for unload, client close must still remove the session, and reclamation must still free the slot for the new owner.

References

• Closed [Bug]: Closing a server preview tab never fires beforeunload or pagehide #23513 ([Bug]: Closing a server preview tab never fires beforeunload or pagehide #23513) and merged fix(server): closing preview tabs runs beforeunload handlers #23537 (fix(server): closing preview tabs runs beforeunload handlers #23537): fix(server): closing preview tabs runs beforeunload handlers #23537 fixed the explicit agent close; its final evidence comment says "The ordinary desktop UI Close button remains a separate unresolved path".
• Related, not duplicates: [Bug]: Server browser: a browser action that never finishes wedges its tab, evicts the preview host and stops other tabs' setting changes #32849 concerns a wedged mirror that prevents closes; [Bug]: Windows snapshot/evaluate timeouts evict the shared server-browser host and abort another open #16921 concerns shared-host eviction after timeouts. Neither condition is needed here.

Impact

Minor bug or occasional failure

Version or commit

0.1.9, commit d9805b2 (server close chain unchanged on main at 8024e50)

Environment

macOS arm64, Node v26.12.1, playwright-core 1.64.1, Chrome for Testing 158.0.8127.18 (Playwright build 1254). Service reproduction with the repository's existing browser/channel doubles; no native Electron or packaged-app run.

Logs or stack traces

CLIENT_CLOSE {"pageCloseCalls":0,"exposeFunctionCalls":0,"desktopDisconnects":1,"modeledUnloadEvents":[],"sessionCount":0}
AGENT_CONTROL {"pageCloseCalls":1,"exposeFunctionCalls":1,"desktopDisconnects":1,"modeledUnloadEvents":["beforeunload","pagehide","visibilitychange"]}
CAPACITY_EVICTION {"pageCloseCalls":0,"exposeFunctionCalls":0,"desktopDisconnects":1,"modeledUnloadEvents":[],"evictedMissing":true,"replacementPresent":true,"releasedCount":1}
      Tests  3 passed | 69 skipped (72)
PASS: production client-close and capacity paths skip unload requests; agent-close control requests and waits for unload.
REAL_CDP_DISCONNECT {"stillOpen":true,"events":[]}
REAL_PAGE_CLOSE_CONTROL {"stillOpen":false,"events":["beforeunload","pagehide","visibilitychange"]}
RUNTIME {"node":"v26.12.1","platform":"darwin","arch":"arm64","playwright":"1.64.1","chromium":"158.0.8127.18"}
PASS: production connectDesktopPage disconnect leaves real page open with zero lifecycle writes; graceful-close control writes beforeunload and pagehide.

Screenshots, recordings, or supporting files

No response

Workaround

For a tab owned by the active agent and not controlled by a human, ask the owning agent to close it with its explicit preview-close tool (t3_preview_close) instead of the client close; that path is the passing control. Staying below the server's 32-tab capacity avoids only the automatic-reclamation route.