@angelky7/dsh-browser-control 1.7.8 → 1.7.10

package/README.en.md

@@ -64,8 +64,8 @@ In one line: **for "use MY browser" tasks (logged-in Bilibili, Zhihu, admin pane
 
 | File | Purpose |
 |---|---|
-| [DSH-Browser-Control-v1.7.2.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.2/DSH-Browser-Control-v1.7.2.zip) | Chrome extension (unzip and load; **the extension no longer changes with feature updates from v1.7.2 on**: v1.7.3–v1.7.8 do not touch the extension — skip this if v1.7.2 is already loaded) |
-| [dsh-browser-control-plugin-v1.7.8.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.8/dsh-browser-control-plugin-v1.7.8.zip) | dsh plugin (offline fallback; online installs use Option A/B) |
+| [DSH-Browser-Control-v1.7.2.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.2/DSH-Browser-Control-v1.7.2.zip) | Chrome extension (unzip and load; **the extension no longer changes with feature updates from v1.7.2 on**: v1.7.3–v1.7.10 need no extension reinstall; the v1.7.10 session fix is plugin-side only (extension clipping improvements ship with the next extension update)) |
+| [dsh-browser-control-plugin-v1.7.10.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.10/dsh-browser-control-plugin-v1.7.10.zip) | dsh plugin (offline fallback; online installs use Option A/B) |
 
 ## Install the Chrome extension (30 seconds)
 
@@ -104,7 +104,7 @@ npm install @angelky7/dsh-browser-control
 
 ```bash
 # Straight from GitHub
-dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.7.8"
+dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.7.10"
 
 # Local checkout for debugging (note: the explicit file: prefix is required)
 dsh plugin --profile web add "file:D:\path\to\dsh-browser-control"

package/README.md

@@ -64,8 +64,8 @@ Chrome 扩展（CDP 驱动）
 
 | 文件 | 说明 |
 |---|---|
-| [DSH-Browser-Control-v1.7.2.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.2/DSH-Browser-Control-v1.7.2.zip) | Chrome 扩展（解压后加载；**扩展从 v1.7.2 起不再随功能更新**：v1.7.3–v1.7.8 都没有动扩展，装过 v1.7.2 的不用重装） |
-| [dsh-browser-control-plugin-v1.7.8.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.8/dsh-browser-control-plugin-v1.7.8.zip) | dsh 插件（离线兜底，在线装直接用方式 A/B） |
+| [DSH-Browser-Control-v1.7.2.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.2/DSH-Browser-Control-v1.7.2.zip) | Chrome 扩展（解压后加载；**扩展从 v1.7.2 起不再随功能更新**：v1.7.3–v1.7.10 的功能更新都不需要重装扩展；v1.7.10 的会话修复只改了插件（扩展侧的截断优化随下一次扩展更新）） |
+| [dsh-browser-control-plugin-v1.7.10.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.7.10/dsh-browser-control-plugin-v1.7.10.zip) | dsh 插件（离线兜底，在线装直接用方式 A/B） |
 
 ## 安装 Chrome 扩展（30 秒）
 
@@ -104,7 +104,7 @@ npm install @angelky7/dsh-browser-control
 
 ```bash
 # 直接从 GitHub 安装
-dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.7.8"
+dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.7.10"
 
 # 本地目录调试（注意：必须显式 file: 前缀）
 dsh plugin --profile web add "file:D:\path\to\dsh-browser-control"
@@ -263,8 +263,8 @@ curl -X POST http://127.0.0.1:9777/api/command \
 | `browser_emulate` | 切设备视口（移动 / 桌面 / 自定义，v1.0.7+）；v1.7.1 起还能限速：`network` slow3g/fast3g/offline/reset + `cpuThrottlingRate`（1–20），回执写明生效数值，`device:"reset"` 一并还原 |
 | `browser_metrics` | 读性能计数器（DOM 节点数 / JS 堆 / 布局与脚本耗时，Performance.getMetrics，只读；让「这页面很重」有数字说话，v1.7.1+） |
 | `browser_drag` | 拖拽：from/to 用选择器或视口坐标；`auto` 对 `draggable="true"` 的源走 html5 事件合成（dragstart→dragover→drop，未接受就不 drop），其余走真实鼠标输入（按下→插值移动→抬起，滑杆/画布/排序组件用这个）。**纯插件实现**（经 v1.7.2 预埋的 cdp 通道），v1.7.3+ |
-| `browser_audit` | 读本次插件会话的内存审计账本：发过/被拒的每条命令（参数脱敏、`code`/`effectState`、耗时），最多 200 条、dsh 重启即清；输入的文字与 cookie 值打码、eval 表达式截断。纯本地读，只读档下照常可用（v1.7.4+） |
-| `browser_journal` | 读**跨 dsh 重启**的持久命令账本（`<stateDir>/journal.jsonl`，最多 1000 条，按运行分组）——重启后先问它「上个会话在哪个标签页干了什么」；同样的脱敏规则；纯本地磁盘读，**扩展离线也能用**（v1.7.5+） |
+| `browser_audit` | 读本次插件会话的内存审计账本：发过/被拒的每条命令（参数脱敏、`code`/`effectState`、耗时），最多 200 条、dsh 重启即清；输入的文字与 cookie 值打码、URL 查询值与敏感片段打码、错误文本里的 URL 同样打码、eval 表达式截断。回执里的 `journal` 说明本次是否在写盘（`enabled:false` + `error` = 仅内存）。纯本地读，只读档下照常可用（v1.7.4+） |
+| `browser_journal` | 读**跨 dsh 重启**的持久命令账本（`<stateDir>/journal.jsonl`，最多 1000 条，按运行分组）——重启后先问它「上个会话在哪个标签页干了什么」；同样的脱敏规则；`journal.enabled` 说明**本次**运行是否在写盘（false 时你看到的是更早的运行）。纯本地磁盘读，**扩展离线也能用**（v1.7.5+） |
 | `browser_sessions` | 多 session 隔离：列出共用这个浏览器的 dsh 会话与各自的**工作标签页**；`action:"release"` 释放自己的。省略 tabId 的调用默认落到**本会话**的工作标签页（先核验还开着），并发会话不再互相抢活动页；显式 tabId 永远有效。纯本地，v1.7.6+ |
 | `browser_windows` | 窗口控制：清单/开窗/改状态与几何/关整窗/跨窗挪标签（唯一能碰窗口几何的工具，v1.6.0+） |
 | `browser_cleanup` | 清理临时文件 |

