fix(browser,js): enforce navigation deadline through synchronous V8 execution

`tokio::time::timeout` only fires at `.await` points. Any synchronous V8
work — script evaluation, module top-level code — holds the tokio executor
thread for its entire duration, making the outer async timeout invisible to
scripts that never yield. A page with heavy synchronous scripts could run
arbitrarily past `--timeout` with no way to interrupt it.

Fix: add `navigation_deadline: Option<Instant>` to `Page` and thread it
through every execution phase.

**Script phase** — each `execute_script_with_timeout` call receives the
remaining budget as its hard ceiling. When the budget expires a watchdog
thread fires `terminate_execution()` in a tight loop (every 10 ms) so that
scripts with `try-catch` error-recovery handlers are still eventually
terminated rather than absorbing a single termination call and continuing.
Scripts are also skipped entirely once the deadline has passed, cutting the
iteration short rather than starting work we know will be cancelled.

**Network fetch phase** — each parallel script fetch is wrapped in
`tokio::time::timeout(remaining_budget, ...)` so a slow CDN response cannot
by itself exhaust the navigation deadline; fetch failures are treated as
absent scripts rather than errors.

**ES module phase** — V8's `terminate_execution` is catchable by JavaScript
`try-catch`, and heavy modules with error-recovery paths run *longer* when
disturbed than when left to complete naturally. A threshold guard skips any
module when the remaining budget is below 15 s; the module would outlast the
deadline regardless, so it is better to skip it cleanly than to start work
that cannot be reliably stopped.

**Load-events / event-loop drain** — the DOMContentLoaded + load dispatch is
capped at the remaining budget (min 50 ms to allow basic event handling).
The idle event-loop drain is capped at min(500 ms, remaining) and now checks
the deadline on *every* iteration, not only in the timeout branch.

**Error surface** — a new `PageError::NavigationTimedOut` variant is
returned when `execute_scripts` exits because the deadline was reached,
letting the CLI distinguish a timeout from a genuine navigation failure and
produce an accurate "Timed out after Ns" message rather than silently
returning a partially-rendered page.

Also switches `eval_module_with_timeout` from `run_event_loop` to
`with_event_loop_promise`: the former waits for *all* pending work in the
runtime to drain (blocking forever on a page with a live `setInterval`),
while the latter resolves as soon as the module's top-level evaluation
completes.

Author: marcbachmann

crates/obscura-browser/src/page.rs

@@ -142,6 +142,12 @@ pub struct Page {
     // contract. Includes `Runtime.addBinding` shims so puppeteer's
     // `exposeFunction` bindings exist before inline `<script>` tags execute.
     preload_scripts: Vec<String>,
+    /// Hard wall-clock deadline for the *current* navigation. Threaded
+    /// into the synchronous JS execution path so a single page-supplied
+    /// script can no longer hold the tokio executor past `--timeout` —
+    /// `tokio::time::timeout` only fires at await points, and inline
+    /// `<script>` evaluation has none.
+    navigation_deadline: Option<std::time::Instant>,
     #[cfg(feature = "stealth")]
     pub stealth_client: Option<Arc<StealthHttpClient>>,
 }
@@ -187,11 +193,29 @@ impl Page {
             intercept_block_patterns: Vec::new(),
             intercept_tx: None,
             preload_scripts: Vec::new(),
+            navigation_deadline: None,
             #[cfg(feature = "stealth")]
             stealth_client,
         }
     }
 
+    /// Set a wall-clock deadline that bounds the next navigation. Pass
+    /// `None` to clear. The deadline is checked between scripts and is
+    /// also handed to the per-script V8 watchdog so synchronous JS work
+    /// is terminated when it overruns.
+    pub fn set_navigation_deadline(&mut self, deadline: Option<std::time::Instant>) {
+        self.navigation_deadline = deadline;
+    }
+
+    fn navigation_remaining(&self) -> Option<std::time::Duration> {
+        self.navigation_deadline
+            .map(|d| d.saturating_duration_since(std::time::Instant::now()))
+    }
+
+    fn navigation_expired(&self) -> bool {
+        matches!(self.navigation_remaining(), Some(r) if r.is_zero())
+    }
+
     fn should_block_url(&self, url: &str) -> bool {
         if !self.intercept_enabled || self.intercept_block_patterns.is_empty() {
             return false;
@@ -387,18 +411,27 @@ impl Page {
         }
 
