fix: resolve the P2 issues - #185

Fixes the open P2 issues from the September sweep, with tests for each fix and docs updated to match. Based on #184 (the P1 fixes), so review and merge that first.

Closes #85
Closes #86
Closes #87
Closes #88
Closes #89
Closes #90
Closes #91
Closes #92
Closes #93
Closes #94
Closes #95
Closes #96
Closes #97
Closes #98
Closes #99
Refs #100
Closes #101
Refs #102
Closes #105
Closes #106
Closes #107
Closes #108
Closes #109
Closes #110
Closes #111
Closes #112
Closes #113
Closes #114
Closes #115
Closes #116
Closes #117
Closes #118
Closes #119
Closes #121
Closes #122
Closes #123
Closes #124
Closes #125
Closes #126
Closes #127
Refs #128
Closes #129
Closes #130
Closes #131
Closes #132
Closes #133
Closes #134
Closes #135
Closes #136
Closes #137
Closes #138
Closes #139
Closes #140
Closes #141
Closes #142
Closes #143
Closes #144
Closes #145
Closes #146
Closes #147
Closes #148
Closes #149
Closes #150
Closes #151
Closes #152
Closes #153
Closes #154
Closes #155
Closes #156
Closes #158
Closes #159

Forms

• Forms field name button says "Highlight on the page" but opens a detail panel that can't be closed #85: The row button was named 'Highlight … on the page' but opened details, aria-pressed never toggled off, and the detail had no close and got no focus. The button is now 'Show details for ', a click toggles it, the detail has a Close button that returns focus to the row, and on open the detail scrolls into view and moves focus to its heading.
• Form markers mix per-page counters, so form-diff, form-history and wait-for-form miss changes #92: Each page numbers its events from 1, and the server merged them without renumbering, so markers mixed counters. mergePageReport now gives each event a global seq that stays the same when a page pushes the same events again and is reassigned after a reload (detected when a known page seq comes back with a different timestamp). The form-diff gap check now uses the smallest seq.
• Forms Lint says "No problems found" when the check fails, and Submit, Payload and field detail stay on "Loading…" #147: formsCall resolves null on failure, and the panels treated that as a result ('No problems found', or 'Loading…' forever). Lint, Submit/Payload and field detail now keep loading (null), result and failed states separate, show 'Could not …' with Try again on failure, and reset to loading when the form or field changes (linkedSignal).
• Forms panel offers a Set editor for fields inside a redacted group, then refuses the write #148: serializeControl and serializeField computed the reason 'parent' but only stored it when !parentSecret, and unmaterializedField never set it. They now always set node.redacted, so the panel shows the redacted badge and hides the Set editor for those children.

SSR and HTTP

• HTTP response preview opens below the whole timeline and focus does not move #86: The timeline had no height limit, so the preview opened below every row, and nothing moved focus or handled Escape. The timeline now scrolls inside a capped box with a sticky header, the preview is a labelled region whose heading takes focus when it opens, and Close or Escape returns focus to the row's URL button.
• Transfer cache hit reported for a request whose params differ from the SSR request #135: claimTransferEntry matched on the TransferState u field, which leaves out HttpParams, so /api/feed?page=2 claimed the entry stored for page=1. It now matches on Angular's cache key (method, response type, URL, body and sorted params), computed for every key format Angular has used from v20 to v22.1+. Analog entries still match on URL.
• HTTP fault rule form: prefilled 500 turns delay-only rules into errors, and body-only rules are ignored #149: The form started with /api/products and 500 filled in as real values, body-only rules were saved but let requests through, and rules that changed nothing were accepted. The form now starts empty with placeholders, a body with no status returns 200 (panel, sanitizeRules and interceptor), rules that change nothing are refused, the form resets after Add rule, the reload hint shows only for SSR rules, and a 51st rule is blocked.
• HTTP timeline shows cancelled requests as red ERR and never says which rule matched #150: A cancelled request was stored as status 0 and shown as a red ERR, and any matching rule set faulted. The interceptor now records cancelled, mocked, delayMs and rulePattern, and sets faulted only for status 400 and up. The panel shows cancelled requests in a neutral tone, splits the note into delayed N ms, mocked and faulted, and shows the matched rule in the row and in the preview.
• HTTP request URLs, page URLs and error messages are sent unredacted, while the router redacts the same URLs #158: HTTP call URLs, page URLs and error messages were stored and sent with no redaction. A new redactCall() runs them through the router's redactUrl/redactText in the overlay push (browser) and again in devframe for push-http and SSR record, so redaction.secretNames applies there too.

