+    const circuits = TorDomainIsolator.getCircuits(

+    // TODO: Handle multiple circuits (for conflux). Only show the primary

+    // circuit until the UI for that is developed.

+    const nodes = circuits.length ? circuits[0] : [];

+  public @NonNull GeckoResult<GeckoBundle> getTorCircuits() {

+    return mEventDispatcher.queryBundle("GeckoView:GetTorCircuits");

+      case "GeckoView:GetTorCircuits":

+        this._getTorCircuits(aCallback);

+  _getTorCircuits(aCallback) {

+      const circuits = lazy.TorDomainIsolator.getCircuits(

+      aCallback?.onSuccess({ domain, circuits });

+ * From the control port specs:

+/**

+ * The ID to match paired conflux circuits.

+ * From the control port specs:

+ *   ConfluxID = 32*HEXDIG

+ *

+ * @typedef {string} ConfluxID

+ */

+ * From the control port specs:

+ * From the control port specs:

+ * @property {NodeFingerprint[]} nodes List of node fingerprints, ordered from

+ * guard/bridge to exit.

+ * @property {ConfluxID} [confluxId] The conflux ID, for associating conflux

+ * circuits.

+    // From the control port specs: a 'default' value semantically different

+    // from an empty string will not have an equal sign, just `250 $key`.

+          this.#eventHandler.onCircuitBuilt(maybeCircuit);

+      /^(?<ID>[a-zA-Z0-9]{1,16})\sBUILT\s(?<Path>(,?\$([0-9a-fA-F]{40})(?:~[a-zA-Z0-9]{1,19})?)+)(?<details>.*)/.exec(

+    const circuit = { id: builtEvent.groups.ID, nodes };

+

+

+    // NOTE: We use a greedy leading ".*" to skip over previous fields that

+    // can contain arbitrary strings, like SOCKS_USERNAME and SOCKS_PASSWORD,

+    // which allows them to contain " CONFLUX_ID=" within their values.

+    // Although such a value is not expected from the usernames and passwords we

+    // set in Tor Browser, it may be set by an external tor user.

+    // NOTE: This assumes there is no other arbitrary string field after

+    // CONFLUX_ID.

+    const maybeConfluxId = builtEvent.groups.details.match(

+      /.* CONFLUX_ID=([0-9a-fA-F]{32,})(?:$| )/

+    );

+    if (maybeConfluxId) {

+      circuit.confluxId = maybeConfluxId[1];

+    }

+

+    return circuit;

+ * @param {CircuitInfo} circuit The information about the circuit

+  ObjectUtils: "resource://gre/modules/ObjectUtils.sys.mjs",

+ * @typedef {string} IsolationKey A string that we use to identify an isolation

+ * key. Currently, it is a string that combines SOCKS credentials.

+ * Each isolation key is used to identify a set of circuits.

+ * @property {IsolationKey} current The last isolation key for which circuit

+ * information is known.

+ * @property {IsolationKey?} pending The last used isolation key.

+ * We might or might not know data about it, yet. But if we know it, we should

+ * move this key into current, and pending should be made null.

+   * A map that associates an isolation context to its circuits.

+   * The circuits are represented with a multidimensional array.

+   * The outer layer contains an array for each circuit of the isolation context

+   * (when conflux is in use, a certain isolation context might use more than a

+   * circuit).

+   * The inner layer contains the data about a certain circuit, ordered from

+   * guard/bridge to exit.

+   *

+   * @type {Map<IsolationKey, NodeData[][]>}

+   * Get the circuits being used for a certain browser. There may be multiple

+   * if conflux is being used.

+   *

+   * Note, this returns the last known circuits for the browser. In particular,

+   * the returned data is created when the circuit is first seen, therefore it

+   * @returns {NodeData[][]} An array of all the circuits being used for this

+   * context. Each circuit is represented by an array of nodes, ordered from

+   * the guard/bridge to the exit. If the context has no known circuits, then

+   * this will be an empty array.

+  getCircuits(browser, domain, userContextId) {

+      const { username, password, circuits } = subject.wrappedJSObject;

+      this.#updateCircuits(username, password, circuits);

+   * @returns {IsolationKey} A string that combines username and password and

+   * can be used as a key for maps.

+  #credentialsToKey(username, password) {

+    const id = this.#credentialsToKey(username, password);

+   * Update the circuits associated to a certain isolation context, and notify

+   * the related circuit displays if they changed.

+   * associate its SOCKS credentials to the circuit it is using.

+   * @param {NodeData[][]} circuits The circuits being used for this isolation

+   * context. Each is represented by an array of nodes.

+  async #updateCircuits(username, password, circuits) {

+    const key = this.#credentialsToKey(username, password);

+    let current = this.#knownCircuits.get(key);

+    if (lazy.ObjectUtils.deepEqual(current, circuits)) {

+    logger.info(`Updating circuits for ${key}`, circuits);

+    this.#knownCircuits.set(key, circuits);

+   * @type {Map<CircuitID, CircuitInfo>}

+

+  /**

+   * Cache with node information.

+   *

+   * As a matter of fact, the circuit display backend continuously ask for

+   * information about the same nodes (e.g., the guards/bridges, and the exit

+   * for conflux circuits).