package/lib/index.js

@@ -974,6 +974,46 @@ const AUDIT_EXPRESSION_MAX_CHARS = 120;
 /** 参数里这些键的值一律打码（大小写不敏感）。 */
 const SECRET_KEY = /^(token|authorization|password|passwd|secret|apikey|api_key|cookie)$/i;
 /**
+* URL 里的秘密不能靠「截断」处理：`?token=…&code=…` 截到 120 字符照样是明文。
+* 审计的用途是「做了什么」，所以保留 scheme/host/path 与查询键名，**查询值一律打码**；
+* 片段（#）只在看起来像参数（含 `=` 或 token/secret 字样）时整体打码——SPA 路由
+* （`#/inbox`）要留住，OAuth 隐式流的 `#access_token=…` 不能留。
+*/
+const URL_PATTERN = /https?:\/\/[^\s"'<>]+/g;
+function redactUrlMatch(match) {
+	const trailing = match.match(/[).,;:!?]+$/);
+	const core = trailing === null ? match : match.slice(0, -trailing[0].length);
+	const tail = trailing === null ? "" : trailing[0];
+	const queryAt = core.indexOf("?");
+	const hashAt = core.indexOf("#");
+	const base = queryAt >= 0 ? core.slice(0, queryAt) : hashAt >= 0 ? core.slice(0, hashAt) : core;
+	const query = queryAt >= 0 ? core.slice(queryAt + 1, hashAt >= 0 ? hashAt : void 0) : "";
+	const hash = hashAt >= 0 ? core.slice(hashAt) : "";
+	let changed = false;
+	const redactedQuery = query.length === 0 ? "" : query.split("&").map((pair) => {
+		const eq = pair.indexOf("=");
+		if (eq < 0) return pair;
+		const key = pair.slice(0, eq);
+		let value = pair.slice(eq + 1);
+		try {
+			value = decodeURIComponent(value);
+		} catch {}
+		changed = true;
+		return `${key}=[redacted:${[...value].length} chars]`;
+	}).join("&");
+	let redactedHash = hash;
+	if (hash.length > 1 && (/=/.test(hash) || /token|secret|access_token/i.test(hash))) {
+		redactedHash = "#[redacted]";
+		changed = true;
+	}
+	if (!changed) return core + tail;
+	return `${base}${redactedQuery.length > 0 ? `?${redactedQuery}` : ""}${redactedHash}${tail}`;
+}
+/** 把一段文本里所有 URL 的查询值/敏感片段打码（用于参数摘要与错误文本）。 */
+function redactAuditText(text) {
+	return text.replace(URL_PATTERN, redactUrlMatch);
+}
+/**
 * 哪个命令的 `value` 字段是敏感内容：`input` 是往页面里打的字（可能是密码），
 * `cookies.set` 直接写凭据。其余命令的 value 字段（如果有）不动。
 */
@@ -991,7 +1031,11 @@ function summarizeAuditParams(command, params) {
 		text = JSON.stringify(params, (key, value) => {
 			if (SECRET_KEY.test(key)) return "[redacted]";
 			if (key === "value" && VALUE_REDACTED_COMMANDS.has(command)) return redactValue(value);
-			if (key === "expression" && typeof value === "string" && [...value].length > AUDIT_EXPRESSION_MAX_CHARS) return `${[...value].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join("")}…[+${[...value].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+			if (typeof value === "string") {
+				const redacted = redactAuditText(value);
+				if (key === "expression" && [...redacted].length > AUDIT_EXPRESSION_MAX_CHARS) return `${[...redacted].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join("")}…[+${[...redacted].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+				return redacted;
+			}
 			return value;
 		}) ?? "{}";
 	} catch {
@@ -1023,7 +1067,10 @@ var AuditLog = class {
 		if (input.tabId !== void 0) entry.tabId = input.tabId;
 		if (input.code !== void 0) entry.code = input.code;
 		if (input.effectState !== void 0) entry.effectState = input.effectState;
-		if (input.error !== void 0) entry.error = [...input.error].length > AUDIT_ERROR_MAX_CHARS ? `${[...input.error].slice(0, AUDIT_ERROR_MAX_CHARS).join("")}…` : input.error;
+		if (input.error !== void 0) {
+			const redacted = redactAuditText(input.error);
+			entry.error = [...redacted].length > AUDIT_ERROR_MAX_CHARS ? `${[...redacted].slice(0, AUDIT_ERROR_MAX_CHARS).join("")}…` : redacted;
+		}
 		this.entries.push(entry);
 		if (this.entries.length > 200) this.entries.splice(0, this.entries.length - 200);
 		return entry;
@@ -1237,6 +1284,38 @@ var SessionRegistry = class {
 	}
 };
 //#endregion
+//#region lib/types/text.js
+/**
+* UTF-16 截断守卫（issue #26）。
+*
+* 页面文本按**码元** `slice(0, n)` 会切出孤立代理项（半个 emoji）。`JSON.stringify`
+* 把它写成裸 `\ud83d`，模型的 JSON 解析器要求代理对成对出现，于是**整个请求体**
+* 被 400 拒收；坏字符进了会话历史就每轮重放，只能换会话。
+*
+* 两条规则：
+*  1. 切点落在高位代理项上时退一格——宁可少一个字，不留半个字符；
+*  2. `toWellFormed()` 兜底页面自己提供的坏字符（孤立代理项 → U+FFFD）。
+*/
+/** 把任意字符串变成 well-formed UTF-16（孤立代理项 → U+FFFD）。 */
+function toWellFormed(text) {
+	const fn = text.toWellFormed;
+	if (typeof fn === "function") return fn.call(text);
+	return text.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "�");
+}
+/**
+* 按码元上限截断，但不留下半个代理对。
+* @param text - 原文本。
+* @param maxChars - 码元上限（与既有 offset/limit 语义一致）；≤0 返回空串。
+*/
+function sliceWellFormed(text, maxChars) {
+	if (maxChars <= 0) return "";
+	if (text.length <= maxChars) return toWellFormed(text);
+	let end = maxChars;
+	const unit = text.charCodeAt(end - 1);
+	if (unit >= 55296 && unit <= 56319) end -= 1;
