@bastani/atomic 0.9.28-alpha.3 → 0.9.28-alpha.5

package/dist/builtin/intercom/index.bundle.mjs

@@ -1406,13 +1406,43 @@ var init_client = __esm(() => {
   };
 });
 
+// dist/builtin/intercom/broker/socket-liveness.ts
+import net2 from "net";
+function isSocketAnswering(socketPath, timeoutMs = SOCKET_PROBE_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    const socket = net2.connect(socketPath);
+    const finish = (isConnected) => {
+      clearTimeout(timeout);
+      socket.off("connect", onConnect);
+      socket.off("error", onError);
+      resolve(isConnected);
+    };
+    const onConnect = () => {
+      socket.on("error", () => {});
+      socket.end();
+      finish(true);
+    };
+    const onError = () => {
+      socket.destroy();
+      finish(false);
+    };
+    socket.on("connect", onConnect);
+    socket.on("error", onError);
+    const timeout = setTimeout(() => {
+      socket.destroy();
+      finish(false);
+    }, timeoutMs);
+  });
+}
+var SOCKET_PROBE_TIMEOUT_MS = 1000;
+var init_socket_liveness = () => {};
+
 // dist/builtin/intercom/broker/spawn.ts
 import { spawn } from "child_process";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
 import { createRequire } from "module";
-import net2 from "net";
 import { createChildProcessEnvironment, isBunBinary } from "@bastani/atomic";
 function isIntercomPackageRoot(dir) {
   return existsSync(join2(dir, "package.json")) && existsSync(join2(dir, "broker"));
@@ -1537,7 +1567,15 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, stderr = "ignore")
 }
 function resetBrokerLog(logPath = BROKER_LOG) {
   ensurePrivateDirectory(dirname(logPath));
-  closeSync(openSync(logPath, "w"));
+  try {
+    closeSync(openSync(logPath, "w"));
+    return true;
+  } catch (error) {
+    const code = error.code;
+    if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM"))
+      return false;
+    throw error;
+  }
 }
 function readBrokerLogTail(logPath = BROKER_LOG, maxBytes = BROKER_LOG_TAIL_BYTES) {
   let fd;
@@ -1571,16 +1609,17 @@ ${tail}`;
 function toError2(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
-async function spawnBrokerIfNeeded(brokerCommand, brokerArgs) {
+async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = BROKER_READY_TIMEOUT_MS) {
   ensurePrivateDirectory(INTERCOM_DIR);
   if (await isBrokerRunning()) {
     return;
   }
-  const ownsLock = acquireSpawnLock();
-  if (!ownsLock) {
-    await waitForBroker();
+  const lockOwner = acquireSpawnLock();
+  if (lockOwner === undefined) {
+    await waitForBroker(readyTimeoutMs);
     return;
   }
+  let keepLock = false;
   try {
     if (await isBrokerRunning()) {
       return;
@@ -1590,7 +1629,10 @@ async function spawnBrokerIfNeeded(brokerCommand, brokerArgs) {
     if (launch.kind === "windows-launcher") {
       writeWindowsHiddenLauncher(launch.launcherCommandLine, launch.launcherPath);
     }
-    resetBrokerLog();
+    if (!resetBrokerLog()) {
+      await waitForBroker(readyTimeoutMs);
+      return;
+    }
     const logFd = launch.kind === "direct" ? openSync(BROKER_LOG, "a") : undefined;
     let child;
     try {
@@ -1620,21 +1662,28 @@ ${describeBrokerLog()}`, { cause: error }));
 ${describeBrokerLog()}`));
           return;
         }
-        reject(new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}
-${describeBrokerLog()}`));
+        const exitedBeforeStartup = () => new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}
+${describeBrokerLog()}`);
+        if (code === 0) {
+          checkSocketConnectable().then((answering) => answering ? resolve() : reject(exitedBeforeStartup()));
+          return;
+        }
+        reject(exitedBeforeStartup());
       };
       child.once("error", onError);
       child.once("exit", onExit);
-      waitForBroker().then(() => {
+      waitForBroker(readyTimeoutMs).then(() => {
         cleanup();
         resolve();
       }, (error) => {
         cleanup();
+        keepLock = launch.kind === "direct" && child.exitCode === null && child.signalCode === null && handSpawnLockToBroker(child.pid, lockOwner);
         reject(toError2(error));
       });
     });
   } finally {
-    releaseSpawnLock();
+    if (!keepLock)
+      releaseSpawnLock(lockOwner);
   }
 }
 async function isBrokerRunning() {
@@ -1654,39 +1703,35 @@ async function isBrokerRunning() {
   }
 }
 function checkSocketConnectable() {
-  return new Promise((resolve) => {
-    const socket = net2.connect(BROKER_SOCKET2);
-    const finish = (isConnected) => {
-      clearTimeout(timeout);
-      socket.off("connect", onConnect);
-      socket.off("error", onError);
-      resolve(isConnected);
-    };
-    const onConnect = () => {
-      socket.on("error", () => {});
-      socket.end();
-      finish(true);
-    };
