@effect-agent/platform-cloudflare 0.1.0-beta.52 → 0.1.0-beta.53

package/dist/CloudflareThreadClient.d.mts

@@ -182,13 +182,13 @@ declare const encodeUnknownResolutionCommand: (input: UnknownResolutionCommand,
   readonly author: string;
   readonly reason: string;
   readonly resolution: {
-    readonly _tag: "SafeToRetry";
-  } | {
     readonly _tag: "CompletedWithResult";
     readonly result: Schema.Json;
     readonly isFailure: boolean;
   } | {
     readonly _tag: "NeverHappened";
+  } | {
+    readonly _tag: "SafeToRetry";
   } | {
     readonly _tag: "AbortSubmission";
   };
@@ -316,19 +316,6 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
       readonly createdAt: string;
       readonly deploymentId: string;
       readonly payload: {
-        readonly _tag: "SubagentStarted";
-        readonly runId: string;
-        readonly toolCallId: string;
-        readonly childThreadId: string;
-        readonly childSubmissionId: string;
-        readonly childReceiptId: string;
-        readonly childRunId: string;
-      } | {
-        readonly _tag: "AbortRequested";
-        readonly submissionId: string;
-        readonly author: string;
-        readonly reason: string;
-      } | {
         readonly _tag: "ThreadCreated";
         readonly agentId: string;
         readonly definitions: {
@@ -466,6 +453,11 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
         readonly runDisposition?: Schema.Json | undefined;
         readonly finishReason?: "budget-exhausted" | undefined;
         readonly exhausted?: "tokens" | "tool-calls" | "turns" | undefined;
+      } | {
+        readonly _tag: "AbortRequested";
+        readonly submissionId: string;
+        readonly author: string;
+        readonly reason: string;
       } | {
         readonly _tag: "SubmissionSettled";
         readonly submissionId: string;
@@ -557,6 +549,14 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
             readonly resultBytes: number;
           };
         } | undefined;
+      } | {
+        readonly _tag: "SubagentStarted";
+        readonly runId: string;
+        readonly toolCallId: string;
+        readonly childThreadId: string;
+        readonly childSubmissionId: string;
+        readonly childReceiptId: string;
+        readonly childRunId: string;
       } | {
         readonly _tag: "SubagentJoined";
         readonly runId: string;
@@ -628,13 +628,13 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly author: string;
     readonly reason: string;
     readonly resolution: {
-      readonly _tag: "SafeToRetry";
-    } | {
       readonly _tag: "CompletedWithResult";
       readonly result: Schema.Json;
       readonly isFailure: boolean;
     } | {
       readonly _tag: "NeverHappened";
+    } | {
+      readonly _tag: "SafeToRetry";
     } | {
       readonly _tag: "AbortSubmission";
     };
@@ -644,6 +644,16 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
 } | {
   readonly _tag: "HostFailed";
   readonly failure: {
+    readonly _tag: "HostProtocolError";
+    readonly message: string;
+  } | {
+    readonly _tag: "AgentInputError";
+    readonly message: string;
+  } | {
+    readonly _tag: "DigestError";
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+  } | {
     readonly _tag: "AdmissionConflict";
     readonly threadId: string;
     readonly principal: string;
@@ -658,6 +668,15 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly _tag: "SettlementConflict";
     readonly submissionId: string;
     readonly existingOutcome: "aborted" | "completed" | "failed";
+  } | {
+    readonly _tag: "ApprovalConflict";
+    readonly submissionId: string;
+    readonly toolCallId: string;
+    readonly existingDecision: "approved" | "denied";
+  } | {
+    readonly _tag: "UnknownResolutionConflict";
+    readonly submissionId: string;
+    readonly toolCallId: string;
   } | {
     readonly _tag: "JoinedToHost";
     readonly submissionId: string;
@@ -687,30 +706,6 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly threadId: string;
     readonly actualEpoch: number;
     readonly attemptedEpoch: number;
-  } | {