+	return toWellFormed(text.slice(0, Math.max(0, end)));
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * Browser-bridge plugin: one local WebSocket endpoint the DSH Browser Control
@@ -1314,11 +1393,23 @@ function defineTool$1(options) {
 	const execute = ((args, exec) => {
 		const agent = exec.agent;
 		const sessionId = typeof agent?.id === "string" && agent.id.length > 0 ? agent.id : void 0;
-		return TOOL_SESSION.run(sessionId, () => inner(args, exec));
+		return TOOL_SESSION.run(sessionId, () => inner(args, exec)).catch((error) => {
+			if (error instanceof Error) error.message = toWellFormed(error.message);
+			throw error;
+		});
 	});
+	const rawRender = options.output?.render;
+	const output = rawRender === void 0 ? options.output : {
+		...options.output,
+		render: (args, value) => rawRender(args, value).map((part) => part.type === "text" && typeof part.text === "string" ? {
+			...part,
+			text: toWellFormed(part.text)
+		} : part)
+	};
 	return defineTool({
 		...options,
-		execute
+		execute,
+		output
 	});
 }
 /** Cordis plugin name used by loader diagnostics. */
@@ -1410,6 +1501,7 @@ var BridgeController = class {
 	current;
 	journal;
 	journalKey = "";
+	journalError;
 	/** 操作审计账本（内存环形缓冲，200 条；命令层记录，见 audit.ts 顶部注释）。 */
 	audit = new AuditLog();
 	/** 多 session 隔离：每个 dsh 会话的工作标签页（见 sessions.ts）。 */
@@ -1426,6 +1518,18 @@ var BridgeController = class {
 		return this.current === void 0 ? void 0 : path.resolve(this.current.stateDir);
 	}
 	/**
+	* Whether THIS run is persisting the journal, and why not. `browser_audit` /
+	* `browser_journal` surface this: a memory-only run used to be visible only in
+	* one log line, so a missing journal looked like "nothing happened".
+	*/
+	get journalStatus() {
+		if (this.journal !== void 0) return { enabled: true };
+		return this.journalError === void 0 ? { enabled: false } : {
+			enabled: false,
+			error: this.journalError
+		};
+	}
+	/**
 	* Record one audit entry in memory and, when the journal is open, on disk.
 	* Journal appends are queued and never block the command path.
 	*/
@@ -1508,8 +1612,10 @@ var BridgeController = class {
 			await previousJournal?.close();
 			try {
 				this.journal = await Journal.open(stateDir, this.log);
+				this.journalError = void 0;
 			} catch (error) {
-				this.log(`journal: disabled — ${errorMessage(error)}`);
+				this.journalError = errorMessage(error);
+				this.log(`journal: disabled — ${this.journalError}`);
 			}
 		}
 		const key = config.enabled ? `${config.port}|${config.token}|${shotsDir}` : "";
@@ -1721,9 +1827,10 @@ function errorMessage(error) {
 */
 const MAX_RENDERED_CHARS = 4e3;
 function clampRendered(text, maxChars = MAX_RENDERED_CHARS) {
-	if (text.length <= maxChars) return text;
-	const omitted = text.length - maxChars;
-	return `${text.slice(0, maxChars)}\n… [renderedTruncated omittedChars=${omitted} limitChars=${maxChars}] narrow the query and call again to see the rest`;
+	const safe = toWellFormed(text);
+	if (safe.length <= maxChars) return safe;
+	const cut = sliceWellFormed(safe, maxChars);
+	return `${cut}\n… [renderedTruncated omittedChars=${safe.length - cut.length} limitChars=${maxChars}] narrow the query and call again to see the rest`;
 }
 /** Model-facing budget for one snapshot listing; `limit` narrows the listing. */
 const SNAPSHOT_RENDER_MAX_CHARS = 8e3;
@@ -1731,8 +1838,8 @@ const SNAPSHOT_RENDER_MAX_CHARS = 8e3;
 const LOG_RENDER_MAX_CHARS = 6e3;
 /** Collapse one page-supplied field to a single line inside a rendered listing. */
 function flattenOneLine(value, maxChars) {
-	const flat = value.replace(/\s+/g, " ").trim();
-	return flat.length <= maxChars ? flat : `${flat.slice(0, maxChars)}…`;
+	const flat = toWellFormed(value.replace(/\s+/g, " ").trim());
+	return flat.length <= maxChars ? flat : `${sliceWellFormed(flat, maxChars)}…`;
 }
 /** `HH:MM:SS` in UTC from an epoch-milliseconds stamp. */
 function formatClock(epochMs) {
@@ -2067,7 +2174,7 @@ function applyBrowserTools(ctx, controller) {
 				tabId: args.tabId
 			}, exec.signal);
 			const full = raw.content ?? "";
-			const content = full.slice(offset, offset + limit);
+			const content = toWellFormed(full.slice(offset, offset + limit));
 			return {
 				tabId: raw.tabId,
 				mode,
@@ -4070,10 +4177,13 @@ function registerDragTool(ctx, controller) {
 		}
 	}));
 }
+function journalWarning(status) {
+	return status.enabled ? "" : `\nJournal write: disabled${status.error === void 0 ? "" : ` — ${status.error}`} — this run is memory-only; entries are not being written to disk.`;
+}
 function registerAuditTool(ctx, controller) {
