From 54d84ff2e0cc4fac5b8fef00d37681ce08d2170a Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 15:24:27 +0800
Subject: [PATCH 01/32] feat: add browser environment builtin

---
 doc/api/browser-env.md                 |  87 +++
 doc/api/cli.md                         |  14 +
 doc/api/index.md                       |   1 +
 lib/browser-env.js                     |   9 +
 lib/internal/browser_env.js            | 798 +++++++++++++++++++++++++
 lib/internal/process/pre_execution.js  |   8 +
 node.gyp                               |   1 +
 src/node_binding.cc                    |   1 +
 src/node_browser_env.cc                | 148 +++++
 src/node_external_reference.h          |   1 +
 src/node_options.cc                    |   4 +
 src/node_options.h                     |   1 +
 test/fixtures/browser-env/profile.json |  19 +
 test/parallel/test-browser-env.js      | 133 +++++
 14 files changed, 1225 insertions(+)
 create mode 100644 doc/api/browser-env.md
 create mode 100644 lib/browser-env.js
 create mode 100644 lib/internal/browser_env.js
 create mode 100644 src/node_browser_env.cc
 create mode 100644 test/fixtures/browser-env/profile.json
 create mode 100644 test/parallel/test-browser-env.js

diff --git a/doc/api/browser-env.md b/doc/api/browser-env.md
new file mode 100644
index 000000000000..1eef339488c3
--- /dev/null
+++ b/doc/api/browser-env.md
@@ -0,0 +1,87 @@
+# Browser environment
+
+<!--introduced_in=REPLACEME-->
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+<!-- source_link=lib/browser-env.js -->
+
+The `node:browser-env` module installs a browser-compatible global environment
+in the current Realm. It provides a lightweight DOM tree, virtual navigation,
+profiled `navigator` and `screen` values, in-memory storage, and a native
+`document.all` implementation. It does not provide rendering, layout, Canvas,
+WebGL, real page navigation, or automatic execution of scripts in HTML.
+
+```cjs
+const { install } = require('node:browser-env');
+
+install({
+  url: 'https://example.test/page',
+  html: '<main id="app">Hello</main>',
+  navigator: { platform: 'Win32', languages: ['zh-CN', 'zh'] },
+  window: { properties: { customFlag: true } },
+  document: { properties: { visibilityState: 'hidden' } },
+});
+
+console.log(document.querySelector('#app').textContent);
+```
+
+```mjs
+import { install } from 'node:browser-env';
+
+install({ url: 'https://example.test/' });
+```
+
+## `browserEnv.install(options)`
+
+Installs the environment in the current Realm and returns
+`{ window, document, navigator, location }`. It must be called before loading
+code that reads browser globals. It throws if the Realm already has an
+installed browser environment.
+
+* `options` {Object}
+  * `url` {string} Required initial URL. `location.href` is also accepted for
+    JSON profile compatibility.
+  * `html` {string} Optional initial HTML. Scripts in this HTML are not run.
+  * `navigator` {Object} Optional overrides for browser identity fields such
+    as `userAgent`, `platform`, `language`, and `languages`.
+  * `screen` {Object} Optional screen-dimension overrides.
+  * `cookies` {string|Object} Optional initial in-memory cookies.
+  * `localStorage` {Object} Optional initial local storage values.
+  * `sessionStorage` {Object} Optional initial session storage values.
+  * `window.properties` {Object} Optional ordinary custom global properties.
+  * `window.descriptors` {Object} Optional custom property descriptors.
+  * `document.properties` {Object} Optional ordinary custom document
+    properties.
+  * `document.descriptors` {Object} Optional custom document property
+    descriptors.
+
+Core browser-environment properties, including `document.all`, DOM methods,
+`location`, `navigator`, and the `window` identity aliases cannot be replaced
+through `properties` or `descriptors`.
+
+## `browserEnv.isInstalled()`
+
+Returns `true` when `install()` or `--browser-env-profile` has installed the
+environment in the current Realm.
+
+## `--browser-env-profile=file`
+
+The command-line option loads the same `options` shape from a JSON file before
+user code executes:
+
+```json
+{
+  "url": "https://example.test/",
+  "html": "<main id=\"app\"></main>",
+  "navigator": { "platform": "Win32" }
+}
+```
+
+The CLI profile is applied independently in each Node Realm that starts with
+the option. Programmatic installation applies only to the Realm that calls
+`install()`.
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 514af04c02cd..c8242adacd72 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -564,6 +564,18 @@ The following options are currently supported:
 When using this flag, additional script files provided on the command line will
 not be executed and instead be interpreted as regular command line arguments.
 
+### `--browser-env-profile=file`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Install the browser-compatible environment described by the JSON profile before
+any user code is evaluated. The profile must contain a `url` string and can
+provide initial HTML, browser identity values, and custom `window` or
+`document` properties. See [`node:browser-env`][] for the supported profile
+shape and limitations.
+
 ### `-c`, `--check`
 
 <!-- YAML
@@ -3859,6 +3871,7 @@ one is included in the list below.
 * `--allow-openssl-store`
 * `--allow-wasi`
 * `--allow-worker`
+* `--browser-env-profile`
 * `--conditions`, `-C`
 * `--cpu-prof-dir`
 * `--cpu-prof-interval`
@@ -4546,6 +4559,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`import` specifier]: esm.md#import-specifiers
 [`net.getDefaultAutoSelectFamilyAttemptTimeout()`]: net.md#netgetdefaultautoselectfamilyattempttimeout
 [`node:ffi`]: ffi.md
+[`node:browser-env`]: browser-env.md
 [`node:sqlite`]: sqlite.md
 [`node:stream/iter`]: stream_iter.md
 [`node:vfs`]: vfs.md
diff --git a/doc/api/index.md b/doc/api/index.md
index 24c38d0f3a70..0c882572db1d 100644
--- a/doc/api/index.md
+++ b/doc/api/index.md
@@ -11,6 +11,7 @@
 * [Asynchronous context tracking](async_context.md)
 * [Async hooks](async_hooks.md)
 * [Buffer](buffer.md)
+* [Browser environment](browser-env.md)
 * [C++ addons](addons.md)
 * [C/C++ addons with Node-API](n-api.md)
 * [C++ embedder API](embedding.md)
diff --git a/lib/browser-env.js b/lib/browser-env.js
new file mode 100644
index 000000000000..9389212743a4
--- /dev/null
+++ b/lib/browser-env.js
@@ -0,0 +1,9 @@
+'use strict';
+
+const {
+  install,
+  isInstalled,
+} = require('internal/browser_env');
+
+exports.install = install;
+exports.isInstalled = isInstalled;
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
new file mode 100644
index 000000000000..18c4c49b5e69
--- /dev/null
+++ b/lib/internal/browser_env.js
@@ -0,0 +1,798 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypeIncludes,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypeSlice,
+  FunctionPrototypeCall,
+  ObjectCreate,
+  ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectSetPrototypeOf,
+  RegExpPrototypeExec,
+  String,
+  StringPrototypeSplit,
+  StringPrototypeToLowerCase,
+  StringPrototypeToUpperCase,
+  Symbol,
+} = primordials;
+
+const { URL } = require('internal/url');
+
+const { createDocumentAll } = internalBinding('browser_env');
+
+const kVoidElements = new Set([
+  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta',
+  'param', 'source', 'track', 'wbr',
+]);
+
+const kDefaultNavigator = {
+  userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '
+    + '(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+  platform: 'Win32',
+  language: 'en-US',
+  languages: ['en-US', 'en'],
+  vendor: 'Google Inc.',
+  maxTouchPoints: 0,
+  hardwareConcurrency: 8,
+  deviceMemory: 8,
+  webdriver: false,
+};
+
+const kProtectedWindowProperties = new Set([
+  'window', 'self', 'top', 'parent', 'globalThis', 'document', 'location',
+  'navigator', 'history', 'screen', 'Window', 'Navigator', 'Event',
+  'Node', 'Element', 'HTMLElement', 'Document', 'Text', 'localStorage',
+  'sessionStorage', 'addEventListener', 'removeEventListener', 'dispatchEvent',
+]);
+
+const kProtectedDocumentProperties = new Set([
+  'all', 'location', 'documentElement', 'head', 'body', 'cookie',
+  'createElement', 'createTextNode', 'appendChild', 'insertBefore',
+  'removeChild', 'replaceChild', 'getElementById', 'getElementsByTagName',
+  'getElementsByClassName', 'getElementsByName', 'querySelector',
+  'querySelectorAll', 'defaultView', 'addEventListener', 'removeEventListener',
+  'dispatchEvent',
+]);
+
+let installed = false;
+let installedEnvironment;
+
+function assertObject(value, name) {
+  if (value === null || typeof value !== 'object') {
+    throw new TypeError(`${name} must be an object`);
+  }
+}
+
+function getHref(options) {
+  const href = options.url ?? options.location?.href;
+  if (typeof href !== 'string' || href.length === 0) {
+    throw new TypeError('browser environment requires a non-empty url');
+  }
+  return href;
+}
+
+function createEventTarget(target) {
+  const listeners = new Map();
+  ObjectDefineProperty(target, '_listeners', {
+    __proto__: null,
+    configurable: false,
+    enumerable: false,
+    value: listeners,
+    writable: false,
+  });
+  target.addEventListener = function addEventListener(type, callback) {
+    if (typeof callback !== 'function') return;
+    const key = String(type);
+    let callbacks = listeners.get(key);
+    if (callbacks === undefined) {
+      callbacks = [];
+      listeners.set(key, callbacks);
+    }
+    if (!ArrayPrototypeIncludes(callbacks, callback)) ArrayPrototypePush(callbacks, callback);
+  };
+  target.removeEventListener = function removeEventListener(type, callback) {
+    const callbacks = listeners.get(String(type));
+    if (callbacks === undefined) return;
+    const index = callbacks.indexOf(callback);
+    if (index !== -1) callbacks.splice(index, 1);
+  };
+  target.dispatchEvent = function dispatchEvent(event) {
+    if (event === null || typeof event !== 'object' || !event.type) {
+      throw new TypeError('dispatchEvent requires an event with a type');
+    }
+    event.target ??= this;
+    event.currentTarget = this;
+    const callbacks = listeners.get(String(event.type));
+    if (callbacks !== undefined) {
+      for (const callback of ArrayPrototypeSlice(callbacks)) {
+        FunctionPrototypeCall(callback, this, event);
+      }
+    }
+    const handler = this[`on${event.type}`];
+    if (typeof handler === 'function') FunctionPrototypeCall(handler, this, event);
+    return !event.defaultPrevented;
+  };
+  return target;
+}
+
+class BrowserEvent {
+  constructor(type, init = {}) {
+    this.type = String(type);
+    this.bubbles = Boolean(init.bubbles);
+    this.cancelable = Boolean(init.cancelable);
+    this.defaultPrevented = false;
+  }
+
+  preventDefault() {
+    if (this.cancelable) this.defaultPrevented = true;
+  }
+}
+
+class BrowserNode {
+  constructor(ownerDocument, nodeType, nodeName) {
+    createEventTarget(this);
+    this.ownerDocument = ownerDocument;
+    this.nodeType = nodeType;
+    this.nodeName = nodeName;
+    this.parentNode = null;
+    this.childNodes = [];
+  }
+
+  get firstChild() {
+    return this.childNodes[0] ?? null;
+  }
+
+  get lastChild() {
+    return this.childNodes[this.childNodes.length - 1] ?? null;
+  }
+
+  get parentElement() {
+    return this.parentNode?.nodeType === 1 ? this.parentNode : null;
+  }
+
+  get children() {
+    return this.childNodes.filter((node) => node.nodeType === 1);
+  }
+
+  appendChild(child) {
+    return this.insertBefore(child, null);
+  }
+
+  insertBefore(child, referenceNode) {
+    if (!(child instanceof BrowserNode)) throw new TypeError('child must be a Node');
+    if (referenceNode !== null && referenceNode.parentNode !== this) {
+      throw new Error('reference node is not a child of this node');
+    }
+    if (child.parentNode !== null) child.parentNode.removeChild(child);
+    const index = referenceNode === null ? this.childNodes.length : this.childNodes.indexOf(referenceNode);
+    this.childNodes.splice(index, 0, child);
+    child.parentNode = this;
+    return child;
+  }
+
+  removeChild(child) {
+    const index = this.childNodes.indexOf(child);
+    if (index === -1) throw new Error('child is not a child of this node');
+    this.childNodes.splice(index, 1);
+    child.parentNode = null;
+    return child;
+    return child;
+  }
+
+  replaceChild(child, oldChild) {
+    const index = this.childNodes.indexOf(oldChild);
+    if (index === -1) throw new Error('old child is not a child of this node');
+    if (child.parentNode !== null) child.parentNode.removeChild(child);
+    this.childNodes[index] = child;
+    child.parentNode = this;
+    oldChild.parentNode = null;
+    return oldChild;
+  }
+
+  contains(node) {
+    for (let current = node; current !== null; current = current.parentNode) {
+      if (current === this) return true;
+    }
+    return false;
+  }
+
+  get textContent() {
+    if (this.nodeType === 3) return this.data;
+    return this.childNodes.map((node) => node.textContent).join('');
+  }
+
+  set textContent(value) {
+    for (const child of this.childNodes) child.parentNode = null;
+    this.childNodes.length = 0;
+    const text = String(value);
+    if (text.length > 0) this.appendChild(new BrowserText(this.ownerDocument, text));
+  }
+}
+
+class BrowserText extends BrowserNode {
+  constructor(ownerDocument, data) {
+    super(ownerDocument, 3, '#text');
+    this.data = String(data);
+  }
+
+  get textContent() {
+    return this.data;
+  }
+
+  set textContent(value) {
+    this.data = String(value);
+  }
+}
+
+class BrowserElement extends BrowserNode {
+  constructor(ownerDocument, tagName) {
+    const localName = StringPrototypeToLowerCase(String(tagName));
+    super(ownerDocument, 1, StringPrototypeToUpperCase(localName));
+    this.tagName = this.nodeName;
+    this.localName = localName;
+    this.attributes = ObjectCreate(null);
+    this.style = ObjectCreate(null);
+  }
+
+  get id() {
+    return this.getAttribute('id') ?? '';
+  }
+
+  set id(value) {
+    this.setAttribute('id', value);
+  }
+
+  get className() {
+    return this.getAttribute('class') ?? '';
+  }
+
+  set className(value) {
+    this.setAttribute('class', value);
+  }
+
+  get classList() {
+    const element = this;
+    return {
+      add(...tokens) {
+        const values = new Set(StringPrototypeSplit(element.className, ' ').filter(Boolean));
+        for (const token of tokens) values.add(String(token));
+        element.className = ArrayPrototypeJoin([...values], ' ');
+      },
+      remove(...tokens) {
+        const values = new Set(StringPrototypeSplit(element.className, ' ').filter(Boolean));
+        for (const token of tokens) values.delete(String(token));
+        element.className = ArrayPrototypeJoin([...values], ' ');
+      },
+      contains(token) {
+        return ArrayPrototypeIncludes(StringPrototypeSplit(element.className, ' '), String(token));
+      },
+      toggle(token, force) {
+        const present = this.contains(token);
+        const shouldAdd = force === undefined ? !present : Boolean(force);
+        if (shouldAdd) this.add(token); else this.remove(token);
+        return shouldAdd;
+      },
+    };
+  }
+
+  getAttribute(name) {
+    const key = StringPrototypeToLowerCase(String(name));
+    return Object.prototype.hasOwnProperty.call(this.attributes, key) ? this.attributes[key] : null;
+  }
+
+  hasAttribute(name) {
+    return this.getAttribute(name) !== null;
+  }
+
+  setAttribute(name, value) {
+    this.attributes[StringPrototypeToLowerCase(String(name))] = String(value);
+  }
+
+  removeAttribute(name) {
+    delete this.attributes[StringPrototypeToLowerCase(String(name))];
+  }
+
+  get innerHTML() {
+    return this.childNodes.map(serializeNode).join('');
+  }
+
+  set innerHTML(value) {
+    for (const child of this.childNodes) child.parentNode = null;
+    this.childNodes.length = 0;
+    for (const node of parseFragment(this.ownerDocument, String(value))) this.appendChild(node);
+  }
+
+  getElementsByTagName(tagName) {
+    const expected = StringPrototypeToLowerCase(String(tagName));
+    return createLiveCollection(this, (element) => expected === '*' || element.localName === expected);
+  }
+
+  getElementsByClassName(className) {
+    const expected = String(className);
+    return createLiveCollection(this, (element) =>
+      ArrayPrototypeIncludes(StringPrototypeSplit(element.className, ' '), expected));
+  }
+
+  getElementsByName(name) {
+    const expected = String(name);
+    return createLiveCollection(this, (element) => element.getAttribute('name') === expected);
+  }
+
+  querySelector(selector) {
+    return findElements(this, selector)[0] ?? null;
+  }
+
+  querySelectorAll(selector) {
+    return findElements(this, selector);
+  }
+}
+
+class BrowserDocument extends BrowserNode {
+  constructor(location) {
+    super(null, 9, '#document');
+    this.ownerDocument = this;
+    this._location = location;
+    this._cookieJar = new Map();
+    this.characterSet = 'UTF-8';
+    this.charset = 'UTF-8';
+    this.visibilityState = 'visible';
+    this._resetDocumentElement();
+  }
+
+  _resetDocumentElement() {
+    for (const child of this.childNodes) child.parentNode = null;
+    this.childNodes.length = 0;
+    this.documentElement = new BrowserElement(this, 'html');
+    this.head = new BrowserElement(this, 'head');
+    this.body = new BrowserElement(this, 'body');
+    this.documentElement.appendChild(this.head);
+    this.documentElement.appendChild(this.body);
+    this.appendChild(this.documentElement);
+  }
+
+  get location() {
+    return this._location;
+  }
+
+  get cookie() {
+    return [...this._cookieJar].map(([key, value]) => `${key}=${value}`).join('; ');
+  }
+
+  set cookie(value) {
+    const entry = StringPrototypeSplit(String(value), ';')[0];
+    const index = entry.indexOf('=');
+    if (index !== -1) this._cookieJar.set(entry.slice(0, index).trim(), entry.slice(index + 1).trim());
+  }
+
+  get title() {
+    return this.querySelector('title')?.textContent ?? '';
+  }
+
+  set title(value) {
+    let title = this.querySelector('title');
+    if (title === null) {
+      title = this.createElement('title');
+      this.head.appendChild(title);
+    }
+    title.textContent = value;
+  }
+
+  get scripts() {
+    return this.getElementsByTagName('script');
+  }
+
+  createElement(tagName) {
+    return new BrowserElement(this, tagName);
+  }
+
+  createTextNode(data) {
+    return new BrowserText(this, data);
+  }
+
+  getElementById(id) {
+    return walkElements(this, (element) => element.id === String(id))[0] ?? null;
+  }
+
+  getElementsByTagName(tagName) {
+    const expected = StringPrototypeToLowerCase(String(tagName));
+    return createLiveCollection(this, (element) => expected === '*' || element.localName === expected);
+  }
+
+  getElementsByClassName(className) {
+    return this.documentElement.getElementsByClassName(className);
+  }
+
+  getElementsByName(name) {
+    return this.documentElement.getElementsByName(name);
+  }
+
+  querySelector(selector) {
+    return findElements(this, selector)[0] ?? null;
+  }
+
+  querySelectorAll(selector) {
+    return findElements(this, selector);
+  }
+
+  loadHTML(html) {
+    const nodes = parseFragment(this, html);
+    const parsedHtml = nodes.find((node) => node instanceof BrowserElement && node.localName === 'html');
+    this._resetDocumentElement();
+    if (parsedHtml !== undefined) {
+      this.removeChild(this.documentElement);
+      this.documentElement = parsedHtml;
+      this.documentElement.parentNode = null;
+      this.appendChild(this.documentElement);
+      this.head = this.documentElement.children.find((node) => node.localName === 'head') ?? this.createElement('head');
+      this.body = this.documentElement.children.find((node) => node.localName === 'body') ?? this.createElement('body');
+      if (this.head.parentNode === null) this.documentElement.insertBefore(this.head, this.documentElement.firstChild);
+      if (this.body.parentNode === null) this.documentElement.appendChild(this.body);
+    } else {
+      for (const node of nodes) this.body.appendChild(node);
+    }
+  }
+}
+
+function walkElements(root, predicate) {
+  const result = [];
+  const visit = (node) => {
+    for (const child of node.childNodes) {
+      if (child.nodeType === 1) {
+        if (predicate(child)) ArrayPrototypePush(result, child);
+        visit(child);
+      }
+    }
+  };
+  if (root.nodeType === 1 && predicate(root)) ArrayPrototypePush(result, root);
+  visit(root);
+  return result;
+}
+
+function createLiveCollection(root, predicate) {
+  const current = () => walkElements(root, predicate);
+  return new Proxy(ObjectCreate(null), {
+    get(target, property) {
+      if (property === 'length') return current().length;
+      if (property === 'item') return (index) => current()[index] ?? null;
+      if (property === 'namedItem') return (name) => current().find((element) =>
+        element.id === name || element.getAttribute('name') === name) ?? null;
+      if (property === Symbol.iterator) return function* iterator() { yield* current(); };
+      if (typeof property === 'string' && /^\\d+$/.test(property)) return current()[Number(property)];
+      return target[property];
+    },
+    ownKeys() {
+      return [...current().keys()].map(String).concat('length');
+    },
+    getOwnPropertyDescriptor(target, property) {
+      if (property === 'length' || (typeof property === 'string' && /^\\d+$/.test(property))) {
+        return { configurable: true, enumerable: true };
+      }
+      return ObjectGetOwnPropertyDescriptor(target, property);
+    },
+  });
+}
+
+function selectorMatches(element, selector) {
+  const attribute = RegExpPrototypeExec(/^\[([\w-]+)(?:=["']?([^\]"']+)["']?)?\]$/, selector);
+  if (attribute !== null) {
+    return element.hasAttribute(attribute[1]) &&
+      (attribute[2] === undefined || element.getAttribute(attribute[1]) === attribute[2]);
+  }
+  const id = RegExpPrototypeExec(/^#([\w-]+)$/, selector);
+  if (id !== null) return element.id === id[1];
+  const className = RegExpPrototypeExec(/^\.([\w-]+)$/, selector);
+  if (className !== null) return element.classList.contains(className[1]);
+  const tagClass = RegExpPrototypeExec(/^([\w-]+)\.([\w-]+)$/, selector);
+  if (tagClass !== null) return element.localName === tagClass[1].toLowerCase() && element.classList.contains(tagClass[2]);
+  return element.localName === StringPrototypeToLowerCase(selector);
+}
+
+function findElements(root, selector) {
+  const selectors = StringPrototypeSplit(String(selector).trim(), /\s+/).filter(Boolean);
+  if (selectors.length === 0) return [];
+  const candidates = walkElements(root, (element) => selectorMatches(element, selectors[selectors.length - 1]));
+  return candidates.filter((candidate) => {
+    let current = candidate.parentElement;
+    for (let index = selectors.length - 2; index >= 0; index--) {
+      while (current !== null && !selectorMatches(current, selectors[index])) current = current.parentElement;
+      if (current === null) return false;
+      current = current.parentElement;
+    }
+    return true;
+  });
+}
+
+function parseAttributes(element, source) {
+  const attributePattern = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+  let match;
+  while ((match = attributePattern.exec(source)) !== null) {
+    element.setAttribute(match[1], match[2] ?? match[3] ?? match[4] ?? '');
+  }
+}
+
+function parseFragment(document, source) {
+  const root = new BrowserNode(document, 11, '#document-fragment');
+  const stack = [root];
+  const tokenPattern = /<\/?([A-Za-z][\w:-]*)([^>]*)>|([^<]+)/g;
+  let match;
+  while ((match = tokenPattern.exec(source)) !== null) {
+    if (match[3] !== undefined) {
+      stack[stack.length - 1].appendChild(document.createTextNode(match[3]));
+      continue;
+    }
+    const tagName = StringPrototypeToLowerCase(match[1]);
+    if (source[match.index + 1] === '/') {
+      for (let index = stack.length - 1; index > 0; index--) {
+        if (stack[index].localName === tagName) {
+          stack.length = index;
+          break;
+        }
+      }
+      continue;
+    }
+    const element = document.createElement(tagName);
+    parseAttributes(element, match[2]);
+    stack[stack.length - 1].appendChild(element);
+    if (!kVoidElements.has(tagName) && !/\/\s*$/.test(match[2])) ArrayPrototypePush(stack, element);
+  }
+  return root.childNodes;
+}
+
+function serializeNode(node) {
+  if (node.nodeType === 3) return node.data;
+  if (node.nodeType !== 1) return '';
+  const attributes = ObjectKeys(node.attributes).map((key) => ` ${key}="${node.attributes[key]}"`).join('');
+  if (kVoidElements.has(node.localName)) return `<${node.localName}${attributes}>`;
+  return `<${node.localName}${attributes}>${node.childNodes.map(serializeNode).join('')}</${node.localName}>`;
+}
+
+function createLocation(href) {
+  let url;
+  const replace = (value) => {
+    url = new URL(String(value), url);
+  };
+  replace(href);
+  const location = {};
+  for (const key of ['href', 'origin', 'protocol', 'host', 'hostname', 'port', 'pathname', 'search', 'hash']) {
+    ObjectDefineProperty(location, key, {
+      __proto__: null,
+      configurable: false,
+      enumerable: true,
+      get() { return url[key]; },
+      set(value) {
+        if (key === 'href') replace(value);
+        else url[key] = String(value);
+      },
+    });
+  }
+  location.assign = function assign(value) { replace(value); };
+  location.replace = function replaceLocation(value) { replace(value); };
+  location.reload = function reload() {};
+  location.toString = function toString() { return url.href; };
+  return location;
+}
+
+function createHistory(location) {
+  const entries = [location.href];
+  let index = 0;
+  return {
+    get length() { return entries.length; },
+    get state() { return null; },
+    pushState(state, unused, url) {
+      if (url !== undefined && url !== null) location.assign(url);
+      entries.splice(index + 1);
+      ArrayPrototypePush(entries, location.href);
+      index = entries.length - 1;
+    },
+    replaceState(state, unused, url) {
+      if (url !== undefined && url !== null) location.replace(url);
+      entries[index] = location.href;
+    },
+    back() {
+      if (index > 0) location.assign(entries[--index]);
+    },
+    forward() {
+      if (index + 1 < entries.length) location.assign(entries[++index]);
+    },
+    go(delta = 0) {
+      const next = index + Number(delta);
+      if (next >= 0 && next < entries.length) {
+        index = next;
+        location.assign(entries[index]);
+      }
+    },
+  };
+}
+
+function createNavigator(values) {
+  function Navigator() {
+    throw new TypeError('Illegal constructor');
+  }
+  for (const [key, value] of Object.entries(values)) {
+    ObjectDefineProperty(Navigator.prototype, key, {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      get() { return value; },
+    });
+  }
+  ObjectDefineProperty(Navigator.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'Navigator',
+  });
+  const navigator = ObjectCreate(Navigator.prototype);
+  return { Navigator, navigator };
+}
+
+function createStorage(seed) {
+  const values = new Map(Object.entries(seed ?? {}));
+  return {
+    get length() { return values.size; },
+    key(index) { return [...values.keys()][index] ?? null; },
+    getItem(key) { return values.get(String(key)) ?? null; },
+    setItem(key, value) { values.set(String(key), String(value)); },
+    removeItem(key) { values.delete(String(key)); },
+    clear() { values.clear(); },
+  };
+}
+
+function assertCustomPropertyName(name, protectedNames, targetName) {
+  if (protectedNames.has(name)) {
+    throw new TypeError(`${targetName}.${name} is a protected browser environment property`);
+  }
+}
+
+function applyCustomProperties(target, source, protectedNames, targetName) {
+  if (source === undefined) return;
+  assertObject(source, `${targetName}.properties`);
+  for (const key of ObjectKeys(source)) {
+    assertCustomPropertyName(key, protectedNames, targetName);
+    ObjectDefineProperty(target, key, {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      value: source[key],
+      writable: true,
+    });
+  }
+}
+
+function applyCustomDescriptors(target, source, protectedNames, targetName) {
+  if (source === undefined) return;
+  assertObject(source, `${targetName}.descriptors`);
+  for (const key of ObjectKeys(source)) {
+    assertCustomPropertyName(key, protectedNames, targetName);
+    const descriptor = source[key];
+    assertObject(descriptor, `${targetName}.descriptors.${key}`);
+    ObjectDefineProperty(target, key, descriptor);
+  }
+}
+
+function install(options) {
+  if (installed) throw new Error('A browser environment is already installed in this Realm');
+  assertObject(options, 'browser environment options');
+
+  const location = createLocation(getHref(options));
+  const document = new BrowserDocument(location);
+  const html = options.html ?? options.document?.html;
+  if (html !== undefined) {
+    if (typeof html !== 'string') throw new TypeError('html must be a string');
+    document.loadHTML(html);
+  }
+  if (options.cookies !== undefined) {
+    if (typeof options.cookies === 'string') document.cookie = options.cookies;
+    else {
+      assertObject(options.cookies, 'cookies');
+      for (const key of ObjectKeys(options.cookies)) document.cookie = `${key}=${options.cookies[key]}`;
+    }
+  }
+
+  const navigatorValues = {
+    ...kDefaultNavigator,
+    ...(options.navigator ?? {}),
+  };
+  if (!ArrayIsArray(navigatorValues.languages)) throw new TypeError('navigator.languages must be an array');
+  if (options.navigator?.language === undefined) navigatorValues.language = navigatorValues.languages[0] ?? kDefaultNavigator.language;
+  const { Navigator, navigator } = createNavigator(navigatorValues);
+  const screen = {
+    availHeight: 1040,
+    availLeft: 0,
+    availTop: 0,
+    availWidth: 1920,
+    colorDepth: 24,
+    height: 1080,
+    pixelDepth: 24,
+    width: 1920,
+    ...(options.screen ?? {}),
+  };
+  const history = createHistory(location);
+
+  const allDelegate = {
+    get(key) {
+      const elements = walkElements(document, () => true);
+      if (key === 'length') return elements.length;
+      if (typeof key === 'number') return elements[key];
+      if (typeof key === 'string' && /^\\d+$/.test(key)) return elements[Number(key)];
+      if (typeof key === 'string') return elements.find((element) =>
+        element.id === key || element.getAttribute('name') === key);
+      return undefined;
+    },
+    call(args) {
+      return this.get(args[0]);
+    },
+  };
+  ObjectDefineProperty(document, 'all', {
+    __proto__: null,
+    configurable: false,
+    enumerable: true,
+    value: createDocumentAll(allDelegate),
+    writable: false,
+  });
+
+  function Window() {
+    throw new TypeError('Illegal constructor');
+  }
+  ObjectSetPrototypeOf(Window.prototype, ObjectGetPrototypeOf(globalThis));
+  ObjectSetPrototypeOf(globalThis, Window.prototype);
+
+  ObjectDefineProperty(globalThis, 'window', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
+  ObjectDefineProperty(globalThis, 'self', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
+  ObjectDefineProperty(globalThis, 'top', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
+  ObjectDefineProperty(globalThis, 'parent', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
+  ObjectDefineProperty(globalThis, 'Window', { __proto__: null, configurable: true, enumerable: false, value: Window, writable: true });
+  ObjectDefineProperty(globalThis, 'Navigator', { __proto__: null, configurable: true, enumerable: false, value: Navigator, writable: true });
+  ObjectDefineProperty(globalThis, 'Event', { __proto__: null, configurable: true, enumerable: false, value: BrowserEvent, writable: true });
+  ObjectDefineProperty(globalThis, 'document', { __proto__: null, configurable: true, enumerable: true, value: document, writable: false });
+  ObjectDefineProperty(globalThis, 'navigator', { __proto__: null, configurable: true, enumerable: true, value: navigator, writable: false });
+  ObjectDefineProperty(globalThis, 'location', {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() { return location; },
+    set(value) { location.assign(value); },
+  });
+  ObjectDefineProperty(globalThis, 'history', { __proto__: null, configurable: true, enumerable: true, value: history, writable: false });
+  ObjectDefineProperty(globalThis, 'screen', { __proto__: null, configurable: true, enumerable: true, value: screen, writable: false });
+  ObjectDefineProperty(document, 'defaultView', { __proto__: null, configurable: false, enumerable: true, value: globalThis, writable: false });
+  createEventTarget(globalThis);
+
+  applyCustomProperties(globalThis, options.window?.properties, kProtectedWindowProperties, 'window');
+  applyCustomDescriptors(globalThis, options.window?.descriptors, kProtectedWindowProperties, 'window');
+  applyCustomProperties(document, options.document?.properties, kProtectedDocumentProperties, 'document');
+  applyCustomDescriptors(document, options.document?.descriptors, kProtectedDocumentProperties, 'document');
+
+  ObjectDefineProperty(globalThis, 'localStorage', { __proto__: null, configurable: true, enumerable: true, value: createStorage(options.localStorage), writable: false });
+  ObjectDefineProperty(globalThis, 'sessionStorage', { __proto__: null, configurable: true, enumerable: true, value: createStorage(options.sessionStorage), writable: false });
+
+  installed = true;
+  installedEnvironment = { window: globalThis, document, navigator, location };
+  return installedEnvironment;
+}
+
+function isInstalled() {
+  return installed;
+}
+
+function installFromProfile(path) {
+  if (typeof path !== 'string' || path.length === 0) return;
+  const { readFileSync } = require('fs');
+  let profile;
+  try {
+    profile = JSON.parse(readFileSync(path, 'utf8'));
+  } catch (error) {
+    throw new Error(`Unable to load --browser-env-profile ${path}: ${error.message}`);
+  }
+  return install(profile);
+}
+
+module.exports = {
+  install,
+  installFromProfile,
+  isInstalled,
+};
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index e379fbe34021..129749fd9b9c 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -121,6 +121,7 @@ function prepareExecution(options) {
   setupVfs();
   setupQuic();
   setupWebStorage();
+  setupBrowserEnvironment();
   removeWebWorkersIfDisabled();
   setupWebsocket();
   setupEventsource();
@@ -388,6 +389,13 @@ function setupNavigator() {
   defineReplaceableLazyAttribute(globalThis, 'internal/navigator', ['navigator'], false);
 }
 
+function setupBrowserEnvironment() {
+  const profile = getOptionValue('--browser-env-profile');
+  if (profile.length > 0) {
+    require('internal/browser_env').installFromProfile(profile);
+  }
+}
+
 function setupFFI() {
   if (!getOptionValue('--experimental-ffi')) {
     return;
diff --git a/node.gyp b/node.gyp
index 4f7a3d1ff634..8eb8b5ee8c3b 100644
--- a/node.gyp
+++ b/node.gyp
@@ -117,6 +117,7 @@
       'src/node_api.cc',
       'src/node_binding.cc',
       'src/node_blob.cc',
+      'src/node_browser_env.cc',
       'src/node_buffer.cc',
       'src/node_builtins.cc',
       'src/node_config.cc',
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 330c7f167105..72528498b9e6 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -41,6 +41,7 @@
   V(async_wrap)                                                                \
   V(blob)                                                                      \
   V(block_list)                                                                \
+  V(browser_env)                                                               \
   V(buffer)                                                                    \
   V(builtins)                                                                  \
   V(cares_wrap)                                                                \
diff --git a/src/node_browser_env.cc b/src/node_browser_env.cc
new file mode 100644
index 000000000000..9c242d55a693
--- /dev/null
+++ b/src/node_browser_env.cc
@@ -0,0 +1,148 @@
+#include "node_binding.h"
+#include "node_external_reference.h"
+#include "util-inl.h"
+
+namespace node::browser_env {
+
+using v8::Array;
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Intercepted;
+using v8::Integer;
+using v8::Isolate;
+using v8::Local;
+using v8::Name;
+using v8::Object;
+using v8::ObjectTemplate;
+using v8::PropertyCallbackInfo;
+using v8::String;
+using v8::Value;
+
+namespace {
+
+constexpr int kDelegateField = 0;
+
+Local<Object> GetDelegate(const PropertyCallbackInfo<Value>& info) {
+  return info.HolderV2()
+      ->GetInternalField(kDelegateField)
+      .As<Value>()
+      .As<Object>();
+}
+
+Local<Object> GetDelegate(const FunctionCallbackInfo<Value>& args) {
+  return args.This()->GetInternalField(kDelegateField).As<Value>().As<Object>();
+}
+
+template <typename CallbackInfo>
+bool CallDelegate(Local<Context> context,
+                  Local<Object> delegate,
+                  Local<Value> method_name,
+                  int argc,
+                  Local<Value>* argv,
+                  const CallbackInfo& info) {
+  Local<Value> method;
+  if (!delegate->Get(context, method_name).ToLocal(&method) ||
+      !method->IsFunction()) {
+    return false;
+  }
+
+  Local<Value> value;
+  if (method.As<Function>()->Call(context, delegate, argc, argv).ToLocal(&value)) {
+    info.GetReturnValue().Set(value);
+    return true;
+  }
+  return false;
+}
+
+Intercepted GetNamedProperty(Local<Name> name,
+                             const PropertyCallbackInfo<Value>& info) {
+  Isolate* isolate = info.GetIsolate();
+  Local<Value> argv[] = { name };
+  return CallDelegate(isolate->GetCurrentContext(),
+                      GetDelegate(info),
+                      FIXED_ONE_BYTE_STRING(isolate, "get"),
+                      1,
+                      argv,
+                      info) ?
+      Intercepted::kYes : Intercepted::kNo;
+}
+
+Intercepted GetIndexedProperty(uint32_t index,
+                               const PropertyCallbackInfo<Value>& info) {
+  Isolate* isolate = info.GetIsolate();
+  Local<Value> argv[] = { Integer::NewFromUnsigned(isolate, index) };
+  return CallDelegate(isolate->GetCurrentContext(),
+                      GetDelegate(info),
+                      FIXED_ONE_BYTE_STRING(isolate, "get"),
+                      1,
+                      argv,
+                      info) ?
+      Intercepted::kYes : Intercepted::kNo;
+}
+
+void CallAsFunction(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  Local<Context> context = isolate->GetCurrentContext();
+  Local<Array> values = Array::New(isolate, args.Length());
+  for (int i = 0; i < args.Length(); i++) {
+    values->Set(context, i, args[i]).Check();
+  }
+  Local<Value> argv[] = { values };
+  CallDelegate(context,
+               GetDelegate(args),
+               FIXED_ONE_BYTE_STRING(isolate, "call"),
+               1,
+               argv,
+               args);
+}
+
+}  // namespace
+
+void CreateDocumentAll(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  Local<Context> context = isolate->GetCurrentContext();
+  if (args.Length() != 1 || !args[0]->IsObject()) {
+    isolate->ThrowException(v8::Exception::TypeError(
+        FIXED_ONE_BYTE_STRING(isolate, "The document.all delegate must be an object")));
+    return;
+  }
+
+  Local<FunctionTemplate> function_template = FunctionTemplate::New(isolate);
+  Local<ObjectTemplate> instance_template = function_template->InstanceTemplate();
+  instance_template->SetInternalFieldCount(1);
+  instance_template->MarkAsUndetectable();
+  instance_template->SetCallAsFunctionHandler(CallAsFunction);
+  instance_template->SetHandler(v8::NamedPropertyHandlerConfiguration(
+      GetNamedProperty));
+  instance_template->SetHandler(v8::IndexedPropertyHandlerConfiguration(
+      GetIndexedProperty));
+
+  Local<Function> constructor;
+  if (!function_template->GetFunction(context).ToLocal(&constructor)) return;
+  Local<Object> result;
+  if (!constructor->NewInstance(context).ToLocal(&result)) return;
+  result->SetInternalField(kDelegateField, args[0]);
+  args.GetReturnValue().Set(result);
+}
+
+void Initialize(Local<Object> target,
+                Local<Value> unused,
+                Local<Context> context,
+                void* priv) {
+  SetMethod(context, target, "createDocumentAll", CreateDocumentAll);
+}
+
+void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  registry->Register(CreateDocumentAll);
+  registry->Register(GetNamedProperty);
+  registry->Register(GetIndexedProperty);
+  registry->Register(CallAsFunction);
+}
+
+}  // namespace node::browser_env
+
+NODE_BINDING_CONTEXT_AWARE_INTERNAL(browser_env, node::browser_env::Initialize)
+NODE_BINDING_EXTERNAL_REFERENCE(browser_env,
+                                node::browser_env::RegisterExternalReferences)
diff --git a/src/node_external_reference.h b/src/node_external_reference.h
index 1e987ce2d4f3..f348e74a40c5 100644
--- a/src/node_external_reference.h
+++ b/src/node_external_reference.h
@@ -66,6 +66,7 @@ class ExternalReferenceRegistry {
   V(async_wrap)                                                                \
   V(binding)                                                                   \
   V(blob)                                                                      \
+  V(browser_env)                                                               \
   V(buffer)                                                                    \
   V(builtins)                                                                  \
   V(cares_wrap)                                                                \
diff --git a/src/node_options.cc b/src/node_options.cc
index c743a20c31bf..8ebbc518ac33 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -652,6 +652,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             BOOL_FIELD(experimental_global_navigator),
             kAllowedInEnvvar,
             true);
+  AddOption("--browser-env-profile",
+            "install a browser-compatible environment from a JSON profile",
+            &EnvironmentOptions::browser_env_profile,
+            kAllowedInEnvvar);
   AddOption("--experimental-global-webcrypto", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-json-modules", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-loader",
diff --git a/src/node_options.h b/src/node_options.h
index 142963dc44a2..6b7747ecdcba 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -134,6 +134,7 @@ class EnvironmentOptions : public Options {
 #endif  // DEBUG
 
