@MarcZX10 thanks, reviewed at 7ae84d2. The validator, the shell-free launch on each OS (posix_spawnp argv / ShellExecuteW), the backend revalidation and the default-off behaviour read well, and the tests cover the rejections thoroughly. One point before merge, plus a small documentation one:

1. Repeated calls. Nothing limits how often a title can trigger this. Export.cpp:47-52 serializes calls with a mutex, but HostUrlPolicy.hpp:48-53 keeps no shared state, so in ask mode a title that retries sceSystemServiceLaunchWebBrowser after the user presses Cancel shows the box again straight away, and in always mode a call in a loop opens a new browser tab each time. With counting fakes over the exact validator and policy headers (no real browser or dialog), 1,000 ask calls answered "no" all reached the confirmation, and 1,000 always calls all reached the launcher. On POSIX each accepted launch also starts a child and a detached wait thread, so the mutex doesn't bound outstanding host work either.

   Could you add a shared limit across URLs and guest threads? For example: after a decline, return the existing unavailable result without asking again for the rest of the session (or a cooldown), cap prompts and launches to a few per minute, and don't queue up further dialogs from callers waiting behind the active one. Deterministic tests with fake time and backends would cover it: repeated same and distinct URLs, repeated Cancel, concurrent callers, recovery after the interval, and never making no backend calls.

2. Docs. always opens any http/https host, including localhost and private-network addresses such as a router's page. Could docs/user/USAGE.md say that, so users know what always allows compared with ask?

There is also a small conflict with #12848 in Export.cpp and the environment/usage docs; whichever lands second rebases.

Re-checked — new head bce7cb8, both requests addressed

Both points were fair: nothing bounded repeated calls, and always was under-described.

What I ran

• Head bce7cb8451d7efd3088ad8733c9d19325f8f6e2e, rebased onto upstream/main 1408347b2e (conflict-free; the history was rewritten by that rebase, so SHAs of the earlier commits changed). feat(libSceSystemService): take the console date and time format from ANYPS5_DATE_FORMAT and ANYPS5_TIME_FORMAT, with auto from the host #12848 and feat(libSceSystemService): take the console language from the host with ANYPS5_LANGUAGE=auto #12752 not touched; whichever lands second rebases.
• Archive build on Linux x86_64 (g++ 12): run_tests.sh '^guest_system_service|^loadexec_arguments$|^guest_system_exit' with the new guest_system_service_open_url_limits_tests, guest_system_service_open_url_tests and the existing system-service, loadexec and exit targets.
• check_conventions.py --base upstream/main, git diff --check, env_reference.py --check, test_public_headers.py --audit-only.

Changes (15 new commits, each with its test)

• One shared OpenUrlGate for every address and guest thread, with an injected clock:
  • a caller that arrives while a box or launch is active gets EOPNOTSUPP at once (try-lock, no queued dialog; the old queuing mutex is gone);
  • at most 3 prompts or launches in a sliding 60 s;
  • after a Cancel, no prompt or launch for 600 s. I chose a bounded cooldown over "rest of the session" so a user who cancelled once can still open a later link without restarting; suppressed calls do not use the per-minute attempts;
  • never makes no backend call (1000 calls counted);
  • POSIX: at most 2 openers (child plus wait thread) outstanding; a third is refused until one exits.
• docs/user/USAGE.md: always opens any http/https host including localhost and private-network addresses such as a router page, unlike ask; the limits are described. New debt entry: the limits are host policy, not console measurements.

Results

• 12/12 passed: guest_system_service_open_url, guest_system_service_open_url_limits (new) and the ten existing tests (system service, language, time zone, usb storage, three app title id, loadexec_arguments, two exit). The existing tests are the same set that passed on upstream/main earlier, so defaults are unchanged.
• Counting fakes over the real validator and policy cover repeated same and distinct URLs (1000 calls each), repeated Cancel, 16 concurrent callers through the exported call while a box is open (one box, 16 refusals), recovery at exactly 60 s and 600 s, never, and the opener bound with a blocking script.