Injectors

• Injector tree rows read as bare numbers to screen readers #87: Screen readers got only bare numbers because the kind letter was aria-hidden and the counts were named only by title. The fix adds sr-only text to each tree row (kind, then 'injects N', 'provides N') and to the lookup path step count ('N providers').
• get-providers misses typed constructor injection, nested generic inject() and bare inject() calls #94: The scanner had four gaps: its regexes only matched name = inject(...) with a flat generic, only read @Inject(Token) parameters, and read providedIn: null as a string. inject() calls now use a bracket-matched generic scan and credit bare calls to the enclosing const, function or class. Typed constructor parameters of decorated classes are read, and a null providedIn is left out.
• inspect-providers returns the whole injector tree with no size cap, and selector does not filter it #95: inspect-providers always dumped the whole pretty-printed tree, and selector only labelled the answer. A new rpc/injector-tools.ts filters by selector (tag, class or id, with the lookup path resolved to names and tokens), adds a token argument (which injectors provide it and what injects it), and caps output at 20,000 characters with a hint to narrow the query.
• Injector tree skips every component inside a ShadowDom component #113: collectInjectorTree used a TreeWalker, which does not enter shadow roots, and climbed with parentElement. It now walks with a shared dom-walk.ts helper that enters open shadow roots and finds parents through the shadow host. Selectors are left out across shadow boundaries, and ngrx-collector uses the same walk.
• Injector tree truncation at 2000 nodes is dropped before it reaches the panel and inspect-providers #114: push-injector-tree dropped the truncated flag and the types had no field for it. The flag is now in the types, kept per page and at the top of the shared state, shown as a notice on the Injectors page, and stated in inspect-providers and the injector-tree resource description.
• Injectors label optional, ng-container and useValue: null dependencies as "not provided anywhere" #115: injectorRef dropped ng-container injectors (their source is a Comment), Angular's debug API treats a null provider value as missing, and the panel warned on optional deps. Comment sources are now named <ng-container> and listed in the tree and lookup path. A token listed in a provider list on the lookup path counts as provided. Optional deps show a neutral 'optional, not provided' label.

NgRx

• NgRx store: keyboard focus is lost when opening or closing the Restore confirmation #88: Cause: opening the Restore confirmation removed the focused button, and Cancel or Restore removed the group again, so focus fell to body. message was only ever set, never cleared. Fix: opening now focuses Cancel inside the labelled group, Cancel or Escape (which also calls preventDefault so the popup stays open) returns focus to Restore this state, restore keeps the P1 focus on the State tree or Back to latest, and selectPage, selectStore and selectEntry clear message.
• NgRx store log shows no change for actions that touch array items past 100 or keys past 100 #118: Cause: the classic log diffed two serialize() snapshots, which keep only the first 100 items or keys, so changes past that limit looked like no change. Fix: logClassic keeps the previous raw state and falls back to referenceDiff on live values when the serialized diff is empty but the state reference changed. This matches the signal store path.
• NgRx store: show where each action came from #119: Feature: while attached, the collector wraps Store.dispatch and Store.next and tags each action in a WeakMap as dispatch, effect (Store.next) or reactive. For reactive, it wraps the function given to dispatch(fn). stop puts the original methods back. The log entry has an origin, the panel shows it as a badge and an Origin row, and the ngrx-store resource description and docs are updated.
• Test the classic @ngrx/store collector against the real library and cover it in the demo #134: Feature: adds @ngrx/store and @ngrx/store-devtools ^22.0.1 as root devDependencies. A real-library TestBed suite covers detection by class name, the action log with origins, restore with and without DevTools, maxAge eviction, dispatch while paused, the ActionsSubject fallback and giving up after 5 misses. A real-Angular test covers a component-scoped signalStore and a signalState field. The demo gets a Lab page at /examples/store with a spec.

