@ai-support-agent/cli 0.1.30-beta.0 → 0.1.30-beta.2

package/dist/vscode/vscode-tunnel-websocket.d.ts

@@ -6,7 +6,7 @@ import { BrowserSessionManager } from '../mcp/tools/browser/browser-session-mana
  * API Server → Agent メッセージ
  */
 export interface VsCodeServerMessage {
-    type: 'vscode_open' | 'vscode_close' | 'port_forward_open' | 'port_forward_close' | 'http_request' | 'ws_frame' | 'auth_success' | 'error' | 'browser_open' | 'browser_close' | 'browser_navigate' | 'browser_go_back' | 'browser_go_forward' | 'browser_reload' | 'browser_mouse_click' | 'browser_mouse_move' | 'browser_mouse_down' | 'browser_mouse_up' | 'browser_mouse_wheel' | 'browser_keyboard_type' | 'browser_keyboard_press' | 'browser_screenshot' | 'browser_viewport' | 'browser_execute_script' | 'browser_set_file' | 'browser_get_selection';
+    type: 'vscode_open' | 'vscode_close' | 'port_forward_open' | 'port_forward_close' | 'http_request' | 'ws_frame' | 'auth_success' | 'error' | 'browser_open' | 'browser_close' | 'browser_navigate' | 'browser_go_back' | 'browser_go_forward' | 'browser_reload' | 'browser_mouse_click' | 'browser_mouse_move' | 'browser_mouse_down' | 'browser_mouse_up' | 'browser_mouse_wheel' | 'browser_keyboard_type' | 'browser_keyboard_press' | 'browser_screenshot' | 'browser_viewport' | 'browser_execute_script' | 'browser_set_file' | 'browser_get_selection' | 'browser_set_input_value';
     filePaths?: string[];
     files?: Array<{
         name: string;
@@ -41,12 +41,15 @@ export interface VsCodeServerMessage {
     height?: number;
     deviceId?: string;
     script?: string;
+    value?: string;
+    selectionStart?: number;
+    selectionEnd?: number;
 }
 /**
  * Agent → API Server メッセージ
  */
 export interface VsCodeAgentMessage {
-    type: 'vscode_ready' | 'vscode_stopped' | 'port_forward_ready' | 'port_forward_stopped' | 'http_response' | 'ws_frame' | 'error' | 'browser_ready' | 'browser_frame' | 'browser_screenshot_result' | 'browser_selection_result' | 'browser_action_log' | 'browser_stopped' | 'browser_script_result' | 'browser_script_progress' | 'browser_file_chooser_opened';
+    type: 'vscode_ready' | 'vscode_stopped' | 'port_forward_ready' | 'port_forward_stopped' | 'http_response' | 'ws_frame' | 'error' | 'browser_ready' | 'browser_frame' | 'browser_screenshot_result' | 'browser_selection_result' | 'browser_action_log' | 'browser_stopped' | 'browser_script_result' | 'browser_script_progress' | 'browser_file_chooser_opened' | 'browser_cursor_update' | 'browser_focus_changed';
     sessionId?: string;
     targetPort?: number;
     requestId?: string;
@@ -87,6 +90,26 @@ export interface VsCodeAgentMessage {
     step?: number;
     line?: string;
     script?: string;
+    /** CSS cursor value at the last mouse-move point (browser_cursor_update) */
+    cursor?: string;
+    focused?: boolean;
+    rect?: {
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+    };
+    value?: string;
+    selectionStart?: number;
+    selectionEnd?: number;
+    multiline?: boolean;
+    inputType?: string;
+    maxLength?: number;
+    fontSize?: number;
+    lineHeight?: number;
+    textAlign?: string;
+    paddingTop?: number;
+    paddingLeft?: number;
 }
 /**
  * VS Code トンネル WebSocket
@@ -118,6 +141,11 @@ export declare class VsCodeTunnelWebSocket extends BaseWebSocketConnection<VsCod
     private browserLocalServer;
     private browserLocalPort;
     private readonly pendingFileChoosers;
+    /**
+     * Last CSS cursor value sent per browser session. Used to suppress redundant
+     * browser_cursor_update messages: only send when the cursor shape changes.