-    const onError = () => {
-      socket.destroy();
-      finish(false);
-    };
-    socket.on("connect", onConnect);
-    socket.on("error", onError);
-    const timeout = setTimeout(() => {
-      socket.destroy();
-      finish(false);
-    }, 1000);
-  });
+  return isSocketAnswering(BROKER_SOCKET2);
+}
+function handSpawnLockToBroker(pid, owner) {
+  if (pid === undefined || !ownsSpawnLock(owner))
+    return false;
+  try {
+    appendFileSync(BROKER_SPAWN_LOCK, `${pid}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ownsSpawnLock(owner, lockPath = BROKER_SPAWN_LOCK) {
+  try {
+    return readFileSync(lockPath, "utf-8").startsWith(owner);
+  } catch {
+    return false;
+  }
 }
 function acquireSpawnLock() {
   const maxRetries = 5;
   for (let attempt = 0;attempt < maxRetries; attempt++) {
-    try {
-      writeFileSync(BROKER_SPAWN_LOCK, `${process.pid}
+    const owner = `${process.pid}
 ${Date.now()}
-`, { flag: "wx" });
-      return true;
+`;
+    try {
+      writeFileSync(BROKER_SPAWN_LOCK, owner, { flag: "wx" });
+      return owner;
     } catch (error) {
       if (!(error instanceof Error) || error.code !== "EEXIST") {
         throw error;
@@ -1697,39 +1742,46 @@ ${Date.now()}
         } catch {}
         continue;
       }
-      return false;
+      return;
     }
   }
-  return false;
+  return;
 }
-function isSpawnLockStale() {
-  if (!existsSync(BROKER_SPAWN_LOCK)) {
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function isSpawnLockStale(lockPath = BROKER_SPAWN_LOCK, nowMs = Date.now()) {
+  if (!existsSync(lockPath)) {
     return false;
   }
   try {
-    const [pidLine = "", createdAtLine = "0"] = readFileSync(BROKER_SPAWN_LOCK, "utf-8").trim().split(`
+    const [spawnerLine = "", createdAtLine = "", brokerLine = ""] = readFileSync(lockPath, "utf-8").trim().split(`
 `);
-    const pid = Number.parseInt(pidLine, 10);
+    const spawnerPid = Number.parseInt(spawnerLine, 10);
     const createdAt = Number.parseInt(createdAtLine, 10);
-    const ageMs = Date.now() - createdAt;
-    if (Number.isFinite(pid)) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-    }
-    return !Number.isFinite(createdAt) || ageMs > 1e4;
+    const brokerPid = Number.parseInt(brokerLine, 10);
+    if (!Number.isFinite(spawnerPid) || !Number.isFinite(createdAt))
+      return true;
+    if (nowMs - createdAt > BROKER_SPAWN_LOCK_MAX_AGE_MS)
+      return true;
+    return !isProcessAlive(Number.isFinite(brokerPid) ? brokerPid : spawnerPid);
   } catch {
     return true;
   }
 }
-function releaseSpawnLock() {
+function releaseSpawnLock(owner, lockPath = BROKER_SPAWN_LOCK) {
+  if (!ownsSpawnLock(owner, lockPath))
+    return;
   try {
-    unlinkSync(BROKER_SPAWN_LOCK);
+    unlinkSync(lockPath);
   } catch {}
 }
-async function waitForBroker(timeoutMs = 5000) {
+async function waitForBroker(timeoutMs = BROKER_READY_TIMEOUT_MS) {
   const start = Date.now();
   let interval = BROKER_POLL_INITIAL_INTERVAL_MS;
   while (Date.now() - start < timeoutMs) {
@@ -1742,8 +1794,9 @@ async function waitForBroker(timeoutMs = 5000) {
   throw new Error(`Broker failed to start within timeout
 ${describeBrokerLog()}`);
 }
-var INTERCOM_DIR, EXTENSION_DIR, BROKER_SOCKET2, BROKER_PID, BROKER_SPAWN_LOCK, BROKER_LOG, BROKER_LOG_TAIL_BYTES, BROKER_POLL_INITIAL_INTERVAL_MS = 10, BROKER_POLL_MAX_INTERVAL_MS = 100, INTERNAL_INTERCOM_BROKER_ARG = "--atomic-internal-intercom-broker";
+var INTERCOM_DIR, EXTENSION_DIR, BROKER_SOCKET2, BROKER_PID, BROKER_SPAWN_LOCK, BROKER_LOG, BROKER_LOG_TAIL_BYTES, BROKER_POLL_INITIAL_INTERVAL_MS = 10, BROKER_POLL_MAX_INTERVAL_MS = 100, BROKER_READY_TIMEOUT_MS = 5000, BROKER_SPAWN_LOCK_MAX_AGE_MS = 60000, INTERNAL_INTERCOM_BROKER_ARG = "--atomic-internal-intercom-broker";
 var init_spawn = __esm(() => {
+  init_socket_liveness();
   init_paths();
   INTERCOM_DIR = getIntercomDirPath();
   EXTENSION_DIR = resolveIntercomPackageRoot(import.meta.url);
@@ -6393,7 +6446,7 @@ __export(exports_index_heavy, {
   default: () => piIntercomExtension
 });
 import { APP_NAME, sessionScopedExtensionState } from "@bastani/atomic";
-import { appendFileSync } from "node:fs";
+import { appendFileSync as appendFileSync2 } from "node:fs";
 function isPendingStageUndeliverableEvent(value) {
   if (typeof value !== "object" || value === null)
     return false;
@@ -7352,7 +7405,7 @@ var init_index_heavy = __esm(() => {
     process.env.ATOMIC_INTERCOM_HEAVY_IMPORTED = "1";
   }
   if (process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE) {
-    appendFileSync(process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE, `intercom
+    appendFileSync2(process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE, `intercom
 `);
   }
   INTERCOM_SESSION_ID_ENV = `${APP_NAME.toUpperCase()}_INTERCOM_SESSION_ID`;

