From a6569eae6fa5c0c71c3ceeae16f8b0e779781251 Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Fri, 2 Oct 2026 23:28:04 +0530
Subject: [PATCH 1/7] fix(livepreview): harden preview channel and preserve
 unfinished pages

Capture channel dependencies before page scripts run and seal private
globals after runtime initialization. Inject the runtime before page
scripts and unfinished markup while retaining leading doctypes.

Add injection-order and unfinished-page regression coverage. Verified
the full 285-spec livepreview category on Linux Edge, Linux Electron,
Windows Tauri and macOS Tauri, plus targeted HTML unit suites.
---
 .../BrowserScripts/LiveDevProtocolRemote.js   | 95 ++++++++++++++-----
 .../LivePreviewTransportRemote.js             | 57 ++++++++---
 .../BrowserScripts/RemoteFunctions.js         |  3 +-
 .../documents/LiveHTMLDocument.js             | 22 ++++-
 .../language/HTMLInstrumentation.js           | 54 +++++++----
 .../protocol/LiveDevProtocol.js               | 22 ++++-
 test/spec/HTMLInstrumentation-test.js         | 95 +++++++++++++++++++
 test/spec/LiveDevelopmentMultiBrowser-test.js | 29 ++++++
 8 files changed, 316 insertions(+), 61 deletions(-)

diff --git a/src/LiveDevelopment/BrowserScripts/LiveDevProtocolRemote.js b/src/LiveDevelopment/BrowserScripts/LiveDevProtocolRemote.js
index eaf420dc83..5dcf88a111 100644
--- a/src/LiveDevelopment/BrowserScripts/LiveDevProtocolRemote.js
+++ b/src/LiveDevelopment/BrowserScripts/LiveDevProtocolRemote.js
@@ -35,6 +35,43 @@
     //     send(msgStr) - sends the given message string over the transport.
     var transport = global._Brackets_LiveDev_Transport;
 
+    // The page's own scripts run after this file and may patch built-ins to read or rewrite what goes
+    // to and from the editor, so everything on that path uses the originals, captured here. The
+    // editor's Runtime.evaluate scripts run through the real eval, called indirectly so they see only
+    // the global scope, as they would from the page: never this closure's transport, comm or the CSS
+    // domain object that shadows window.CSS here.
+    const _globalEval = global.eval;
+    const _parse = JSON.parse;
+    const _stringify = JSON.stringify;
+    const _Promise = global.Promise;
+    const _setTimeout = global.setTimeout;
+    const _clearTimeout = global.clearTimeout;
+
+    /**
+     * Append without Array.prototype.push, which a page could patch to collect the item.
+     * @param {Array} arr Destination array.
+     * @param {*} item Item to append.
+     */
+    function _arrayPush(arr, item) {
+        arr[arr.length] = item;
+    }
+
+    /**
+     * Copy nonmatching items without exposing the array to a page-patched filter.
+     * @param {Array} arr Source array.
+     * @param {function(*): boolean} predicate Returns true for items to remove.
+     * @return {Array} The remaining items, in order.
+     */
+    function _arrayWithout(arr, predicate) {
+        const kept = [];
+        for (let i = 0; i < arr.length; i++) {
+            if (!predicate(arr[i])) {
+                _arrayPush(kept, arr[i]);
+            }
+        }
+        return kept;
+    }
+
     /**
      * Manage messaging between Editor and Browser at the protocol layer.
      * Handle messages that arrives through the current transport and dispatch them
@@ -68,16 +105,15 @@
 
             if (msgHandlers && msgHandlers.length > 0) {
                 // invoke handlers with the received message
-                msgHandlers.forEach(function (handler) {
+                // A plain loop: a patched Array.prototype.forEach would be handed the message.
+                for (let i = 0; i < msgHandlers.length; i++) {
                     try {
                         // TODO: check which context should be used to call handlers here.
-                        handler(msg);
-                        return;
+                        msgHandlers[i](msg);
                     } catch (e) {
                         console.error("[Brackets LiveDev] Error executing a handler for " + msg.method, e.stack);
-                        return;
                     }
-                });
+                }
             } else {
                 // no subscribers, ignore it.
                 // TODO: any other default handling? (eg. specific respond, trigger as a generic event, etc.);
@@ -115,8 +151,7 @@
                 //initialize array
                 this.handlers[method] = [];
             }
-            // add handler to the stack
-            this.handlers[method].push(handler);
+            _arrayPush(this.handlers[method], handler);
         },
 
         /**
@@ -124,7 +159,7 @@
          * @param {string} msgStr Message to be sent.
          */
         send: function (msgStr) {
-            transport.send(JSON.stringify(msgStr));
+            transport.send(_stringify(msgStr));
         }
     };
 
@@ -140,9 +175,9 @@
         evaluate: function (msg) {
             // an unanswered request leaves the editor side waiting forever
             try {
-                var result = eval(msg.params.expression);
+                var result = _globalEval(msg.params.expression);
                 MessageBroker.respond(msg, {
-                    result: JSON.stringify(result) // TODO: in original protocol this is an object handle
+                    result: _stringify(result) // TODO: in original protocol this is an object handle
                 });
             } catch (e) {
                 console.error("[Brackets LiveDev] Runtime.evaluate failed", e);
@@ -349,7 +384,7 @@
          * @param {string} msgStr The protocol message as stringified JSON.
          */
         message: function (msgStr) {
-            const msg = JSON.parse(msgStr);
+            const msg = _parse(msgStr);
             _setPCommReady();
             if(msg && typeof msg === "object" && msg.method === "PhoenixComm.execLPFn") {
                 _onLPFnTrigger(msg.fnName, msg.params);
@@ -397,7 +432,8 @@
 
     let currentFnExecID = 1;
     let lpCommReady = false;
-    const pendingExecPromises = new Map();
+    // A page-patched Map.prototype.set must not receive the promise's resolve/reject callbacks.
+    const pendingExecPromises = Object.create(null);
     let queuedExecRequests = [];         // array of { fnName, paramObj, fnExecID }
     // A pending execPhoenixFn is only ever settled by a response message, so if
     // the editor disconnects mid-call the promise would hang forever (and any
@@ -414,7 +450,7 @@
         if (lpCommReady) {
             MessageBroker.send(payload);
         } else {
-            queuedExecRequests.push(payload);
+            _arrayPush(queuedExecRequests, payload);
         }
     }
 
