@effect-agent/platform-cloudflare 0.1.0-beta.120 → 0.1.0-beta.121

package/dist/{ThreadObject-9IVibJM7.d.mts → ThreadObject-mt0uxvZZ.d.mts}

@@ -705,20 +705,17 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
 } | {
   readonly _tag: "AdminFailed";
   readonly failure: {
-    readonly _tag: "ThreadNotMaterialized";
-    readonly threadId: string;
-  } | {
-    readonly _tag: "ThreadStoreError";
+    readonly _tag: "DurableAlarmError";
     readonly operation: string;
     readonly message: string;
     readonly cause?: Schema.Json | undefined;
-    readonly diagnostic?: {
-      readonly causeTag: string;
-      readonly operation: string;
-      readonly decoder?: string | undefined;
-      readonly issueTag?: string | undefined;
-      readonly sequence?: number | undefined;
-    } | undefined;
+  } | {
+    readonly _tag: "HostProtocolError";
+    readonly message: string;
+  } | {
+    readonly _tag: "DigestError";
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "AdmissionPolicyError";
     readonly reason: "occupied" | "refused" | "unavailable";
@@ -734,6 +731,21 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly operation: string;
     readonly message: string;
     readonly cause?: import("effect-agent/failure-diagnostic").Diagnostic | undefined;
+  } | {
+    readonly _tag: "ThreadStoreError";
+    readonly operation: string;
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+    readonly diagnostic?: {
+      readonly causeTag: string;
+      readonly operation: string;
+      readonly decoder?: string | undefined;
+      readonly issueTag?: string | undefined;
+      readonly sequence?: number | undefined;
+    } | undefined;
+  } | {
+    readonly _tag: "ThreadNotMaterialized";
+    readonly threadId: string;
   } | {
     readonly _tag: "AppendConflict";
     readonly threadId: string;
@@ -746,30 +758,18 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly threadId: string;
     readonly actualEpoch: number;
     readonly attemptedEpoch: number;
-  } | {
-    readonly _tag: "DurableAlarmError";
-    readonly operation: string;
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "HostProtocolError";
-    readonly message: string;
-  } | {
-    readonly _tag: "DigestError";
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "DurableRuntimeFailpointError";
     readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "checkpoint:after-save" | "checkpoint:before-save" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-duration-append" | "run:after-start-append" | "run:before-duration-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "subagent:before-join-append" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:after-unavailable-append" | "tools:before-prepared-append" | "tools:before-unavailable-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append" | "update:after-canonical-append" | "update:after-delivery-insert" | "update:before-canonical-append" | "update:before-delivery-insert" | "worker:after-completion-append" | "worker:after-origin-append" | "worker:after-report-append" | "worker:after-report-delivery" | "worker:after-source-append" | "worker:after-stop-append" | "worker:after-stop-seal" | "worker:after-subtree-append" | "worker:before-completion-append" | "worker:before-origin-append" | "worker:before-report-append" | "worker:before-report-delivery" | "worker:before-source-append" | "worker:before-stop-append" | "worker:before-stop-seal" | "worker:before-subtree-append";
-  } | {
-    readonly _tag: "ApprovalSuspensionError";
-    readonly cause: Schema.Json;
   } | {
     readonly _tag: "OperationDenied";
     readonly operation: "abort" | "awaitSettlement" | "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
     readonly reason: string;
     readonly threadId?: string | undefined;
     readonly submissionId?: string | undefined;
+  } | {
+    readonly _tag: "ApprovalSuspensionError";
+    readonly cause: Schema.Json;
   } | {
     readonly _tag: "RetryRefused";
     readonly submissionId: string;
@@ -836,4 +836,4 @@ interface Class<EventServices = never> {
 declare const make: <ApplicationServices, ApplicationError, EventServices = never, EventLayerError = never>(applicationLayer: Layer.Layer<CloudflareDurableRuntimeServices | ApplicationServices, ApplicationError, CloudflareBootstrapServices | DurableObjectState$1.DurableObjectState | WorkerEnvironment | DurableObjectContext | ThreadObjectNamespace>, options: Options<ApplicationServices, EventServices, EventLayerError>) => Class<ApplicationServices | EventServices>;
 //#endregion
 export { ThreadPublicationOptions as A, portCall as C, CloudflareDurableRuntimeOptions as D, CloudflareDurableRuntimeInitializationError as E, layerConfig as M, layerHostConfig as N, CloudflareDurableRuntimeServices as O, layerInHost as P, make as S, CloudflareBootstrapServices as T, decodeAdminVerifyRequest as _, AdminVerifyRequest as a, encodeAdminResponse as b, Instance as c, RetryExecuted as d, ThreadObject_d_exports as f, decodeAdminResponse as g, decodeAdminExplainRequest as h, AdminResponse as i, layer as j, ThreadObjectPorts as k, ObligationsScanned as l, VerifiedIntegrity as m, AdminFailed as n, Class as o, ThreadRpcOperation as p, AdminFailure as r, ExplainedRecovery as s, AdminExplainRequest as t, Options as u, decodeObligationThresholds as v, submit as w, handleRpc as x, decodeRetryCommand as y };
-//# sourceMappingURL=ThreadObject-9IVibJM7.d.mts.map
+//# sourceMappingURL=ThreadObject-mt0uxvZZ.d.mts.map