   std::string dns_result_order;
+  std::string browser_env_profile;
   std::string localstorage_file;
   std::string input_type;  // Value of --input-type
   std::string heap_snapshot_signal;
diff --git a/test/fixtures/browser-env/profile.json b/test/fixtures/browser-env/profile.json
new file mode 100644
index 000000000000..80068cdaf744
--- /dev/null
+++ b/test/fixtures/browser-env/profile.json
@@ -0,0 +1,19 @@
+{
+  "url": "https://profile.example.test/path?from=profile",
+  "html": "<html><head><title>Profile</title></head><body><main id=\"app\" class=\"ready\">ok</main></body></html>",
+  "navigator": {
+    "userAgent": "ProfileBrowser/1.0",
+    "platform": "ProfileOS",
+    "languages": ["zh-CN", "zh"]
+  },
+  "window": {
+    "properties": {
+      "profileEnabled": true
+    }
+  },
+  "document": {
+    "properties": {
+      "visibilityState": "hidden"
+    }
+  }
+}
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
new file mode 100644
index 000000000000..1835a321546f
--- /dev/null
+++ b/test/parallel/test-browser-env.js
@@ -0,0 +1,133 @@
+'use strict';
+
+require('../common');
+const assert = require('node:assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+const moduleScript = `
+  const assert = require('node:assert');
+  const env = require('node:browser-env');
+  let descriptorValue;
+  assert.strictEqual(env.isInstalled(), false);
+  assert.strictEqual(typeof globalThis.document, 'undefined');
+  const result = env.install({
+    url: 'https://example.test/start?x=1',
+    html: '<html><head><title>Initial</title></head><body><div id="app" class="ready">hello</div></body></html>',
+    navigator: {
+      userAgent: 'TestBrowser/1.0',
+      platform: 'TestOS',
+      languages: ['zh-CN', 'zh'],
+    },
+    window: {
+      properties: { customFlag: true },
+    },
+    document: {
+      properties: { visibilityState: 'hidden' },
+      descriptors: {
+        challengeValue: { enumerable: true, get() { return 'challenge'; } },
+        mutableValue: {
+          enumerable: true,
+          get() { return descriptorValue; },
+          set(value) { descriptorValue = value; },
+        },
+      },
+    },
+  });
+  assert.strictEqual(env.isInstalled(), true);
+  assert.strictEqual(result.window, globalThis);
+  assert.strictEqual(window, globalThis);
+  assert.strictEqual(self, window);
+  assert.strictEqual(top, window);
+  assert.strictEqual(parent, window);
+  assert.strictEqual(document.defaultView, window);
+  assert.strictEqual(location.host, 'example.test');
+  assert.strictEqual(document.title, 'Initial');
+  assert.strictEqual(document.querySelector('#app').textContent, 'hello');
+  assert.strictEqual(document.querySelector('.ready').id, 'app');
+  assert.strictEqual(document.querySelectorAll('body #app').length, 1);
+  assert.strictEqual(navigator.userAgent, 'TestBrowser/1.0');
+  assert.strictEqual(navigator.platform, 'TestOS');
+  assert.deepStrictEqual(navigator.languages, ['zh-CN', 'zh']);
+  assert.strictEqual(window.customFlag, true);
+  assert.strictEqual(document.visibilityState, 'hidden');
+  assert.strictEqual(document.challengeValue, 'challenge');
+  document.mutableValue = 'updated';
+  assert.strictEqual(document.mutableValue, 'updated');
+  const all = document.all;
+  assert.strictEqual(typeof all, 'undefined');
+  assert(all == null);
+  assert.strictEqual(Boolean(all), false);
+  assert.strictEqual(all.length, 5);
+  assert.strictEqual(all.app, document.querySelector('#app'));
+  assert.strictEqual(all(0), document.documentElement);
+  assert.strictEqual(all('app'), document.querySelector('#app'));
+  const later = document.createElement('section');
+  later.id = 'later';
+  document.body.appendChild(later);
+  assert.strictEqual(document.all.later, later);
+  assert.strictEqual(document.all.length, 6);
+  history.pushState(null, '', '/next');
+  assert.strictEqual(location.pathname, '/next');
+  document.cookie = 'token=value; Path=/';
+  assert.strictEqual(document.cookie, 'token=value');
+  localStorage.setItem('key', 'value');
+  assert.strictEqual(localStorage.getItem('key'), 'value');
+  assert.throws(() => env.install({ url: 'https://again.test/' }), /already installed/);
+`;
+
+spawnSyncAndAssert(process.execPath, ['-e', moduleScript], { status: 0, stderr: '' });
+
+spawnSyncAndAssert(process.execPath, [
+  '-e',
+  `
+    const assert = require('node:assert');
+    const { install } = require('node:browser-env');
+    assert.throws(
+      () => install({ url: 'https://example.test/', document: { properties: { all: null } } }),
+      /protected browser environment property/,
+    );
+    assert.throws(
+      () => install({ url: 'https://example.test/', document: { descriptors: { createElement: { value: null } } } }),
+      /protected browser environment property/,
+    );
+    assert.throws(
+      () => install({ url: 'https://example.test/', window: { properties: { location: null } } }),
+      /protected browser environment property/,
+    );
+  `,
+], { status: 0, stderr: '' });
+
+spawnSyncAndAssert(process.execPath, [
+  '--input-type=module',
+  '-e',
+  `
+    import assert from 'node:assert';
+    import { install, isInstalled } from 'node:browser-env';
+    assert.strictEqual(isInstalled(), false);
+    install({ url: 'https://esm.example.test/' });
+    assert.strictEqual(document.location.hostname, 'esm.example.test');
+  `,
+], { status: 0, stderr: '' });
+
+const profile = fixtures.path('browser-env', 'profile.json');
+spawnSyncAndAssert(process.execPath, [
+  `--browser-env-profile=${profile}`,
+  '-e',
+  `
+    const assert = require('node:assert');
+    const env = require('node:browser-env');
+    assert.strictEqual(env.isInstalled(), true);
+    assert.throws(() => env.install({ url: 'https://again.example.test/' }), /already installed/);
+    assert.strictEqual(location.hostname, 'profile.example.test');
+    assert.strictEqual(document.querySelector('#app').textContent, 'ok');
+    assert.strictEqual(document.visibilityState, 'hidden');
+    assert.strictEqual(window.profileEnabled, true);
+    assert.strictEqual(navigator.userAgent, 'ProfileBrowser/1.0');
+  `,
+], { status: 0, stderr: '' });
+
+spawnSyncAndAssert(process.execPath, [
+  '--browser-env-profile=/definitely/missing/profile.json',
+  '-e', '',
+], { status: 1, stderr: /Unable to load --browser-env-profile/ });

From 97a130437fc6acd4e242b060fd72b0239bbb6451 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 16:14:17 +0800
Subject: [PATCH 02/32] ci: test browser environment branch

---
 .github/workflows/browser-env.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/browser-env.yml

diff --git a/.github/workflows/browser-env.yml b/.github/workflows/browser-env.yml
new file mode 100644
index 000000000000..d82fd743d16b
--- /dev/null
+++ b/.github/workflows/browser-env.yml
@@ -0,0 +1,26 @@
+name: Browser environment
+
+on:
+  push:
+    branches:
+      - codex/browser-env
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-browser-environment:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Configure Debug build
+        run: ./configure --debug
+
+      - name: Build Node
+        run: make -j4 node
+
+      - name: Run browser environment regression test
+        run: out/Debug/node test/parallel/test-browser-env.js

From db87e692035500890dda437f9355bee7c5b06c74 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 16:28:51 +0800
Subject: [PATCH 03/32] ci: publish native platform releases

---
 .github/workflows/publish-native-release.yml | 157 +++++++++++++++++++
 1 file changed, 157 insertions(+)
 create mode 100644 .github/workflows/publish-native-release.yml

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
new file mode 100644
index 000000000000..b162cc2ac928
--- /dev/null
+++ b/.github/workflows/publish-native-release.yml
@@ -0,0 +1,157 @@
+name: Publish native release
+
+on:
+  push:
+    tags:
+      - 'mode_*_v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  mac-arm:
+    if: startsWith(github.ref_name, 'mode_mac_arm_v')
+    runs-on: macos-15
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - name: Verify Apple Silicon runner
+        run: test "$(uname -m)" = arm64
+      - name: Configure and build
+        run: |
+          ./configure
+          make -j3 node
+      - name: Run browser environment regression test
+        run: out/Release/node test/parallel/test-browser-env.js
+      - name: Package
+        run: |
+          mkdir -p "dist/$RELEASE_TAG"
+          cp out/Release/node "dist/$RELEASE_TAG/mode"
+          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
+      - name: Create or update release
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
+          else
+            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
+              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
+          fi
+
+  windows-x64:
+    if: startsWith(github.ref_name, 'mode_win_x64_v')
+    runs-on: windows-2022
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - name: Build x64 binary
+        shell: cmd
+        run: vcbuild.bat x64
+      - name: Run browser environment regression test
+        shell: pwsh
+        run: .\out\Release\node.exe test\parallel\test-browser-env.js
+      - name: Package
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Path "dist\$env:RELEASE_TAG" -Force | Out-Null
+          Copy-Item "out\Release\node.exe" "dist\$env:RELEASE_TAG\mode.exe"
+          Compress-Archive -Path "dist\$env:RELEASE_TAG" -DestinationPath "dist\$env:RELEASE_TAG.zip"
+      - name: Create or update release
+        shell: pwsh
+        run: |
+          if (gh release view "$env:RELEASE_TAG" 2>$null) {
+            gh release upload "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --clobber
+          } else {
+            gh release create "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --target "$env:GITHUB_SHA" --title "$env:RELEASE_TAG" --generate-notes
+          }
+
+  windows-x32:
+    if: startsWith(github.ref_name, 'mode_win_x32_v')
+    runs-on: windows-2022
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - name: Build x32 binary
+        shell: cmd
+        run: vcbuild.bat x86
+      - name: Run browser environment regression test
+        shell: pwsh
+        run: .\out\Release\node.exe test\parallel\test-browser-env.js
+      - name: Package
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Path "dist\$env:RELEASE_TAG" -Force | Out-Null
+          Copy-Item "out\Release\node.exe" "dist\$env:RELEASE_TAG\mode.exe"
+          Compress-Archive -Path "dist\$env:RELEASE_TAG" -DestinationPath "dist\$env:RELEASE_TAG.zip"
+      - name: Create or update release
+        shell: pwsh
+        run: |
+          if (gh release view "$env:RELEASE_TAG" 2>$null) {
+            gh release upload "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --clobber
+          } else {
+            gh release create "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --target "$env:GITHUB_SHA" --title "$env:RELEASE_TAG" --generate-notes
+          }
+
+  linux-x64:
+    if: startsWith(github.ref_name, 'mode_linux_x64_v')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - name: Configure and build
+        run: |
+          ./configure
+          make -j4 node
+      - name: Run browser environment regression test
+        run: out/Release/node test/parallel/test-browser-env.js
+      - name: Package
+        run: |
+          mkdir -p "dist/$RELEASE_TAG"
+          cp out/Release/node "dist/$RELEASE_TAG/mode"
+          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
+      - name: Create or update release
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
+          else
+            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
+              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
+          fi
+
+  linux-x32:
+    if: startsWith(github.ref_name, 'mode_linux_x32_v')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - name: Build and test native x32 binary
+        run: |
+          docker run --rm --platform linux/386 \
+            -e DEBIAN_FRONTEND=noninteractive \
+            -e RELEASE_TAG \
+            -v "$GITHUB_WORKSPACE:/src" -w /src \
+            i386/ubuntu:24.04 \
+            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure --dest-cpu=x86 && make -j2 node && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
+      - name: Create or update release
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
+          else
+            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
+              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
+          fi

From b06f2383318f2f49273841c5158e8d574d18b0d5 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 16:32:13 +0800
Subject: [PATCH 04/32] ci: trigger native release publishing

---
 .github/workflows/publish-native-release.yml | 24 ++++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index b162cc2ac928..601bdb47fdd9 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -2,8 +2,12 @@ name: Publish native release
 
 on:
   push:
+    branches:
+      - codex/browser-env
     tags:
       - 'mode_*_v*'
+    paths:
+      - '.github/workflows/publish-native-release.yml'
   workflow_dispatch:
 
 permissions:
@@ -11,11 +15,11 @@ permissions:
 
 jobs:
   mac-arm:
-    if: startsWith(github.ref_name, 'mode_mac_arm_v')
+    if: startsWith(github.ref_name, 'mode_mac_arm_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: macos-15
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_mac_arm_v') && github.ref_name || 'mode_mac_arm_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
@@ -42,11 +46,11 @@ jobs:
           fi
 
   windows-x64:
-    if: startsWith(github.ref_name, 'mode_win_x64_v')
+    if: startsWith(github.ref_name, 'mode_win_x64_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: windows-2022
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x64_v') && github.ref_name || 'mode_win_x64_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
@@ -72,11 +76,11 @@ jobs:
           }
 
   windows-x32:
-    if: startsWith(github.ref_name, 'mode_win_x32_v')
+    if: startsWith(github.ref_name, 'mode_win_x32_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: windows-2022
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x32_v') && github.ref_name || 'mode_win_x32_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
@@ -102,11 +106,11 @@ jobs:
           }
 
   linux-x64:
-    if: startsWith(github.ref_name, 'mode_linux_x64_v')
+    if: startsWith(github.ref_name, 'mode_linux_x64_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x64_v') && github.ref_name || 'mode_linux_x64_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
@@ -131,11 +135,11 @@ jobs:
           fi
 
   linux-x32:
-    if: startsWith(github.ref_name, 'mode_linux_x32_v')
+    if: startsWith(github.ref_name, 'mode_linux_x32_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x32_v') && github.ref_name || 'mode_linux_x32_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0

From d12b63d1551ccdb6d7a62b0e8b320bcffa40785f Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 16:58:35 +0800
Subject: [PATCH 05/32] ci: fix native release checkout pin

---
 .github/workflows/publish-native-release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 601bdb47fdd9..85f3b7088ce5 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -22,7 +22,7 @@ jobs:
       RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_mac_arm_v') && github.ref_name || 'mode_mac_arm_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Verify Apple Silicon runner
         run: test "$(uname -m)" = arm64
       - name: Configure and build
@@ -53,7 +53,7 @@ jobs:
       RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x64_v') && github.ref_name || 'mode_win_x64_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build x64 binary
         shell: cmd
         run: vcbuild.bat x64
@@ -83,7 +83,7 @@ jobs:
       RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x32_v') && github.ref_name || 'mode_win_x32_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build x32 binary
         shell: cmd
         run: vcbuild.bat x86
@@ -113,7 +113,7 @@ jobs:
       RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x64_v') && github.ref_name || 'mode_linux_x64_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Configure and build
         run: |
           ./configure
@@ -142,7 +142,7 @@ jobs:
       RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x32_v') && github.ref_name || 'mode_linux_x32_v22.0.0' }}
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@f3f76b2fcbf20c48e7005c2900bb5c4b45502a76 # v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build and test native x32 binary
         run: |
           docker run --rm --platform linux/386 \

From 364037b74023bb9f8a5ae7fd7d8daccd7cf60ce7 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 17:11:17 +0800
Subject: [PATCH 06/32] build: restore x32 release targets

---
 .github/workflows/publish-native-release.yml | 14 ++++++++------
 configure.py                                 |  8 ++++++--
 vcbuild.bat                                  |  5 -----
 3 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 85f3b7088ce5..ad24ddb5908b 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -145,12 +145,14 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build and test native x32 binary
         run: |
-          docker run --rm --platform linux/386 \
-            -e DEBIAN_FRONTEND=noninteractive \
-            -e RELEASE_TAG \
-            -v "$GITHUB_WORKSPACE:/src" -w /src \
-            i386/ubuntu:24.04 \
-            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure --dest-cpu=x86 && make -j2 node && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
+          sudo apt-get update
+          sudo apt-get install -y g++-multilib libc6-dev-i386
+          ./configure --dest-cpu=x86
+          make -j2 node
+          out/Release/node test/parallel/test-browser-env.js
+          mkdir -p "dist/$RELEASE_TAG"
+          cp out/Release/node "dist/$RELEASE_TAG/mode"
+          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
       - name: Create or update release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
diff --git a/configure.py b/configure.py
index 3f4f9984d5a8..9ff11ab6aca7 100755
--- a/configure.py
+++ b/configure.py
@@ -1890,8 +1890,12 @@ def configure_node(o):
   # triple for the target architecture.
   o['variables']['cargo_rust_target'] = ''
   if flavor == 'win':
-    o['variables']['cargo_rust_target'] = \
-      'aarch64-pc-windows-msvc' if target_arch == 'arm64' else 'x86_64-pc-windows-msvc'
+    if target_arch == 'arm64':
+      o['variables']['cargo_rust_target'] = 'aarch64-pc-windows-msvc'
+    elif target_arch == 'ia32':
+      o['variables']['cargo_rust_target'] = 'i686-pc-windows-msvc'
+    else:
+      o['variables']['cargo_rust_target'] = 'x86_64-pc-windows-msvc'
   # Always set the Rust target for x64 macOS in case we will be building
   # under Rosetta 2.
   if flavor == 'mac' and target_arch == 'x64':
diff --git a/vcbuild.bat b/vcbuild.bat
index 28494815df1d..b9a7e9e8b5b0 100644
--- a/vcbuild.bat
+++ b/vcbuild.bat
@@ -275,11 +275,6 @@ if defined cfg              set configure_flags=%configure_flags% --control-flow
 if defined v8temporal       set configure_flags=%configure_flags% --v8-enable-temporal-support
 if defined v8windbg         set configure_flags=%configure_flags% --enable-v8windbg
 
-if "%target_arch%"=="x86" (
-  echo "32-bit Windows builds are not supported anymore."
-  exit /b 1
-)
-
 if not exist "%~dp0deps\icu" goto no-depsicu
 if "%target%"=="Clean" echo deleting %~dp0deps\icu
 if "%target%"=="Clean" rmdir /S /Q %~dp0deps\icu

From 4e756d85f8508ff0aceab19499d7b83cd215fcd9 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 17:15:58 +0800
Subject: [PATCH 07/32] build: select Win32 solution for x32

---
 .github/workflows/publish-native-release.yml | 2 ++
 vcbuild.bat                                  | 1 +
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index ad24ddb5908b..b754c8c87e78 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -8,6 +8,8 @@ on:
       - 'mode_*_v*'
     paths:
       - '.github/workflows/publish-native-release.yml'
+      - configure.py
+      - vcbuild.bat
   workflow_dispatch:
 
 permissions:
diff --git a/vcbuild.bat b/vcbuild.bat
index b9a7e9e8b5b0..4799ffca014c 100644
--- a/vcbuild.bat
+++ b/vcbuild.bat
@@ -452,6 +452,7 @@ if defined nobuild goto :after-build
 set "msbcpu=/m:2"
 if "%NUMBER_OF_PROCESSORS%"=="1" set "msbcpu=/m:1"
 set "msbplatform=x64"
+if "%target_arch%"=="x86" set "msbplatform=Win32"
 if "%target_arch%"=="arm64" set "msbplatform=ARM64"
 if "%target%"=="Build" (
   if defined no_cctest set target=node

From 1805c482667d522b081801e233dc7fc30bf17943 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 17:29:23 +0800
Subject: [PATCH 08/32] ci: reduce x32 build log volume

---
 .github/workflows/publish-native-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index b754c8c87e78..70d1fb2acaf8 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -150,7 +150,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y g++-multilib libc6-dev-i386
           ./configure --dest-cpu=x86
-          make -j2 node
+          make -s -j2 node
           out/Release/node test/parallel/test-browser-env.js
           mkdir -p "dist/$RELEASE_TAG"
           cp out/Release/node "dist/$RELEASE_TAG/mode"

From 5c25cbc93c4600895161e124e7d51996612549ba Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 17:46:17 +0800
Subject: [PATCH 09/32] ci: silence x32 generated make output

---
 .github/workflows/publish-native-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 70d1fb2acaf8..f8061820cecf 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -150,7 +150,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y g++-multilib libc6-dev-i386
           ./configure --dest-cpu=x86
-          make -s -j2 node
+          make V=0 -j2 node
           out/Release/node test/parallel/test-browser-env.js
           mkdir -p "dist/$RELEASE_TAG"
           cp out/Release/node "dist/$RELEASE_TAG/mode"

From 1fcf24f042108ff291f0942c8ec3718cade2745c Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 17:56:51 +0800
Subject: [PATCH 10/32] ci: build Linux x32 in native container

---
 .github/workflows/publish-native-release.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index f8061820cecf..d0e9d254781d 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -147,14 +147,12 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build and test native x32 binary
         run: |
-          sudo apt-get update
-          sudo apt-get install -y g++-multilib libc6-dev-i386
-          ./configure --dest-cpu=x86
-          make V=0 -j2 node
-          out/Release/node test/parallel/test-browser-env.js
-          mkdir -p "dist/$RELEASE_TAG"
-          cp out/Release/node "dist/$RELEASE_TAG/mode"
-          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
+          docker run --rm --platform linux/386 \
+            -e DEBIAN_FRONTEND=noninteractive \
+            -e RELEASE_TAG \
+            -v "$GITHUB_WORKSPACE:/src" -w /src \
+            i386/debian:bookworm \
+            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
       - name: Create or update release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then

From 60cff08538c8578be51687ef7a4341d31ef76b9a Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 18:05:53 +0800
Subject: [PATCH 11/32] ci: install nasm for Linux x32

---
 .github/workflows/publish-native-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index d0e9d254781d..8a679353e2a7 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -152,7 +152,7 @@ jobs:
             -e RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/src" -w /src \
             i386/debian:bookworm \
-            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
+            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git nasm pkg-config python3 && ./configure && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
       - name: Create or update release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then

From 9bb4ea155d64056e3d613c72d3092b529b38efe1 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 18:26:47 +0800
Subject: [PATCH 12/32] ci: disable OpenSSL asm for Linux x32

---
 .github/workflows/publish-native-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 8a679353e2a7..d2e3cbb05c72 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -152,7 +152,7 @@ jobs:
             -e RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/src" -w /src \
             i386/debian:bookworm \
-            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git nasm pkg-config python3 && ./configure && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
+            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure --openssl-no-asm && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
       - name: Create or update release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then

From 9018ae75c662720b56d2e1163c09037869b2f8e4 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 19:47:26 +0800
Subject: [PATCH 13/32] ci: use shared zlib for Linux x32

---
 .github/workflows/publish-native-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index d2e3cbb05c72..67194e448df7 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -152,7 +152,7 @@ jobs:
             -e RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/src" -w /src \
             i386/debian:bookworm \
-            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 && ./configure --openssl-no-asm && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
+            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 zlib1g-dev && ./configure --openssl-no-asm --shared-zlib && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
       - name: Create or update release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then

From 3a37aceaadb6ebd1fddd9d0a7bcc7404ff643704 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 20:06:13 +0800
Subject: [PATCH 14/32] build: complete Windows x32 toolchain support

---
 .github/workflows/publish-native-release.yml | 3 +++
 deps/crates/cargo_build.py                   | 3 ++-
 tools/gyp/pylib/gyp/generator/msvs.py        | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 67194e448df7..db18a0afb24c 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -86,6 +86,9 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Install 32-bit Rust target
+        shell: pwsh
+        run: rustup target add i686-pc-windows-msvc
       - name: Build x32 binary
         shell: cmd
         run: vcbuild.bat x86
diff --git a/deps/crates/cargo_build.py b/deps/crates/cargo_build.py
index eaac737c77cc..258d473aed1d 100644
--- a/deps/crates/cargo_build.py
+++ b/deps/crates/cargo_build.py
@@ -22,7 +22,7 @@ def main():
         print('Usage: cargo_build.py <platform> <output_dir> [cargo_args...]', file=sys.stderr)
         sys.exit(1)
 
-    platform = sys.argv[1]     # x64 or arm64
+    platform = sys.argv[1]     # Win32, x64, or arm64
     output_dir = sys.argv[2]   # SHARED_INTERMEDIATE_DIR
     cargo_args = sys.argv[3:]
     build_profile = 'release' if '--release' in cargo_args else 'debug'
@@ -35,6 +35,7 @@ def main():
             cargo = cargo_home
 
     rust_target_map = {
+        'Win32': 'i686-pc-windows-msvc',
         'x64': 'x86_64-pc-windows-msvc',
         'arm64': 'aarch64-pc-windows-msvc',
     }
diff --git a/tools/gyp/pylib/gyp/generator/msvs.py b/tools/gyp/pylib/gyp/generator/msvs.py
index 42bee33d9b63..858bd230ab22 100644
--- a/tools/gyp/pylib/gyp/generator/msvs.py
+++ b/tools/gyp/pylib/gyp/generator/msvs.py
@@ -2896,7 +2896,7 @@ def _GenerateMSBuildRuleXmlFile(xml_path, msbuild_rules):
 def _GetConfigurationAndPlatform(name, settings, spec):
     configuration = name.rsplit("_", 1)[0]
     platform = settings.get("msvs_configuration_platform", "Win32")
-    if spec["toolset"] == "host" and platform == "arm64":
+    if spec["toolset"] == "host" and platform in ("Win32", "arm64"):
         platform = "x64"  # Host-only tools are always built for x64
     return (configuration, platform)
 

From f9214f6b565fe7ca135a18fac58723e3cd6c004a Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 7 Sep 2026 20:29:27 +0800
Subject: [PATCH 15/32] ci: publish only supported 64-bit targets

---
 .github/workflows/publish-native-release.yml | 63 +-------------------
 1 file changed, 3 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index db18a0afb24c..f9a979949ce7 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -5,7 +5,9 @@ on:
     branches:
       - codex/browser-env
     tags:
-      - 'mode_*_v*'
+      - 'mode_mac_arm_v*'
+      - 'mode_win_x64_v*'
+      - 'mode_linux_x64_v*'
     paths:
       - '.github/workflows/publish-native-release.yml'
       - configure.py
@@ -77,39 +79,6 @@ jobs:
             gh release create "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --target "$env:GITHUB_SHA" --title "$env:RELEASE_TAG" --generate-notes
           }
 
-  windows-x32:
-    if: startsWith(github.ref_name, 'mode_win_x32_v') || github.ref == 'refs/heads/codex/browser-env'
-    runs-on: windows-2022
-    timeout-minutes: 60
-    env:
-      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x32_v') && github.ref_name || 'mode_win_x32_v22.0.0' }}
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Install 32-bit Rust target
-        shell: pwsh
-        run: rustup target add i686-pc-windows-msvc
-      - name: Build x32 binary
-        shell: cmd
-        run: vcbuild.bat x86
-      - name: Run browser environment regression test
-        shell: pwsh
-        run: .\out\Release\node.exe test\parallel\test-browser-env.js
-      - name: Package
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Path "dist\$env:RELEASE_TAG" -Force | Out-Null
-          Copy-Item "out\Release\node.exe" "dist\$env:RELEASE_TAG\mode.exe"
-          Compress-Archive -Path "dist\$env:RELEASE_TAG" -DestinationPath "dist\$env:RELEASE_TAG.zip"
-      - name: Create or update release
-        shell: pwsh
-        run: |
-          if (gh release view "$env:RELEASE_TAG" 2>$null) {
-            gh release upload "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --clobber
-          } else {
-            gh release create "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --target "$env:GITHUB_SHA" --title "$env:RELEASE_TAG" --generate-notes
-          }
-
   linux-x64:
     if: startsWith(github.ref_name, 'mode_linux_x64_v') || github.ref == 'refs/heads/codex/browser-env'
     runs-on: ubuntu-24.04
@@ -138,29 +107,3 @@ jobs:
             gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
               --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
           fi
-
-  linux-x32:
-    if: startsWith(github.ref_name, 'mode_linux_x32_v') || github.ref == 'refs/heads/codex/browser-env'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x32_v') && github.ref_name || 'mode_linux_x32_v22.0.0' }}
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Build and test native x32 binary
-        run: |
-          docker run --rm --platform linux/386 \
-            -e DEBIAN_FRONTEND=noninteractive \
-            -e RELEASE_TAG \
-            -v "$GITHUB_WORKSPACE:/src" -w /src \
-            i386/debian:bookworm \
-            bash -lc 'apt-get update && apt-get install -y build-essential ca-certificates git pkg-config python3 zlib1g-dev && ./configure --openssl-no-asm --shared-zlib && if ! make -j2 node >/tmp/mode-build.log 2>&1; then tail -n 200 /tmp/mode-build.log; exit 1; fi && out/Release/node test/parallel/test-browser-env.js && mkdir -p "dist/$RELEASE_TAG" && cp out/Release/node "dist/$RELEASE_TAG/mode" && tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"'
-      - name: Create or update release
-        run: |
-          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
-            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
-          else
-            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
-              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
-          fi

From fb81e2cff07d5ea80bf3c7ba9aef77e5bcca6082 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Tue, 8 Sep 2026 09:40:30 +0800
Subject: [PATCH 16/32] fix: validate browser environment options before
 install

---
 lib/internal/browser_env.js       | 23 +++++++++++++++++++++--
 test/parallel/test-browser-env.js |  1 +
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index 18c4c49b5e69..a943c3f3d6c5 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -648,11 +648,18 @@ function assertCustomPropertyName(name, protectedNames, targetName) {
   }
 }
 
-function applyCustomProperties(target, source, protectedNames, targetName) {
+function validateCustomProperties(source, protectedNames, targetName) {
   if (source === undefined) return;
   assertObject(source, `${targetName}.properties`);
   for (const key of ObjectKeys(source)) {
     assertCustomPropertyName(key, protectedNames, targetName);
+  }
+}
+
+function applyCustomProperties(target, source, protectedNames, targetName) {
+  if (source === undefined) return;
+  validateCustomProperties(source, protectedNames, targetName);
+  for (const key of ObjectKeys(source)) {
     ObjectDefineProperty(target, key, {
       __proto__: null,
       configurable: true,
@@ -663,13 +670,21 @@ function applyCustomProperties(target, source, protectedNames, targetName) {
   }
 }
 
-function applyCustomDescriptors(target, source, protectedNames, targetName) {
+function validateCustomDescriptors(source, protectedNames, targetName) {
   if (source === undefined) return;
   assertObject(source, `${targetName}.descriptors`);
   for (const key of ObjectKeys(source)) {
     assertCustomPropertyName(key, protectedNames, targetName);
     const descriptor = source[key];
     assertObject(descriptor, `${targetName}.descriptors.${key}`);
+  }
+}
+
+function applyCustomDescriptors(target, source, protectedNames, targetName) {
+  if (source === undefined) return;
+  validateCustomDescriptors(source, protectedNames, targetName);
+  for (const key of ObjectKeys(source)) {
+    const descriptor = source[key];
     ObjectDefineProperty(target, key, descriptor);
   }
 }
@@ -677,6 +692,10 @@ function applyCustomDescriptors(target, source, protectedNames, targetName) {
 function install(options) {
   if (installed) throw new Error('A browser environment is already installed in this Realm');
   assertObject(options, 'browser environment options');
+  validateCustomProperties(options.window?.properties, kProtectedWindowProperties, 'window');
+  validateCustomDescriptors(options.window?.descriptors, kProtectedWindowProperties, 'window');
+  validateCustomProperties(options.document?.properties, kProtectedDocumentProperties, 'document');
+  validateCustomDescriptors(options.document?.descriptors, kProtectedDocumentProperties, 'document');
 
   const location = createLocation(getHref(options));
   const document = new BrowserDocument(location);
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index 1835a321546f..a8cd16fce2ca 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -87,6 +87,7 @@ spawnSyncAndAssert(process.execPath, [
       () => install({ url: 'https://example.test/', document: { properties: { all: null } } }),
       /protected browser environment property/,
     );
+    assert.strictEqual(typeof globalThis.document, 'undefined');
     assert.throws(
       () => install({ url: 'https://example.test/', document: { descriptors: { createElement: { value: null } } } }),
       /protected browser environment property/,

From e1c6b62da2900dea356cf267a92b0e37d8e660f7 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Tue, 8 Sep 2026 10:45:04 +0800
Subject: [PATCH 17/32] ci: allow full native builds to complete

---
 .github/workflows/publish-native-release.yml | 22 +++++++-------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index f9a979949ce7..837499c9d45e 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -2,16 +2,10 @@ name: Publish native release
 
 on:
   push:
-    branches:
-      - codex/browser-env
     tags:
       - 'mode_mac_arm_v*'
       - 'mode_win_x64_v*'
       - 'mode_linux_x64_v*'
-    paths:
-      - '.github/workflows/publish-native-release.yml'
-      - configure.py
-      - vcbuild.bat
   workflow_dispatch:
 
 permissions:
@@ -19,11 +13,11 @@ permissions:
 
 jobs:
   mac-arm:
-    if: startsWith(github.ref_name, 'mode_mac_arm_v') || github.ref == 'refs/heads/codex/browser-env'
+    if: startsWith(github.ref_name, 'mode_mac_arm_v')
     runs-on: macos-15
-    timeout-minutes: 60
+    timeout-minutes: 120
     env:
-      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_mac_arm_v') && github.ref_name || 'mode_mac_arm_v22.0.0' }}
+      RELEASE_TAG: ${{ github.ref_name }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -50,11 +44,11 @@ jobs:
           fi
 
   windows-x64:
-    if: startsWith(github.ref_name, 'mode_win_x64_v') || github.ref == 'refs/heads/codex/browser-env'
+    if: startsWith(github.ref_name, 'mode_win_x64_v')
     runs-on: windows-2022
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_win_x64_v') && github.ref_name || 'mode_win_x64_v22.0.0' }}
+      RELEASE_TAG: ${{ github.ref_name }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -80,11 +74,11 @@ jobs:
           }
 
   linux-x64:
-    if: startsWith(github.ref_name, 'mode_linux_x64_v') || github.ref == 'refs/heads/codex/browser-env'
+    if: startsWith(github.ref_name, 'mode_linux_x64_v')
     runs-on: ubuntu-24.04
-    timeout-minutes: 60
+    timeout-minutes: 120
     env:
-      RELEASE_TAG: ${{ startsWith(github.ref_name, 'mode_linux_x64_v') && github.ref_name || 'mode_linux_x64_v22.0.0' }}
+      RELEASE_TAG: ${{ github.ref_name }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

From 483c4ed2abbaa40750c36aee53b91884ecc9247e Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Thu, 10 Sep 2026 12:01:17 +0800
Subject: [PATCH 18/32] docs: document Mode browser environment

---
 README.md | 186 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 185 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e27d95f26f1f..8b2a547a9ce8 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,182 @@
-# Node.js
+# Mode
+
+Mode is a Node.js distribution with an optional lightweight browser-compatible
+runtime environment. It is intended for running JavaScript that expects common
+browser globals, without embedding Chromium or rendering a page.
+
+> The executable keeps the upstream Node.js version string. The `v22.0.0` part
+> of the release name is the Mode release label, not a claim that the embedded
+> Node.js runtime is upstream Node.js 22.
+
+## Mode browser environment
+
+### Install
+
+Download the archive that matches the host CPU from [GitHub Releases][mode-releases]:
+
+| Platform | Release | Archive |
+| --- | --- | --- |
+| macOS Apple Silicon (ARM64) | [mode_mac_arm_v22.0.0][mode-mac-release] | `mode_mac_arm_v22.0.0.tar.gz` |
+| Windows x64 | [mode_win_x64_v22.0.0][mode-windows-release] | `mode_win_x64_v22.0.0.zip` |
+| Linux x64 | [mode_linux_x64_v22.0.0][mode-linux-release] | `mode_linux_x64_v22.0.0.tar.gz` |
+
+On macOS or Linux, extract the archive and place `mode` on `PATH`:
+
+```bash
+tar -xzf mode_linux_x64_v22.0.0.tar.gz
+mkdir -p "$HOME/.local/bin"
+install -m 755 mode_linux_x64_v22.0.0/mode "$HOME/.local/bin/mode"
+export PATH="$HOME/.local/bin:$PATH"
+mode --version
+```
+
+Use `mode_mac_arm_v22.0.0` in the commands above for macOS Apple Silicon.
+Add the `export PATH=...` line to the shell startup file if the command should
+remain available in future terminals.
+
+On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
+directory to `PATH`:
+
+```powershell
+Expand-Archive .\mode_win_x64_v22.0.0.zip
+.\mode_win_x64_v22.0.0\mode.exe --version
+```
+
+Verify that the installed executable has the Mode extension:
+
+```bash
+mode -e "console.log(typeof require('node:browser-env').install)"
+```
+
+It must print `function`. If it reports `Cannot find module 'node:browser-env'`,
+the shell is running a different Node.js executable.
+
+### What it provides
+
+After installation, Mode can create these browser-like globals in the current
+JavaScript Realm:
+
+* `window`, `self`, and `globalThis` identity aliases.
+* `document` with a lightweight DOM tree, HTML parsing, element creation,
+  append/remove/update operations, and common query APIs such as
+  `getElementById()`, `querySelector()`, and `querySelectorAll()`.
+* Native-compatible `document.all`, including its special `typeof`, boolean,
+  loose-equality, indexed, and named-lookup behavior.
+* Virtual `location` and `history` objects.
+* Profiled `navigator` and `screen` values.
+* In-memory `document.cookie`, `localStorage`, and `sessionStorage`.
+* Basic DOM event-target methods: `addEventListener()`, `removeEventListener()`,
+  and `dispatchEvent()`.
+
+It deliberately does **not** provide a renderer, layout engine, Canvas, WebGL,
+real navigation, or automatic execution of `<script>` tags contained in the
+initial HTML. It is a script compatibility environment, not a headless browser.
+
+### Start an existing script with a JSON profile
+
+The `--browser-env-profile` option installs the environment before the target
+script is evaluated. Create `browser-profile.json`:
+
+```json
+{
+  "url": "https://example.com/page?a=1",
+  "html": "<html><body><div id=\"app\">hello</div></body></html>",
+  "navigator": {
+    "userAgent": "Mozilla/5.0",
+    "platform": "Win32",
+    "languages": ["zh-CN", "zh"]
+  },
+  "window": {
+    "properties": {
+      "customFlag": true
+    }
+  },
+  "document": {
+    "properties": {
+      "visibilityState": "hidden"
+    },
+    "descriptors": {
+      "challengeValue": {
+        "value": "custom-value",
+        "enumerable": true
+      }
+    }
+  }
+}
+```
+
+Then launch the target file:
+
+```bash
+mode --browser-env-profile=./browser-profile.json target.js
+```
+
+Inside `target.js`, the configured globals are immediately available:
+
+```js
+console.log(window === globalThis);                         // true
+console.log(location.href);                                 // configured URL
+console.log(navigator.platform);                            // Win32
+console.log(document.querySelector('#app').textContent);    // hello
+console.log(document.visibilityState);                       // hidden
+console.log(window.customFlag);                              // true
+console.log(document.all == null);                           // true
+console.log(typeof document.all);                            // undefined
+```
+
+The profile is JSON, so descriptors in it may only use JSON-representable
+values. `url` is required. `location.href` is accepted as an alternative URL
+field for profile compatibility.
+
+### Install from JavaScript
+
+Use `node:browser-env` when getters, setters, functions, or values computed at
+startup are needed. Install first, then load the code that reads browser
+globals:
+
+```js
+// boot.js
+const { install, isInstalled } = require('node:browser-env');
+
+console.log(isInstalled()); // false
+
+install({
+  url: 'https://example.com/',
+  html: '<div id="app"></div>',
+  navigator: { platform: 'Win32', languages: ['zh-CN', 'zh'] },
+  window: {
+    properties: { customFlag: true },
+  },
+  document: {
+    properties: { visibilityState: 'hidden' },
+    descriptors: {
+      challengeValue: {
+        enumerable: true,
+        get() {
+          return 'dynamic-value';
+        },
+      },
+    },
+  },
+});
+
+require('./target.js');
+```
+
+Run it with:
+
+```bash
+mode boot.js
+```
+
+`install()` returns `{ window, document, navigator, location }` and can only
+be called once per Realm. It must not be combined with
+`--browser-env-profile` in the same Realm. Custom `window` and `document`
+properties cannot replace protected runtime members such as `document.all`,
+DOM query/construction methods, `location`, `navigator`, or the `window` /
+`globalThis` identity aliases.
+
+For the complete API reference, see [Browser environment API][browser-env-api].
 
 Node.js is an open-source, cross-platform JavaScript runtime environment.
 
@@ -17,6 +195,7 @@ that discourage, exhaust, or otherwise negatively affect other participants.
 
 ## Table of contents
 
+* [Mode browser environment](#mode-browser-environment)
 * [Support](#support)
 * [Release types](#release-types)
   * [Download](#download)
@@ -905,6 +1084,11 @@ additions comply with the project’s license guidelines.
 