@@ -437,21 +473,25 @@
             }
             registeredPhoenixCommFns[fnName] = fn;
         },
+        /**
+         * Request an editor function, rejecting if no response arrives before the timeout.
+         * @param {string} fnName Registered editor function name.
+         * @param {*} paramObj Function parameters.
+         * @return {Promise<*>} The editor's response.
+         */
         execPhoenixFn: function (fnName, paramObj) {
-            return new Promise((resolve, reject) => {
+            return new _Promise((resolve, reject) => {
                 const fnExecID = currentFnExecID++;
-                const timer = setTimeout(function () {
-                    if (pendingExecPromises.has(fnExecID)) {
-                        pendingExecPromises.delete(fnExecID);
+                const timer = _setTimeout(function () {
+                    if (pendingExecPromises[fnExecID]) {
+                        delete pendingExecPromises[fnExecID];
                         // if still queued (comm never became ready), drop it so a
                         // late flush doesn't execute a call the caller saw fail
-                        queuedExecRequests = queuedExecRequests.filter(function (req) {
-                            return req.fnExecID !== fnExecID;
-                        });
+                        queuedExecRequests = _arrayWithout(queuedExecRequests, req => req.fnExecID === fnExecID);
                         reject(new Error(`execPhoenixFn timed out: ${fnName}`));
                     }
                 }, PHOENIX_FN_TIMEOUT_MS);
-                pendingExecPromises.set(fnExecID, { resolve, reject, timer });
+                pendingExecPromises[fnExecID] = { resolve, reject, timer };
                 _sendOrQueueExec({
                     execFnName: fnName,
                     paramObj,
@@ -468,17 +508,24 @@
 
     PhoenixComm.registerLpFn("PH_LP_COMM_READY", _setPCommReady);
 
+    /**
+     * Settle a pending editor request and clear its timeout; ignore late or unknown replies.
+     * @param {string} fnName Editor function name, used for diagnostics.
+     * @param {number} fnExecID Request identifier.
+     * @param {*} resolveWith Successful result.
+     * @param {*} rejectWith Error returned by the editor, if any.
+     */
     function _onPhoenixExecResponse(fnName, fnExecID, resolveWith, rejectWith) {
-        const pendingPromise = pendingExecPromises.get(fnExecID);
+        const pendingPromise = pendingExecPromises[fnExecID];
         if(!pendingPromise) {
             // already settled (e.g. by the timeout) or an unknown id — bail
             // rather than dereference undefined and throw in the message handler
             console.error(`execPhoenixFn: No response promise found! for ${fnName}: ${fnExecID}`);
             return;
         }
-        pendingExecPromises.delete(fnExecID);
+        delete pendingExecPromises[fnExecID];
         if (pendingPromise.timer) {
-            clearTimeout(pendingPromise.timer);
+            _clearTimeout(pendingPromise.timer);
         }
         if(rejectWith) {
             pendingPromise.reject(rejectWith);
diff --git a/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js b/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
index 6bb986b0b4..682a71f9e6 100644
--- a/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
+++ b/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
@@ -97,12 +97,41 @@
     const TRANSPORT_CONFIG={};
     //Replace dynamic section end
 
+    // The page's own scripts run after this one and may patch built-ins to read or rewrite what goes
+    // to and from the editor. The channel uses the originals, captured here before any of them runs.
+    const _apply = Reflect.apply;
+    const _workerPostMessage = Worker.prototype.postMessage;
+    const _messageEventData = Object.getOwnPropertyDescriptor(MessageEvent.prototype, "data").get;
+    const _stringify = JSON.stringify;
+    const _console = global.console;
+    const _consoleLog = _console.log;
+
+    /**
+     * Log only when enabled by the editor, using the original console method.
+     * @param {...*} args Values to log.
+     */
     function _debugLog(...args) {
-        if(window.LIVE_PREVIEW_DEBUG_ENABLED) {
-            console.log(...args);
+        if (TRANSPORT_CONFIG.LIVE_PREVIEW_DEBUG_ENABLED) {
+            _apply(_consoleLog, _console, args);
         }
     }
 
+    /**
+     * Send data through the captured Worker method.
+     * @param {Object} data Worker message.
+     */
+    function _postToWorker(data) {
+        _apply(_workerPostMessage, worker, [data]);
+    }
+    /**
+     * Read worker data without invoking a page-patched getter.
+     * @param {MessageEvent} event Worker event.
+     * @return {*} The event payload.
+     */
+    function _eventData(event) {
+        return _apply(_messageEventData, event, []);
+    }
+
     function createLRU(max = 100) {
         const map = new Map();
 
@@ -139,9 +168,10 @@
     const worker = new Worker(TRANSPORT_CONFIG.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME);
     let _workerMessageProcessor;
     worker.onmessage = (event) => {
-        const type = event.data.type;
+        const data = _eventData(event);
+        const type = data.type;
         switch (type) {
-        case 'REDIRECT_PAGE': location.href = event.data.URL; break;
+        case 'REDIRECT_PAGE': location.href = data.URL; break;
         default:
             if(_workerMessageProcessor){
                 return _workerMessageProcessor(event);
@@ -151,7 +181,7 @@
     };
     // message channel to phoenix connect on load itself. The channel id is injected from phoenix
     // via LivePreviewTransport.js while serving the instrumented html file
-    worker.postMessage({
+    _postToWorker({
         type: "setupPhoenixComm",
         livePreviewDebugModeEnabled: TRANSPORT_CONFIG.LIVE_PREVIEW_DEBUG_ENABLED,
         broadcastChannel: TRANSPORT_CONFIG.LIVE_PREVIEW_BROADCAST_CHANNEL_ID, // in browser this will be present, but not in tauri
@@ -159,7 +189,7 @@
         clientID
     });
     function _postLivePreviewMessage(message) {
-        worker.postMessage({type: "livePreview", message});
+        _postToWorker({type: "livePreview", message});
     }
     let sentTitle, sentFavIconURL;
 
@@ -192,7 +222,7 @@
                 if(!base64){
                     base64 = "favicon.ico";
                 }
-                worker.postMessage({
+                _postToWorker({
                     type: "updateTitleIcon",
                     faviconBase64: base64
                 });
@@ -201,7 +231,7 @@
 
         if(sentTitle!== document.title) {
             sentTitle = document.title;
-            worker.postMessage({
+            _postToWorker({
                 type: "updateTitleIcon",
                 title: document.title
             });
@@ -239,18 +269,19 @@
 
             // Listen to the response
             _workerMessageProcessor = (event) => {
+                const data = _eventData(event);
                 // Print the result
-                _debugLog("Live Preview: Browser received event from Phoenix: ", JSON.stringify(event.data));
-                const type = event.data.type;
+                _debugLog("Live Preview: Browser received event from Phoenix: ", _stringify(data));
+                const type = data.type;
                 switch (type) {
                 case 'BROWSER_CONNECT': break; // do nothing. This is a loopback message from another live preview tab
                 case 'BROWSER_MESSAGE': break; // do nothing. This is a loopback message from another live preview tab
                 case 'BROWSER_CLOSE': break; // do nothing. This is a loopback message from another live preview tab
                 case 'MESSAGE_FROM_PHOENIX':
                     if (self._callbacks && self._callbacks.message) {
-                        const clientIDs = event.data.clientIDs,
-                            message = event.data.message,
-                            messageID = event.data.messageID;
+                        const clientIDs = data.clientIDs,
+                            message = data.message,
+                            messageID = data.messageID;
                         if(messageID && processedMessageIDs.has(messageID)){
                             return; // we have already processed this message.
                         }
diff --git a/src/LiveDevelopment/BrowserScripts/RemoteFunctions.js b/src/LiveDevelopment/BrowserScripts/RemoteFunctions.js
index 9c62170e54..df45119ced 100644
--- a/src/LiveDevelopment/BrowserScripts/RemoteFunctions.js
+++ b/src/LiveDevelopment/BrowserScripts/RemoteFunctions.js
@@ -22,7 +22,8 @@ function RemoteFunctions(config = {}) {
         // this is just a test function here to check if live preview. fn call is working correctly.
         console.log("Hello World", param);
     });
-    const MessageBroker = window._Brackets_MessageBroker; // to be used by plugins.
+    // Injected plugins share this closure; the window property is removed after injection.
+    const MessageBroker = window._Brackets_MessageBroker;
 