package/dist/ThreadObject.d.mts

@@ -1,2 +1,2 @@
-import { A as ThreadPublicationOptions, C as portCall, D as CloudflareDurableRuntimeOptions, E as CloudflareDurableRuntimeInitializationError, M as layerConfig, N as layerHostConfig, O as CloudflareDurableRuntimeServices, P as layerInHost, S as make, T as CloudflareBootstrapServices, _ as decodeAdminVerifyRequest, a as AdminVerifyRequest, b as encodeAdminResponse, c as Instance, d as RetryExecuted, g as decodeAdminResponse, h as decodeAdminExplainRequest, i as AdminResponse, j as layer, k as ThreadObjectPorts, l as ObligationsScanned, m as VerifiedIntegrity, n as AdminFailed, o as Class, p as ThreadRpcOperation, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeObligationThresholds, w as submit, x as handleRpc, y as decodeRetryCommand } from "./ThreadObject-9IVibJM7.mjs";
+import { A as ThreadPublicationOptions, C as portCall, D as CloudflareDurableRuntimeOptions, E as CloudflareDurableRuntimeInitializationError, M as layerConfig, N as layerHostConfig, O as CloudflareDurableRuntimeServices, P as layerInHost, S as make, T as CloudflareBootstrapServices, _ as decodeAdminVerifyRequest, a as AdminVerifyRequest, b as encodeAdminResponse, c as Instance, d as RetryExecuted, g as decodeAdminResponse, h as decodeAdminExplainRequest, i as AdminResponse, j as layer, k as ThreadObjectPorts, l as ObligationsScanned, m as VerifiedIntegrity, n as AdminFailed, o as Class, p as ThreadRpcOperation, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeObligationThresholds, w as submit, x as handleRpc, y as decodeRetryCommand } from "./ThreadObject-mt0uxvZZ.mjs";
 export { AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, type CloudflareBootstrapServices as BootstrapServices, Class, ExplainedRecovery, type CloudflareDurableRuntimeInitializationError as InitializationError, Instance, ObligationsScanned, Options, type ThreadPublicationOptions as PublicationOptions, RetryExecuted, type CloudflareDurableRuntimeOptions as RuntimeOptions, type CloudflareDurableRuntimeServices as Services, ThreadObjectPorts, ThreadRpcOperation, VerifiedIntegrity, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeObligationThresholds, decodeRetryCommand, encodeAdminResponse, handleRpc, layer, layerConfig, layerHostConfig, layerInHost, make, portCall, submit };