Signals

• Signals: value and history scroll boxes have no tabindex, and the change count is announced on every change #89: Cause: the value

   and the history 
   scroll but had no tabindex, and the history summary was aria-live, so it was read out again on every change. Fix: both boxes (and the new resource params, value and error boxes) now have tabindex="0", a label (role=region with aria-label, or aria-labelledby on the list) and a focus ring (m.focus-ring(-2px)). aria-live is removed from the summary.
  #117: Cause: on Angular 20.0 the graph nodes have no ids, so every node became "undefined" and graphKey never changed. Fix: a graph whose nodes lack ids now comes back as { unsupported: true }. The panel shows the source scan with the note "The live signal graph needs Angular 20.1 or later", and inspect-signals says the same. The DI empty state, signals.md, injectors.md, configuration.md, overlay.md, components.md and config.ts now give one minimum (Angular 20, and 20.1 for the live signal graph).
  #131: Cause: the collector only ever passed component-host injectors to ng.ɵgetSignalGraph. Fix: the collector finds the root and route environment injectors through ɵgetInjectorResolutionPath and pushes them as environments. The target { env } collects an R3Injector graph with the same node, edge and history code. The "Graph of" picker now lists Root services and Route: path entries. inspect-signals accepts root, /path, Route: path or an injector id: it switches the page and waits up to 1.5s for the graph. The demo TravelStore gets a root persistSaved effect.
  #132: Cause: the Resource#name.* internals and the httpResource extras reached the panel as separate nodes with no link between them, and linkedSignal state had no value. Fix: the new signal-resources.ts groups these nodes by label and edges into resources (status, isLoading, params, value, error, statusCode, nodeIds). It reads the resource's state without calling it and numbers unnamed resources. Status changes go into the history. The panel shows a Resources section with status tags, a status history and a toggle for the internal signals. inspect-signals and the signal-graph resource return the grouped view.
  #138: Cause: a linkedSignal value came from any instance getter whose name matched the node label, and the getter was called. Fix: a field's value is used only when exactly one field's SIGNAL node has the same name and version === epoch, and exactly one graph node has that label and epoch. The stored node.value is read only when the node is not dirty, so no user computation runs.
  #154: Cause: the badge and the summary counted the history list, which is capped at 50, and 400+ node graphs were cut with no notice. Fix: signal-history keeps a total per node and resource, gaps between capped writes included, and the overlay sends it as changes. The panel shows "N changes recorded, showing the last 50", uses correct plurals and no longer says "0 changes" over the initial entry. When the graph is cut, it sends nodeCount and the panel shows "Showing 400 of N signals".
  

Components

• Agents cannot pick a component to read its live detail; highlight never sets the selection #91: Only the panel's select-component set the page's componentTarget, and highlight used the first findComponents hit without saying how many matched. highlight now also selects the instance (shared selectedId plus inspect-component-in-page) and lists every matching id. A new read tool, ng-devtools:inspect-component, selects the instance, waits up to 3 s for the page to report it and returns the live detail. Both tools take an optional pageId, and the panel follows a selection made elsewhere.
• Components: show the selected component's own properties, not only inputs #109: componentDetail only read the keys in getDirectiveMetadata().inputs. A new detail.properties field lists own enumerable fields that are not inputs, outputs, methods, ngContext or injected services (matched by the dep.value that ɵgetDependenciesFromInjectable returns). Signals are unwrapped and resources become {status, value, error}. Values are capped with MAX_PROPS and VALUE_LIMITS and redacted through serializeNamed. The panel gets a Properties block, and the resource and tool descriptions mention the field.
• Inspect @defer blocks and incremental hydration state with ng.ɵgetControlFlowBlocks #116: The only defer data was a page-wide count. A new collector (defer-blocks.ts) calls ng.ɵgetControlFlowBlocks, or ng.ɵgetDeferBlocks as a fallback, on each Angular root. For each block it records the owner, state, hydration, triggers, loading and placeholder config, root element ids and state-change or hydratedAt times, and ids stay stable. The list goes into the component tree report. The panel shows a Defer blocks list (hidden when empty or when the util is missing), and a new ng-devtools:defer-blocks tool flags blocks that failed or are stuck on their placeholder. A /examples/defer demo page was added, with withIncrementalHydration() turned on.
• Components and Dashboard show the newest reporting tab instead of the inspected page #143: Without ?pageId, page() picked the newest reportedAt, so keepalive pushes swapped tabs, and the Dashboard read the global tree and graph. Components now keeps the shown page in a linkedSignal (picked page, then host page, then the previous page, then the newest) and adds a Page picker labelled with the url and title the overlay now reports. The Dashboard Injectors and Signals cards read pages[pageId] when a page id is known and no longer fall back to another page.
• Components filter shows no match count, and the live count announces app churn to screen readers #144: The count always showed the total inside an aria-live region, which announced app churn. filterTree now counts matching nodes only, the count reads 'N of M' while filtering, it is no longer a live region, and a separate status region announces the result only from setFilter.
• Components: a destroyed selected component clears the detail pane silently and drops keyboard focus #145: selectedNode went null while selectedId was kept, focus fell to body and the page kept componentTarget. reconcileSelection now drops a selection that left the tree (skipped when the tree is truncated) and sends select-component with a null id. The panel shows 'The selected component was destroyed' and announces it, and focus moves to the nearest remaining row (the next one, else the previous one or the parent).
• Components: pick an element on the page to select its component #146: Only the extension could go from the page to a component. A new startComponentPick (component-pick.ts) highlights the host under the pointer and selects the host of the clicked element. It ignores the popup, fades the floating panel through a data-picking attribute, and stops on Escape, cancel() or a 15 s timeout. It is wired through request-component-pick, component-pick, component-pick-result and cancel-component-pick. The panel has a Pick component on page / Cancel pick button, and Escape cancels from the panel too.