     const SHARED_STATE = {
         __description: "Use this to keep shared state for Live Preview Edit instead of window.*",
diff --git a/src/LiveDevelopment/MultiBrowserImpl/documents/LiveHTMLDocument.js b/src/LiveDevelopment/MultiBrowserImpl/documents/LiveHTMLDocument.js
index 195e11c444..7c5243ba14 100644
--- a/src/LiveDevelopment/MultiBrowserImpl/documents/LiveHTMLDocument.js
+++ b/src/LiveDevelopment/MultiBrowserImpl/documents/LiveHTMLDocument.js
@@ -121,7 +121,22 @@ define(function (require, exports, module) {
     };
 
     /**
-     * Returns the instrumented version of the file.
+     * Insert the runtime before unfinished markup, preserving a leading doctype's parsing mode.
+     * Only complete comments and a doctype may precede the script; partial markup must
+     * follow it so an unfinished attribute, comment or raw-text element cannot swallow the runtime.
+     * @param {string} html Uninstrumentable source text.
+     * @param {string} remoteScript Blocking runtime script markup.
+     * @return {string} Source text with the runtime inserted before page content.
+     */
+    function _injectIntoUnfinishedHTML(html, remoteScript) {
+        // HTML ends a doctype at the first > even inside an unfinished quoted identifier.
+        const preamble = /^(?:\uFEFF|[\t\n\f\r ]|<!--(?:>|->|[\s\S]*?--!?>))*(?:<!doctype[\t\n\f\r ][^>]*>)?/i
+            .exec(html)[0];
+        return preamble + remoteScript + html.slice(preamble.length);
+    }
+
+    /**
+     * Returns the instrumented file, including a runtime for empty or unfinished HTML.
      * @return {{body: string}} instrumented doc
      */
     LiveHTMLDocument.prototype.getResponseData = function (enabled) {
@@ -135,11 +150,10 @@ define(function (require, exports, module) {
             // HTML cannot be parsed into a DOM (no instrumentable content). In that case it
             // also never injected the remote <script>, so without help the served page would
             // have no live-preview runtime at all — a blank page with no way to connect back
-            // or start editing. Fall back to the raw text but still inject the remote script
-            // so the runtime always loads, even for a completely empty page.
+            // or start editing. Inject before unfinished content so the runtime always loads.
             body = this.doc.getText();
             if (this._instrumentationEnabled) {
-                body += this.protocol.getRemoteScript();
+                body = _injectIntoUnfinishedHTML(body, this.protocol.getRemoteScript());
             }
         }
 
diff --git a/src/LiveDevelopment/MultiBrowserImpl/language/HTMLInstrumentation.js b/src/LiveDevelopment/MultiBrowserImpl/language/HTMLInstrumentation.js
index c1c70941ef..86cb68db19 100644
--- a/src/LiveDevelopment/MultiBrowserImpl/language/HTMLInstrumentation.js
+++ b/src/LiveDevelopment/MultiBrowserImpl/language/HTMLInstrumentation.js
@@ -727,6 +727,7 @@ define(function (require, exports, module) {
      *
      * @param {Editor} editor The editor whose document we're instrumenting, and which we should
      *     mark ranges in.
+     * @param {string} [remoteScript] Blocking script markup to insert before page content executes.
      * @return {string} instrumented html content
      */
     function generateInstrumentedHTML(editor, remoteScript) {
@@ -742,6 +743,38 @@ define(function (require, exports, module) {
             return null;
         }
 
+        // The parser's root can omit earlier top-level siblings in HTML fragments. Inspect all
+        // source elements so a script outside that root cannot run before the channel is sealed.
+        let remoteScriptOffset = orig.length;
+        if (remoteScript) {
+            // Incremental DOM updates leave some source offsets stale; reloads need current offsets.
+            const sourceDOM = dom.fullBuild ? dom : HTMLSimpleDOM.build(orig);
+            if (!sourceDOM) {
+                return null;
+            }
+            Object.keys(sourceDOM.nodeMap).forEach(function (id) {
+                const node = sourceDOM.nodeMap[id];
+                if (node.tag && node.tag !== "html") {
+                    const offset = node.tag === "head" ? node.openEnd : node.start;
+                    remoteScriptOffset = Math.min(remoteScriptOffset, offset);
+                }
+            });
+        }
+
+        /**
+         * Copy source text, inserting the blocking remote script at its source offset once.
+         * @param {number} endOffset Exclusive end of the source text to copy.
+         */
+        function appendOriginalText(endOffset) {
+            if (remoteScript && !remoteScriptInserted && remoteScriptOffset <= endOffset) {
+                gen += orig.substr(lastIndex, remoteScriptOffset - lastIndex) + remoteScript;
+                lastIndex = remoteScriptOffset;
+                remoteScriptInserted = true;
+            }
+            gen += orig.substr(lastIndex, endOffset - lastIndex);
+            lastIndex = endOffset;
+        }
+
         // Ensure that the marks in the editor are up to date with respect to the given DOM.
         // (But only do this if the dom we got back from scanDocument() was a full rebuild. Otherwise,
         // rely on the marks in the editor.)
@@ -792,17 +825,8 @@ define(function (require, exports, module) {
 
                 // Insert the attribute as the first attribute in the tag.
                 var insertIndex = startOffset + node.tag.length + 1;
-                gen += orig.substr(lastIndex, insertIndex - lastIndex) + attrText;
-                lastIndex = insertIndex;
-
-                // If we have a script to inject and this is the head tag, inject it immediately
-                // after the open tag.
-                if (remoteScript && !remoteScriptInserted && node.tag === "head") {
-                    insertIndex = node.openEnd;
-                    gen += orig.substr(lastIndex, insertIndex - lastIndex) + remoteScript;
-                    lastIndex = insertIndex;
-                    remoteScriptInserted = true;
-                }
+                appendOriginalText(insertIndex);
+                gen += attrText;
             }
 
             if (node.isElement()) {
@@ -811,13 +835,7 @@ define(function (require, exports, module) {
         }
 
         walk(dom);
-        gen += orig.substr(lastIndex);
-
-        if (remoteScript && !remoteScriptInserted) {
-            // if the remote script couldn't be injected before (e.g. due to missing "head" tag),
-            // append it at the end
-            gen += remoteScript;
-        }
+        appendOriginalText(orig.length);
 
         return gen;
     }
diff --git a/src/LiveDevelopment/MultiBrowserImpl/protocol/LiveDevProtocol.js b/src/LiveDevelopment/MultiBrowserImpl/protocol/LiveDevProtocol.js
index ec98c881c4..fe96c33648 100644
--- a/src/LiveDevelopment/MultiBrowserImpl/protocol/LiveDevProtocol.js
+++ b/src/LiveDevelopment/MultiBrowserImpl/protocol/LiveDevProtocol.js
@@ -539,6 +539,25 @@ define(function (require, exports, module) {
         return "\n" + script + "\n";
     }
 
