Harden settle listener cleanup against method getter traps

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

currentState.md

@@ -147,6 +147,7 @@ HyperAgent exposes a TypeScript SDK for browser automation with three primary pa
 - Hardened global debug-option storage by normalizing option payloads to plain boolean fields at set-time, preventing trap-prone debug option getters from leaking into runtime reads.
 - Hardened page-URL normalization option reads (fallback/maxChars) against trap-prone option objects, ensuring deterministic URL fallback/truncation behavior under malformed option payloads.
 - Hardened `waitForSettledDOM` option reads for frame filtering with trap-safe accessors, so malformed/trap-prone option objects no longer break settle flow or frame-manager configuration.
+- Hardened wait-listener lifecycle cleanup against trap-prone session listener-method getters, preserving settle completion while emitting sanitized detach diagnostics.
 - Hardened prompt base-message materialization with trap-safe array reads so malformed/trap-prone seed message arrays no longer crash message assembly and readable entries are preserved.
 - Hardened constructor custom-action ingestion with trap-safe array reads so unreadable custom-action entries are skipped while valid entries continue to register.
 - Expanded top-level package exports for key workflow/config types at `@hyperbrowser/agent`.

src/utils/waitForSettledDOM.test.ts

@@ -430,6 +430,58 @@ describe("waitForSettledDOM diagnostics", () => {
     }
   });
 
+  it("sanitizes and truncates listener detach getter diagnostics", async () => {
+    const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+    const { session } = createSessionWithEvents();
+    const trappedSession = new Proxy(session, {
+      get: (target, prop, receiver) => {
+        if (prop === "off") {
+          throw new Error(`off getter\u0000\n${"x".repeat(10_000)}`);
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    }) as CDPSession;
+    const cdpClient: CDPClient = {
+      rootSession: trappedSession,
+      createSession: async () => trappedSession,
+      acquireSession: async () => trappedSession,
+      dispose: async () => undefined,
+    };
+    getCDPClient.mockResolvedValue(cdpClient);
+    getOrCreateFrameContextManager.mockReturnValue({
+      setDebug: jest.fn(),
+    });
+    getDebugOptions.mockReturnValue({
+      enabled: false,
+      traceWait: false,
+    });
+
+    const page = {
+      context: () => ({}),
+    } as never;
+
+    try {
+      const waitPromise = waitForSettledDOM(page, 2000);
+      await Promise.resolve();
+      await Promise.resolve();
+      await jest.advanceTimersByTimeAsync(600);
+      const stats = await waitPromise;
+
+      const detachWarning = String(
+        warnSpy.mock.calls.find((call) =>
+          String(call[0] ?? "").includes("Failed to detach listener")
+        )?.[0] ?? ""
+      );
+      expect(detachWarning).toContain("[truncated");
+      expect(detachWarning).not.toContain("\u0000");
+      expect(detachWarning).not.toContain("\n");
+      expect(stats.resolvedByTimeout).toBe(false);
+      expect(stats.requestsSeen).toBe(0);
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
   it("sanitizes and truncates listener detach diagnostics", async () => {
     const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
     const { session } = createSessionWithEvents({

src/utils/waitForSettledDOM.ts

@@ -87,8 +87,33 @@ function attachSessionListener<TPayload extends unknown[]>(
   event: string,
   handler: (...payload: TPayload) => void
 ): boolean {
+  let onMethod: unknown;
   try {
-    session.on(event, handler);
+    onMethod = (session as unknown as { on?: unknown }).on;
+  } catch (error) {
+    console.warn(
+      `[waitForSettledDOM] Failed to attach listener ${formatWaitIdentifier(
+        event
+      )}: ${formatWaitDiagnostic(error)}`
+    );
+    return false;
+  }
+  if (typeof onMethod !== "function") {
+    console.warn(
+      `[waitForSettledDOM] Failed to attach listener ${formatWaitIdentifier(
+        event
+      )}: listener method unavailable`
+    );
+    return false;
+  }
+  try {
+    (
+      onMethod as (
+        this: CDPSession,
+        event: string,
+        handler: (...payload: unknown[]) => void
+      ) => void
+    ).call(session, event, handler as (...payload: unknown[]) => void);
     return true;
   } catch (error) {
     console.warn(
@@ -105,11 +130,28 @@ function detachSessionListener<TPayload extends unknown[]>(
   event: string,
   handler: (...payload: TPayload) => void
 ): void {
-  if (!session.off) {
+  let offMethod: unknown;
+  try {
+    offMethod = (session as unknown as { off?: unknown }).off;
+  } catch (error) {
+    console.warn(
+      `[waitForSettledDOM] Failed to detach listener ${formatWaitIdentifier(
+        event
+      )}: ${formatWaitDiagnostic(error)}`
+    );
+    return;
+  }
+  if (typeof offMethod !== "function") {
     return;
   }
   try {
-    session.off(event, handler);
+    (
+      offMethod as (
+        this: CDPSession,
+        event: string,
+        handler: (...payload: unknown[]) => void
+      ) => void
+    ).call(session, event, handler as (...payload: unknown[]) => void);
   } catch (error) {
     console.warn(
       `[waitForSettledDOM] Failed to detach listener ${formatWaitIdentifier(