@cyberstrike-io/cyberstrike 1.1.16-beta.2 → 1.1.16-beta.4

package/hackbrowser-worker.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -19343,7 +19325,7 @@ var require_tracestate_impl = __commonJS((exports) => {
           const value = listMember.slice(i2 + 1, part.length);
           if ((0, tracestate_validators_1.validateKey)(key) && (0, tracestate_validators_1.validateValue)(value)) {
             agg.set(key, value);
-          }
+          } else {}
         }
         return agg;
       }, new Map);
@@ -30852,7 +30834,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                }
+                } else {}
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -87530,7 +87512,7 @@ function finalize(ctx, schema) {
     result.$schema = "http://json-schema.org/draft-07/schema#";
   } else if (ctx.target === "draft-04") {
     result.$schema = "http://json-schema.org/draft-04/schema#";
-  } else if (ctx.target === "openapi-3.0") {}
+  } else if (ctx.target === "openapi-3.0") {} else {}
   if (ctx.external?.uri) {
     const id = ctx.external.registry.get(schema)?.id;
     if (!id)
@@ -87777,7 +87759,7 @@ var literalProcessor = (schema, ctx, json2, _params) => {
     if (val === undefined) {
       if (ctx.unrepresentable === "throw") {
         throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-      }
+      } else {}
     } else if (typeof val === "bigint") {
       if (ctx.unrepresentable === "throw") {
         throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -115538,6 +115520,9 @@ A JSON snapshot with:
 - url: current page URL
 - viewportCenterBlocked: true if an overlay/modal/sidebar is open
 - elements: interactive elements with id, role, label, type, value, placeholder, href, options
+  - occludedBy: present when this element is physically covered by an overlay and
+    cannot be clicked until that overlay is cleared. The value is the overlay's
+    visible text (which usually includes its own dismiss control's label).
 - outOfScope (optional): array of labels the user has excluded — never plan tasks matching these
 - pendingMutations (optional): mutation keywords awaiting a triggering task.
   If a task you plan would trigger one of these, set \`triggersMutation\` on that
@@ -115639,6 +115624,25 @@ Also include:
 - Product/item cards — include max 2-3 (the API pattern repeats)
 - CRUD buttons (Edit, Delete, View, Export, etc.) — one per action type is enough
 
+### Modal/dialog you opened to fill (viewportCenterBlocked + form fields)
+When viewportCenterBlocked is true because a MODAL/DIALOG containing form fields is
+open (you likely just opened it via a "+ Add" / "New" / "Create" / "Edit" button),
+that modal IS the content to explore: FILL its fields and SUBMIT via its primary
+action button (e.g. Kaydet / Save / Submit / Create). Do NOT plan a click on its
+close / X / Cancel control — closing it discards the form before it is submitted.
+Only dismiss a centered overlay that has NO form to complete (a banner, tour, cookie
+or notification notice covering the content behind it).
+
+### Occluded elements (occludedBy present)
+An element with an \`occludedBy\` field is physically covered by an overlay and
+cannot be clicked until that overlay is cleared. \`occludedBy\` is the overlay's
+visible text. BEFORE planning any task on an occluded element, plan a click that
+dismisses the overlay FIRST (make it the first task). Identify the dismiss control
+among the listed elements using the \`occludedBy\` text, and choose the LEAST-COMMITTAL
+option — one that closes or postpones without granting permissions, subscribing,
+accepting terms, or changing account state. If no such dismiss control is present,
+simply omit the occluded element (do not invent a control, do not click a destructive one).