package/dist/index.d.mts

@@ -8,6 +8,6 @@ import { t as CloudflareMemory_d_exports } from "./CloudflareMemory.mjs";
 import { t as CloudflareScheduling_d_exports } from "./CloudflareScheduling.mjs";
 import { t as CloudflareSubscriptions_d_exports } from "./CloudflareSubscriptions.mjs";
 import { t as CloudflareThreadClient_d_exports } from "./CloudflareThreadClient.mjs";
-import { f as ThreadObject_d_exports } from "./ThreadObject-9IVibJM7.mjs";
+import { f as ThreadObject_d_exports } from "./ThreadObject-mt0uxvZZ.mjs";
 import { t as WakeScheduler_d_exports } from "./WakeScheduler.mjs";
 export { Alarm_d_exports as Alarm, CloudflareAiGateway_d_exports as CloudflareAiGateway, CloudflareBindings_d_exports as CloudflareBindings, CloudflareBrowser_d_exports as CloudflareBrowser, CloudflareCodeMode_d_exports as CloudflareCodeMode, CloudflareConfig_d_exports as CloudflareConfig, CloudflareMemory_d_exports as CloudflareMemory, CloudflareScheduling_d_exports as CloudflareScheduling, CloudflareSubscriptions_d_exports as CloudflareSubscriptions, CloudflareThreadClient_d_exports as CloudflareThreadClient, ThreadObject_d_exports as ThreadObject, WakeScheduler_d_exports as WakeScheduler };

package/package.json

@@ -1 +1 @@
-{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.120","dependencies":{"@effect-agent/storage-cloudflare":"0.1.0-beta.120","@effect/platform-browser":"4.0.0-rc.116","@effect/sql-sqlite-do":"4.0.0-rc.116","effect-agent":"0.1.0-beta.120"},"devDependencies":{"@cloudflare/puppeteer":"1.1.0","@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/testing":"0.1.0-beta.120","@effect/platform-node":"4.0.0-rc.116","@effect/sql-d1":"4.0.0-rc.116","@effect/vitest":"4.0.0-rc.116","effect":"4.0.0-rc.116","effect-cf":"0.44.1","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.2","vitest":"4.1.11"},"peerDependencies":{"@cloudflare/puppeteer":"^1.1.0","effect":"^4.0.0-rc.116","effect-cf":"^0.44.1 || ^0.45.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./browser-rest-capture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./browser-rest-crawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./cloudflare-bindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./cloudflare-browser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./cloudflare-code-mode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./cloudflare-config":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./cloudflare-memory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./cloudflare-scheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./cloudflare-subscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./cloudflare-thread-client":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./interactive-browser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./protected-browser":{"types":"./dist/ProtectedBrowser.d.mts","default":"./dist/ProtectedBrowser.mjs"},"./thread-object":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./wake-scheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"},"./cloudflare-ai-gateway":{"types":"./dist/CloudflareAiGateway.d.mts","default":"./dist/CloudflareAiGateway.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"},"peerDependenciesMeta":{"@cloudflare/puppeteer":{"optional":true}}}
+{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.121","dependencies":{"@effect-agent/storage-cloudflare":"0.1.0-beta.121","@effect/platform-browser":"4.0.0-rc.116","@effect/sql-sqlite-do":"4.0.0-rc.116","effect-agent":"0.1.0-beta.121","puppeteer-core":"24.29.0"},"devDependencies":{"@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/testing":"0.1.0-beta.121","@effect/platform-node":"4.0.0-rc.116","@effect/sql-d1":"4.0.0-rc.116","@effect/vitest":"4.0.0-rc.116","effect":"4.0.0-rc.116","effect-cf":"0.44.1","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.2","vitest":"4.1.11"},"peerDependencies":{"effect":"^4.0.0-rc.116","effect-cf":"^0.44.1 || ^0.45.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./browser-rest-capture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./browser-rest-crawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./cloudflare-bindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./cloudflare-browser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./cloudflare-code-mode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./cloudflare-config":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./cloudflare-memory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./cloudflare-scheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./cloudflare-subscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./cloudflare-thread-client":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./interactive-browser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./protected-browser":{"types":"./dist/ProtectedBrowser.d.mts","default":"./dist/ProtectedBrowser.mjs"},"./thread-object":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./wake-scheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"},"./cloudflare-ai-gateway":{"types":"./dist/CloudflareAiGateway.d.mts","default":"./dist/CloudflareAiGateway.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"}}