+     */
+    private readonly lastSentCursor;
     constructor(apiUrl: string, token: string, agentId: string, projectDir?: string | undefined, 
     /**
      * code-server セッション起動時に最新の envVars を取り出す関数。
@@ -169,9 +197,55 @@ export declare class VsCodeTunnelWebSocket extends BaseWebSocketConnection<VsCod
     private handleBrowserKeyboardPress;
     private handleBrowserScreenshot;
     private handleBrowserGetSelection;
+    private handleBrowserSetInputValue;
     private handleBrowserExecuteScript;
     private handleBrowserViewport;
     private handleBrowserSetFile;
+    /**
+     * Branch 1: Agent FS paths chosen directly by the user via the workspace file
+     * explorer. These arrive as workspace-relative paths (e.g. `repos/app.ts`) —
+     * Playwright's setFiles requires absolute paths, so each is resolved against
+     * the workspace root before being forwarded. Already absolute paths are
+     * accepted as-is for backward compatibility, but every resolved path must
+     * stay inside the workspace root (traversal + symlink-escape guard).
+     */
+    private handleBrowserSetFileByPaths;
+    /**
+     * Branch 2: base64 file contents uploaded from the web client. Decode each
+     * into a temporary file on the agent host, hand the temp paths to setFiles,
+     * then always remove the temp files afterwards.
+     */
+    private handleBrowserSetFileByContent;
+    /**
+     * Resolve user-chosen file-explorer paths into absolute paths suitable for
+     * Playwright's `setFiles`, enforcing that every resolved path stays inside
+     * the agent workspace root.
+     *
+     * Resolution rules per path:
+     *  - Absolute paths are kept as-is (backward compatibility for callers that
+     *    already send absolute agent-FS paths).
+     *  - Relative paths (e.g. `repos/app.ts`) are resolved against the workspace
+     *    directory (`getWorkspaceDir(projectDir)`).
+     *
+     * Traversal guard (lexical): after resolution, the absolute path must be the
+     * workspace root itself or a descendant of it. `path.relative(workspaceDir,
+     * resolved)` starting with `..` (or being absolute) means the path escaped the
+     * workspace and is rejected. This rejects both relative escapes
+     * (`../../etc/passwd`) and absolute paths pointing outside the workspace.
+     *
+     * Symlink-escape guard (physical): a path that is lexically inside the
+     * workspace may still resolve, through a symlink, to a target OUTSIDE it
+     * (e.g. a `link` inside the workspace pointing at `../../.ssh/id_rsa`). After
+     * the lexical check, each existing path's real (canonical) location is
+     * resolved via `fs.realpath` and re-checked against the workspace root. Paths
+     * whose real location escapes the workspace are rejected. Non-existent paths
+     * cannot be canonicalized; they are left as-is (Playwright's setFiles will
+     * fail on them) rather than rejected here, preserving the lexical guarantee.
+     *
+     * Returns the resolved absolute paths on success, or an error message string
+     * describing why the upload was rejected (never silently dropped).