         let client = self.http_client.clone();
+        let nav_deadline = self.navigation_deadline;
         let fetch_futures: Vec<_> = fetch_tasks.iter().map(|(idx, url)| {
             let client = client.clone();
             let url = url.clone();
             let idx = *idx;
             async move {
                 let parsed = Url::parse(&url).unwrap_or_else(|_| Url::parse("about:blank").unwrap());
-                match client.fetch(&parsed).await {
-                    Ok(resp) => Some((idx, url, resp)),
-                    Err(e) => {
+                let fetch_budget = nav_deadline
+                    .map(|d| d.saturating_duration_since(std::time::Instant::now()))
+                    .filter(|d| !d.is_zero())
+                    .unwrap_or_else(|| std::time::Duration::from_secs(30));
+                match tokio::time::timeout(fetch_budget, client.fetch(&parsed)).await {
+                    Ok(Ok(resp)) => Some((idx, url, resp)),
+                    Ok(Err(e)) => {
                         tracing::warn!("Failed to fetch script {}: {}", url, e);
                         None
                     }
+                    Err(_) => {
+                        tracing::debug!("Script fetch deadline exceeded: {}", url);
+                        None
+                    }
                 }
             }
         }).collect();
@@ -437,26 +470,58 @@ impl Page {
         }
 
         for (i, script) in all_to_execute.iter().enumerate() {
+            // Hard cut-off when the caller's deadline has elapsed. Without
+            // this, `--timeout=1` on a script-heavy page would still run
+            // every remaining `<script>` to completion because the
+            // synchronous V8 calls below never yield to the tokio
+            // executor.
+            if self.navigation_expired() {
+                break;
+            }
+            let script_budget = self
+                .navigation_remaining()
+                .unwrap_or_else(|| std::time::Duration::from_secs(5));
+
             if script.src.is_some() {
                 if let Some((url, code, resp)) = fetched.remove(&i) {
                     tracing::info!("Executing script ({} bytes): {}", code.len(), url);
                     self.record_network_event(&url, "GET", "Script", resp.status, &resp.headers, resp.body.len());
                     if let Some(js) = &mut self.js {
-                        if let Err(e) = js.execute_script_guarded(&url, &code) {
+                        if let Err(e) = js.execute_script_with_timeout(&code, script_budget) {
                             tracing::warn!("Script error ({}): {}", url, e);
                         }
                     }
                 }
             } else if !script.inline.is_empty() {
                 if let Some(js) = &mut self.js {
-                    if let Err(e) = js.execute_script_guarded("<inline>", &script.inline) {
+                    if let Err(e) = js.execute_script_with_timeout(&script.inline, script_budget) {
                         tracing::warn!("Inline script error: {}", e);
                     }
                 }
             }
         }
 
-        for module_script in &module_scripts {
+        for module_script in module_scripts.iter() {
+            if self.navigation_expired() {
+                break;
+            }
+            let module_budget = self
+                .navigation_remaining()
+                .unwrap_or_else(|| std::time::Duration::from_secs(10));
+
+            // V8 module evaluation cannot be reliably interrupted: JS try-catch
+            // absorbs terminate_execution(), so the module runs to natural
+            // completion regardless of the watchdog. Only start a module when
+            // there is enough budget to absorb its worst-case run time.
+            const MIN_MODULE_BUDGET: std::time::Duration = std::time::Duration::from_secs(15);
+            if self.navigation_deadline.is_some() && module_budget < MIN_MODULE_BUDGET {
+                tracing::info!(
+                    "skipping ES module: only {:.1}s remaining (need {}s min)",
+                    module_budget.as_secs_f64(),
+                    MIN_MODULE_BUDGET.as_secs()
+                );
+                break;
+            }
             if let Some(ref src) = module_script.src {
                 let full_url = if src.starts_with("http://") || src.starts_with("https://") {
                     src.clone()
@@ -468,7 +533,7 @@ impl Page {
 
                 tracing::info!("Loading ES module: {}", full_url);
                 if let Some(js) = &mut self.js {
-                    match js.load_module(&full_url).await {
+                    match js.load_module(&full_url, module_budget).await {
                         Ok(()) => {
                             tracing::info!("ES module loaded: {}", full_url);
                             self.record_network_event(&full_url, "GET", "Script", 200, &std::collections::HashMap::new(), 0);
@@ -481,29 +546,51 @@ impl Page {
             } else if !module_script.inline.is_empty() {
                 let base = self.url_string();
                 if let Some(js) = &mut self.js {
-                    if let Err(e) = js.load_inline_module(&module_script.inline, &base).await {
+                    if let Err(e) = js.load_inline_module(&module_script.inline, &base, module_budget).await {
                         tracing::warn!("Inline ES module error: {}", e);
                     }
                 }
             }
         }
 
