@effect-agent/platform-cloudflare 0.1.0-beta.9 → 0.1.0-beta.91

package/src/protected-browser/binding.ts

@@ -0,0 +1,313 @@
+/// <reference types="@cloudflare/workers-types" />
+import puppeteer, { type Browser, type Page, type CDPSession } from "@cloudflare/puppeteer";
+import { Clock, Context, Crypto, Effect, Layer, Redacted, Schema, type Scope } from "effect";
+import { type InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
+import { ProtectedBrowserError } from "effect-agent/protected-browser";
+
+import { BrowserRunSessionLifecycle } from "../internal/browser-session-lifecycle.ts";
+import { makeProtectedNativeTransport, ProtectedNativeSession } from "./native.ts";
+import {
+  BrowserRunProtectedTransport,
+  ProtectedTransportError,
+  type ProtectedBrowserTransport,
+} from "./policy.ts";
+
+/** Host-private exact page identity; never include it in model-visible results. */
+export const ProtectedProviderIdentity = Schema.Struct({
+  sessionId: Schema.Redacted(Schema.String.check(Schema.isUUID())),
+  contextId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+  targetId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+});
+
+export type ProtectedProviderIdentity = typeof ProtectedProviderIdentity.Type;
+
+export interface ProtectedProviderSession {
+  readonly identity: ProtectedProviderIdentity;
+  readonly driver: ProtectedBrowserTransport;
+  readonly command: (
+    method: "Cloudflare.getLiveView" | "Cloudflare.handoff" | "Cloudflare.getHandoffState",
+    parameters: Readonly<Record<string, string | number>>,
+  ) => Effect.Effect<unknown, ProtectedBrowserError>;
+  readonly detach: Effect.Effect<void, ProtectedBrowserError>;
+}
+
+export class BrowserRunProtectedBinding extends Context.Service<
+  BrowserRunProtectedBinding,
+  {
+    readonly open: (
+      policy: InteractiveBrowserPolicy,
+      identity?: ProtectedProviderIdentity,
+    ) => Effect.Effect<ProtectedProviderSession, ProtectedBrowserError, Scope.Scope>;
+  }
+>()("@effect-agent/platform-cloudflare/BrowserRunProtectedBinding") {}
+
+/**
+ * Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
+ * documented opt-in semantics are the recording guarantee; no recording-status API exists.
+ * Account operators remain trusted, and must not attach external observers to private passes.
+ */
+const protectedBindingLayer = (options: { readonly browser: Pick<BrowserRun, "fetch"> }) =>
+  Layer.effect(BrowserRunProtectedBinding)(
+    Effect.gen(function* () {
+      const lifecycle = yield* BrowserRunSessionLifecycle;
+      const crypto = yield* Crypto.Crypto;
+
+      const open = Effect.fn("BrowserRunProtectedTransport.open")(function* (
+        policy: InteractiveBrowserPolicy,
+        identity?: ProtectedProviderIdentity,
+      ): Effect.fn.Return<ProtectedProviderSession, ProtectedBrowserError, Scope.Scope> {
+        const failure = () =>
+          new ProtectedBrowserError({
+            reason: "provider",
+            dispatch: "not-dispatched",
+            milestone: "none",
+            observation: "closed",
+            cleanup: "unconfirmed",
+          });
+
+        let sessionId: Redacted.Redacted<string> | undefined = identity?.sessionId;
+        let detached = false;
+        let control: CDPSession | undefined;
+        let providerIdentity: ProtectedProviderIdentity | undefined;
+        let browser: Browser | undefined;
+        let driver: ProtectedBrowserTransport | undefined;
+        let invalid = false;
+        // SDK acquisition may finish after interruption. Its late-reply callback must await cleanup,
+        // using this pass's clock rather than starting an Effect runtime with default services.