+     */
+    private resolveWorkspaceFilePaths;
     /**
      * Cancel a pending file chooser by applying an empty file list so the remote
      * `<input type=file>` is cleared rather than left pending. Failures are

package/dist/vscode/vscode-tunnel-websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vscode-tunnel-websocket.d.ts","sourceRoot":"","sources":["../../src/vscode/vscode-tunnel-websocket.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAG3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGzD,OAAO,EACL,qBAAqB,EAEtB,MAAM,8CAA8C,CAAA;AAcrD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EACA,aAAa,GACb,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,cAAc,GACd,UAAU,GACV,cAAc,GACd,OAAO,GAEP,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,oBAAoB,GACpB,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,uBAAuB,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EACA,cAAc,GACd,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,GACtB,eAAe,GACf,UAAU,GACV,OAAO,GAEP,eAAe,GACf,eAAe,GACf,2BAA2B,GAC3B,0BAA0B,GAC1B,oBAAoB,GACpB,iBAAiB,GACjB,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEvF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAWD;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,uBAAuB,CAAC,mBAAmB,CAAC;IAkBnF,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAxBnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,YAAY,CAA4B;IAChD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAa;IAC7C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoE;IACxG,QAAQ,CAAC,qBAAqB,wBAA4D;IAC1F,OAAO,CAAC,kBAAkB,CAAkC;IAC5D,OAAO,CAAC,gBAAgB,CAAI;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkE;gBAGpG,MAAM,EAAE,MAAM,EACG,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;IACpC;;;OAGG;IACc,eAAe,CAAC,EAAE,eAAe,YAAA;IAWpD;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B,SAAS,CAAC,eAAe,IAAI,SAAS;IAatC,sEAAsE;IACtE,OAAO,CAAC,8BAA8B,CAA6B;IAEnE,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,GAAG,IAAI;IA8BtE;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAOhD,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI;IAuFzD,SAAS,CAAC,YAAY,IAAI,IAAI;YAMhB,gBAAgB;IAsE9B,OAAO,CAAC,iBAAiB;YAQX,iBAAiB;IA4C/B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAwB/B,OAAO,CAAC,aAAa;IAwDrB,OAAO,CAAC,qBAAqB;IAyB7B,OAAO,CAAC,sBAAsB;YAgBhB,iBAAiB;YA2EjB,kBAAkB;YAelB,qBAAqB;YAyBrB,mBAAmB;YAWnB,sBAAsB;YAWtB,mBAAmB;YAWnB,uBAAuB;YAWvB,sBAAsB;YActB,sBAAsB;YAWtB,oBAAoB;YAWpB,uBAAuB;YAUvB,yBAAyB;YAWzB,0BAA0B;YAW1B,uBAAuB;YA4BvB,yBAAyB;YAmBzB,0BAA0B;YAuC1B,qBAAqB;YAUrB,oBAAoB;IA6ClC;;;;;OAKG;YACW,iBAAiB;IAW/B,OAAO,CAAC,OAAO;IA4Bf,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,+BAA+B;IAIvC,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"vscode-tunnel-websocket.d.ts","sourceRoot":"","sources":["../../src/vscode/vscode-tunnel-websocket.ts"],"names":[],"mappings":"AAIA,OAAO,SAAS,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAG3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD,OAAO,EACL,qBAAqB,EAEtB,MAAM,8CAA8C,CAAA;AAcrD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EACA,aAAa,GACb,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,cAAc,GACd,UAAU,GACV,cAAc,GACd,OAAO,GAEP,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,oBAAoB,GACpB,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EACA,cAAc,GACd,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,GACtB,eAAe,GACf,UAAU,GACV,OAAO,GAEP,eAAe,GACf,eAAe,GACf,2BAA2B,GAC3B,0BAA0B,GAC1B,oBAAoB,GACpB,iBAAiB,GACjB,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,uBAAuB,GACvB,uBAAuB,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEvF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAiCD;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,uBAAuB,CAAC,mBAAmB,CAAC;IAuBnF,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IA7BnