[cacieprins]

• Closes Requests for an unowned Cypress-reserved path (/__/…, /__cypress/…) never receive a response #34810
• Closes Synchronous XHR to a URL under the /__cypress/ namespace hangs the browser forever (15.19.0+, still present in 16.1.1 #35026

Additional details

A request for a path under /__cypress/ or /__/ that Cypress doesn't serve never received a response. A fetch() for one hung, and a synchronous XMLHttpRequest to one froze the browser for good, because a sync XHR blocks the page until it is answered. The cause is that serveInternalRoutes can answer with its own 404 without calling next(), and on the Express transport only the last pipeline stage wrote the client response, so the 404 was dropped.

The fix is the commit from #35077 by @VedantBhayani, cherry-picked here with its authorship intact (c0572da28c). The Express codec now writes a response synthesized by a short-circuiting middleware to the client; the CDP codec does not. That PR is still waiting on review, and its changelog entry conflicts with other changes landing on develop, so this PR carries the fix forward instead. Once this merges, #35077 can be closed.

What this PR adds on top:

• A system test, unowned_reserved_path_spec.ts, that reproduces Synchronous XHR to a URL under the /__cypress/ namespace hangs the browser forever (15.19.0+, still present in 16.1.1 #35026 in Electron and Chrome. On unpatched develop the async fetches never settle and the run hangs until the harness timeout; with the fix all 7 tests pass. It covers async fetch and sync XHR to /__cypress/repro-check, /__cypress//config.js (what location.pathname-derived URLs produce under /__cypress/src/...) and /__/does-not-exist, plus a control to a path outside the reserved namespaces.
• Synchronous XHR to a URL under the /__cypress/ namespace hangs the browser forever (15.19.0+, still present in 16.1.1 #35026 added to the changelog entry.

Not changed: Cypress still claims /__/ on any origin by pathname alone. Unowned requests now get a prompt 404 there too, but whether another origin's /__/ should be claimed at all is a separate question.

---

Note

Medium Risk
Touches core proxy response encoding for all Express-routed traffic; behavior is scoped to short-circuit responses and guarded against double-writes, but a regression could affect how middleware answers are delivered.

Overview
Fixes hung requests when the app hits Cypress-reserved URLs (/__cypress/…, /__/…) that no handler owns. Middleware such as serveInternalRoutes could return a 404 without calling next(), but on the Express proxy transport only the legacy pipeline normally writes ctx.res, so that synthesized response was dropped and clients never got an answer (sync XHR could freeze the page).

The Express HTTP codec now optionally writes short-circuit middleware responses straight to the client via writeSynthesizedResponse and writeSynthesizedResponses: true on proxyHttpCodec. The CDP/synthetic codec keeps the default off so it does not double-write. Coverage includes unit tests for the codec and internal-routes stack, plus a new system test that asserts 404 for async fetch and sync XHR on several unowned reserved paths.

^{Reviewed by Cursor Bugbot for commit 6bb13d2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Steps to test

env -u ELECTRON_RUN_AS_NODE yarn build
env -u ELECTRON_RUN_AS_NODE yarn test-system unowned_reserved_path --browser electron
env -u ELECTRON_RUN_AS_NODE yarn test-system unowned_reserved_path --browser chrome

To see it fail, check out 55aeb23a72 (the test without the fix); the run hangs until the 90s timeout.

How has the user experience changed?

Before: a request for an unserved /__cypress/… or /__/… path hangs, and a synchronous XHR to one freezes the browser with no error. After: it receives a 404 promptly.

PR Tasks

• Is there an associated issue with maintainer approval for PR submission?
• Have tests been added/updated?
• [na] Has a PR for user-facing changes been opened in cypress-documentation?
• [na] Have API changes been updated in the type definitions?

🤖 Generated with Claude Code