@f5xc-salesdemos/xcsh 19.43.1 → 19.44.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/xcsh",
-	"version": "19.43.1",
+	"version": "19.44.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -31,11 +31,11 @@
 		"xcsh": "src/cli.ts"
 	},
 	"scripts": {
-		"build": "bun run generate-build-info && bun run generate-api-spec-index && bun run generate-branding-index && bun run generate-terraform-index && bun run generate-console-catalog && test -f src/internal-urls/api-spec-index.generated.ts && bun --cwd=../stats scripts/generate-client-bundle.ts --generate && bun --cwd=../natives run embed:native && bun build --compile --define PI_COMPILED=true --external mupdf --root ../.. ./src/cli.ts --outfile dist/xcsh && bun --cwd=../natives run embed:native --reset && bun --cwd=../stats scripts/generate-client-bundle.ts --reset",
+		"build": "bun run generate-build-info && bun run generate-api-spec-index && bun run generate-branding-index && bun run generate-terraform-index && bun run generate-console-catalog && bun run generate-console-field-metadata && test -f src/internal-urls/api-spec-index.generated.ts && bun --cwd=../stats scripts/generate-client-bundle.ts --generate && bun --cwd=../natives run embed:native && bun build --compile --define PI_COMPILED=true --external mupdf --root ../.. ./src/cli.ts --outfile dist/xcsh && bun --cwd=../natives run embed:native --reset && bun --cwd=../stats scripts/generate-client-bundle.ts --reset",
 		"check": "biome check . && bun run format-prompts -- --check && bun run check:types",
 		"check:types": "bun run generate-build-info && bun run generate-api-spec-index && bun run generate-branding-index && bun run generate-terraform-index && tsgo -p tsconfig.json --noEmit",
 		"lint": "biome lint .",
-		"test": "bun run generate-build-info && bun run generate-api-spec-index && bun run generate-console-catalog && bun test --max-concurrency 4",
+		"test": "bun run generate-build-info && bun run generate-api-spec-index && bun run generate-console-catalog && bun run generate-console-field-metadata && bun test --max-concurrency 4",
 		"fix": "biome check --write --unsafe . && bun run format-prompts && bun run generate-docs-index && bun run generate-api-spec-index && bun run generate-build-info",
 		"fmt": "biome format --write . && bun run format-prompts",
 		"format-prompts": "bun scripts/format-prompts.ts",
@@ -46,19 +46,21 @@
 		"generate-build-info": "bun scripts/generate-build-info.ts",
 		"generate-terraform-index": "bun scripts/generate-terraform-index.ts",
 		"generate-console-catalog": "bun scripts/generate-console-catalog.ts",
-		"prepack": "bun scripts/generate-docs-index.ts && bun scripts/generate-api-spec-index.ts && bun scripts/generate-build-info.ts && bun scripts/generate-terraform-index.ts && bun scripts/generate-console-catalog.ts",
-		"generate-template": "bun scripts/generate-template.ts"
+		"generate-console-field-metadata": "bun scripts/generate-console-field-metadata.ts",
+		"prepack": "bun scripts/generate-docs-index.ts && bun scripts/generate-api-spec-index.ts && bun scripts/generate-build-info.ts && bun scripts/generate-terraform-index.ts && bun scripts/generate-console-catalog.ts && bun scripts/generate-console-field-metadata.ts",
+		"generate-template": "bun scripts/generate-template.ts",
+		"check-workflow-field-coverage": "bun scripts/check-workflow-field-coverage.ts"
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5xc-salesdemos/xcsh-stats": "19.43.1",
-		"@f5xc-salesdemos/pi-agent-core": "19.43.1",
-		"@f5xc-salesdemos/pi-ai": "19.43.1",
-		"@f5xc-salesdemos/pi-natives": "19.43.1",
-		"@f5xc-salesdemos/pi-resource-management": "19.43.1",
-		"@f5xc-salesdemos/pi-tui": "19.43.1",
-		"@f5xc-salesdemos/pi-utils": "19.43.1",
+		"@f5xc-salesdemos/xcsh-stats": "19.44.0",
+		"@f5xc-salesdemos/pi-agent-core": "19.44.0",
+		"@f5xc-salesdemos/pi-ai": "19.44.0",
+		"@f5xc-salesdemos/pi-natives": "19.44.0",
+		"@f5xc-salesdemos/pi-resource-management": "19.44.0",
+		"@f5xc-salesdemos/pi-tui": "19.44.0",
+		"@f5xc-salesdemos/pi-utils": "19.44.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/scripts/capture-ax-fixture.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 // One-shot capture: login + open the HTTP-LB create form + snapshot the accessibility tree.
-// Creds via env (KC_USER/KC_PASS); never hard-coded. Output is the resolver's test oracle.
+// Creds via env (F5XC_USERNAME/F5XC_CONSOLE_PASSWORD); never hard-coded. Output is the resolver's test oracle.
 import puppeteer from "puppeteer";
 