Overlay and popup

• Floating panel is not kept on screen and can only be dragged with a mouse #111: Cause: the toolbar drag only listened to mouse events, had no touch-action: none and gave no way to move the panel without dragging. The P1 branch already clamped the restored position and size. Fix: the toolbar drag now uses pointer events with capture and touch-action: none and ignores the dock and close buttons, and a double click on the toolbar resets the panel to its default place. Tests cover off-screen restore plus resize, touch drag, button presses that should not drag, dblclick reset and dock switching.
• Page highlight and floating button are hidden behind dialogs, popovers and CDK overlays in the top layer #121: Cause: the highlight box, launcher and panel were fixed elements with a z-index, so top-layer dialogs, popovers and CDK overlays painted over them. Fix: all three are now popover="manual" and shown with showPopover() when the API exists (the z-index stays as the fallback). The launcher and panel are shown again on any document toggle-open event, except for a :modal dialog.
• Page highlight skips SVG hosts and draws an empty box for display: contents, hidden or off-screen hosts #122: Cause: highlight-in-page only accepted HTMLElement and drew the raw getBoundingClientRect. Fix: highlighting moved to page-highlight.ts. It accepts any Element, uses the union of the children's boxes for an empty rect, draws nothing when that is empty too (and returns false), and scrolls into view with block 'nearest' when the request has reveal: true. The agent highlight tool and the Pipes chip click send that flag.
• Pages drop out of the panel when their tab is in the background or refreshMs is above 7500 #123: Cause: keepalives skipped a tick when elapsed < 8000 ms, so any refreshMs above 7500 reported only every ~16 s, past the 15 s TTL. Hidden tabs were throttled below the TTL too. Fix: a new keepaliveDue(sentAt, tickMs) sends when the next tick would be too late, and TTLs are shared through rpc/page-ttl.ts. Pages now pause collection on visibilitychange and send report-page-visibility (repeated every 60 s while hidden), and the server keeps hidden pages until 5 minutes pass without that signal. The panel says 'Tab in background, showing the last data.'
• Pressing Escape to clear a filter box also closes the popup panel #127: Cause: the popup closed on any Escape from the frame that was not defaultPrevented, and search boxes clear on Escape without preventDefault (native type=search does the same). Fix: a capture-phase listener on the frame document marks Escape events whose target is a type=search input with text, and the close handler ignores them. Test: Escape in a filled search box clears it and keeps the panel open, and a second Escape closes it.
• Selected inspector tab resets to Dashboard on every page reload in the extension and popup #152: Cause: the tab was only restored from #tab=, and the extension and popup reload the panel without a hash. Fix: the new app/src/tab-memory.ts saves the tab in sessionStorage per view (inside try/catch) when the user switches tabs. On load the hash wins, otherwise the saved tab is used, and a tab that is not available falls back to Dashboard.