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
+[browser-env-api]: doc/api/browser-env.md
+[mode-linux-release]: https://github.com/wen2go/mode/releases/tag/mode_linux_x64_v22.0.0
+[mode-mac-release]: https://github.com/wen2go/mode/releases/tag/mode_mac_arm_v22.0.0
+[mode-releases]: https://github.com/wen2go/mode/releases
+[mode-windows-release]: https://github.com/wen2go/mode/releases/tag/mode_win_x64_v22.0.0
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/
 [Strategic initiatives]: doc/contributing/strategic-initiatives.md

From a206fee49f7ba2fc14e2f885e5d79147e84385b3 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Thu, 10 Sep 2026 16:45:51 +0800
Subject: [PATCH 19/32] fix: publish unified Mode browser environment release

---
 .github/workflows/publish-native-release.yml | 134 +++++---
 README.md                                    |  28 +-
 lib/internal/browser_env.js                  |   4 +-
 rs_mode_server/.gitignore                    |   1 +
 rs_mode_server/README.md                     |  67 ++++
 rs_mode_server/server.js                     | 316 +++++++++++++++++++
 rs_mode_server/test/fixtures/challenge.html  |  21 ++
 rs_mode_server/test/fixtures/challenge.js    |   8 +
 rs_mode_server/test/server.test.js           | 169 ++++++++++
 test/parallel/test-browser-env.js            |   3 +
 10 files changed, 687 insertions(+), 64 deletions(-)
 create mode 100644 rs_mode_server/.gitignore
 create mode 100644 rs_mode_server/README.md
 create mode 100644 rs_mode_server/server.js
 create mode 100644 rs_mode_server/test/fixtures/challenge.html
 create mode 100644 rs_mode_server/test/fixtures/challenge.js
 create mode 100644 rs_mode_server/test/server.test.js

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 837499c9d45e..83b2928dd653 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -3,22 +3,41 @@ name: Publish native release
 on:
   push:
     tags:
-      - 'mode_mac_arm_v*'
-      - 'mode_win_x64_v*'
-      - 'mode_linux_x64_v*'
+      - 'mode_20*_v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Release tag, for example mode_20260910_v22.0.1'
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 jobs:
-  mac-arm:
-    if: startsWith(github.ref_name, 'mode_mac_arm_v')
+  validate-release-tag:
+    runs-on: ubuntu-24.04
+    outputs:
+      release_tag: ${{ steps.release.outputs.tag }}
+      release_suffix: ${{ steps.release.outputs.suffix }}
+    steps:
+      - id: release
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^mode_[0-9]{8}_v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Release tag must use mode_YYYYmmdd_vX.Y.Z: $RELEASE_TAG" >&2
+            exit 1
+          fi
+          echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+          echo "suffix=${RELEASE_TAG#mode_}" >> "$GITHUB_OUTPUT"
+
+  mac-arm64:
+    needs: validate-release-tag
     runs-on: macos-15
     timeout-minutes: 120
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
-      GH_TOKEN: ${{ github.token }}
+      RELEASE_SUFFIX: ${{ needs.validate-release-tag.outputs.release_suffix }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Verify Apple Silicon runner
@@ -27,77 +46,98 @@ jobs:
         run: |
           ./configure
           make -j3 node
-      - name: Run browser environment regression test
-        run: out/Release/node test/parallel/test-browser-env.js
-      - name: Package
+      - name: Run Mode regressions
         run: |
-          mkdir -p "dist/$RELEASE_TAG"
-          cp out/Release/node "dist/$RELEASE_TAG/mode"
-          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
-      - name: Create or update release
+          out/Release/node test/parallel/test-browser-env.js
+          out/Release/node --test rs_mode_server/test/server.test.js
+      - name: Package
         run: |
-          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
-            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
-          else
-            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
-              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
-          fi
+          package="mode_mac_arm_${RELEASE_SUFFIX}"
+          mkdir -p "dist/$package"
+          cp out/Release/node "dist/$package/mode"
+          tar -czf "dist/$package.tar.gz" -C dist "$package"
+      - name: Stage release asset
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mode-mac-arm
+          path: dist/*.tar.gz
+          if-no-files-found: error
 
   windows-x64:
-    if: startsWith(github.ref_name, 'mode_win_x64_v')
+    needs: validate-release-tag
     runs-on: windows-2022
     timeout-minutes: 60
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
-      GH_TOKEN: ${{ github.token }}
+      RELEASE_SUFFIX: ${{ needs.validate-release-tag.outputs.release_suffix }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build x64 binary
         shell: cmd
         run: vcbuild.bat x64
-      - name: Run browser environment regression test
-        shell: pwsh
-        run: .\out\Release\node.exe test\parallel\test-browser-env.js
-      - name: Package
+      - name: Run Mode regressions
         shell: pwsh
         run: |
-          New-Item -ItemType Directory -Path "dist\$env:RELEASE_TAG" -Force | Out-Null
-          Copy-Item "out\Release\node.exe" "dist\$env:RELEASE_TAG\mode.exe"
-          Compress-Archive -Path "dist\$env:RELEASE_TAG" -DestinationPath "dist\$env:RELEASE_TAG.zip"
-      - name: Create or update release
+          .\out\Release\node.exe test\parallel\test-browser-env.js
+          .\out\Release\node.exe --test rs_mode_server/test/server.test.js
+      - name: Package
         shell: pwsh
         run: |
-          if (gh release view "$env:RELEASE_TAG" 2>$null) {
-            gh release upload "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --clobber
-          } else {
-            gh release create "$env:RELEASE_TAG" "dist\$env:RELEASE_TAG.zip" --target "$env:GITHUB_SHA" --title "$env:RELEASE_TAG" --generate-notes
-          }
+          $package = "mode_win_x64_$env:RELEASE_SUFFIX"
+          New-Item -ItemType Directory -Path "dist\$package" -Force | Out-Null
+          Copy-Item "out\Release\node.exe" "dist\$package\mode.exe"
+          Compress-Archive -Path "dist\$package" -DestinationPath "dist\$package.zip"
+      - name: Stage release asset
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mode-windows-x64
+          path: dist/*.zip
+          if-no-files-found: error
 
   linux-x64:
-    if: startsWith(github.ref_name, 'mode_linux_x64_v')
+    needs: validate-release-tag
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     env:
-      RELEASE_TAG: ${{ github.ref_name }}
-      GH_TOKEN: ${{ github.token }}
+      RELEASE_SUFFIX: ${{ needs.validate-release-tag.outputs.release_suffix }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Configure and build
         run: |
           ./configure
           make -j4 node
-      - name: Run browser environment regression test
-        run: out/Release/node test/parallel/test-browser-env.js
+      - name: Run Mode regressions
+        run: |
+          out/Release/node test/parallel/test-browser-env.js
+          out/Release/node --test rs_mode_server/test/server.test.js
       - name: Package
         run: |
-          mkdir -p "dist/$RELEASE_TAG"
-          cp out/Release/node "dist/$RELEASE_TAG/mode"
-          tar -czf "dist/$RELEASE_TAG.tar.gz" -C dist "$RELEASE_TAG"
-      - name: Create or update release
+          package="mode_linux_x64_${RELEASE_SUFFIX}"
+          mkdir -p "dist/$package"
+          cp out/Release/node "dist/$package/mode"
+          tar -czf "dist/$package.tar.gz" -C dist "$package"
+      - name: Stage release asset
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mode-linux-x64
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  publish-release:
+    needs: [validate-release-tag, mac-arm64, windows-x64, linux-x64]
+    runs-on: ubuntu-24.04
+    env:
+      RELEASE_TAG: ${{ needs.validate-release-tag.outputs.release_tag }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Create or update the unified release
         run: |
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
-            gh release upload "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" --clobber
+            gh release upload "$RELEASE_TAG" dist/* --clobber
           else
-            gh release create "$RELEASE_TAG" "dist/$RELEASE_TAG.tar.gz" \
+            gh release create "$RELEASE_TAG" dist/* \
               --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
           fi
diff --git a/README.md b/README.md
index 8b2a547a9ce8..f7aba96163c2 100644
--- a/README.md
+++ b/README.md
@@ -4,9 +4,9 @@ Mode is a Node.js distribution with an optional lightweight browser-compatible
 runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
-> The executable keeps the upstream Node.js version string. The `v22.0.0` part
-> of the release name is the Mode release label, not a claim that the embedded
-> Node.js runtime is upstream Node.js 22.
+> The executable keeps the upstream Node.js version string. Mode releases use
+> one date-stamped tag, such as `mode_20260910_v22.0.1`; the `v22.0.1` part is
+> the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
 
@@ -14,23 +14,23 @@ browser globals, without embedding Chromium or rendering a page.
 
 Download the archive that matches the host CPU from [GitHub Releases][mode-releases]:
 
-| Platform | Release | Archive |
+| Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_mac_arm_v22.0.0][mode-mac-release] | `mode_mac_arm_v22.0.0.tar.gz` |
-| Windows x64 | [mode_win_x64_v22.0.0][mode-windows-release] | `mode_win_x64_v22.0.0.zip` |
-| Linux x64 | [mode_linux_x64_v22.0.0][mode-linux-release] | `mode_linux_x64_v22.0.0.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.1][mode-release] | `mode_mac_arm_20260910_v22.0.1.tar.gz` |
+| Windows x64 | [mode_20260910_v22.0.1][mode-release] | `mode_win_x64_20260910_v22.0.1.zip` |
+| Linux x64 | [mode_20260910_v22.0.1][mode-release] | `mode_linux_x64_20260910_v22.0.1.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_v22.0.0.tar.gz
+tar -xzf mode_linux_x64_20260910_v22.0.1.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_v22.0.0/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260910_v22.0.1/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_v22.0.0` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260910_v22.0.1` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_v22.0.0.zip
-.\mode_win_x64_v22.0.0\mode.exe --version
+Expand-Archive .\mode_win_x64_20260910_v22.0.1.zip
+.\mode_win_x64_20260910_v22.0.1\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -1085,10 +1085,8 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-linux-release]: https://github.com/wen2go/mode/releases/tag/mode_linux_x64_v22.0.0
-[mode-mac-release]: https://github.com/wen2go/mode/releases/tag/mode_mac_arm_v22.0.0
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.1
 [mode-releases]: https://github.com/wen2go/mode/releases
-[mode-windows-release]: https://github.com/wen2go/mode/releases/tag/mode_win_x64_v22.0.0
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/
 [Strategic initiatives]: doc/contributing/strategic-initiatives.md
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index a943c3f3d6c5..9017179b79ba 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -462,14 +462,14 @@ function createLiveCollection(root, predicate) {
       if (property === 'namedItem') return (name) => current().find((element) =>
         element.id === name || element.getAttribute('name') === name) ?? null;
       if (property === Symbol.iterator) return function* iterator() { yield* current(); };
-      if (typeof property === 'string' && /^\\d+$/.test(property)) return current()[Number(property)];
+      if (typeof property === 'string' && /^\d+$/.test(property)) return current()[Number(property)];
       return target[property];
     },
     ownKeys() {
       return [...current().keys()].map(String).concat('length');
     },
     getOwnPropertyDescriptor(target, property) {
-      if (property === 'length' || (typeof property === 'string' && /^\\d+$/.test(property))) {
+      if (property === 'length' || (typeof property === 'string' && /^\d+$/.test(property))) {
         return { configurable: true, enumerable: true };
       }
       return ObjectGetOwnPropertyDescriptor(target, property);
diff --git a/rs_mode_server/.gitignore b/rs_mode_server/.gitignore
new file mode 100644
index 000000000000..833200818870
--- /dev/null
+++ b/rs_mode_server/.gitignore
@@ -0,0 +1 @@
+out_js/
diff --git a/rs_mode_server/README.md b/rs_mode_server/README.md
new file mode 100644
index 000000000000..ec1b03898690
--- /dev/null
+++ b/rs_mode_server/README.md
@@ -0,0 +1,67 @@
+# Mode rs_env compatibility server
+
+`rs_mode_server` keeps the existing local `POST /rs_env` protocol while running
+challenge JavaScript in Mode's native `node:browser-env` runtime. It does not
+read, append, or execute `env.js`.
+
+## Start
+
+From the Mode source checkout, start it with the locally built binary:
+
+```sh
+out/Release/node rs_mode_server/server.js
+```
+
+After installing a Mode release, use the release command instead:
+
+```sh
+mode rs_mode_server/server.js
+```
+
+It listens on `127.0.0.1:8080` by default. Set `RS_MODE_HOST` or `RS_JS_PORT`
+before launching to change the bind address or port.
+
+## API
+
+`GET /health` returns:
+
+```json
+{"status":"ok"}
+```
+
+`POST /rs_env` accepts the same body used by the previous Python client:
+
+```json
+{
+  "html": "<html>...</html>",
+  "url": "https://example.test/page",
+  "ua": "Mozilla/5.0 ..."
+}
+```
+
+On success, it returns the Cookie object set by the challenge. Invalid requests,
+missing challenge markers or scripts, external-script errors, unsupported browser
+interfaces, and worker timeouts return HTTP 500 with `{}`.
+
+Each request executes in its own Worker. The Worker installs a fresh Mode browser
+environment with the supplied URL, original HTML, dynamic user agent, DOM,
+`document.all`, location/history, cookies, Storage, event interfaces, base
+navigator values, screen dimensions, window dimensions, and hidden document
+visibility. External `r="m"` scripts are cached under `out_js/`; the cache is
+ignored by Git.
+
+## Strict compatibility boundary
+
+This service intentionally provides only the Mode browser environment. It does
+not emulate the old `env.js` fallback surface, including fake XHR/fetch responses,
+Canvas/WebGL, `chrome`, `mimeTypes`, battery APIs, form hacks, or native
+`toString` spoofing. A challenge that depends on one of these missing APIs fails
+with the normal HTTP 500 response instead of silently mixing environments.
+
+## Tests
+
+The test suite uses only local, sanitized HTML and external-JS fixtures:
+
+```sh
+out/Release/node --test rs_mode_server/test/server.test.js
+```
diff --git a/rs_mode_server/server.js b/rs_mode_server/server.js
new file mode 100644
index 000000000000..cb1b6f896e93
--- /dev/null
+++ b/rs_mode_server/server.js
@@ -0,0 +1,316 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const http = require('node:http');
+const https = require('node:https');
+const path = require('node:path');
+const {
+  Worker,
+  isMainThread,
+  parentPort,
+  workerData,
+} = require('node:worker_threads');
+
+const DEFAULT_HOST = process.env.RS_MODE_HOST || '127.0.0.1';
+const DEFAULT_PORT = Number(process.env.RS_JS_PORT || 8080);
+const DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024;
+const DEFAULT_REQUEST_TIMEOUT = 20_000;
+const DEFAULT_WORKER_TIMEOUT = 40_000;
+const DEFAULT_OUT_JS_DIR = path.join(__dirname, 'out_js');
+
+function parseAttributes(text) {
+  const attributes = {};
+  const matcher = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+  let match;
+  while ((match = matcher.exec(text)) !== null) {
+    attributes[match[1].toLowerCase()] = match[2] ?? match[3] ?? match[4] ?? '';
+  }
+  return attributes;
+}
+
+function parseChallengeHtml(html) {
+  const metas = Array.from(html.matchAll(/<meta\b([^>]*)>/gi), (match) => ({
+    attributes: parseAttributes(match[1]),
+  }));
+  const scripts = Array.from(html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi), (match) => ({
+    attributes: parseAttributes(match[1]),
+    content: match[2],
+  }));
+
+  const meta = metas.find((tag) => tag.attributes.r === 'm');
+  if (!meta || !meta.attributes.id || !meta.attributes.content) {
+    throw new Error('missing r=m meta challenge marker');
+  }
+
+  const inline = scripts.find(
+    (tag) => tag.attributes.r === 'm' &&
+      !tag.attributes.src &&
+      tag.content.includes('$_'),
+  );
+  if (!inline) {
+    throw new Error('missing inline r=m challenge script');
+  }
+
+  const external = scripts.find((tag) => tag.attributes.r === 'm' && tag.attributes.src);
+  if (!external) {
+    throw new Error('missing external r=m challenge script');
+  }
+
+  return {
+    inlineCode: inline.content,
+    outJsPath: external.attributes.src,
+  };
+}
+
+function fetchText(targetUrl, ua, referer, requestTimeout, redirectCount = 0) {
+  if (redirectCount > 5) {
+    return Promise.reject(new Error('too many external script redirects'));
+  }
+
+  const client = targetUrl.startsWith('https:') ? https : http;
+  return new Promise((resolve, reject) => {
+    const options = {
+      headers: {
+        'User-Agent': ua,
+        Referer: referer,
+      },
+      timeout: requestTimeout,
+    };
+    if (client === https) {
+      options.rejectUnauthorized = false;
+      options.secureOptions = crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT;
+    }
+
+    const request = client.get(targetUrl, options, (response) => {
+      const { statusCode = 0, headers } = response;
+      if (statusCode >= 300 && statusCode < 400 && headers.location) {
+        response.resume();
+        resolve(fetchText(new URL(headers.location, targetUrl).href, ua, referer, requestTimeout, redirectCount + 1));
+        return;
+      }
+      if (statusCode < 200 || statusCode >= 300) {
+        response.resume();
+        reject(new Error(`external script request failed with status ${statusCode}`));
+        return;
+      }
+
+      let text = '';
+      response.setEncoding('utf8');
+      response.on('data', (chunk) => { text += chunk; });
+      response.on('end', () => resolve(text));
+      response.on('error', reject);
+    });
+    request.on('timeout', () => request.destroy(new Error('external script request timed out')));
+    request.on('error', reject);
+  });
+}
+
+async function loadOutJs(outJsUrl, ua, referer, { outJsDir, requestTimeout }) {
+  const parsedUrl = new URL(outJsUrl);
+  const fileName = path.basename(parsedUrl.pathname) || 'challenge.js';
+  const cachePath = path.join(outJsDir, fileName);
+
+  try {
+    return {
+      content: await fs.promises.readFile(cachePath, 'utf8'),
+      fileName,
+      source: 'cache',
+    };
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+
+  const content = await fetchText(outJsUrl, ua, referer, requestTimeout);
+  await fs.promises.mkdir(outJsDir, { recursive: true });
+  const temporaryPath = `${cachePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  await fs.promises.writeFile(temporaryPath, content, 'utf8');
+  await fs.promises.rename(temporaryPath, cachePath);
+  return { content, fileName, source: 'network' };
+}
+
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  for (const part of cookieHeader.split(';')) {
+    const separator = part.indexOf('=');
+    if (separator <= 0) continue;
+    const name = part.slice(0, separator).trim();
+    const value = part.slice(separator + 1).trim();
+    if (name) cookies[name] = value;
+  }
+  return cookies;
+}
+
+function installBrowserEnvironment({ html, url, ua }) {
+  const { install } = require('node:browser-env');
+  install({
+    url,
+    html,
+    navigator: {
+      userAgent: ua,
+      platform: 'Win32',
+      language: 'zh-CN',
+      languages: ['zh-CN', 'zh'],
+      vendor: 'Google Inc.',
+      webdriver: false,
+      maxTouchPoints: 0,
+      appVersion: ua.replace(/^Mozilla\//, ''),
+      appName: 'Netscape',
+    },
+    screen: {
+      availHeight: 1040,
+      availLeft: 0,
+      availTop: 0,
+      availWidth: 1920,
+      colorDepth: 24,
+      height: 1080,
+      pixelDepth: 24,
+      width: 1920,
+    },
+    window: {
+      properties: {
+        innerHeight: 1080,
+        innerWidth: 1920,
+        outerHeight: 1080,
+        outerWidth: 1920,
+        screenLeft: 0,
+        screenTop: 0,
+        screenX: 0,
+        screenY: 0,
+      },
+    },
+    document: {
+      properties: {
+        visibilityState: 'hidden',
+      },
+    },
+  });
+}
+
+async function generateCookie(payload, options) {
+  const { html, url, ua } = payload;
+  if (typeof html !== 'string' || !html || typeof url !== 'string' || !url || typeof ua !== 'string' || !ua) {
+    throw new Error('html, url, and ua must be non-empty strings');
+  }
+
+  const challenge = parseChallengeHtml(html);
+  const outJsUrl = new URL(challenge.outJsPath, url).href;
+  const outJs = await loadOutJs(outJsUrl, ua, url, options);
+
+  installBrowserEnvironment({ html, url, ua });
+  const executeChallenge = new Function('require', `${challenge.inlineCode}\n${outJs.content}`);
+  const result = executeChallenge(require);
+  if (result && typeof result.then === 'function') await result;
+
+  return {
+    cookies: parseCookies(document.cookie),
+    outJsFile: outJs.fileName,
+    outJsSource: outJs.source,
+  };
+}
+
+function runWorker(payload, options) {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(__filename, { workerData: { payload, options } });
+    let settled = false;
+    const settle = (callback, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      callback(value);
+    };
+    const timer = setTimeout(() => {
+      settle(reject, new Error('challenge worker timed out'));
+      worker.terminate().catch(() => {});
+    }, options.workerTimeout);
+
+    worker.once('message', (message) => {
+      if (message.ok) settle(resolve, message.value);
+      else settle(reject, new Error(message.error));
+    });
+    worker.once('error', (error) => settle(reject, error));
+    worker.once('exit', (code) => {
+      if (!settled && code !== 0) settle(reject, new Error(`challenge worker exited with code ${code}`));
+    });
+  });
+}
+
+function sendJson(response, statusCode, body) {
+  response.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
+  response.end(JSON.stringify(body));
+}
+
+function readJson(request, maxBodySize) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    let body = '';
+    let rejected = false;
+    request.setEncoding('utf8');
+    request.on('data', (chunk) => {
+      if (rejected) return;
+      size += Buffer.byteLength(chunk);
+      if (size > maxBodySize) {
+        rejected = true;
+        reject(new Error('request body exceeds 10 MB limit'));
+        return;
+      }
+      body += chunk;
+    });
+    request.on('end', () => {
+      if (rejected) return;
+      try {
+        resolve(JSON.parse(body));
+      } catch {
+        reject(new Error('invalid JSON body'));
+      }
+    });
+    request.on('error', reject);
+  });
+}
+
+function createRsServer(overrides = {}) {
+  const options = {
+    maxBodySize: overrides.maxBodySize ?? DEFAULT_MAX_BODY_SIZE,
+    outJsDir: overrides.outJsDir ?? DEFAULT_OUT_JS_DIR,
+    requestTimeout: overrides.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT,
+    workerTimeout: overrides.workerTimeout ?? DEFAULT_WORKER_TIMEOUT,
+  };
+
+  return http.createServer(async (request, response) => {
+    if (request.method === 'GET' && request.url === '/health') {
+      sendJson(response, 200, { status: 'ok' });
+      return;
+    }
+    if (request.method !== 'POST' || request.url !== '/rs_env') {
+      sendJson(response, 404, {});
+      return;
+    }
+
+    try {
+      const payload = await readJson(request, options.maxBodySize);
+      const result = await runWorker(payload, options);
+      console.log(`[out_js:${result.outJsSource}] ${result.outJsFile}`);
+      sendJson(response, 200, result.cookies);
+    } catch (error) {
+      console.error(`[rs_mode_server] ${error.message}`);
+      sendJson(response, 500, {});
+    }
+  });
+}
+
+function startServer() {
+  const server = createRsServer();
+  server.listen(DEFAULT_PORT, DEFAULT_HOST, () => {
+    console.log(`Mode rs_env server listening on http://${DEFAULT_HOST}:${DEFAULT_PORT}`);
+  });
+  return server;
+}
+
+if (isMainThread) {
+  module.exports = { createRsServer, parseChallengeHtml, startServer };
+  if (require.main === module) startServer();
+} else {
+  generateCookie(workerData.payload, workerData.options)
+    .then((value) => parentPort.postMessage({ ok: true, value }))
+    .catch((error) => parentPort.postMessage({ ok: false, error: error.message }));
+}
diff --git a/rs_mode_server/test/fixtures/challenge.html b/rs_mode_server/test/fixtures/challenge.html
new file mode 100644
index 000000000000..444d02abf45e
--- /dev/null
+++ b/rs_mode_server/test/fixtures/challenge.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<head>
+  <meta r="m" id="fixture-meta" content="fixture-content">
+  <script r="m">
+    var $_ = { fixture: true };
+    if (document.getElementsByTagName('meta').item(0).getAttribute('id') !== 'fixture-meta') {
+      throw new Error('initial HTML is unavailable');
+    }
+    if (navigator.userAgent !== 'FixtureUA/1.0') {
+      throw new Error('dynamic user agent is unavailable');
+    }
+    if (window !== globalThis || !(document.all == null) || typeof document.all !== 'undefined') {
+      throw new Error('Mode browser globals are unavailable');
+    }
+    document.cookie = 'inline=ok; Path=/';
+  </script>
+  <script r="m" src="/challenge.js"></script>
+</head>
+<body><main id="app">fixture</main></body>
+</html>
diff --git a/rs_mode_server/test/fixtures/challenge.js b/rs_mode_server/test/fixtures/challenge.js
new file mode 100644
index 000000000000..1a199ce53f90
--- /dev/null
+++ b/rs_mode_server/test/fixtures/challenge.js
@@ -0,0 +1,8 @@
+'use strict';
+
+if (document.getElementById('app').textContent !== 'fixture') {
+  throw new Error('initial HTML is unavailable');
+}
+document.cookie = `storage=${localStorage.getItem('marker') === null ? 'fresh' : 'leaked'}`;
+localStorage.setItem('marker', 'present');
+document.cookie = 'external=ok; Path=/';
diff --git a/rs_mode_server/test/server.test.js b/rs_mode_server/test/server.test.js
new file mode 100644
index 000000000000..fd27d39f3255
--- /dev/null
+++ b/rs_mode_server/test/server.test.js
@@ -0,0 +1,169 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const http = require('node:http');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+
+const { createRsServer } = require('../server.js');
+
+const fixturesDirectory = path.join(__dirname, 'fixtures');
+const fixtureHtml = fs.readFileSync(path.join(fixturesDirectory, 'challenge.html'), 'utf8');
+const fixtureScript = fs.readFileSync(path.join(fixturesDirectory, 'challenge.js'), 'utf8');
+
+function listen(server) {
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+}
+
+function request(port, method, pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? '' : typeof body === 'string' ? body : JSON.stringify(body);
+    const headers = payload ? {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(payload),
+    } : {};
+    const clientRequest = http.request({
+      host: '127.0.0.1',
+      port,
+      method,
+      path: pathname,
+      headers,
+    }, (response) => {
+      let text = '';
+      response.setEncoding('utf8');
+      response.on('data', (chunk) => { text += chunk; });
+      response.on('end', () => resolve({ statusCode: response.statusCode, body: JSON.parse(text) }));
+    });
+    clientRequest.on('error', reject);
+    clientRequest.end(payload);
+  });
+}
+
+function challengeWith(inlineCode, outJsPath = '/challenge.js') {
+  return `<!doctype html><html><head>
+    <meta r="m" id="fixture-meta" content="fixture-content">
+    <script r="m">${inlineCode}</script>
+    <script r="m" src="${outJsPath}"></script>
+  </head><body></body></html>`;
+}
+
+let cacheDirectory;
+let fixtureServer;
+let fixturePort;
+let rsServer;
+let rsPort;
+
+test.before(async () => {
+  cacheDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'mode-rs-env-'));
+  fixtureServer = http.createServer((request, response) => {
+    if (request.url === '/challenge.js') {
+      response.writeHead(200, { 'Content-Type': 'application/javascript' });
+      response.end(fixtureScript);
+      return;
+    }
+    response.writeHead(404);
+    response.end('not found');
+  });
+  fixturePort = await listen(fixtureServer);
+  rsServer = createRsServer({ outJsDir: cacheDirectory, workerTimeout: 2_000 });
+  rsPort = await listen(rsServer);
+});
+
+test.after(async () => {
+  await close(rsServer);
+  await close(fixtureServer);
+  fs.rmSync(cacheDirectory, { recursive: true, force: true });
+});
+
+function validPayload() {
+  return {
+    html: fixtureHtml,
+    url: `http://127.0.0.1:${fixturePort}/page`,
+    ua: 'FixtureUA/1.0',
+  };
+}
+
+test('health and unknown routes retain the compatibility service shape', async () => {
+  assert.deepEqual(await request(rsPort, 'GET', '/health'), {
+    statusCode: 200,
+    body: { status: 'ok' },
+  });
+  assert.deepEqual(await request(rsPort, 'GET', '/unknown'), {
+    statusCode: 404,
+    body: {},
+  });
+});
+
+test('runs local inline and external challenge scripts in Mode browser-env', async () => {
+  const response = await request(rsPort, 'POST', '/rs_env', validPayload());
+  assert.equal(response.statusCode, 200);
+  assert.deepEqual(response.body, {
+    external: 'ok',
+    inline: 'ok',
+    storage: 'fresh',
+  });
+});
+
+test('cookies and storage do not leak between request workers', async () => {
+  const first = await request(rsPort, 'POST', '/rs_env', validPayload());
+  const second = await request(rsPort, 'POST', '/rs_env', validPayload());
+  assert.equal(first.statusCode, 200);
+  assert.equal(second.statusCode, 200);
+  assert.equal(first.body.storage, 'fresh');
+  assert.equal(second.body.storage, 'fresh');
+});
+
+test('invalid input, absent challenge pieces, and failed external loads return compatibility errors', async () => {
+  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', '{'), {
+    statusCode: 500,
+    body: {},
+  });
+  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', {}), {
+    statusCode: 500,
+    body: {},
+  });
+  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', {
+    ...validPayload(),
+    html: challengeWith('var $_ = 1;', '/missing.js'),
+  }), {
+    statusCode: 500,
+    body: {},
+  });
+});
+
+test('the request-size limit keeps the HTTP 500 compatibility response', async () => {
+  const limitedServer = createRsServer({ maxBodySize: 16, outJsDir: cacheDirectory });
+  const limitedPort = await listen(limitedServer);
+  try {
+    assert.deepEqual(await request(limitedPort, 'POST', '/rs_env', { tooLarge: 'this request exceeds sixteen bytes' }), {
+      statusCode: 500,
+      body: {},
+    });
+  } finally {
+    await close(limitedServer);
+  }
+});
+
+test('unsupported browser interfaces fail instead of falling back to env.js', async () => {
+  const response = await request(rsPort, 'POST', '/rs_env', {
+    ...validPayload(),
+    html: challengeWith('var $_ = 1; new XMLHttpRequest();'),
+  });
+  assert.deepEqual(response, { statusCode: 500, body: {} });
+});
+
+test('a runaway challenge is terminated by the worker timeout', async () => {
+  const response = await request(rsPort, 'POST', '/rs_env', {
+    ...validPayload(),
+    html: challengeWith('var $_ = 1; while (true) {}'),
+  });
+  assert.deepEqual(response, { statusCode: 500, body: {} });
+});
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index a8cd16fce2ca..325000b724f4 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -46,6 +46,9 @@ const moduleScript = `
   assert.strictEqual(document.querySelector('#app').textContent, 'hello');
   assert.strictEqual(document.querySelector('.ready').id, 'app');
   assert.strictEqual(document.querySelectorAll('body #app').length, 1);
+  const divs = document.getElementsByTagName('div');
+  assert.strictEqual(divs[0], document.querySelector('#app'));
+  assert.strictEqual(divs[0].getAttribute('id'), 'app');
   assert.strictEqual(navigator.userAgent, 'TestBrowser/1.0');
   assert.strictEqual(navigator.platform, 'TestOS');
   assert.deepStrictEqual(navigator.languages, ['zh-CN', 'zh']);

From 73cc96d62206727ee44512490eaccbe018d715d7 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Thu, 10 Sep 2026 18:47:47 +0800
Subject: [PATCH 20/32] fix: create releases from existing Mode tags

---
 .github/workflows/publish-native-release.yml | 15 +++++++++++----
 README.md                                    | 20 ++++++++++----------
 2 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 83b2928dd653..4b9b349faf12 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: 'Release tag, for example mode_20260910_v22.0.1'
+        description: 'Release tag, for example mode_20260910_v22.0.2'
         required: true
         type: string
 
@@ -135,9 +135,16 @@ jobs:
           merge-multiple: true
       - name: Create or update the unified release
         run: |
+          shopt -s nullglob
+          assets=(dist/*.tar.gz dist/*.zip)
+          if (( ${#assets[@]} != 3 )); then
+            echo "Expected exactly three release assets:" >&2
+            find dist -maxdepth 2 -type f -print >&2
+            exit 1
+          fi
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
-            gh release upload "$RELEASE_TAG" dist/* --clobber
+            gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber
           else
-            gh release create "$RELEASE_TAG" dist/* \
-              --target "$GITHUB_SHA" --title "$RELEASE_TAG" --generate-notes
+            gh release create "$RELEASE_TAG" "${assets[@]}" \
+              --verify-tag --title "$RELEASE_TAG" --notes-from-tag
           fi
diff --git a/README.md b/README.md
index f7aba96163c2..44d90d03a90c 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
 > The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260910_v22.0.1`; the `v22.0.1` part is
+> one date-stamped tag, such as `mode_20260910_v22.0.2`; the `v22.0.2` part is
 > the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
@@ -16,21 +16,21 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.1][mode-release] | `mode_mac_arm_20260910_v22.0.1.tar.gz` |
-| Windows x64 | [mode_20260910_v22.0.1][mode-release] | `mode_win_x64_20260910_v22.0.1.zip` |
-| Linux x64 | [mode_20260910_v22.0.1][mode-release] | `mode_linux_x64_20260910_v22.0.1.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.2][mode-release] | `mode_mac_arm_20260910_v22.0.2.tar.gz` |
+| Windows x64 | [mode_20260910_v22.0.2][mode-release] | `mode_win_x64_20260910_v22.0.2.zip` |
+| Linux x64 | [mode_20260910_v22.0.2][mode-release] | `mode_linux_x64_20260910_v22.0.2.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_20260910_v22.0.1.tar.gz
+tar -xzf mode_linux_x64_20260910_v22.0.2.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_20260910_v22.0.1/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260910_v22.0.2/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_20260910_v22.0.1` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260910_v22.0.2` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260910_v22.0.1.zip
-.\mode_win_x64_20260910_v22.0.1\mode.exe --version
+Expand-Archive .\mode_win_x64_20260910_v22.0.2.zip
+.\mode_win_x64_20260910_v22.0.2\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -1085,7 +1085,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.1
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.2
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/

From b94e98112cb77c24597fd06e0fd2abe70c6aa3b4 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Thu, 10 Sep 2026 18:50:31 +0800
Subject: [PATCH 21/32] fix: configure unified release repository

---
 .github/workflows/publish-native-release.yml |  1 +
 README.md                                    | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 4b9b349faf12..3637c1ee0c24 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -127,6 +127,7 @@ jobs:
     runs-on: ubuntu-24.04
     env:
       RELEASE_TAG: ${{ needs.validate-release-tag.outputs.release_tag }}
+      GH_REPO: ${{ github.repository }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/README.md b/README.md
index 44d90d03a90c..d9fd4e334cb8 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
 > The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260910_v22.0.2`; the `v22.0.2` part is
+> one date-stamped tag, such as `mode_20260910_v22.0.3`; the `v22.0.3` part is
 > the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
@@ -16,21 +16,21 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.2][mode-release] | `mode_mac_arm_20260910_v22.0.2.tar.gz` |
-| Windows x64 | [mode_20260910_v22.0.2][mode-release] | `mode_win_x64_20260910_v22.0.2.zip` |
-| Linux x64 | [mode_20260910_v22.0.2][mode-release] | `mode_linux_x64_20260910_v22.0.2.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.3][mode-release] | `mode_mac_arm_20260910_v22.0.3.tar.gz` |
+| Windows x64 | [mode_20260910_v22.0.3][mode-release] | `mode_win_x64_20260910_v22.0.3.zip` |
+| Linux x64 | [mode_20260910_v22.0.3][mode-release] | `mode_linux_x64_20260910_v22.0.3.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_20260910_v22.0.2.tar.gz
+tar -xzf mode_linux_x64_20260910_v22.0.3.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_20260910_v22.0.2/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260910_v22.0.3/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_20260910_v22.0.2` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260910_v22.0.3` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260910_v22.0.2.zip
-.\mode_win_x64_20260910_v22.0.2\mode.exe --version
+Expand-Archive .\mode_win_x64_20260910_v22.0.3.zip
+.\mode_win_x64_20260910_v22.0.3\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -1085,7 +1085,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.2
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.3
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/

From 658ccab48a7f5c253739597caf9b70afc559e1a8 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Thu, 10 Sep 2026 21:40:22 +0800
Subject: [PATCH 22/32] fix: checkout tag before unified release publishing

---
 .github/workflows/publish-native-release.yml |  4 ++++
 README.md                                    | 20 ++++++++++----------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 3637c1ee0c24..d14029387d90 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -130,6 +130,10 @@ jobs:
       GH_REPO: ${{ github.repository }}
       GH_TOKEN: ${{ github.token }}
     steps:
+      # --notes-from-tag reads the annotated tag through the local Git checkout.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
diff --git a/README.md b/README.md
index d9fd4e334cb8..829add1a2356 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
 > The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260910_v22.0.3`; the `v22.0.3` part is
+> one date-stamped tag, such as `mode_20260910_v22.0.4`; the `v22.0.4` part is
 > the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
@@ -16,21 +16,21 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.3][mode-release] | `mode_mac_arm_20260910_v22.0.3.tar.gz` |
-| Windows x64 | [mode_20260910_v22.0.3][mode-release] | `mode_win_x64_20260910_v22.0.3.zip` |
-| Linux x64 | [mode_20260910_v22.0.3][mode-release] | `mode_linux_x64_20260910_v22.0.3.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.4][mode-release] | `mode_mac_arm_20260910_v22.0.4.tar.gz` |
+| Windows x64 | [mode_20260910_v22.0.4][mode-release] | `mode_win_x64_20260910_v22.0.4.zip` |
+| Linux x64 | [mode_20260910_v22.0.4][mode-release] | `mode_linux_x64_20260910_v22.0.4.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_20260910_v22.0.3.tar.gz
+tar -xzf mode_linux_x64_20260910_v22.0.4.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_20260910_v22.0.3/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260910_v22.0.4/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_20260910_v22.0.3` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260910_v22.0.4` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260910_v22.0.3.zip
-.\mode_win_x64_20260910_v22.0.3\mode.exe --version
+Expand-Archive .\mode_win_x64_20260910_v22.0.4.zip
+.\mode_win_x64_20260910_v22.0.4\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -1085,7 +1085,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.3
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.4
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/

From 15f2bfdfd9aaacd19974adaca82620f6a13e0e47 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Fri, 11 Sep 2026 10:10:10 +0800
Subject: [PATCH 23/32] feat: expand browser environment compatibility

---
 README.md                          |  31 +-
 lib/internal/browser_env.js        | 468 ++++++++++++++++++++++++++++-
 rs_mode_server/README.md           |  24 +-
 rs_mode_server/test/server.test.js |  13 +-
 test/parallel/test-browser-env.js  |  85 ++++++
 5 files changed, 590 insertions(+), 31 deletions(-)

diff --git a/README.md b/README.md
index 829add1a2356..648f10f23b32 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
 > The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260910_v22.0.4`; the `v22.0.4` part is
+> one date-stamped tag, such as `mode_20260911_v22.0.5`; the `v22.0.5` part is
 > the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
@@ -16,21 +16,21 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260910_v22.0.4][mode-release] | `mode_mac_arm_20260910_v22.0.4.tar.gz` |
-| Windows x64 | [mode_20260910_v22.0.4][mode-release] | `mode_win_x64_20260910_v22.0.4.zip` |
-| Linux x64 | [mode_20260910_v22.0.4][mode-release] | `mode_linux_x64_20260910_v22.0.4.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260911_v22.0.5][mode-release] | `mode_mac_arm_20260911_v22.0.5.tar.gz` |
+| Windows x64 | [mode_20260911_v22.0.5][mode-release] | `mode_win_x64_20260911_v22.0.5.zip` |
+| Linux x64 | [mode_20260911_v22.0.5][mode-release] | `mode_linux_x64_20260911_v22.0.5.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_20260910_v22.0.4.tar.gz
+tar -xzf mode_linux_x64_20260911_v22.0.5.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_20260910_v22.0.4/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260911_v22.0.5/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_20260910_v22.0.4` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260911_v22.0.5` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260910_v22.0.4.zip
-.\mode_win_x64_20260910_v22.0.4\mode.exe --version
+Expand-Archive .\mode_win_x64_20260911_v22.0.5.zip
+.\mode_win_x64_20260911_v22.0.5\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -67,10 +67,15 @@ JavaScript Realm:
 * In-memory `document.cookie`, `localStorage`, and `sessionStorage`.
 * Basic DOM event-target methods: `addEventListener()`, `removeEventListener()`,
   and `dispatchEvent()`.
+* `DOMParser`, basic `XMLHttpRequest` state transitions and argument capture,
+  `MutationObserver`, `indexedDB`, Chrome app metadata, and common DOM
+  constructors such as `HTMLAnchorElement`, `HTMLFormElement`, and
+  `HTMLCanvasElement`.
 
-It deliberately does **not** provide a renderer, layout engine, Canvas, WebGL,
-real navigation, or automatic execution of `<script>` tags contained in the
-initial HTML. It is a script compatibility environment, not a headless browser.
+It deliberately does **not** provide a renderer, layout engine, Canvas pixel
+output, WebGL, XHR emulation that makes network requests, real navigation, or
+automatic execution of `<script>` tags contained in the initial HTML. It is a
+script compatibility environment, not a headless browser.
 