+    // Runs last in the injected script, before any of the page's own scripts. The transport, broker,
+    // comm and protocol manager have each captured what they need from one another by now, so they
+    // leave the window: a page script cannot read, rewrite or send on the channel to the editor.
+    // _LD stays, since the editor's evaluate calls reach it by name, but frozen and fixed in place, so
+    // a page can neither wrap its functions nor shadow it with a global let of its own.
+    const SEAL_REMOTE_SCRIPT = `
+;(function (global) {
+    delete global._Brackets_LiveDev_Transport;
+    delete global._Brackets_MessageBroker;
+    delete global._Brackets_LiveDev_PhoenixComm;
+    delete global._Brackets_LiveDev_ProtocolManager;
+    const ld = global._LD;
+    if (ld && typeof ld === "object") {
+        Object.freeze(ld);
+        Object.defineProperty(global, "_LD", { value: ld, writable: false, configurable: false });
+    }
+}(this));
+`;
+
     /**
      * Returns a script that should be injected into the HTML that's launched in the
      * browser in order to handle protocol requests. Includes the <script> tags.
@@ -550,7 +569,8 @@ define(function (require, exports, module) {
         const remoteFunctionsScript = _getRemoteFunctionsScript() || "";
         return transportScript +
             "\n" + LiveDevProtocolRemote + "\n" +
-            remoteFunctionsScript;
+            remoteFunctionsScript +
+            SEAL_REMOTE_SCRIPT;
     }
 
     /**
diff --git a/test/spec/HTMLInstrumentation-test.js b/test/spec/HTMLInstrumentation-test.js
index 055a85f278..2201e01817 100644
--- a/test/spec/HTMLInstrumentation-test.js
+++ b/test/spec/HTMLInstrumentation-test.js
@@ -34,6 +34,7 @@ define(function (require, exports, module) {
         WellFormedDoc       = require("text!spec/HTMLInstrumentation-test-files/wellformed.html"),
         NotWellFormedDoc    = require("text!spec/HTMLInstrumentation-test-files/omitEndTags.html"),
         InvalidHTMLDoc      = require("text!spec/HTMLInstrumentation-test-files/invalidHTML.html");
+    const LiveHTMLDocument = require("LiveDevelopment/MultiBrowserImpl/documents/LiveHTMLDocument");
 
     RemoteFunctions = eval(`(()=>{${RemoteFunctions.trim()}\nreturn RemoteFunctions();})()`);
 
@@ -415,6 +416,100 @@ define(function (require, exports, module) {
         }
     };
 
+    describe("unit: HTML Instrumentation Script Order", function () {
+        const remoteScript = '<script src="/phoenix-remote.js"></script>';
+        const pageScript = '<script>window.pageRan = true;</script>';
+        const fixtures = [
+            { name: "inline scripts in the head", html: '<!doctype html><html><head>' + pageScript +
+                '</head><body></body></html>' },
+            { name: "a body with no explicit head", html: '<!doctype html><html><body>' + pageScript +
+                '</body></html>' },
+            { name: "an HTML fragment starting with a script", html: pageScript + '<p>content</p>' },
+            { name: "a script before an explicit head", html: '<!doctype html><html>' + pageScript +
+                '<head></head><body></body></html>' },
+            { name: "uppercase head and script tags", html: '<!doctype html><HTML><HEAD>' +
+                pageScript.toUpperCase() + '</HEAD><BODY></BODY></HTML>' }
+        ];
+
+        fixtures.forEach(function (fixture) {
+            it("injects before " + fixture.name, function () {
+                const mockEditor = SpecRunnerUtils.createMockEditor(fixture.html, "html").editor;
+                try {
+                    // Repeat after an edit so regeneration also uses the cached editor marks.
+                    for (let i = 0; i < 2; i++) {
+                        if (i > 0) {
+                            mockEditor.document.replaceRange(" ", { line: 0, ch: 0 });
+                            HTMLInstrumentation.getUnappliedEditList(mockEditor);
+                        }
+                        const html = HTMLInstrumentation.generateInstrumentedHTML(mockEditor, remoteScript);
+                        const parsed = new DOMParser().parseFromString(html, "text/html");
+                        const scripts = parsed.querySelectorAll("script");
+                        expect(scripts.length).toBe(2);
+                        expect(scripts[0].getAttribute("src")).toBe("/phoenix-remote.js");
+                        expect(scripts[1].textContent.toLowerCase()).toBe("window.pageran = true;");
+                        if (fixture.html.startsWith("<!doctype")) {
+                            expect(parsed.compatMode).toBe("CSS1Compat");
+                        }
+                    }
+                } finally {
+                    SpecRunnerUtils.destroyMockEditor(mockEditor.document);
+                }
+            });
+        });
+    });
+
+    describe("unit: HTML Live Preview Unfinished Pages", function () {
+        const remoteScript = '<script src="/phoenix-remote.js"></script>';
+        const fixtures = [
+            { name: "an empty page", html: "" },
+            { name: "whitespace only", html: " \n\t" },
+            { name: "a doctype only", html: "<!doctype html>", standards: true },
+            { name: "a partial opening tag", html: "<div" },
+            { name: "an unfinished comment", html: "<!-- still typing" },
+            { name: "an unfinished attribute", html: '<!doctype html><html><body><div class="', standards: true },
+            { name: "an unfinished script", html: '<!doctype html><script>window.pageRan = true;', standards: true },
+            { name: "a script followed by a partial tag", html: '<script>window.pageRan = true;</script><div' },
+            { name: "a comment before the doctype", html: '<!-- note --><!doctype html><div', standards: true },
+            { name: "a PUBLIC doctype", html: '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" ' +
+                '"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><div', standards: true },
+            { name: "a SYSTEM identifier containing a greater-than sign", html: '<!doctype html SYSTEM "a>b"><div' },
+            { name: "an abruptly closed doctype before a script",
+                html: '<!doctype html SYSTEM "a><script>window.pageRan = true;</script><div' },
+            { name: "a comment with a browser-supported alternate ending",
+                html: '<!-- note --!><script>window.pageRan = true;</script><!-- unfinished' }
+        ];
+
+        fixtures.forEach(function (fixture) {
+            it("keeps the runtime available for " + fixture.name, function () {
+                const mockEditor = SpecRunnerUtils.createMockEditor(fixture.html, "html").editor;
+                const liveDoc = {
+                    editor: mockEditor,
+                    doc: mockEditor.document,
+                    protocol: { getRemoteScript: function () { return remoteScript; } },
+                    _instrumentationEnabled: true
+                };
+                try {
+                    const html = LiveHTMLDocument.prototype.getResponseData.call(liveDoc).body;
+                    const parsed = new DOMParser().parseFromString(html, "text/html");
+                    const scripts = parsed.querySelectorAll("script");
+                    expect(scripts[0].getAttribute("src")).toBe("/phoenix-remote.js");
+                    expect(parsed.querySelectorAll('script[src="/phoenix-remote.js"]').length).toBe(1);
+                    if (fixture.standards) {
+                        expect(parsed.compatMode).toBe("CSS1Compat");
+                    }
+                    const original = new DOMParser().parseFromString(fixture.html, "text/html");
+                    if (original.doctype) {
+                        expect(parsed.compatMode).toBe(original.compatMode);
+                    }
+                    liveDoc._instrumentationEnabled = false;
+                    expect(LiveHTMLDocument.prototype.getResponseData.call(liveDoc).body).toBe(fixture.html);
+                } finally {
+                    SpecRunnerUtils.destroyMockEditor(mockEditor.document);
+                }
+            });
+        });
+    });
+
     describe("HTML Instrumentation", function () {
 