Router

• navigate waitFor: 'stable' is a fixed 300 ms delay, not app stability #96: Cause: waitFor: 'stable' waited a fixed 300 ms after the navigation ended. Fix: new waitForStable() in router-actions.ts waits on the Router's root PendingTasksInternal (the same signal ApplicationRef.whenStable() reads), within the 10s WAIT_MS. The result now includes stable: true, stable: false with a note, or stable: 'unknown'. The tool schema also describes waitFor now.
• Router detection fails on Angular 20.0 to 20.3.4, and CI never tests the declared peer range #100 (partly): Partly fixed. Cause confirmed: ɵgetRouterInstance first ships in @angular/router 20.3.5 (checked with npm pack of 20.3.4 and 20.3.5). Fix: Analog's routerOf now falls back to findRouters (the injector-provider lookup), setupKind reports 'unknown' when the util is missing on versions below 20.3.5 (new publishesRouterUtil), and the docs name the tested Angular and Node versions.
• DevTools Lab: add a route scenario that triggers router loop detection #102 (partly): Cause: the Routes lab had no loop case. Fix: added loop-a/loop-b routes whose guards redirect to each other five times and then to summary?from=loop (a bounded module counter), a Guard loop link, RenderMode.Client entries for both routes, a root-app spec, and docs in demo-apps.md and router.md.
• Probe in app runs a full navigation when a canMatch guard redirects #128 (partly): Cause: probe only tracked its own navigation id, so when canMatch redirected (UrlTree, RedirectCommand, or the error handler) the follow-up navigation ran to completion. Fix: after a Redirect cancel, probe takes over the next navigation id and aborts it at NavigationStart, marks both records as probes, and returns redirectedTo. The panel message and the tool description report this too.
• Router instrumentation: class guards and resolvers shared by several routes always report the first route #129: Cause: class guard and resolver wrappers sit on the shared prototype and fixed the first route's path (and resolve key) when they were created. Fix: a module WeakMap maps each route config to its path, and the wrapper works out the route (and resolve key) from its run arguments (Route for canMatch/canLoad, snapshot.routeConfig otherwise, walking up to the declaring route for canActivateChild).
• Router setup detection: initialNavigation and withDebugTracing() are wrong for provideRouter apps, and nothing tests it against a real Router #130: Cause: detectSetup only read router.options and missed the INITIAL_NAVIGATION token, the withDebugTracing initializer and platform navigation. Testing against a real Router also showed the scroller was never detected (its token is an InjectionToken, not a RouterScroller class). Fix: read INITIAL_NAVIGATION from the explicit providers, find the tracing initializer in the injector records, add a platformNavigation feature (NavigationStateManager), and fall back to the 'Router Scroller' token. Real-Router tests now cover every with* feature and the forRoot options.
• Router Lint shows an all-clear when it could not check, and stops re-running after 50 navigations #151: Cause: router-lint returned [] when it could not check, the panel turned RPC failures into [], re-runs were keyed on the capped navigations.length, and every re-run replaced the list and could be overwritten by a stale answer. Fix: the server returns {checked:false, reason} or {checked:true, findings}. The panel shows 'No checks ran' with events-only or no-config wording, and an error with Retry. Re-runs are keyed on the last navigation's id and outcome, findings stay visible during automatic re-runs, and a sequence token drops stale answers.