+        const runCleanup = Effect.runPromiseWith(Context.make(Clock.Clock, yield* Clock.Clock));
+
+        const terminate = Effect.gen(function* () {
+          invalid = true;
+          driver?.invalidate();
+          if (sessionId === undefined) return "unconfirmed" as const;
+
+          const cleanup = yield* lifecycle.close(sessionId).pipe(
+            Effect.as("confirmed" as const),
+            Effect.catchCause(() => Effect.succeed("unconfirmed" as const)),
+            Effect.interruptible,
+            Effect.timeoutOrElse({
+              duration: "10 seconds",
+              orElse: () => Effect.succeed("unconfirmed" as const),
+            }),
+          );
+
+          // Local disconnect is not remote-closure evidence. Do it even when confirmation fails.
+          const connected = browser;
+
+          if (connected !== undefined)
+            yield* Effect.promise(() => connected.disconnect()).pipe(
+              Effect.catchCause(() => Effect.void),
+              Effect.interruptible,
+              Effect.timeoutOrElse({ duration: "1 second", orElse: () => Effect.void }),
+            );
+
+          return cleanup;
+        });
+
+        const close = yield* Effect.cached(terminate);
+
+        yield* Effect.addFinalizer(() =>
+          detached
+            ? Effect.void
+            : close.pipe(
+                Effect.flatMap((state) =>
+                  state === "confirmed"
+                    ? Effect.void
+                    : Effect.logWarning("Protected browser exact-session closure unconfirmed"),
+                ),
+              ),
+        );
+
+        const acquired = yield* Effect.tryPromise({
+          try: async (signal) => {
+            let recordingDisabled = false;
+
+            const binding = {
+              fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
+                const request = new Request(input, init);
+                const url = new URL(request.url);
+
+                if (url.pathname === "/v1/devtools/browser" && request.method === "POST") {
+                  url.searchParams.set("recording", "false");
+                  recordingDisabled = url.searchParams.get("recording") === "false";
+
+                  return options.browser.fetch(new Request(url, request));
+                }
+
+                return options.browser.fetch(request);
+              },
+            };
+
+            const acquired =
+              identity === undefined
+                ? await puppeteer.acquire(binding, {
+                    recording: false,
+                    // Provider inactivity timeout, independent of the finite total pass deadline.
+                    keep_alive: Math.min(600_000, Math.max(10_000, policy.maxElapsedMillis)),
+                  })
+                : { sessionId: Redacted.value(identity.sessionId) };
+
+            sessionId = Redacted.make(
+              Schema.decodeSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId),
+            );
+            if ((identity === undefined && !recordingDisabled) || signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+            // Resume only a host-persisted exact page. Never open a replacement page or context.
+            browser = await puppeteer.connect(options.browser, acquired.sessionId);
+            if (signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+            let page: Page;
+
+            if (identity === undefined) {
+              const context = await browser.createBrowserContext();
+
+              page = await context.newPage();
+            } else {
+              const context = browser
+                .browserContexts()
+                .find((candidate) => candidate.id === Redacted.value(identity.contextId));
+
+              if (context === undefined)
+                throw new ProtectedTransportError({ reason: "stale-reference" });
+              const pages = await context.pages();
+              let found: Page | undefined;
+
+              for (const candidate of pages) {
+                const client = await candidate.createCDPSession();
+                const info = await client.send("Target.getTargetInfo");
+
+                await client.detach();
+                if (info.targetInfo.targetId === Redacted.value(identity.targetId))
+                  found = candidate;
+              }
+              if (found === undefined || pages.length !== 1)
+                throw new ProtectedTransportError({ reason: "stale-reference" });
+              page = found;
+            }
+            control = await page.createCDPSession();
+            const info = await control.send("Target.getTargetInfo");