         function getIdToTagMap(instrumentedHTML, map) {
diff --git a/test/spec/LiveDevelopmentMultiBrowser-test.js b/test/spec/LiveDevelopmentMultiBrowser-test.js
index 3c060863b3..e36f621a46 100644
--- a/test/spec/LiveDevelopmentMultiBrowser-test.js
+++ b/test/spec/LiveDevelopmentMultiBrowser-test.js
@@ -265,6 +265,35 @@ define(function (require, exports, module) {
             await endPreviewSession();
         }, 60000);
 
+        [
+            { name: "a blank page", html: "" },
+            { name: "an unfinished attribute after a page script", html: '<!doctype html><script>' +
+                'window.__pageSawComm = typeof window._Brackets_LiveDev_PhoenixComm;</script><div class="' },
+            { name: "an unfinished script", html: '<!doctype html><script>window.stillTyping = ' }
+        ].forEach(function (fixture) {
+            it("keeps live preview connected for " + fixture.name + " and recovers when HTML is completed",
+                async function () {
+                    try {
+                        await awaitsForDone(SpecRunnerUtils.openProjectFiles(["simple1.html"]));
+                        const doc = DocumentManager.getCurrentDocument();
+                        doc.setText(fixture.html);
+                        await waitsForLiveDevelopmentToOpen();
+                        const sealed = await forRemoteExec("({frozen:Object.isFrozen(window._LD)," +
+                            "comm:typeof window._Brackets_LiveDev_PhoenixComm,answer:40+2})", result => !!result);
+                        expect(sealed).toEqual({ frozen: true, comm: "undefined", answer: 42 });
+                        if (fixture.html.includes("__pageSawComm")) {
+                            expect(await forRemoteExec("window.__pageSawComm", value => value !== undefined))
+                                .toBe("undefined");
+                        }
+                        doc.setText('<!doctype html><html><head></head><body><p id="recovered">Ready</p></body></html>');
+                        await forRemoteExec("document.getElementById('recovered') && " +
+                            "document.getElementById('recovered').textContent", value => value === "Ready");
+                    } finally {
+                        await endPreviewSession();
+                    }
+                }, 60000);
+        });
+
         it("should send all external stylesheets as related docs on start-up", async function () {
             let liveDoc;
             await awaitsForDone(SpecRunnerUtils.openProjectFiles(["simple1.html"]),

From fbf08680de022eff708c9b3328fbc77e127e5c26 Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sat, 3 Oct 2026 11:03:24 +0530
Subject: [PATCH 2/7] feat(ai): forward intermediate usage reports to the chat
 meter

Send assistant-message token snapshots with request, message, parent tool and model identifiers.
The UI can deduplicate provisional usage until the final report arrives.
---
 src-node/claude-code-agent.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src-node/claude-code-agent.js b/src-node/claude-code-agent.js
index 862886b757..c93408453a 100644
--- a/src-node/claude-code-agent.js
+++ b/src-node/claude-code-agent.js
@@ -2499,8 +2499,8 @@ async function _runQuery(requestId, prompt, projectPath, model, signal, locale,
             // Per-turn token usage: each SDKAssistantMessage carries the
             // wrapped Anthropic API message whose `.usage` reflects what
             // that single turn consumed. Useful for diagnosing runaway
-            // loops; logged but not metric'd individually (the result
-            // message rolls up the session totals).
+            // loops. The panel keeps these in RAM until the result replaces
+            // them; message ids let it dedupe repeated content blocks.
             if (message.type === "assistant" &&
                     message.message && message.message.usage) {
                 const u = message.message.usage;
@@ -2510,6 +2510,13 @@ async function _runQuery(requestId, prompt, projectPath, model, signal, locale,
                     "cacheRead=" + (u.cache_read_input_tokens || 0),
                     "cacheCreate=" + (u.cache_creation_input_tokens || 0),
                     message.parent_tool_use_id ? "(subagent)" : "");
+                nodeConnector.triggerPeer("aiUsageProgress", {
+                    requestId: requestId,
+                    messageId: message.message.id,
+                    parentToolUseId: message.parent_tool_use_id || null,
+                    model: message.message.model,
+                    usage: u
+                });
             }
 
             // Aggregate session usage on the terminal `result` message.

From 15b4ada0ee2ab2f5df5a8fa356275e7f60c89fbe Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sat, 3 Oct 2026 17:18:27 +0530
Subject: [PATCH 3/7] feat(livepreview): support embedded Ask AI controls

Add the Show Ask AI preference, preview configuration, and localized composer strings.

Pin Phoenix Pro to the embedded live preview chat implementation.
---
 src/LiveDevelopment/LivePreviewConstants.js   |  1 +
 src/LiveDevelopment/main.js                   |  9 +++++++
 .../Phoenix-live-preview/main.js              | 18 ++++++++++++-
 src/nls/root/strings.js                       | 25 +++++++++++++++++++
 tracking-repos.json                           |  2 +-
 5 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/src/LiveDevelopment/LivePreviewConstants.js b/src/LiveDevelopment/LivePreviewConstants.js
index 69a46993c7..d1b890a44c 100644
--- a/src/LiveDevelopment/LivePreviewConstants.js
+++ b/src/LiveDevelopment/LivePreviewConstants.js
@@ -41,6 +41,7 @@ define(function main(require, exports, module) {
     exports.HIGHLIGHT_CLICK = "click";
 
     exports.PREFERENCE_SHOW_RULER_LINES = "livePreviewShowMeasurements";
+    exports.PREFERENCE_SHOW_ASK_AI = "livePreviewShowAskAI";
 
     exports.PREFERENCE_SHOW_STYLES_BAR = "livePreviewShowStylesBar";
 
diff --git a/src/LiveDevelopment/main.js b/src/LiveDevelopment/main.js
index c8d8600a08..203e41845e 100644
--- a/src/LiveDevelopment/main.js
+++ b/src/LiveDevelopment/main.js
@@ -71,6 +71,7 @@ define(function main(require, exports, module) {
         mode: LIVE_HIGHLIGHT_MODE, // will be updated when we fetch entitlements
         elemHighlights: CONSTANTS.HIGHLIGHT_HOVER, // default value, this will get updated when the extension loads
         showRulerLines: false, // default value, this will get updated when the extension loads
+        showAskAI: true,
         showStylesBar: true, // default value, this will get updated when the extension loads
         showStarterBar: true, // default value, this will get updated when the extension loads
         stylesBarPosition: "bottom", // saved dock side ("top"/"bottom")
@@ -339,6 +340,13 @@ define(function main(require, exports, module) {
         MultiBrowserLiveDev.updateConfig(config);
     }
 