package/src/InteractiveBrowser.ts

@@ -1,12 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
 
-import {
-  type Browser,
-  type BrowserContext,
-  type CDPSession,
-  type HTTPRequest,
-  type Page,
-} from "@cloudflare/puppeteer";
 import {
   Cause,
   Context,
@@ -47,6 +40,13 @@ import {
 } from "effect-agent/interactive-browser";
 import { PageScreenshotResult } from "effect-agent/page-screenshot";
 import { SandboxImplementation } from "effect-agent/sandbox";
+import {
+  type Browser,
+  type BrowserContext,
+  type CDPSession,
+  type HTTPRequest,
+  type Page,
+} from "puppeteer-core/lib/esm/puppeteer/puppeteer-core-browser.js";
 
 import { BrowserRunBinding } from "./internal/browser-binding.ts";
 import {
@@ -380,7 +380,10 @@ export class BrowserRunInteractiveBinding extends Context.Service<
   BrowserRunInteractiveBinding,
   {
     readonly acquire: (keepAliveMillis: number) => Promise<unknown>;
-    readonly connect: (sessionId: string) => Promise<BrowserRunInteractiveBrowser>;
+    readonly connect: (
+      sessionId: string,
+      signal?: AbortSignal,
+    ) => Promise<BrowserRunInteractiveBrowser>;
     /** Success proves whole-browser termination or exact-session absence. */
     readonly closeSession: (
       sessionId: Redacted.Redacted<string>,
@@ -406,9 +409,10 @@ export class BrowserRunInteractiveBinding extends Context.Service<
         return {
           acquire: async (keepAliveMillis: number) =>
             binding.acquire(keepAliveMillis, "interactive.acquire"),
-          connect: async (sessionId: string) =>
+          connect: async (sessionId: string, signal?: AbortSignal) =>
             makeProductionBrowser(
-              await binding.connect(sessionId, "interactive.connect"),
+              await binding.connect(sessionId, "interactive.connect", signal),
+              sessionId,
               viewport,
             ),
           closeSession: (sessionId: Redacted.Redacted<string>) =>
@@ -1385,6 +1389,7 @@ const makeProductionContext = (
 
 const makeProductionBrowser = (
   browser: Browser,
+  sessionId: string,
   viewport?: BrowserRunViewport,
 ): BrowserRunInteractiveBrowser => ({
   detach: () => browser.disconnect(),
@@ -1417,7 +1422,7 @@ const makeProductionBrowser = (
       if (!isRemoteClosure(cause)) throw cause;
     }
   },
-  sessionId: () => browser.sessionId(),
+  sessionId: () => sessionId,
   isConnected: () => browser.isConnected(),
   onDisconnected: (listener) => {
     browser.on("disconnected", listener);
@@ -2673,7 +2678,7 @@ const makeHostService = (
                   signal,
                   closeLateAcquisition(
                     signal,
-                    () => binding.connect(sessionIdValue),
+                    () => binding.connect(sessionIdValue, signal),
                     (acquired) =>
                       runCleanup(
                         resume === undefined

package/src/internal/browser-binding.ts

@@ -1,8 +1,11 @@
 /// <reference types="@cloudflare/workers-types" />
-import puppeteer, { type Browser } from "@cloudflare/puppeteer";
 import { Context, Layer, Schema } from "effect";
+import puppeteer, {
+  type Browser,
+  type ConnectionTransport,
+} from "puppeteer-core/lib/esm/puppeteer/puppeteer-core-browser.js";
 
-import { browserFailure, BrowserRunFailure } from "./browser-failure.ts";
+import { browserFailure, BrowserRunFailure, reportedBrowserError } from "./browser-failure.ts";
 
 const Acquired = Schema.Struct({ sessionId: Schema.String.check(Schema.isUUID()) });
 
@@ -14,7 +17,11 @@ export class BrowserRunBinding extends Context.Service<
       keepAliveMillis: number,
       operation: "protected.acquire" | "interactive.acquire",
     ) => Promise<string>;
-    readonly connect: (sessionId: string, operation: string) => Promise<Browser>;
+    readonly connect: (
+      sessionId: string,
+      operation: string,
+      signal?: AbortSignal,
+    ) => Promise<Browser>;
   }
 >()("@effect-agent/platform-cloudflare/internal/BrowserRunBinding") {
   static layer(browser: Pick<BrowserRun, "fetch">) {
@@ -43,38 +50,81 @@ export class BrowserRunBinding extends Context.Service<
 