+
+            providerIdentity = Schema.decodeSync(ProtectedProviderIdentity)({
+              sessionId,
+              contextId: Redacted.make(page.browserContext().id ?? ""),
+              targetId: Redacted.make(info.targetInfo.targetId),
+            });
+
+            await page.setBypassServiceWorker(true);
+            await page.setRequestInterception(true);
+            page.on("request", (request) => {
+              let allowed = policy.network._tag === "Unrestricted";
+
+              try {
+                const url = new URL(request.url());
+
+                allowed ||=
+                  policy.network._tag === "ExactHosts" &&
+                  url.protocol === "https:" &&
+                  !url.username &&
+                  !url.password &&
+                  policy.network.allowedHosts.includes(url.host);
+              } catch {
+                /* Refuse malformed destinations. */
+              }
+              void (
+                allowed && !invalid ? request.continue() : request.abort("blockedbyclient")
+              ).catch(() => {
+                invalid = true;
+                driver?.invalidate();
+              });
+            });
+            if (signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+
+            return ProtectedNativeSession.of({
+              browser,
+              page,
+              close,
+              release: Effect.suspend(() => (detached ? Effect.void : close.pipe(Effect.asVoid))),
+            });
+          },
+          catch: failure,
+        }).pipe(
+          Effect.timeoutOrElse({
+            duration: Math.min(policy.maxElapsedMillis, 30_000),
+            orElse: () =>
+              Effect.fail(new ProtectedBrowserError({ ...failure(), reason: "timeout" })),
+          }),
+          Effect.catch((error) =>
+            close.pipe(
+              Effect.flatMap((cleanup) =>
+                Effect.fail(new ProtectedBrowserError({ ...error, cleanup })),
+              ),
+            ),
+          ),
+        );
+
+        driver = yield* makeProtectedNativeTransport(policy).pipe(
+          Effect.provideService(ProtectedNativeSession, acquired),
+          Effect.provideService(Crypto.Crypto, crypto),
+        );
+
+        const exact = providerIdentity;
+
+        if (exact === undefined) return yield* failure();
+
+        return {
+          identity: exact,
+          driver,
+          command: (method, parameters) =>
+            Effect.tryPromise({
+              try: async () => {
+                if (invalid || detached || control === undefined) throw undefined;
+
+                // Cloudflare extends CDP with host-only methods absent from upstream ProtocolMapping.
+                const send = Reflect.get(control, "send");
+
+                return await Reflect.apply(send, control, [method, parameters]);
+              },
+              catch: failure,
+            }).pipe(
+              Effect.timeoutOrElse({
+                duration: "10 seconds",
+                orElse: () => Effect.fail(failure()),
+              }),
+            ),
+          detach: Effect.tryPromise({
+            try: async () => {
+              if (invalid || detached || browser === undefined) throw undefined;
+              // Stop this attachment before another controller can attach. The browser remains live.
+              await browser.disconnect();
+              detached = true;
+              driver?.invalidate();
+            },
+            catch: failure,
+          }).pipe(
+            Effect.timeoutOrElse({ duration: "10 seconds", orElse: () => Effect.fail(failure()) }),
+          ),
+        };
+      }, Effect.withTracerEnabled(false));
+
+      return { open };
+    }),
+  );
+
+/** One binding implementation serves scoped tools and host-managed protected handoffs. */
+export const browserRunProtectedBindingLayer = (options: {
+  readonly browser: Pick<BrowserRun, "fetch">;
+}) =>
+  Layer.effect(BrowserRunProtectedTransport)(
+    Effect.gen(function* () {
+      const binding = yield* BrowserRunProtectedBinding;
+
+      return {
+        open: (policy: InteractiveBrowserPolicy) =>
+          binding.open(policy).pipe(Effect.map((session) => session.driver)),
+      };
+    }),
+  ).pipe(Layer.provideMerge(protectedBindingLayer(options)));

package/src/protected-browser/host.ts

@@ -0,0 +1,344 @@
+import {
+  Clock,
+  Context,
+  Crypto,
+  Effect,
+  Layer,
+  Redacted,
+  Schema,
+  Semaphore,
+  type Scope,
+} from "effect";
+import { InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
+import {
+  type BrowserCredentialAccess,
+  CredentialOrigin,
+  ProtectedBrowserCheckpoint,