 ### Start an existing script with a JSON profile
 
@@ -1085,7 +1090,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260910_v22.0.4
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260911_v22.0.5
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index 9017179b79ba..af82ab09c2d9 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -31,8 +31,24 @@ const kVoidElements = new Set([
 ]);
 
 const kDefaultNavigator = {
+  appCodeName: 'Mozilla',
+  appName: 'Netscape',
+  appVersion: '5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '
+    + '(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+  cookieEnabled: true,
+  connection: {
+    downlink: 10,
+    effectiveType: '4g',
+    onchange: null,
+    rtt: 200,
+    saveData: false,
+  },
   userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '
     + '(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+  mimeTypes: [
+    { description: 'Portable Document Format', suffixes: 'pdf', type: 'application/pdf' },
+    { description: 'Portable Document Format', suffixes: 'pdf', type: 'text/pdf' },
+  ],
   platform: 'Win32',
   language: 'en-US',
   languages: ['en-US', 'en'],
@@ -40,6 +56,10 @@ const kDefaultNavigator = {
   maxTouchPoints: 0,
   hardwareConcurrency: 8,
   deviceMemory: 8,
+  onLine: true,
+  product: 'Gecko',
+  productSub: '20030107',
+  vendorSub: '',
   webdriver: false,
 };
 
@@ -48,6 +68,11 @@ const kProtectedWindowProperties = new Set([
   'navigator', 'history', 'screen', 'Window', 'Navigator', 'Event',
   'Node', 'Element', 'HTMLElement', 'Document', 'Text', 'localStorage',
   'sessionStorage', 'addEventListener', 'removeEventListener', 'dispatchEvent',
+  'History', 'Screen', 'Location', 'DOMParser', 'XMLHttpRequest',
+  'MutationObserver', 'HTMLAnchorElement', 'HTMLCanvasElement',
+  'CanvasRenderingContext2D', 'HTMLFormElement', 'HTMLInputElement',
+  'indexedDB', 'chrome', 'clientInformation', 'msCrypto', 'name', 'open',
+  'prompt', 'webkitRequestFileSystem', 'TEMPORARY',
 ]);
 
 const kProtectedDocumentProperties = new Set([
@@ -56,7 +81,7 @@ const kProtectedDocumentProperties = new Set([
   'removeChild', 'replaceChild', 'getElementById', 'getElementsByTagName',
   'getElementsByClassName', 'getElementsByName', 'querySelector',
   'querySelectorAll', 'defaultView', 'addEventListener', 'removeEventListener',
-  'dispatchEvent',
+  'dispatchEvent', 'createExpression',
 ]);
 
 let installed = false;
@@ -255,6 +280,38 @@ class BrowserElement extends BrowserNode {
     this.setAttribute('class', value);
   }
 
+  get name() {
+    return this.getAttribute('name') ?? '';
+  }
+
+  set name(value) {
+    this.setAttribute('name', value);
+  }
+
+  get value() {
+    return this.getAttribute('value') ?? '';
+  }
+
+  set value(value) {
+    this.setAttribute('value', value);
+  }
+
+  get type() {
+    return this.getAttribute('type') ?? '';
+  }
+
+  set type(value) {
+    this.setAttribute('type', value);
+  }
+
+  get src() {
+    return this.getAttribute('src') ?? '';
+  }
+
+  set src(value) {
+    this.setAttribute('src', value);
+  }
+
   get classList() {
     const element = this;
     return {
@@ -332,6 +389,102 @@ class BrowserElement extends BrowserNode {
   }
 }
 
+class HTMLAnchorElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'a');
+  }
+
+  get _url() {
+    return new URL(this.getAttribute('href') ?? '', this.ownerDocument.location.href);
+  }
+
+  get href() {
+    return this._url.href;
+  }
+
+  set href(value) {
+    this.setAttribute('href', value);
+  }
+
+  get origin() { return this._url.origin; }
+  get protocol() { return this._url.protocol; }
+  get host() { return this._url.host; }
+  get hostname() { return this._url.hostname; }
+  get port() { return this._url.port; }
+  get pathname() { return this._url.pathname; }
+  get search() { return this._url.search; }
+  get hash() { return this._url.hash; }
+}
+
+class CanvasRenderingContext2D {
+  constructor(canvas) {
+    this.canvas = canvas;
+    this.fillStyle = '#000000';
+    this.font = '10px sans-serif';
+  }
+
+  clearRect() {}
+  fillRect() {}
+  fillText() {}
+  drawImage() {}
+  beginPath() {}
+  closePath() {}
+  stroke() {}
+  fill() {}
+
+  getImageData() {
+    return { data: new Uint8ClampedArray(0), height: 0, width: 0 };
+  }
+
+  measureText(value) {
+    return { width: String(value).length * 6 };
+  }
+}
+
+class HTMLCanvasElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'canvas');
+    this.height = 150;
+    this.width = 300;
+    this._context2d = undefined;
+  }
+
+  getContext(type) {
+    if (StringPrototypeToLowerCase(String(type)) !== '2d') return null;
+    this._context2d ??= new CanvasRenderingContext2D(this);
+    return this._context2d;
+  }
+
+  toDataURL() {
+    return 'data:,';
+  }
+}
+
+class HTMLFormElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'form');
+  }
+
+  get elements() {
+    return createLiveCollection(this, (element) =>
+      element !== this && ['button', 'fieldset', 'input', 'object', 'output', 'select', 'textarea'].includes(element.localName));
+  }
+
+  get action() {
+    return new URL(this.getAttribute('action') ?? '', this.ownerDocument.location.href).href;
+  }
+
+  set action(value) {
+    this.setAttribute('action', value);
+  }
+}
+
+class HTMLInputElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'input');
+  }
+}
+
 class BrowserDocument extends BrowserNode {
   constructor(location) {
     super(null, 9, '#document');
@@ -387,13 +540,28 @@ class BrowserDocument extends BrowserNode {
   }
 
   createElement(tagName) {
-    return new BrowserElement(this, tagName);
+    switch (StringPrototypeToLowerCase(String(tagName))) {
+      case 'a':
+        return new HTMLAnchorElement(this);
+      case 'canvas':
+        return new HTMLCanvasElement(this);
+      case 'form':
+        return new HTMLFormElement(this);
+      case 'input':
+        return new HTMLInputElement(this);
+      default:
+        return new BrowserElement(this, tagName);
+    }
   }
 
   createTextNode(data) {
     return new BrowserText(this, data);
   }
 
+  createExpression() {
+    return ObjectCreate(null);
+  }
+
   getElementById(id) {
     return walkElements(this, (element) => element.id === String(id))[0] ?? null;
   }
@@ -455,7 +623,13 @@ function walkElements(root, predicate) {
 
 function createLiveCollection(root, predicate) {
   const current = () => walkElements(root, predicate);
-  return new Proxy(ObjectCreate(null), {
+  const collection = ObjectCreate(null);
+  ObjectDefineProperty(collection, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'HTMLCollection',
+  });
+  return new Proxy(collection, {
     get(target, property) {
       if (property === 'length') return current().length;
       if (property === 'item') return (index) => current()[index] ?? null;
@@ -574,6 +748,16 @@ function createLocation(href) {
   location.replace = function replaceLocation(value) { replace(value); };
   location.reload = function reload() {};
   location.toString = function toString() { return url.href; };
+  ObjectDefineProperty(location, 'ancestorOrigins', {
+    __proto__: null,
+    configurable: false,
+    enumerable: true,
+    value: {
+      item() { return null; },
+      length: 0,
+    },
+    writable: false,
+  });
   return location;
 }
 
@@ -642,6 +826,197 @@ function createStorage(seed) {
   };
 }
 
+function createMimeTypeArray(values) {
+  const entries = values.map((value) => ({
+    description: value.description ?? '',
+    suffixes: value.suffixes ?? '',
+    type: value.type ?? '',
+  }));
+  const mimeTypes = ObjectCreate(null);
+  for (let index = 0; index < entries.length; index++) {
+    const entry = entries[index];
+    ObjectDefineProperty(mimeTypes, index, {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      value: entry,
+    });
+    if (entry.type) {
+      ObjectDefineProperty(mimeTypes, entry.type, {
+        __proto__: null,
+        configurable: true,
+        enumerable: true,
+        value: entry,
+      });
+    }
+  }
+  ObjectDefineProperty(mimeTypes, 'length', {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() { return entries.length; },
+  });
+  mimeTypes.item = function item(index) { return entries[index] ?? null; };
+  mimeTypes.namedItem = function namedItem(name) {
+    return entries.find((entry) => entry.type === String(name)) ?? null;
+  };
+  ObjectDefineProperty(mimeTypes, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'MimeTypeArray',
+  });
+  return mimeTypes;
+}
+
+function createDOMParser(location) {
+  return class DOMParser {
+    parseFromString(source) {
+      const document = new BrowserDocument(createLocation(location.href));
+      document.loadHTML(String(source));
+      return document;
+    }
+  };
+}
+
+function createXMLHttpRequest(window, location) {
+  function XMLHttpRequest() {
+    createEventTarget(this);
+    this.readyState = XMLHttpRequest.UNSENT;
+    this.response = null;
+    this.responseText = '';
+    this.responseType = '';
+    this.responseURL = '';
+    this.status = 0;
+    this.statusText = '';
+    this.timeout = 0;
+    this.withCredentials = false;
+    this._headers = new Map();
+    this._requestHeaders = new Map();
+  }
+
+  XMLHttpRequest.UNSENT = 0;
+  XMLHttpRequest.OPENED = 1;
+  XMLHttpRequest.HEADERS_RECEIVED = 2;
+  XMLHttpRequest.LOADING = 3;
+  XMLHttpRequest.DONE = 4;
+  for (const name of ['UNSENT', 'OPENED', 'HEADERS_RECEIVED', 'LOADING', 'DONE']) {
+    XMLHttpRequest.prototype[name] = XMLHttpRequest[name];
+  }
+  XMLHttpRequest.prototype.open = function open(method, url, async = true) {
+    this.method = String(method);
+    this.async = Boolean(async);
+    this.url = String(url);
+    this.responseURL = new URL(this.url, location.href).href;
+    this.readyState = XMLHttpRequest.OPENED;
+    window.encode_url = this.url;
+    this.dispatchEvent(new BrowserEvent('readystatechange'));
+  };
+  XMLHttpRequest.prototype.setRequestHeader = function setRequestHeader(name, value) {
+    if (this.readyState !== XMLHttpRequest.OPENED) throw new Error('InvalidStateError');
+    this._requestHeaders.set(String(name).toLowerCase(), String(value));
+  };
+  XMLHttpRequest.prototype.getResponseHeader = function getResponseHeader(name) {
+    return this._headers.get(String(name).toLowerCase()) ?? null;
+  };
+  XMLHttpRequest.prototype.getAllResponseHeaders = function getAllResponseHeaders() {
+    return [...this._headers].map(([name, value]) => `${name}: ${value}`).join('\r\n');
+  };
+  XMLHttpRequest.prototype.send = function send(data = null) {
+    if (this.readyState !== XMLHttpRequest.OPENED) throw new Error('InvalidStateError');
+    this.requestBody = data;
+    window.encode_data = data;
+    this.readyState = XMLHttpRequest.DONE;
+    this.dispatchEvent(new BrowserEvent('readystatechange'));
+    this.dispatchEvent(new BrowserEvent('loadend'));
+  };
+  XMLHttpRequest.prototype.abort = function abort() {
+    this.readyState = XMLHttpRequest.UNSENT;
+    this.dispatchEvent(new BrowserEvent('abort'));
+    this.dispatchEvent(new BrowserEvent('loadend'));
+  };
+  ObjectDefineProperty(XMLHttpRequest.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'XMLHttpRequest',
+  });
+  return XMLHttpRequest;
+}
+
+function createMutationObserver() {
+  return class MutationObserver {
+    constructor(callback) {
+      if (typeof callback !== 'function') throw new TypeError('MutationObserver callback must be a function');
+      this.callback = callback;
+      this.records = [];
+    }
+
+    observe(target, options) {
+      this.target = target;
+      this.options = options;
+    }
+
+    disconnect() {
+      this.target = undefined;
+      this.records.length = 0;
+    }
+
+    takeRecords() {
+      const records = ArrayPrototypeSlice(this.records);
+      this.records.length = 0;
+      return records;
+    }
+  };
+}
+
+function createIndexedDB() {
+  const databases = new Map();
+  return {
+    deleteDatabase(name) {
+      databases.delete(String(name));
+      return { error: null, readyState: 'done', result: undefined };
+    },
+    open(name, version = 1) {
+      const databaseName = String(name);
+      let database = databases.get(databaseName);
+      if (database === undefined) {
+        database = {
+          close() {},
+          name: databaseName,
+          objectStoreNames: createLiveCollection({ childNodes: [] }, () => false),
+          version: Number(version),
+        };
+        databases.set(databaseName, database);
+      }
+      return {
+        error: null,
+        readyState: 'done',
+        result: database,
+        transaction() { throw new Error('IndexedDB transactions are not implemented'); },
+      };
+    },
+  };
+}
+
+function createChrome() {
+  return {
+    app: {
+      InstallState: {
+        DISABLED: 'disabled',
+        INSTALLED: 'installed',
+        NOT_INSTALLED: 'not_installed',
+      },
+      RunningState: {
+        CANNOT_RUN: 'cannot_run',
+        READY_TO_RUN: 'ready_to_run',
+        RUNNING: 'running',
+      },
+      isInstalled: false,
+    },
+    csi() { return {}; },
+    loadTimes() { return {}; },
+  };
+}
+
 function assertCustomPropertyName(name, protectedNames, targetName) {
   if (protectedNames.has(name)) {
     throw new TypeError(`${targetName}.${name} is a protected browser environment property`);
@@ -718,6 +1093,27 @@ function install(options) {
   };
   if (!ArrayIsArray(navigatorValues.languages)) throw new TypeError('navigator.languages must be an array');
   if (options.navigator?.language === undefined) navigatorValues.language = navigatorValues.languages[0] ?? kDefaultNavigator.language;
+  if (options.navigator?.appVersion === undefined) {
+    navigatorValues.appVersion = String(navigatorValues.userAgent).replace(/^Mozilla\//, '');
+  }
+  if (ArrayIsArray(navigatorValues.mimeTypes)) navigatorValues.mimeTypes = createMimeTypeArray(navigatorValues.mimeTypes);
+  if (navigatorValues.sendBeacon === undefined) navigatorValues.sendBeacon = function sendBeacon() { return true; };
+  if (navigatorValues.getBattery === undefined) {
+    navigatorValues.getBattery = function getBattery() {
+      const battery = {
+        charging: true,
+        chargingTime: Infinity,
+        dischargingTime: Infinity,
+        level: 0.8,
+        onchargingchange: null,
+        onchargingtimechange: null,
+        ondischargingtimechange: null,
+        onlevelchange: null,
+      };
+      createEventTarget(battery);
+      return Promise.resolve(battery);
+    };
+  }
   const { Navigator, navigator } = createNavigator(navigatorValues);
   const screen = {
     availHeight: 1040,
@@ -726,6 +1122,11 @@ function install(options) {
     availWidth: 1920,
     colorDepth: 24,
     height: 1080,
+    orientation: {
+      angle: 0,
+      onchange: null,
+      type: 'landscape-primary',
+    },
     pixelDepth: 24,
     width: 1920,
     ...(options.screen ?? {}),
@@ -737,7 +1138,7 @@ function install(options) {
       const elements = walkElements(document, () => true);
       if (key === 'length') return elements.length;
       if (typeof key === 'number') return elements[key];
-      if (typeof key === 'string' && /^\\d+$/.test(key)) return elements[Number(key)];
+      if (typeof key === 'string' && /^\d+$/.test(key)) return elements[Number(key)];
       if (typeof key === 'string') return elements.find((element) =>
         element.id === key || element.getAttribute('name') === key);
       return undefined;
@@ -757,18 +1158,51 @@ function install(options) {
   function Window() {
     throw new TypeError('Illegal constructor');
   }
+  function History() {
+    throw new TypeError('Illegal constructor');
+  }
+  function Screen() {
+    throw new TypeError('Illegal constructor');
+  }
+  function Location() {
+    throw new TypeError('Illegal constructor');
+  }
   ObjectSetPrototypeOf(Window.prototype, ObjectGetPrototypeOf(globalThis));
   ObjectSetPrototypeOf(globalThis, Window.prototype);
+  ObjectSetPrototypeOf(history, History.prototype);
+  ObjectSetPrototypeOf(screen, Screen.prototype);
+  ObjectSetPrototypeOf(location, Location.prototype);
+
+  const DOMParser = createDOMParser(location);
+  const XMLHttpRequest = createXMLHttpRequest(globalThis, location);
+  const MutationObserver = createMutationObserver();
 
   ObjectDefineProperty(globalThis, 'window', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
   ObjectDefineProperty(globalThis, 'self', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
   ObjectDefineProperty(globalThis, 'top', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
   ObjectDefineProperty(globalThis, 'parent', { __proto__: null, configurable: true, enumerable: true, value: globalThis, writable: false });
   ObjectDefineProperty(globalThis, 'Window', { __proto__: null, configurable: true, enumerable: false, value: Window, writable: true });
+  ObjectDefineProperty(globalThis, 'History', { __proto__: null, configurable: true, enumerable: false, value: History, writable: true });
+  ObjectDefineProperty(globalThis, 'Screen', { __proto__: null, configurable: true, enumerable: false, value: Screen, writable: true });
+  ObjectDefineProperty(globalThis, 'Location', { __proto__: null, configurable: true, enumerable: false, value: Location, writable: true });
   ObjectDefineProperty(globalThis, 'Navigator', { __proto__: null, configurable: true, enumerable: false, value: Navigator, writable: true });
   ObjectDefineProperty(globalThis, 'Event', { __proto__: null, configurable: true, enumerable: false, value: BrowserEvent, writable: true });
+  ObjectDefineProperty(globalThis, 'Node', { __proto__: null, configurable: true, enumerable: false, value: BrowserNode, writable: true });
+  ObjectDefineProperty(globalThis, 'Element', { __proto__: null, configurable: true, enumerable: false, value: BrowserElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLElement', { __proto__: null, configurable: true, enumerable: false, value: BrowserElement, writable: true });
+  ObjectDefineProperty(globalThis, 'Document', { __proto__: null, configurable: true, enumerable: false, value: BrowserDocument, writable: true });
+  ObjectDefineProperty(globalThis, 'Text', { __proto__: null, configurable: true, enumerable: false, value: BrowserText, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLAnchorElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLAnchorElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLCanvasElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLCanvasElement, writable: true });
+  ObjectDefineProperty(globalThis, 'CanvasRenderingContext2D', { __proto__: null, configurable: true, enumerable: false, value: CanvasRenderingContext2D, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLFormElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLFormElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLInputElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLInputElement, writable: true });
+  ObjectDefineProperty(globalThis, 'DOMParser', { __proto__: null, configurable: true, enumerable: false, value: DOMParser, writable: true });
+  ObjectDefineProperty(globalThis, 'XMLHttpRequest', { __proto__: null, configurable: true, enumerable: false, value: XMLHttpRequest, writable: true });
+  ObjectDefineProperty(globalThis, 'MutationObserver', { __proto__: null, configurable: true, enumerable: false, value: MutationObserver, writable: true });
   ObjectDefineProperty(globalThis, 'document', { __proto__: null, configurable: true, enumerable: true, value: document, writable: false });
   ObjectDefineProperty(globalThis, 'navigator', { __proto__: null, configurable: true, enumerable: true, value: navigator, writable: false });
+  ObjectDefineProperty(globalThis, 'clientInformation', { __proto__: null, configurable: true, enumerable: true, value: navigator, writable: false });
   ObjectDefineProperty(globalThis, 'location', {
     __proto__: null,
     configurable: true,
@@ -778,6 +1212,32 @@ function install(options) {
   });
   ObjectDefineProperty(globalThis, 'history', { __proto__: null, configurable: true, enumerable: true, value: history, writable: false });
   ObjectDefineProperty(globalThis, 'screen', { __proto__: null, configurable: true, enumerable: true, value: screen, writable: false });
+  ObjectDefineProperty(globalThis, 'indexedDB', { __proto__: null, configurable: true, enumerable: true, value: createIndexedDB(), writable: false });
+  ObjectDefineProperty(globalThis, 'chrome', { __proto__: null, configurable: true, enumerable: true, value: createChrome(), writable: false });
+  ObjectDefineProperty(globalThis, 'TEMPORARY', { __proto__: null, configurable: true, enumerable: true, value: 0, writable: false });
+  ObjectDefineProperty(globalThis, 'name', { __proto__: null, configurable: true, enumerable: true, value: '', writable: true });
+  ObjectDefineProperty(globalThis, 'innerHeight', { __proto__: null, configurable: true, enumerable: true, value: 1080, writable: true });
+  ObjectDefineProperty(globalThis, 'innerWidth', { __proto__: null, configurable: true, enumerable: true, value: 1920, writable: true });
+  ObjectDefineProperty(globalThis, 'outerHeight', { __proto__: null, configurable: true, enumerable: true, value: 1080, writable: true });
+  ObjectDefineProperty(globalThis, 'outerWidth', { __proto__: null, configurable: true, enumerable: true, value: 1920, writable: true });
+  ObjectDefineProperty(globalThis, 'screenLeft', { __proto__: null, configurable: true, enumerable: true, value: 0, writable: true });
+  ObjectDefineProperty(globalThis, 'screenTop', { __proto__: null, configurable: true, enumerable: true, value: 0, writable: true });
+  ObjectDefineProperty(globalThis, 'screenX', { __proto__: null, configurable: true, enumerable: true, value: 0, writable: true });
+  ObjectDefineProperty(globalThis, 'screenY', { __proto__: null, configurable: true, enumerable: true, value: 0, writable: true });
+  ObjectDefineProperty(globalThis, 'open', {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    value: function open() {
+      return { close() { this.closed = true; }, closed: false };
+    },
+    writable: true,
+  });
+  ObjectDefineProperty(globalThis, 'prompt', { __proto__: null, configurable: true, enumerable: true, value: function prompt() { return null; }, writable: true });
+  ObjectDefineProperty(globalThis, 'webkitRequestFileSystem', { __proto__: null, configurable: true, enumerable: true, value: function webkitRequestFileSystem() { return {}; }, writable: true });
+  if (globalThis.crypto !== undefined) {
+    ObjectDefineProperty(globalThis, 'msCrypto', { __proto__: null, configurable: true, enumerable: true, value: globalThis.crypto, writable: false });
+  }
   ObjectDefineProperty(document, 'defaultView', { __proto__: null, configurable: false, enumerable: true, value: globalThis, writable: false });
   createEventTarget(globalThis);
 