+
 ### Skip these (do NOT include as tasks):
 - Language / locale selectors (labels: "EN", "English", "DE", "🌐")
 - Logout / sign-out / delete account (system handles logout separately)
@@ -115830,8 +115834,11 @@ async function planPage(snapshot, model, usageAcc) {
       model,
       system: systemPrompt,
       messages: [{ role: "user", content: userMessage }],
-      maxOutputTokens: 2048,
-      temperature: 0
+      maxOutputTokens: 16384,
+      temperature: 0,
+      providerOptions: {
+        openai: { reasoningEffort: "low" }
+      }
     });
     if (usageAcc) {
       usageAcc.inputTokens += result.usage.inputTokens ?? 0;
@@ -115884,8 +115891,11 @@ async function planUnexploredElements(snapshot, unexploredLabels, model, usageAc
       model,
       system: systemPrompt,
       messages: [{ role: "user", content: userMessage }],
-      maxOutputTokens: 2048,
-      temperature: 0
+      maxOutputTokens: 16384,
+      temperature: 0,
+      providerOptions: {
+        openai: { reasoningEffort: "low" }
+      }
     });
     if (usageAcc) {
       usageAcc.inputTokens += result.usage.inputTokens ?? 0;
@@ -116123,12 +116133,20 @@ function elementToPrompt(el) {
   }
   return result;
 }
-function buildPlannerSnapshot(url3, elements, globalState, credId, viewportCenterBlocked) {
+function buildPlannerSnapshot(url3, elements, globalState, credId, viewportCenterBlocked, occlusions) {
+  const promptElements = elements.map(elementToPrompt);
+  if (occlusions && occlusions.length > 0) {
+    for (const occ of occlusions) {
+      const match = promptElements.find((e2) => e2.label === occ.label && e2.role === occ.role);
+      if (match)
+        match.occludedBy = occ.occluderText;
+    }
+  }
   const snapshot = {
     url: url3,
     viewportCenterBlocked,
     totalPagesVisited: globalState.visitedPages.size,
-    elements: elements.map(elementToPrompt)
+    elements: promptElements
   };
   if (globalState.outOfScope.length > 0) {
     snapshot.outOfScope = [...globalState.outOfScope];
@@ -116299,7 +116317,7 @@ async function collectInteractiveElements(page) {
         return true;
       return /^(mui-\d|radix-|headlessui-|react-aria-|rc-_?\d|ember\d)/i.test(id);
     }
-    function buildCSSSelector(el) {
+    function buildCSSSelectorCandidate(el) {
       const tag = el.tagName.toLowerCase();
       const id = el.getAttribute("id");
       if (id && !isEphemeralId(id))
@@ -116347,6 +116365,35 @@ async function collectInteractiveElements(page) {
       }
       return tag;
     }
+    function uniquePositionalPath(el) {
+      const segs = [];
+      let cur = el;
+      while (cur && cur !== document.documentElement) {
+        const tag = cur.tagName.toLowerCase();
+        const id = cur.getAttribute("id");
+        if (id && !isEphemeralId(id)) {
+          segs.unshift(`${tag}#${CSS.escape(id)}`);
+          break;
+        }
+        const parent = cur.parentElement;
+        if (!parent) {
+          segs.unshift(tag);
+          break;
+        }
+        const sameTag = Array.from(parent.children).filter((c) => c.tagName === cur.tagName);
+        segs.unshift(sameTag.length > 1 ? `${tag}:nth-of-type(${sameTag.indexOf(cur) + 1})` : tag);
+        cur = parent;
+      }
+      return segs.join(" > ");
+    }
+    function buildCSSSelector(el) {
+      const candidate = buildCSSSelectorCandidate(el);
+      try {
+        if (document.querySelectorAll(candidate).length === 1)
+          return candidate;
+      } catch {}
+      return uniquePositionalPath(el);
+    }
     const INTERACTIVE_SELECTORS = [
       "button",
       "a[href]",
@@ -116422,7 +116469,12 @@ async function collectInteractiveElements(page) {
       const label = getLabel(el);
       const tag = el.tagName.toLowerCase();
       const type = el.type?.toLowerCase() || "";
-      const href = el.href || "";
+      const rawHref = (el.getAttribute("href") || "").trim();
+      const navigates = !!rawHref && rawHref !== "#" && !rawHref.startsWith("#") && !rawHref.startsWith("javascript:");
+      const href = navigates ? el.href || "" : "";
+      const nonNavAnchor = tag === "a" && !navigates;
+      if (nonNavAnchor)
+        role = "button";
       const isSlider = role === "slider";
       const value = isSlider ? el.getAttribute("aria-valuenow") ?? el.value ?? "" : el.value || "";
       const placeholder = el.placeholder || "";
@@ -116438,7 +116490,8 @@ async function collectInteractiveElements(page) {
       const disambiguatedLabel = count > 1 ? `${label} (${count})` : label;
       const ariaLabelRaw = (el.getAttribute("aria-label") || "").trim();
       const safeAriaLabel = ariaLabelRaw.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-      const selectorRole = syntheticRole || count > 1 ? "" : safeAriaLabel ? `role=${role}[name="${safeAriaLabel}"]` : `role=${role}`;
