v0.1.12013 Aug 2026·JavaScript & JIT, Privacy & Shields, DevTools

DevTools: a WebSocket transport, so external tools can attach

The DevTools protocol stops being in-app only. The engine has spoken a standard DevTools protocol subset for a while - evaluate expressions, read the live DOM and computed style, set breakpoints, step - but only the built-in panel could drive it. This adds a real WebSocket transport: an external CDP frontend (Puppeteer, Playwright, the browser's own inspector page) connects over ws://, fetches the discovery endpoints, sends JSON-RPC requests that are dispatched into the engine, and receives Debugger.paused / Debugger.resumed as live pushes when execution suspends. It is OFF by default and localhost only - a privacy-first browser does not open a listening socket unless you ask it to (set FLOATI_CDP_PORT), and it never binds a routable address. DevTools moves 33 to 35; overall holds at 51 - the remaining piece is the full Target/session model that lets a tool drive a whole page lifecycle, not just evaluate and debug.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

JavaScript & JIT	A localhost-only, opt-in WebSocket server (FLOATI_CDP_PORT): it serves the /json/version and /json/list discovery endpoints a CDP client reads to find the socket, upgrades a ws connection, and frames JSON-RPC {id, method, params} requests to {id, result} or {id, error}. Each request is dispatched into the page session's __cdp.send on the engine thread, with params passed as a JSON string parsed by JSON.parse - never spliced as code, so a hostile value cannot inject script.
DevTools	The debugger event push: when execution genuinely suspends at a breakpoint (the interactive step gate), the client receives a Debugger.paused notification carrying the pause reason, function and scope, then Debugger.resumed when it continues - the async event a real external debugger needs, delivered over the same socket as the request/response replies without the two ever racing (a single writer owns the sink).
Privacy & Shields	Proven by a ws-client gate test that connects over the loopback and round-trips a Runtime.evaluate, an unknown-method error, and a pushed paused/resumed pair; plus a full end-to-end test that stands up a real engine, loads a page, and drives the dispatcher so Runtime.evaluate of 6*7 comes back as a real 42 from the engine's own __cdp. Off by default, so a normal user opens no socket; the whole conformance suite is unchanged (6375/6375). Research note docs/devtools-ws-transport.md.