 	ctx.tools.register(defineTool$1({
 		name: "browser_audit",
-		description: "Read this plugin session's in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; eval expressions are truncated. Plugin-local read — works in read-only mode.",
+		description: "Read this plugin session's in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; URL query values and URLs inside error text are redacted; eval expressions are truncated. The `journal` field says whether this run is also being written to disk (enabled:false + error = memory-only). Plugin-local read — works in read-only mode.",
 		parameters: {
 			command: {
 				type: "string",
@@ -4105,6 +4215,17 @@ function registerAuditTool(ctx, controller) {
 						type: "number",
 						required: true
 					},
+					journal: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							enabled: {
+								type: "boolean",
+								required: true
+							},
+							error: { type: "string" }
+						}
+					},
 					entries: {
 						type: "array",
 						required: true,
@@ -4147,9 +4268,10 @@ function registerAuditTool(ctx, controller) {
 			},
 			render: (_args, value) => {
 				const v = value;
+				const warn = v.journal === void 0 ? "" : journalWarning(v.journal);
 				if (v.entries.length === 0) return [{
 					type: "text",
-					text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.`
+					text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.${warn}`
 				}];
 				const lines = v.entries.map((e) => {
 					const tab = e.tabId === void 0 ? "" : ` tab ${e.tabId}`;
@@ -4159,7 +4281,7 @@ function registerAuditTool(ctx, controller) {
 				});
 				return [{
 					type: "text",
-					text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join("\n")}`)
+					text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join("\n")}${warn}`)
 				}];
 			}
 		},
@@ -4178,7 +4300,8 @@ function registerAuditTool(ctx, controller) {
 			return {
 				total: controller.audit.size(),
 				shown: entries.length,
-				entries
+				entries,
+				journal: controller.journalStatus
 			};
 		}
 	}));
@@ -4186,7 +4309,7 @@ function registerAuditTool(ctx, controller) {
 function registerJournalTool(ctx, controller) {
 	ctx.tools.register(defineTool$1({
 		name: "browser_journal",
-		description: "Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover \"what was I doing\" after a restart.",
+		description: "Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. The `journal` field says whether the CURRENT run is writing (enabled:false + error = this run is memory-only; what you see is from earlier runs). Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover \"what was I doing\" after a restart.",
 		parameters: {
 			command: {
 				type: "string",
@@ -4218,6 +4341,17 @@ function registerJournalTool(ctx, controller) {
 						type: "number",
 						required: true
 					},
+					journal: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							enabled: {
+								type: "boolean",
+								required: true
+							},
+							error: { type: "string" }
+						}
+					},
 					entries: {
 						type: "array",
 						required: true,
@@ -4264,9 +4398,10 @@ function registerJournalTool(ctx, controller) {
 			},
 			render: (_args, value) => {
 				const v = value;
+				const warn = v.journal === void 0 ? "" : journalWarning(v.journal);
 				if (v.entries.length === 0) return [{
 					type: "text",
-					text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.`
+					text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.${warn}`
 				}];
 				const lines = [];
 				let run = "";
@@ -4281,7 +4416,7 @@ function registerJournalTool(ctx, controller) {
 				}
 				return [{
 					type: "text",
-					text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join("\n")}`)
+					text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join("\n")}${warn}`)
 				}];
 			}
 		},
@@ -4302,7 +4437,8 @@ function registerJournalTool(ctx, controller) {
 				total,
 				shown: entries.length,
 				runs: new Set(entries.map((e) => e.run)).size,
-				entries
+				entries,
+				journal: controller.journalStatus
 			};
 		}
 	}));
@@ -4349,7 +4485,7 @@ function registerSessionsTool(ctx, controller) {
 			},
 			render: (_args, value) => {
 				const v = value;
-				const short = (id) => id.length <= 18 ? id : `${id.slice(0, 16)}…`;
+				const short = (id) => id.length <= 18 ? id : `${sliceWellFormed(id, 16)}…`;
 				if (v.releasedTabId !== void 0) return [{
 					type: "text",
 					text: `Sessions: released your working tab ${v.releasedTabId} — later calls without tabId follow the browser's active tab again.`