+      const isFileInput = el.matches("input[type=file]");
+      const selectorRole = syntheticRole || count > 1 || isFileInput || nonNavAnchor ? "" : safeAriaLabel ? `role=${role}[name="${safeAriaLabel}"]` : `role=${role}`;
       const selectorCSS = buildCSSSelector(el);
       const inChrome = !!el.closest("nav, header, footer, aside, [role=navigation], [role=banner], [role=contentinfo], [role=complementary]");
       const roleCount = (seenRoleSelectors.get(selectorRole) ?? 0) + 1;
@@ -116573,8 +116626,17 @@ function assignIds(browserElements, startId) {
 }
 async function collectElements(page) {
   const browserElements = await collectInteractiveElements(page);
-  const sampled = sampleTemplates(browserElements);
-  return assignIds(sampled, 1).slice(0, MAX_ELEMENTS);
+  const sampled = capElements(sampleTemplates(browserElements));
+  return assignIds(sampled, 1);
+}
+var ACTION_ROLES_CAP = new Set(["button", "link", "menuitem", "tab"]);
+function capElements(els) {
+  if (els.length <= MAX_ELEMENTS)
+    return els;
+  const actions = els.filter((e2) => ACTION_ROLES_CAP.has(e2.role));
+  const rest = els.filter((e2) => !ACTION_ROLES_CAP.has(e2.role));
+  const kept = new Set([...actions, ...rest].slice(0, MAX_ELEMENTS));
+  return els.filter((e2) => kept.has(e2));
 }
 function sampleTemplates(elements) {
   const clusterCount = new Map;
@@ -116703,6 +116765,48 @@ function evalIsViewportCenterBlocked(page) {
     return false;
   });
 }
+async function probeClickPoint(page, selector) {
+  try {
+    return await page.evaluate((sel) => {
+      const el = document.querySelector(sel);
+      if (!el)
+        return { status: "clickable" };
+      const r2 = el.getBoundingClientRect();
+      if (r2.width === 0 || r2.height === 0)
+        return { status: "clickable" };
+      const cx = r2.left + r2.width / 2;
+      const cy = r2.top + r2.height / 2;
+      if (cx < 0 || cy < 0 || cx > window.innerWidth || cy > window.innerHeight) {
+        return { status: "offscreen" };
+      }
+      const top = document.elementFromPoint(cx, cy);
+      if (!top)
+        return { status: "offscreen" };
+      if (top === el || el.contains(top) || top.contains(el))
+        return { status: "clickable" };
+      if (top.tagName === "IFRAME")
+        return { status: "clickable" };
+      let node = el;
+      while (node) {
+        const root = node.getRootNode();
+        if (root instanceof ShadowRoot) {
+          const host = root.host;
+          if (host === top || top.contains(host))
+            return { status: "clickable" };
+          node = host;
+        } else
+          break;
+      }
+      const text2 = (top.innerText || top.getAttribute("aria-label") || "").trim().replace(/\s+/g, " ").slice(0, 80);
+      return {
+        status: "occluded",
+        occluder: { tag: top.tagName.toLowerCase(), role: top.getAttribute("role") || "", text: text2 }
+      };
+    }, selector);
+  } catch {
+    return { status: "clickable" };
+  }
+}
 function filterVisitedLinks(elements, currentUrl, visitedPages) {
   let currentPath;
   try {
@@ -116728,6 +116832,59 @@ function filterVisitedLinks(elements, currentUrl, visitedPages) {
   });
 }
 
+// ../hackbrowser/src/upload-samples.ts
+var nodeBuffer = globalThis.Buffer;
+var b64 = (s2) => nodeBuffer.from(s2, "base64");
+var txt = (s2) => nodeBuffer.from(s2, "utf8");
+var SAMPLES = [
+  {
+    name: "sample.png",
+    ext: "png",
+    mimeType: "image/png",
+    buffer: b64("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGJgAQAAAAUAAaX2RUAAAAAASUVORK5CYII=")
+  },
+  {
+    name: "sample.jpg",
+    ext: "jpg",
+    mimeType: "image/jpeg",
+    buffer: b64("/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAAA//EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEAAD8AfwD/2Q==")
+  },
+  {
+    name: "sample.pdf",
+    ext: "pdf",
+    mimeType: "application/pdf",
+    buffer: b64("JVBERi0xLjQKMSAwIG9iajw8L1R5cGUvQ2F0YWxvZy9QYWdlcyAyIDAgUj4+ZW5kb2JqCjIgMCBvYmo8PC9UeXBlL1BhZ2VzL0tpZHNbMyAwIFJdL0NvdW50IDE+PmVuZG9iagozIDAgb2JqPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9NZWRpYUJveFswIDAgMjAwIDIwMF0+PmVuZG9iagp0cmFpbGVyPDwvUm9vdCAxIDAgUj4+CiUlRU9GCg==")
+  },
+  { name: "sample.csv", ext: "csv", mimeType: "text/csv", buffer: txt(`name,email
+Test User,test@example.com
+`) },
+  { name: "sample.txt", ext: "txt", mimeType: "text/plain", buffer: txt(`sample text file
+`) },
+  { name: "sample.json", ext: "json", mimeType: "application/json", buffer: txt(`{"sample":true,"value":123}
+`) }
+];
+var DEFAULT_SAMPLE = SAMPLES[0];
+function tokenMatches(sample, token) {
+  const t2 = token.trim().toLowerCase();
+  if (!t2)
+    return false;
+  if (t2.startsWith("."))