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.5",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^1.0.4",
+    "@earendil-works/pi-tui": "^1.1.0",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.5",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.28-alpha.4] - 2026-10-07
+
+### Changed
+
+- Updated the bundled Cua Driver skill to upstream `cua-driver-rs-v0.34.0`, with focused runtime, workflow, and visual guides covering authorization, exact targets, observation, and outcome verification.
+
 ## [0.9.27] - 2026-10-05
 
 ### Fixed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.5",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [
@@ -35,8 +35,8 @@
   "peerDependencies": {
     "@bastani/atomic": "*",
     "@bastani/pi-ai": "*",
-    "@earendil-works/pi-agent-core": "^1.0.4",
-    "@earendil-works/pi-tui": "^1.0.4",
+    "@earendil-works/pi-agent-core": "^1.1.0",
+    "@earendil-works/pi-tui": "^1.1.0",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/subagents/skills/agent-browser/SKILL.md

@@ -4,7 +4,7 @@ description: Browser automation CLI for AI agents. Use when the user needs to in
 hidden: true
 metadata:
     github-path: skills/agent-browser
-    github-ref: refs/tags/v0.38.1
+    github-ref: refs/tags/v0.38.2
     github-repo: https://github.com/vercel-labs/agent-browser
     github-tree-sha: 82def67855a0d2aad7794207951820fa5422fdb0
 name: agent-browser

package/dist/builtin/subagents/skills/cua-driver/BROWSER.md

@@ -3,10 +3,14 @@
 Use this guide for page content in Chromium-family browsers and Electron.
 Browser chrome, permission prompts, downloads, file pickers, and unsupported
 engines remain native windows: inspect and operate them with
-`get_window_state` and the normal AX/PX action ladder in `SKILL.md`.
+`get_window_state` and the native action loop in [WORKFLOW.md](WORKFLOW.md).
 
 ## Choose the page-aware route first
 
+Use this route only when the user's requested interaction method permits
+page-aware automation. GUI-only/native-input tasks stay on the native window
+or authorized desktop loop, even for Electron applications.
+
 For supported page content, prefer the typed browser tools over the legacy
 `page` tool, accessibility guesses, omnibox shortcuts, or raw pixels. The
 typed route binds an exact native `(pid, window_id)` to a browser target and
@@ -32,14 +36,15 @@ same value on every call that accepts it. Passing it once is not sticky; a later
 omitted value uses the transport's implicit session. One long-lived MCP or SDK
 transport may omit `session` for one-off or deliberately unlabeled work; its
 first admitted call creates one implicit session and later unnamed calls reuse
-it. Direct one-shot CLI calls use disposable transports. Never substitute a raw
+it. Use one persistent MCP connection for preparation, binding, actions, and
+cleanup; see [RUNTIME.md](RUNTIME.md). Anonymous one-shot CLI calls use disposable transports. Never substitute a raw
 CDP target id, tab ordinal, URL match, or remembered ref for a capability
 returned by `get_browser_state`.
 