package/lib/types/audit.d.ts

@@ -9,6 +9,7 @@
  *   - **只存内存**（环形缓冲，200 条）：跨 dsh 重启的持久化是「会话恢复」那一版的事；
  *     这一版先把账记对，别把磁盘格式写死。
  *   - **参数摘要是脱敏后的**：输入框的值、cookie 的值、令牌类字段一律打码；
+ *     URL 的查询值与敏感片段打码，错误文本里的 URL 同样打码（截断不是脱敏）；
  *     表达式截断。审计的用途是「做了什么」，不是「内容是什么」。
  */
 export interface AuditEntry {
@@ -37,6 +38,8 @@ export interface AuditFilter {
 }
 /** 环形缓冲上限。200 条足够覆盖一次排障现场，又不至于让内存跟着会话长度涨。 */
 export declare const AUDIT_MAX_ENTRIES = 200;
+/** 把一段文本里所有 URL 的查询值/敏感片段打码（用于参数摘要与错误文本）。 */
+export declare function redactAuditText(text: string): string;
 /**
  * 把一次调用的参数压成可审计的摘要：敏感键打码、特定命令的 value 打码、
  * 长表达式截断、整体限长。返回 JSON 文本——审计工具原样把它交给模型。

package/lib/types/audit.js

@@ -8,6 +8,50 @@ const AUDIT_ERROR_MAX_CHARS = 200;
 const AUDIT_EXPRESSION_MAX_CHARS = 120;
 /** 参数里这些键的值一律打码（大小写不敏感）。 */
 const SECRET_KEY = /^(token|authorization|password|passwd|secret|apikey|api_key|cookie)$/i;
+/**
+ * URL 里的秘密不能靠「截断」处理：`?token=…&code=…` 截到 120 字符照样是明文。
+ * 审计的用途是「做了什么」，所以保留 scheme/host/path 与查询键名，**查询值一律打码**；
+ * 片段（#）只在看起来像参数（含 `=` 或 token/secret 字样）时整体打码——SPA 路由
+ * （`#/inbox`）要留住，OAuth 隐式流的 `#access_token=…` 不能留。
+ */
+const URL_PATTERN = /https?:\/\/[^\s"'<>]+/g;
+function redactUrlMatch(match) {
+    // 错误文本里的 URL 常跟着标点（"...?token=x." / "...(https://…)")，先剥掉再原样接回。
+    const trailing = match.match(/[).,;:!?]+$/);
+    const core = trailing === null ? match : match.slice(0, -trailing[0].length);
+    const tail = trailing === null ? '' : trailing[0];
+    const queryAt = core.indexOf('?');
+    const hashAt = core.indexOf('#');
+    const base = queryAt >= 0 ? core.slice(0, queryAt) : (hashAt >= 0 ? core.slice(0, hashAt) : core);
+    const query = queryAt >= 0 ? core.slice(queryAt + 1, hashAt >= 0 ? hashAt : undefined) : '';
+    const hash = hashAt >= 0 ? core.slice(hashAt) : '';
+    let changed = false;
+    const redactedQuery = query.length === 0 ? '' : query.split('&').map((pair) => {
+        const eq = pair.indexOf('=');
+        if (eq < 0)
+            return pair;
+        const key = pair.slice(0, eq);
+        let value = pair.slice(eq + 1);
+        try {
+            value = decodeURIComponent(value);
+        }
+        catch { /* 解码失败就按原文字符数 */ }
+        changed = true;
+        return `${key}=[redacted:${[...value].length} chars]`;
+    }).join('&');
+    let redactedHash = hash;
+    if (hash.length > 1 && (/=/.test(hash) || /token|secret|access_token/i.test(hash))) {
+        redactedHash = '#[redacted]';
+        changed = true;
+    }
+    if (!changed)
+        return core + tail;
+    return `${base}${redactedQuery.length > 0 ? `?${redactedQuery}` : ''}${redactedHash}${tail}`;
+}
+/** 把一段文本里所有 URL 的查询值/敏感片段打码（用于参数摘要与错误文本）。 */
+export function redactAuditText(text) {
+    return text.replace(URL_PATTERN, redactUrlMatch);
+}
 /**
  * 哪个命令的 `value` 字段是敏感内容：`input` 是往页面里打的字（可能是密码），
  * `cookies.set` 直接写凭据。其余命令的 value 字段（如果有）不动。
@@ -29,8 +73,13 @@ export function summarizeAuditParams(command, params) {
                 return '[redacted]';
             if (key === 'value' && VALUE_REDACTED_COMMANDS.has(command))
                 return redactValue(value);
-            if (key === 'expression' && typeof value === 'string' && [...value].length > AUDIT_EXPRESSION_MAX_CHARS) {
-                return `${[...value].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join('')}…[+${[...value].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+            if (typeof value === 'string') {
+                // URL query 与敏感片段先打码，再做表达式截断/整体限长：截断不是脱敏。
+                const redacted = redactAuditText(value);
+                if (key === 'expression' && [...redacted].length > AUDIT_EXPRESSION_MAX_CHARS) {
+                    return `${[...redacted].slice(0, AUDIT_EXPRESSION_MAX_CHARS).join('')}…[+${[...redacted].length - AUDIT_EXPRESSION_MAX_CHARS} chars]`;
+                }
+                return redacted;
             }
             return value;
         }) ?? '{}';
@@ -70,9 +119,10 @@ export class AuditLog {
         if (input.effectState !== undefined)
             entry.effectState = input.effectState;
         if (input.error !== undefined) {
-            entry.error = [...input.error].length > AUDIT_ERROR_MAX_CHARS
-                ? `${[...input.error].slice(0, AUDIT_ERROR_MAX_CHARS).join('')}…`
-                : input.error;
+            const redacted = redactAuditText(input.error);
+            entry.error = [...redacted].length > AUDIT_ERROR_MAX_CHARS
+                ? `${[...redacted].slice(0, AUDIT_ERROR_MAX_CHARS).join('')}…`
+                : redacted;
         }
         this.entries.push(entry);
         // 环形缓冲：超出上限从最旧的一端丢。seq 不回收——调用方拿 seq 分页时