+    return t2.slice(1) === sample.ext;
+  if (t2.endsWith("/*"))
+    return sample.mimeType.startsWith(t2.slice(0, -1));
+  return t2 === sample.mimeType;
+}
+function pickSample(accept) {
+  if (!accept || !accept.trim())
+    return DEFAULT_SAMPLE;
+  const tokens = accept.split(",");
+  for (const sample of SAMPLES) {
+    if (tokens.some((tok) => tokenMatches(sample, tok)))
+      return sample;
+  }
+  return DEFAULT_SAMPLE;
+}
+
 // ../hackbrowser/src/executor.ts
 var log6 = Log.create({ service: "hackbrowser:executor" });
 var CLICK_TIMEOUT = 2000;
@@ -116773,6 +116930,9 @@ async function executeFill(page, element, value) {
   if (element.role === "slider" || element.type === "range") {
     return executeSliderFill(page, selector || "role=slider", value);
   }
+  if (element.type === "file") {
+    return executeFileSelect(page, selector);
+  }
   const fillErr = await page.fill(selector, value, { timeout: FILL_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]);
   if (!fillErr)
@@ -116784,6 +116944,18 @@ async function executeFill(page, element, value) {
   log6.warn("fill failed", { selector, error: fillErr });
   return fillErr;
 }
+async function executeFileSelect(page, selector) {
+  const accept = await page.getAttribute(selector, "accept").catch(() => null);
+  const sample = pickSample(accept);
+  const err = await page.setInputFiles(selector, { name: sample.name, mimeType: sample.mimeType, buffer: sample.buffer }, { timeout: FILL_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
+`)[0]);
+  if (err) {
+    log6.warn("file select failed", { selector, accept, error: err });
+    return err;
+  }
+  log6.info("file selected", { selector, file: sample.name });
+  return;
+}
 async function executeSliderFill(page, selector, value) {
   const numericValue = parseInt(value);
   if (isNaN(numericValue) || numericValue <= 0) {
@@ -127843,7 +128015,8 @@ function normalizeScope(input) {
   s2 = s2.replace(/^https?:\/\//, "");
   s2 = s2.split(/[/?#]/)[0] ?? "";
   s2 = s2.replace(/:\d+$/, "");
-  s2 = s2.replace(/\.+$/, "");
+  while (s2.endsWith("."))