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,YAAY,CAA4B;IAChD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAa;IAC7C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoE;IACxG,QAAQ,CAAC,qBAAqB,wBAA4D;IAC1F,OAAO,CAAC,kBAAkB,CAAkC;IAC5D,OAAO,CAAC,gBAAgB,CAAI;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkE;IACtG;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;gBAGzD,MAAM,EAAE,MAAM,EACG,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;IACpC;;;OAGG;IACc,eAAe,CAAC,EAAE,eAAe,YAAA;IAWpD;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B,SAAS,CAAC,eAAe,IAAI,SAAS;IAatC,sEAAsE;IACtE,OAAO,CAAC,8BAA8B,CAA6B;IAEnE,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,GAAG,IAAI;IA8BtE;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAOhD,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI;IA0FzD,SAAS,CAAC,YAAY,IAAI,IAAI;YAMhB,gBAAgB;IAsE9B,OAAO,CAAC,iBAAiB;YAQX,iBAAiB;IA4C/B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAwB/B,OAAO,CAAC,aAAa;IAwDrB,OAAO,CAAC,qBAAqB;IAyB7B,OAAO,CAAC,sBAAsB;YAgBhB,iBAAiB;YA0FjB,kBAAkB;YAgBlB,qBAAqB;YAyBrB,mBAAmB;YAWnB,sBAAsB;YAWtB,mBAAmB;YAWnB,uBAAuB;YAWvB,sBAAsB;YAgCtB,sBAAsB;YAWtB,oBAAoB;YAWpB,uBAAuB;YAUvB,yBAAyB;YAWzB,0BAA0B;YAW1B,uBAAuB;YA4BvB,yBAAyB;YAmBzB,0BAA0B;YAa1B,0BAA0B;YAuC1B,qBAAqB;YAUrB,oBAAoB;IA+BlC;;;;;;;OAOG;YACW,2BAA2B;IAoCzC;;;;OAIG;YACW,6BAA6B;IAqE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,yBAAyB;IAyCvC;;;;;OAKG;YACW,iBAAiB;IAW/B,OAAO,CAAC,OAAO;IA6Bf,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,+BAA+B;IAIvC,OAAO,CAAC,IAAI;CAGb"}

package/dist/vscode/vscode-tunnel-websocket.js

@@ -1,14 +1,51 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VsCodeTunnelWebSocket = void 0;
+const node_fs_1 = require("node:fs");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const ws_1 = __importDefault(require("ws"));
 const base_websocket_1 = require("../base-websocket");
 const browser_local_server_1 = require("../browser/browser-local-server");
 const constants_1 = require("../constants");
 const logger_1 = require("../logger");
+const project_dir_1 = require("../project-dir");
 const utils_1 = require("../utils");
 const browser_session_manager_1 = require("../mcp/tools/browser/browser-session-manager");
 const browser_security_1 = require("../mcp/tools/browser/browser-security");
@@ -24,6 +61,27 @@ const LIVE_VIEW_INTERVAL_MS = 200;
  * Guards against unbounded base64 payloads consuming agent memory.
  */
 const MAX_UPLOAD_BYTES = 10 * 1024 * 1024; // 10MB
+/**
+ * Sanitize a client-supplied upload file name into a safe basename so it can be
+ * joined to a temp directory without escaping it (path-traversal defense).
+ *
+ * Strips any directory components (`path.basename`), then rejects path-relative
+ * tokens (`.`/`..`) and any remaining separator characters by replacing unsafe
+ * characters with `_`. Always returns a non-empty basename, falling back to
+ * `upload` when nothing safe remains.
+ */
+function sanitizeUploadFileName(name) {
+    const raw = typeof name === 'string' ? name : '';
+    // Drop any directory portion the client may have included.
+    let base = path.basename(raw);
+    // Replace path separators and traversal-relevant characters; collapse control
+    // chars and leading dots that could hide the file or break paths.
+    base = base.replace(/[/\\]/g, '_').replace(/\0/g, '');
+    if (base === '' || base === '.' || base === '..') {
+        return 'upload';
+    }
+    return base;
+}
 /**
  * VS Code トンネル WebSocket
  *
@@ -50,6 +108,11 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
     browserLocalServer = null;
     browserLocalPort = 0;
     pendingFileChoosers = new Map();
+    /**
+     * Last CSS cursor value sent per browser session. Used to suppress redundant
+     * browser_cursor_update messages: only send when the cursor shape changes.