package/lib/types/index.js

@@ -29,6 +29,7 @@ import { policyRefusal } from "./policy.js";
 import { AUDIT_MAX_ENTRIES, AuditLog, summarizeAuditParams } from "./audit.js";
 import { Journal, readJournal } from "./journal.js";
 import { SessionRegistry } from "./sessions.js";
+import { sliceWellFormed, toWellFormed } from "./text.js";
 /** Navigation wait ceiling (same as browser_wait); the bridge gets this plus BRIDGE_MARGIN_MS. */
 const NAV_MAX_MS = 120_000;
 /**
@@ -76,12 +77,28 @@ function defineTool(options) {
     const execute = ((args, exec) => {
         const agent = exec.agent;
         const sessionId = typeof agent?.id === 'string' && agent.id.length > 0 ? agent.id : undefined;
-        return TOOL_SESSION.run(sessionId, () => inner(args, exec));
+        return TOOL_SESSION.run(sessionId, () => inner(args, exec)).catch((error) => {
+            // 错误文本同样进入模型请求体：页面异常可能带孤立代理项（issue #26）。
+            // 原地改 message 而不是包一层，保留 BridgeError 的 code/effectState。
+            if (error instanceof Error)
+                error.message = toWellFormed(error.message);
+            throw error;
+        });
     });
+    // 模型可见文本的最后一道路障（issue #26）：任何 render 产出的 text 在交给宿主前
+    // 都修成 well-formed。扩展侧旧版本还在用码元截断，这里必须兜住；否则半个 emoji
+    // 会让整个请求体 400，且坏字符会随会话历史每轮重放。
+    const rawRender = options.output?.render;
+    const output = rawRender === undefined
+        ? options.output
+        : {
+            ...options.output,
+            render: (args, value) => rawRender(args, value).map((part) => (part.type === 'text' && typeof part.text === 'string' ? { ...part, text: toWellFormed(part.text) } : part)),
+        };
     // Call the host helper through a non-generic point: re-instantiating its
     // recursive InferObject types from inside a generic wrapper is what TS chokes on.
     const hostDefine = defineHostTool;
-    return hostDefine({ ...options, execute });
+    return hostDefine({ ...options, execute, output });
 }
 // Re-exported so the policy tables stay testable from the published bundle
 // (verify/verify_policy.mjs reconciles them against the extension's COMMANDS).
@@ -163,6 +180,7 @@ class BridgeController {
     current;
     journal;
     journalKey = '';
+    journalError;
     /** 操作审计账本（内存环形缓冲，200 条；命令层记录，见 audit.ts 顶部注释）。 */
     audit = new AuditLog();
     /** 多 session 隔离：每个 dsh 会话的工作标签页（见 sessions.ts）。 */
@@ -178,6 +196,16 @@ class BridgeController {
     get stateDir() {
         return this.current === undefined ? undefined : path.resolve(this.current.stateDir);
     }
+    /**
+     * Whether THIS run is persisting the journal, and why not. `browser_audit` /
+     * `browser_journal` surface this: a memory-only run used to be visible only in
+     * one log line, so a missing journal looked like "nothing happened".
+     */
+    get journalStatus() {
+        if (this.journal !== undefined)
+            return { enabled: true };
+        return this.journalError === undefined ? { enabled: false } : { enabled: false, error: this.journalError };
+    }
     /**
      * Record one audit entry in memory and, when the journal is open, on disk.
      * Journal appends are queued and never block the command path.
@@ -267,10 +295,13 @@ class BridgeController {
             await previousJournal?.close();
             try {
                 this.journal = await Journal.open(stateDir, this.log);
+                this.journalError = undefined;
             }
             catch (error) {
                 // 账本打不开不是让桥起不来的理由：降级为纯内存审计。
-                this.log(`journal: disabled — ${errorMessage(error)}`);
+                // 降级状态必须能被调用方看见（audit/journal 工具的回执），不能只写一行日志。
+                this.journalError = errorMessage(error);
+                this.log(`journal: disabled — ${this.journalError}`);
             }
         }
         const key = config.enabled ? `${config.port}|${config.token}|${shotsDir}` : '';
@@ -492,10 +523,14 @@ function errorMessage(error) {
  */
 const MAX_RENDERED_CHARS = 4_000;
 function clampRendered(text, maxChars = MAX_RENDERED_CHARS) {
-    if (text.length <= maxChars)
-        return text;
-    const omitted = text.length - maxChars;
-    return `${text.slice(0, maxChars)}\n… [renderedTruncated omittedChars=${omitted} limitChars=${maxChars}] narrow the query and call again to see the rest`;
+    // 页面文本可能自带孤立代理项，也可能是上一次按码元切出来的；先修好再判断长度。
+    const safe = toWellFormed(text);
+    if (safe.length <= maxChars)
+        return safe;
+    const cut = sliceWellFormed(safe, maxChars);
+    // 报数按**实际展示**的长度算：退掉的半个代理对算进 omitted，可见 + omitted = 总长。
+    const omitted = safe.length - cut.length;
+    return `${cut}\n… [renderedTruncated omittedChars=${omitted} limitChars=${maxChars}] narrow the query and call again to see the rest`;
 }
 /** Model-facing budget for one snapshot listing; `limit` narrows the listing. */
 const SNAPSHOT_RENDER_MAX_CHARS = 8_000;
@@ -503,8 +538,8 @@ const SNAPSHOT_RENDER_MAX_CHARS = 8_000;
 const LOG_RENDER_MAX_CHARS = 6_000;
 /** Collapse one page-supplied field to a single line inside a rendered listing. */
 function flattenOneLine(value, maxChars) {
-    const flat = value.replace(/\s+/g, ' ').trim();
-    return flat.length <= maxChars ? flat : `${flat.slice(0, maxChars)}…`;
+    const flat = toWellFormed(value.replace(/\s+/g, ' ').trim());
+    return flat.length <= maxChars ? flat : `${sliceWellFormed(flat, maxChars)}…`;
 }
 /** `HH:MM:SS` in UTC from an epoch-milliseconds stamp. */
 function formatClock(epochMs) {
@@ -821,7 +856,9 @@ function applyBrowserTools(ctx, controller) {
             const limit = Math.min(READ_WINDOW_MAX_CHARS, Math.max(1, Math.floor(Number(args.limit ?? READ_WINDOW_MAX_CHARS)) || READ_WINDOW_MAX_CHARS));
             const raw = await controller.execute('content', args.tabId === undefined ? { mode } : { mode, tabId: args.tabId }, exec.signal);
             const full = raw.content ?? '';
-            const content = full.slice(offset, offset + limit);
+            // 码元窗口可能切在代理对中间；修成 well-formed，长度不变（U+FFFD 也是一码元），
+            // offset/truncated 的算术保持原语义。
+            const content = toWellFormed(full.slice(offset, offset + limit));
             return {
                 tabId: raw.tabId,
                 mode,
@@ -2255,10 +2292,15 @@ function registerDragTool(ctx, controller) {
         },
     }));
 }
+function journalWarning(status) {
+    return status.enabled
+        ? ''
+        : `\nJournal write: disabled${status.error === undefined ? '' : ` — ${status.error}`} — this run is memory-only; entries are not being written to disk.`;
+}
 function registerAuditTool(ctx, controller) {
     ctx.tools.register(defineTool({
         name: 'browser_audit',
-        description: 'Read this plugin session\'s in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; eval expressions are truncated. Plugin-local read — works in read-only mode.',