Negative control

• 20 mutations in the built tree, each rebuilt: blocking lock instead of try-lock (hang, 20 s timeout), cap off by one, window boundary, attempts not recorded, cap checked after recording, suppression removed, suppression boundary, decline not recorded, suppressed calls counted as attempts, never reaching the gate state, state kept across reset, validation removed from the gate, gate not shared in Export.cpp, injected clock ignored, opener cap raised, opener count never released, opener check disabled; and the three constants (cooldown 60 s, window 3600 s, max 4). Every one made at least one of the two new tests fail, except that the cooldown constant first passed because the test derived values from it, so I added literal assertions for 3, 60 s and 600 s and re-ran it: now caught.
• Not mutation-tested: the posix_spawn_file_actions_init failure path of the opener counter.

Not verified

• Windows, macOS, a real browser or message box, Wayland-only, a title, a console. The ShellExecuteW backend has no opener bound (it starts no child or thread here) and is only MinGW syntax-checked.
• upstream/main moved again after my last build (unrelated files); I did not rebuild on it.

I will re-run the checks on any new head and say so here.

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Windows run of this head (bce7cb8451), merged onto main bb04a4f1ea (clean merge, local only). Windows 11 Enterprise 10.0.22621, Ryzen 9 5950X, WinLibs GCC 15.2.0 UCRT r7, Ninja, Release, BUILD_TESTING=ON, no Vulkan driver visible.

• This PR: guest_system_service_open_url, guest_system_service_open_url_limits pass 3 of 3 (ctest --repeat until-fail:3).
• Negative control: not possible. With this PR's source files (core/libs/prx/libSceSystemService/Export.cpp, core/libs/prx/libSceSystemService/HostUrl.hpp, core/libs/prx/libSceSystemService/HostUrlBackends.hpp, core/libs/prx/libSceSystemService/HostUrlConfirmation.cpp, core/libs/prx/libSceSystemService/HostUrlLauncherPosix.cpp, core/libs/prx/libSceSystemService/HostUrlLauncherWindows.cpp and 1 more) put back to main's version, and the ones it adds removed, the build fails against the rest of the PR, so there is no source-only control.

AI-assisted: yes (Claude Code).

✅ AMD GPU test: passed

PR head 737ac71 merged onto main b11c7bf · tested 2026-11-04 15:38 UTC · 20 min

agc_driver_array_layer_target_cpu: failed in 3 of the last 10 main runs
agc_driver_pipeline_journal: failed in 8 of the last 10 main runs
agc_driver_two_sample_alpha_to_coverage_sample_mask_export: failed in 3 of the last 10 main runs

agc_driver_alpha_to_coverage_sample_mask_export
agc_driver_guest_memory_lifetime_direct
agc_driver_image_table
agc_driver_native_depth_bda_clear
agc_driver_native_multisample_depth
agc_driver_submit_progress

public_headers
public_headers_compile_0
public_headers_compile_1
public_headers_compile_10
public_headers_compile_11
public_headers_compile_12
public_headers_compile_13
public_headers_compile_14
public_headers_compile_15
public_headers_compile_16
public_headers_compile_17
public_headers_compile_18
public_headers_compile_2
public_headers_compile_20
public_headers_compile_21
public_headers_compile_22
public_headers_compile_23
public_headers_compile_24
public_headers_compile_25
public_headers_compile_26
public_headers_compile_27
public_headers_compile_28
public_headers_compile_29
public_headers_compile_3
public_headers_compile_30
public_headers_compile_31
public_headers_compile_32
public_headers_compile_33
public_headers_compile_34
public_headers_compile_35
public_headers_compile_36
public_headers_compile_37
public_headers_compile_38
public_headers_compile_39
public_headers_compile_4
public_headers_compile_40
public_headers_compile_41
public_headers_compile_42
public_headers_compile_43
public_headers_compile_44
public_headers_compile_45
public_headers_compile_46
public_headers_compile_47
public_headers_compile_48
public_headers_compile_49
public_headers_compile_5
public_headers_compile_50
public_headers_compile_51
public_headers_compile_52
public_headers_compile_53
public_headers_compile_54
public_headers_compile_55
public_headers_compile_56
public_headers_compile_57
public_headers_compile_58
public_headers_compile_59
public_headers_compile_6
public_headers_compile_60
public_headers_compile_61
public_headers_compile_62
public_headers_compile_63
public_headers_compile_7
public_headers_compile_8
public_headers_compile_9