+     */
+    lastSentCursor = new Map();
     constructor(apiUrl, token, agentId, projectDir, 
     /**
      * code-server セッション起動時に最新の envVars を取り出す関数。
@@ -208,6 +271,9 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
             case 'browser_get_selection':
                 void this.handleBrowserGetSelection(msg);
                 break;
+            case 'browser_set_input_value':
+                void this.handleBrowserSetInputValue(msg);
+                break;
             default:
                 logger_1.logger.debug(`[vscode-ws] Unknown message type: ${msg.type}`);
         }
@@ -452,6 +518,14 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
             this.sendMissingSessionIdError();
             return;
         }
+        // Reset any stale cursor state for this sessionId on (re)open. The idle-timeout
+        // auto-close path closes a session via BrowserSessionManager WITHOUT routing
+        // through handleBrowserClose/cleanup, so lastSentCursor can survive a closed
+        // session. If the same sessionId is later re-opened, a stale entry would make
+        // the first mouse-move's cursor look "unchanged" and suppress the initial
+        // browser_cursor_update, freezing the client cursor at the previous session's
+        // last shape. Deleting here guarantees the first move after (re)open is sent.
+        this.lastSentCursor.delete(sessionId);
         try {
             const session = await this.browserSessionManager.getOrCreate(sessionId);
             // Wire up action log notifications so in-process operations are relayed to Web UI
@@ -467,6 +541,11 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
                 this.pendingFileChoosers.set(sessionId, accept);
                 this.send({ type: 'browser_file_chooser_opened', sessionId });
             };
+            // Wire up focus-change notifications so the Web client can overlay a real
+            // input/textarea on the focused element (native caret + IME).
+            session.onFocusChange = (payload) => {
+                this.send({ type: 'browser_focus_changed', sessionId, ...payload });
+            };
             if (msg.conversationId) {
                 this.browserSessionManager.linkConversation(msg.conversationId, sessionId);
             }
@@ -523,6 +602,7 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
             await this.browserSessionManager.close(sessionId);
         }
         this.pendingFileChoosers.delete(sessionId);
+        this.lastSentCursor.delete(sessionId);
         this.send({ type: 'browser_stopped', sessionId, reason: 'closed' });
         logger_1.logger.info(`[vscode-ws] Browser session closed: ${sessionId}`);
     }
@@ -598,8 +678,9 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
         }
     }
     async handleBrowserMouseMove(msg) {
-        const session = msg.sessionId ? this.browserSessionManager.get(msg.sessionId) : undefined;
-        if (!session || msg.x === undefined || msg.y === undefined)
+        const sessionId = msg.sessionId;
+        const session = sessionId ? this.browserSessionManager.get(sessionId) : undefined;
+        if (!session || !sessionId || msg.x === undefined || msg.y === undefined)
             return;
         try {
             await session.executeMouseMove(msg.x, msg.y);
@@ -609,7 +690,24 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
             // navigation) is intentionally logged but NOT surfaced as an `error` message
             // to the web client, to avoid error spam during drag-selection. Unlike
             // mouse_down / mouse_up, a dropped move does not leave the page in a broken state.
-            logger_1.logger.warn(`[vscode-ws] mouseMove failed (session=${msg.sessionId}): ${(0, utils_1.getErrorMessage)(error)}`);
+            logger_1.logger.warn(`[vscode-ws] mouseMove failed (session=${sessionId}): ${(0, utils_1.getErrorMessage)(error)}`);
+            return;
+        }
+        // Best-effort cursor-shape mirroring: read the CSS cursor at the point and,
+        // only when it differs from the last value sent for this session, forward a
+        // browser_cursor_update. A failed read is logged (not silently swallowed)
+        // and skips the update for this frame rather than spamming an error message.
+        let cursor;
+        try {
+            cursor = await session.getCursorAt(msg.x, msg.y);
+        }
+        catch (error) {
+            logger_1.logger.warn(`[vscode-ws] getCursorAt failed (session=${sessionId}): ${(0, utils_1.getErrorMessage)(error)}`);
+            return;
+        }
+        if (this.lastSentCursor.get(sessionId) !== cursor) {
+            this.lastSentCursor.set(sessionId, cursor);
+            this.send({ type: 'browser_cursor_update', sessionId, cursor });
         }
     }
     async handleBrowserMouseDown(msg) {
@@ -715,6 +813,21 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
             this.send({ type: 'error', sessionId, message: `getSelection failed: ${(0, utils_1.getErrorMessage)(error)}` });
         }
     }
+    async handleBrowserSetInputValue(msg) {
+        const session = msg.sessionId ? this.browserSessionManager.get(msg.sessionId) : undefined;
+        if (!session)
+            return;
+        // The contract requires `value` to be a string; ignore malformed payloads.