diff --git a/rs_mode_server/README.md b/rs_mode_server/README.md
index ec1b03898690..a00e25c89823 100644
--- a/rs_mode_server/README.md
+++ b/rs_mode_server/README.md
@@ -40,23 +40,25 @@ before launching to change the bind address or port.
 ```
 
 On success, it returns the Cookie object set by the challenge. Invalid requests,
-missing challenge markers or scripts, external-script errors, unsupported browser
-interfaces, and worker timeouts return HTTP 500 with `{}`.
+missing challenge markers or scripts, external-script errors, and worker timeouts
+return HTTP 500 with `{}`.
 
 Each request executes in its own Worker. The Worker installs a fresh Mode browser
 environment with the supplied URL, original HTML, dynamic user agent, DOM,
-`document.all`, location/history, cookies, Storage, event interfaces, base
-navigator values, screen dimensions, window dimensions, and hidden document
-visibility. External `r="m"` scripts are cached under `out_js/`; the cache is
-ignored by Git.
+`document.all`, location/history, cookies, Storage, event interfaces, DOMParser,
+basic XHR state transitions, base navigator values (including connection,
+mimeTypes, battery, and beacon APIs), screen dimensions, window dimensions, and
+hidden document visibility. External `r="m"` scripts are cached under `out_js/`;
+the cache is ignored by Git.
 
 ## Strict compatibility boundary
 
-This service intentionally provides only the Mode browser environment. It does
-not emulate the old `env.js` fallback surface, including fake XHR/fetch responses,
-Canvas/WebGL, `chrome`, `mimeTypes`, battery APIs, form hacks, or native
-`toString` spoofing. A challenge that depends on one of these missing APIs fails
-with the normal HTTP 500 response instead of silently mixing environments.
+This service intentionally provides only the Mode browser environment. Its XHR
+implementation records `open()` and `send()` arguments without making a network
+request; Node's built-in `fetch` retains its normal behavior. The Canvas surface
+is deterministic and has no renderer or pixel fingerprint. WebGL, site-specific
+prebuilt challenge DOM, form hacks, and native `toString` spoofing are not
+implemented.
 
 ## Tests
 
diff --git a/rs_mode_server/test/server.test.js b/rs_mode_server/test/server.test.js
index fd27d39f3255..f42e3df5724f 100644
--- a/rs_mode_server/test/server.test.js
+++ b/rs_mode_server/test/server.test.js
@@ -152,12 +152,19 @@ test('the request-size limit keeps the HTTP 500 compatibility response', async (
   }
 });
 
-test('unsupported browser interfaces fail instead of falling back to env.js', async () => {
+test('XMLHttpRequest compatibility runs without loading env.js', async () => {
   const response = await request(rsPort, 'POST', '/rs_env', {
     ...validPayload(),
-    html: challengeWith('var $_ = 1; new XMLHttpRequest();'),
+    html: fixtureHtml.replace("document.cookie = 'inline=ok; Path=/';", `
+      var xhr = new XMLHttpRequest();
+      xhr.open('POST', '/probe');
+      xhr.send('payload');
+      document.cookie = 'xhr=' + encode_url + ':' + encode_data;
+      document.cookie = 'inline=ok; Path=/';
+    `),
   });
-  assert.deepEqual(response, { statusCode: 500, body: {} });
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.body.xhr, '/probe:payload');
 });
 
 test('a runaway challenge is terminated by the worker timeout', async () => {
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index 325000b724f4..0ba94f4dc2c7 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -81,6 +81,91 @@ const moduleScript = `
 
 spawnSyncAndAssert(process.execPath, ['-e', moduleScript], { status: 0, stderr: '' });
 
+spawnSyncAndAssert(process.execPath, [
+  '-e',
+  `
+    (async () => {
+      const assert = require('node:assert');
+      const { install } = require('node:browser-env');
+      install({
+        url: 'https://example.test/page?x=1',
+        html: '<html><body><form id="form"><input name="token" value="initial"></form></body></html>',
+        navigator: { userAgent: 'Mozilla/5.0 ModeTest' },
+      });
+
+      assert.strictEqual(window.innerWidth, 1920);
+      assert.strictEqual(window.outerHeight, 1080);
+      assert.strictEqual(screen.orientation.type, 'landscape-primary');
+      assert.strictEqual(location.ancestorOrigins.length, 0);
+      assert.strictEqual(clientInformation, navigator);
+      assert.strictEqual(navigator.appName, 'Netscape');
+      assert.strictEqual(navigator.appVersion, '5.0 ModeTest');
+      assert.strictEqual(navigator.connection.effectiveType, '4g');
+      assert.strictEqual(navigator.mimeTypes.length, 2);
+      assert.strictEqual(navigator.mimeTypes.namedItem('application/pdf').suffixes, 'pdf');
+      assert.strictEqual(navigator.sendBeacon('/beacon', 'body'), true);
+      assert.strictEqual((await navigator.getBattery()).charging, true);
+
+      assert(document instanceof Document);
+      assert(document.body instanceof HTMLElement);
+      assert(document.createTextNode('text') instanceof Text);
+      assert.strictEqual(Object.prototype.toString.call(document.getElementsByTagName('input')), '[object HTMLCollection]');
+      assert.deepStrictEqual(document.createExpression(), Object.create(null));
+
+      const anchor = document.createElement('a');
+      anchor.href = '/next?q=1#hash';
+      assert(anchor instanceof HTMLAnchorElement);
+      assert.strictEqual(anchor.href, 'https://example.test/next?q=1#hash');
+      assert.strictEqual(anchor.host, 'example.test');
+      const form = document.querySelector('#form');
+      assert(form instanceof HTMLFormElement);
+      assert.strictEqual(form.elements.namedItem('token').value, 'initial');
+
+      const canvas = document.createElement('canvas');
+      assert(canvas instanceof HTMLCanvasElement);
+      assert(canvas.getContext('2d') instanceof CanvasRenderingContext2D);
+      assert.strictEqual(canvas.toDataURL(), 'data:,');
+
+      const parsed = new DOMParser().parseFromString('<html><body><p id="parsed">ok</p></body></html>', 'text/html');
+      assert(parsed instanceof Document);
+      assert.strictEqual(parsed.querySelector('#parsed').textContent, 'ok');
+
+      const xhr = new XMLHttpRequest();
+      const states = [];
+      xhr.addEventListener('readystatechange', () => states.push(xhr.readyState));
+      xhr.open('POST', '/challenge');
+      xhr.setRequestHeader('x-test', 'yes');
+      xhr.send('payload');
+      assert.deepStrictEqual(states, [XMLHttpRequest.OPENED, XMLHttpRequest.DONE]);
+      assert.strictEqual(xhr.status, 0);
+      assert.strictEqual(xhr.responseURL, 'https://example.test/challenge');
+      assert.strictEqual(window.encode_url, '/challenge');
+      assert.strictEqual(window.encode_data, 'payload');
+
+      let observed = false;
+      const observer = new MutationObserver(() => { observed = true; });
+      observer.observe(document.body, { childList: true });
+      assert.strictEqual(observer.takeRecords().length, 0);
+      observer.disconnect();
+      assert.strictEqual(observed, false);
+      assert.strictEqual(indexedDB.open('mode-test').result.name, 'mode-test');
+      assert.strictEqual(chrome.app.isInstalled, false);
+      assert.strictEqual(typeof chrome.loadTimes, 'function');
+      assert.strictEqual(msCrypto, globalThis.crypto);
+      assert.strictEqual(typeof msCrypto.getRandomValues, 'function');
+      assert.strictEqual(window.open('https://example.test/').closed, false);
+      assert.strictEqual(window.prompt('question'), null);
+      assert.strictEqual(typeof webkitRequestFileSystem, 'function');
+
+      assert.strictEqual(document.all[0], document.documentElement);
+      assert.strictEqual(document.all[3], form);
+    })().catch((error) => {
+      console.error(error.stack);
+      process.exitCode = 1;
+    });
+  `,
+], { status: 0, stderr: '' });
+
 spawnSyncAndAssert(process.execPath, [
   '-e',
   `

From 922d457e738bdaadc0c9fba25fc43f22475ae571 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Sat, 12 Sep 2026 02:16:08 +0800
Subject: [PATCH 24/32] =?UTF-8?q?feat:=20=E8=A1=A5=E5=85=A8=E6=B5=8F?=
 =?UTF-8?q?=E8=A7=88=E5=99=A8=E7=8E=AF=E5=A2=83=E5=B9=B6=E9=9A=94=E7=A6=BB?=
 =?UTF-8?q?=20Node=20=E7=89=B9=E5=BE=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish-native-release.yml |  16 +-
 .gitignore                                   |   1 +
 README.md                                    |   8 +-
 doc/api/browser-env.md                       |   6 +
 lib/internal/browser_env.js                  | 546 +++++++++++++++----
 rs_mode_server/README.md                     |   7 +-
 rs_mode_server/server.js                     |   7 +-
 rs_mode_server/test/server.test.js           |  15 +
 test/parallel/test-browser-env.js            |  53 +-
 9 files changed, 549 insertions(+), 110 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index d14029387d90..a61c48958b23 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -138,6 +138,19 @@ jobs:
         with:
           path: dist
           merge-multiple: true
+      - name: 编写中文发布说明
+        run: |
+          printf '%s\n' \
+            '## 本次更新' \
+            '' \
+            '- 补全 Mode 浏览器环境的 DOM 对象标签、构造器和集合描述符，降低普通 JavaScript 对象特征。' \
+            '- `rs_mode_server` 的挑战 Worker 现在隔离 `global`、`process`、`Buffer`、`setImmediate` 等 Node 全局别名，并取消向挑战脚本注入 CommonJS `require`。' \
+            '- 保持 `document.all`、原始 HTML、动态 UA、Cookie、Storage、location/history 与每请求独立 Worker 的兼容行为。' \
+            '' \
+            '## 构建与验证' \
+            '' \
+            '- 已在 macOS ARM64、Windows x64、Linux x64 统一构建，并执行浏览器环境和 rs_mode_server 本地回归测试。' \
+            > release-notes.md
       - name: Create or update the unified release
         run: |
           shopt -s nullglob
@@ -148,8 +161,9 @@ jobs:
             exit 1
           fi
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release edit "$RELEASE_TAG" --title "$RELEASE_TAG" --notes-file release-notes.md
             gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber
           else
             gh release create "$RELEASE_TAG" "${assets[@]}" \
-              --verify-tag --title "$RELEASE_TAG" --notes-from-tag
+              --verify-tag --title "$RELEASE_TAG" --notes-file release-notes.md
           fi
diff --git a/.gitignore b/.gitignore
index 69c1dd205316..0d598418e4a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -164,6 +164,7 @@ install_manifest.txt
 # === Rules for AI assistants ===
 CLAUDE.md
 AGENTS.md
+js_reverse_cache/
 
 # === Global Rules ===
 # Keep last to avoid being excluded
diff --git a/README.md b/README.md
index 648f10f23b32..98725b026660 100644
--- a/README.md
+++ b/README.md
@@ -16,9 +16,9 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260911_v22.0.5][mode-release] | `mode_mac_arm_20260911_v22.0.5.tar.gz` |
-| Windows x64 | [mode_20260911_v22.0.5][mode-release] | `mode_win_x64_20260911_v22.0.5.zip` |
-| Linux x64 | [mode_20260911_v22.0.5][mode-release] | `mode_linux_x64_20260911_v22.0.5.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260912_v22.0.6][mode-release] | `mode_mac_arm_20260912_v22.0.6.tar.gz` |
+| Windows x64 | [mode_20260912_v22.0.6][mode-release] | `mode_win_x64_20260912_v22.0.6.zip` |
+| Linux x64 | [mode_20260912_v22.0.6][mode-release] | `mode_linux_x64_20260912_v22.0.6.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
@@ -1090,7 +1090,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260911_v22.0.5
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260912_v22.0.6
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/
diff --git a/doc/api/browser-env.md b/doc/api/browser-env.md
index 1eef339488c3..eac8d8f4bf7b 100644
--- a/doc/api/browser-env.md
+++ b/doc/api/browser-env.md
@@ -53,6 +53,12 @@ installed browser environment.
   * `cookies` {string|Object} Optional initial in-memory cookies.
   * `localStorage` {Object} Optional initial local storage values.
   * `sessionStorage` {Object} Optional initial session storage values.
+  * `hideNodeGlobals` {boolean} When `true`, removes the configurable Node-only
+    global aliases `global`, `process`, `Buffer`, `require`, `module`,
+    `exports`, `__dirname`, `__filename`, `setImmediate`, and `clearImmediate`
+    from this Realm after installation. Use it when browser challenge code is
+    evaluated through a separate function; it is `false` by default so normal
+    Mode scripts retain their Node entry points.
   * `window.properties` {Object} Optional ordinary custom global properties.
   * `window.descriptors` {Object} Optional custom property descriptors.
   * `document.properties` {Object} Optional ordinary custom document
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index af82ab09c2d9..3feacd794981 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -71,8 +71,13 @@ const kProtectedWindowProperties = new Set([
   'History', 'Screen', 'Location', 'DOMParser', 'XMLHttpRequest',
   'MutationObserver', 'HTMLAnchorElement', 'HTMLCanvasElement',
   'CanvasRenderingContext2D', 'HTMLFormElement', 'HTMLInputElement',
+  'HTMLBodyElement', 'HTMLCollection', 'HTMLHeadElement', 'HTMLHtmlElement',
+  'HTMLMetaElement', 'HTMLScriptElement', 'HTMLTitleElement', 'MimeType',
+  'MimeTypeArray', 'Storage',
   'indexedDB', 'chrome', 'clientInformation', 'msCrypto', 'name', 'open',
   'prompt', 'webkitRequestFileSystem', 'TEMPORARY',
+  'global', 'process', 'Buffer', 'require', 'module', 'exports',
+  'setImmediate', 'clearImmediate',
 ]);
 
 const kProtectedDocumentProperties = new Set([
@@ -101,6 +106,16 @@ function getHref(options) {
   return href;
 }
 
+function defineInternal(target, name, value) {
+  ObjectDefineProperty(target, name, {
+    __proto__: null,
+    configurable: false,
+    enumerable: false,
+    value,
+    writable: true,
+  });
+}
+
 function createEventTarget(target) {
   const listeners = new Map();
   ObjectDefineProperty(target, '_listeners', {
@@ -110,38 +125,56 @@ function createEventTarget(target) {
     value: listeners,
     writable: false,
   });
-  target.addEventListener = function addEventListener(type, callback) {
-    if (typeof callback !== 'function') return;
-    const key = String(type);
-    let callbacks = listeners.get(key);
-    if (callbacks === undefined) {
-      callbacks = [];
-      listeners.set(key, callbacks);
-    }
-    if (!ArrayPrototypeIncludes(callbacks, callback)) ArrayPrototypePush(callbacks, callback);
-  };
-  target.removeEventListener = function removeEventListener(type, callback) {
-    const callbacks = listeners.get(String(type));
-    if (callbacks === undefined) return;
-    const index = callbacks.indexOf(callback);
-    if (index !== -1) callbacks.splice(index, 1);
-  };
-  target.dispatchEvent = function dispatchEvent(event) {
-    if (event === null || typeof event !== 'object' || !event.type) {
-      throw new TypeError('dispatchEvent requires an event with a type');
-    }
-    event.target ??= this;
-    event.currentTarget = this;
-    const callbacks = listeners.get(String(event.type));
-    if (callbacks !== undefined) {
-      for (const callback of ArrayPrototypeSlice(callbacks)) {
-        FunctionPrototypeCall(callback, this, event);
+  ObjectDefineProperty(target, 'addEventListener', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: function addEventListener(type, callback) {
+      if (typeof callback !== 'function') return;
+      const key = String(type);
+      let callbacks = listeners.get(key);
+      if (callbacks === undefined) {
+        callbacks = [];
+        listeners.set(key, callbacks);
       }
-    }
-    const handler = this[`on${event.type}`];
-    if (typeof handler === 'function') FunctionPrototypeCall(handler, this, event);
-    return !event.defaultPrevented;
-  };
+      if (!ArrayPrototypeIncludes(callbacks, callback)) ArrayPrototypePush(callbacks, callback);
+    },
+    writable: true,
+  });
+  ObjectDefineProperty(target, 'removeEventListener', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: function removeEventListener(type, callback) {
+      const callbacks = listeners.get(String(type));
+      if (callbacks === undefined) return;
+      const index = callbacks.indexOf(callback);
+      if (index !== -1) callbacks.splice(index, 1);
+    },
+    writable: true,
+  });
+  ObjectDefineProperty(target, 'dispatchEvent', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: function dispatchEvent(event) {
+      if (event === null || typeof event !== 'object' || !event.type) {
+        throw new TypeError('dispatchEvent requires an event with a type');
+      }
+      event.target ??= this;
+      event.currentTarget = this;
+      const callbacks = listeners.get(String(event.type));
+      if (callbacks !== undefined) {
+        for (const callback of ArrayPrototypeSlice(callbacks)) {
+          FunctionPrototypeCall(callback, this, event);
+        }
+      }
+      const handler = this[`on${event.type}`];
+      if (typeof handler === 'function') FunctionPrototypeCall(handler, this, event);
+      return !event.defaultPrevented;
+    },
+    writable: true,
+  });
   return target;
 }
 
@@ -161,11 +194,39 @@ class BrowserEvent {
 class BrowserNode {
   constructor(ownerDocument, nodeType, nodeName) {
     createEventTarget(this);
-    this.ownerDocument = ownerDocument;
-    this.nodeType = nodeType;
-    this.nodeName = nodeName;
-    this.parentNode = null;
-    this.childNodes = [];
+    defineInternal(this, '_ownerDocument', ownerDocument);
+    defineInternal(this, '_nodeType', nodeType);
+    defineInternal(this, '_nodeName', nodeName);
+    defineInternal(this, '_parentNode', null);
+    defineInternal(this, '_childNodes', []);
+  }
+
+  get ownerDocument() {
+    return this._ownerDocument;
+  }
+
+  set ownerDocument(value) {
+    this._ownerDocument = value;
+  }
+
+  get nodeType() {
+    return this._nodeType;
+  }
+
+  get nodeName() {
+    return this._nodeName;
+  }
+
+  get parentNode() {
+    return this._parentNode;
+  }
+
+  set parentNode(value) {
+    this._parentNode = value;
+  }
+
+  get childNodes() {
+    return this._childNodes;
   }
 
   get firstChild() {
@@ -181,7 +242,7 @@ class BrowserNode {
   }
 
   get children() {
-    return this.childNodes.filter((node) => node.nodeType === 1);
+    return createCollection(() => this.childNodes.filter((node) => node.nodeType === 1));
   }
 
   appendChild(child) {
@@ -237,6 +298,14 @@ class BrowserNode {
     const text = String(value);
     if (text.length > 0) this.appendChild(new BrowserText(this.ownerDocument, text));
   }
+
+  get innerText() {
+    return this.textContent;
+  }
+
+  set innerText(value) {
+    this.textContent = value;
+  }
 }
 
 class BrowserText extends BrowserNode {
@@ -252,16 +321,48 @@ class BrowserText extends BrowserNode {
   set textContent(value) {
     this.data = String(value);
   }
+
+  get [Symbol.toStringTag]() {
+    return 'Text';
+  }
 }
 
 class BrowserElement extends BrowserNode {
   constructor(ownerDocument, tagName) {
     const localName = StringPrototypeToLowerCase(String(tagName));
     super(ownerDocument, 1, StringPrototypeToUpperCase(localName));
-    this.tagName = this.nodeName;
-    this.localName = localName;
-    this.attributes = ObjectCreate(null);
-    this.style = ObjectCreate(null);
+    defineInternal(this, '_tagName', this.nodeName);
+    defineInternal(this, '_localName', localName);
+    defineInternal(this, '_attributes', ObjectCreate(null));
+    defineInternal(this, '_style', ObjectCreate(null));
+  }
+
+  get tagName() {
+    return this._tagName;
+  }
+
+  get localName() {
+    return this._localName;
+  }
+
+  get attributes() {
+    return this._attributes;
+  }
+
+  get style() {
+    return this._style;
+  }
+
+  get [Symbol.toStringTag]() {
+    switch (this.localName) {
+      case 'body': return 'HTMLBodyElement';
+      case 'head': return 'HTMLHeadElement';
+      case 'html': return 'HTMLHtmlElement';
+      case 'meta': return 'HTMLMetaElement';
+      case 'script': return 'HTMLScriptElement';
+      case 'title': return 'HTMLTitleElement';
+      default: return `HTML${this.localName[0].toUpperCase()}${this.localName.slice(1)}Element`;
+    }
   }
 
   get id() {
@@ -305,13 +406,22 @@ class BrowserElement extends BrowserNode {
   }
 
   get src() {
-    return this.getAttribute('src') ?? '';
+    const value = this.getAttribute('src');
+    return value === null ? '' : new URL(value, this.ownerDocument.location.href).href;
   }
 
   set src(value) {
     this.setAttribute('src', value);
   }
 
+  get content() {
+    return this.getAttribute('content') ?? '';
+  }
+
+  set content(value) {
+    this.setAttribute('content', value);
+  }
+
   get classList() {
     const element = this;
     return {
@@ -389,6 +499,42 @@ class BrowserElement extends BrowserNode {
   }
 }
 
+class HTMLHtmlElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'html');
+  }
+}
+
+class HTMLHeadElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'head');
+  }
+}
+
+class HTMLBodyElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'body');
+  }
+}
+
+class HTMLMetaElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'meta');
+  }
+}
+
+class HTMLScriptElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'script');
+  }
+}
+
+class HTMLTitleElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'title');
+  }
+}
+
 class HTMLAnchorElement extends BrowserElement {
   constructor(ownerDocument) {
     super(ownerDocument, 'a');
@@ -489,20 +635,69 @@ class BrowserDocument extends BrowserNode {
   constructor(location) {
     super(null, 9, '#document');
     this.ownerDocument = this;
-    this._location = location;
-    this._cookieJar = new Map();
-    this.characterSet = 'UTF-8';
-    this.charset = 'UTF-8';
-    this.visibilityState = 'visible';
+    defineInternal(this, '_location', location);
+    defineInternal(this, '_cookieJar', new Map());
+    defineInternal(this, '_documentElement', null);
+    defineInternal(this, '_head', null);
+    defineInternal(this, '_body', null);
+    ObjectDefineProperty(this, 'characterSet', {
+      __proto__: null,
+      configurable: true,
+      enumerable: false,
+      value: 'UTF-8',
+      writable: true,
+    });
+    ObjectDefineProperty(this, 'charset', {
+      __proto__: null,
+      configurable: true,
+      enumerable: false,
+      value: 'UTF-8',
+      writable: true,
+    });
+    ObjectDefineProperty(this, 'visibilityState', {
+      __proto__: null,
+      configurable: true,
+      enumerable: false,
+      value: 'visible',
+      writable: true,
+    });
     this._resetDocumentElement();
   }
 
+  get [Symbol.toStringTag]() {
+    return 'HTMLDocument';
+  }
+
+  get documentElement() {
+    return this._documentElement;
+  }
+
+  set documentElement(value) {
+    this._documentElement = value;
+  }
+
+  get head() {
+    return this._head;
+  }
+
+  set head(value) {
+    this._head = value;
+  }
+
+  get body() {
+    return this._body;
+  }
+
+  set body(value) {
+    this._body = value;
+  }
+
   _resetDocumentElement() {
     for (const child of this.childNodes) child.parentNode = null;
     this.childNodes.length = 0;
-    this.documentElement = new BrowserElement(this, 'html');
-    this.head = new BrowserElement(this, 'head');
-    this.body = new BrowserElement(this, 'body');
+    this.documentElement = this.createElement('html');
+    this.head = this.createElement('head');
+    this.body = this.createElement('body');
     this.documentElement.appendChild(this.head);
     this.documentElement.appendChild(this.body);
     this.appendChild(this.documentElement);
@@ -543,12 +738,24 @@ class BrowserDocument extends BrowserNode {
     switch (StringPrototypeToLowerCase(String(tagName))) {
       case 'a':
         return new HTMLAnchorElement(this);
+      case 'body':
+        return new HTMLBodyElement(this);
       case 'canvas':
         return new HTMLCanvasElement(this);
       case 'form':
         return new HTMLFormElement(this);
+      case 'head':
+        return new HTMLHeadElement(this);
+      case 'html':
+        return new HTMLHtmlElement(this);
       case 'input':
         return new HTMLInputElement(this);
+      case 'meta':
+        return new HTMLMetaElement(this);
+      case 'script':
+        return new HTMLScriptElement(this);
+      case 'title':
+        return new HTMLTitleElement(this);
       default:
         return new BrowserElement(this, tagName);
     }
@@ -596,8 +803,8 @@ class BrowserDocument extends BrowserNode {
       this.documentElement = parsedHtml;
       this.documentElement.parentNode = null;
       this.appendChild(this.documentElement);
-      this.head = this.documentElement.children.find((node) => node.localName === 'head') ?? this.createElement('head');
-      this.body = this.documentElement.children.find((node) => node.localName === 'body') ?? this.createElement('body');
+      this.head = this.documentElement.childNodes.find((node) => node.localName === 'head') ?? this.createElement('head');
+      this.body = this.documentElement.childNodes.find((node) => node.localName === 'body') ?? this.createElement('body');
       if (this.head.parentNode === null) this.documentElement.insertBefore(this.head, this.documentElement.firstChild);
       if (this.body.parentNode === null) this.documentElement.appendChild(this.body);
     } else {
@@ -621,36 +828,67 @@ function walkElements(root, predicate) {
   return result;
 }
 
-function createLiveCollection(root, predicate) {
-  const current = () => walkElements(root, predicate);
-  const collection = ObjectCreate(null);
-  ObjectDefineProperty(collection, Symbol.toStringTag, {
-    __proto__: null,
-    configurable: true,
-    value: 'HTMLCollection',
-  });
+function HTMLCollection() {
+  throw new TypeError('Illegal constructor');
+}
+
+ObjectDefineProperty(HTMLCollection.prototype, Symbol.toStringTag, {
+  __proto__: null,
+  configurable: true,
+  value: 'HTMLCollection',
+});
+
+function createCollection(current) {
+  const collection = ObjectCreate(HTMLCollection.prototype);
   return new Proxy(collection, {
-    get(target, property) {
+    get(target, property, receiver) {
       if (property === 'length') return current().length;
       if (property === 'item') return (index) => current()[index] ?? null;
       if (property === 'namedItem') return (name) => current().find((element) =>
         element.id === name || element.getAttribute('name') === name) ?? null;
       if (property === Symbol.iterator) return function* iterator() { yield* current(); };
       if (typeof property === 'string' && /^\d+$/.test(property)) return current()[Number(property)];
-      return target[property];
+      return Reflect.get(target, property, receiver);
     },
     ownKeys() {
-      return [...current().keys()].map(String).concat('length');
+      return [...current().keys()].map(String);
     },
     getOwnPropertyDescriptor(target, property) {
-      if (property === 'length' || (typeof property === 'string' && /^\d+$/.test(property))) {
-        return { configurable: true, enumerable: true };
+      if (property === 'length') {
+        return {
+          configurable: true,
+          enumerable: false,
+          value: current().length,
+          writable: false,
+        };
+      }
+      if (typeof property === 'string' && /^\d+$/.test(property)) {
+        return {
+          configurable: true,
+          enumerable: true,
+          value: current()[Number(property)],
+          writable: false,
+        };
       }
       return ObjectGetOwnPropertyDescriptor(target, property);
     },
   });
 }
 
+function createLiveCollection(root, predicate) {
+  return createCollection(() => walkElements(root, predicate));
+}
+
+function DOMStringList() {
+  throw new TypeError('Illegal constructor');
+}
+
+ObjectDefineProperty(DOMStringList.prototype, Symbol.toStringTag, {
+  __proto__: null,
+  configurable: true,
+  value: 'DOMStringList',
+});
+
 function selectorMatches(element, selector) {
   const attribute = RegExpPrototypeExec(/^\[([\w-]+)(?:=["']?([^\]"']+)["']?)?\]$/, selector);
   if (attribute !== null) {
@@ -692,9 +930,18 @@ function parseAttributes(element, source) {
 function parseFragment(document, source) {
   const root = new BrowserNode(document, 11, '#document-fragment');
   const stack = [root];
-  const tokenPattern = /<\/?([A-Za-z][\w:-]*)([^>]*)>|([^<]+)/g;
+  const tokenPattern = /<!--[\s\S]*?-->|<\/?([A-Za-z][\w:-]*)([^>]*)>|([^<]+)/g;
   let match;
   while ((match = tokenPattern.exec(source)) !== null) {
+    if (match[0].startsWith('<!--')) {
+      // Conditional comments can contain markup which is ignored by modern
+      // browsers. Do not accidentally turn that hidden markup into DOM nodes.
+      // Inside a script element the same sequence is JavaScript text instead.
+      if (stack[stack.length - 1].localName === 'script') {
+        stack[stack.length - 1].appendChild(document.createTextNode(match[0]));
+      }
+      continue;
+    }
     if (match[3] !== undefined) {
       stack[stack.length - 1].appendChild(document.createTextNode(match[3]));
       continue;
@@ -752,12 +999,23 @@ function createLocation(href) {
     __proto__: null,
     configurable: false,
     enumerable: true,
-    value: {
-      item() { return null; },
-      length: 0,
-    },
+    value: ObjectCreate(DOMStringList.prototype),
+    writable: false,
+  });
+  ObjectDefineProperty(location.ancestorOrigins, 'length', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: 0,
     writable: false,
   });
+  ObjectDefineProperty(location.ancestorOrigins, 'item', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: function item() { return null; },
+    writable: true,
+  });
   return location;
 }
 
@@ -815,24 +1073,77 @@ function createNavigator(values) {
 }
 
 function createStorage(seed) {
-  const values = new Map(Object.entries(seed ?? {}));
-  return {
-    get length() { return values.size; },
-    key(index) { return [...values.keys()][index] ?? null; },
-    getItem(key) { return values.get(String(key)) ?? null; },
-    setItem(key, value) { values.set(String(key), String(value)); },
-    removeItem(key) { values.delete(String(key)); },
-    clear() { values.clear(); },
-  };
+  const storage = ObjectCreate(Storage.prototype);
+  defineInternal(storage, '_values', new Map(Object.entries(seed ?? {})));
+  return storage;
+}
+
+function Storage() {
+  throw new TypeError('Illegal constructor');
+}
+
+ObjectDefineProperty(Storage.prototype, 'length', {
+  __proto__: null,
+  configurable: true,
+  enumerable: true,
+  get() { return this._values.size; },
+});
+Storage.prototype.key = function key(index) {
+  return [...this._values.keys()][index] ?? null;
+};
+Storage.prototype.getItem = function getItem(key) {
+  return this._values.get(String(key)) ?? null;
+};
+Storage.prototype.setItem = function setItem(key, value) {
+  this._values.set(String(key), String(value));
+};
+Storage.prototype.removeItem = function removeItem(key) {
+  this._values.delete(String(key));
+};
+Storage.prototype.clear = function clear() {
+  this._values.clear();
+};
+ObjectDefineProperty(Storage.prototype, Symbol.toStringTag, {
+  __proto__: null,
+  configurable: true,
+  value: 'Storage',
+});
+
+function MimeType() {
+  throw new TypeError('Illegal constructor');
+}
+
+function MimeTypeArray() {
+  throw new TypeError('Illegal constructor');
 }
 
+ObjectDefineProperty(MimeType.prototype, Symbol.toStringTag, {
+  __proto__: null,
+  configurable: true,
+  value: 'MimeType',
+});
+ObjectDefineProperty(MimeTypeArray.prototype, Symbol.toStringTag, {
+  __proto__: null,
+  configurable: true,
+  value: 'MimeTypeArray',
+});
+
 function createMimeTypeArray(values) {
-  const entries = values.map((value) => ({
-    description: value.description ?? '',
-    suffixes: value.suffixes ?? '',
-    type: value.type ?? '',
-  }));
-  const mimeTypes = ObjectCreate(null);
+  const entries = values.map((value) => {
+    const entry = ObjectCreate(MimeType.prototype);
+    for (const key of ['description', 'suffixes', 'type']) {
+      ObjectDefineProperty(entry, key, {
+        __proto__: null,
+        configurable: true,
+        enumerable: true,
+        value: value[key] ?? '',
+        writable: false,
+      });
+    }
+    return entry;
+  });
+  const mimeTypes = ObjectCreate(MimeTypeArray.prototype);
+  defineInternal(mimeTypes, '_entries', entries);
   for (let index = 0; index < entries.length; index++) {
     const entry = entries[index];
     ObjectDefineProperty(mimeTypes, index, {
@@ -845,7 +1156,7 @@ function createMimeTypeArray(values) {
       ObjectDefineProperty(mimeTypes, entry.type, {
         __proto__: null,
         configurable: true,
-        enumerable: true,
+        enumerable: false,
         value: entry,
       });
     }
@@ -853,21 +1164,19 @@ function createMimeTypeArray(values) {
   ObjectDefineProperty(mimeTypes, 'length', {
     __proto__: null,
     configurable: true,
-    enumerable: true,
+    enumerable: false,
     get() { return entries.length; },
   });
-  mimeTypes.item = function item(index) { return entries[index] ?? null; };
-  mimeTypes.namedItem = function namedItem(name) {
-    return entries.find((entry) => entry.type === String(name)) ?? null;
-  };
-  ObjectDefineProperty(mimeTypes, Symbol.toStringTag, {
-    __proto__: null,
-    configurable: true,
-    value: 'MimeTypeArray',
-  });
   return mimeTypes;
 }
 
+MimeTypeArray.prototype.item = function item(index) {
+  return this._entries[index] ?? null;
+};
+MimeTypeArray.prototype.namedItem = function namedItem(name) {
+  return this._entries.find((entry) => entry.type === String(name)) ?? null;
+};
+
 function createDOMParser(location) {
   return class DOMParser {
     parseFromString(source) {
@@ -1064,9 +1373,24 @@ function applyCustomDescriptors(target, source, protectedNames, targetName) {
   }
 }
 
+function hideNodeGlobals() {
+  for (const name of [
+    'global', 'process', 'Buffer', 'require', 'module', 'exports',
+    '__dirname', '__filename', 'setImmediate', 'clearImmediate',
+  ]) {
+    const descriptor = ObjectGetOwnPropertyDescriptor(globalThis, name);
+    if (descriptor?.configurable) delete globalThis[name];
+  }
+  const prepareStackTrace = ObjectGetOwnPropertyDescriptor(Error, 'prepareStackTrace');
+  if (prepareStackTrace?.configurable) delete Error.prepareStackTrace;
+}
+
 function install(options) {
   if (installed) throw new Error('A browser environment is already installed in this Realm');
   assertObject(options, 'browser environment options');
+  if (options.hideNodeGlobals !== undefined && typeof options.hideNodeGlobals !== 'boolean') {
+    throw new TypeError('hideNodeGlobals must be a boolean');
+  }
   validateCustomProperties(options.window?.properties, kProtectedWindowProperties, 'window');
   validateCustomDescriptors(options.window?.descriptors, kProtectedWindowProperties, 'window');
   validateCustomProperties(options.document?.properties, kProtectedDocumentProperties, 'document');
@@ -1150,7 +1474,7 @@ function install(options) {
   ObjectDefineProperty(document, 'all', {
     __proto__: null,
     configurable: false,
-    enumerable: true,
+    enumerable: false,
     value: createDocumentAll(allDelegate),
     writable: false,
   });
@@ -1172,6 +1496,21 @@ function install(options) {
   ObjectSetPrototypeOf(history, History.prototype);
   ObjectSetPrototypeOf(screen, Screen.prototype);
   ObjectSetPrototypeOf(location, Location.prototype);
+  ObjectDefineProperty(Window.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'Window',
+  });
+  ObjectDefineProperty(Screen.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'Screen',
+  });
+  ObjectDefineProperty(Location.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'Location',
+  });
 
   const DOMParser = createDOMParser(location);
   const XMLHttpRequest = createXMLHttpRequest(globalThis, location);
@@ -1193,10 +1532,20 @@ function install(options) {
   ObjectDefineProperty(globalThis, 'Document', { __proto__: null, configurable: true, enumerable: false, value: BrowserDocument, writable: true });
   ObjectDefineProperty(globalThis, 'Text', { __proto__: null, configurable: true, enumerable: false, value: BrowserText, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLAnchorElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLAnchorElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLBodyElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLBodyElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLCanvasElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLCanvasElement, writable: true });
   ObjectDefineProperty(globalThis, 'CanvasRenderingContext2D', { __proto__: null, configurable: true, enumerable: false, value: CanvasRenderingContext2D, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLCollection', { __proto__: null, configurable: true, enumerable: false, value: HTMLCollection, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLFormElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLFormElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLHeadElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLHeadElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLHtmlElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLHtmlElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLInputElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLInputElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLMetaElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLMetaElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLScriptElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLScriptElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLTitleElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLTitleElement, writable: true });
+  ObjectDefineProperty(globalThis, 'MimeType', { __proto__: null, configurable: true, enumerable: false, value: MimeType, writable: true });
+  ObjectDefineProperty(globalThis, 'MimeTypeArray', { __proto__: null, configurable: true, enumerable: false, value: MimeTypeArray, writable: true });
+  ObjectDefineProperty(globalThis, 'Storage', { __proto__: null, configurable: true, enumerable: false, value: Storage, writable: true });
   ObjectDefineProperty(globalThis, 'DOMParser', { __proto__: null, configurable: true, enumerable: false, value: DOMParser, writable: true });
   ObjectDefineProperty(globalThis, 'XMLHttpRequest', { __proto__: null, configurable: true, enumerable: false, value: XMLHttpRequest, writable: true });
   ObjectDefineProperty(globalThis, 'MutationObserver', { __proto__: null, configurable: true, enumerable: false, value: MutationObserver, writable: true });
@@ -1238,7 +1587,7 @@ function install(options) {
   if (globalThis.crypto !== undefined) {
     ObjectDefineProperty(globalThis, 'msCrypto', { __proto__: null, configurable: true, enumerable: true, value: globalThis.crypto, writable: false });
   }
-  ObjectDefineProperty(document, 'defaultView', { __proto__: null, configurable: false, enumerable: true, value: globalThis, writable: false });
+  ObjectDefineProperty(document, 'defaultView', { __proto__: null, configurable: false, enumerable: false, value: globalThis, writable: false });
   createEventTarget(globalThis);
 
   applyCustomProperties(globalThis, options.window?.properties, kProtectedWindowProperties, 'window');
@@ -1249,6 +1598,7 @@ function install(options) {
   ObjectDefineProperty(globalThis, 'localStorage', { __proto__: null, configurable: true, enumerable: true, value: createStorage(options.localStorage), writable: false });
   ObjectDefineProperty(globalThis, 'sessionStorage', { __proto__: null, configurable: true, enumerable: true, value: createStorage(options.sessionStorage), writable: false });
 
+  if (options.hideNodeGlobals) hideNodeGlobals();
   installed = true;
   installedEnvironment = { window: globalThis, document, navigator, location };
   return installedEnvironment;
diff --git a/rs_mode_server/README.md b/rs_mode_server/README.md
index a00e25c89823..fa18759f80c6 100644
--- a/rs_mode_server/README.md
+++ b/rs_mode_server/README.md
@@ -48,8 +48,11 @@ environment with the supplied URL, original HTML, dynamic user agent, DOM,
 `document.all`, location/history, cookies, Storage, event interfaces, DOMParser,
 basic XHR state transitions, base navigator values (including connection,
 mimeTypes, battery, and beacon APIs), screen dimensions, window dimensions, and
-hidden document visibility. External `r="m"` scripts are cached under `out_js/`;
-the cache is ignored by Git.
+hidden document visibility. The Worker also removes the Node-only global aliases
+`global`, `process`, `Buffer`, `require`, `module`, `exports`, `__dirname`,
+`__filename`, `setImmediate`, and `clearImmediate`; challenge code is evaluated
+without a CommonJS `require` parameter. External `r="m"` scripts are cached
+under `out_js/`; the cache is ignored by Git.
 
 ## Strict compatibility boundary
 
diff --git a/rs_mode_server/server.js b/rs_mode_server/server.js
index cb1b6f896e93..cbde9dcf4d22 100644
--- a/rs_mode_server/server.js
+++ b/rs_mode_server/server.js
@@ -146,6 +146,9 @@ function installBrowserEnvironment({ html, url, ua }) {
   install({
     url,
     html,
+    // A challenge runs through new Function below, so it has no CommonJS
+    // lexical bindings. Remove Node-only globals from that Worker Realm too.
+    hideNodeGlobals: true,
     navigator: {
       userAgent: ua,
       platform: 'Win32',
@@ -198,8 +201,8 @@ async function generateCookie(payload, options) {
   const outJs = await loadOutJs(outJsUrl, ua, url, options);
 
   installBrowserEnvironment({ html, url, ua });
-  const executeChallenge = new Function('require', `${challenge.inlineCode}\n${outJs.content}`);
-  const result = executeChallenge(require);
+  const executeChallenge = new Function(`${challenge.inlineCode}\n${outJs.content}`);
+  const result = executeChallenge();
   if (result && typeof result.then === 'function') await result;
 
   return {
diff --git a/rs_mode_server/test/server.test.js b/rs_mode_server/test/server.test.js
index f42e3df5724f..32e3443df34f 100644
--- a/rs_mode_server/test/server.test.js
+++ b/rs_mode_server/test/server.test.js
@@ -112,6 +112,21 @@ test('runs local inline and external challenge scripts in Mode browser-env', asy
   });
 });
 
+test('challenge workers expose browser globals without Node global aliases', async () => {
+  const response = await request(rsPort, 'POST', '/rs_env', {
+    ...validPayload(),
+    html: fixtureHtml.replace('var $_ = { fixture: true };', `
+      var $_ = { fixture: true };
+      if ([typeof global, typeof process, typeof Buffer, typeof require, typeof setImmediate].some((type) => type !== 'undefined')) {
+        throw new Error('Node global leaked into challenge');
+      }
+    `),
+  });
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.body.inline, 'ok');
+  assert.equal(response.body.external, 'ok');
+});
+
 test('cookies and storage do not leak between request workers', async () => {
   const first = await request(rsPort, 'POST', '/rs_env', validPayload());
   const second = await request(rsPort, 'POST', '/rs_env', validPayload());
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index 0ba94f4dc2c7..1a899717d1ec 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -46,6 +46,11 @@ const moduleScript = `
   assert.strictEqual(document.querySelector('#app').textContent, 'hello');
   assert.strictEqual(document.querySelector('.ready').id, 'app');
   assert.strictEqual(document.querySelectorAll('body #app').length, 1);
+  assert.strictEqual(Object.prototype.toString.call(document), '[object HTMLDocument]');
+  assert.strictEqual(Object.prototype.toString.call(document.documentElement), '[object HTMLHtmlElement]');
+  assert.strictEqual(Object.prototype.toString.call(document.head), '[object HTMLHeadElement]');
+  assert.strictEqual(Object.prototype.toString.call(document.body), '[object HTMLBodyElement]');
+  assert.deepStrictEqual(Object.keys(document.body), []);
   const divs = document.getElementsByTagName('div');
   assert.strictEqual(divs[0], document.querySelector('#app'));
   assert.strictEqual(divs[0].getAttribute('id'), 'app');
@@ -89,7 +94,7 @@ spawnSyncAndAssert(process.execPath, [
       const { install } = require('node:browser-env');
       install({
         url: 'https://example.test/page?x=1',
-        html: '<html><body><form id="form"><input name="token" value="initial"></form></body></html>',
+        html: '<html><head><!--[if lt IE 9]><script>hidden-script</script><![endif]--><meta id="challenge" content="initial-content"><script src="/challenge.js">initial-script</script></head><body><form id="form"><input name="token" value="initial"></form></body></html>',
         navigator: { userAgent: 'Mozilla/5.0 ModeTest' },
       });
 
@@ -109,7 +114,17 @@ spawnSyncAndAssert(process.execPath, [
       assert(document instanceof Document);
       assert(document.body instanceof HTMLElement);
       assert(document.createTextNode('text') instanceof Text);
-      assert.strictEqual(Object.prototype.toString.call(document.getElementsByTagName('input')), '[object HTMLCollection]');
+      const inputs = document.getElementsByTagName('input');
+      assert.strictEqual(Object.prototype.toString.call(inputs), '[object HTMLCollection]');
+      assert(inputs instanceof HTMLCollection);
+      assert.strictEqual(inputs.constructor, HTMLCollection);
+      assert.deepStrictEqual(Object.keys(inputs), ['0']);
+      assert.strictEqual(Object.prototype.toString.call(document), '[object HTMLDocument]');
+      assert.strictEqual(Object.prototype.toString.call(document.head), '[object HTMLHeadElement]');
+      assert.strictEqual(Object.prototype.toString.call(document.body), '[object HTMLBodyElement]');
+      assert.deepStrictEqual(Object.keys(document), []);
+      assert.deepStrictEqual(Object.keys(document.body), []);
+      assert.deepStrictEqual(Object.keys(navigator.mimeTypes), ['0', '1']);
       assert.deepStrictEqual(document.createExpression(), Object.create(null));
 
       const anchor = document.createElement('a');
@@ -117,6 +132,22 @@ spawnSyncAndAssert(process.execPath, [
       assert(anchor instanceof HTMLAnchorElement);
       assert.strictEqual(anchor.href, 'https://example.test/next?q=1#hash');
       assert.strictEqual(anchor.host, 'example.test');
+
+      const meta = document.querySelector('#challenge');
+      assert(meta instanceof HTMLMetaElement);
+      assert.strictEqual(Object.prototype.toString.call(meta), '[object HTMLMetaElement]');
+      assert.strictEqual(meta.content, 'initial-content');
+      meta.content = 'updated-content';
+      assert.strictEqual(meta.getAttribute('content'), 'updated-content');
+      const script = document.querySelector('script');
+      assert(script instanceof HTMLScriptElement);
+      assert.strictEqual(Object.prototype.toString.call(script), '[object HTMLScriptElement]');
+      assert.strictEqual(script.innerText, 'initial-script');
+      script.innerText = 'updated-script';
+      assert.strictEqual(script.textContent, 'updated-script');
+      assert.strictEqual(script.src, 'https://example.test/challenge.js');
+      assert.strictEqual(document.getElementsByTagName('script').length, 1);
+
       const form = document.querySelector('#form');
       assert(form instanceof HTMLFormElement);
       assert.strictEqual(form.elements.namedItem('token').value, 'initial');
@@ -158,7 +189,7 @@ spawnSyncAndAssert(process.execPath, [
       assert.strictEqual(typeof webkitRequestFileSystem, 'function');
 
       assert.strictEqual(document.all[0], document.documentElement);
-      assert.strictEqual(document.all[3], form);
+      assert.strictEqual(document.all.form, form);
     })().catch((error) => {
       console.error(error.stack);
       process.exitCode = 1;
@@ -166,6 +197,22 @@ spawnSyncAndAssert(process.execPath, [
   `,
 ], { status: 0, stderr: '' });
 
+spawnSyncAndAssert(process.execPath, [
+  '-e',
+  `
+    const assert = require('node:assert');
+    const { install } = require('node:browser-env');
+    install({ url: 'https://example.test/', hideNodeGlobals: true });
+    assert.deepStrictEqual(
+      new Function('return [typeof global, typeof process, typeof Buffer, typeof require, typeof module, typeof exports, typeof __dirname, typeof __filename, typeof setImmediate, typeof clearImmediate].join(\",\")')(),
+      'undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined',
+    );
+    for (const name of ['global', 'process', 'Buffer', 'require', 'module', 'exports', '__dirname', '__filename', 'setImmediate', 'clearImmediate']) {
+      assert.strictEqual(Object.getOwnPropertyDescriptor(globalThis, name), undefined);
+    }
+  `,
+], { status: 0, stderr: '' });
+
 spawnSyncAndAssert(process.execPath, [
   '-e',
   `

From 90db1dbeef1a7c4a9cb77f4e385e6360c07b8024 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Sat, 12 Sep 2026 22:15:36 +0800
Subject: [PATCH 25/32] =?UTF-8?q?fix:=20=E4=BF=9D=E7=95=99=E6=8C=91?=
 =?UTF-8?q?=E6=88=98=E8=84=9A=E6=9C=AC=E6=89=80=E9=9C=80=E7=9A=84=20Buffer?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish-native-release.yml |  2 +-
 README.md                                    |  8 ++++----
 doc/api/browser-env.md                       |  4 ++--
 lib/internal/browser_env.js                  |  2 +-
 rs_mode_server/README.md                     | 10 ++++++----
 rs_mode_server/test/server.test.js           |  2 +-
 test/parallel/test-browser-env.js            |  7 ++++---
 7 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index a61c48958b23..b45af9161cde 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -144,7 +144,7 @@ jobs:
             '## 本次更新' \
             '' \
             '- 补全 Mode 浏览器环境的 DOM 对象标签、构造器和集合描述符，降低普通 JavaScript 对象特征。' \
-            '- `rs_mode_server` 的挑战 Worker 现在隔离 `global`、`process`、`Buffer`、`setImmediate` 等 Node 全局别名，并取消向挑战脚本注入 CommonJS `require`。' \
+            '- `rs_mode_server` 的挑战 Worker 现在隔离 `global`、`process`、`module`、`require`、`setImmediate` 等 Node 全局别名，并取消向挑战脚本注入 CommonJS `require`；保留 `Buffer` 兼容既有挑战脚本。' \
             '- 保持 `document.all`、原始 HTML、动态 UA、Cookie、Storage、location/history 与每请求独立 Worker 的兼容行为。' \
             '' \
             '## 构建与验证' \
diff --git a/README.md b/README.md
index 98725b026660..30b7aa6ccbb9 100644
--- a/README.md
+++ b/README.md
@@ -16,9 +16,9 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260912_v22.0.6][mode-release] | `mode_mac_arm_20260912_v22.0.6.tar.gz` |
-| Windows x64 | [mode_20260912_v22.0.6][mode-release] | `mode_win_x64_20260912_v22.0.6.zip` |
-| Linux x64 | [mode_20260912_v22.0.6][mode-release] | `mode_linux_x64_20260912_v22.0.6.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260912_v22.0.7][mode-release] | `mode_mac_arm_20260912_v22.0.7.tar.gz` |
+| Windows x64 | [mode_20260912_v22.0.7][mode-release] | `mode_win_x64_20260912_v22.0.7.zip` |
+| Linux x64 | [mode_20260912_v22.0.7][mode-release] | `mode_linux_x64_20260912_v22.0.7.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
@@ -1090,7 +1090,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260912_v22.0.6
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260912_v22.0.7
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/
diff --git a/doc/api/browser-env.md b/doc/api/browser-env.md
index eac8d8f4bf7b..e6ff8c4f7ae9 100644
--- a/doc/api/browser-env.md
+++ b/doc/api/browser-env.md
@@ -54,8 +54,8 @@ installed browser environment.
   * `localStorage` {Object} Optional initial local storage values.
   * `sessionStorage` {Object} Optional initial session storage values.
   * `hideNodeGlobals` {boolean} When `true`, removes the configurable Node-only
-    global aliases `global`, `process`, `Buffer`, `require`, `module`,
-    `exports`, `__dirname`, `__filename`, `setImmediate`, and `clearImmediate`
+    global aliases `global`, `process`, `require`, `module`, `exports`,
+    `__dirname`, `__filename`, `setImmediate`, and `clearImmediate`
     from this Realm after installation. Use it when browser challenge code is
     evaluated through a separate function; it is `false` by default so normal
     Mode scripts retain their Node entry points.
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index 3feacd794981..5a8855bc6573 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -1375,7 +1375,7 @@ function applyCustomDescriptors(target, source, protectedNames, targetName) {
 
 function hideNodeGlobals() {
   for (const name of [
-    'global', 'process', 'Buffer', 'require', 'module', 'exports',
+    'global', 'process', 'require', 'module', 'exports',
     '__dirname', '__filename', 'setImmediate', 'clearImmediate',
   ]) {
     const descriptor = ObjectGetOwnPropertyDescriptor(globalThis, name);
diff --git a/rs_mode_server/README.md b/rs_mode_server/README.md
index fa18759f80c6..b7596e4c7384 100644
--- a/rs_mode_server/README.md
+++ b/rs_mode_server/README.md
@@ -49,10 +49,12 @@ environment with the supplied URL, original HTML, dynamic user agent, DOM,
 basic XHR state transitions, base navigator values (including connection,
 mimeTypes, battery, and beacon APIs), screen dimensions, window dimensions, and
 hidden document visibility. The Worker also removes the Node-only global aliases
-`global`, `process`, `Buffer`, `require`, `module`, `exports`, `__dirname`,
-`__filename`, `setImmediate`, and `clearImmediate`; challenge code is evaluated
-without a CommonJS `require` parameter. External `r="m"` scripts are cached
-under `out_js/`; the cache is ignored by Git.
+`global`, `process`, `require`, `module`, `exports`, `__dirname`,
+`__filename`, `setImmediate`, and `clearImmediate`. `Buffer` stays available
+for compatibility with existing challenge code; it does not cross Worker
+boundaries. Challenge code is evaluated without a CommonJS `require` parameter.
+External `r="m"` scripts are cached under `out_js/`; the cache is ignored by
+Git.
 
 ## Strict compatibility boundary
 
diff --git a/rs_mode_server/test/server.test.js b/rs_mode_server/test/server.test.js
index 32e3443df34f..8607ef6ad944 100644
--- a/rs_mode_server/test/server.test.js
+++ b/rs_mode_server/test/server.test.js
@@ -117,7 +117,7 @@ test('challenge workers expose browser globals without Node global aliases', asy
     ...validPayload(),
     html: fixtureHtml.replace('var $_ = { fixture: true };', `
       var $_ = { fixture: true };
-      if ([typeof global, typeof process, typeof Buffer, typeof require, typeof setImmediate].some((type) => type !== 'undefined')) {
+      if ([typeof global, typeof process, typeof require, typeof setImmediate].some((type) => type !== 'undefined')) {
         throw new Error('Node global leaked into challenge');
       }
     `),
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index 1a899717d1ec..94efff6d8472 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -204,10 +204,11 @@ spawnSyncAndAssert(process.execPath, [
     const { install } = require('node:browser-env');
     install({ url: 'https://example.test/', hideNodeGlobals: true });
     assert.deepStrictEqual(
-      new Function('return [typeof global, typeof process, typeof Buffer, typeof require, typeof module, typeof exports, typeof __dirname, typeof __filename, typeof setImmediate, typeof clearImmediate].join(\",\")')(),
-      'undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined',
+      new Function('return [typeof global, typeof process, typeof require, typeof module, typeof exports, typeof __dirname, typeof __filename, typeof setImmediate, typeof clearImmediate].join(\",\")')(),
+      'undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined,undefined',
     );
-    for (const name of ['global', 'process', 'Buffer', 'require', 'module', 'exports', '__dirname', '__filename', 'setImmediate', 'clearImmediate']) {
+    assert.strictEqual(typeof Buffer, 'function');
+    for (const name of ['global', 'process', 'require', 'module', 'exports', '__dirname', '__filename', 'setImmediate', 'clearImmediate']) {
       assert.strictEqual(Object.getOwnPropertyDescriptor(globalThis, name), undefined);
     }
   `,

From 1a27296a93ac9493b68a12c50f9d495f7b027580 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Sun, 13 Sep 2026 00:28:48 +0800
Subject: [PATCH 26/32] =?UTF-8?q?test:=20=E6=B7=BB=E5=8A=A0=E6=B5=8F?=
 =?UTF-8?q?=E8=A7=88=E5=99=A8=E7=8E=AF=E5=A2=83=E6=BA=90=E7=A0=81=E8=AF=8A?=
 =?UTF-8?q?=E6=96=AD=E5=99=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tools/browser-env-source-runner.js | 177 +++++++++++++++++++++++++++++
 1 file changed, 177 insertions(+)
 create mode 100644 tools/browser-env-source-runner.js

diff --git a/tools/browser-env-source-runner.js b/tools/browser-env-source-runner.js
new file mode 100644
index 000000000000..702e97fc0f11
--- /dev/null
+++ b/tools/browser-env-source-runner.js
@@ -0,0 +1,177 @@
+'use strict';
+
+// Executes the browser environment JavaScript from the working tree without
+// rebuilding Node. The running Mode binary supplies only the native
+// `document.all` binding; `lib/internal/browser_env.js` is loaded from disk.
+//
+// Run with a previously built Mode binary:
+//   mode --expose-internals tools/browser-env-source-runner.js \
+//     js_reverse_cache/.../first_412.html --deterministic
+// Add --trace only when inspecting environment accesses. It instruments DOM
+// methods and is therefore deliberately not part of the production-equivalent
+// default execution.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { internalBinding, primordials } = require('internal/test/binding');
+const nodeProcess = process;
+
+const [htmlPath, ...flags] = nodeProcess.argv.slice(2);
+if (!htmlPath || flags.some((flag) => !['--deterministic', '--trace'].includes(flag))) {
+  throw new Error('usage: mode --expose-internals tools/browser-env-source-runner.js <challenge.html> [--deterministic] [--trace]');
+}
+
+const root = path.resolve(__dirname, '..');
+const url = 'https://etax.qingdao.chinatax.gov.cn:8443/';
+const ua = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '
+  + '(KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36';
+const html = fs.readFileSync(htmlPath, 'utf8');
+
+function loadBrowserEnvironmentFromSource() {
+  const sourcePath = path.join(root, 'lib', 'internal', 'browser_env.js');
+  const source = fs.readFileSync(sourcePath, 'utf8');
+  const module = { exports: {} };
+  const factory = vm.runInThisContext(
+    `(function(exports, module, require, primordials, internalBinding) {\n${source}\n})`,
+    { filename: sourcePath },
+  );
+  factory(module.exports, module, require, primordials, internalBinding);
+  return module.exports;
+}
+
+function parseAttributes(source) {
+  const attributes = {};
+  const matcher = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+  let match;
+  while ((match = matcher.exec(source)) !== null) {
+    attributes[match[1].toLowerCase()] = match[2] ?? match[3] ?? match[4] ?? '';
+  }
+  return attributes;
+}
+
+function parseChallenge(source) {
+  const metas = Array.from(source.matchAll(/<meta\b([^>]*)>/gi), (match) => parseAttributes(match[1]));
+  const scripts = Array.from(source.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi), (match) => ({
+    attributes: parseAttributes(match[1]),
+    content: match[2],
+  }));
+  const meta = metas.find((tag) => tag.r === 'm');
+  const inline = scripts.find((tag) => tag.attributes.r === 'm' && !tag.attributes.src && tag.content.includes('$_'));
+  const external = scripts.find((tag) => tag.attributes.r === 'm' && tag.attributes.src);
+  if (!meta || !inline || !external) throw new Error('missing r=m challenge parts');
+  return { external: external.attributes.src, inline: inline.content };
+}
+
+function deterministicPrelude() {
+  if (!flags.includes('--deterministic')) return '';
+  return `
+    var __modeSeed = 0x13579bdf;
+    Math.random = function random() {
+      __modeSeed = (__modeSeed * 1664525 + 1013904223) >>> 0;
+      return __modeSeed / 0x100000000;
+    };
+    var __modeRealDate = Date;
+    var __modeTime = 1700000000000;
+    Date = function Date() {
+      if (!new.target) return __modeRealDate();
+      return arguments.length ? Reflect.construct(__modeRealDate, arguments) : new __modeRealDate(__modeTime++);
+    };
+    Date.now = function now() { return __modeTime++; };
+    Date.parse = __modeRealDate.parse;
+    Date.UTC = __modeRealDate.UTC;
+    Date.prototype = __modeRealDate.prototype;
+  `;
+}
+
+function cookieSummary(cookieHeader) {
+  return String(cookieHeader).split(';').flatMap((part) => {
+    const separator = part.indexOf('=');
+    if (separator <= 0) return [];
+    const value = part.slice(separator + 1).trim();
+    let hash = 2166136261;
+    for (let index = 0; index < value.length; index++) {
+      hash = Math.imul(hash ^ value.charCodeAt(index), 16777619);
+    }
+    return [{
+      name: part.slice(0, separator).trim(),
+      valueHash: (hash >>> 0).toString(16),
+      valueLength: value.length,
+    }];
+  });
+}
+
+const traceEnabled = flags.includes('--trace');
+const hook = traceEnabled ?
+  fs.readFileSync(path.join(root, 'js_reverse_cache', 'compare_browser_env_hook.js'), 'utf8') : '';
+const challenge = parseChallenge(html);
+const fileName = path.basename(new URL(challenge.external, url).pathname);
+const outJs = fs.readFileSync(path.join(root, 'rs_mode_server', 'out_js', fileName), 'utf8');
+const { install } = loadBrowserEnvironmentFromSource();
+
+install({
+  url,
+  html,
+  hideNodeGlobals: true,
+  navigator: {
+    appName: 'Netscape',
+    appVersion: ua.replace(/^Mozilla\//, ''),
+    language: 'zh-CN',
+    languages: ['zh-CN', 'zh'],
+    maxTouchPoints: 0,
+    platform: 'Win32',
+    userAgent: ua,
+    vendor: 'Google Inc.',
+    webdriver: false,
+  },
+  screen: {
+    availHeight: 1040,
+    availLeft: 0,
+    availTop: 0,
+    availWidth: 1920,
+    colorDepth: 24,
+    height: 1080,
+    pixelDepth: 24,
+    width: 1920,
+  },
+  window: {
+    properties: {
+      innerHeight: 1080,
+      innerWidth: 1920,
+      outerHeight: 1080,
+      outerWidth: 1920,
+      screenLeft: 0,
+      screenTop: 0,
+      screenX: 0,
+      screenY: 0,
+    },
+  },
+  document: { properties: { visibilityState: 'hidden' } },
+});
+
+const originalConsole = globalThis.console;
+globalThis.console = { debug() {}, error() {}, info() {}, log() {}, warn() {} };
+try {
+  const result = new Function(`${deterministicPrelude()}\n${hook}\n${challenge.inline}\n${outJs}
+    const result = {
+      label: 'source',
+      source: 'lib/internal/browser_env.js',
+      traceEnabled: ${traceEnabled},
+      nodeGlobals: {
+      Buffer: typeof Buffer,
+      clearImmediate: typeof clearImmediate,
+      exports: typeof exports,
+      global: typeof global,
+      module: typeof module,
+      process: typeof process,
+      require: typeof require,
+      setImmediate: typeof setImmediate,
+      },
+      cookies: (${cookieSummary.toString()})(document.cookie),
+    };
+    if (${traceEnabled}) Object.assign(result, __modeEnvTrace.dump('source'));
+    return result;`)();
+  nodeProcess.stdout.write(JSON.stringify(result), () => nodeProcess.exit(0));
+} finally {
+  globalThis.console = originalConsole;
+}

From 78a69aa360379e034a0e9ea10c52aeb6b45540cd Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Sun, 13 Sep 2026 22:36:25 +0800
Subject: [PATCH 27/32] =?UTF-8?q?ci:=20=E8=A1=A5=E5=85=85=E6=B5=8F?=
 =?UTF-8?q?=E8=A7=88=E5=99=A8=E7=8E=AF=E5=A2=83=E8=AF=8A=E6=96=AD=E5=8F=91?=
 =?UTF-8?q?=E5=B8=83=E8=AF=B4=E6=98=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish-native-release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index b45af9161cde..303c606d352f 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -144,6 +144,7 @@ jobs:
             '## 本次更新' \
             '' \
             '- 补全 Mode 浏览器环境的 DOM 对象标签、构造器和集合描述符，降低普通 JavaScript 对象特征。' \
+            '- 新增源码诊断器：可不重新编译而直接以当前工作区的浏览器环境源码执行缓存挑战，用于发布前定位环境差异。' \
             '- `rs_mode_server` 的挑战 Worker 现在隔离 `global`、`process`、`module`、`require`、`setImmediate` 等 Node 全局别名，并取消向挑战脚本注入 CommonJS `require`；保留 `Buffer` 兼容既有挑战脚本。' \
             '- 保持 `document.all`、原始 HTML、动态 UA、Cookie、Storage、location/history 与每请求独立 Worker 的兼容行为。' \
             '' \

From 630229c1d7c7d7e5a29fc0bd0565a3e988dfe783 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 14 Sep 2026 10:03:26 +0800
Subject: [PATCH 28/32] =?UTF-8?q?feat:=20=E8=A1=A5=E9=BD=90=E6=8C=91?=
 =?UTF-8?q?=E6=88=98=E4=BD=BF=E7=94=A8=E7=9A=84=20DOM=20=E4=B8=8E=20BOM=20?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish-native-release.yml |   3 +-
 lib/internal/browser_env.js                  | 245 ++++++++++++++++---
 test/parallel/test-browser-env.js            |  24 +-
 3 files changed, 233 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/publish-native-release.yml b/.github/workflows/publish-native-release.yml
index 303c606d352f..41681bd8efb6 100644
--- a/.github/workflows/publish-native-release.yml
+++ b/.github/workflows/publish-native-release.yml
@@ -143,7 +143,8 @@ jobs:
           printf '%s\n' \
             '## 本次更新' \
             '' \
-            '- 补全 Mode 浏览器环境的 DOM 对象标签、构造器和集合描述符，降低普通 JavaScript 对象特征。' \
+            '- 补齐 `HTMLDivElement`、`HTMLIFrameElement`、空锚点 URL、`NetworkInformation` 与 `BatteryManager`，修正挑战实际创建的 DOM/BOM 对象原型和标签。' \
+            '- 浏览器环境方法现在为常见 `fn.toString()` 检测提供原生函数形态，并保留真实调用行为。' \
             '- 新增源码诊断器：可不重新编译而直接以当前工作区的浏览器环境源码执行缓存挑战，用于发布前定位环境差异。' \
             '- `rs_mode_server` 的挑战 Worker 现在隔离 `global`、`process`、`module`、`require`、`setImmediate` 等 Node 全局别名，并取消向挑战脚本注入 CommonJS `require`；保留 `Buffer` 兼容既有挑战脚本。' \
             '- 保持 `document.all`、原始 HTML、动态 UA、Cookie、Storage、location/history 与每请求独立 Worker 的兼容行为。' \
diff --git a/lib/internal/browser_env.js b/lib/internal/browser_env.js
index 5a8855bc6573..5c3a31d5e3ef 100644
--- a/lib/internal/browser_env.js
+++ b/lib/internal/browser_env.js
@@ -10,6 +10,7 @@ const {
   ObjectCreate,
   ObjectDefineProperty,
   ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyNames,
   ObjectGetPrototypeOf,
   ObjectKeys,
   ObjectSetPrototypeOf,
@@ -72,8 +73,9 @@ const kProtectedWindowProperties = new Set([
   'MutationObserver', 'HTMLAnchorElement', 'HTMLCanvasElement',
   'CanvasRenderingContext2D', 'HTMLFormElement', 'HTMLInputElement',
   'HTMLBodyElement', 'HTMLCollection', 'HTMLHeadElement', 'HTMLHtmlElement',
-  'HTMLMetaElement', 'HTMLScriptElement', 'HTMLTitleElement', 'MimeType',
-  'MimeTypeArray', 'Storage',
+  'HTMLDivElement', 'HTMLIFrameElement', 'HTMLMetaElement', 'HTMLScriptElement',
+  'HTMLTitleElement', 'MimeType', 'MimeTypeArray', 'Storage', 'BatteryManager',
+  'NetworkInformation',
   'indexedDB', 'chrome', 'clientInformation', 'msCrypto', 'name', 'open',
   'prompt', 'webkitRequestFileSystem', 'TEMPORARY',
   'global', 'process', 'Buffer', 'require', 'module', 'exports',
@@ -116,6 +118,37 @@ function defineInternal(target, name, value) {
   });
 }
 
+function markAsNativeFunction(value, name = value.name) {
+  if (typeof value !== 'function') return value;
+  if (value.name !== name) {
+    ObjectDefineProperty(value, 'name', {
+      __proto__: null,
+      configurable: true,
+      enumerable: false,
+      value: name,
+      writable: false,
+    });
+  }
+  ObjectDefineProperty(value, 'toString', {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    value: function toString() { return `function ${name}() { [native code] }`; },
+    writable: true,
+  });
+  return value;
+}
+
+function markNativePrototype(prototype) {
+  for (const name of ObjectGetOwnPropertyNames(prototype)) {
+    if (name === 'constructor') continue;
+    const descriptor = ObjectGetOwnPropertyDescriptor(prototype, name);
+    if (typeof descriptor?.value === 'function') markAsNativeFunction(descriptor.value);
+    if (typeof descriptor?.get === 'function') markAsNativeFunction(descriptor.get);
+    if (typeof descriptor?.set === 'function') markAsNativeFunction(descriptor.set);
+  }
+}
+
 function createEventTarget(target) {
   const listeners = new Map();
   ObjectDefineProperty(target, '_listeners', {
@@ -129,7 +162,7 @@ function createEventTarget(target) {
     __proto__: null,
     configurable: true,
     enumerable: false,
-    value: function addEventListener(type, callback) {
+    value: markAsNativeFunction(function addEventListener(type, callback) {
       if (typeof callback !== 'function') return;
       const key = String(type);
       let callbacks = listeners.get(key);
@@ -138,26 +171,26 @@ function createEventTarget(target) {
         listeners.set(key, callbacks);
       }
       if (!ArrayPrototypeIncludes(callbacks, callback)) ArrayPrototypePush(callbacks, callback);
-    },
+    }),
     writable: true,
   });
   ObjectDefineProperty(target, 'removeEventListener', {
     __proto__: null,
     configurable: true,
     enumerable: false,
-    value: function removeEventListener(type, callback) {
+    value: markAsNativeFunction(function removeEventListener(type, callback) {
       const callbacks = listeners.get(String(type));
       if (callbacks === undefined) return;
       const index = callbacks.indexOf(callback);
       if (index !== -1) callbacks.splice(index, 1);
-    },
+    }),
     writable: true,
   });
   ObjectDefineProperty(target, 'dispatchEvent', {
     __proto__: null,
     configurable: true,
     enumerable: false,
-    value: function dispatchEvent(event) {
+    value: markAsNativeFunction(function dispatchEvent(event) {
       if (event === null || typeof event !== 'object' || !event.type) {
         throw new TypeError('dispatchEvent requires an event with a type');
       }
@@ -172,7 +205,7 @@ function createEventTarget(target) {
       const handler = this[`on${event.type}`];
       if (typeof handler === 'function') FunctionPrototypeCall(handler, this, event);
       return !event.defaultPrevented;
-    },
+    }),
     writable: true,
   });
   return target;
@@ -361,6 +394,7 @@ class BrowserElement extends BrowserNode {
       case 'meta': return 'HTMLMetaElement';
       case 'script': return 'HTMLScriptElement';
       case 'title': return 'HTMLTitleElement';
+      case 'iframe': return 'HTMLIFrameElement';
       default: return `HTML${this.localName[0].toUpperCase()}${this.localName.slice(1)}Element`;
     }
   }
@@ -517,6 +551,26 @@ class HTMLBodyElement extends BrowserElement {
   }
 }
 
+class HTMLDivElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'div');
+  }
+}
+
+class HTMLIFrameElement extends BrowserElement {
+  constructor(ownerDocument) {
+    super(ownerDocument, 'iframe');
+  }
+
+  get contentDocument() {
+    return null;
+  }
+
+  get contentWindow() {
+    return null;
+  }
+}
+
 class HTMLMetaElement extends BrowserElement {
   constructor(ownerDocument) {
     super(ownerDocument, 'meta');
@@ -545,21 +599,21 @@ class HTMLAnchorElement extends BrowserElement {
   }
 
   get href() {
-    return this._url.href;
+    return this.getAttribute('href') === null ? '' : this._url.href;
   }
 
   set href(value) {
     this.setAttribute('href', value);
   }
 
-  get origin() { return this._url.origin; }
-  get protocol() { return this._url.protocol; }
-  get host() { return this._url.host; }
-  get hostname() { return this._url.hostname; }
-  get port() { return this._url.port; }
-  get pathname() { return this._url.pathname; }
-  get search() { return this._url.search; }
-  get hash() { return this._url.hash; }
+  get origin() { return this.getAttribute('href') === null ? '' : this._url.origin; }
+  get protocol() { return this.getAttribute('href') === null ? '' : this._url.protocol; }
+  get host() { return this.getAttribute('href') === null ? '' : this._url.host; }
+  get hostname() { return this.getAttribute('href') === null ? '' : this._url.hostname; }
+  get port() { return this.getAttribute('href') === null ? '' : this._url.port; }
+  get pathname() { return this.getAttribute('href') === null ? '' : this._url.pathname; }
+  get search() { return this.getAttribute('href') === null ? '' : this._url.search; }
+  get hash() { return this.getAttribute('href') === null ? '' : this._url.hash; }
 }
 
 class CanvasRenderingContext2D {
@@ -742,6 +796,8 @@ class BrowserDocument extends BrowserNode {
         return new HTMLBodyElement(this);
       case 'canvas':
         return new HTMLCanvasElement(this);
+      case 'div':
+        return new HTMLDivElement(this);
       case 'form':
         return new HTMLFormElement(this);
       case 'head':
@@ -750,6 +806,8 @@ class BrowserDocument extends BrowserNode {
         return new HTMLHtmlElement(this);
       case 'input':
         return new HTMLInputElement(this);
+      case 'iframe':
+        return new HTMLIFrameElement(this);
       case 'meta':
         return new HTMLMetaElement(this);
       case 'script':
@@ -991,10 +1049,10 @@ function createLocation(href) {
       },
     });
   }
-  location.assign = function assign(value) { replace(value); };
-  location.replace = function replaceLocation(value) { replace(value); };
-  location.reload = function reload() {};
-  location.toString = function toString() { return url.href; };
+  location.assign = markAsNativeFunction(function assign(value) { replace(value); });
+  location.replace = markAsNativeFunction(function replaceLocation(value) { replace(value); }, 'replace');
+  location.reload = markAsNativeFunction(function reload() {});
+  location.toString = markAsNativeFunction(function toString() { return url.href; });
   ObjectDefineProperty(location, 'ancestorOrigins', {
     __proto__: null,
     configurable: false,
@@ -1051,6 +1109,82 @@ function createHistory(location) {
   };
 }
 
+function createNetworkInformation(values) {
+  function NetworkInformation() {
+    throw new TypeError('Illegal constructor');
+  }
+  const connection = ObjectCreate(NetworkInformation.prototype);
+  defineInternal(connection, '_values', values);
+  defineInternal(connection, '_onchange', values.onchange ?? null);
+  for (const name of ['downlink', 'effectiveType', 'rtt', 'saveData']) {
+    ObjectDefineProperty(NetworkInformation.prototype, name, {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      get() { return this._values[name]; },
+    });
+  }
+  ObjectDefineProperty(NetworkInformation.prototype, 'onchange', {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() { return this._onchange; },
+    set(value) { this._onchange = value; },
+  });
+  ObjectDefineProperty(NetworkInformation.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'NetworkInformation',
+  });
+  markAsNativeFunction(NetworkInformation);
+  markNativePrototype(NetworkInformation.prototype);
+  return { NetworkInformation, connection };
+}
+
+function createBatteryManagerFactory() {
+  function BatteryManager() {
+    throw new TypeError('Illegal constructor');
+  }
+  for (const name of [
+    'charging', 'chargingTime', 'dischargingTime', 'level',
+    'onchargingchange', 'onchargingtimechange', 'ondischargingtimechange',
+    'onlevelchange',
+  ]) {
+    ObjectDefineProperty(BatteryManager.prototype, name, {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      get() { return this._values[name]; },
+      set(value) { this._values[name] = value; },
+    });
+  }
+  ObjectDefineProperty(BatteryManager.prototype, Symbol.toStringTag, {
+    __proto__: null,
+    configurable: true,
+    value: 'BatteryManager',
+  });
+  markAsNativeFunction(BatteryManager);
+  markNativePrototype(BatteryManager.prototype);
+  return {
+    BatteryManager,
+    createBattery() {
+      const battery = ObjectCreate(BatteryManager.prototype);
+      defineInternal(battery, '_values', {
+        charging: true,
+        chargingTime: Infinity,
+        dischargingTime: Infinity,
+        level: 0.8,
+        onchargingchange: null,
+        onchargingtimechange: null,
+        ondischargingtimechange: null,
+        onlevelchange: null,
+      });
+      createEventTarget(battery);
+      return battery;
+    },
+  };
+}
+
 function createNavigator(values) {
   function Navigator() {
     throw new TypeError('Illegal constructor');
@@ -1060,7 +1194,7 @@ function createNavigator(values) {
       __proto__: null,
       configurable: true,
       enumerable: true,
-      get() { return value; },
+      get: markAsNativeFunction(function getNavigatorValue() { return value; }, `get ${key}`),
     });
   }
   ObjectDefineProperty(Navigator.prototype, Symbol.toStringTag, {
@@ -1069,6 +1203,8 @@ function createNavigator(values) {
     value: 'Navigator',
   });
   const navigator = ObjectCreate(Navigator.prototype);
+  markAsNativeFunction(Navigator);
+  markNativePrototype(Navigator.prototype);
   return { Navigator, navigator };
 }
 
@@ -1326,6 +1462,37 @@ function createChrome() {
   };
 }
 
+function markBrowserInterfaces() {
+  for (const constructor of [
+    BrowserEvent,
+    BrowserNode,
+    BrowserText,
+    BrowserElement,
+    HTMLHtmlElement,
+    HTMLHeadElement,
+    HTMLBodyElement,
+    HTMLDivElement,
+    HTMLIFrameElement,
+    HTMLMetaElement,
+    HTMLScriptElement,
+    HTMLTitleElement,
+    HTMLAnchorElement,
+    HTMLCanvasElement,
+    CanvasRenderingContext2D,
+    HTMLFormElement,
+    HTMLInputElement,
+    BrowserDocument,
+    HTMLCollection,
+    DOMStringList,
+    Storage,
+    MimeType,
+    MimeTypeArray,
+  ]) {
+    markAsNativeFunction(constructor);
+    markNativePrototype(constructor.prototype);
+  }
+}
+
 function assertCustomPropertyName(name, protectedNames, targetName) {
   if (protectedNames.has(name)) {
     throw new TypeError(`${targetName}.${name} is a protected browser environment property`);
@@ -1395,6 +1562,7 @@ function install(options) {
   validateCustomDescriptors(options.window?.descriptors, kProtectedWindowProperties, 'window');
   validateCustomProperties(options.document?.properties, kProtectedDocumentProperties, 'document');
   validateCustomDescriptors(options.document?.descriptors, kProtectedDocumentProperties, 'document');
+  markBrowserInterfaces();
 
   const location = createLocation(getHref(options));
   const document = new BrowserDocument(location);
@@ -1421,22 +1589,17 @@ function install(options) {
     navigatorValues.appVersion = String(navigatorValues.userAgent).replace(/^Mozilla\//, '');
   }
   if (ArrayIsArray(navigatorValues.mimeTypes)) navigatorValues.mimeTypes = createMimeTypeArray(navigatorValues.mimeTypes);
-  if (navigatorValues.sendBeacon === undefined) navigatorValues.sendBeacon = function sendBeacon() { return true; };
+  assertObject(navigatorValues.connection, 'navigator.connection');
+  const { NetworkInformation, connection } = createNetworkInformation(navigatorValues.connection);
+  navigatorValues.connection = connection;
+  const { BatteryManager, createBattery } = createBatteryManagerFactory();
+  if (navigatorValues.sendBeacon === undefined) {
+    navigatorValues.sendBeacon = markAsNativeFunction(function sendBeacon() { return true; });
+  }
   if (navigatorValues.getBattery === undefined) {
-    navigatorValues.getBattery = function getBattery() {
-      const battery = {
-        charging: true,
-        chargingTime: Infinity,
-        dischargingTime: Infinity,
-        level: 0.8,
-        onchargingchange: null,
-        onchargingtimechange: null,
-        ondischargingtimechange: null,
-        onlevelchange: null,
-      };
-      createEventTarget(battery);
-      return Promise.resolve(battery);
-    };
+    navigatorValues.getBattery = markAsNativeFunction(function getBattery() {
+      return Promise.resolve(createBattery());
+    });
   }
   const { Navigator, navigator } = createNavigator(navigatorValues);
   const screen = {
@@ -1491,6 +1654,10 @@ function install(options) {
   function Location() {
     throw new TypeError('Illegal constructor');
   }
+  for (const constructor of [Window, History, Screen, Location]) {
+    markAsNativeFunction(constructor);
+    markNativePrototype(constructor.prototype);
+  }
   ObjectSetPrototypeOf(Window.prototype, ObjectGetPrototypeOf(globalThis));
   ObjectSetPrototypeOf(globalThis, Window.prototype);
   ObjectSetPrototypeOf(history, History.prototype);
@@ -1536,15 +1703,19 @@ function install(options) {
   ObjectDefineProperty(globalThis, 'HTMLCanvasElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLCanvasElement, writable: true });
   ObjectDefineProperty(globalThis, 'CanvasRenderingContext2D', { __proto__: null, configurable: true, enumerable: false, value: CanvasRenderingContext2D, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLCollection', { __proto__: null, configurable: true, enumerable: false, value: HTMLCollection, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLDivElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLDivElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLFormElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLFormElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLHeadElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLHeadElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLHtmlElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLHtmlElement, writable: true });
+  ObjectDefineProperty(globalThis, 'HTMLIFrameElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLIFrameElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLInputElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLInputElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLMetaElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLMetaElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLScriptElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLScriptElement, writable: true });
   ObjectDefineProperty(globalThis, 'HTMLTitleElement', { __proto__: null, configurable: true, enumerable: false, value: HTMLTitleElement, writable: true });
   ObjectDefineProperty(globalThis, 'MimeType', { __proto__: null, configurable: true, enumerable: false, value: MimeType, writable: true });
   ObjectDefineProperty(globalThis, 'MimeTypeArray', { __proto__: null, configurable: true, enumerable: false, value: MimeTypeArray, writable: true });
+  ObjectDefineProperty(globalThis, 'BatteryManager', { __proto__: null, configurable: true, enumerable: false, value: BatteryManager, writable: true });
+  ObjectDefineProperty(globalThis, 'NetworkInformation', { __proto__: null, configurable: true, enumerable: false, value: NetworkInformation, writable: true });
   ObjectDefineProperty(globalThis, 'Storage', { __proto__: null, configurable: true, enumerable: false, value: Storage, writable: true });
   ObjectDefineProperty(globalThis, 'DOMParser', { __proto__: null, configurable: true, enumerable: false, value: DOMParser, writable: true });
   ObjectDefineProperty(globalThis, 'XMLHttpRequest', { __proto__: null, configurable: true, enumerable: false, value: XMLHttpRequest, writable: true });
diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index 94efff6d8472..fd66fce7ab58 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -106,10 +106,17 @@ spawnSyncAndAssert(process.execPath, [
       assert.strictEqual(navigator.appName, 'Netscape');
       assert.strictEqual(navigator.appVersion, '5.0 ModeTest');
       assert.strictEqual(navigator.connection.effectiveType, '4g');
+      assert(navigator.connection instanceof NetworkInformation);
+      assert.strictEqual(Object.prototype.toString.call(navigator.connection), '[object NetworkInformation]');
+      assert.deepStrictEqual(Object.keys(navigator.connection), []);
       assert.strictEqual(navigator.mimeTypes.length, 2);
       assert.strictEqual(navigator.mimeTypes.namedItem('application/pdf').suffixes, 'pdf');
       assert.strictEqual(navigator.sendBeacon('/beacon', 'body'), true);
-      assert.strictEqual((await navigator.getBattery()).charging, true);
+      assert.match(String(navigator.getBattery), /^function getBattery\(\) \{ \[native code\] \}$/);
+      const battery = await navigator.getBattery();
+      assert(battery instanceof BatteryManager);
+      assert.strictEqual(Object.prototype.toString.call(battery), '[object BatteryManager]');
+      assert.strictEqual(battery.charging, true);
 
       assert(document instanceof Document);
       assert(document.body instanceof HTMLElement);
@@ -128,11 +135,26 @@ spawnSyncAndAssert(process.execPath, [
       assert.deepStrictEqual(document.createExpression(), Object.create(null));
 
       const anchor = document.createElement('a');
+      assert.strictEqual(anchor.href, '');
       anchor.href = '/next?q=1#hash';
       assert(anchor instanceof HTMLAnchorElement);
       assert.strictEqual(anchor.href, 'https://example.test/next?q=1#hash');
       assert.strictEqual(anchor.host, 'example.test');
 
+      const div = document.createElement('div');
+      assert(div instanceof HTMLDivElement);
+      assert.strictEqual(div.constructor, HTMLDivElement);
+      assert.strictEqual(Object.prototype.toString.call(div), '[object HTMLDivElement]');
+      assert.match(String(div.getAttribute), /^function getAttribute\(\) \{ \[native code\] \}$/);
+
+      const iframe = document.createElement('iframe');
+      assert(iframe instanceof HTMLIFrameElement);
+      assert.strictEqual(iframe.constructor, HTMLIFrameElement);
+      assert.strictEqual(Object.prototype.toString.call(iframe), '[object HTMLIFrameElement]');
+      assert.strictEqual(iframe.contentDocument, null);
+      assert.strictEqual(iframe.contentWindow, null);
+      assert.match(String(location.assign), /^function assign\(\) \{ \[native code\] \}$/);
+
       const meta = document.querySelector('#challenge');
       assert(meta instanceof HTMLMetaElement);
       assert.strictEqual(Object.prototype.toString.call(meta), '[object HTMLMetaElement]');

From 843a760390cb0e1abaebc2e6e59b399663717662 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 14 Sep 2026 13:42:59 +0800
Subject: [PATCH 29/32] =?UTF-8?q?test:=20=E4=BF=AE=E6=AD=A3=E5=8E=9F?=
 =?UTF-8?q?=E7=94=9F=E5=87=BD=E6=95=B0=E5=BD=A2=E6=80=81=E6=96=AD=E8=A8=80?=
 =?UTF-8?q?=E8=BD=AC=E4=B9=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 test/parallel/test-browser-env.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/parallel/test-browser-env.js b/test/parallel/test-browser-env.js
index fd66fce7ab58..15842d317b77 100644
--- a/test/parallel/test-browser-env.js
+++ b/test/parallel/test-browser-env.js
@@ -112,7 +112,7 @@ spawnSyncAndAssert(process.execPath, [
       assert.strictEqual(navigator.mimeTypes.length, 2);
       assert.strictEqual(navigator.mimeTypes.namedItem('application/pdf').suffixes, 'pdf');
       assert.strictEqual(navigator.sendBeacon('/beacon', 'body'), true);
-      assert.match(String(navigator.getBattery), /^function getBattery\(\) \{ \[native code\] \}$/);
+      assert.strictEqual(String(navigator.getBattery), 'function getBattery() { [native code] }');
       const battery = await navigator.getBattery();
       assert(battery instanceof BatteryManager);
       assert.strictEqual(Object.prototype.toString.call(battery), '[object BatteryManager]');
@@ -145,7 +145,7 @@ spawnSyncAndAssert(process.execPath, [
       assert(div instanceof HTMLDivElement);
       assert.strictEqual(div.constructor, HTMLDivElement);
       assert.strictEqual(Object.prototype.toString.call(div), '[object HTMLDivElement]');
-      assert.match(String(div.getAttribute), /^function getAttribute\(\) \{ \[native code\] \}$/);
+      assert.strictEqual(String(div.getAttribute), 'function getAttribute() { [native code] }');
 
       const iframe = document.createElement('iframe');
       assert(iframe instanceof HTMLIFrameElement);
@@ -153,7 +153,7 @@ spawnSyncAndAssert(process.execPath, [
       assert.strictEqual(Object.prototype.toString.call(iframe), '[object HTMLIFrameElement]');
       assert.strictEqual(iframe.contentDocument, null);
       assert.strictEqual(iframe.contentWindow, null);
-      assert.match(String(location.assign), /^function assign\(\) \{ \[native code\] \}$/);
+      assert.strictEqual(String(location.assign), 'function assign() { [native code] }');
 
       const meta = document.querySelector('#challenge');
       assert(meta instanceof HTMLMetaElement);

From ee08495187e87c709f632e2b989e5226e2cc40aa Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 14 Sep 2026 16:29:03 +0800
Subject: [PATCH 30/32] =?UTF-8?q?docs:=20=E6=80=BB=E7=BB=93=20Mode=20?=
 =?UTF-8?q?=E6=B5=8F=E8=A7=88=E5=99=A8=E7=8E=AF=E5=A2=83=E6=94=B9=E5=8A=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 47 +++++++++++++++++++++++++++++++++++++----------
 1 file changed, 37 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 30b7aa6ccbb9..208d4c0358f6 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ runtime environment. It is intended for running JavaScript that expects common
 browser globals, without embedding Chromium or rendering a page.
 
 > The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260911_v22.0.5`; the `v22.0.5` part is
+> one date-stamped tag, such as `mode_20260914_v22.0.10`; the `v22.0.10` part is
 > the Mode release label, not a claim about the embedded upstream Node.js version.
 
 ## Mode browser environment
@@ -16,21 +16,21 @@ Download the archive that matches the host CPU from [GitHub Releases][mode-relea
 
 | Platform | Unified release | Archive |
 | --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260912_v22.0.7][mode-release] | `mode_mac_arm_20260912_v22.0.7.tar.gz` |
-| Windows x64 | [mode_20260912_v22.0.7][mode-release] | `mode_win_x64_20260912_v22.0.7.zip` |
-| Linux x64 | [mode_20260912_v22.0.7][mode-release] | `mode_linux_x64_20260912_v22.0.7.tar.gz` |
+| macOS Apple Silicon (ARM64) | [mode_20260914_v22.0.10][mode-release] | `mode_mac_arm_20260914_v22.0.10.tar.gz` |
+| Windows x64 | [mode_20260914_v22.0.10][mode-release] | `mode_win_x64_20260914_v22.0.10.zip` |
+| Linux x64 | [mode_20260914_v22.0.10][mode-release] | `mode_linux_x64_20260914_v22.0.10.tar.gz` |
 
 On macOS or Linux, extract the archive and place `mode` on `PATH`:
 