Analog

• Analog demo: login and register give no field errors, and checkout shows errors before any input #101: Cause: login and register had no per-field errors, aria-invalid, aria-describedby or invalid style, and checkout showed errors before any touch. Fix: per-field errors after touch or submit with aria-invalid and aria-describedby, a register status line, checkout errors gated on touched(), and an --error token with an invalid border (light #b91c1c, dark #f87171 for AA contrast). Invalid states are still reachable for the Forms inspector.
• Analog load() preview redacts normal keys like author and passengers #105: Cause: redact() in analog-runtime.ts hid any key containing a secret substring (auth, pass, card and so on), so author and passengers were hidden. Fix: it now uses the whole-word isSecretKey from analog-server-log.ts, plus the custom redaction.secretNames, the same check server call previews use.
• Analog render modes: last request never matches dynamic pages, routeRules match by prefix, and most route rules are ignored #106: Cause: last-request rows were keyed by the real URL but looked up by pattern, /x/** matched by string prefix, and only ssr: false route rules were read. Fix: requests are matched to rows with explainUrl, matching follows Nitro (/x/** covers /x and below, * is one segment, the most specific rule wins), every rule kind is parsed (ssr, prerender, isr, swr, cache, redirect, Cache-Control) and cited as the reason, Cached and Redirect modes are new, and prerender: true rules feed the Prerender plan.
• Analog: form action submissions are logged as load() fetches #107: Cause: classify() mapped every method on /_analog/pages to load. Fix: a new action kind for non-GET/HEAD requests, with a success, redirect (redacted Location), invalid (X-Analog-Errors, redacted preview) or error outcome. It is in the Server filter, analog-server-calls and its kind enum, and duplicateLoads() now pairs GET loads only.
• Analog: show server functions by name, including SSR calls, and stop false lint warnings for them #108: Cause: the scan only looked at page .server.ts files for load/action, calls showed opaque ids, SSR calls skip HTTP, and __analog_fn_ seeds were unlabeled. Fix: scan every src/**/*.server.ts for serverFn exports with Analog's sha256 id and method, show names in the Server list, analog-server-calls and payload labels, record SSR reads from their TransferState seeds in the page HTML, flag a seeded read called again after hydration (lint fn-fetched-twice, a callout, notes), stop the two false warnings, and add the analog-server-functions MCP tool plus a Server functions table.
• Analog Routes and Server tabs: Test a URL shows stale results, and the request playground has no pending state #141: Cause: the Test a URL callout showed the live input text over an old result, and failures and empty input did nothing. send() kept the old response and left Send enabled. Fix: the result now stores the URL it explains, shows empty-input and RPC errors, and has an Explaining state. The playground has a sending state that clears the old response and turns Send off. Send also stays off for POST/PUT/PATCH/DELETE until the checkbox is ticked, with a hint that points to it.
• Analog lint cards hide the per-finding message, so hydration errors and duplicate files lose their details #142: Cause: lintCards kept only file and path for each finding and dropped message. Fix: each card item keeps the per-finding message and shows it (skipped for rules whose message only repeats the summary), and identical items are deduped.

Pipes

• Flag async pipes that resubscribe on every check, like getData() | async #110: There was no per-instance history of AsyncPipe sources and no lint rule for this. The collector keeps a WeakMap of each AsyncPipe's last _obj and sets resubscribing once the source changed on 3 reports in a row. A new async-on-call info lint rule flags method calls before | async, skipping signal/input/computed/linkedSignal/toSignal/model fields and $any. Both show up in explain-pipe and the panel (resubscribing chip).
• Pipe source scan misses pipes in @let, @else if and @defer (when ...) #124: expressionRegionsIn (rpc/get-pipes.ts) only read {{ }}, bound attributes and @if/@for/@switch/@case, so pipes in @let, @else if and @defer triggers were missed. Added @else if and @defer to the control regex and a @let region that ends at its top-level ';' (skips strings and brackets). impure-pipe-in-for picks this up too.
• Pipes recording: a new recording adds to the old counts, and Record shows "Recording on 0 page(s)" with no page #125: Call stats lived in one WeakMap for the collector's whole life, and the panel set the button before any page confirmed. Starting a recording now swaps in fresh stats and a fresh StaleTracker. request-instrument-pipes returns { pages }. The panel's instrumenting state is now computed from the confirmed pages, the button shows Starting…/Stopping… while it waits (5s timeout), and it says so when no page is connected.
• Pipes stale check: misses mutated Date, Map and Set, and keeps flagging pipes that already reran #126: shapeHash hashed Date/Map/Set as {} (no own keys), and the stale check never looked at whether transform ran. Date now hashes by getTime(), Map/Set by size plus capped entries. Each snapshot also stores the instance call count, so a pipe is only stale if transform did not run, and the flag clears once it runs again.
• signal-read-in-pure-pipe lint misses linkedSignal, toSignal, model and service signals #140: SIGNAL_FIELD only matched signal/input/computed, and only direct this.field() reads were checked. It now also matches linkedSignal, toSignal and model, and zero-argument calls on inject() or constructor-injected fields (this.rates.current()) are reported at info level as possible signal reads.