 ### Copy page content to the system clipboard
 
-If the requested outcome is exact page content on the system clipboard—not a
-literal text-selection gesture—read the content from a fresh semantic browser
+If the requested outcome is exact page content on the system clipboard (not a
+literal text-selection gesture), read the content from a fresh semantic browser
 snapshot, call `clipboard_write` with the exact observed value, and verify it
 with `clipboard_read`. This path is background-safe and does not require a
 clickable ref: passive headings and text nodes are evidence sources, not
@@ -48,7 +53,7 @@ controls that must be clicked before their value can be copied.
 Fall back to visual text selection and the platform copy hotkey only when the
 user explicitly requires that gesture or clipboard tools are unavailable.
 That fallback is native input, not a typed page mutation, and may require the
-foreground escalation rules in `SKILL.md`.
+foreground escalation rules in [RUNTIME.md](RUNTIME.md#foreground-boundary).
 
 ### Browser recording feedback
 
@@ -74,13 +79,17 @@ recording overlay to explain navigation in a public demo.
 
 ## 1. Select an exact native window
 
+The examples below show tool names and JSON arguments for calls on the same
+persistent MCP connection. They are not separate shell commands. Replace all
+sample PIDs, windows, target/tab IDs, and refs with returned values.
+
 Start or discover the app with the native tools and select one returned
 `window_id`:
 
-```bash
-cua-driver start_session '{"session":"browser-run-1"}'
-cua-driver list_windows '{"pid":4242}'
-cua-driver get_browser_state \
+```text
+start_session '{"session":"browser-run-1"}'
+list_windows '{"pid":4242}'
+get_browser_state
   '{"pid":4242,"window_id":991,"session":"browser-run-1"}'
 ```
 
@@ -108,8 +117,8 @@ a DevTools listener merely because the listener belongs to that process.
 Prefer an isolated profile when the task does not need the user's existing
 cookies or login state:
 
-```bash
-cua-driver browser_prepare \
+```text
+browser_prepare
   '{"session":"browser-run-1","allow_launch":true,
     "profile":{"mode":"isolated_new"}}'
 ```
@@ -126,6 +135,14 @@ order: Google Chrome, then Microsoft Edge. On Linux it accepts exact
 root-owned, non-group/world-writable package payloads in this order: Google
 Chrome, Chromium, then Microsoft Edge. User application directories, `PATH`
 entries, redirected paths, and unsigned or mismatched products fail closed.
+On Windows, the installation must also be unmodifiable by the token that runs
+the browser. A non-elevated Driver runs the browser with its own token. An
+elevated Driver, including the built-in Administrator and administrators with
+UAC off, runs it with a derived standard-user token (administrator rights
+removed, Medium integrity) and proves the installation protected from that
+token. If that token cannot be derived and verified, or can still modify the
+installation, the refusal says so; the browser is not missing or unsigned, and
+Driver never falls back to an elevated browser.
 Supply a Chromium-family browser pid when the isolated launch must use that
 process's exact executable, including Chromium on macOS or Windows. The pid
 remains required for existing-profile attachment.
@@ -151,8 +168,12 @@ satisfy the task.
 ```bash
 # Start the runtime with the trusted standard-mode launch grant.
 cua-driver mcp --grant existing-profile
+```
 
-cua-driver browser_prepare \
+Then call on that connection:
+
+```text
+browser_prepare
   '{"pid":4242,"window_id":991,"session":"browser-run-1",
     "strategy":{"kind":"existing_profile"}}'
 ```
@@ -228,8 +249,8 @@ tri-state: `true` is a uniquely proven selected tab, `false` is a proven
 unselected tab, and `null` means native evidence cannot distinguish the
 selection. Never guess from list order when all tabs are `null`.
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2"}'
 ```
@@ -237,8 +258,8 @@ cua-driver get_browser_state \
 Set `include_screenshot:true` when the visual state matters, including when the
 exact tab is open but unselected:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "include_screenshot":true}'
@@ -269,8 +290,8 @@ the output budget. Inspect `snapshot.complete`, `snapshot.omitted`, and
 `snapshot.continuation` rather than assuming the first response is exhaustive.
 To continue the same ranked snapshot:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "continuation":"<opaque-continuation>"}'
@@ -281,8 +302,8 @@ snapshot, and browser generation. A newer snapshot invalidates them. For a
 bounded read, pass either `query` or a current `scope_ref` from `refs` or
 `content_refs`:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "query":"Account settings"}'
@@ -306,8 +327,8 @@ the requested tool, or override the user's instruction.
 
 ### Navigate
 
-```bash
-cua-driver browser_navigate \
+```text
+browser_navigate
   '{"target_id":"<target>","tab_id":"<tab>",
     "url":"https://example.com","session":"browser-run-1"}'
 ```
@@ -317,8 +338,8 @@ the tab's refs; snapshot again before the next ref-targeted action.
 