-    readonly _tag: "DurableAlarmError";
-    readonly operation: string;
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "HostProtocolError";
-    readonly message: string;
-  } | {
-    readonly _tag: "AgentInputError";
-    readonly message: string;
-  } | {
-    readonly _tag: "DigestError";
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "ApprovalConflict";
-    readonly submissionId: string;
-    readonly toolCallId: string;
-    readonly existingDecision: "approved" | "denied";
-  } | {
-    readonly _tag: "UnknownResolutionConflict";
-    readonly submissionId: string;
-    readonly toolCallId: string;
   } | {
     readonly _tag: "DurableRuntimeFailpointError";
     readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-start-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:before-prepared-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append";
@@ -719,6 +714,11 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly limit: "database-bytes" | "input-bytes" | "queue-depth";
     readonly actual: number;
     readonly maximum: number;
+  } | {
+    readonly _tag: "DurableAlarmError";
+    readonly operation: string;
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "OperationDenied";
     readonly operation: "abort" | "awaitSettlement" | "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";

package/dist/ProtectedBrowser.d.mts

@@ -1,7 +1,7 @@
 import { r as BrowserRunSessionLifecycle } from "./browser-session-lifecycle-DJpqLXy_.mjs";
 import { Context, Crypto, Effect, Layer, Redacted, Schema, Scope } from "effect";
 import { InteractiveBrowserPolicy } from "@effect-agent/sandbox/InteractiveBrowser";
-import { CredentialFieldRole, ProtectedBrowser, ProtectedBrowserControl, ProtectedBrowserError, ProtectedCleanup } from "@effect-agent/sandbox/ProtectedBrowser";
+import { CredentialFieldRole, CredentialOrigin, ProtectedBrowser, ProtectedBrowserControl, ProtectedBrowserError, ProtectedCleanup } from "@effect-agent/sandbox/ProtectedBrowser";
 //#region src/protected-browser/policy.d.ts
 declare const ProtectedTransportError_base: Schema.Class<ProtectedTransportError, Schema.TaggedStruct<"ProtectedTransportError", {
   readonly reason: Schema.Literals<readonly ["stale-reference", "needs-attention", "unsupported", "provider"]>;
@@ -14,12 +14,14 @@ declare const ProtectedBrowserDispatch_base: Context.ServiceClass<ProtectedBrows
 declare class ProtectedBrowserDispatch extends ProtectedBrowserDispatch_base {}
 /** Decoded adapter boundary. SDK exceptions and page diagnostics never cross this port. */
 interface ProtectedBrowserTransport {
+  /** Select observation/target origins; undefined restores all network-permitted HTTPS frames. */
+  readonly restrictObservation: (origins: ReadonlyArray<typeof CredentialOrigin.Type> | undefined) => Effect.Effect<void, ProtectedTransportError>;
   readonly context: Effect.Effect<typeof ProtectedPageContext.Type, ProtectedTransportError>;
   readonly discover: Effect.Effect<typeof ProtectedDiscovery.Type, ProtectedTransportError>;
   readonly target: (ref: string) => Effect.Effect<ProtectedBrowserControl, ProtectedTransportError>;
   readonly navigate: (url: string) => Effect.Effect<void, ProtectedTransportError>;
   readonly click: (ref: string) => Effect.Effect<void, ProtectedTransportError>;
-  readonly fill: (ref: string, role: typeof CredentialFieldRole.Type, value: Redacted.Redacted<string>) => Effect.Effect<void, ProtectedTransportError, ProtectedBrowserDispatch>;
+  readonly fill: (ref: string, role: typeof CredentialFieldRole.Type | "text" | "select", value: Redacted.Redacted<string>) => Effect.Effect<void, ProtectedTransportError, ProtectedBrowserDispatch>;
   /** Invalidates local references synchronously before bounded exact-session cleanup. */
   readonly invalidate: () => void;
   readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;
@@ -44,7 +46,7 @@ declare const ProtectedDiscovery: Schema.Struct<{
 }>;
 /**
  * Fresh private passes only. Account administrators and Browser Rendering token holders are
- * trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext-fill API exists.
+ * trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
  * Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
  */
 declare const browserRunProtectedLayer: () => Layer.Layer<ProtectedBrowser, never, BrowserRunProtectedTransport | Crypto.Crypto>;

package/dist/ProtectedBrowser.mjs

@@ -2,7 +2,7 @@ import { n as BrowserRunSessionLifecycle } from "./browser-session-lifecycle-CUb
 import { Clock, Context, Crypto, Effect, Layer, Option, Redacted, Schema, Semaphore } from "effect";
 import puppeteer from "@cloudflare/puppeteer";
 import { InteractiveBrowserPolicy } from "@effect-agent/sandbox/InteractiveBrowser";
-import { BrowserCredentialAccess, CardCredential, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "@effect-agent/sandbox/ProtectedBrowser";
+import { BrowserCredentialAccess, CardCredential, CredentialObservationDecision, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "@effect-agent/sandbox/ProtectedBrowser";
 //#region src/protected-browser/policy.ts
 var ProtectedTransportError = class extends Schema.TaggedError()("ProtectedTransportError", { reason: Schema.Literals([
 	"stale-reference",
@@ -42,7 +42,7 @@ const secretFor = (material, role) => {
 };
 /**
 * Fresh private passes only. Account administrators and Browser Rendering token holders are
-* trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext-fill API exists.
+* trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
 * Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
 */
 const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen(function* () {
@@ -100,18 +100,48 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 		const pageContext = remote(driver.context);
 		const permitObservation = Effect.gen(function* () {
 			const context = yield* pageContext;
+			let origins;
 			if (exposures.length > 0) {
 				observation = "protected";
-				if ((yield* access.observation({
+				const principal = yield* caller;
+				const rawDecision = yield* access.observation({
 					...context,
-					caller: yield* caller,
+					caller: principal,
 					exposures: [...exposures]
-				}).pipe(Effect.mapError((error) => fail(error.reason)))) !== "trust-recipient-no-credential-echo") return yield* fail("observation-blocked");
+				}).pipe(Effect.mapError((error) => fail(error.reason)));
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+				const decision = yield* Schema.decodeUnknownEffect(CredentialObservationDecision)(rawDecision).pipe(Effect.mapError(() => fail("observation-blocked")));
+				if (decision === "deny") return yield* fail("observation-blocked");
+				if (typeof decision !== "string") {
+					origins = [...decision.origins];
+					if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
+				}
 				observation = "approved-after-exposure";
 			}
-			return context;
+			yield* remote(driver.restrictObservation(origins));
+			return {
+				...context,
+				frameOrigins: context.frameOrigins.filter((origin) => origins === void 0 || origins.includes(origin))
+			};
 		});
 		const target = (ref) => remote(driver.target(ref));
+		const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (action) {
+			if (access.authorizeAction === void 0) {
+				if (action._tag === "Submit") return yield* fail("unsupported");
+				return;
+			}
+			const principal = yield* caller;
+			yield* access.authorizeAction({
+				caller: principal,
+				action,
+				exposures: [...exposures]
+			}).pipe(Effect.mapError((error) => fail(error.reason)));
+			if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+			if (action._tag !== "Navigate") {
+				const current = yield* target(action.ref);
+				if (!sameTarget(current.target, action.target) || current.role !== (action._tag === "Submit" ? "submit" : action.role) || action._tag === "Click" && action.role === "link" && current.url !== action.url) return yield* fail("stale-reference");
+			}
+		}, Effect.withTracerEnabled(false));
 		const bounded = (result) => {
 			return new TextEncoder().encode(JSON.stringify(result)).byteLength <= policy.maxReturnedBytes ? Effect.succeed(result) : Effect.fail(fail("limit"));
 		};
@@ -155,6 +185,10 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 				}
 				if (url.protocol !== "https:" || url.username || url.password || policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) return yield* fail("denied");
 				if (exposures.length > 0) yield* permitObservation;
+				yield* authorizeAction({
+					_tag: "Navigate",
+					url: decoded.url
+				});
 				offers.clear();
 				dispatch = "possibly-dispatched";
 				yield* remote(driver.navigate(decoded.url));
@@ -165,7 +199,8 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 				const before = yield* permitObservation;
 				const result = yield* remote(driver.discover);
 				const after = yield* permitObservation;
-				if (before.document !== after.document || result.document !== after.document) return yield* fail("stale-reference");
+				if (before.document !== after.document || result.document !== after.document || result.topOrigin !== after.topOrigin) return yield* fail("stale-reference");
+				if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin))) return yield* fail("observation-blocked");
 				return yield* bounded(ProtectedBrowserObservation.make({
 					...result,
 					observation: exposures.length > 0 ? "approved-after-exposure" : "before-exposure"