         return Schema.decodeUnknownSync(Acquired)(await response.json()).sessionId;
       },
-      // The SDK embeds bodies and session IDs in errors; retain status before that loss.
-      connect: async (sessionId, operation) => {
-        let failure: BrowserRunFailure | undefined;
+      connect: async (sessionId, operation, signal) => {
+        let socket: WebSocket | undefined;
+        let closedByAbort = false;
 
         try {
-          return await puppeteer.connect(
-            {
-              fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
-                try {
-                  const response = await browser.fetch(input, init);
-
-                  if (response.status !== 101) {
-                    failure = new BrowserRunFailure({
-                      operation,
-                      reason: "provider",
-                      status: response.status,
-                    });
-                    await response.body?.cancel();
-                    throw failure;
-                  }
-
-                  return response;
-                } catch (cause) {
-                  failure ??= browserFailure(operation, cause);
-                  throw failure;
-                }
-              },
-            },
-            sessionId,
+          const response = await browser.fetch(
+            `https://browser-rendering.cloudflare.com/v1/devtools/browser/${sessionId}`,
+            { headers: { Upgrade: "websocket" }, ...(signal === undefined ? {} : { signal }) },
           );
+
+          if (response.status !== 101) {
+            const failure = new BrowserRunFailure({
+              operation,
+              reason: "provider",
+              status: response.status,
+            });
+
+            try {
+              await response.body?.cancel();
+            } catch {
+              // Body cancellation cannot replace the provider refusal.
+            }
+            throw failure;
+          }
+          const connected = response.webSocket;
+
+          if (connected === null) throw new BrowserRunFailure({ operation, reason: "malformed" });
+          socket = connected;
+
+          const transport: ConnectionTransport = {
+            send: (message) => connected.send(message),
+            close: () => connected.close(),
+          };
+
+          connected.addEventListener("message", (event) => {
+            transport.onmessage?.(event.data);
+          });
+          connected.addEventListener("close", () => transport.onclose?.());
+          connected.accept();
+
+          const abort = () => {
+            try {
+              const wasOpen = connected.readyState === WebSocket.OPEN;
+
+              connected.close();
+              closedByAbort = wasOpen;
+            } catch {
+              // The local transport may already have closed; never terminate the provider here.
+            }
+          };
+
+          signal?.addEventListener("abort", abort, { once: true });
+          try {
+            signal?.throwIfAborted();
+
+            return await puppeteer.connect({ transport });
+          } finally {
+            signal?.removeEventListener("abort", abort);
+          }
         } catch (cause) {
-          throw failure ?? browserFailure(operation, cause);
+          try {
+            socket?.close();
+          } catch {
+            // Preserve the connection failure when local release also fails.
+          }
+          const failure = browserFailure(operation, cause);
+
+          // A local abort can reject SDK initialization as target-closed. Genuine late
+          // provider failures still report, even when the caller's signal has aborted.
+          const localCancellation =
+            cause instanceof Error &&
+            signal?.aborted === true &&
+            (cause === signal.reason || (closedByAbort && cause.name === "TargetCloseError"));
+
+          throw localCancellation ? reportedBrowserError(failure) : failure;
         }
       },
     });

package/src/internal/browser-file-selection.ts

@@ -1,6 +1,6 @@
-import type { Page } from "@cloudflare/puppeteer";
 import { Encoding } from "effect";
 import type { BrowserSelectFileRequest } from "effect-agent/interactive-browser";
+import type { Page } from "puppeteer-core/lib/esm/puppeteer/puppeteer-core-browser.js";
 
 type Element = NonNullable<Awaited<ReturnType<Page["$"]>>>;
 

package/src/protected-browser/binding.ts

@@ -1,8 +1,13 @@
 /// <reference types="@cloudflare/workers-types" />
-import { type Browser, type Page, type CDPSession } from "@cloudflare/puppeteer";
+
 import { Cause, Context, Crypto, Effect, Layer, Redacted, Schema, type Scope } from "effect";
 import { type InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
 import { ProtectedBrowserError } from "effect-agent/protected-browser";
+import {
+  type Browser,
+  type Page,
+  type CDPSession,
+} from "puppeteer-core/lib/esm/puppeteer/puppeteer-core-browser.js";
 
 import { BrowserRunBinding } from "../internal/browser-binding.ts";
 import {
@@ -89,23 +94,29 @@ const protectedBindingLayer = (options: { readonly browser: Pick<BrowserRun, "fe
           driver?.invalidate();
           if (sessionId === undefined) return "unconfirmed" as const;
 