+        if (typeof msg.value !== 'string')
+            return;
+        try {
+            await session.setFocusedInputValue(msg.value, msg.selectionStart, msg.selectionEnd);
+        }
+        catch (error) {
+            logger_1.logger.warn(`[vscode-ws] setInputValue failed (session=${msg.sessionId}): ${(0, utils_1.getErrorMessage)(error)}`);
+            this.send({ type: 'error', sessionId: msg.sessionId, message: `setInputValue failed: ${(0, utils_1.getErrorMessage)(error)}` });
+        }
+    }
     async handleBrowserExecuteScript(msg) {
         const sessionId = msg.sessionId;
         if (!sessionId || !msg.script) {
@@ -773,34 +886,197 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
         }
         // Consume the pending chooser up-front so it is not left dangling on any path.
         this.pendingFileChoosers.delete(sessionId);
-        const files = msg.files ?? [];
+        // Outermost guard: any unexpected error (malformed payload, FS failure, a
+        // throwing `accept`) MUST surface as an `error` notification AND cancel the
+        // chooser, never escape as an unhandled rejection that leaves the remote
+        // `<input type=file>` stuck waiting. Each branch below already cancels on
+        // its own validation failures; this catch is the final backstop so a
+        // non-string filePath element, a non-array `files`, etc. cannot wedge the
+        // chooser.
+        try {
+            if (msg.files === undefined && msg.filePaths !== undefined) {
+                await this.handleBrowserSetFileByPaths(sessionId, accept, msg.filePaths);
+                return;
+            }
+            await this.handleBrowserSetFileByContent(sessionId, accept, msg.files);
+        }
+        catch (error) {
+            this.send({ type: 'error', sessionId, message: `File upload failed: ${(0, utils_1.getErrorMessage)(error)}` });
+            await this.cancelFileChooser(accept, sessionId);
+        }
+    }
+    /**
+     * Branch 1: Agent FS paths chosen directly by the user via the workspace file
+     * explorer. These arrive as workspace-relative paths (e.g. `repos/app.ts`) —
+     * Playwright's setFiles requires absolute paths, so each is resolved against
+     * the workspace root before being forwarded. Already absolute paths are
+     * accepted as-is for backward compatibility, but every resolved path must
+     * stay inside the workspace root (traversal + symlink-escape guard).
+     */
+    async handleBrowserSetFileByPaths(sessionId, accept, filePaths) {
+        // Explicit input validation (do not rely on a thrown TypeError): the payload
+        // must be an array of strings. Anything else is rejected + chooser cancelled.
+        if (!Array.isArray(filePaths) || filePaths.some((p) => typeof p !== 'string')) {
+            this.send({
+                type: 'error',
+                sessionId,
+                message: 'Invalid file payload: filePaths must be an array of strings',
+            });
+            await this.cancelFileChooser(accept, sessionId);
+            return;
+        }
+        const resolved = await this.resolveWorkspaceFilePaths(filePaths);
+        if (typeof resolved === 'string') {
+            // Resolution rejected the upload (escape attempt / missing workspace /
+            // symlink pointing outside). Surface the reason and cancel the chooser so
+            // the remote input is not left pending.
+            this.send({ type: 'error', sessionId, message: resolved });
+            await this.cancelFileChooser(accept, sessionId);
+            return;
+        }
+        try {
+            await accept(resolved);
+        }
+        catch (error) {
+            // Symmetry with the base64 branch: when setFiles rejects, surface the
+            // error AND cancel the chooser so the remote input is not left pending.