@@ -175,10 +210,54 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 				const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserClick)(request).pipe(Effect.mapError(() => fail("denied")));
 				yield* permitObservation;
 				const control = yield* target(decoded.ref);
-				if (control.role !== "link" && control.role !== "button") return yield* fail("unsupported");
+				if (control.role !== "link" && control.role !== "button" && control.role !== "radio" && control.role !== "checkbox" && control.role !== "submit") return yield* fail("unsupported");
+				let action;
+				if (control.role === "link") {
+					if (control.url === void 0) return yield* fail("unsupported");
+					action = {
+						_tag: "Click",
+						ref: decoded.ref,
+						target: control.target,
+						role: "link",
+						url: control.url
+					};
+				} else if (control.role === "submit") action = {
+					_tag: "Submit",
+					ref: decoded.ref,
+					target: control.target
+				};
+				else action = {
+					_tag: "Click",
+					ref: decoded.ref,
+					target: control.target,
+					role: control.role
+				};
+				yield* authorizeAction(action);
 				dispatch = "possibly-dispatched";
-				yield* remote(driver.click(decoded.ref));
+				yield* remote(driver.click(decoded.ref)).pipe(Effect.catch((error) => {
+					if (error.reason === "needs-attention") dispatch = "not-dispatched";
+					return Effect.fail(error);
+				}));
+				dispatch = "dispatched";
+				if (control.role === "submit") milestone = "submission-dispatched";
+				yield* permitObservation;
+			})),
+			fill: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserFill)(request).pipe(Effect.mapError(() => fail("denied")));
+				yield* permitObservation;
+				const control = yield* target(decoded.ref);
+				if (control.role !== "text" && control.role !== "select") return yield* fail("unsupported");
+				yield* authorizeAction({
+					_tag: "Fill",
+					ref: decoded.ref,
+					target: control.target,
+					role: control.role
+				});
+				yield* remote(driver.fill(decoded.ref, control.role, Redacted.make(decoded.value))).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+					dispatch = "possibly-dispatched";
+				}) }));
 				dispatch = "dispatched";
+				milestone = "filled";
 				yield* permitObservation;
 			})),
 			listCredentialOffers: (request) => run(Effect.gen(function* () {
@@ -226,7 +305,6 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 				if (offer === void 0 || offer.expires <= (yield* Clock.currentTimeMillis)) return yield* fail("stale-reference");
 				const principal = yield* caller;
 				if (Redacted.value(principal) !== Redacted.value(offer.caller)) return yield* fail("denied");
-				if (offer.kind === "card" && decoded.submit !== void 0) return yield* fail("unsupported");
 				if (new Set(decoded.fields.map((field) => field.ref)).size !== decoded.fields.length || new Set(decoded.fields.map((field) => field.role)).size !== decoded.fields.length) return yield* fail("denied");
 				const validate = Effect.gen(function* () {
 					if (!sameTarget(offer.target, (yield* target(offer.targetRef)).target)) return yield* fail("stale-reference");
@@ -251,6 +329,7 @@ const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen
 				const authorize = Effect.gen(function* () {
 					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
 					yield* access.authorize(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
 				});
 				yield* authorize;
 				yield* validate;
@@ -302,41 +381,66 @@ const maxAttributeLength = 2048;
 const inspectFrame = `(() => {
   const doc = document;
   const forms = [];
-  const elements = [...doc.querySelectorAll('input,select,button,a[href]')].slice(0, 65);
+  const isChoice = el => el instanceof HTMLInputElement && ['radio','checkbox'].includes(el.type);
+  const presented = el => {
+    if (el.closest('[hidden],[aria-hidden="true"],[inert]') ||
+      ['hidden','collapse'].includes(getComputedStyle(el).visibility)) return false;
+    for (let parent = el; parent; parent = parent.parentElement) {
+      if (getComputedStyle(parent).opacity === '0') return false;
+    }
+    return true;
+  };
+  const hasLayout = el => presented(el) &&
+    [...el.getClientRects()].some(rect => rect.width > 0 && rect.height > 0);
+  const available = el => el.type !== 'hidden' && !el.closest('[hidden],[aria-hidden="true"],[inert]') &&
+    (hasLayout(el) || (isChoice(el) && [...(el.labels ?? [])].some(hasLayout)));
+  const elements = [...doc.querySelectorAll('input,textarea,select,button,a[href]')].filter(available).slice(0, 65);
+  const labelText = el => {
+    const label = el.labels?.[0]?.cloneNode(true);
+    label?.querySelectorAll('input,textarea,select,script,style,noscript').forEach(child => child.remove());
+    return label?.textContent ?? el.getAttribute('aria-label');
+  };
   const describe = (el) => {
-    if (doc !== document || !el.isConnected || el.ownerDocument !== doc) return null;
+    if (doc !== document || !el.isConnected || el.ownerDocument !== doc || !available(el)) return null;
     const form = el.form ?? null;
     let formIndex = forms.indexOf(form);
     if (formIndex < 0) { formIndex = forms.length; forms.push(form); }
-    const action = form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
+    // Resolved href (including path/query/fragment and base-URL changes) is part of the fingerprint.