+   * Therefore, we can keep a cache of them to avoid a few control port lookups.

+   * And since it is likely we will get asked information about all nodes that

+   * appear in circuits, we can build this cache proactively.

+   *

+   * @type {Map<NodeFingerprint, Promise<NodeData>>}

+   */

+  #nodeInfo = new Map();

+

+  // Circuit handling.

+

+    for (const circuit of await this.#controller.getCircuits()) {

+      this.onCircuitBuilt(circuit);

+    }

+  }

+

+  /**

+   * Returns tha data about a relay or a bridge.

+   *

+   * @param {string} id The fingerprint of the node to get data about

+   * @returns {Promise<NodeData>}

+   */

+  #getNodeInfo(id) {

+    // This is an async method, so it will not insert the result, but a promise.

+    // However, this is what we want.

+    const info = this.#nodeInfo.getOrInsertComputed(id, async () => {

+      const node = {

+        fingerprint: id,

+        ipAddrs: [],

+        bridgeType: null,

+        regionCode: null,

+      };

+

+      const bridge = (await this.#controller.getBridges())?.find(

+        foundBridge => foundBridge.id?.toUpperCase() === id.toUpperCase()

+      );

+      if (bridge) {

+        node.bridgeType = bridge.transport ?? "";

+        // Attempt to get an IP address from bridge address string.

+        const ip = bridge.addr.match(/^\[?([^\]]+)\]?:\d+$/)?.[1];

+        if (ip && !ip.startsWith("0.")) {

+          node.ipAddrs.push(ip);

+        }

+      } else {

+        node.ipAddrs = await this.#controller.getNodeAddresses(id);

+      }

+

+      // tor-browser#43116, tor-browser-build#41224: on Android, we do not ship

+      // the GeoIP databases to save some space. So skip it for now.

+      if (node.ipAddrs.length && !TorLauncherUtil.isAndroid) {

+        // Get the country code for the node's IP address.

+        try {

+          // Expect a 2-letter ISO3166-1 code, which should also be a valid

+          // BCP47 Region subtag.

+          const regionCode = await this.#controller.getIPCountry(

+            node.ipAddrs[0]

+          );

+          if (regionCode && regionCode !== "??") {

+            node.regionCode = regionCode.toUpperCase();

+          }

+        } catch (e) {

+          logger.warn(`Cannot get a country for IP ${node.ipAddrs[0]}`, e);

+        }

+      }

+      return node;

+    });

+

+    const MAX_NODES = 300;

+    while (this.#nodeInfo.size > MAX_NODES) {

+      const oldestKey = this.#nodeInfo.keys().next().value;

+      this.#nodeInfo.delete(oldestKey);

+

+    return info;

+   * @param {CircuitInfo} circuit The information about the circuit

+  onCircuitBuilt(circuit) {

+    logger.debug(`Built tor circuit ${circuit.id}`, circuit);

+

+    if (circuit.nodes.length === 1) {

+    this.#circuits.set(circuit.id, circuit);

+

+    for (const fingerprint of circuit.nodes) {

+      // To make the pending onStreamSentConnect call for this circuit faster,

+      // we pre-fetch the node data, which should be cached by the time it is

+      // called. No need to await here.

+      this.#getNodeInfo(fingerprint);

+    }

+

+    this.#maybeBridgeChanged(circuit);

+  }

+

+  /**

+   * Broadcast a bridge change, if needed.

+   *

+   * @param {CircuitInfo} circuit The information about the circuit

+   */

+  #maybeBridgeChanged(circuit) {

+    if (this.#currentBridge?.fingerprint === circuit.nodes[0]) {

+      return;

+    }

+    this.#getNodeInfo(circuit.nodes[0]).then(nodeInfo => {

+        logger.info(`Bridge changed to ${circuit.nodes[0]}`);

+    });

+   * @param {StreamID} _streamId The ID of the stream that switched to the

+  async onStreamSentConnect(_streamId, circuitId, username, password) {

+    if (!this.#circuits.has(circuitId)) {

+      // tor-browser#42132: When using onion-grater (e.g., in Tails), we might

+      // not receive the CIRC BUILT event, as it is impossible to know whether

+      // that circuit will be the browser's at that point. So, we will have to

+      // poll circuits and wait for that to finish to be able to get the data.

+      try {

+        await this.#fetchCircuits();

+      } catch {

+        return;

+      }

+

+    const primaryCircuit = this.#circuits.get(circuitId);

+    if (!primaryCircuit) {

+      logger.error(

+        `Seen a STREAM SENTCONNECT with circuit ${circuitId}, but Tor did not send information about it.`

+      );

+

+    const circuitIds = [circuitId];

+    if (primaryCircuit.confluxId) {

+      circuitIds.push(

+        ...this.#circuits

+          .entries()

+          .filter(

+            ([id, circ]) =>

+              circ.confluxId === primaryCircuit.confluxId && id != circuitId

+          )

+          .map(([id]) => id)

+      );

+    }

+    const circuits = await Promise.all(

+      circuitIds.map(id =>

+        Promise.all(this.#circuits.get(id).nodes.map(n => this.#getNodeInfo(n)))

+      )

+    );

+          circuits,