+    s2 = s2.slice(0, -1);
   return s2;
 }
 function deriveScope(targetUrl) {
@@ -127872,8 +128045,10 @@ var log7 = Log.create({ service: "hackbrowser:agent" });
 var MAX_STEPS_PER_PAGE = 30;
 var MAX_UNPLANNED_ITERATIONS = 2;
 var OVERLAY_ESCAPE_WAIT = 400;
+var OVERLAY_CLEAR_WAIT = 800;
 var SPA_RENDER_RETRY_WAIT = 600;
 var POST_GOTO_WAIT = 400;
+var MAX_INLINE_DEPTH = 2;
 var LOGIN_SUCCESS_PATTERN = /POST\s+.*\/(login|signin|authenticate)\S*\s+\[200\]/i;
 function triggerReDiscovery(globalState) {
   if (globalState.authPhase === "authenticated")
@@ -128036,6 +128211,15 @@ function attachDialogAutoAccept(page) {
     dialog.accept().catch(() => {});
   });
 }
+function attachFileChooserAutoFill(page) {
+  page.on("filechooser", async (chooser) => {
+    try {
+      const accept = await chooser.element().getAttribute("accept").catch(() => null);
+      const sample = pickSample(accept);
+      await chooser.setFiles({ name: sample.name, mimeType: sample.mimeType, buffer: sample.buffer });
+    } catch {}
+  });
+}
 function setupRequestInterceptor(page, inScope, onCapture, credentialId = SINGLE_CRED) {
   let pendingUIContext = null;
   let pendingTrigger = null;
@@ -128185,9 +128369,10 @@ function getPathPatternKey(url3) {
     return null;
   }
 }
-async function explorePageWithAI(page, pageUrl, interceptor, model, globalState, inScope, credentialId, maxPages, usageAcc) {
+async function explorePageWithAI(page, pageUrl, interceptor, model, globalState, inScope, credentialId, maxPages, usageAcc, nav = { explore: async () => {}, depth: MAX_INLINE_DEPTH }) {
   const linksToEnqueue = [];
   const semanticActionsDone = new Set;
+  const occ = { pending: [], signaled: new Set };
   csEmit(page, {
     type: "page-change",
     url: pageUrl,
@@ -128246,9 +128431,9 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       remaining: taskQueue.length
     });
     if (task.type === "form") {
-      await executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope);
+      await executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav);
     } else {
-      await executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope);
+      await executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav);
     }
     const postActionElements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
     if (task.type === "click" && task.role === "combobox") {
@@ -128259,9 +128444,10 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
     }
     const hasNewElements = discoverNewElements(postActionElements, seenKeys);
     const hasStaleTargets = queueHasStaleTargets(taskQueue, postActionElements);
-    if (hasNewElements || hasStaleTargets) {
+    if (hasNewElements || hasStaleTargets || occ.pending.length > 0) {
       const freshElements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
-      const snapshot2 = buildPlannerSnapshot(pageUrl, freshElements, globalState, credentialId, await isViewportCenterBlocked(page));
+      const snapshot2 = buildPlannerSnapshot(pageUrl, freshElements, globalState, credentialId, await isViewportCenterBlocked(page), occ.pending);
+      occ.pending = [];
       csEmit(page, {
         type: "llm-thinking",
         reason: "replan",
@@ -128367,9 +128553,9 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
         remaining: additionalQueue.length
       });
       if (task.type === "form") {
-        await executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope);
+        await executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav);
       } else {
-        await executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope);
+        await executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav);
       }
       const postActionElements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
       if (task.type === "click" && task.role === "combobox") {
@@ -128379,9 +128565,10 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       }
       const hasNewElements = discoverNewElements(postActionElements, seenKeys);
       const hasStaleTargets = queueHasStaleTargets(additionalQueue, postActionElements);
-      if (hasNewElements || hasStaleTargets) {
+      if (hasNewElements || hasStaleTargets || occ.pending.length > 0) {
         const freshElements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
-        const freshSnap = buildPlannerSnapshot(pageUrl, freshElements, globalState, credentialId, await isViewportCenterBlocked(page));
+        const freshSnap = buildPlannerSnapshot(pageUrl, freshElements, globalState, credentialId, await isViewportCenterBlocked(page), occ.pending);
+        occ.pending = [];
         csEmit(page, {
           type: "llm-thinking",
           reason: "replan",