 const CHROME = process.env.CHROME_PATH;
@@ -18,8 +18,8 @@ try {
 	await page.goto(BASE, { waitUntil: "networkidle2", timeout: 45000 }).catch(() => {});
 	if (/login-staging\.volterra\.us/.test(page.url())) {
 		await page.waitForSelector("#username", { timeout: 20000 });
-		await page.type("#username", process.env.KC_USER ?? "");
-		await page.type("#password", process.env.KC_PASS ?? "");
+		await page.type("#username", process.env.F5XC_USERNAME ?? "");
+		await page.type("#password", process.env.F5XC_CONSOLE_PASSWORD ?? "");
 		await Promise.all([
 			page.waitForNavigation({ waitUntil: "networkidle2", timeout: 45000 }).catch(() => {}),
 			page.click("#kc-login").catch(() => page.keyboard.press("Enter")),

package/scripts/check-workflow-field-coverage.ts

@@ -0,0 +1,101 @@
+#!/usr/bin/env bun
+// scripts/check-workflow-field-coverage.ts
+//
+// Cross-checks every console `create` workflow against the authoritative
+// required-field registry (console_field_metadata, embedded). For each required
+// field it reports whether the create workflow ADDRESSES it (a fill/select step
+// whose selector or context names the field) or relies on a console DEFAULT —
+// and flags GAPS (required, no default, not addressed) and AMBIGUOUS selectors
+// (addressed only by a bare role like `textbox`, which grabs the wrong input on
+// multi-field forms — exactly the http-lb "Domains is required" bug).
+//
+// Reports per-resource. Exit 1 if any GAP (so CI surfaces missing required-field
+// coverage); ambiguous selectors are warnings only.
+
+import { parse as parseYaml } from "yaml";
+import { CONSOLE_CATALOG_DATA } from "../src/internal-urls/console-catalog.generated";
+import { CONSOLE_FIELD_METADATA } from "../src/internal-urls/console-field-metadata.generated";
+import type { ConsoleFieldMeta } from "../src/internal-urls/console-field-metadata-types";
+
+const norm = (s: string) => s.toLowerCase().replace(/[-_\s]+/g, "");
+
+interface Step {
+	action?: string;
+	selector?: string;
+	context?: string;
+	value?: string;
+	then?: Step[];
+}
+function flatten(steps: Step[]): Step[] {
+	const out: Step[] = [];
+	for (const s of steps) {
+		out.push(s);
+		if (Array.isArray(s.then)) out.push(...flatten(s.then));
+	}
+	return out;
+}
+
+/** Does any fill/select step explicitly name this field's label/section? */
+function addressedBy(steps: Step[], label: string, section: string | undefined): "named" | "ambiguous" | "no" {
+	const nlabel = norm(label);
+	const nsection = section ? norm(section) : "";
+	const inputs = steps.filter(s => s.action === "fill" || s.action === "select");
+	let ambiguous = false;
+	for (const s of inputs) {
+		const sel = s.selector ?? "";
+		const ctx = s.context ?? "";
+		// Extract the value of any [name='X'] / :text('X') / [name="X"] in the selector.
+		const targets = [...sel.matchAll(/name=['"]([^'"]*)['"]|text\(['"]([^'"]*)['"]\)/g)].map(m =>
+			norm(m[1] ?? m[2] ?? ""),
+		);
+		const named =
+			targets.some(t => t === nlabel || (t.length > 0 && (t.includes(nlabel) || nlabel.includes(t)))) ||
+			norm(ctx).includes(nlabel) ||
+			(nsection !== "" && norm(ctx).includes(nsection));
+		if (named) return "named";
+		// bare role selector (textbox / listbox / spinbutton with no [name=…]) → ambiguous