+        description: 'Read this plugin session\'s in-memory audit trail: every command sent to the browser extension (and every policy/gate refusal), with redacted params, outcome code and duration. Newest last; capped at 200 entries and wiped when dsh restarts. Values typed into pages and cookie values are redacted; URL query values and URLs inside error text are redacted; eval expressions are truncated. The `journal` field says whether this run is also being written to disk (enabled:false + error = memory-only). Plugin-local read — works in read-only mode.',
         parameters: {
             command: { type: 'string', description: 'Only entries whose command contains this substring (e.g. "nav", "cookies", "tabs").' },
             tabId: { type: 'number', description: 'Only entries that carried this tabId.' },
@@ -2272,6 +2314,14 @@ function registerAuditTool(ctx, controller) {
                 properties: {
                     total: { type: 'number', required: true },
                     shown: { type: 'number', required: true },
+                    journal: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            enabled: { type: 'boolean', required: true },
+                            error: { type: 'string' },
+                        },
+                    },
                     entries: {
                         type: 'array',
                         required: true,
@@ -2296,8 +2346,9 @@ function registerAuditTool(ctx, controller) {
             },
             render: (_args, value) => {
                 const v = value;
+                const warn = v.journal === undefined ? '' : journalWarning(v.journal);
                 if (v.entries.length === 0) {
-                    return [{ type: 'text', text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.` }];
+                    return [{ type: 'text', text: `Audit: ${v.total} entries, none match — the trail starts when a command is executed.${warn}` }];
                 }
                 const lines = v.entries.map((e) => {
                     const tab = e.tabId === undefined ? '' : ` tab ${e.tabId}`;
@@ -2305,7 +2356,7 @@ function registerAuditTool(ctx, controller) {
                     const err = e.ok || e.error === undefined ? '' : ` — ${e.error}`;
                     return `#${e.seq} ${formatClock(e.t)} ${e.command}${tab} ${outcome} ${e.durationMs}ms ${e.params}${err}`;
                 });
-                return [{ type: 'text', text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join('\n')}`) }];
+                return [{ type: 'text', text: clampRendered(`Audit: ${v.total} entries (showing ${v.shown})\n${lines.join('\n')}${warn}`) }];
             },
         },
         presentCall: () => ({ card: 'generic', title: 'Browser audit', kind: 'other' }),
@@ -2316,14 +2367,14 @@ function registerAuditTool(ctx, controller) {
                 sinceSeq: args.sinceSeq,
                 limit: args.limit,
             });
-            return { total: controller.audit.size(), shown: entries.length, entries };
+            return { total: controller.audit.size(), shown: entries.length, entries, journal: controller.journalStatus };
         },
     }));
 }
 function registerJournalTool(ctx, controller) {
     ctx.tools.register(defineTool({
         name: 'browser_journal',
-        description: 'Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover "what was I doing" after a restart.',
+        description: 'Read the persistent command journal across dsh restarts: every command from previous runs of this plugin (written to <stateDir>/journal.jsonl, last 1000 entries), grouped by run. Same redaction as browser_audit. The `journal` field says whether the CURRENT run is writing (enabled:false + error = this run is memory-only; what you see is from earlier runs). Plugin-local disk read — works with the extension offline and in read-only mode, so it is the way to recover "what was I doing" after a restart.',
         parameters: {
             command: { type: 'string', description: 'Only entries whose command contains this substring.' },
             tabId: { type: 'number', description: 'Only entries that carried this tabId.' },
@@ -2337,6 +2388,14 @@ function registerJournalTool(ctx, controller) {
                     total: { type: 'number', required: true },
                     shown: { type: 'number', required: true },
                     runs: { type: 'number', required: true },
+                    journal: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            enabled: { type: 'boolean', required: true },
+                            error: { type: 'string' },
+                        },
+                    },
                     entries: {
                         type: 'array',
                         required: true,
@@ -2362,8 +2421,9 @@ function registerJournalTool(ctx, controller) {
             },
             render: (_args, value) => {
                 const v = value;
+                const warn = v.journal === undefined ? '' : journalWarning(v.journal);
                 if (v.entries.length === 0) {
-                    return [{ type: 'text', text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.` }];
+                    return [{ type: 'text', text: `Journal: ${v.total} entries on disk, none match — nothing recorded across runs yet.${warn}` }];
                 }
                 const lines = [];
                 let run = '';
@@ -2376,7 +2436,7 @@ function registerJournalTool(ctx, controller) {
                     const outcome = e.ok ? 'ok' : `FAIL ${e.code ?? 'error'}`;
                     lines.push(`#${e.seq} ${formatClock(e.t)} ${e.command}${tab} ${outcome} ${e.durationMs}ms ${e.params}`);
                 }
-                return [{ type: 'text', text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join('\n')}`) }];
+                return [{ type: 'text', text: clampRendered(`Journal: ${v.total} entries in ${v.runs} run(s) (showing ${v.shown})\n${lines.join('\n')}${warn}`) }];
             },
         },
         presentCall: () => ({ card: 'generic', title: 'Browser journal', kind: 'other' }),
@@ -2385,7 +2445,7 @@ function registerJournalTool(ctx, controller) {
             if (dir === undefined)
                 throw new Error('browser-bridge is not configured yet — the journal has no stateDir to read');
             const { total, entries } = await readJournal(dir, { command: args.command, tabId: args.tabId, limit: args.limit });
-            return { total, shown: entries.length, runs: new Set(entries.map((e) => e.run)).size, entries };
+            return { total, shown: entries.length, runs: new Set(entries.map((e) => e.run)).size, entries, journal: controller.journalStatus };
         },
     }));
 }
@@ -2421,7 +2481,7 @@ function registerSessionsTool(ctx, controller) {
             },
             render: (_args, value) => {
                 const v = value;
-                const short = (id) => (id.length <= 18 ? id : `${id.slice(0, 16)}…`);
+                const short = (id) => (id.length <= 18 ? id : `${sliceWellFormed(id, 16)}…`);
                 if (v.releasedTabId !== undefined) {
                     return [{ type: 'text', text: `Sessions: released your working tab ${v.releasedTabId} — later calls without tabId follow the browser's active tab again.` }];
                 }