+  ProtectedBrowserError,
+  type ProtectedBrowserHandle,
+  type ProtectedCleanup,
+} from "effect-agent/protected-browser";
+
+import {
+  BrowserRunHandoffRequest,
+  BrowserRunHandoffState,
+  BrowserRunLiveViewRequest,
+  BrowserRunLiveViewResult,
+} from "../InteractiveBrowser.ts";
+import { BrowserRunSessionLifecycle } from "../internal/browser-session-lifecycle.ts";
+import { BrowserRunProtectedBinding, ProtectedProviderIdentity } from "./binding.ts";
+import { BrowserRunProtectedTransport, makeProtectedBrowserPolicy } from "./policy.ts";
+
+/** Host-only receipt. Store atomically with the controller lease; never return it to a model. */
+export class BrowserRunProtectedCheckpoint extends Schema.Class<BrowserRunProtectedCheckpoint>(
+  "BrowserRunProtectedCheckpoint",
+)({
+  ...ProtectedProviderIdentity.fields,
+  protected: ProtectedBrowserCheckpoint,
+  handoffId: Schema.optionalKey(
+    Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(1024))),
+  ),
+}) {}
+
+export interface BrowserRunProtectedSession {
+  readonly handle: ProtectedBrowserHandle;
+  readonly sessionId: Redacted.Redacted<string>;
+  /** Quiesce before publishing a durable human-control request. Persist before detaching. */
+  readonly suspend: Effect.Effect<BrowserRunProtectedCheckpoint, ProtectedBrowserError>;
+  /** Fences agent tools before dispatch. Persist the returned receipt before detaching. */
+  readonly handoff: (
+    request: BrowserRunHandoffRequest,
+  ) => Effect.Effect<BrowserRunProtectedCheckpoint, ProtectedBrowserError>;
+  /** Available only while human control is held; the host must authorize the specific human. */
+  readonly getLiveView: (
+    request: BrowserRunLiveViewRequest,
+  ) => Effect.Effect<BrowserRunLiveViewResult, ProtectedBrowserError>;
+  readonly getHandoffState: Effect.Effect<BrowserRunHandoffState, ProtectedBrowserError>;
+  /** Read only the exact page’s current origin after its recorded handoff completes; tools remain paused. */
+  readonly getReturnOrigin: Effect.Effect<typeof CredentialOrigin.Type, ProtectedBrowserError>;
+  /** Requires provider completion and a renewed observation grant. Tools must observe before acting. */
+  readonly returnControl: Effect.Effect<void, ProtectedBrowserError>;
+  /** Releases this attachment without terminating the remote browser. Only a committed handoff may detach. */
+  readonly detach: Effect.Effect<void, ProtectedBrowserError>;
+  readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;
+}
+
+/**
+ * Host authority for one protected page. The consumer owns durable generation fencing, authorized
+ * human recipients, checkpoint integrity, vault exposure metadata, and expiry cleanup. Resume only
+ * the latest committed suspended receipt; it never replays browser mutations or creates a page.
+ * Hosted passes require Unrestricted network policy: attachment-local request interception
+ * cannot enforce an ExactHosts policy during detachment. Current credential grants still apply.
+ * Provider inactivity/session deadlines still apply while the host is detached.
+ */
+export class BrowserRunProtectedHost extends Context.Service<
+  BrowserRunProtectedHost,
+  {
+    readonly open: (
+      policy: InteractiveBrowserPolicy,
+    ) => Effect.Effect<
+      BrowserRunProtectedSession,
+      ProtectedBrowserError,
+      Scope.Scope | BrowserCredentialAccess
+    >;
+    readonly resume: (
+      checkpoint: BrowserRunProtectedCheckpoint,
+    ) => Effect.Effect<
+      BrowserRunProtectedSession,
+      ProtectedBrowserError,
+      Scope.Scope | BrowserCredentialAccess
+    >;
+    readonly closeSession: (
+      sessionId: Redacted.Redacted<string>,
+    ) => Effect.Effect<typeof ProtectedCleanup.Type>;
+  }
+>()("@effect-agent/platform-cloudflare/BrowserRunProtectedHost") {}
+
+const failure = (reason: ProtectedBrowserError["reason"]) =>
+  new ProtectedBrowserError({
+    reason,
+    dispatch: "not-dispatched",
+    milestone: "none",
+    observation: "protected",
+    cleanup: "not-requested",
+  });
+
+const Handoff = Schema.Struct({ handoffId: Schema.NonEmptyString.check(Schema.isMaxLength(1024)) });
+
+const HandoffState = Schema.Struct({
+  active: Schema.Boolean,
+  handoffId: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(1024))),
+  durationMs: Schema.optionalKey(Schema.Natural),
+});
+
+const LiveView = Schema.Struct({ devtoolsFrontendUrl: Schema.String });
+
+/** Compose with browserRunProtectedBindingLayer and BrowserRunSessionLifecycle. */
+export const browserRunProtectedHostLayer = () =>
+  Layer.effect(BrowserRunProtectedHost)(
+    Effect.gen(function* () {