+    const action = el instanceof HTMLAnchorElement ? el.href : form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
     const method = form ? (el.hasAttribute('formmethod') ? el.formMethod : form.method) : '';
     const enctype = form?.enctype ?? '';
     const name = el.name ?? '';
     const completion = el.getAttribute('autocomplete') ?? '';
     const inputType = el.type ?? '';
+    const choiceValue = isChoice(el) ? el.value : '';
     // Reject before parsing, fingerprinting or CDP transfer. Truncation could hide a target change.
-    if ([action, method, enctype, name, completion, inputType].some(value => value.length > ${maxAttributeLength})) return null;
+    if ([action, method, enctype, name, completion, inputType, choiceValue].some(value => value.length > ${maxAttributeLength})) return null;
     const type = inputType.toLowerCase();
     const autocomplete = completion.trim().toLowerCase().split(/\\s+/).at(-1);
     const cardRoles = { 'cc-name':'card-name', 'cc-number':'card-number', 'cc-exp':'card-expiry',
       'cc-exp-month':'card-expiry-month', 'cc-exp-year':'card-expiry-year', 'cc-csc':'card-security-code' };
     let role = 'unsupported';
-    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement;
-    if (nativeField && form && !['submit','button'].includes(type) && !el.disabled && !el.readOnly && el.getClientRects().length > 0) {
-      if (el instanceof HTMLInputElement && type === 'password') role = 'password';
-      else if (['text','email','tel','number','month',''].includes(type) || el instanceof HTMLSelectElement) {
-        if (cardRoles[autocomplete]) role = cardRoles[autocomplete];
-        else if (autocomplete === 'username' || autocomplete === 'email') role = 'username';
+    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement || el instanceof HTMLTextAreaElement;
+    if (nativeField && !['submit','button'].includes(type) && !el.matches(':disabled') && !el.readOnly && !(el instanceof HTMLSelectElement && el.multiple)) {
+      if (isChoice(el)) role = type;
+      else if (type === 'password' || ['current-password','new-password','one-time-code'].includes(autocomplete)) {
+        if (type === 'password' && form) role = 'password';
+      } else if (['text','email','tel','number','month','search','url','date','time','week','datetime-local','textarea',''].includes(type) || el instanceof HTMLSelectElement) {
+        if (cardRoles[autocomplete]) { if (form) role = cardRoles[autocomplete]; }
+        else if (autocomplete === 'username' || autocomplete === 'email') { if (form) role = 'username'; }
         else if (['text','email'].includes(type) && form && form.querySelector('input[type="password"]')) role = 'username';
+        else if (el instanceof HTMLSelectElement) { if (!el.multiple) role = 'select'; }
+        else role = 'text';
       }
     } else if (el instanceof HTMLButtonElement || (el instanceof HTMLInputElement && ['submit','button'].includes(type))) {
-      if (!el.disabled) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
+      if (!el.matches(':disabled')) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
     } else if (el instanceof HTMLAnchorElement) role = 'link';
-    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type]);
-    return { role, formIndex, action, fingerprint,
-      label: (el.labels?.[0]?.textContent ?? el.getAttribute('aria-label') ?? el.textContent ?? '').slice(0,200) };
+    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type, choiceValue]);
+    return { role, formIndex, action, fingerprint, ...(isChoice(el) ? {checked: el.checked} : {}),
+      label: (labelText(el) ?? (nativeField ? '' : el.textContent) ?? '').slice(0,200) };
   };
-  const expose = ({role, formIndex, action, label}) => ({role, formIndex, action, label});
+  const expose = ({role, formIndex, action, label, checked}) =>
+    ({role, formIndex, action, label, ...(checked === undefined ? {} : {checked})});