 ```bash
-tar -xzf mode_linux_x64_20260911_v22.0.5.tar.gz
+tar -xzf mode_linux_x64_20260914_v22.0.10.tar.gz
 mkdir -p "$HOME/.local/bin"
-install -m 755 mode_linux_x64_20260911_v22.0.5/mode "$HOME/.local/bin/mode"
+install -m 755 mode_linux_x64_20260914_v22.0.10/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
 mode --version
 ```
 
-Use `mode_mac_arm_20260911_v22.0.5` in the commands above for macOS Apple Silicon.
+Use `mode_mac_arm_20260914_v22.0.10` in the commands above for macOS Apple Silicon.
 Add the `export PATH=...` line to the shell startup file if the command should
 remain available in future terminals.
 
@@ -38,8 +38,8 @@ On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
 directory to `PATH`:
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260911_v22.0.5.zip
-.\mode_win_x64_20260911_v22.0.5\mode.exe --version
+Expand-Archive .\mode_win_x64_20260914_v22.0.10.zip
+.\mode_win_x64_20260914_v22.0.10\mode.exe --version
 ```
 
 Verify that the installed executable has the Mode extension:
@@ -77,6 +77,33 @@ output, WebGL, XHR emulation that makes network requests, real navigation, or
 automatic execution of `<script>` tags contained in the initial HTML. It is a
 script compatibility environment, not a headless browser.
 
+### 相对官方 Node.js 的改动（Mode v22.0.10）
+
+官方 Node.js 保持服务器端 JavaScript 运行时定位：没有 `window`、`document`
+或浏览器启动配置。本仓库在不嵌入 Chromium 的前提下，新增了下面的可选浏览器
+兼容层；未启用时普通 Node.js 的运行方式不变。
+
+| 范围 | 官方 Node.js | Mode 的新增/修改 |
+| --- | --- | --- |
+| 启动与模块 | 没有内置浏览器环境模块或对应 CLI 参数。 | 新增公开内置模块 `node:browser-env`（CommonJS 与 ESM 均可加载）和 `--browser-env-profile=file`；profile 会在入口脚本运行前安装环境。 |
+| Realm 生命周期 | 没有浏览器环境安装状态。 | `install(options)` 仅影响当前 Realm、只能安装一次，并返回 `window`、`document`、`navigator`、`location`；可用 JSON profile 或代码对象配置 URL、HTML、UA、screen、Cookie、Storage 与自定义属性。 |
+| DOM | 没有 `document` 或 HTML 树。 | 新增轻量 DOM：解析传入的 HTML，支持节点增删改、属性、文本、`getElementById()`、`getElementsBy*()`、`querySelector()`、`querySelectorAll()`、事件接口及 `DOMParser`。提供 `HTMLHtmlElement`、`HTMLHeadElement`、`HTMLBodyElement`、`HTMLDivElement`、`HTMLAnchorElement`、`HTMLFormElement`、`HTMLInputElement`、`HTMLIFrameElement`、`HTMLMetaElement`、`HTMLScriptElement`、`HTMLTitleElement` 等常用构造器。 |
+| `window` 与 BOM | 没有 `window`、`location`、`history`、`navigator`、`screen`。 | 安装后 `window`、`self`、`top`、`parent` 与 `globalThis` 指向同一对象；提供虚拟 `location/history`、可配置的 `navigator/screen`、窗口尺寸、`NetworkInformation`、`BatteryManager`、MIME 类型及 `sendBeacon()`。 |
+| Cookie 与存储 | 没有浏览器 Cookie/Storage 接口。 | 每个已安装 Realm 有内存 `document.cookie`、`localStorage` 与 `sessionStorage`；`rs_mode_server` 会为每个请求创建独立 Worker，状态不会跨请求泄漏。 |
+| 浏览器特征兼容 | 没有 `document.all`，也没有 DOM/BOM 方法形态。 | 通过 Node/V8 内部 binding 实现不可检测对象语义的 `document.all`，覆盖特殊 `typeof`、布尔值、宽松相等、索引、命名查找与调用；常见的 `fn.toString()` 检查会看到原生函数形态。 |
+| 兼容存根 | 没有这些浏览器全局。 | 提供 `XMLHttpRequest` 状态/参数记录、`MutationObserver`、`indexedDB`、`chrome` 元数据、`open()`、`prompt()`、`msCrypto` 别名和确定性的 Canvas 表面，供常见探测脚本继续运行。它们不是完整浏览器实现。 |
+| Node 特征隔离 | Node 全局默认可见。 | `install({ hideNodeGlobals: true })` 可在该 Realm 删除可配置的 `global`、`process`、`require`、`module`、`exports`、路径与 immediate 别名。默认关闭，普通 Mode 脚本仍保留 Node 入口；`rs_mode_server` 的挑战 Worker 会开启它，同时保留 `Buffer` 以兼容实际挑战脚本。 |
+
+当前版本已用真实目标的连续请求验证可得到 HTTP 200；这证明已覆盖该目标读取到的
+环境路径，不代表 Mode 已成为完整 Chromium 或保证所有站点都能通过指纹检测。
+
+#### 明确边界
+
+Mode 不提供页面渲染、CSS/layout、真实 iframe 文档、Canvas 像素/图形指纹、WebGL、
+WebRTC、AudioContext、Worker 浏览器 API、真实页面导航，或初始 HTML 中 `<script>` 的
+自动执行。`XMLHttpRequest` 仅记录 `open()`/`send()` 状态和参数，不发出网络请求；如需
+这些能力，应使用真实浏览器或在目标代码外自行完成网络调用。
+
 ### Start an existing script with a JSON profile
 
 The `--browser-env-profile` option installs the environment before the target
@@ -1090,7 +1117,7 @@ additions comply with the project’s license guidelines.
 [Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
 [Contributing to the project]: CONTRIBUTING.md
 [browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260912_v22.0.7
+[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260914_v22.0.10
 [mode-releases]: https://github.com/wen2go/mode/releases
 [Node.js website]: https://nodejs.org/
 [OpenJS Foundation]: https://openjsf.org/

From bb00fd22cb9a517e2b9c0cfaeceb563a5e9e609a Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 14 Sep 2026 16:56:13 +0800
Subject: [PATCH 31/32] =?UTF-8?q?docs:=20=E7=B2=BE=E7=AE=80=20Mode=20?=
 =?UTF-8?q?=E9=A1=B9=E7=9B=AE=E8=AF=B4=E6=98=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 1144 +++--------------------------------------------------
 1 file changed, 63 insertions(+), 1081 deletions(-)

diff --git a/README.md b/README.md
index 208d4c0358f6..e1ee037d6189 100644
--- a/README.md
+++ b/README.md
@@ -1,1126 +1,108 @@
 # Mode
 
-Mode is a Node.js distribution with an optional lightweight browser-compatible
-runtime environment. It is intended for running JavaScript that expects common
-browser globals, without embedding Chromium or rendering a page.
+Mode 是基于 Node.js 的定制运行时。默认仍可像 Node.js 一样执行 JavaScript；在显式
+启用后，它会在当前 Realm 注入轻量浏览器兼容环境，以运行依赖常见 DOM/BOM 的脚本，
+而不需要嵌入 Chromium 或启动图形浏览器。
 
-> The executable keeps the upstream Node.js version string. Mode releases use
-> one date-stamped tag, such as `mode_20260914_v22.0.10`; the `v22.0.10` part is
-> the Mode release label, not a claim about the embedded upstream Node.js version.
+当前发布版：[`mode_20260914_v22.0.10`](https://github.com/wen2go/mode/releases/tag/mode_20260914_v22.0.10)。
 
-## Mode browser environment
+## 与官方 Node.js 的区别
 
-### Install
+| 范围 | 官方 Node.js | Mode |
+| --- | --- | --- |
+| 启用方式 | 没有浏览器环境。 | 新增 `node:browser-env` 内置模块（CommonJS/ESM）和 `--browser-env-profile=file`。未启用时保持普通 Node.js 行为。 |
+| DOM | 没有 `window`、`document` 或 HTML 树。 | 提供轻量 DOM、HTML 解析、节点/属性增删改、文本、查询 API、事件、`DOMParser` 及常用 HTML 元素构造器。 |
+| BOM | 没有浏览器的 `location`、`history`、`navigator`、`screen`。 | 提供虚拟 `location/history`，可配置 UA、平台、语言、屏幕和窗口尺寸，以及 `NetworkInformation`、`BatteryManager`、MIME 类型、`sendBeacon()`。 |
+| Cookie 与存储 | 没有浏览器 Cookie/Storage 接口。 | 提供内存 `document.cookie`、`localStorage`、`sessionStorage`。 |
+| 浏览器特征 | 没有 `document.all`。 | 使用 Node/V8 内部 binding 提供特殊 `document.all` 语义，并为常见 `fn.toString()` 检查提供原生函数形态。 |
+| 兼容存根 | 没有这些浏览器全局。 | 提供 `XMLHttpRequest` 状态/参数记录、`MutationObserver`、`indexedDB`、`chrome` 元数据、`open()`、`prompt()`、`msCrypto` 别名和确定性的 Canvas 表面。 |
+| RS 本地服务 | 不提供。 | `rs_mode_server/server.js` 以每请求独立 Worker 执行挑战脚本；可使用原始 HTML、动态 UA、Cookie、Storage 和 Mode DOM/BOM。 |
 
-Download the archive that matches the host CPU from [GitHub Releases][mode-releases]:
+## 安装与启动
 
-| Platform | Unified release | Archive |
-| --- | --- | --- |
-| macOS Apple Silicon (ARM64) | [mode_20260914_v22.0.10][mode-release] | `mode_mac_arm_20260914_v22.0.10.tar.gz` |
-| Windows x64 | [mode_20260914_v22.0.10][mode-release] | `mode_win_x64_20260914_v22.0.10.zip` |
-| Linux x64 | [mode_20260914_v22.0.10][mode-release] | `mode_linux_x64_20260914_v22.0.10.tar.gz` |
+从 [GitHub Releases](https://github.com/wen2go/mode/releases/tag/mode_20260914_v22.0.10)
+下载与系统匹配的文件：
 
-On macOS or Linux, extract the archive and place `mode` on `PATH`:
+| 平台 | 文件 |
+| --- | --- |
+| macOS Apple Silicon | `mode_mac_arm_20260914_v22.0.10.tar.gz` |
+| Linux x64 | `mode_linux_x64_20260914_v22.0.10.tar.gz` |
+| Windows x64 | `mode_win_x64_20260914_v22.0.10.zip` |
+
+macOS/Linux：
 
 ```bash
 tar -xzf mode_linux_x64_20260914_v22.0.10.tar.gz
 mkdir -p "$HOME/.local/bin"
 install -m 755 mode_linux_x64_20260914_v22.0.10/mode "$HOME/.local/bin/mode"
 export PATH="$HOME/.local/bin:$PATH"
-mode --version
+mode -e "console.log(typeof require('node:browser-env').install)"
 ```
 
-Use `mode_mac_arm_20260914_v22.0.10` in the commands above for macOS Apple Silicon.
-Add the `export PATH=...` line to the shell startup file if the command should
-remain available in future terminals.
+macOS Apple Silicon 请把文件和目录名替换为 `mode_mac_arm_20260914_v22.0.10`。
+最后一条命令输出 `function` 即表示当前 shell 正在使用 Mode。
 
-On Windows, extract the ZIP, then run `mode.exe` from its directory or add that
-directory to `PATH`:
+Windows：解压 ZIP 后运行：
 
 ```powershell
-Expand-Archive .\mode_win_x64_20260914_v22.0.10.zip
-.\mode_win_x64_20260914_v22.0.10\mode.exe --version
+.\mode_win_x64_20260914_v22.0.10\mode.exe -e "console.log(typeof require('node:browser-env').install)"
 ```
 