+      const binding = yield* BrowserRunProtectedBinding;
+      const lifecycle = yield* BrowserRunSessionLifecycle;
+      const crypto = yield* Crypto.Crypto;
+
+      const open = Effect.fn("BrowserRunProtectedHost.open")(function* (
+        input: InteractiveBrowserPolicy,
+        checkpoint?: BrowserRunProtectedCheckpoint,
+      ): Effect.fn.Return<
+        BrowserRunProtectedSession,
+        ProtectedBrowserError,
+        Scope.Scope | BrowserCredentialAccess
+      > {
+        const policy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(
+          Effect.mapError(() => failure("denied")),
+        );
+
+        if (policy.network._tag !== "Unrestricted") return yield* failure("unsupported");
+
+        const remaining =
+          policy.maxElapsedMillis -
+          ((yield* Clock.currentTimeMillis) -
+            (checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis)));
+
+        if (
+          remaining <= 0 ||
+          (checkpoint !== undefined &&
+            checkpoint.protected.startedAt > (yield* Clock.currentTimeMillis))
+        )
+          return yield* failure("timeout");
+        if (checkpoint !== undefined && checkpoint.protected.actions > policy.maxActions)
+          return yield* failure("denied");
+        const provider = yield* binding.open(policy, checkpoint);
+
+        const state = yield* makeProtectedBrowserPolicy(policy, checkpoint?.protected).pipe(
+          Effect.provideService(BrowserRunProtectedTransport, {
+            open: () => Effect.succeed({ ...provider.driver, detach: provider.detach }),
+          }),
+          Effect.provideService(Crypto.Crypto, crypto),
+        );
+
+        const lock = yield* Semaphore.make(1);
+        let handoff = checkpoint;
+        let detached = false;
+
+        const control = <A>(effect: Effect.Effect<A, ProtectedBrowserError>) =>
+          lock
+            .withPermitsIfAvailable(1)(
+              Effect.suspend(() => (detached ? Effect.fail(failure("closed")) : effect)),
+            )
+            .pipe(Effect.flatMap(Effect.fromOption(() => failure("busy"))));
+
+        const fits = (millis: number) =>
+          Effect.gen(function* () {
+            const started = handoff?.protected.startedAt ?? startedAt;
+
+            if (millis > policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started))
+              return yield* failure("timeout");
+          });
+
+        const startedAt = checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis);
+
+        const getHandoffState = Effect.gen(function* () {
+          if (handoff?.handoffId === undefined) return yield* failure("denied");
+          yield* fits(0);
+          const raw = yield* provider.command("Cloudflare.getHandoffState", {});
+
+          const result = yield* Schema.decodeUnknownEffect(HandoffState)(raw).pipe(
+            Effect.mapError(() => failure("provider")),
+          );
+
+          if (
+            (result.active && result.handoffId === undefined) ||
+            (result.handoffId !== undefined &&
+              result.handoffId !== Redacted.value(handoff.handoffId))
+          )
+            return yield* failure("denied");
+
+          return BrowserRunHandoffState.make({
+            active: result.active,
+            ...(result.durationMs === undefined ? {} : { durationMs: result.durationMs }),
+            ...(result.handoffId === undefined
+              ? {}
+              : { handoffId: Redacted.make(result.handoffId) }),
+          });
+        });
+
+        return {
+          handle: state.handle,
+          sessionId: provider.identity.sessionId,
+          suspend: control(
+            Effect.gen(function* () {
+              if (handoff !== undefined) {
+                yield* state.suspend();
+
+                return handoff;
+              }
+              const suspended = yield* state.suspend();
+
+              handoff = BrowserRunProtectedCheckpoint.make({
+                ...provider.identity,
+                protected: suspended,
+              });
+
+              return handoff;
+            }),
+          ),
+          handoff: (request) =>
+            control(
+              Effect.gen(function* () {
+                if (handoff?.handoffId !== undefined) return yield* failure("busy");
+
+                const decoded = yield* Schema.decodeEffect(BrowserRunHandoffRequest)(request).pipe(
+                  Effect.mapError(() => failure("denied")),
+                );
+
+                yield* fits(decoded.timeout);
+                const suspended = yield* state.suspend(true);
+
+                // An uncertain handoff is never retried; close exactly this provider session.