-          const cleanup = yield* lifecycle.close(sessionId).pipe(
-            Effect.as("confirmed" as const),
-            Effect.catchCause((cause) =>
-              reportBrowserCause("protected.close", cause).pipe(Effect.as("unconfirmed" as const)),
-            ),
-            Effect.interruptible,
-            Effect.timeoutOrElse({
-              duration: "10 seconds",
-              orElse: () =>
-                reportBrowserCause(
-                  "protected.close",
-                  Cause.fail(
-                    new BrowserRunFailure({ operation: "protected.close", reason: "timeout" }),
+          // A failed resume has not acquired the host's retained provider. Release only
+          // this connection; successful attachments and new allocations own termination.
+          const cleanup = yield* identity !== undefined && driver === undefined
+            ? Effect.succeed("unconfirmed" as const)
+            : lifecycle.close(sessionId).pipe(
+                Effect.as("confirmed" as const),
+                Effect.catchCause((cause) =>
+                  reportBrowserCause("protected.close", cause).pipe(
+                    Effect.as("unconfirmed" as const),
                   ),
-                ).pipe(Effect.as("unconfirmed" as const)),
-            }),
-          );
+                ),
+                Effect.interruptible,
+                Effect.timeoutOrElse({
+                  duration: "10 seconds",
+                  orElse: () =>
+                    reportBrowserCause(
+                      "protected.close",
+                      Cause.fail(
+                        new BrowserRunFailure({ operation: "protected.close", reason: "timeout" }),
+                      ),
+                    ).pipe(Effect.as("unconfirmed" as const)),
+                }),
+              );
 
           // Local disconnect is not remote-closure evidence. Do it even when confirmation fails.
           const connected = browser;
@@ -155,7 +166,7 @@ const protectedBindingLayer = (options: { readonly browser: Pick<BrowserRun, "fe
               }
               // Resume only a host-persisted exact page. Never open a replacement page or context.
               stage = "protected.connect";
-              browser = await binding.connect(Redacted.value(sessionId), stage);
+              browser = await binding.connect(Redacted.value(sessionId), stage, signal);
               if (signal.aborted || invalid) {
                 await runCleanup(terminate);
                 throw new ProtectedTransportError({ reason: "stale-reference" });
@@ -262,7 +273,8 @@ const protectedBindingLayer = (options: { readonly browser: Pick<BrowserRun, "fe
                     new ProtectedBrowserError({
                       ...failure(),
                       reason: error.reason === "timeout" ? "timeout" : "provider",
-                      cleanup,
+                      cleanup:
+                        identity !== undefined && driver === undefined ? "not-requested" : cleanup,
                     }),
                   ),
                 ),

package/src/protected-browser/native.ts

@@ -1,5 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import type { Browser, Frame, JSHandle, Page } from "@cloudflare/puppeteer";
+
 import { Cause, Clock, Context, Crypto, Effect, Redacted, Schema, type Scope } from "effect";
 import { type InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
 import {
@@ -7,6 +7,12 @@ import {
   CredentialTarget,
   ProtectedBrowserControl,
 } from "effect-agent/protected-browser";
+import type {
+  Browser,
+  Frame,
+  JSHandle,
+  Page,
+} from "puppeteer-core/lib/esm/puppeteer/puppeteer-core-browser.js";
 
 import {
   browserFailure,
@@ -22,14 +28,6 @@ import {
   type ProtectedBrowserTransport,
 } from "./policy.ts";
 
-// The pinned SDK implements this method but strips its internal declaration from lib/types.d.ts.
-// Keep the declaration narrow and refuse runtimes without it. No main-world fallback is safe.
-declare module "@cloudflare/puppeteer" {
-  interface Frame {
-    isolatedRealm(): { evaluateHandle(source: string): Promise<JSHandle<unknown>> };
-  }
-}
-
 const Description = Schema.Struct({
   role: ProtectedBrowserControl.fields.role,
   formIndex: Schema.Natural,