   const original = elements.map(describe);
   const validate = (index) => {
     const current = describe(elements[index]);
@@ -348,14 +452,32 @@ const inspectFrame = `(() => {
     doc, elements, original: original.map(current => current && expose(current)), validate,
     text: () => {
       if (doc !== document) return null;
-      const clone = doc.body?.cloneNode(true);
-      clone?.querySelectorAll('input,textarea,select,script,style,noscript,iframe,object,embed').forEach(el => el.remove());
-      return (clone?.textContent ?? '').slice(0,65536);
+      if (!doc.body) return '';
+      const walker = doc.createTreeWalker(doc.body, NodeFilter.SHOW_TEXT);
+      const range = doc.createRange();
+      let text = '';
+      for (let node = walker.nextNode(); node && text.length < 65536; node = walker.nextNode()) {
+        const parent = node.parentElement;
+        if (!parent || parent.closest('input,textarea,select,script,style,noscript,iframe,object,embed')) continue;
+        if (!presented(parent)) continue;
+        range.selectNodeContents(node);
+        if (![...range.getClientRects()].some(rect => rect.width > 0 && rect.height > 0)) continue;
+        text += (node.textContent ?? '').replace(/\\s+/g, ' ') + ' ';
+      }
+      return text.slice(0,65536);
     },
     fill: (index, role, value) => {
       const current = validate(index);
       if (!current || current.role !== role) return false;
       const el = elements[index];
+      if (role === 'select') {
+        const options = [...el.options].filter(option => !option.matches(':disabled'));
+        const values = options.filter(option => option.value === value);
+        const matches = values.length > 0 ? values : options.filter(option => option.textContent?.trim() === value);
+        if (matches.length !== 1) return 'unsupported';
+        value = matches[0].value;
+        if ([...el.options].filter(option => option.value === value).length !== 1) return 'unsupported';
+      }
       let prototype = Object.getPrototypeOf(el);
       let setter;
       while (prototype && !setter) { setter = Object.getOwnPropertyDescriptor(prototype,'value')?.set; prototype = Object.getPrototypeOf(prototype); }
@@ -370,7 +492,7 @@ const inspectFrame = `(() => {
     },
     click: (index) => {
       const current = validate(index);
-      if (!current || !['button','submit','link'].includes(current.role)) return false;
+      if (!current || !['button','submit','link','radio','checkbox'].includes(current.role)) return false;
       if (current.role === 'submit' && elements[index].form && !elements[index].form.matches(':valid')) return 'needs-attention';
       elements[index].click();
       return true;
@@ -383,7 +505,8 @@ const Description = Schema.Struct({
 	role: ProtectedBrowserControl.fields.role,
 	formIndex: Schema.Natural,
 	action: Schema.String.check(Schema.isMaxLength(maxAttributeLength)),
-	label: Schema.String.check(Schema.isMaxLength(200))
+	label: Schema.String.check(Schema.isMaxLength(200)),
+	checked: Schema.optionalKey(Schema.Boolean)
 });
 const Descriptions = Schema.Array(Schema.NullOr(Description)).check(Schema.isMaxLength(65));
 /** One host-private acquired session. The SDK handles and exact-session cleanup have one owner. */
@@ -413,6 +536,7 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 	let closed = false;
 	let violation = false;
 	let documentRef;
+	let observationOrigins;
 	const frames = /* @__PURE__ */ new Map();
 	const controls = /* @__PURE__ */ new Map();
 	const origin = (value) => Effect.try({
@@ -442,12 +566,20 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 		closed = true;
 		clear();
 	};
+	const observationFrames = Effect.gen(function* () {
+		const list = page.frames();
+		if (list.length > 32) return yield* transportError("unsupported");
+		return yield* Effect.filter(list, (frame) => frame === page.mainFrame() ? Effect.succeed(true) : Effect.try({