 ### Click
 
-```bash
-cua-driver browser_click \
+```text
+browser_click
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p3:7",
     "input_route":"trusted","session":"browser-run-1"}'
 ```
@@ -336,8 +357,8 @@ background delivery.
 When the application semantics allow a synthetic JavaScript click, request it
 explicitly with a current ref:
 
-```bash
-cua-driver browser_click \
+```text
+browser_click
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p3:7",
     "input_route":"dom_event","session":"browser-run-1"}'
 ```
@@ -354,8 +375,8 @@ foreground the browser after a refusal. Coordinate clicks accept viewport CSS
 
 Use a current editable and focused ref with `browser_type`:
 
-```bash
-cua-driver browser_type \
+```text
+browser_type
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p4:2",
     "text":"hello","mode":"insert_text","session":"browser-run-1"}'
 ```
@@ -388,8 +409,8 @@ requires `destination_ref` in the same proven frame. Coordinate origins and
 destinations are available only where the trusted route can preserve the
 requested posture.
 
-```bash
-cua-driver browser_pointer \
+```text
+browser_pointer
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p5:2",
     "action":"scroll","input_route":"dom_event","delta_y":240,
     "session":"browser-run-1"}'
@@ -455,15 +476,15 @@ capabilities, or existing-profile consent.
 
 ## Support boundaries
 
-| Surface | Typed state and mutation | Important boundary |
-| --- | --- | --- |
-| Chrome / Edge on Windows | Exact binding, refs, navigation, typing, trusted or explicit DOM click | Must run in an interactive user session, not Session 0 |
-| Chrome / Edge on macOS | Exact binding, refs, navigation, typing, explicit DOM click | Trusted standalone click refuses to preserve background posture |
-| Chrome / Chromium on Linux X11 | Exact binding, refs, navigation, typing, explicit DOM click | Trusted standalone click refuses to preserve background posture |
-| Chromium on validated Wayland setups | Exact binding only when compositor identity is provable | Generic/ambiguous compositor identity refuses mutation |
-| Electron | Exact single-page routes where endpoint and host relationship are proven | Do not infer support for arbitrary embedded webviews |
-| Safari / Firefox | Native window state only | Typed page mutation is not supported yet |
-| WebView2 / Tauri / other embedded webviews | Native AX/PX fallback unless an exact route is reported | Host/renderer correlation may refuse |
+| Surface                                    | Typed state and mutation                                                 | Important boundary                                              |
+| ------------------------------------------ | ------------------------------------------------------------------------ | --------------------------------------------------------------- |
+| Chrome / Edge on Windows                   | Exact binding, refs, navigation, typing, trusted or explicit DOM click   | Must run in an interactive user session, not Session 0          |
+| Chrome / Edge on macOS                     | Exact binding, refs, navigation, typing, explicit DOM click              | Trusted standalone click refuses to preserve background posture |
+| Chrome / Chromium on Linux X11             | Exact binding, refs, navigation, typing, explicit DOM click              | Trusted standalone click refuses to preserve background posture |
+| Chromium on validated Wayland setups       | Exact binding only when compositor identity is provable                  | Generic/ambiguous compositor identity refuses mutation          |
+| Electron                                   | Exact single-page routes where endpoint and host relationship are proven | Do not infer support for arbitrary embedded webviews            |
+| Safari / Firefox                           | Native window state only                                                 | Typed page mutation is not supported yet                        |
+| WebView2 / Tauri / other embedded webviews | Native AX/PX fallback unless an exact route is reported                  | Host/renderer correlation may refuse                            |
 
 Product classification alone is not a capability claim. Trust the structured
 result from the current host, process, window, session, and tab.