CLI, config and security

• Agent tools pick the browser tab inconsistently and fall back silently on a wrong page id #90: Cause: each live tool picked the page its own way. highlight and inspect-signals had no page argument, findComponents walked pages oldest first, and an unknown pageId/page fell back silently or blamed stdio. Fix: a shared page argument (rpc/pages.ts PAGE_ARGUMENT, inspect-providers keeps pageId as an alias), one unknownPageText message that lists the reporting pages newest first (used by the router noPage, forms, highlight, inspect-signals, inspect-providers and navigate), names resolved on the newest page with a note for other matches, and a new list-pages tool.
• Standalone CLI and stdio MCP server can't take any devtools config #93: Cause: bin.mjs passed the default export (always the defaults) to createCac, so mcp registered every tool, including page-only and write tools. Fix: a new createNgDevtoolsCli() in cli.ts adds --config <file> / NG_DEVTOOLS_CONFIG / ng-devtools.config.json and --read-only to dev, build and mcp, and passes the config through createNgDevtools(). Its new pageTools host option drops the tools listed in PAGE_AGENT_ENTRIES from mcp.
• Standalone CLI has no way to set the project folder, and scans from the wrong folder return empty data silently #133: Cause: every scan reads ctx.cwd = process.cwd(), and nothing could change it. Fix: --root <dir> / NG_DEVTOOLS_ROOT changes into the folder before the server starts and refuses a missing folder. If the folder has no angular.json and no package.json that depends on @angular/core, it prints a warning on stderr.
• Vite plugin: allowedOrigins entries with a trailing slash, path or uppercase host never match but still turn on the one-time code #136: Cause: isAllowedHubOrigin compared raw allowedOrigins entries with the browser origin, while allowsRemoteOrigins still counted them. Fix: new normalizeAllowedOrigins() reduces each entry to new URL(entry).origin once, warns through server.config.logger when it changes or drops an entry, and feeds the same list to both checks. A new blockedOriginReporter warns once per refused origin, for HTTP and WebSocket.
• Warn at startup when the devtools config has unknown keys, wrong types or clamped limits #137: Cause: resolveNgDevtoolsConfig() silently dropped unknown keys and wrong types and clamped limits. Fix: new ngDevtoolsConfigProblems() / ngDevtoolsConfigWarning() list unknown keys (with a "did you mean"), wrong types (with the value used instead) and clamped limits. createNgDevtools() prints one [ng-devtools] warning. configFromConnection stays silent.
• ng-devtools CLI prints version 0.0.0, prints no URL on start, and shows a stack trace for an unknown flag #139: Cause: devframe's createCac hardcodes version 0.0.0, bin.mjs passed no onReady, and parse errors were unhandled. Fix: createNgDevtoolsCli() sets cli.globalCommand.versionNumber from package.json. It prints the version, panel URL and MCP URL on ready, plus a note when port 9999 was taken. It registers a real dev command, rejects unknown positionals, and catches every error as one [ng-devtools] line with exit code 1.
• Redaction rules differ across inspectors: mask and unmask lists, token scrubbing and secret words #159: Cause: NgRx, nested form values, Signal Forms placeholders, secretInside/keepSecrets and Analog called isSecretKey (or their own regexes) and ignored mask/unmask, the NgRx serializer skipped redactMessage, and Analog had its own word list. Fix: one isRedactedKey() (the built-in words, secretNames, mask and unmask) used everywhere, one merged word list (adds cookie, authorization, jwt, sessionId, sessionKey), and redactMessage on NgRx strings and Error messages.