+		if (/^(textbox|listbox|spinbutton|combobox|checkbox)$/i.test(sel.trim())) ambiguous = true;
+	}
+	return ambiguous ? "ambiguous" : "no";
+}
+
+let gaps = 0;
+let warns = 0;
+const resources = Object.keys(CONSOLE_CATALOG_DATA.resources).sort();
+console.log("# Console create-workflow required-field coverage\n");
+
+for (const id of resources) {
+	const createRaw = CONSOLE_CATALOG_DATA.workflows[`${id}/create`];
+	if (!createRaw) continue;
+	const resourceDoc = parseYaml(CONSOLE_CATALOG_DATA.resources[id] ?? "") as { api?: { kind?: string } };
+	const kind = resourceDoc?.api?.kind;
+	const fields = (kind && CONSOLE_FIELD_METADATA.resources[kind]) || undefined;
+	if (!fields) continue;
+	const required = Object.entries(fields).filter(([, m]) => (m as ConsoleFieldMeta).required === true);
+	if (required.length === 0) continue;
+
+	const steps = flatten((parseYaml(createRaw) as { steps?: Step[] })?.steps ?? []);
+	const rows: string[] = [];
+	for (const [apiField, raw] of required) {
+		const m = raw as ConsoleFieldMeta;
+		const label = m.label ?? apiField;
+		const how = addressedBy(steps, label, m.form_section);
+		const hasDefault = m.default !== undefined && m.default !== "" && m.default !== 0;
+		let mark: string;
+		if (how === "named") mark = "✅ filled by a named step";
+		else if (hasDefault) mark = `✅ relies on default (${JSON.stringify(m.default)})`;
+		else if (how === "ambiguous") {
+			mark = "⚠️ only a BARE selector (e.g. `textbox`) targets this — ambiguous on multi-field forms";
+			warns++;
+		} else {
+			mark = "❌ GAP: required, no default, no step fills it";
+			gaps++;
+		}
+		rows.push(`  - **${label}** (\`${apiField}\`): ${mark}`);
+	}
+	console.log(`## ${id} (${kind})`);
+	console.log(rows.join("\n"), "\n");
+}
+
+console.log(`\n---\nGaps: ${gaps}  Ambiguous-selector warnings: ${warns}`);
+process.exit(gaps > 0 ? 1 : 0);

package/scripts/extension-uat-harness.ts

@@ -69,15 +69,19 @@ async function run() {
 	}
 
 	console.log("[1b] login (native F5 XC auth)");
-	const KC_USER = process.env.KC_USER;
-	const KC_PASS = process.env.KC_PASS;
-	if (KC_USER && KC_PASS) {
+	const F5XC_USERNAME = process.env.F5XC_USERNAME;
+	const F5XC_CONSOLE_PASSWORD = process.env.F5XC_CONSOLE_PASSWORD;
+	if (F5XC_USERNAME && F5XC_CONSOLE_PASSWORD) {
 		try {
 			// Login directly to the target deep-link — NOT /web. Going to /web triggers
 			// an OIDC flow, then the subsequent navigate to the LB URL interrupts it
 			// mid-flight → "Invalid CSRF token". Logging into the target URL directly
 			// means ONE navigation, one OIDC flow, no interruption.
-			const l = await tool("login", { email: KC_USER, password: KC_PASS, consoleUrl: ROUTE }, 90000);
+			const l = await tool(
+				"login",
+				{ email: F5XC_USERNAME, password: F5XC_CONSOLE_PASSWORD, consoleUrl: ROUTE },
+				90000,
+			);
 			(l as any)?.loggedIn
 				? pass("login", `${(l as any).steps?.length ?? 0} redirect steps: ${((l as any).steps || []).join(" | ")}`)
 				: fail("login", JSON.stringify(l));
@@ -85,11 +89,11 @@ async function run() {
 			fail("login", (e as Error).message);
 		}
 	} else {
-		console.log("  ⏭ login skipped (no KC_USER/KC_PASS env) — relying on existing session");
+		console.log("  ⏭ login skipped (no F5XC_USERNAME/F5XC_CONSOLE_PASSWORD env) — relying on existing session");
 	}
 
