fix(#125): DOM mutations not applied after action

[lekt9]

Summary

• After Runtime.callFunctionOn dispatches a DOM-mutating action (click, dblclick, check, uncheck, fill, type, select, press), the browser queues microtasks/macrotasks for framework state updates (React/Vue reconciliation, MutationObserver callbacks). The handler was returning immediately, so a subsequent /snapshot call read stale DOM.
• Fix: send Runtime.evaluate with awaitPromise:true and a setTimeout(r, 0)-based Promise after every mutating action. CDP blocks until the promise resolves — which only happens after the current macrotask queue turn drains — ensuring all pending DOM mutations are committed before we respond.
• Applies the flush at three call sites: the main action path, the realistic fill path, and the press key-event path.

Test plan

• New regression test action microtask flush params are well-formed JSON (#125) in src/test/integration.zig verifies the flush JSON payload contains awaitPromise:true and the setTimeout-based Promise expression
• All existing tests pass: zig build test exits 0
• Manual: click a button on a React/Vue SPA, then immediately call /snapshot — updated DOM should reflect the mutation

🤖 Generated with Claude Code

[justrach]

Review

This is a solid and needed fix — the microtask flush pattern and native key events are real improvements for SPA compatibility. A few suggestions:

✅ What's good

• Input.dispatchKeyEvent (keyDown+keyUp) instead of JS KeyboardEvent dispatch — Enter/Escape/Tab now work natively
• nativeInputValueSetter bypasses React/Vue controlled input overrides — this was a real pain point
• select now dispatches both input + change events for framework compat
• Microtask flush with awaitPromise:true ensures DOM is settled before returning

⚠️ Suggestions

1. Microtask flush depth — The setTimeout(r, 0) flush drains one macrotask turn. For heavy SPAs (Angular with zone.js, Svelte with tick()), a single turn may not be enough. Consider either:

   • Two consecutive flushes: new Promise(r => setTimeout(() => setTimeout(r, 0), 0))
   • Or a configurable delay param: &flush_ms=50 for callers who know they need more time

2. HAR flush after every action — The PR adds flushEventsToHar() after click/fill/press/select/evaluate. This is defensive but adds latency. Consider making it opt-in (&flush_har=true) or only flushing when HAR recording is active (which you partly do with the isRecording() check — good).

3. Rebase needed — client.zig has diverged significantly on main (EventBuffer is now ArrayListUnmanaged with OwnedEvent struct). The push() signature changed. You'll need to rebase against current main.

🔧 Needs rebase

src/cdp/client.zig and src/server/router.zig both have conflicts with main. The router changes (action handling) should rebase cleanly since they're in different regions than our SSRF/bot-detect work.

[justrach]

Can you update this PR to build and test against Zig 0.16.0? The active release/CI path is now targeting 0.16.0, so it would help to rebase and rerun on that toolchain before review.

[justrach]

Triage from a fresh look at this against current main:

1. Conflicts: branch is DIRTY against main — needs a rebase.
2. Some of this is now obsolete: cmdAction on main no longer interpolates user values into JS source. The fill/select paths bind two JS function constants (value_action_fn, select_action_fn) and pass the value as a CDP argument to Runtime.callFunctionOn. So the React-controlled-input + microtask-flush parts of this PR are still wanted, but the parts that substitute {s} into a JS template are stale.
3. Still valuable from this PR after rebase:
   • Input.dispatchKeyEvent for press (real native key handling).
   • nativeInputValueSetter to bypass React/Vue value setters.
   • setTimeout(0)-await microtask flush after mutations.
   • Focus-before-keypress via DOM.resolveNode.
4. EventBuffer changes here look identical to fix(#113): 120s timeout hang in /auth/extract due to unread stderr pipe #126 and fix(#124): HAR recording returns 0 entries - add response_body via getResponseBody #127 — those should probably be a single PR. If you rebase, can you split this into a feat/dom-mutation-flush-after-action PR that only touches server/router.zig, and let fix(#124): HAR recording returns 0 entries - add response_body via getResponseBody #127 own the EventBuffer + HAR-bodies changes?

If you rebase + split, ping me and I'll re-review.