-Verify that the installed executable has the Mode extension:
-
-```bash
-mode -e "console.log(typeof require('node:browser-env').install)"
-```
-
-It must print `function`. If it reports `Cannot find module 'node:browser-env'`,
-the shell is running a different Node.js executable.
-
-### What it provides
-
-After installation, Mode can create these browser-like globals in the current
-JavaScript Realm:
-
-* `window`, `self`, and `globalThis` identity aliases.
-* `document` with a lightweight DOM tree, HTML parsing, element creation,
-  append/remove/update operations, and common query APIs such as
-  `getElementById()`, `querySelector()`, and `querySelectorAll()`.
-* Native-compatible `document.all`, including its special `typeof`, boolean,
-  loose-equality, indexed, and named-lookup behavior.
-* Virtual `location` and `history` objects.
-* Profiled `navigator` and `screen` values.
-* In-memory `document.cookie`, `localStorage`, and `sessionStorage`.
-* Basic DOM event-target methods: `addEventListener()`, `removeEventListener()`,
-  and `dispatchEvent()`.
-* `DOMParser`, basic `XMLHttpRequest` state transitions and argument capture,
-  `MutationObserver`, `indexedDB`, Chrome app metadata, and common DOM
-  constructors such as `HTMLAnchorElement`, `HTMLFormElement`, and
-  `HTMLCanvasElement`.
-
-It deliberately does **not** provide a renderer, layout engine, Canvas pixel
-output, WebGL, XHR emulation that makes network requests, real navigation, or
-automatic execution of `<script>` tags contained in the initial HTML. It is a
-script compatibility environment, not a headless browser.
-
-### 相对官方 Node.js 的改动（Mode v22.0.10）
-
-官方 Node.js 保持服务器端 JavaScript 运行时定位：没有 `window`、`document`
-或浏览器启动配置。本仓库在不嵌入 Chromium 的前提下，新增了下面的可选浏览器
-兼容层；未启用时普通 Node.js 的运行方式不变。
-
-| 范围 | 官方 Node.js | Mode 的新增/修改 |
-| --- | --- | --- |
-| 启动与模块 | 没有内置浏览器环境模块或对应 CLI 参数。 | 新增公开内置模块 `node:browser-env`（CommonJS 与 ESM 均可加载）和 `--browser-env-profile=file`；profile 会在入口脚本运行前安装环境。 |
-| Realm 生命周期 | 没有浏览器环境安装状态。 | `install(options)` 仅影响当前 Realm、只能安装一次，并返回 `window`、`document`、`navigator`、`location`；可用 JSON profile 或代码对象配置 URL、HTML、UA、screen、Cookie、Storage 与自定义属性。 |
-| DOM | 没有 `document` 或 HTML 树。 | 新增轻量 DOM：解析传入的 HTML，支持节点增删改、属性、文本、`getElementById()`、`getElementsBy*()`、`querySelector()`、`querySelectorAll()`、事件接口及 `DOMParser`。提供 `HTMLHtmlElement`、`HTMLHeadElement`、`HTMLBodyElement`、`HTMLDivElement`、`HTMLAnchorElement`、`HTMLFormElement`、`HTMLInputElement`、`HTMLIFrameElement`、`HTMLMetaElement`、`HTMLScriptElement`、`HTMLTitleElement` 等常用构造器。 |
-| `window` 与 BOM | 没有 `window`、`location`、`history`、`navigator`、`screen`。 | 安装后 `window`、`self`、`top`、`parent` 与 `globalThis` 指向同一对象；提供虚拟 `location/history`、可配置的 `navigator/screen`、窗口尺寸、`NetworkInformation`、`BatteryManager`、MIME 类型及 `sendBeacon()`。 |
-| Cookie 与存储 | 没有浏览器 Cookie/Storage 接口。 | 每个已安装 Realm 有内存 `document.cookie`、`localStorage` 与 `sessionStorage`；`rs_mode_server` 会为每个请求创建独立 Worker，状态不会跨请求泄漏。 |
-| 浏览器特征兼容 | 没有 `document.all`，也没有 DOM/BOM 方法形态。 | 通过 Node/V8 内部 binding 实现不可检测对象语义的 `document.all`，覆盖特殊 `typeof`、布尔值、宽松相等、索引、命名查找与调用；常见的 `fn.toString()` 检查会看到原生函数形态。 |
-| 兼容存根 | 没有这些浏览器全局。 | 提供 `XMLHttpRequest` 状态/参数记录、`MutationObserver`、`indexedDB`、`chrome` 元数据、`open()`、`prompt()`、`msCrypto` 别名和确定性的 Canvas 表面，供常见探测脚本继续运行。它们不是完整浏览器实现。 |
-| Node 特征隔离 | Node 全局默认可见。 | `install({ hideNodeGlobals: true })` 可在该 Realm 删除可配置的 `global`、`process`、`require`、`module`、`exports`、路径与 immediate 别名。默认关闭，普通 Mode 脚本仍保留 Node 入口；`rs_mode_server` 的挑战 Worker 会开启它，同时保留 `Buffer` 以兼容实际挑战脚本。 |
-
-当前版本已用真实目标的连续请求验证可得到 HTTP 200；这证明已覆盖该目标读取到的
-环境路径，不代表 Mode 已成为完整 Chromium 或保证所有站点都能通过指纹检测。
-
-#### 明确边界
-
-Mode 不提供页面渲染、CSS/layout、真实 iframe 文档、Canvas 像素/图形指纹、WebGL、
-WebRTC、AudioContext、Worker 浏览器 API、真实页面导航，或初始 HTML 中 `<script>` 的
-自动执行。`XMLHttpRequest` 仅记录 `open()`/`send()` 状态和参数，不发出网络请求；如需
-这些能力，应使用真实浏览器或在目标代码外自行完成网络调用。
-
-### Start an existing script with a JSON profile
-
-The `--browser-env-profile` option installs the environment before the target
-script is evaluated. Create `browser-profile.json`:
+使用 JSON profile 在目标脚本运行前安装浏览器环境：
 
 ```json
 {
-  "url": "https://example.com/page?a=1",
-  "html": "<html><body><div id=\"app\">hello</div></body></html>",
-  "navigator": {
-    "userAgent": "Mozilla/5.0",
-    "platform": "Win32",
-    "languages": ["zh-CN", "zh"]
-  },
-  "window": {
-    "properties": {
-      "customFlag": true
-    }
-  },
-  "document": {
-    "properties": {
-      "visibilityState": "hidden"
-    },
-    "descriptors": {
-      "challengeValue": {
-        "value": "custom-value",
-        "enumerable": true
-      }
-    }
-  }
+  "url": "https://example.test/",
+  "html": "<div id=\"app\">hello</div>",
+  "navigator": { "platform": "Win32", "languages": ["zh-CN", "zh"] }
 }
 ```
 
-Then launch the target file:
-
 ```bash
 mode --browser-env-profile=./browser-profile.json target.js
 ```
 
-Inside `target.js`, the configured globals are immediately available:
+需要 getter、setter 或函数型自定义属性时，在包装脚本中先调用 `install()`，再加载
+目标脚本：
 
 ```js
-console.log(window === globalThis);                         // true
-console.log(location.href);                                 // configured URL
-console.log(navigator.platform);                            // Win32
-console.log(document.querySelector('#app').textContent);    // hello
-console.log(document.visibilityState);                       // hidden
-console.log(window.customFlag);                              // true
-console.log(document.all == null);                           // true
-console.log(typeof document.all);                            // undefined
-```
-
-The profile is JSON, so descriptors in it may only use JSON-representable
-values. `url` is required. `location.href` is accepted as an alternative URL
-field for profile compatibility.
-
-### Install from JavaScript
-
-Use `node:browser-env` when getters, setters, functions, or values computed at
-startup are needed. Install first, then load the code that reads browser
-globals:
-
-```js
-// boot.js
-const { install, isInstalled } = require('node:browser-env');
-
-console.log(isInstalled()); // false
+const { install } = require('node:browser-env');
 
 install({
-  url: 'https://example.com/',
+  url: 'https://example.test/',
   html: '<div id="app"></div>',
-  navigator: { platform: 'Win32', languages: ['zh-CN', 'zh'] },
-  window: {
-    properties: { customFlag: true },
-  },
-  document: {
-    properties: { visibilityState: 'hidden' },
-    descriptors: {
-      challengeValue: {
-        enumerable: true,
-        get() {
-          return 'dynamic-value';
-        },
-      },
-    },
-  },
+  navigator: { userAgent: 'Mozilla/5.0', platform: 'Win32' },
 });
 
 require('./target.js');
 ```
 
-Run it with:
-
-```bash
-mode boot.js
-```
-
-`install()` returns `{ window, document, navigator, location }` and can only
-be called once per Realm. It must not be combined with
-`--browser-env-profile` in the same Realm. Custom `window` and `document`
-properties cannot replace protected runtime members such as `document.all`,
-DOM query/construction methods, `location`, `navigator`, or the `window` /
-`globalThis` identity aliases.
-
-For the complete API reference, see [Browser environment API][browser-env-api].
-
-Node.js is an open-source, cross-platform JavaScript runtime environment.
-
-For information on using Node.js, see the [Node.js website][].
-
-The Node.js project uses an [open governance model](./GOVERNANCE.md). The
-[OpenJS Foundation][] provides support for the project.
-
-Contributors are expected to act in a collaborative manner to move
-the project forward. We encourage the constructive exchange of contrary
-opinions and compromise. The [TSC](./GOVERNANCE.md#technical-steering-committee)
-reserves the right to limit or block contributors who repeatedly act in ways
-that discourage, exhaust, or otherwise negatively affect other participants.
-
-**This project has a [Code of Conduct][].**
-
-## Table of contents
-
-* [Mode browser environment](#mode-browser-environment)
-* [Support](#support)
-* [Release types](#release-types)
-  * [Download](#download)
-    * [Current and LTS releases](#current-and-lts-releases)
-    * [Nightly releases](#nightly-releases)
-    * [API documentation](#api-documentation)
-  * [Verifying binaries](#verifying-binaries)
-* [Building Node.js](#building-nodejs)
-* [Security](#security)
-* [Contributing to Node.js](#contributing-to-nodejs)
-* [Current project team members](#current-project-team-members)
-  * [TSC (Technical Steering Committee)](#tsc-technical-steering-committee)
-  * [Collaborators](#collaborators)
-  * [Triagers](#triagers)
-  * [Release keys](#release-keys)
-* [License](#license)
-
-## Support
-
-Looking for help? Check out the
-[instructions for getting support](.github/SUPPORT.md).
-
-## Release types
-
-* **Current**: Under active development. Code for the Current release is in the
-  branch for its major version number (for example,
-  [v22.x](https://github.com/nodejs/node/tree/v22.x)). Node.js releases a new
-  major version every 6 months, allowing for breaking changes. This happens in
-  April and October every year. Releases appearing each October have a support
-  life of 8 months. Releases appearing each April convert to LTS (see below)
-  each October.
-* **LTS**: Releases that receive Long Term Support, with a focus on stability
-  and security. Every even-numbered major version will become an LTS release.
-  LTS releases receive 12 months of _Active LTS_ support and a further 18 months
-  of _Maintenance_. LTS release lines have alphabetically-ordered code names,
-  beginning with v4 Argon. There are no breaking changes or feature additions,
-  except in some special circumstances.
-* **Nightly**: Code from the Current branch built every 24-hours when there are
-  changes. Use with caution.
-
-Current and LTS releases follow [semantic versioning](https://semver.org). A
-member of the Release Team [signs](#release-keys) each Current and LTS release.
-For more information, see the
-[Release README](https://github.com/nodejs/Release#readme).
-
-### Download
-
-Binaries, installers, and source tarballs are available at
-<https://nodejs.org/en/download/>.
-
-#### Current and LTS releases
-
-<https://nodejs.org/download/release/>
-
-The [latest](https://nodejs.org/download/release/latest/) directory is an
-alias for the latest Current release. The latest-_codename_ directory is an
-alias for the latest release from an LTS line. For example, the
-[latest-hydrogen](https://nodejs.org/download/release/latest-hydrogen/)
-directory contains the latest Hydrogen (Node.js 18) release.
-
-#### Nightly releases
-
-<https://nodejs.org/download/nightly/>
-
-Each directory and filename includes the version (e.g., `v22.0.0`),
-followed by the UTC date (e.g., `20240424` for April 24, 2024),
-and the short commit SHA of the HEAD of the release (e.g., `ddd0a9e494`).
-For instance, a full directory name might look like `v22.0.0-nightly20240424ddd0a9e494`.
-
-#### API documentation
-
-Documentation for the latest Current release is at <https://nodejs.org/api/>.
-Version-specific documentation is available in each release directory in the
-_docs_ subdirectory. Version-specific documentation is also at
-<https://nodejs.org/download/docs/>.
-
-### Verifying binaries
-
-Download directories contain a `SHASUMS256.txt.asc` file with SHA checksums for the
-files and the releaser PGP signature.
-
-You can get a trusted keyring from nodejs/release-keys, e.g. using `curl`:
+使用 RS 兼容服务：
 
 ```bash
-curl -fsLo "/path/to/nodejs-keyring.kbx" "https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx"
+mode rs_mode_server/server.js
 ```
 
-Alternatively, you can import the releaser keys in your default keyring, see
-[Release keys](#release-keys) for commands on how to do that.
-
-Then, you can verify the files you've downloaded locally
-(if you're using your default keyring, pass `--keyring="${GNUPGHOME:-~/.gnupg}/pubring.kbx"`):
-
-```bash
-curl -fsO "https://nodejs.org/dist/${VERSION}/SHASUMS256.txt.asc" \
-&& gpgv --keyring="/path/to/nodejs-keyring.kbx" --output SHASUMS256.txt < SHASUMS256.txt.asc \
-&& shasum --check SHASUMS256.txt --ignore-missing
-```
-
-## Building Node.js
-
-See [BUILDING.md](BUILDING.md) for instructions on how to build Node.js from
-source and a list of supported platforms.
-
-## Security
-
-For information on reporting security vulnerabilities in Node.js, see
-[SECURITY.md](./SECURITY.md).
-
-## Contributing to Node.js
-
-* [Contributing to the project][]
-* [Working Groups][]
-* [Strategic initiatives][]
-* [Technical values and prioritization][]
-
-## Current project team members
-
-For information about the governance of the Node.js project, see
-[GOVERNANCE.md](./GOVERNANCE.md).
-
-<!-- node-core-utils and find-inactive-tsc.mjs depend on the format of the TSC
-     list. If the format changes, those utilities need to be tested and
-     updated. -->
-
-### TSC (Technical Steering Committee)
-
-#### TSC voting members
-
-<!--lint disable prohibited-strings-->
-
-* [aduh95](https://github.com/aduh95) -
-  **Antoine du Hamel** <<duhamelantoine1995@gmail.com>> (he/him)
-* [anonrig](https://github.com/anonrig) -
-  **Yagiz Nizipli** <<yagiz@nizipli.com>> (he/him)
-* [benjamingr](https://github.com/benjamingr) -
-  **Benjamin Gruenbaum** <<benjamingr@gmail.com>>
-* [BridgeAR](https://github.com/BridgeAR) -
-  **Ruben Bridgewater** <<ruben@bridgewater.de>> (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-  **Gireesh Punathil** <<gpunathi@in.ibm.com>> (he/him)
-* [jasnell](https://github.com/jasnell) -
-  **James M Snell** <<jasnell@gmail.com>> (he/him)
-* [joyeecheung](https://github.com/joyeecheung) -
-  **Joyee Cheung** <<joyeec9h3@gmail.com>> (she/her)
-* [legendecas](https://github.com/legendecas) -
-  **Chengzhong Wu** <<legendecas@gmail.com>> (he/him)
-* [marco-ippolito](https://github.com/marco-ippolito) -
-  **Marco Ippolito** <<marcoippolito54@gmail.com>> (he/him)
-* [mcollina](https://github.com/mcollina) -
-  **Matteo Collina** <<matteo.collina@gmail.com>> (he/him)
-* [panva](https://github.com/panva) -
-  **Filip Skokan** <<panva.ip@gmail.com>> (he/him)
-* [RafaelGSS](https://github.com/RafaelGSS) -
-  **Rafael Gonzaga** <<rafael.nunu@hotmail.com>> (he/him)
-* [RaisinTen](https://github.com/RaisinTen) -
-  **Darshan Sen** <<raisinten@gmail.com>> (he/him)
-* [richardlau](https://github.com/richardlau) -
-  **Richard Lau** <<richard.lau@ibm.com>>
-* [ronag](https://github.com/ronag) -
-  **Robert Nagy** <<ronagy@icloud.com>>
-* [ruyadorno](https://github.com/ruyadorno) -
-  **Ruy Adorno** <<ruy@vlt.sh>> (he/him)
-* [ShogunPanda](https://github.com/ShogunPanda) -
-  **Paolo Insogna** <<paolo@cowtech.it>> (he/him)
-* [targos](https://github.com/targos) -
-  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
-* [tniessen](https://github.com/tniessen) -
-  **Tobias Nießen** <<tniessen@tnie.de>> (he/him)
-
-#### TSC regular members
-
-* [BethGriggs](https://github.com/BethGriggs) -
-  **Beth Griggs** <<bethanyngriggs@gmail.com>> (she/her)
-* [bnoordhuis](https://github.com/bnoordhuis) -
-  **Ben Noordhuis** <<info@bnoordhuis.nl>>
-* [cjihrig](https://github.com/cjihrig) -
-  **Colin Ihrig** <<cjihrig@gmail.com>> (he/him)
-* [codebytere](https://github.com/codebytere) -
-  **Shelley Vohr** <<shelley.vohr@gmail.com>> (she/her)
-* [GeoffreyBooth](https://github.com/GeoffreyBooth) -
-  **Geoffrey Booth** <<webadmin@geoffreybooth.com>> (he/him)
-* [MoLow](https://github.com/MoLow) -
-  **Moshe Atlow** <<moshe@atlow.co.il>> (he/him)
-* [Trott](https://github.com/Trott) -
-  **Rich Trott** <<rtrott@gmail.com>> (he/him)
-
-<details>
-
-<summary>TSC emeriti members</summary>
-
-#### TSC emeriti members
-
-* [addaleax](https://github.com/addaleax) -
-  **Anna Henningsen** <<anna@addaleax.net>> (she/her)
-* [apapirovski](https://github.com/apapirovski) -
-  **Anatoli Papirovski** <<apapirovski@mac.com>> (he/him)
-* [ChALkeR](https://github.com/ChALkeR) -
-  **Сковорода Никита Андреевич** <<chalkerx@gmail.com>> (he/him)
-* [chrisdickinson](https://github.com/chrisdickinson) -
-  **Chris Dickinson** <<christopher.s.dickinson@gmail.com>>
-* [danbev](https://github.com/danbev) -
-  **Daniel Bevenius** <<daniel.bevenius@gmail.com>> (he/him)
-* [danielleadams](https://github.com/danielleadams) -
-  **Danielle Adams** <<adamzdanielle@gmail.com>> (she/her)
-* [evanlucas](https://github.com/evanlucas) -
-  **Evan Lucas** <<evanlucas@me.com>> (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-  **Franziska Hinkelmann** <<franziska.hinkelmann@gmail.com>> (she/her)
-* [Fishrock123](https://github.com/Fishrock123) -
-  **Jeremiah Senkpiel** <<fishrock123@rocketmail.com>> (he/they)
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-  **Gabriel Schulhof** <<gabrielschulhof@gmail.com>>
-* [gibfahn](https://github.com/gibfahn) -
-  **Gibson Fahnestock** <<gibfahn@gmail.com>> (he/him)
-* [indutny](https://github.com/indutny) -
-  **Fedor Indutny** <<fedor@indutny.com>>
-* [isaacs](https://github.com/isaacs) -
-  **Isaac Z. Schlueter** <<i@izs.me>>
-* [joshgav](https://github.com/joshgav) -
-  **Josh Gavant** <<josh.gavant@outlook.com>>
-* [mhdawson](https://github.com/mhdawson) -
-  **Michael Dawson** <<midawson@redhat.com>> (he/him)
-* [mmarchini](https://github.com/mmarchini) -
-  **Mary Marchini** <<oss@mmarchini.me>> (she/her)
-* [mscdex](https://github.com/mscdex) -
-  **Brian White** <<mscdex@mscdex.net>>
-* [MylesBorins](https://github.com/MylesBorins) -
-  **Myles Borins** <<myles.borins@gmail.com>> (he/him)
-* [nebrius](https://github.com/nebrius) -
-  **Bryan Hughes** <<bryan@nebri.us>>
-* [ofrobots](https://github.com/ofrobots) -
-  **Ali Ijaz Sheikh** <<ofrobots@google.com>> (he/him)
-* [orangemocha](https://github.com/orangemocha) -
-  **Alexis Campailla** <<orangemocha@nodejs.org>>
-* [piscisaureus](https://github.com/piscisaureus) -
-  **Bert Belder** <<bertbelder@gmail.com>>
-* [rvagg](https://github.com/rvagg) -
-  **Rod Vagg** <<r@va.gg>>
-* [sam-github](https://github.com/sam-github) -
-  **Sam Roberts** <<vieuxtech@gmail.com>>
-* [shigeki](https://github.com/shigeki) -
-  **Shigeki Ohtsu** <<ohtsu@ohtsu.org>> (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-  **Sakthipriyan Vairamani** <<thechargingvolcano@gmail.com>> (he/him)
-* [TimothyGu](https://github.com/TimothyGu) -
-  **Tiancheng "Timothy" Gu** <<timothygu99@gmail.com>> (he/him)
-* [trevnorris](https://github.com/trevnorris) -
-  **Trevor Norris** <<trev.norris@gmail.com>>
-
-</details>
-
-<!-- node-core-utils and find-inactive-collaborators.mjs depend on the format
-     of the collaborator list. If the format changes, those utilities need to be
-     tested and updated. -->
-
-### Collaborators
-
-* [abmusse](https://github.com/abmusse) -
-  **Abdirahim Musse** <<abdirahim.musse@ibm.com>>
-* [addaleax](https://github.com/addaleax) -
-  **Anna Henningsen** <<anna@addaleax.net>> (she/her)
-* [Aditi-1400](https://github.com/Aditi-1400) -
-  **Aditi Singh** <<aditisingh1400@gmail.com>> (she/her)
-* [aduh95](https://github.com/aduh95) -
-  **Antoine du Hamel** <<duhamelantoine1995@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/aduh95)
-* [anonrig](https://github.com/anonrig) -
-  **Yagiz Nizipli** <<yagiz@nizipli.com>> (he/him) - [Support me](https://github.com/sponsors/anonrig)
-* [atlowChemi](https://github.com/atlowChemi) -
-  **Chemi Atlow** <<chemi@atlow.co.il>> (he/him)
-* [avivkeller](https://github.com/avivkeller) -
-  **Aviv Keller** <<me@aviv.sh>> (he/him) - [Support me](https://github.com/sponsors/avivkeller)
-* [Ayase-252](https://github.com/Ayase-252) -
-  **Qingyu Deng** <<i@ayase-lab.com>>
-* [bengl](https://github.com/bengl) -
-  **Bryan English** <<bryan@bryanenglish.com>> (he/him)
-* [benjamingr](https://github.com/benjamingr) -
-  **Benjamin Gruenbaum** <<benjamingr@gmail.com>>
-* [BethGriggs](https://github.com/BethGriggs) -
-  **Beth Griggs** <<bethanyngriggs@gmail.com>> (she/her)
-* [bnb](https://github.com/bnb) -
-  **Tierney Cyren** <<hello@bnb.im>> (they/them)
-* [bnoordhuis](https://github.com/bnoordhuis) -
-  **Ben Noordhuis** <<info@bnoordhuis.nl>>
-* [BridgeAR](https://github.com/BridgeAR) -
-  **Ruben Bridgewater** <<ruben@bridgewater.de>> (he/him)
-* [cclauss](https://github.com/cclauss) -
-  **Christian Clauss** <<cclauss@me.com>> (he/him)
-* [ChALkeR](https://github.com/ChALkeR) -
-  **Сковорода Никита Андреевич** <<chalkerx@gmail.com>> (he/him)
-* [cjihrig](https://github.com/cjihrig) -
-  **Colin Ihrig** <<cjihrig@gmail.com>> (he/him)
-* [codebytere](https://github.com/codebytere) -
-  **Shelley Vohr** <<shelley.vohr@gmail.com>> (she/her)
-* [cola119](https://github.com/cola119) -
-  **Kohei Ueno** <<kohei.ueno119@gmail.com>> (he/him)
-* [daeyeon](https://github.com/daeyeon) -
-  **Daeyeon Jeong** <<daeyeon.dev@gmail.com>> (he/him)
-* [dario-piotrowicz](https://github.com/dario-piotrowicz) -
-  **Dario Piotrowicz** <<dario.piotrowicz@gmail.com>> (he/him)
-* [deokjinkim](https://github.com/deokjinkim) -
-  **Deokjin Kim** <<deokjin81.kim@gmail.com>> (he/him)
-* [ErickWendel](https://github.com/ErickWendel) -
-  **Erick Wendel** <<erick.workspace@gmail.com>> (he/him)
-* [Ethan-Arrowood](https://github.com/Ethan-Arrowood) -
-  **Ethan Arrowood** <<ethan@arrowood.dev>> (he/him)
-* [Flarna](https://github.com/Flarna) -
-  **Gerhard Stöbich** <<deb2001-github@yahoo.de>> (he/they)
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-  **Gabriel Schulhof** <<gabrielschulhof@gmail.com>>
-* [geeksilva97](https://github.com/geeksilva97) -
-  **Edy Silva** <<edigleyssonsilva@gmail.com>> (he/him)
-* [gengjiawen](https://github.com/gengjiawen) -
-  **Jiawen Geng** <<technicalcute@gmail.com>>
-* [GeoffreyBooth](https://github.com/GeoffreyBooth) -
-  **Geoffrey Booth** <<webadmin@geoffreybooth.com>> (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-  **Gireesh Punathil** <<gpunathi@in.ibm.com>> (he/him)
-* [gurgunday](https://github.com/gurgunday) -
-  **Gürgün Dayıoğlu** <<hey@gurgun.day>> (he/him)
-* [guybedford](https://github.com/guybedford) -
-  **Guy Bedford** <<guybedford@gmail.com>> (he/him)
-* [H4ad](https://github.com/H4ad) -
-  **Vinícius Lourenço Claro Cardoso** <<contact@viniciusl.com.br>> (he/him)
-* [HarshithaKP](https://github.com/HarshithaKP) -
-  **Harshitha K P** <<harshitha014@gmail.com>> (she/her)
-* [himself65](https://github.com/himself65) -
-  **Zeyu "Alex" Yang** <<himself65@outlook.com>> (he/him)
-* [hybrist](https://github.com/hybrist) -
-  **Jan Martin** <<jan.krems@gmail.com>> (he/him)
-* [IlyasShabi](https://github.com/IlyasShabi) -
-  **Ilyas Shabi** <<ilyasshabi94@gmail.com>> (he/him)
-* [islandryu](https://github.com/islandryu) -
-  **Ryuhei Shima** <<shimaryuhei@gmail.com>> (he/him)
-* [jakecastelli](https://github.com/jakecastelli) -
-  **Jake Yuesong Li** <<jake.yuesong@gmail.com>> (he/him)
-* [JakobJingleheimer](https://github.com/JakobJingleheimer) -
-  **Jacob Smith** <<jacob@frende.me>> (he/him)
-* [jasnell](https://github.com/jasnell) -
-  **James M Snell** <<jasnell@gmail.com>> (he/him)
-* [jazelly](https://github.com/jazelly) -
-  **Jason Zhang** <<xzha4350@gmail.com>> (he/him)
-* [joyeecheung](https://github.com/joyeecheung) -
-  **Joyee Cheung** <<joyeec9h3@gmail.com>> (she/her)
-* [juanarbol](https://github.com/juanarbol) -
-  **Juan José Arboleda** <<soyjuanarbol@gmail.com>> (he/him)
-* [JungMinu](https://github.com/JungMinu) -
-  **Minwoo Jung** <<nodecorelab@gmail.com>> (he/him)
-* [KhafraDev](https://github.com/KhafraDev) -
-  **Matthew Aitken** <<maitken033380023@gmail.com>> (he/him)
-* [legendecas](https://github.com/legendecas) -
-  **Chengzhong Wu** <<legendecas@gmail.com>> (he/him)
-* [lemire](https://github.com/lemire) -
-  **Daniel Lemire** <<daniel@lemire.me>>
-* [LiviaMedeiros](https://github.com/LiviaMedeiros) -
-  **LiviaMedeiros** <<livia@cirno.name>>
-* [ljharb](https://github.com/ljharb) -
-  **Jordan Harband** <<ljharb@gmail.com>>
-* [lpinca](https://github.com/lpinca) -
-  **Luigi Pinca** <<luigipinca@gmail.com>> (he/him)
-* [Lxxyx](https://github.com/Lxxyx) -
-  **Zijian Liu** <<lxxyxzj@gmail.com>> (he/him)
-* [marco-ippolito](https://github.com/marco-ippolito) -
-  **Marco Ippolito** <<marcoippolito54@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/marco-ippolito)
-* [marsonya](https://github.com/marsonya) -
-  **Akhil Marsonya** <<akhil.marsonya27@gmail.com>> (he/him)
-* [MattiasBuelens](https://github.com/MattiasBuelens) -
-  **Mattias Buelens** <<mattias@buelens.com>> (he/him)
-* [mcollina](https://github.com/mcollina) -
-  **Matteo Collina** <<matteo.collina@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/mcollina)
-* [meixg](https://github.com/meixg) -
-  **Xuguang Mei** <<meixuguang@gmail.com>> (he/him)
-* [MikeMcC399](https://github.com/MikeMcC399) -
-  **Mike McCready** <<66998419+MikeMcC399@users.noreply.github.com>> (he/him)
-* [MoLow](https://github.com/MoLow) -
-  **Moshe Atlow** <<moshe@atlow.co.il>> (he/him)
-* [MrJithil](https://github.com/MrJithil) -
-  **Jithil P Ponnan** <<jithil@outlook.com>> (he/him)
-* [ovflowd](https://github.com/ovflowd) -
-  **Claudio Wunder** <<cwunder@gnome.org>> (he/they)
-* [panva](https://github.com/panva) -
-  **Filip Skokan** <<panva.ip@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/panva)
-* [pimterry](https://github.com/pimterry) -
-  **Tim Perry** <<pimterry@gmail.com>> (he/him)
-* [pmarchini](https://github.com/pmarchini) -
-  **Pietro Marchini** <<pietro.marchini94@gmail.com>> (he/him)
-* [Qard](https://github.com/Qard) -
-  **Stephen Belanger** <<admin@stephenbelanger.com>> (he/him)
-* [RafaelGSS](https://github.com/RafaelGSS) -
-  **Rafael Gonzaga** <<rafael.nunu@hotmail.com>> (he/him) - [Support me](https://github.com/sponsors/RafaelGSS)
-* [RaisinTen](https://github.com/RaisinTen) -
-  **Darshan Sen** <<raisinten@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/RaisinTen)
-* [Renegade334](https://github.com/Renegade334) -
-  **René** <<contact.9a5d6388@renegade334.me.uk>>
-* [richardlau](https://github.com/richardlau) -
-  **Richard Lau** <<richard.lau@ibm.com>>
-* [rluvaton](https://github.com/rluvaton) -
-  **Raz Luvaton** <<rluvaton@gmail.com>> (he/him)
-* [ronag](https://github.com/ronag) -
-  **Robert Nagy** <<ronagy@icloud.com>>
-* [ruyadorno](https://github.com/ruyadorno) -
-  **Ruy Adorno** <<ruy@vlt.sh>> (he/him)
-* [santigimeno](https://github.com/santigimeno) -
-  **Santiago Gimeno** <<santiago.gimeno@gmail.com>>
-* [ShogunPanda](https://github.com/ShogunPanda) -
-  **Paolo Insogna** <<paolo@cowtech.it>> (he/him)
-* [srl295](https://github.com/srl295) -
-  **Steven R Loomis** <<srl295@gmail.com>>
-* [StefanStojanovic](https://github.com/StefanStojanovic) -
-  **Stefan Stojanovic** <<stefan.stojanovic@janeasystems.com>> (he/him)
-* [sxa](https://github.com/sxa) -
-  **Stewart X Addison** <<sxa@redhat.com>> (he/him)
-* [targos](https://github.com/targos) -
-  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
-* [theanarkh](https://github.com/theanarkh) -
-  **theanarkh** <<theratliter@gmail.com>> (he/him)
-* [tniessen](https://github.com/tniessen) -
-  **Tobias Nießen** <<tniessen@tnie.de>> (he/him)
-* [trivikr](https://github.com/trivikr) -
-  **Trivikram Kamat** <<trivikr.dev@gmail.com>>
-* [Trott](https://github.com/Trott) -
-  **Rich Trott** <<rtrott@gmail.com>> (he/him)
-* [UlisesGascon](https://github.com/UlisesGascon) -
-  **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>> (he/him)
-* [vmoroz](https://github.com/vmoroz) -
-  **Vladimir Morozov** <<vmorozov@microsoft.com>> (he/him)
-* [watilde](https://github.com/watilde) -
-  **Daijiro Wachi** <<daijiro.wachi@gmail.com>> (he/him)
-* [ZYSzys](https://github.com/ZYSzys) -
-  **Yongsheng Zhang** <<zyszys98@gmail.com>> (he/him)
-
-<details>
-
-<summary>Emeriti</summary>
-
-<!-- find-inactive-collaborators.mjs depends on the format of the emeriti list.
-     If the format changes, those utilities need to be tested and updated. -->
-
-### Collaborator emeriti
-
-* [ak239](https://github.com/ak239) -
-  **Aleksei Koziatinskii** <<ak239spb@gmail.com>>
-* [andrasq](https://github.com/andrasq) -
-  **Andras** <<andras@kinvey.com>>
-* [AndreasMadsen](https://github.com/AndreasMadsen) -
-  **Andreas Madsen** <<amwebdk@gmail.com>> (he/him)
-* [AnnaMag](https://github.com/AnnaMag) -
-  **Anna M. Kedzierska** <<anna.m.kedzierska@gmail.com>>
-* [antsmartian](https://github.com/antsmartian) -
-  **Anto Aravinth** <<anto.aravinth.cse@gmail.com>> (he/him)
-* [apapirovski](https://github.com/apapirovski) -
-  **Anatoli Papirovski** <<apapirovski@mac.com>> (he/him)
-* [aqrln](https://github.com/aqrln) -
-  **Alexey Orlenko** <<eaglexrlnk@gmail.com>> (he/him)
-* [AshCripps](https://github.com/AshCripps) -
-  **Ash Cripps** <<email@ashleycripps.co.uk>>
-* [bcoe](https://github.com/bcoe) -
-  **Ben Coe** <<bencoe@gmail.com>> (he/him)
-* [bmeck](https://github.com/bmeck) -
-  **Bradley Farias** <<bradley.meck@gmail.com>>
-* [bmeurer](https://github.com/bmeurer) -
-  **Benedikt Meurer** <<benedikt.meurer@gmail.com>>
-* [boneskull](https://github.com/boneskull) -
-  **Christopher Hiller** <<boneskull@boneskull.com>> (he/him)
-* [brendanashworth](https://github.com/brendanashworth) -
-  **Brendan Ashworth** <<brendan.ashworth@me.com>>
-* [bzoz](https://github.com/bzoz) -
-  **Bartosz Sosnowski** <<bartosz@janeasystems.com>>
-* [calvinmetcalf](https://github.com/calvinmetcalf) -
-  **Calvin Metcalf** <<calvin.metcalf@gmail.com>>
-* [chrisdickinson](https://github.com/chrisdickinson) -
-  **Chris Dickinson** <<christopher.s.dickinson@gmail.com>>
-* [claudiorodriguez](https://github.com/claudiorodriguez) -
-  **Claudio Rodriguez** <<cjrodr@yahoo.com>>
-* [danbev](https://github.com/danbev) -
-  **Daniel Bevenius** <<daniel.bevenius@gmail.com>> (he/him)
-* [danielleadams](https://github.com/danielleadams) -
-  **Danielle Adams** <<adamzdanielle@gmail.com>> (she/her)
-* [DavidCai1111](https://github.com/DavidCai1111) -
-  **David Cai** <<davidcai1993@yahoo.com>> (he/him)
-* [davisjam](https://github.com/davisjam) -
-  **Jamie Davis** <<davisjam@vt.edu>> (he/him)
-* [debadree25](https://github.com/debadree25) -
-  **Debadree Chatterjee** <<debadree333@gmail.com>> (he/him)
-* [devnexen](https://github.com/devnexen) -
-  **David Carlier** <<devnexen@gmail.com>>
-* [devsnek](https://github.com/devsnek) -
-  **Gus Caplan** <<me@gus.host>> (they/them)
-* [digitalinfinity](https://github.com/digitalinfinity) -
-  **Hitesh Kanwathirtha** <<digitalinfinity@gmail.com>> (he/him)
-* [dmabupt](https://github.com/dmabupt) -
-  **Xu Meng** <<dmabupt@gmail.com>> (he/him)
-* [dnlup](https://github.com/dnlup) -
-  **dnlup** <<dnlup.dev@gmail.com>>
-* [edsadr](https://github.com/edsadr) -
-  **Adrian Estrada** <<edsadr@gmail.com>> (he/him)
-* [eljefedelrodeodeljefe](https://github.com/eljefedelrodeodeljefe) -
-  **Robert Jefe Lindstaedt** <<robert.lindstaedt@gmail.com>>
-* [estliberitas](https://github.com/estliberitas) -
-  **Alexander Makarenko** <<estliberitas@gmail.com>>
-* [eugeneo](https://github.com/eugeneo) -
-  **Eugene Ostroukhov** <<eostroukhov@google.com>>
-* [evanlucas](https://github.com/evanlucas) -
-  **Evan Lucas** <<evanlucas@me.com>> (he/him)
-* [F3n67u](https://github.com/F3n67u) -
-  **Feng Yu** <<F3n67u@outlook.com>> (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-  **Franziska Hinkelmann** <<franziska.hinkelmann@gmail.com>> (she/her)
-* [firedfox](https://github.com/firedfox) -
-  **Daniel Wang** <<wangyang0123@gmail.com>>
-* [Fishrock123](https://github.com/Fishrock123) -
-  **Jeremiah Senkpiel** <<fishrock123@rocketmail.com>> (he/they)
-* [gdams](https://github.com/gdams) -
-  **George Adams** <<gadams@microsoft.com>> (he/him)
-* [geek](https://github.com/geek) -
-  **Wyatt Preul** <<wpreul@gmail.com>>
-* [gibfahn](https://github.com/gibfahn) -
-  **Gibson Fahnestock** <<gibfahn@gmail.com>> (he/him)
-* [glentiki](https://github.com/glentiki) -
-  **Glen Keane** <<glenkeane.94@gmail.com>> (he/him)
-* [hashseed](https://github.com/hashseed) -
-  **Yang Guo** <<yangguo@chromium.org>> (he/him)
-* [hiroppy](https://github.com/hiroppy) -
-  **Yuta Hiroto** <<hello@hiroppy.me>> (he/him)
-* [iansu](https://github.com/iansu) -
-  **Ian Sutherland** <<ian@iansutherland.ca>>
-* [iarna](https://github.com/iarna) -
-  **Rebecca Turner** <<me@re-becca.org>>
-* [imran-iq](https://github.com/imran-iq) -
-  **Imran Iqbal** <<imran@imraniqbal.org>>
-* [imyller](https://github.com/imyller) -
-  **Ilkka Myller** <<ilkka.myller@nodefield.com>>
-* [indutny](https://github.com/indutny) -
-  **Fedor Indutny** <<fedor@indutny.com>>
-* [isaacs](https://github.com/isaacs) -
-  **Isaac Z. Schlueter** <<i@izs.me>>
-* [italoacasas](https://github.com/italoacasas) -
-  **Italo A. Casas** <<me@italoacasas.com>> (he/him)
-* [JacksonTian](https://github.com/JacksonTian) -
-  **Jackson Tian** <<shyvo1987@gmail.com>>
-* [jasongin](https://github.com/jasongin) -
-  **Jason Ginchereau** <<jasongin@microsoft.com>>
-* [jbergstroem](https://github.com/jbergstroem) -
-  **Johan Bergström** <<bugs@bergstroem.nu>>
-* [jdalton](https://github.com/jdalton) -
-  **John-David Dalton** <<john.david.dalton@gmail.com>>
-* [jhamhader](https://github.com/jhamhader) -
-  **Yuval Brik** <<yuval@brik.org.il>>
-* [joaocgreis](https://github.com/joaocgreis) -
-  **João Reis** <<reis@janeasystems.com>>
-* [joesepi](https://github.com/joesepi) -
-  **Joe Sepi** <<sepi@joesepi.com>> (he/him)
-* [JonasBa](https://github.com/JonasBa) -
-  **Jonas Badalic** <<jonas.badalic@gmail.com>> (he/him)
-* [joshgav](https://github.com/joshgav) -
-  **Josh Gavant** <<josh.gavant@outlook.com>>
-* [julianduque](https://github.com/julianduque) -
-  **Julian Duque** <<julianduquej@gmail.com>> (he/him)
-* [kfarnung](https://github.com/kfarnung) -
-  **Kyle Farnung** <<kfarnung@microsoft.com>> (he/him)
-* [kunalspathak](https://github.com/kunalspathak) -
-  **Kunal Pathak** <<kunal.pathak@microsoft.com>>
-* [kuriyosh](https://github.com/kuriyosh) -
-  **Yoshiki Kurihara** <<yosyos0306@gmail.com>> (he/him)
-* [kvakil](https://github.com/kvakil) -
-  **Keyhan Vakil** <<kvakil@sylph.kvakil.me>>
-* [lance](https://github.com/lance) -
-  **Lance Ball** <<lball@redhat.com>> (he/him)
-* [Leko](https://github.com/Leko) -
-  **Shingo Inoue** <<leko.noor@gmail.com>> (he/him)
-* [Linkgoron](https://github.com/Linkgoron) -
-  **Nitzan Uziely** <<linkgoron@gmail.com>>
-* [lucamaraschi](https://github.com/lucamaraschi) -
-  **Luca Maraschi** <<luca.maraschi@gmail.com>> (he/him)
-* [lukekarrys](https://github.com/lukekarrys) -
-  **Luke Karrys** <<luke@lukekarrys.com>> (he/him)
-* [lundibundi](https://github.com/lundibundi) -
-  **Denys Otrishko** <<shishugi@gmail.com>> (he/him)
-* [lxe](https://github.com/lxe) -
-  **Aleksey Smolenchuk** <<lxe@lxe.co>>
-* [maclover7](https://github.com/maclover7) -
-  **Jon Moss** <<me@jonathanmoss.me>> (he/him)
-* [mafintosh](https://github.com/mafintosh) -
-  **Mathias Buus** <<mathiasbuus@gmail.com>> (he/him)
-* [matthewloring](https://github.com/matthewloring) -
-  **Matthew Loring** <<mattloring@google.com>>
-* [Mesteery](https://github.com/Mesteery) -
-  **Mestery** <<mestery@protonmail.com>> (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-  **Michael Dawson** <<midawson@redhat.com>> (he/him)
-* [micnic](https://github.com/micnic) -
-  **Nicu Micleușanu** <<micnic90@gmail.com>> (he/him)
-* [mikeal](https://github.com/mikeal) -
-  **Mikeal Rogers** <<mikeal.rogers@gmail.com>>
-* [miladfarca](https://github.com/miladfarca) -
-  **Milad Fa** <<mfarazma@redhat.com>> (he/him)
-* [mildsunrise](https://github.com/mildsunrise) -
-  **Alba Mendez** <<me@alba.sh>> (she/her)
-* [misterdjules](https://github.com/misterdjules) -
-  **Julien Gilli** <<jgilli@netflix.com>>
-* [mmarchini](https://github.com/mmarchini) -
-  **Mary Marchini** <<oss@mmarchini.me>> (she/her)
-* [monsanto](https://github.com/monsanto) -
-  **Christopher Monsanto** <<chris@monsan.to>>
-* [MoonBall](https://github.com/MoonBall) -
-  **Chen Gang** <<gangc.cxy@foxmail.com>>
-* [mscdex](https://github.com/mscdex) -
-  **Brian White** <<mscdex@mscdex.net>>
-* [MylesBorins](https://github.com/MylesBorins) -
-  **Myles Borins** <<myles.borins@gmail.com>> (he/him)
-* [not-an-aardvark](https://github.com/not-an-aardvark) -
-  **Teddy Katz** <<teddy.katz@gmail.com>> (he/him)
-* [ofrobots](https://github.com/ofrobots) -
-  **Ali Ijaz Sheikh** <<ofrobots@google.com>> (he/him)
-* [Olegas](https://github.com/Olegas) -
-  **Oleg Elifantiev** <<oleg@elifantiev.ru>>
-* [orangemocha](https://github.com/orangemocha) -
-  **Alexis Campailla** <<orangemocha@nodejs.org>>
-* [othiym23](https://github.com/othiym23) -
-  **Forrest L Norvell** <<ogd@aoaioxxysz.net>> (they/them/themself)
-* [oyyd](https://github.com/oyyd) -
-  **Ouyang Yadong** <<oyydoibh@gmail.com>> (he/him)
-* [petkaantonov](https://github.com/petkaantonov) -
-  **Petka Antonov** <<petka_antonov@hotmail.com>>
-* [phillipj](https://github.com/phillipj) -
-  **Phillip Johnsen** <<johphi@gmail.com>>
-* [piscisaureus](https://github.com/piscisaureus) -
-  **Bert Belder** <<bertbelder@gmail.com>>
-* [pmq20](https://github.com/pmq20) -
-  **Minqi Pan** <<pmq2001@gmail.com>>
-* [PoojaDurgad](https://github.com/PoojaDurgad) -
-  **Pooja D P** <<Pooja.D.P@ibm.com>> (she/her)
-* [princejwesley](https://github.com/princejwesley) -
-  **Prince John Wesley** <<princejohnwesley@gmail.com>>
-* [psmarshall](https://github.com/psmarshall) -
-  **Peter Marshall** <<petermarshall@chromium.org>> (he/him)
-* [puskin](https://github.com/puskin) -
-  **Giovanni Bucci** <<github@puskin.it>> (he/him)
-* [puzpuzpuz](https://github.com/puzpuzpuz) -
-  **Andrey Pechkurov** <<apechkurov@gmail.com>> (he/him)
-* [refack](https://github.com/refack) -
-  **Refael Ackermann (רפאל פלחי)** <<refack@gmail.com>> (he/him/הוא/אתה)
-* [rexagod](https://github.com/rexagod) -
-  **Pranshu Srivastava** <<rexagod@gmail.com>> (he/him)
-* [rickyes](https://github.com/rickyes) -
-  **Ricky Zhou** <<0x19951125@gmail.com>> (he/him)
-* [rlidwka](https://github.com/rlidwka) -
-  **Alex Kocharin** <<alex@kocharin.ru>>
-* [rmg](https://github.com/rmg) -
-  **Ryan Graham** <<r.m.graham@gmail.com>>
-* [robertkowalski](https://github.com/robertkowalski) -
-  **Robert Kowalski** <<rok@kowalski.gd>>
-* [romankl](https://github.com/romankl) -
-  **Roman Klauke** <<romaaan.git@gmail.com>>
-* [ronkorving](https://github.com/ronkorving) -
-  **Ron Korving** <<ron@ronkorving.nl>>
-* [RReverser](https://github.com/RReverser) -
-  **Ingvar Stepanyan** <<me@rreverser.com>>
-* [rubys](https://github.com/rubys) -
-  **Sam Ruby** <<rubys@intertwingly.net>>
-* [rvagg](https://github.com/rvagg) -
-  **Rod Vagg** <<rod@vagg.org>>
-* [ryzokuken](https://github.com/ryzokuken) -
-  **Ujjwal Sharma** <<ryzokuken@disroot.org>> (he/him)
-* [saghul](https://github.com/saghul) -
-  **Saúl Ibarra Corretgé** <<s@saghul.net>>
-* [sam-github](https://github.com/sam-github) -
-  **Sam Roberts** <<vieuxtech@gmail.com>>
-* [sebdeckers](https://github.com/sebdeckers) -
-  **Sebastiaan Deckers** <<sebdeckers83@gmail.com>>
-* [seishun](https://github.com/seishun) -
-  **Nikolai Vavilov** <<vvnicholas@gmail.com>>
-* [shigeki](https://github.com/shigeki) -
-  **Shigeki Ohtsu** <<ohtsu@ohtsu.org>> (he/him)
-* [shisama](https://github.com/shisama) -
-  **Masashi Hirano** <<shisama07@gmail.com>> (he/him)
-* [silverwind](https://github.com/silverwind) -
-  **Roman Reiss** <<me@silverwind.io>>
-* [starkwang](https://github.com/starkwang) -
-  **Weijia Wang** <<starkwang@126.com>>
-* [stefanmb](https://github.com/stefanmb) -
-  **Stefan Budeanu** <<stefan@budeanu.com>>
-* [tellnes](https://github.com/tellnes) -
-  **Christian Tellnes** <<christian@tellnes.no>>
-* [thefourtheye](https://github.com/thefourtheye) -
-  **Sakthipriyan Vairamani** <<thechargingvolcano@gmail.com>> (he/him)
-* [thlorenz](https://github.com/thlorenz) -
-  **Thorsten Lorenz** <<thlorenz@gmx.de>>
-* [TimothyGu](https://github.com/TimothyGu) -
-  **Tiancheng "Timothy" Gu** <<timothygu99@gmail.com>> (he/him)
-* [trevnorris](https://github.com/trevnorris) -
-  **Trevor Norris** <<trev.norris@gmail.com>>
-* [tunniclm](https://github.com/tunniclm) -
-  **Mike Tunnicliffe** <<m.j.tunnicliffe@gmail.com>>
-* [vdeturckheim](https://github.com/vdeturckheim) -
-  **Vladimir de Turckheim** <<vlad2t@hotmail.com>> (he/him)
-* [vkurchatkin](https://github.com/vkurchatkin) -
-  **Vladimir Kurchatkin** <<vladimir.kurchatkin@gmail.com>>
-* [VoltrexKeyva](https://github.com/VoltrexKeyva) -
-  **Mohammed Keyvanzadeh** <<mohammadkeyvanzade94@gmail.com>> (he/him)
-* [vsemozhetbyt](https://github.com/vsemozhetbyt) -
-  **Vse Mozhet Byt** <<vsemozhetbyt@gmail.com>> (he/him)
-* [watson](https://github.com/watson) -
-  **Thomas Watson** <<w@tson.dk>>
-* [whitlockjc](https://github.com/whitlockjc) -
-  **Jeremy Whitlock** <<jwhitlock@apache.org>>
-* [XadillaX](https://github.com/XadillaX) -
-  **Khaidi Chu** <<i@2333.moe>> (he/him)
-* [yashLadha](https://github.com/yashLadha) -
-  **Yash Ladha** <<yash@yashladha.in>> (he/him)
-* [yhwang](https://github.com/yhwang) -
-  **Yihong Wang** <<yh.wang@ibm.com>>
-* [yorkie](https://github.com/yorkie) -
-  **Yorkie Liu** <<yorkiefixer@gmail.com>>
-* [yosuke-furukawa](https://github.com/yosuke-furukawa) -
-  **Yosuke Furukawa** <<yosuke.furukawa@gmail.com>>
-* [zcbenz](https://github.com/zcbenz) -
-  **Cheng Zhao** <<zcbenz@gmail.com>> (he/him)
-
-</details>
-
-<!--lint enable prohibited-strings-->
-
-Collaborators follow the [Collaborator Guide](./doc/contributing/collaborator-guide.md) in
-maintaining the Node.js project.
-
-### Triagers
-
-* [1ilsang](https://github.com/1ilsang) -
-  **Sangchul Lee** <<1ilsang.dev@gmail.com>> (he/him)
-* [bjohansebas](https://github.com/bjohansebas) -
-  **Sebastian Beltran** <<bjohansebas@gmail.com>>
-* [bmuenzenmeyer](https://github.com/bmuenzenmeyer) -
-  **Brian Muenzenmeyer** <<brian.muenzenmeyer@gmail.com>> (he/him)
-* [efekrskl](https://github.com/efekrskl) -
-  **Efe Karasakal** <<hi@efe.dev>> (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-  **Gireesh Punathil** <<gpunathi@in.ibm.com>> (he/him)
-* [haramj](https://github.com/haramj) -
-  **Haram Jeong** <<haramj.dev@gmail.com>>
-* [HBSPS](https://github.com/HBSPS) -
-  **Wiyeong Seo** <<hbsps.dev@gmail.com>>
-* [iam-frankqiu](https://github.com/iam-frankqiu) -
-  **Frank Qiu** <<iam.frankqiu@gmail.com>> (he/him)
-* [milesguicent](https://github.com/milesguicent) -
-  **Miles Guicent** <<guicent@pm.me>> (he/him)
-* [preveen-stack](https://github.com/preveen-stack) -
-  **Preveen Padmanabhan** <<wide4head@gmail.com>> (he/him)
-
-Triagers follow the [Triage Guide](./doc/contributing/issues.md#triaging-a-bug-report) when
-responding to new issues.
-
-### Release keys
-
-Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
-
-* **Antoine du Hamel** <<duhamelantoine1995@gmail.com>>
-  `5BE8A3F6C8A5C01D106C0AD820B1A390B168D356`
-* **Juan José Arboleda** <<soyjuanarbol@gmail.com>>
-  `DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7`
-* **Marco Ippolito** <<marcoippolito54@gmail.com>>
-  `CC68F5A3106FF448322E48ED27F5E38D5B0A215F`
-* **Michaël Zasso** <<targos@protonmail.com>>
-  `8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`
-* **Rafael Gonzaga** <<rafael.nunu@hotmail.com>>
-  `890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4`
-* **Richard Lau** <<richard.lau@ibm.com>>
-  `C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`
-* **Ruy Adorno** <<ruyadorno@hotmail.com>>
-  `108F52B48DB57BB0CC439B2997B01419BD92F80A`
-* **Stewart X Addison** <<sxa@ibm.com>>
-  `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`
-* **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>>
-  `A363A499291CBBC940DD62E41F10027AF002F8B0`
-
-You can use the keyring the project maintains at
-<https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx>.
-Alternatively, you can import them from a public key server. Have in mind that
-the project cannot guarantee the availability of the server nor the keys on
-that server.
-
-```bash
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
-gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
-gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
-gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD # Stewart X Addison
-gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón
-```
-
-See [Verifying binaries](#verifying-binaries) for how to use these keys to
-verify a downloaded file.
-
-<details>
-
-<summary>Other keys used to sign some previous releases</summary>
-
-* **Antoine du Hamel** <<duhamelantoine1995@gmail.com>>
-  `C0D6248439F1D5604AAFFB4021D900FFDB233756`
-* **Beth Griggs** <<bethanyngriggs@gmail.com>>
-  `4ED778F539E3634C779C87C6D7062848A1AB005C`
-* **Bryan English** <<bryan@bryanenglish.com>>
-  `141F07595B7B3FFE74309A937405533BE57C7D57`
-* **Chris Dickinson** <<christopher.s.dickinson@gmail.com>>
-  `9554F04D7259F04124DE6B476D5A82AC7E37093B`
-* **Colin Ihrig** <<cjihrig@gmail.com>>
-  `94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
-* **Danielle Adams** <<adamzdanielle@gmail.com>>
-  `1C050899334244A8AF75E53792EF661D867B9DFA`
-  `74F12602B6F1C4E913FAA37AD3A89613643B6201`
-* **Evan Lucas** <<evanlucas@me.com>>
-  `B9AE9905FFD7803F25714661B63B535A4C206CA9`
-* **Gibson Fahnestock** <<gibfahn@gmail.com>>
-  `77984A986EBC2AA786BC0F66B01FBB92821C587A`
-* **Isaac Z. Schlueter** <<i@izs.me>>
-  `93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`
-* **Italo A. Casas** <<me@italoacasas.com>>
-  `56730D5401028683275BD23C23EFEFE93C4CFFFE`
-* **James M Snell** <<jasnell@keybase.io>>
-  `71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`
-* **Jeremiah Senkpiel** <<fishrock@keybase.io>>
-  `FD3A5288F042B6850C66B31F09FE44734EB7990E`
-* **Juan José Arboleda** <<soyjuanarbol@gmail.com>>
-  `61FC681DFB92A079F1685E77973F295594EC4689`
-* **Julien Gilli** <<jgilli@fastmail.fm>>
-  `114F43EE0176B71C7BC219DD50A3051F888C628D`
-* **Myles Borins** <<myles.borins@gmail.com>>
-  `C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`
-* **Rod Vagg** <<rod@vagg.org>>
-  `DD8F2338BAE7501E3DD5AC78C273792F7D83545D`
-* **Ruben Bridgewater** <<ruben@bridgewater.de>>
-  `A48C2BEE680E841632CD4E44F07496B3EB3C1762`
-* **Shelley Vohr** <<shelley.vohr@gmail.com>>
-  `B9E2F5981AA6E0CD28160D9FF13993A75599653C`
-* **Timothy J Fontaine** <<tjfontaine@gmail.com>>
-  `7937DFD2AB06298B2293C3187D33FF9D0246406D`
-
-The project maintains a keyring able to verify all past releases of Node.js at
-<https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg/pubring.kbx>.
-
-</details>
-
-### Security release stewards
-
-When possible, the commitment to take slots in the
-security release steward rotation is made by companies in order
-to ensure individuals who act as security stewards have the
-support and recognition from their employer to be able to
-prioritize security releases. Security release stewards manage security
-releases on a rotation basis as outlined in the
-[security release process](./doc/contributing/security-release-process.md).
-
-* [Datadog](https://www.datadoghq.com/)
-  * [bengl](https://github.com/bengl) -
-    **Bryan English** <<bryan@bryanenglish.com>> (he/him)
-* [HeroDevs](https://www.herodevs.com/)
-  * [juanarbol](https://github.com/juanarbol) - OpenJS Slack handle: `juanarbol`
-    **Juan José Arboleda** <<soyjuanarbol@gmail.com>> (he/him)
-  * [marco-ippolito](https://github.com/marco-ippolito) - OpenJS Slack handle: `Marco Ippolito`
-    **Marco Ippolito** <<marcoippolito54@gmail.com>> (he/him)
-* [NodeSource](https://nodesource.com/)
-  * [RafaelGSS](https://github.com/RafaelGSS) - OpenJS Slack handle: `RafaelGSS`
-    **Rafael Gonzaga** <<rafael.nunu@hotmail.com>> (he/him)
-* [Platformatic](https://platformatic.dev/)
-  * [mcollina](https://github.com/mcollina) - OpenJS Slack handle: `mcollina`
-    **Matteo Collina** <<matteo.collina@gmail.com>> (he/him)
-* [Red Hat](https://redhat.com) / [IBM](https://ibm.com)
-  * [BethGriggs](https://github.com/BethGriggs) -
-    **Beth Griggs** <<bethanyngriggs@gmail.com>> (she/her)
-  * [sxa](https://github.com/sxa) -
-    **Stewart X Addison** <<sxa@redhat.com>> (he/him)
-
-## License
-
-Node.js is licensed under the [MIT License](https://opensource.org/licenses/MIT).
-
-This project also depends on external libraries that may use different open-source
-licenses. For a complete list of included licenses, please see the
-[LICENSE](https://github.com/nodejs/node/blob/main/LICENSE) file.
-
-If you are contributing documentation or source changes, please ensure your
-additions comply with the project’s license guidelines.
-
-[Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md
-[Contributing to the project]: CONTRIBUTING.md
-[browser-env-api]: doc/api/browser-env.md
-[mode-release]: https://github.com/wen2go/mode/releases/tag/mode_20260914_v22.0.10
-[mode-releases]: https://github.com/wen2go/mode/releases
-[Node.js website]: https://nodejs.org/
-[OpenJS Foundation]: https://openjsf.org/
-[Strategic initiatives]: doc/contributing/strategic-initiatives.md
-[Technical values and prioritization]: doc/contributing/technical-values.md
-[Working Groups]: https://github.com/nodejs/TSC/blob/HEAD/WORKING_GROUPS.md
+服务默认监听 `http://127.0.0.1:8080`，提供 `GET /health` 与原有的
+`POST /rs_env` 协议。
+
+## 安全与能力边界
+
+- Mode 是脚本兼容层，不是 Chromium：没有页面渲染、CSS/layout、真实 iframe 文档、
+  Canvas 图像指纹、WebGL、WebRTC、AudioContext、浏览器 Worker API、真实导航，也不会
+  自动执行初始 HTML 内的 `<script>`。
+- `XMLHttpRequest` 只记录 `open()`/`send()` 的状态和参数，不会发出网络请求；Canvas
+  为确定性兼容表面，不生成真实图形输出。
+- `rs_mode_server` 会执行请求 HTML 关联的挑战 JavaScript；只应向受信任的本地调用方
+  暴露，并只用于已获授权的目标。每个请求虽在独立 Worker 中运行，但这不是针对不可信
+  JavaScript 的安全沙箱。
+- `install({ hideNodeGlobals: true })` 仅隐藏可配置的 `process`、`require` 等常见 Node
+  全局别名，用于减少环境差异；它不是权限隔离机制。普通 `mode` 进程仍具备与 Node.js
+  相同的文件和网络权限。
+- 当前版本已在授权目标的连续请求中得到 HTTP 200；这只说明该目标已读到的环境路径
+  被覆盖，不代表所有网站都能通过浏览器指纹检测。
+
+## 许可证
+
+Mode 基于 Node.js 源码修改，沿用 [MIT License](./LICENSE)。仓库内第三方依赖可能有
+各自的许可证；完整声明以 [LICENSE](./LICENSE) 为准。