@@ -128431,7 +128618,45 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
   }
   return linksToEnqueue;
 }
-async function executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope) {
+async function recoverFromOcclusion(page, el, original, retry) {
+  if (original.success)
+    return original;
+  if ((await probeClickPoint(page, el.selector)).status !== "occluded")
+    return original;
+  log7.debug("click occluded — clearing overlay + waiting, then retrying once", { label: el.label });
+  await closeOverlay(page);
+  await page.waitForTimeout(OVERLAY_CLEAR_WAIT);
+  return retry();
+}
+async function diagnoseOcclusion(page, el, occ) {
+  const probe = await probeClickPoint(page, el.selector);
+  if (probe.status === "occluded" && !occ.signaled.has(probe.occluder.text)) {
+    occ.signaled.add(probe.occluder.text);
+    occ.pending.push({ label: el.label, role: el.role, occluderText: probe.occluder.text });
+    log7.debug("action target occluded — signalling planner to dismiss overlay first", {
+      label: el.label,
+      occluder: probe.occluder.text
+    });
+    return true;
+  }
+  return false;
+}
+async function handleNavigation(page, parentUrl, linksToEnqueue, inScope, globalState, nav) {
+  const cur = page.url();
+  const curNorm = normalizeUrl(cur);
+  if (curNorm !== normalizeUrl(parentUrl) && isInScope(cur, inScope)) {
+    if (!globalState.visitedPages.has(curNorm) && nav.depth < MAX_INLINE_DEPTH) {
+      globalState.visitedPages.add(curNorm);
+      await nav.explore(page, cur, nav.depth + 1);
+    } else {
+      linksToEnqueue.push(cur);
+    }
+  }
+  await page.goto(parentUrl, { waitUntil: "domcontentloaded", timeout: 15000 }).catch(() => {});
+  await page.waitForTimeout(POST_GOTO_WAIT);
+  await page.waitForLoadState("domcontentloaded", { timeout: 5000 }).catch(() => {});
+}
+async function executeFormTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav) {
   for (const field of task.fields) {
     let el = resolveElement(elements, field.role, field.label);
     if (!el) {
@@ -128483,23 +128708,19 @@ async function executeFormTask(task, page, elements, interceptor, semanticAction
     targetSelector: submitEl.selector,
     credential: credentialId
   });
-  const result = await execute(page, submitEl, "click", undefined, interceptor.setPendingUI, elements.length);
+  let result = await execute(page, submitEl, "click", undefined, interceptor.setPendingUI, elements.length);
+  result = await recoverFromOcclusion(page, submitEl, result, () => execute(page, submitEl, "click", undefined, interceptor.setPendingUI, elements.length));
+  const occluded = !result.success && await diagnoseOcclusion(page, submitEl, occ);
   interceptor.clearPendingTrigger();
   trackResult(result, interceptor, globalState, credentialId, task.triggersMutation, page);
   csEmit(page, { type: "action-end", ok: result.success, credential: credentialId });
-  semanticActionsDone.add(submitKey);
+  if (!occluded)
+    semanticActionsDone.add(submitKey);
   globalState.totalSteps++;
-  if (result.navigated) {
-    const cur = page.url();
-    if (cur !== pageUrl && isInScope(cur, inScope))
-      linksToEnqueue.push(cur);
-    log7.debug("reloading after form submit", { pageUrl });
-    await page.goto(pageUrl, { waitUntil: "domcontentloaded", timeout: 15000 }).catch(() => {});
-    await page.waitForTimeout(POST_GOTO_WAIT);
-    await page.waitForLoadState("domcontentloaded", { timeout: 5000 }).catch(() => {});
-  }
+  if (result.navigated)
+    await handleNavigation(page, pageUrl, linksToEnqueue, inScope, globalState, nav);
 }
-async function executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope) {
+async function executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav) {
   const el = resolveElement(elements, task.role, task.label);
   if (!el) {
     log7.debug("click target not found", { role: task.role, label: task.label });
@@ -128518,15 +128739,13 @@ async function executeClickTask(task, page, elements, interceptor, semanticActio
     credential: credentialId
   });
   let result = await execute(page, el, "click", undefined, interceptor.setPendingUI, elements.length);
-  if (!result.success && await isViewportCenterBlocked(page)) {
-    log7.debug("click blocked by a stray overlay — closing it and retrying once", { label: el.label });
-    await closeOverlay(page);
-    result = await execute(page, el, "click", undefined, interceptor.setPendingUI, elements.length);
-  }
+  result = await recoverFromOcclusion(page, el, result, () => execute(page, el, "click", undefined, interceptor.setPendingUI, elements.length));
+  const occluded = !result.success && await diagnoseOcclusion(page, el, occ);
   interceptor.clearPendingTrigger();
   trackResult(result, interceptor, globalState, credentialId, task.triggersMutation, page);