+			try: () => frame.url() !== "" && new URL(frame.url()).protocol === "https:",
+			catch: () => transportError("provider")
+		}));
+	});
 	const context = Effect.gen(function* () {
 		yield* check;
-		const list = page.frames();
-		if (list.length > 16) return yield* transportError("unsupported");
+		const list = yield* observationFrames;
 		const topOrigin = yield* origin(page.url());
-		const frameOrigins = yield* Effect.forEach(list, (frame) => origin(frame.url()));
+		const frameOrigins = [...new Set(yield* Effect.forEach(list, (frame) => origin(frame.url())))];
+		if (frameOrigins.length > 16) return yield* transportError("unsupported");
 		if (documentRef === void 0) documentRef = yield* uuid;
 		return yield* decode(ProtectedPageContext, {
 			document: documentRef,
@@ -465,7 +597,7 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 	const get = Effect.fn("ProtectedNativeTransport.get")(function* (ref) {
 		yield* check;
 		const state = controls.get(ref);
-		if (!state || state.expires <= (yield* clock.currentTimeMillis) || !(yield* isCurrent(state.frame))) return yield* transportError("stale-reference");
+		if (!state || observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin) || state.expires <= (yield* clock.currentTimeMillis) || !(yield* isCurrent(state.frame))) return yield* transportError("stale-reference");
 		const current = yield* remote(() => state.frame.handle.evaluate((held, index) => {
 			if (typeof held !== "object" || held === null) return null;
 			return Reflect.apply(Reflect.get(held, "validate"), held, [index]);
@@ -490,6 +622,11 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 		browser.on("targetcreated", onTarget);
 	}), () => close);
 	return {
+		restrictObservation: Effect.fn("ProtectedNativeTransport.restrictObservation")(function* (origins) {
+			yield* check;
+			observationOrigins = origins === void 0 ? void 0 : new Set(yield* decode(Schema.Array(CredentialOrigin), origins));
+			for (const [ref, state] of controls) if (observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin)) controls.delete(ref);
+		}),
 		context,
 		invalidate,
 		close,
@@ -509,7 +646,11 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 			const discovered = [];
 			let text = "";
 			let truncated = false;
-			for (const frame of page.frames()) {
+			const frameOrigins = /* @__PURE__ */ new Set();
+			for (const frame of yield* observationFrames) {
+				const frameOrigin = yield* origin(frame.url());
+				if (observationOrigins !== void 0 && !observationOrigins.has(frameOrigin)) continue;
+				frameOrigins.add(frameOrigin);
 				if (typeof frame.isolatedRealm !== "function") return yield* transportError("unsupported");
 				const handle = yield* remote(() => frame.isolatedRealm().evaluateHandle(inspectFrame));
 				const state = {
@@ -543,6 +684,8 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 						ref: yield* uuid,
 						role: desc.role,
 						label: desc.label,
+						...desc.checked === void 0 ? {} : { checked: desc.checked },
+						...desc.role === "link" ? { url: desc.action } : {},
 						target: CredentialTarget.make({
 							topOrigin: before.topOrigin,
 							frameOrigin: yield* origin(frame.url()),
@@ -573,6 +716,7 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 			if ((yield* context).document !== before.document) return yield* transportError("stale-reference");
 			return yield* decode(ProtectedDiscovery, {
 				...before,
+				frameOrigins: [...frameOrigins],
 				text,
 				controls: discovered,
 				truncated
@@ -658,7 +802,7 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 					return options.browser.fetch(request);
 				} }, {
 					recording: false,
-					keep_alive: Math.max(1e4, policy.maxElapsedMillis)
+					keep_alive: Math.min(6e5, Math.max(1e4, policy.maxElapsedMillis))
 				});
 				sessionId = Redacted.make(Schema.decodeUnknownSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId));
 				if (!recordingDisabled || signal.aborted || invalid) {