 	console.log("[2] navigate");
-	if (KC_USER && KC_PASS) {
+	if (F5XC_USERNAME && F5XC_CONSOLE_PASSWORD) {
 		// Login already navigated to ROUTE — skip the redundant second navigate
 		// (two navigations to the same OIDC-protected URL in succession → CSRF).
 		pass("navigate", "skipped (login already navigated to target)");

package/scripts/generate-console-field-metadata.ts

@@ -0,0 +1,74 @@
+#!/usr/bin/env bun
+// scripts/generate-console-field-metadata.ts
+//
+// Embeds the console field-requirements registry from the authoritative source
+// (api-specs-enriched/config/console_field_metadata.yaml) into
+// src/internal-urls/console-field-metadata.generated.ts. Mirrors the source
+// resolution of generate-api-spec-index.ts (env override → sibling checkout).
+// The registry is what `xcsh://console/<resource>` surfaces so the agent knows
+// each form's required fields + constraints before driving a create workflow.
+//
+// If api-specs-enriched is missing/incorrect field metadata, fix it UPSTREAM
+// there and re-run this — never hand-edit the generated file or patch downstream.
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
+
+const repoRoot = path.resolve(import.meta.dir, "..");
+const outputPath = path.join(repoRoot, "src/internal-urls/console-field-metadata.generated.ts");
+
+/** Resolve the console_field_metadata.yaml path from api-specs-enriched. */
+function resolveMetadataFile(): string | null {
+	const candidates = [
+		process.env.API_SPECS_ENRICHED_DIR &&
+			path.join(process.env.API_SPECS_ENRICHED_DIR, "config/console_field_metadata.yaml"),
+		// Local sibling checkout: <workspace>/api-specs-enriched
+		path.resolve(repoRoot, "../../../api-specs-enriched/config/console_field_metadata.yaml"),
+		path.resolve(repoRoot, "../../../../api-specs-enriched/config/console_field_metadata.yaml"),
+	].filter(Boolean) as string[];
+	for (const c of candidates) {
+		if (fs.existsSync(c)) return c;
+	}
+	return null;
+}
+
+function build(): { version: string; resources: Record<string, Record<string, unknown>> } {
+	const file = resolveMetadataFile();
+	if (!file) {
+		console.warn("api-specs-enriched console_field_metadata.yaml not found; emitting empty registry");
+		return { version: "unavailable", resources: {} };
+	}
+	const doc = (parseYaml(fs.readFileSync(file, "utf-8")) ?? {}) as {
+		version?: string;
+		resources?: Record<string, Record<string, unknown> | null>;
+	};
+	const resources: Record<string, Record<string, unknown>> = {};
+	for (const [kind, fields] of Object.entries(doc.resources ?? {})) {
+		if (fields && typeof fields === "object") resources[kind] = fields as Record<string, unknown>;
+	}
+	const version = process.env.API_SPECS_ENRICHED_VERSION ?? doc.version ?? "local";
+	return { version, resources };
+}
+
+const data = build();
+
+// Keep the committed registry if the source wasn't found and a file already exists.
+if (data.version === "unavailable" && fs.existsSync(outputPath)) {
+	console.log("console field metadata source not found; keeping existing generated module");
+	process.exit(0);
+}
+
+const output = [
+	"// Auto-generated by scripts/generate-console-field-metadata.ts - DO NOT EDIT",
+	"// Source of truth: api-specs-enriched/config/console_field_metadata.yaml",
+	"",
+	`import type { ConsoleFieldMetadataData } from "./console-field-metadata-types";`,
+	"",
+	`export const CONSOLE_FIELD_METADATA: ConsoleFieldMetadataData = ${JSON.stringify(data, null, 2)};`,
+	"",
+].join("\n");
+
+await Bun.write(outputPath, output);
+const total = Object.values(data.resources).reduce((n, f) => n + Object.keys(f).length, 0);
+console.log(`Wrote ${outputPath} (resources=${Object.keys(data.resources).length}, fields=${total})`);