+    /** Synchronize the preview-only Ask AI visibility preference with connected pages. */
+    function updateAskAIConfig() {
+        const config = MultiBrowserLiveDev.getConfig();
+        config.showAskAI = PreferencesManager.get(CONSTANTS.PREFERENCE_SHOW_ASK_AI) !== false;
+        MultiBrowserLiveDev.updateConfig(config);
+    }
+
     function updateStylesBarConfig() {
         const prefValue = PreferencesManager.get(CONSTANTS.PREFERENCE_SHOW_STYLES_BAR);
         const config = MultiBrowserLiveDev.getConfig();
@@ -383,6 +391,7 @@ define(function main(require, exports, module) {
     exports.setLivePreviewTransportBridge = setLivePreviewTransportBridge;
     exports.updateElementHighlightConfig = updateElementHighlightConfig;
     exports.updateRulerLinesConfig = updateRulerLinesConfig;
+    exports.updateAskAIConfig = updateAskAIConfig;
     exports.updateStylesBarConfig = updateStylesBarConfig;
     exports.updateStarterBarConfig = updateStarterBarConfig;
     exports.updateStylesBarPositionConfig = updateStylesBarPositionConfig;
diff --git a/src/extensionsIntegrated/Phoenix-live-preview/main.js b/src/extensionsIntegrated/Phoenix-live-preview/main.js
index 03d6b139f1..1d60d649e6 100644
--- a/src/extensionsIntegrated/Phoenix-live-preview/main.js
+++ b/src/extensionsIntegrated/Phoenix-live-preview/main.js
@@ -112,6 +112,10 @@ define(function (require, exports, module) {
 
     // live preview ruler lines preference (show/hide ruler lines on element selection)
     const PREFERENCE_SHOW_RULER_LINES = CONSTANTS.PREFERENCE_SHOW_RULER_LINES;
+    const PREFERENCE_SHOW_ASK_AI = CONSTANTS.PREFERENCE_SHOW_ASK_AI;
+    PreferencesManager.definePreference(PREFERENCE_SHOW_ASK_AI, "boolean", true, {
+        description: Strings.LIVE_DEV_AI_CHAT_SHOW
+    });
     PreferencesManager.definePreference(PREFERENCE_SHOW_RULER_LINES, "boolean", false, {
         description: Strings.LIVE_DEV_SETTINGS_SHOW_RULER_LINES_PREFERENCE
     });
@@ -415,6 +419,9 @@ define(function (require, exports, module) {
             items.push(Strings.LIVE_PREVIEW_EDIT_HIGHLIGHT_ON);
             items.push(Strings.LIVE_PREVIEW_SHOW_RULER_LINES);
         }
+        if (Phoenix.isNativeApp) {
+            items.push("---", Strings.LIVE_DEV_AI_CHAT_SHOW);
+        }
 
         $dropdown = new DropdownButton.DropdownButton("", items, function(item, index) {
             if (item === Strings.LIVE_PREVIEW_MODE_PREVIEW) {
@@ -440,6 +447,8 @@ define(function (require, exports, module) {
                     return `✓ ${Strings.LIVE_PREVIEW_EDIT_HIGHLIGHT_ON}`;
                 }
                 return `${'\u00A0'.repeat(4)}${Strings.LIVE_PREVIEW_EDIT_HIGHLIGHT_ON}`;
+            } else if (item === Strings.LIVE_DEV_AI_CHAT_SHOW) {
+                return (PreferencesManager.get(PREFERENCE_SHOW_ASK_AI) ? "✓ " : "\u00A0".repeat(4)) + item;
             } else if (item === Strings.LIVE_PREVIEW_SHOW_RULER_LINES) {
                 const isEnabled = PreferencesManager.get(PREFERENCE_SHOW_RULER_LINES);
                 if(isEnabled) {
@@ -483,6 +492,8 @@ define(function (require, exports, module) {
                         Metrics.countEvent(Metrics.EVENT_TYPE.PRO, "proUpsellDlg", "fail");
                     }
                 }
+            } else if (item === Strings.LIVE_DEV_AI_CHAT_SHOW) {
+                PreferencesManager.set(PREFERENCE_SHOW_ASK_AI, !PreferencesManager.get(PREFERENCE_SHOW_ASK_AI));
             } else if (item === Strings.LIVE_PREVIEW_EDIT_HIGHLIGHT_ON) {
                 // Don't allow edit highlight toggle if edit features are not active
                 if (!isEditFeaturesActive) {
@@ -1691,6 +1702,9 @@ define(function (require, exports, module) {
         PreferencesManager.on("change", PREFERENCE_SHOW_RULER_LINES, function() {
             LiveDevelopment.updateRulerLinesConfig();
         });
+        PreferencesManager.on("change", PREFERENCE_SHOW_ASK_AI, function () {
+            LiveDevelopment.updateAskAIConfig();
+        });
         PreferencesManager.on("change", PREFERENCE_SHOW_STYLES_BAR, function() {
             LiveDevelopment.updateStylesBarConfig();
         });
@@ -1703,6 +1717,7 @@ define(function (require, exports, module) {
         // Initialize element highlight, ruler lines and styles bar config on startup
         LiveDevelopment.updateElementHighlightConfig();
         LiveDevelopment.updateRulerLinesConfig();
+        LiveDevelopment.updateAskAIConfig();
         LiveDevelopment.updateStylesBarConfig();
         LiveDevelopment.updateStarterBarConfig();
         LiveDevelopment.updateStylesBarPositionConfig();
@@ -1901,9 +1916,10 @@ define(function (require, exports, module) {
     exports.showInterstitial = showInterstitial;
     exports.hideInterstitial = hideInterstitial;
     exports.getPreviewedFilePath = getPreviewedFilePath;
+    /** @return {string|null} Transport client of the current embedded HTML preview, never a popout. */
+    exports.getEmbeddedClientID = function () { return _dockedClientID || null; };
     exports.canPopoutLivePreview = canPopoutLivePreview;
     exports.popoutLivePreview = popoutLivePreview;
     exports.reloadLivePreview = reloadLivePreview;
 });
 