+                const result = yield* provider
+                  .command("Cloudflare.handoff", {
+                    instructions: decoded.instructions,
+                    timeout: decoded.timeout,
+                  })
+                  .pipe(
+                    Effect.flatMap(Schema.decodeUnknownEffect(Handoff)),
+                    Effect.catch(() =>
+                      state.handle.close.pipe(
+                        Effect.flatMap((cleanup) =>
+                          Effect.fail(
+                            new ProtectedBrowserError({
+                              reason: "outcome-unknown",
+                              dispatch: "possibly-dispatched",
+                              milestone: suspended.milestone,
+                              observation: "closed",
+                              cleanup,
+                            }),
+                          ),
+                        ),
+                      ),
+                    ),
+                    Effect.onInterrupt(() => state.handle.close),
+                  );
+
+                handoff = BrowserRunProtectedCheckpoint.make({
+                  ...provider.identity,
+                  protected: suspended,
+                  handoffId: Redacted.make(result.handoffId),
+                });
+
+                return handoff;
+              }),
+            ),
+          getLiveView: (request) =>
+            control(
+              Effect.gen(function* () {
+                if (handoff?.handoffId === undefined) return yield* failure("denied");
+
+                const decoded = yield* Schema.decodeEffect(BrowserRunLiveViewRequest)(request).pipe(
+                  Effect.mapError(() => failure("denied")),
+                );
+
+                yield* fits(decoded.expiresInMs);
+
+                const raw = yield* provider.command("Cloudflare.getLiveView", {
+                  mode: decoded.mode,
+                  expiresInMs: decoded.expiresInMs,
+                });
+
+                const result = yield* Schema.decodeUnknownEffect(LiveView)(raw).pipe(
+                  Effect.mapError(() => failure("provider")),
+                );
+
+                return yield* Schema.decodeEffect(BrowserRunLiveViewResult)({
+                  devtoolsFrontendUrl: Redacted.make(result.devtoolsFrontendUrl),
+                }).pipe(Effect.mapError(() => failure("provider")));
+              }),
+            ),
+          getHandoffState: control(getHandoffState),
+          getReturnOrigin: control(
+            Effect.gen(function* () {
+              if ((yield* getHandoffState).active) return yield* failure("busy");
+
+              const context = yield* provider.driver.context.pipe(
+                Effect.mapError((error) => failure(error.reason)),
+              );
+
+              return yield* Schema.decodeEffect(CredentialOrigin)(context.topOrigin).pipe(
+                Effect.mapError(() => failure("provider")),
+              );
+            }),
+          ),
+          returnControl: control(
+            Effect.gen(function* () {
+              if ((yield* getHandoffState).active) return yield* failure("busy");
+              yield* state.returnControl;
+              handoff = undefined;
+            }),
+          ),
+          detach: control(
+            Effect.gen(function* () {
+              if (handoff === undefined) return yield* failure("denied");
+              yield* state.detach;
+              detached = true;
+            }),
+          ),
+          close: state.handle.close,
+        };
+      }, Effect.withTracerEnabled(false));
+
+      return {
+        open: (policy: InteractiveBrowserPolicy) => open(policy),
+        resume: (checkpoint: BrowserRunProtectedCheckpoint) =>
+          Schema.decodeEffect(BrowserRunProtectedCheckpoint)(checkpoint).pipe(
+            Effect.mapError(() => failure("denied")),
+            Effect.flatMap((decoded) => open(decoded.protected.policy, decoded)),
+          ),
+        closeSession: (id: Redacted.Redacted<string>) =>
+          lifecycle.close(id).pipe(
+            Effect.as("confirmed" as const),
+            Effect.catchCause(() => Effect.succeed("unconfirmed" as const)),
+          ),
+      };
+    }),
+  );