package/scripts/uat-matrix.ts

@@ -13,7 +13,7 @@
  *        [--filter <regex over phrase ids>] [--no-cleanup] [--cleanup-only]
  *        [--dry-run] [--self-test-api] [--strict-nl] [--report-dir <dir>]
  *
- * Env: F5XC_API_URL, F5XC_API_TOKEN, KC_USER, KC_PASS, CONSOLE_NAMESPACE=demo,
+ * Env: F5XC_API_URL, F5XC_API_TOKEN, F5XC_USERNAME, F5XC_CONSOLE_PASSWORD, F5XC_NAMESPACE=demo,
  *      XCSH_BIN=xcsh
  */
 import * as fs from "node:fs";
@@ -124,7 +124,7 @@ function cfgFromEnv(args: Args): MatrixConfig {
 		xcshBin: process.env.XCSH_BIN ?? "xcsh",
 		apiUrl: process.env.F5XC_API_URL ?? "https://nferreira.staging.volterra.us",
 		apiToken: process.env.F5XC_API_TOKEN ?? "",
-		consoleNamespace: process.env.CONSOLE_NAMESPACE ?? "demo",
+		consoleNamespace: process.env.F5XC_NAMESPACE ?? "demo",
 		tenant: (process.env.F5XC_API_URL ?? "https://nferreira.staging.volterra.us")
 			.replace(/^https?:\/\//, "")
 			.split(".")[0]!,
@@ -152,17 +152,21 @@ async function ensureExtensionConnectedAndLogin(cfg: MatrixConfig): Promise<void
 			);
 		}
 		console.log("[console] extension connected ✅");
-		const KC_USER = process.env.KC_USER;
-		const KC_PASS = process.env.KC_PASS;
-		if (KC_USER && KC_PASS) {
+		const F5XC_USERNAME = process.env.F5XC_USERNAME;
+		const F5XC_CONSOLE_PASSWORD = process.env.F5XC_CONSOLE_PASSWORD;
+		if (F5XC_USERNAME && F5XC_CONSOLE_PASSWORD) {
 			const route = `${cfg.apiUrl}/web/workspaces/web-app-and-api-protection/namespaces/${cfg.consoleNamespace}/manage/load_balancers/http_loadbalancers`;
 			console.log("[console] establishing session via login tool...");
-			const r = await server.request("login", { email: KC_USER, password: KC_PASS, consoleUrl: route }, 160_000);
+			const r = await server.request(
+				"login",
+				{ email: F5XC_USERNAME, password: F5XC_CONSOLE_PASSWORD, consoleUrl: route },
+				160_000,
+			);
 			if (r.is_error || !(r.content as any)?.loggedIn)
 				throw new Error(`login failed: ${JSON.stringify(r.content).slice(0, 160)}`);
 			console.log("[console] logged in ✅ (session persists across xcsh runs)");
 		} else {
-			console.log("[console] no KC_USER/KC_PASS — relying on an existing Chrome session");
+			console.log("[console] no F5XC_USERNAME/F5XC_CONSOLE_PASSWORD — relying on an existing Chrome session");
 		}
 	} finally {
 		// Release the socket so each `xcsh --print` can own it (the extension reconnects via its alarm).