-
diff --git a/src/nls/root/strings.js b/src/nls/root/strings.js
index e2bc53c088..598e9b2a2c 100644
--- a/src/nls/root/strings.js
+++ b/src/nls/root/strings.js
@@ -3020,6 +3020,31 @@ define({
     "AI_CHAT_ATTACH_FILE_OPTION": "Attach a file",
     "AI_CHAT_ATTACH_FOLDER": "Add folder as context",
     "AI_CHAT_ATTACH_FOLDER_PICK_TITLE": "Choose folder to add as context",
+    "LIVE_DEV_AI_CHAT_TITLE": "Ask AI",
+    "LIVE_DEV_AI_CHAT_SHOW": "Show Ask AI",
+    "LIVE_DEV_AI_CHAT_MOVE": "Drag to move · Double-click to reset · Arrow keys to move, Home to reset",
+    "LIVE_DEV_AI_CHAT_IMAGES": "Images and element references",
+    "LIVE_DEV_AI_CHAT_PICK": "Select element",
+    "LIVE_DEV_AI_CHAT_PICK_HINT": "Select an element to add as context",
+    "LIVE_DEV_AI_CHAT_SCREENSHOT": "Screenshot",
+    "LIVE_DEV_AI_CHAT_PLACEHOLDER": "Ask about this element…",
+    "LIVE_DEV_AI_CHAT_SEND": "Send to Visual AI",
+    "LIVE_DEV_AI_CHAT_KEYS": "Enter to send · Shift + Enter for a new line",
+    "LIVE_DEV_AI_CHAT_SELECTED": "Selected element",
+    "LIVE_DEV_AI_CHAT_CURRENT": "Current element · Updated when Ask AI opens",
+    "LIVE_DEV_AI_CHAT_NO_SELECTION": "None selected",
+    "LIVE_DEV_AI_CHAT_ADD": "Add screenshot and element reference: {0}",
+    "LIVE_DEV_AI_CHAT_REMOVE": "Remove image",
+    "LIVE_DEV_AI_CHAT_OPEN_IMAGE": "Open image",
+    "LIVE_DEV_AI_CHAT_CAPTURE": "Capturing…",
+    "LIVE_DEV_AI_CHAT_CAPTURE_ERROR": "Could not capture. Try again.",
+    "LIVE_DEV_AI_CHAT_SENDING": "Sending…",
+    "LIVE_DEV_AI_CHAT_SENT": "Sent to Visual AI",
+    "LIVE_DEV_AI_CHAT_SEND_ERROR": "Not sent. Check the AI panel, then try again. Your draft is saved here.",
+    "LIVE_DEV_AI_CHAT_LIMIT": "You can attach up to {0} images.",
+    "LIVE_DEV_AI_CHAT_SOURCE": "{0}:{1}",
+    "LIVE_DEV_AI_CHAT_SOURCE_UNAVAILABLE": "Source location unavailable",
+
     "AI_CHAT_SCREENSHOT_TITLE": "Take Screenshot",
     "AI_CHAT_SCREENSHOT_LIVE_PREVIEW": "Live Preview",
     "AI_CHAT_SCREENSHOT_AREA": "Select Area",
diff --git a/tracking-repos.json b/tracking-repos.json
index 3169a0c51d..95ecc26d3c 100644
--- a/tracking-repos.json
+++ b/tracking-repos.json
@@ -1,5 +1,5 @@
 {
   "phoenixPro": {
-    "commitID": "e31639b0d77eb4ae07ebb9e627d372387f7d6126"
+    "commitID": "0bd160bd5825cac76f529e43e5029607259e6e05"
   }
 }

From 465bb35fa8ec86d4e08f43186e8010a6a3547477 Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sat, 3 Oct 2026 18:03:51 +0530
Subject: [PATCH 4/7] fix(build): pin Pro with compatible preview syntax

---
 tracking-repos.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tracking-repos.json b/tracking-repos.json
index 95ecc26d3c..fa0e3da6d3 100644
--- a/tracking-repos.json
+++ b/tracking-repos.json
@@ -1,5 +1,5 @@
 {
   "phoenixPro": {
-    "commitID": "0bd160bd5825cac76f529e43e5029607259e6e05"
+    "commitID": "ad52b10b4d23b605f13fafca84f84390e664c7ad"
   }
 }

From 4923d31efe465db7cfa4bfc584a314919a7987b2 Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sun, 4 Oct 2026 00:09:40 +0530
Subject: [PATCH 5/7] fix(livepreview): preserve private transport setup in
 production

Replace the declaration-based config marker with a call that survives minification.

Keep transport configuration private and retain the captured globals and runtime sealing.
---
 .../LivePreviewTransportRemote.js             | 13 ++++---
 .../transports/LivePreviewTransport.js        | 35 +++++++++----------
 2 files changed, 23 insertions(+), 25 deletions(-)

diff --git a/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js b/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
index 682a71f9e6..fa94cc917e 100644
--- a/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
+++ b/src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js
@@ -19,6 +19,8 @@
  *
  */
 
+/*global __PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__ */
+
 // This is a transport injected into the browser via a script that handles the low
 // level communication between the live development protocol handlers on both sides.
 // The actual communication to phoenix is done via the loaded web worker below. We just post/receive all
@@ -89,13 +91,10 @@
 
 (function (global) {
 
-    // The below line will be replaced with the transport scripts provided by the static server at
-    // LivePreviewTransport.js:getRemoteScript() This is so that the actual live preview page doesnt get hold of
-    // any phoenix web socket or broadcast channel ids from this closure programatically for security.
-
-    //Replace dynamic section start
-    const TRANSPORT_CONFIG={};
-    //Replace dynamic section end
+    // getRemoteScript() replaces this call with a private config initializer before serving the script.
+    // A call survives minification without depending on declaration spacing or merged const statements.
+    // Its unknown return value also prevents the minifier from folding config property reads.
+    const TRANSPORT_CONFIG = __PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__();
 
     // The page's own scripts run after this one and may patch built-ins to read or rewrite what goes
     // to and from the editor. The channel uses the originals, captured here before any of them runs.
diff --git a/src/LiveDevelopment/MultiBrowserImpl/transports/LivePreviewTransport.js b/src/LiveDevelopment/MultiBrowserImpl/transports/LivePreviewTransport.js
index 6b1d847292..5d8f90f225 100644
--- a/src/LiveDevelopment/MultiBrowserImpl/transports/LivePreviewTransport.js
+++ b/src/LiveDevelopment/MultiBrowserImpl/transports/LivePreviewTransport.js
@@ -63,30 +63,29 @@ define(function (require, exports, module) {
     let _transportBridge;
 