+            this.send({ type: 'error', sessionId, message: `File upload failed: ${(0, utils_1.getErrorMessage)(error)}` });
+            await this.cancelFileChooser(accept, sessionId);
+        }
+    }
+    /**
+     * Branch 2: base64 file contents uploaded from the web client. Decode each
+     * into a temporary file on the agent host, hand the temp paths to setFiles,
+     * then always remove the temp files afterwards.
+     */
+    async handleBrowserSetFileByContent(sessionId, accept, rawFiles) {
+        // Explicit input validation (do not rely on a thrown TypeError): `files`
+        // must be an array, and every entry must carry a string `dataBase64`.
+        if (rawFiles !== undefined && !Array.isArray(rawFiles)) {
+            this.send({ type: 'error', sessionId, message: 'Invalid file payload: files must be an array' });
+            await this.cancelFileChooser(accept, sessionId);
+            return;
+        }
+        const files = (rawFiles ?? []);
         // Validate every entry has a string dataBase64 before decoding so we never
         // pass undefined / non-string into Buffer.from.
-        if (files.some((f) => typeof f.dataBase64 !== 'string')) {
+        if (files.some((f) => typeof f?.dataBase64 !== 'string')) {
             this.send({ type: 'error', sessionId, message: 'Invalid file payload: dataBase64 must be a string' });
             // Cancel the remote input so it is not left pending/half-filled.
             await this.cancelFileChooser(accept, sessionId);
             return;
         }
+        const safeFiles = files;
         // Estimate decoded size from base64 length and enforce the authoritative limit
         // before allocating buffers.
-        const totalBytes = files.reduce((sum, f) => sum + Math.floor((f.dataBase64.length * 3) / 4), 0);
+        const totalBytes = safeFiles.reduce((sum, f) => sum + Math.floor((f.dataBase64.length * 3) / 4), 0);
         if (totalBytes > MAX_UPLOAD_BYTES) {
             this.send({ type: 'error', sessionId, message: 'File too large (max 10MB)' });
             await this.cancelFileChooser(accept, sessionId);
             return;
         }
-        const payload = files.map((f) => ({
-            name: f.name,
-            mimeType: f.mimeType,
-            buffer: Buffer.from(f.dataBase64, 'base64'),
-        }));
+        // Create a unique temp directory for this upload so concurrent uploads and
+        // duplicate file names never collide.
+        let tmpDir;
+        try {
+            tmpDir = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'browser-upload-'));
+        }
+        catch (error) {
+            this.send({ type: 'error', sessionId, message: `File upload failed: ${(0, utils_1.getErrorMessage)(error)}` });
+            await this.cancelFileChooser(accept, sessionId);
+            return;
+        }
         try {
+            const tmpPaths = [];
+            for (let i = 0; i < safeFiles.length; i++) {
+                const file = safeFiles[i];
+                // Prefix with the index so distinct uploads sharing a sanitized name
+                // never overwrite one another within the temp dir.
+                const safeName = `${i}-${sanitizeUploadFileName(file.name)}`;
+                const tmpPath = path.join(tmpDir, safeName);
+                await node_fs_1.promises.writeFile(tmpPath, Buffer.from(file.dataBase64, 'base64'));
+                tmpPaths.push(tmpPath);
+            }
+            const payload = tmpPaths;
             await accept(payload);
         }
         catch (error) {
             this.send({ type: 'error', sessionId, message: `File upload failed: ${(0, utils_1.getErrorMessage)(error)}` });
+            await this.cancelFileChooser(accept, sessionId);
+        }
+        finally {
+            // Always remove the temp files/dir once setFiles has resolved or rejected.
+            await node_fs_1.promises.rm(tmpDir, { recursive: true, force: true }).catch((error) => {
+                logger_1.logger.warn(`[vscode-ws] failed to remove temp upload dir ${tmpDir}: ${(0, utils_1.getErrorMessage)(error)}`);
+            });
+        }
+    }
+    /**
+     * Resolve user-chosen file-explorer paths into absolute paths suitable for
+     * Playwright's `setFiles`, enforcing that every resolved path stays inside
+     * the agent workspace root.