package/src/browser/extension-page-actions.ts

@@ -20,8 +20,6 @@
  * health-check via form → delete via kebab → verify) which used javascript_tool
  * + click_xy/type_text to bypass the read_ax freeze.
  */
-import * as fs from "node:fs";
-import * as path from "node:path";
 import type { ExtensionPage } from "./extension-provider";
 import type { PageActions } from "./page-actions";
 
@@ -63,35 +61,72 @@ function roleToSelector(role){
     default:return'[role='+role+']';
   }
 }
+function isVisible(e){
+  if(!e||!e.getBoundingClientRect)return false;
+  const r=e.getBoundingClientRect();
+  if(r.width===0&&r.height===0)return false;
+  // offsetParent is null for display:none (and position:fixed, hence the rect check above).
+  return e.offsetParent!==null||r.width>0||r.height>0;
+}
 function findByText(text,roleSel){
-  const candidates=roleSel?[...document.querySelectorAll(roleSel)]:[...document.querySelectorAll('*')];
-  const norm=t=>t.replace(/\\s+/g,' ').trim();
+  const all=roleSel?[...document.querySelectorAll(roleSel)]:[...document.querySelectorAll('*')];
+  const norm=t=>t.replace(/\\u0421/g,'C').replace(/\\s+/g,' ').trim();
   const want=norm(text);
-  return candidates.find(e=>{const n=norm(e.textContent||'');return n===want||n.includes(want);});
+  // Match by text FIRST (cheap, no layout), then prefer a VISIBLE match — a
+  // hidden/template duplicate (e.g. an off-screen 'Delete' button) resolves to
+  // rect 0,0 and the trusted click misses. Computing visibility only on the few
+  // text matches avoids forcing a full-page reflow per call.
+  const exact=all.filter(e=>norm(e.textContent||'')===want);
+  if(exact.length)return exact.find(isVisible)||exact[0];
+  const sub=all.filter(e=>norm(e.textContent||'').includes(want));
+  return sub.find(isVisible)||sub[0];
 }
 function findByRoleName(role,name){
   const roleSel=roleToSelector(role);
   const candidates=[...document.querySelectorAll(roleSel)];
   const norm=t=>t.replace(/\\s+/g,' ').trim();
   const want=norm(name);
-  return candidates.find(e=>{
+  const byAttr=candidates.filter(e=>{
     const n=norm(e.getAttribute('aria-label')||e.getAttribute('name')||e.getAttribute('placeholder')||e.textContent||'');
     return n===want||n.includes(want);
-  })||(role==='textbox'?candidates.find(e=>{
-    const lbl=(e.closest('[class*=form-group],[class*=field],.row')||{}).textContent||'';
-    return norm(lbl).includes(want);
-  }):null);
+  });
+  if(byAttr.length)return byAttr.find(isVisible)||byAttr[0];
+  if(role==='textbox'){
+    const byLabel=candidates.filter(e=>norm((e.closest('[class*=form-group],[class*=field],.row')||{}).textContent||'').includes(want));
+    return byLabel.find(isVisible)||byLabel[0]||null;
+  }
+  return null;
+}
+// Row-scoping: "row:has-text('NAME') >> <subSelector>" finds the table row
+// containing NAME, then resolves <subSelector> WITHIN that row. Essential for
+// per-row actions (kebab/Delete) when a list has many rows.
+function findInScope(s){
+  const textM=s.match(/^text\\('([^']*)'\\)$/);
+  const roleTextM=s.match(/^([a-z]+):text\\('([^']*)'\\)$/);
+  const roleNameM=s.match(/^([a-z]+)\\[name='([^']*)'\\]$/);
+  const bareRoleM=s.match(/^[a-z]+$/);
+  if(textM)return findByText(textM[1]);
+  if(roleTextM)return findByText(roleTextM[2],roleToSelector(roleTextM[1]));