     /**
-     * Returns the script that should be injected into the browser to handle the other end of the transport.
+     * Fill the remote script's config initializer, preserving its private scope in source and minified builds.
      * @return {string}
      */
     function getRemoteScript() {
-        const replaceString = "const TRANSPORT_CONFIG={};";
+        const replaceString = "__PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__()";
         if(!LivePreviewTransportRemote.includes(replaceString)){
-            throw new Error("Live preview transport is expected to have replaceable template string:" +
-                " //REPLACE_ME_WITH_LIVE_PREVIEW_TRANSPORT_CONFIG_AND_SCRIPT_DYNAMIC");
+            throw new Error("Live preview transport is missing its config initializer: " + replaceString);
         }
-        let transportScript = (_transportBridge && _transportBridge.getRemoteTransportScript &&
+        const transportScript = (_transportBridge && _transportBridge.getRemoteTransportScript &&
             _transportBridge.getRemoteTransportScript()) || "";
-        transportScript = "const TRANSPORT_CONFIG={};" +
-            `TRANSPORT_CONFIG.PHOENIX_INSTANCE_ID = "${Phoenix.PHOENIX_INSTANCE_ID}";\n` +
-            `TRANSPORT_CONFIG.IS_NATIVE_APP = ${Phoenix.isNativeApp};\n` +
-            `TRANSPORT_CONFIG.PLATFORM = "${Phoenix.platform}";\n` +
-            `TRANSPORT_CONFIG.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME = "${LiveDevProtocol.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME}";\n` +
-            `TRANSPORT_CONFIG.LIVE_PREVIEW_DEBUG_ENABLED = ${logger.loggingOptions.logLivePreview};\n`+
-            `TRANSPORT_CONFIG.TRUSTED_ORIGINS_EMBED = ${JSON.stringify(Phoenix.TRUSTED_ORIGINS)};\n`+
-            `TRANSPORT_CONFIG.STRINGS = {
-                UNSUPPORTED_DOM_APIS_CONFIRM: "${Strings.UNSUPPORTED_DOM_APIS_CONFIRM}"
-            };\n`+
-            transportScript;
-        return LivePreviewTransportRemote.replace(replaceString, transportScript)
-            + "\n";
+        const config = {
+            PHOENIX_INSTANCE_ID: Phoenix.PHOENIX_INSTANCE_ID,
+            IS_NATIVE_APP: Phoenix.isNativeApp,
+            PLATFORM: Phoenix.platform,
+            LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME: LiveDevProtocol.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME,
+            LIVE_PREVIEW_DEBUG_ENABLED: logger.loggingOptions.logLivePreview,
+            TRUSTED_ORIGINS_EMBED: Phoenix.TRUSTED_ORIGINS,
+            STRINGS: { UNSUPPORTED_DOM_APIS_CONFIRM: Strings.UNSUPPORTED_DOM_APIS_CONFIRM }
+        };
+        const initializer = "(function () {\nconst TRANSPORT_CONFIG = " + JSON.stringify(config) + ";\n" +
+            transportScript + "\nreturn TRANSPORT_CONFIG;\n}())";
+        // A callback keeps literal $ sequences in config values out of String.replace's replacement syntax.
+        return LivePreviewTransportRemote.replace(replaceString, () => initializer) + "\n";
     }
 
     EventDispatcher.makeEventDispatcher(exports);

From 75feec10b4f8b4dea27b5e0cd8d1f19aee9d07e2 Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sun, 4 Oct 2026 12:27:22 +0530
Subject: [PATCH 6/7] fix(livepreview): pin improved Ask AI composer

---
 src/brackets.js         | 5 +++--
 src/nls/root/strings.js | 3 ++-
 tracking-repos.json     | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/brackets.js b/src/brackets.js
index 8cc2e89296..fb735919b8 100644
--- a/src/brackets.js
+++ b/src/brackets.js
@@ -461,8 +461,9 @@ define(function (require, exports, module) {
         // not steal focus. Calling preventDefault() on mousedown prevents
         // focus from going to the click target.
         $("html").on("mousedown", ".no-focus", function (e) {
-            // Text fields should always be focusable.
-            const $target = $(e.target),
+            // Shadow DOM retargets e.target to its host; text fields inside it must still be focusable.
+            const eventPath = e.originalEvent && e.originalEvent.composedPath ? e.originalEvent.composedPath() : [];
+            const $target = $(eventPath[0] || e.target),
                 isFormElement =
                     $target.is("input") ||
                     $target.is("textarea") ||
diff --git a/src/nls/root/strings.js b/src/nls/root/strings.js
index 598e9b2a2c..e174aa11c9 100644
--- a/src/nls/root/strings.js
+++ b/src/nls/root/strings.js
@@ -3022,7 +3022,7 @@ define({
     "AI_CHAT_ATTACH_FOLDER_PICK_TITLE": "Choose folder to add as context",
     "LIVE_DEV_AI_CHAT_TITLE": "Ask AI",
     "LIVE_DEV_AI_CHAT_SHOW": "Show Ask AI",
-    "LIVE_DEV_AI_CHAT_MOVE": "Drag to move · Double-click to reset · Arrow keys to move, Home to reset",
+    "LIVE_DEV_AI_CHAT_MOVE": "Drag to move · Double-click to reset position",
     "LIVE_DEV_AI_CHAT_IMAGES": "Images and element references",
     "LIVE_DEV_AI_CHAT_PICK": "Select element",
     "LIVE_DEV_AI_CHAT_PICK_HINT": "Select an element to add as context",
@@ -3031,6 +3031,7 @@ define({
     "LIVE_DEV_AI_CHAT_SEND": "Send to Visual AI",
     "LIVE_DEV_AI_CHAT_KEYS": "Enter to send · Shift + Enter for a new line",
     "LIVE_DEV_AI_CHAT_SELECTED": "Selected element",
+    "LIVE_DEV_AI_CHAT_ADD_SELECTED": "Add selected",
     "LIVE_DEV_AI_CHAT_CURRENT": "Current element · Updated when Ask AI opens",
     "LIVE_DEV_AI_CHAT_NO_SELECTION": "None selected",
     "LIVE_DEV_AI_CHAT_ADD": "Add screenshot and element reference: {0}",
diff --git a/tracking-repos.json b/tracking-repos.json
index fa0e3da6d3..7421b7f764 100644
--- a/tracking-repos.json
+++ b/tracking-repos.json
@@ -1,5 +1,5 @@
 {
   "phoenixPro": {
-    "commitID": "ad52b10b4d23b605f13fafca84f84390e664c7ad"
+    "commitID": "0aa88ca543e1cbd329c57eac7a77b08a6b7d0e2b"
   }
 }

From ac58b7a4bbc49be3d04534dc29a2464ea1beacdc Mon Sep 17 00:00:00 2001
From: abose <arun@core.ai>
Date: Sun, 4 Oct 2026 14:12:51 +0530
Subject: [PATCH 7/7] chore: update pro deps

---
 tracking-repos.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tracking-repos.json b/tracking-repos.json
index 7421b7f764..bc9afbcd8a 100644
--- a/tracking-repos.json
+++ b/tracking-repos.json
@@ -1,5 +1,5 @@
 {
   "phoenixPro": {
-    "commitID": "0aa88ca543e1cbd329c57eac7a77b08a6b7d0e2b"
+    "commitID": "4be34303f8a86fcf696198275c8b9bfe1b80ee3d"
   }
 }