package/lib/types/text.d.ts

@@ -0,0 +1,19 @@
+/**
+ * UTF-16 截断守卫（issue #26）。
+ *
+ * 页面文本按**码元** `slice(0, n)` 会切出孤立代理项（半个 emoji）。`JSON.stringify`
+ * 把它写成裸 `\ud83d`，模型的 JSON 解析器要求代理对成对出现，于是**整个请求体**
+ * 被 400 拒收；坏字符进了会话历史就每轮重放，只能换会话。
+ *
+ * 两条规则：
+ *  1. 切点落在高位代理项上时退一格——宁可少一个字，不留半个字符；
+ *  2. `toWellFormed()` 兜底页面自己提供的坏字符（孤立代理项 → U+FFFD）。
+ */
+/** 把任意字符串变成 well-formed UTF-16（孤立代理项 → U+FFFD）。 */
+export declare function toWellFormed(text: string): string;
+/**
+ * 按码元上限截断，但不留下半个代理对。
+ * @param text - 原文本。
+ * @param maxChars - 码元上限（与既有 offset/limit 语义一致）；≤0 返回空串。
+ */
+export declare function sliceWellFormed(text: string, maxChars: number): string;

package/lib/types/text.js

@@ -0,0 +1,36 @@
+/**
+ * UTF-16 截断守卫（issue #26）。
+ *
+ * 页面文本按**码元** `slice(0, n)` 会切出孤立代理项（半个 emoji）。`JSON.stringify`
+ * 把它写成裸 `\ud83d`，模型的 JSON 解析器要求代理对成对出现，于是**整个请求体**
+ * 被 400 拒收；坏字符进了会话历史就每轮重放，只能换会话。
+ *
+ * 两条规则：
+ *  1. 切点落在高位代理项上时退一格——宁可少一个字，不留半个字符；
+ *  2. `toWellFormed()` 兜底页面自己提供的坏字符（孤立代理项 → U+FFFD）。
+ */
+/** 把任意字符串变成 well-formed UTF-16（孤立代理项 → U+FFFD）。 */
+export function toWellFormed(text) {
+    const fn = text.toWellFormed;
+    if (typeof fn === 'function')
+        return fn.call(text);
+    // 老运行时兜底：只替换没有配对的代理项。
+    return text.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, '\uFFFD');
+}
+/**
+ * 按码元上限截断，但不留下半个代理对。
+ * @param text - 原文本。
+ * @param maxChars - 码元上限（与既有 offset/limit 语义一致）；≤0 返回空串。
+ */
+export function sliceWellFormed(text, maxChars) {
+    if (maxChars <= 0)
+        return '';
+    if (text.length <= maxChars)
+        return toWellFormed(text);
+    let end = maxChars;
+    const unit = text.charCodeAt(end - 1);
+    // 高位代理项（0xD800–0xDBFF）意味着下一码元才是配对的一半：退一格。
+    if (unit >= 0xd800 && unit <= 0xdbff)
+        end -= 1;
+    return toWellFormed(text.slice(0, Math.max(0, end)));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@angelky7/dsh-browser-control",
   "description": "Local WebSocket bridge between dsh and the DSH Browser Control browser extension, with model-facing browser_* tools and a Settings-managed on/off switch",
-  "version": "1.7.8",
+  "version": "1.7.10",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -37,7 +37,7 @@
     "build": "tsc -p tsconfig.json && tsdown",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "check": "npm run typecheck && npm run build && publint",
-    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_cookies.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_server_hardening.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs && node verify/verify_nav_timeout.mjs && node verify/verify_nav_waituntil.mjs && node verify/verify_archive.mjs && node verify/verify_windows.mjs && node verify/verify_history_nav.mjs && node verify/verify_metrics_throttle.mjs && node verify/verify_drag.mjs && node verify/verify_audit.mjs && node verify/verify_journal.mjs && node verify/verify_sessions.mjs && node verify/verify_snapshot_page.mjs && node verify/verify_compat_matrix.mjs"
+    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_cookies.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_server_hardening.mjs && node verify/verify_text_safety.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs && node verify/verify_nav_timeout.mjs && node verify/verify_nav_waituntil.mjs && node verify/verify_archive.mjs && node verify/verify_windows.mjs && node verify/verify_history_nav.mjs && node verify/verify_metrics_throttle.mjs && node verify/verify_drag.mjs && node verify/verify_audit.mjs && node verify/verify_journal.mjs && node verify/verify_sessions.mjs && node verify/verify_snapshot_page.mjs && node verify/verify_compat_matrix.mjs"
   },
   "publishConfig": {
     "access": "public",