VUID-VkDeviceCreateInfo-pNext-pNext (677 tests): agc_compute_pipeline_replay, agc_driver_address_draw_space_reuse, agc_driver_address_draw_space_reuse_held, agc_driver_address_draw_space_reuse_off, agc_driver_address_draw_space_reuse_transitions, agc_driver_address_draw_space_reuse_verify, agc_driver_address_passes, agc_driver_address_passes_draw_transitions, and 669 more
VUID-vkCmdCopyImage-srcImage-01548 (11 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store_image_copy, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_partially_unmapped_plane, agc_driver_depth_plane_unmapped_plane, and 3 more
VUID-vkCmdCopyImage-srcImage-01551 (11 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store_image_copy, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_partially_unmapped_plane, agc_driver_depth_plane_unmapped_plane, and 3 more
VUID-VkPipelineColorBlendStateCreateInfo-pAttachments-00605 (2 tests): agc_driver_prepared_exports, agc_driver_srgb8_color_target
VUID-VkSamplerCreateInfo-addressModeU-01079 (1 test): agc_driver_image_gather_volume
VUID-VkSamplerCreateInfo-addressModeU-parameter (1 test): agc_driver_image_gather_volume
VUID-VkSamplerCreateInfo-addressModeV-parameter (1 test): agc_driver_image_gather_volume
VUID-VkSamplerCreateInfo-addressModeW-parameter (1 test): agc_driver_image_gather_volume

agc_driver_copied_writer_label_order: skipped, the device reports a minStorageBufferOffsetAlignment of 4, so the dispatch binds its record at +0x1004 in place and nothing is written back; the test needs an alignment above 4
agc_driver_copied_writer_label_order_drain: skipped, the device reports a minStorageBufferOffsetAlignment of 4, so the dispatch binds its record at +0x1004 in place and nothing is written back; the test needs an alignment above 4
agc_driver_float16_unused_nan_payloads: skipped, the device has no native f16 conversions with RTE rounding and kept f16 denormals
agc_driver_gcn_display_present: skipped, no display: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform
agc_driver_linear_target_direct_write_completion: skipped, the device does not keep host imports write-watched, so no completion stamp over the target is tracked
agc_driver_ngg_vertex_wave_reduction: skipped, s3 describes a 32-lane wave only on 32-lane subgroups, and the device has 64 lanes
agc_driver_scattered_runs: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_sparse_dma_buf_import: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_vertex_elected_atomic_max: skipped, the device runs vertex programs in subgroups, so they keep their cross-lane reductions
video_out_flip_eop_main: skipped, no display or Vulkan device: DisplayWindow: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform

git fetch origin 737ac7199d6fa4048d32016835442d5f421cd434 b11c7bf84f5d2f636ff60166cc3371bd071e24d5
git checkout b11c7bf84f5d2f636ff60166cc3371bd071e24d5 && git merge --no-ff 737ac7199d6fa4048d32016835442d5f421cd434
git submodule update --init --recursive
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DANYPS5_ENABLE_SPIRV_TOOLS=ON
cmake --build build && cmake --build build --target libs
VK_DRIVER_FILES=/nonexistent/icd.json ctest --test-dir build -E '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 12 --output-on-failure
ANYPS5_REQUIRE_VULKAN=1 ANYPS5_NO_SHADER_CACHE=1 VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
  ctest --test-dir build -R '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 16 --output-on-failure
# failures are then re-run alone: --timeout 360 --parallel 2; new validation IDs: the test alone, twice, --parallel 1

_{Automated build and test on a contributor's AMD machine; it does not replace upstream CI. A new comment is posted for each new push. Full logs.}