   csEmit(page, { type: "action-end", ok: result.success, credential: credentialId });
-  semanticActionsDone.add(key);
+  if (!occluded)
+    semanticActionsDone.add(key);
   globalState.totalSteps++;
   if (el.role === "option") {
     const parentCombobox = elements.find((e2) => e2.role === "combobox");
@@ -128535,12 +128754,7 @@ async function executeClickTask(task, page, elements, interceptor, semanticActio
     }
   }
   if (result.navigated) {
-    const cur = page.url();
-    if (cur !== pageUrl && isInScope(cur, inScope))
-      linksToEnqueue.push(cur);
-    await page.goto(pageUrl, { waitUntil: "domcontentloaded", timeout: 15000 }).catch(() => {});
-    await page.waitForTimeout(POST_GOTO_WAIT);
-    await page.waitForLoadState("domcontentloaded", { timeout: 5000 }).catch(() => {});
+    await handleNavigation(page, pageUrl, linksToEnqueue, inScope, globalState, nav);
     return;
   }
   if (el.role === "combobox")
@@ -128870,6 +129084,7 @@ async function runMultiCredential(config3, credentials) {
       await browserContext.addInitScript(PANEL_INIT_SCRIPT);
     const page = await browserContext.newPage();
     attachDialogAutoAccept(page);
+    attachFileChooserAutoFill(page);
     await page.goto(targetUrl, { waitUntil: "domcontentloaded", timeout: 30000 });
     csEmit(page, {
       type: "init",
@@ -128975,11 +129190,14 @@ async function runMultiCredential(config3, credentials) {
           });
           continue;
         }
-        log7.info("redirect to different page, will explore actual URL", {
+        const landed = normalizeUrl(r2.ctx.page.url());
+        log7.info("redirect to different page, enqueueing landed URL", {
           credential: r2.ctx.id,
           intended: entry.url,
-          actual: r2.ctx.page.url()
+          landed
         });
+        enqueueWithContext(landed, r2.ctx.id, pageQueue, visitedPages, inScope, pathPatternCounts);
+        continue;
       }
       visitableContexts.push(r2.ctx);
     }
@@ -129022,7 +129240,12 @@ async function runMultiCredential(config3, credentials) {
     }
     for (const ctx of visitableContexts) {
       log7.info("exploring", { credential: ctx.id, url: entry.url });
-      const discovered = await explorePageWithAI(ctx.page, entry.url, ctx.interceptor, model, globalState, inScope, ctx.id, maxPages, usageAcc);
+      const exploreInline = async (p, url3, depth) => {
+        const found = await explorePageWithAI(p, url3, ctx.interceptor, model, globalState, inScope, ctx.id, maxPages, usageAcc, { explore: exploreInline, depth });
+        for (const u of found)
+          enqueueWithContext(u, ctx.id, pageQueue, visitedPages, inScope, pathPatternCounts);
+      };
+      const discovered = await explorePageWithAI(ctx.page, entry.url, ctx.interceptor, model, globalState, inScope, ctx.id, maxPages, usageAcc, { explore: exploreInline, depth: 0 });
       for (const url3 of discovered) {
         enqueueWithContext(url3, ctx.id, pageQueue, visitedPages, inScope, pathPatternCounts);
       }
@@ -129115,6 +129338,7 @@ async function run(config3) {
     await context.addInitScript(PANEL_INIT_SCRIPT);
   const page = await context.newPage();
   attachDialogAutoAccept(page);
+  attachFileChooserAutoFill(page);
   if (config3.auth.sessionFile) {
     await loadSession(context, config3.auth.sessionFile);
   }
@@ -129207,6 +129431,10 @@ async function run(config3) {
       continue;
     }
     const currentUrl = normalizeUrl(page.url());
+    if (currentUrl !== normalizeUrl(nextUrl) && globalState.visitedPages.has(currentUrl)) {
+      log7.info("redirect to already-explored page, skipping", { requested: normalizeUrl(nextUrl), landed: currentUrl });
+      continue;
+    }
     globalState.visitedPages.add(currentUrl);
     log7.info("exploring page", { page: `${pagesExplored}/${maxPages}`, url: currentUrl });
     log7.debug("state", {
@@ -129258,7 +129486,12 @@ async function run(config3) {
       }
       log7.info("page changed after auth, re-exploring", { url: currentUrl });
     }
-    const discovered = await explorePageWithAI(page, currentUrl, interceptor, model, globalState, inScope, SINGLE_CRED, maxPages, usageAcc);
+    const exploreInline = async (p, url3, depth) => {
+      const found = await explorePageWithAI(p, url3, interceptor, model, globalState, inScope, SINGLE_CRED, maxPages, usageAcc, { explore: exploreInline, depth });
+      for (const u of found)
+        enqueueUrl(u, globalState, inScope);
+    };
+    const discovered = await explorePageWithAI(page, currentUrl, interceptor, model, globalState, inScope, SINGLE_CRED, maxPages, usageAcc, { explore: exploreInline, depth: 0 });
     let newEnqueued = 0;
     for (const url3 of discovered) {
       if (enqueueUrl(url3, globalState, inScope))