+        // Compute budgets before mutably borrowing self.js.
+        let events_budget = self
+            .navigation_remaining()
+            .unwrap_or_else(|| std::time::Duration::from_secs(5))
+            .max(std::time::Duration::from_millis(50));
+        let event_loop_cap = std::time::Duration::from_millis(500);
+        let event_loop_budget = self
+            .navigation_remaining()
+            .map(|r| r.min(event_loop_cap))
+            .unwrap_or(event_loop_cap);
+
         if let Some(js) = &mut self.js {
             // Spec order: readyState -> interactive, fire DOMContentLoaded on both
             // document and window, then readyState -> complete, fire load.
-            let _ = js.execute_script("<load-events>",
+            // Allow at least 50 ms so basic event dispatch always completes, but cap
+            // at the remaining navigation budget so heavy onload handlers don't escape.
+            let _ = js.execute_script_with_timeout(
                 "globalThis.__documentReadyState__ = 'interactive';\n\
                  try { document.dispatchEvent(new Event('DOMContentLoaded', {bubbles:false,cancelable:false})); } catch(e) {}\n\
                  try { window.dispatchEvent(new Event('DOMContentLoaded', {bubbles:false,cancelable:false})); } catch(e) {}\n\
                  if (typeof window.onload === 'function') { try { window.onload(); } catch(e) {} }\n\
                  globalThis.__documentReadyState__ = 'complete';\n\
-                 try { window.dispatchEvent(new Event('load', {bubbles:false,cancelable:false})); } catch(e) {}");
+                 try { window.dispatchEvent(new Event('load', {bubbles:false,cancelable:false})); } catch(e) {}",
+                events_budget,
+            );
         }
 
         if let Some(js) = &mut self.js {
-            let deadline = tokio::time::Instant::now() + tokio::time::Duration::from_millis(500);
+            let deadline = tokio::time::Instant::now() + event_loop_budget;
             let mut idle_count = 0u32;
             loop {
+                // Check the deadline on every iteration, not only in the
+                // timeout branch — otherwise a page that keeps the event
+                // loop "busy" (microtask spirals, stuck XHRs) can loop here
+                // indefinitely because the deadline check is unreachable.
+                if tokio::time::Instant::now() >= deadline {
+                    break;
+                }
                 let result = tokio::time::timeout(
                     tokio::time::Duration::from_millis(10),
                     js.run_event_loop(),
@@ -525,9 +612,6 @@ impl Page {
                     Ok(Err(_)) => break,
                     Err(_) => {
                         idle_count = 0;
-                        if tokio::time::Instant::now() >= deadline {
-                            break;
-                        }
                     }
                 }
             }
@@ -795,6 +879,16 @@ impl Page {
 
         self.execute_scripts().await;
 
+        // execute_scripts honours the deadline internally and breaks
+        // early, but `Ok(())` from there is ambiguous: the caller still
+        // sees "navigation succeeded". Surface the timeout so the CLI
+        // produces the expected "Timed out navigating" error instead of
+        // silently returning a partially-rendered page.
+        if self.navigation_expired() {
+            self.lifecycle = LifecycleState::Failed;
+            return Err(PageError::NavigationTimedOut);
+        }
+
         if let Some(js) = &mut self.js {
             if let Ok(new_title) = js.evaluate("document.title") {
                 if let Some(t) = new_title.as_str() {
@@ -1103,6 +1197,9 @@ pub enum PageError {
 
     #[error("Too many redirects (limit {0})")]
     TooManyRedirects(usize),
+
+    #[error("Navigation deadline exceeded")]
+    NavigationTimedOut,
 }
 
 impl From<ObscuraNetError> for PageError {

crates/obscura-cli/src/main.rs

@@ -525,8 +525,25 @@ async fn run_fetch(
         eprintln!("Fetching {}...", url_str);
     }
 
+    // tokio::time::timeout can only fire at await points, so synchronous
+    // V8 work (page-supplied `<script>` evaluation) used to hold the
+    // executor for the entire duration of every script regardless of
+    // `--timeout`. Plumb the deadline into the page itself so each
+    // script runs under a V8 watchdog with the remaining budget, and
+    // the navigation aborts cleanly between scripts once the deadline
+    // is past. The outer `timeout(...)` wrapper still guards async-only
+    // hangs (slow network, idle wait).
+    let deadline = std::time::Instant::now() + Duration::from_secs(timeout_secs);
+    page.set_navigation_deadline(Some(deadline));
+
     match timeout(Duration::from_secs(timeout_secs), page.navigate_with_wait(url_str, wait_condition)).await {
-        Ok(result) => result.map_err(|e| anyhow::anyhow!("Failed to navigate to {}: {}", url_str, e))?,
+        Ok(Ok(())) => {}
+        Ok(Err(obscura_browser::page::PageError::NavigationTimedOut)) => anyhow::bail!(
+            "Timed out navigating to {} after {}s",
+            url_str,
+            timeout_secs
+        ),
+        Ok(Err(e)) => return Err(anyhow::anyhow!("Failed to navigate to {}: {}", url_str, e)),
         Err(_) => anyhow::bail!(
             "Timed out navigating to {} after {}s",
             url_str,