From 43c47ef1374f33ab2895321d32511dfbb4815088 Mon Sep 17 00:00:00 2001
From: sunwen <1102633262@qq.com>
Date: Mon, 14 Sep 2026 17:07:04 +0800
Subject: [PATCH 32/32] update

---
 .gitignore                                  |   1 +
 rs_mode_server/.gitignore                   |   1 -
 rs_mode_server/README.md                    |  74 -----
 rs_mode_server/server.js                    | 319 --------------------
 rs_mode_server/test/fixtures/challenge.html |  21 --
 rs_mode_server/test/fixtures/challenge.js   |   8 -
 rs_mode_server/test/server.test.js          | 191 ------------
 7 files changed, 1 insertion(+), 614 deletions(-)
 delete mode 100644 rs_mode_server/.gitignore
 delete mode 100644 rs_mode_server/README.md
 delete mode 100644 rs_mode_server/server.js
 delete mode 100644 rs_mode_server/test/fixtures/challenge.html
 delete mode 100644 rs_mode_server/test/fixtures/challenge.js
 delete mode 100644 rs_mode_server/test/server.test.js

diff --git a/.gitignore b/.gitignore
index 0d598418e4a5..eeae5e710fbd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -182,3 +182,4 @@ compile_commands.json
 .devcontainer/**
 !.devcontainer/base/
 !.devcontainer/base/devcontainer.json
+/rs_mode_server.zip
diff --git a/rs_mode_server/.gitignore b/rs_mode_server/.gitignore
deleted file mode 100644
index 833200818870..000000000000
--- a/rs_mode_server/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-out_js/
diff --git a/rs_mode_server/README.md b/rs_mode_server/README.md
deleted file mode 100644
index b7596e4c7384..000000000000
--- a/rs_mode_server/README.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# Mode rs_env compatibility server
-
-`rs_mode_server` keeps the existing local `POST /rs_env` protocol while running
-challenge JavaScript in Mode's native `node:browser-env` runtime. It does not
-read, append, or execute `env.js`.
-
-## Start
-
-From the Mode source checkout, start it with the locally built binary:
-
-```sh
-out/Release/node rs_mode_server/server.js
-```
-
-After installing a Mode release, use the release command instead:
-
-```sh
-mode rs_mode_server/server.js
-```
-
-It listens on `127.0.0.1:8080` by default. Set `RS_MODE_HOST` or `RS_JS_PORT`
-before launching to change the bind address or port.
-
-## API
-
-`GET /health` returns:
-
-```json
-{"status":"ok"}
-```
-
-`POST /rs_env` accepts the same body used by the previous Python client:
-
-```json
-{
-  "html": "<html>...</html>",
-  "url": "https://example.test/page",
-  "ua": "Mozilla/5.0 ..."
-}
-```
-
-On success, it returns the Cookie object set by the challenge. Invalid requests,
-missing challenge markers or scripts, external-script errors, and worker timeouts
-return HTTP 500 with `{}`.
-
-Each request executes in its own Worker. The Worker installs a fresh Mode browser
-environment with the supplied URL, original HTML, dynamic user agent, DOM,
-`document.all`, location/history, cookies, Storage, event interfaces, DOMParser,
-basic XHR state transitions, base navigator values (including connection,
-mimeTypes, battery, and beacon APIs), screen dimensions, window dimensions, and
-hidden document visibility. The Worker also removes the Node-only global aliases
-`global`, `process`, `require`, `module`, `exports`, `__dirname`,
-`__filename`, `setImmediate`, and `clearImmediate`. `Buffer` stays available
-for compatibility with existing challenge code; it does not cross Worker
-boundaries. Challenge code is evaluated without a CommonJS `require` parameter.
-External `r="m"` scripts are cached under `out_js/`; the cache is ignored by
-Git.
-
-## Strict compatibility boundary
-
-This service intentionally provides only the Mode browser environment. Its XHR
-implementation records `open()` and `send()` arguments without making a network
-request; Node's built-in `fetch` retains its normal behavior. The Canvas surface
-is deterministic and has no renderer or pixel fingerprint. WebGL, site-specific
-prebuilt challenge DOM, form hacks, and native `toString` spoofing are not
-implemented.
-
-## Tests
-
-The test suite uses only local, sanitized HTML and external-JS fixtures:
-
-```sh
-out/Release/node --test rs_mode_server/test/server.test.js
-```
diff --git a/rs_mode_server/server.js b/rs_mode_server/server.js
deleted file mode 100644
index cbde9dcf4d22..000000000000
--- a/rs_mode_server/server.js
+++ /dev/null
@@ -1,319 +0,0 @@
-'use strict';
-
-const crypto = require('node:crypto');
-const fs = require('node:fs');
-const http = require('node:http');
-const https = require('node:https');
-const path = require('node:path');
-const {
-  Worker,
-  isMainThread,
-  parentPort,
-  workerData,
-} = require('node:worker_threads');
-
-const DEFAULT_HOST = process.env.RS_MODE_HOST || '127.0.0.1';
-const DEFAULT_PORT = Number(process.env.RS_JS_PORT || 8080);
-const DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024;
-const DEFAULT_REQUEST_TIMEOUT = 20_000;
-const DEFAULT_WORKER_TIMEOUT = 40_000;
-const DEFAULT_OUT_JS_DIR = path.join(__dirname, 'out_js');
-
-function parseAttributes(text) {
-  const attributes = {};
-  const matcher = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
-  let match;
-  while ((match = matcher.exec(text)) !== null) {
-    attributes[match[1].toLowerCase()] = match[2] ?? match[3] ?? match[4] ?? '';
-  }
-  return attributes;
-}
-
-function parseChallengeHtml(html) {
-  const metas = Array.from(html.matchAll(/<meta\b([^>]*)>/gi), (match) => ({
-    attributes: parseAttributes(match[1]),
-  }));
-  const scripts = Array.from(html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi), (match) => ({
-    attributes: parseAttributes(match[1]),
-    content: match[2],
-  }));
-
-  const meta = metas.find((tag) => tag.attributes.r === 'm');
-  if (!meta || !meta.attributes.id || !meta.attributes.content) {
-    throw new Error('missing r=m meta challenge marker');
-  }
-
-  const inline = scripts.find(
-    (tag) => tag.attributes.r === 'm' &&
-      !tag.attributes.src &&
-      tag.content.includes('$_'),
-  );
-  if (!inline) {
-    throw new Error('missing inline r=m challenge script');
-  }
-
-  const external = scripts.find((tag) => tag.attributes.r === 'm' && tag.attributes.src);
-  if (!external) {
-    throw new Error('missing external r=m challenge script');
-  }
-
-  return {
-    inlineCode: inline.content,
-    outJsPath: external.attributes.src,
-  };
-}
-
-function fetchText(targetUrl, ua, referer, requestTimeout, redirectCount = 0) {
-  if (redirectCount > 5) {
-    return Promise.reject(new Error('too many external script redirects'));
-  }
-
-  const client = targetUrl.startsWith('https:') ? https : http;
-  return new Promise((resolve, reject) => {
-    const options = {
-      headers: {
-        'User-Agent': ua,
-        Referer: referer,
-      },
-      timeout: requestTimeout,
-    };
-    if (client === https) {
-      options.rejectUnauthorized = false;
-      options.secureOptions = crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT;
-    }
-
-    const request = client.get(targetUrl, options, (response) => {
-      const { statusCode = 0, headers } = response;
-      if (statusCode >= 300 && statusCode < 400 && headers.location) {
-        response.resume();
-        resolve(fetchText(new URL(headers.location, targetUrl).href, ua, referer, requestTimeout, redirectCount + 1));
-        return;
-      }
-      if (statusCode < 200 || statusCode >= 300) {
-        response.resume();
-        reject(new Error(`external script request failed with status ${statusCode}`));
-        return;
-      }
-
-      let text = '';
-      response.setEncoding('utf8');
-      response.on('data', (chunk) => { text += chunk; });
-      response.on('end', () => resolve(text));
-      response.on('error', reject);
-    });
-    request.on('timeout', () => request.destroy(new Error('external script request timed out')));
-    request.on('error', reject);
-  });
-}
-
-async function loadOutJs(outJsUrl, ua, referer, { outJsDir, requestTimeout }) {
-  const parsedUrl = new URL(outJsUrl);
-  const fileName = path.basename(parsedUrl.pathname) || 'challenge.js';
-  const cachePath = path.join(outJsDir, fileName);
-
-  try {
-    return {
-      content: await fs.promises.readFile(cachePath, 'utf8'),
-      fileName,
-      source: 'cache',
-    };
-  } catch (error) {
-    if (error.code !== 'ENOENT') throw error;
-  }
-
-  const content = await fetchText(outJsUrl, ua, referer, requestTimeout);
-  await fs.promises.mkdir(outJsDir, { recursive: true });
-  const temporaryPath = `${cachePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  await fs.promises.writeFile(temporaryPath, content, 'utf8');
-  await fs.promises.rename(temporaryPath, cachePath);
-  return { content, fileName, source: 'network' };
-}
-
-function parseCookies(cookieHeader) {
-  const cookies = {};
-  for (const part of cookieHeader.split(';')) {
-    const separator = part.indexOf('=');
-    if (separator <= 0) continue;
-    const name = part.slice(0, separator).trim();
-    const value = part.slice(separator + 1).trim();
-    if (name) cookies[name] = value;
-  }
-  return cookies;
-}
-
-function installBrowserEnvironment({ html, url, ua }) {
-  const { install } = require('node:browser-env');
-  install({
-    url,
-    html,
-    // A challenge runs through new Function below, so it has no CommonJS
-    // lexical bindings. Remove Node-only globals from that Worker Realm too.
-    hideNodeGlobals: true,
-    navigator: {
-      userAgent: ua,
-      platform: 'Win32',
-      language: 'zh-CN',
-      languages: ['zh-CN', 'zh'],
-      vendor: 'Google Inc.',
-      webdriver: false,
-      maxTouchPoints: 0,
-      appVersion: ua.replace(/^Mozilla\//, ''),
-      appName: 'Netscape',
-    },
-    screen: {
-      availHeight: 1040,
-      availLeft: 0,
-      availTop: 0,
-      availWidth: 1920,
-      colorDepth: 24,
-      height: 1080,
-      pixelDepth: 24,
-      width: 1920,
-    },
-    window: {
-      properties: {
-        innerHeight: 1080,
-        innerWidth: 1920,
-        outerHeight: 1080,
-        outerWidth: 1920,
-        screenLeft: 0,
-        screenTop: 0,
-        screenX: 0,
-        screenY: 0,
-      },
-    },
-    document: {
-      properties: {
-        visibilityState: 'hidden',
-      },
-    },
-  });
-}
-
-async function generateCookie(payload, options) {
-  const { html, url, ua } = payload;
-  if (typeof html !== 'string' || !html || typeof url !== 'string' || !url || typeof ua !== 'string' || !ua) {
-    throw new Error('html, url, and ua must be non-empty strings');
-  }
-
-  const challenge = parseChallengeHtml(html);
-  const outJsUrl = new URL(challenge.outJsPath, url).href;
-  const outJs = await loadOutJs(outJsUrl, ua, url, options);
-
-  installBrowserEnvironment({ html, url, ua });
-  const executeChallenge = new Function(`${challenge.inlineCode}\n${outJs.content}`);
-  const result = executeChallenge();
-  if (result && typeof result.then === 'function') await result;
-
-  return {
-    cookies: parseCookies(document.cookie),
-    outJsFile: outJs.fileName,
-    outJsSource: outJs.source,
-  };
-}
-
-function runWorker(payload, options) {
-  return new Promise((resolve, reject) => {
-    const worker = new Worker(__filename, { workerData: { payload, options } });
-    let settled = false;
-    const settle = (callback, value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      callback(value);
-    };
-    const timer = setTimeout(() => {
-      settle(reject, new Error('challenge worker timed out'));
-      worker.terminate().catch(() => {});
-    }, options.workerTimeout);
-
-    worker.once('message', (message) => {
-      if (message.ok) settle(resolve, message.value);
-      else settle(reject, new Error(message.error));
-    });
-    worker.once('error', (error) => settle(reject, error));
-    worker.once('exit', (code) => {
-      if (!settled && code !== 0) settle(reject, new Error(`challenge worker exited with code ${code}`));
-    });
-  });
-}
-
-function sendJson(response, statusCode, body) {
-  response.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
-  response.end(JSON.stringify(body));
-}
-
-function readJson(request, maxBodySize) {
-  return new Promise((resolve, reject) => {
-    let size = 0;
-    let body = '';
-    let rejected = false;
-    request.setEncoding('utf8');
-    request.on('data', (chunk) => {
-      if (rejected) return;
-      size += Buffer.byteLength(chunk);
-      if (size > maxBodySize) {
-        rejected = true;
-        reject(new Error('request body exceeds 10 MB limit'));
-        return;
-      }
-      body += chunk;
-    });
-    request.on('end', () => {
-      if (rejected) return;
-      try {
-        resolve(JSON.parse(body));
-      } catch {
-        reject(new Error('invalid JSON body'));
-      }
-    });
-    request.on('error', reject);
-  });
-}
-
-function createRsServer(overrides = {}) {
-  const options = {
-    maxBodySize: overrides.maxBodySize ?? DEFAULT_MAX_BODY_SIZE,
-    outJsDir: overrides.outJsDir ?? DEFAULT_OUT_JS_DIR,
-    requestTimeout: overrides.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT,
-    workerTimeout: overrides.workerTimeout ?? DEFAULT_WORKER_TIMEOUT,
-  };
-
-  return http.createServer(async (request, response) => {
-    if (request.method === 'GET' && request.url === '/health') {
-      sendJson(response, 200, { status: 'ok' });
-      return;
-    }
-    if (request.method !== 'POST' || request.url !== '/rs_env') {
-      sendJson(response, 404, {});
-      return;
-    }
-
-    try {
-      const payload = await readJson(request, options.maxBodySize);
-      const result = await runWorker(payload, options);
-      console.log(`[out_js:${result.outJsSource}] ${result.outJsFile}`);
-      sendJson(response, 200, result.cookies);
-    } catch (error) {
-      console.error(`[rs_mode_server] ${error.message}`);
-      sendJson(response, 500, {});
-    }
-  });
-}
-
-function startServer() {
-  const server = createRsServer();
-  server.listen(DEFAULT_PORT, DEFAULT_HOST, () => {
-    console.log(`Mode rs_env server listening on http://${DEFAULT_HOST}:${DEFAULT_PORT}`);
-  });
-  return server;
-}
-
-if (isMainThread) {
-  module.exports = { createRsServer, parseChallengeHtml, startServer };
-  if (require.main === module) startServer();
-} else {
-  generateCookie(workerData.payload, workerData.options)
-    .then((value) => parentPort.postMessage({ ok: true, value }))
-    .catch((error) => parentPort.postMessage({ ok: false, error: error.message }));
-}
diff --git a/rs_mode_server/test/fixtures/challenge.html b/rs_mode_server/test/fixtures/challenge.html
deleted file mode 100644
index 444d02abf45e..000000000000
--- a/rs_mode_server/test/fixtures/challenge.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<html>
-<head>
-  <meta r="m" id="fixture-meta" content="fixture-content">
-  <script r="m">
-    var $_ = { fixture: true };
-    if (document.getElementsByTagName('meta').item(0).getAttribute('id') !== 'fixture-meta') {
-      throw new Error('initial HTML is unavailable');
-    }
-    if (navigator.userAgent !== 'FixtureUA/1.0') {
-      throw new Error('dynamic user agent is unavailable');
-    }
-    if (window !== globalThis || !(document.all == null) || typeof document.all !== 'undefined') {
-      throw new Error('Mode browser globals are unavailable');
-    }
-    document.cookie = 'inline=ok; Path=/';
-  </script>
-  <script r="m" src="/challenge.js"></script>
-</head>
-<body><main id="app">fixture</main></body>
-</html>
diff --git a/rs_mode_server/test/fixtures/challenge.js b/rs_mode_server/test/fixtures/challenge.js
deleted file mode 100644
index 1a199ce53f90..000000000000
--- a/rs_mode_server/test/fixtures/challenge.js
+++ /dev/null
@@ -1,8 +0,0 @@
-'use strict';
-
-if (document.getElementById('app').textContent !== 'fixture') {
-  throw new Error('initial HTML is unavailable');
-}
-document.cookie = `storage=${localStorage.getItem('marker') === null ? 'fresh' : 'leaked'}`;
-localStorage.setItem('marker', 'present');
-document.cookie = 'external=ok; Path=/';
diff --git a/rs_mode_server/test/server.test.js b/rs_mode_server/test/server.test.js
deleted file mode 100644
index 8607ef6ad944..000000000000
--- a/rs_mode_server/test/server.test.js
+++ /dev/null
@@ -1,191 +0,0 @@
-'use strict';
-
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const http = require('node:http');
-const os = require('node:os');
-const path = require('node:path');
-const test = require('node:test');
-
-const { createRsServer } = require('../server.js');
-
-const fixturesDirectory = path.join(__dirname, 'fixtures');
-const fixtureHtml = fs.readFileSync(path.join(fixturesDirectory, 'challenge.html'), 'utf8');
-const fixtureScript = fs.readFileSync(path.join(fixturesDirectory, 'challenge.js'), 'utf8');
-
-function listen(server) {
-  return new Promise((resolve) => {
-    server.listen(0, '127.0.0.1', () => resolve(server.address().port));
-  });
-}
-
-function close(server) {
-  return new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
-}
-
-function request(port, method, pathname, body) {
-  return new Promise((resolve, reject) => {
-    const payload = body === undefined ? '' : typeof body === 'string' ? body : JSON.stringify(body);
-    const headers = payload ? {
-      'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(payload),
-    } : {};
-    const clientRequest = http.request({
-      host: '127.0.0.1',
-      port,
-      method,
-      path: pathname,
-      headers,
-    }, (response) => {
-      let text = '';
-      response.setEncoding('utf8');
-      response.on('data', (chunk) => { text += chunk; });
-      response.on('end', () => resolve({ statusCode: response.statusCode, body: JSON.parse(text) }));
-    });
-    clientRequest.on('error', reject);
-    clientRequest.end(payload);
-  });
-}
-
-function challengeWith(inlineCode, outJsPath = '/challenge.js') {
-  return `<!doctype html><html><head>
-    <meta r="m" id="fixture-meta" content="fixture-content">
-    <script r="m">${inlineCode}</script>
-    <script r="m" src="${outJsPath}"></script>
-  </head><body></body></html>`;
-}
-
-let cacheDirectory;
-let fixtureServer;
-let fixturePort;
-let rsServer;
-let rsPort;
-
-test.before(async () => {
-  cacheDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'mode-rs-env-'));
-  fixtureServer = http.createServer((request, response) => {
-    if (request.url === '/challenge.js') {
-      response.writeHead(200, { 'Content-Type': 'application/javascript' });
-      response.end(fixtureScript);
-      return;
-    }
-    response.writeHead(404);
-    response.end('not found');
-  });
-  fixturePort = await listen(fixtureServer);
-  rsServer = createRsServer({ outJsDir: cacheDirectory, workerTimeout: 2_000 });
-  rsPort = await listen(rsServer);
-});
-
-test.after(async () => {
-  await close(rsServer);
-  await close(fixtureServer);
-  fs.rmSync(cacheDirectory, { recursive: true, force: true });
-});
-
-function validPayload() {
-  return {
-    html: fixtureHtml,
-    url: `http://127.0.0.1:${fixturePort}/page`,
-    ua: 'FixtureUA/1.0',
-  };
-}
-
-test('health and unknown routes retain the compatibility service shape', async () => {
-  assert.deepEqual(await request(rsPort, 'GET', '/health'), {
-    statusCode: 200,
-    body: { status: 'ok' },
-  });
-  assert.deepEqual(await request(rsPort, 'GET', '/unknown'), {
-    statusCode: 404,
-    body: {},
-  });
-});
-
-test('runs local inline and external challenge scripts in Mode browser-env', async () => {
-  const response = await request(rsPort, 'POST', '/rs_env', validPayload());
-  assert.equal(response.statusCode, 200);
-  assert.deepEqual(response.body, {
-    external: 'ok',
-    inline: 'ok',
-    storage: 'fresh',
-  });
-});
-
-test('challenge workers expose browser globals without Node global aliases', async () => {
-  const response = await request(rsPort, 'POST', '/rs_env', {
-    ...validPayload(),
-    html: fixtureHtml.replace('var $_ = { fixture: true };', `
-      var $_ = { fixture: true };
-      if ([typeof global, typeof process, typeof require, typeof setImmediate].some((type) => type !== 'undefined')) {
-        throw new Error('Node global leaked into challenge');
-      }
-    `),
-  });
-  assert.equal(response.statusCode, 200);
-  assert.equal(response.body.inline, 'ok');
-  assert.equal(response.body.external, 'ok');
-});
-
-test('cookies and storage do not leak between request workers', async () => {
-  const first = await request(rsPort, 'POST', '/rs_env', validPayload());
-  const second = await request(rsPort, 'POST', '/rs_env', validPayload());
-  assert.equal(first.statusCode, 200);
-  assert.equal(second.statusCode, 200);
-  assert.equal(first.body.storage, 'fresh');
-  assert.equal(second.body.storage, 'fresh');
-});
-
-test('invalid input, absent challenge pieces, and failed external loads return compatibility errors', async () => {
-  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', '{'), {
-    statusCode: 500,
-    body: {},
-  });
-  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', {}), {
-    statusCode: 500,
-    body: {},
-  });
-  assert.deepEqual(await request(rsPort, 'POST', '/rs_env', {
-    ...validPayload(),
-    html: challengeWith('var $_ = 1;', '/missing.js'),
-  }), {
-    statusCode: 500,
-    body: {},
-  });
-});
-
-test('the request-size limit keeps the HTTP 500 compatibility response', async () => {
-  const limitedServer = createRsServer({ maxBodySize: 16, outJsDir: cacheDirectory });
-  const limitedPort = await listen(limitedServer);
-  try {
-    assert.deepEqual(await request(limitedPort, 'POST', '/rs_env', { tooLarge: 'this request exceeds sixteen bytes' }), {
-      statusCode: 500,
-      body: {},
-    });
-  } finally {
-    await close(limitedServer);
-  }
-});
-
-test('XMLHttpRequest compatibility runs without loading env.js', async () => {
-  const response = await request(rsPort, 'POST', '/rs_env', {
-    ...validPayload(),
-    html: fixtureHtml.replace("document.cookie = 'inline=ok; Path=/';", `
-      var xhr = new XMLHttpRequest();
-      xhr.open('POST', '/probe');
-      xhr.send('payload');
-      document.cookie = 'xhr=' + encode_url + ':' + encode_data;
-      document.cookie = 'inline=ok; Path=/';
-    `),
-  });
-  assert.equal(response.statusCode, 200);
-  assert.equal(response.body.xhr, '/probe:payload');
-});
-
-test('a runaway challenge is terminated by the worker timeout', async () => {
-  const response = await request(rsPort, 'POST', '/rs_env', {
-    ...validPayload(),
-    html: challengeWith('var $_ = 1; while (true) {}'),
-  });
-  assert.deepEqual(response, { statusCode: 500, body: {} });
-});