Performance and limits

• Hydration warning capture makes console.warn and console.error throw on some arguments #112: Cause: captureHydrationWarnings in http.ts built the log text with String(a) before calling the original console method, so a null-prototype object or a throwing toString threw before the call. Fix: each argument is turned into text in a guarded textOf(), the whole parse is in try/catch, and the original method always runs.
• Show when a timeline has dropped old entries at its limit #153: Cause: the HTTP, navigation, forms and NgRx timelines trimmed at their limits and reported nothing. Fix: each collector or merge counts what it drops (HttpPage.dropped and HttpState.serverDropped, RouterReport.dropped, FormsState.dropped per page, NgrxPage.dropped from the first kept seq). A shared app-limit-note shows 'Showing the latest N ... Raise limits.X' with a docs link on all four timelines, and explain-navigation and form-history add the same note.
• Overlay keepalives resend full HTTP call lists and trees, and every push rebroadcasts the whole shared state #155: Cause: components, injectors, signals and HTTP resent their full data every 8 s, HTTP resent every call on each change, and push-http rebroadcast all TransferState payloads in the 'http' state. Fix: unchanged data now sends ping-component-tree, ping-injector-tree, ping-signal-graph or ping-http, which update reportedAt on the server without a mutate. HTTP sends the full call list only with the payload and after that only new calls (full: false). Payloads moved to a separate 'http-payloads' shared state that changes only when a payload arrives or a page goes away. Overlay FAQ and components docs updated.
• Record change detection cycles and time per component using the existing profiler hook #156: Cause: the profiler only debounced refreshes, and the forms render counter registered its own profiler without the v20 guard. Fix: change-detection.ts now has one guarded profiler hub (addProfilerListener, never setProfiler(null)) that the refresh scheduler, countRenders and a new opt-in recorder share. cd-recorder.ts records cycles (start, duration, sync passes, per-component checks and self time, and the output that ran before the tick) with a new limits.cdCycles cap and totals per component. It is exposed through push-, ping-, forget- and request-change-detection-record, a 'change-detection' shared state, a Record, Stop and Clear section with a cycle list and slowest-components table in the Components tab, check-count badges on tree rows, and an ng-devtools:change-detection agent tool.

CI

• Add unit tests and an automated axe check for the devtools panel in CI #97: The panel had no tests and axe only ran by hand, which hid a bug: Select.move() clamped to the list end and landed on a disabled option. Fixed move() to step to the next enabled option only. Added a Vitest setup for app/ (pnpm test:panel, 32 tests) and an axe CI job (pnpm test:axe, all tabs and hub views, light and dark). The job found a duplicate region landmark on Routes, now fixed.
• Analog demo is not type-checked, and its tsconfig fails on the package source #98: Two causes. The demo's tsconfig rejected the package's .ts import paths (TS5097). Also, nothing in the demo program imports devframe itself, so TS never loaded it as the augmentation target (TS2664). Fixed with rewriteRelativeImportExtensions in examples/analog/tsconfig.app.json and import type {} from 'devframe' in types.ts. Widened the include to src/server/**, so API routes are checked too, and added the demo's ngc check to pnpm typecheck.
• CI does not type-check panel templates, so template errors in app/ pass every check #99: pnpm typecheck ran plain tsc on app/, which never reads templates. It now runs ngc -p app/tsconfig.json --noEmit, and app/tsconfig.json turns on strictTemplates (it passes with 0 errors).

Left open

• Router detection fails on Angular 20.0 to 20.3.4, and CI never tests the declared peer range #100: router detection is fixed; the Angular 20 to 22 CI matrix and the peer range upper bound need a decision
• DevTools Lab: add a route scenario that triggers router loop detection #102: the loop scenario is added; the optional ping-pong link is not
• Probe in app runs a full navigation when a canMatch guard redirects #128: the full navigation on a canMatch redirect is fixed; whether actions: {router: false} should also block the probe needs a decision
• Chrome extension: no retry after "No devtools server answered", and a 403 is reported as no answer #103, Chrome extension: panel falls back to another tab's data when the page id is not stored yet #104, No live-data setup for client-only Angular CLI apps #120, Default origin check accepts any installed Chrome extension, not only the devtools extension #157: not in this PR (need a decision or a manual test)

Checks

• pnpm test:devtools: 997 tests pass
• pnpm test:panel and pnpm test:axe (new, from Add unit tests and an automated axe check for the devtools panel in CI #97): pass
• pnpm exec nx test angular-devtools, pnpm typecheck (now with template and Analog checks), pnpm format:check, pnpm skills:check, docs build: pass
• extension/ui rebuilt in its own commit

Notes for review

• test:devtools now runs the package tests only; the panel tests and the axe check are separate scripts, and CI runs all three
• @ngrx/store and @ngrx/store-devtools are new dev dependencies, and the demo has a new /examples/store page