+     *
+     * Resolution rules per path:
+     *  - Absolute paths are kept as-is (backward compatibility for callers that
+     *    already send absolute agent-FS paths).
+     *  - Relative paths (e.g. `repos/app.ts`) are resolved against the workspace
+     *    directory (`getWorkspaceDir(projectDir)`).
+     *
+     * Traversal guard (lexical): after resolution, the absolute path must be the
+     * workspace root itself or a descendant of it. `path.relative(workspaceDir,
+     * resolved)` starting with `..` (or being absolute) means the path escaped the
+     * workspace and is rejected. This rejects both relative escapes
+     * (`../../etc/passwd`) and absolute paths pointing outside the workspace.
+     *
+     * Symlink-escape guard (physical): a path that is lexically inside the
+     * workspace may still resolve, through a symlink, to a target OUTSIDE it
+     * (e.g. a `link` inside the workspace pointing at `../../.ssh/id_rsa`). After
+     * the lexical check, each existing path's real (canonical) location is
+     * resolved via `fs.realpath` and re-checked against the workspace root. Paths
+     * whose real location escapes the workspace are rejected. Non-existent paths
+     * cannot be canonicalized; they are left as-is (Playwright's setFiles will
+     * fail on them) rather than rejected here, preserving the lexical guarantee.
+     *
+     * Returns the resolved absolute paths on success, or an error message string
+     * describing why the upload was rejected (never silently dropped).
+     */
+    async resolveWorkspaceFilePaths(filePaths) {
+        // A workspace root is required to both resolve relative paths and to bound
+        // absolute ones. Without a project directory we cannot safely accept any
+        // file-explorer path.
+        if (!this.projectDir) {
+            return 'Cannot resolve file paths: no project directory configured for this agent';
+        }
+        const workspaceDir = path.resolve((0, project_dir_1.getWorkspaceDir)(this.projectDir));
+        // Canonicalize the workspace root too, so a symlinked workspace dir does not
+        // produce false positives when comparing against realpath'd children.
+        const realWorkspaceDir = await node_fs_1.promises.realpath(workspaceDir).catch(() => workspaceDir);
+        const isInside = (root, target) => {
+            const rel = path.relative(root, target);
+            // Inside when the relative path stays under root: not climbing out (`..`)
+            // and not forced absolute (different root/drive). An empty `rel` means the
+            // path IS the root, which is allowed.
+            return !rel.startsWith('..') && !path.isAbsolute(rel);
+        };
+        const resolved = [];
+        for (const filePath of filePaths) {
+            const absolute = path.isAbsolute(filePath)
+                ? path.resolve(filePath)
+                : path.resolve(workspaceDir, filePath);
+            // Lexical guard first (cheap, also covers non-existent paths).
+            if (!isInside(workspaceDir, absolute)) {
+                return `Access denied: file path is outside the workspace: ${filePath}`;
+            }
+            // Physical guard: resolve symlinks and re-check. Missing paths cannot be
+            // canonicalized — keep the lexically-validated absolute path (setFiles
+            // will surface the non-existence downstream).
+            const real = await node_fs_1.promises.realpath(absolute).catch(() => null);
+            if (real !== null && !isInside(realWorkspaceDir, real)) {
+                return `Access denied: file path is outside the workspace: ${filePath}`;
+            }
+            resolved.push(absolute);
         }
+        return resolved;
     }
     /**
      * Cancel a pending file chooser by applying an empty file list so the remote
@@ -820,6 +1096,7 @@ class VsCodeTunnelWebSocket extends base_websocket_1.BaseWebSocketConnection {
         // ブラウザセッションのクリーンアップ
         void this.browserSessionManager.closeAll();
         this.pendingFileChoosers.clear();
+        this.lastSentCursor.clear();
         // ブラウザローカルサーバーのクリーンアップ
         if (this.browserLocalServer) {
             void this.browserLocalServer.stop();