+  if(roleNameM)return findByRoleName(roleNameM[1],roleNameM[2]);
+  if(bareRoleM){const c=[...document.querySelectorAll(roleToSelector(s))].filter(isVisible);return c[0]||document.querySelector(roleToSelector(s));}
+  {const c=[...document.querySelectorAll(s)].filter(isVisible);return c[0]||document.querySelector(s);}
 }
 let el=null;
-const textM=sel.match(/^text\\('([^']*)'\\)$/);
-const roleTextM=sel.match(/^([a-z]+):text\\('([^']*)'\\)$/);
-const roleNameM=sel.match(/^([a-z]+)\\[name='([^']*)'\\]$/);
-const bareRoleM=sel.match(/^[a-z]+$/);
-if(textM){el=findByText(textM[1]);}
-else if(roleTextM){el=findByText(roleTextM[2],roleToSelector(roleTextM[1]));}
-else if(roleNameM){el=findByRoleName(roleNameM[1],roleNameM[2]);}
-else if(bareRoleM){el=document.querySelector(roleToSelector(sel));}
-else{el=document.querySelector(sel);}
+if(sel.includes('>>')){
+  const parts=sel.split('>>').map(p=>p.trim());
+  const rowM=parts[0].match(/^row:has-text\\('([^']*)'\\)$/);
+  const want=rowM?rowM[1].replace(/\\u0421/g,'C'):'';
+  const rows=[...document.querySelectorAll('tr,[role=row],datatable-body-row')];
+  const row=rows.find(r=>(r.textContent||'').replace(/\\u0421/g,'C').includes(want));
+  if(!row)return JSON.stringify({found:false,error:'no row matching '+parts[0]});
+  // resolve the sub-selector within the row
+  const subTextM=parts[1].match(/^([a-z]+):text\\('([^']*)'\\)$/);
+  if(subTextM){const want2=subTextM[2];const cs=[...row.querySelectorAll(roleToSelector(subTextM[1]))].filter(isVisible);const nm=t=>t.replace(/\\s+/g,' ').trim();el=cs.find(e=>nm(e.textContent||'')===want2)||cs.find(e=>nm(e.textContent||'').includes(want2));}
+  else{const cs=[...row.querySelectorAll(parts[1])].filter(isVisible);el=cs[0]||row.querySelector(parts[1]);}
+  if(!el)return JSON.stringify({found:false,error:'sub-selector '+parts[1]+' not found in row'});
+}else{
+  el=findInScope(sel);
+}
 if(!el)return JSON.stringify({found:false,error:'no match for '+sel});
 el.scrollIntoView({block:'center',inline:'center'});
 const r=el.getBoundingClientRect();
@@ -99,10 +134,22 @@ return JSON.stringify({found:true,x:Math.round(r.x+r.width/2),y:Math.round(r.y+r
 })()`;
 }
 
+/**
+ * Run a `javascript_tool` snippet whose body returns a JSON string, and parse it.
+ * The bridge's `javascript_tool` wraps the evaluated value as `{ result: <value> }`,
+ * so unwrap `.result` first; tolerate either the wrapper, a bare string, or a bare
+ * object so this works against the real BridgeExtensionPage AND test doubles.
+ */
+async function evalJson(ext: ExtensionPage, code: string): Promise<any> {
+	const raw = await ext.javascriptTool(code);
+	const payload =
+		raw && typeof raw === "object" && "result" in (raw as object) ? (raw as { result: unknown }).result : raw;
+	return typeof payload === "string" ? JSON.parse(payload) : payload;
+}
+
 /** Resolve a selector to viewport-center coords via `javascript_tool`. */
 async function resolveCoords(ext: ExtensionPage, selector: string): Promise<{ x: number; y: number }> {
-	const raw = await ext.javascriptTool(buildResolverScript(selector));
-	const result = typeof raw === "string" ? JSON.parse(raw) : raw;
+	const result = await evalJson(ext, buildResolverScript(selector));
 	if (!result?.found) {
 		throw new Error(`selector "${selector}" not found in the page: ${result?.error ?? "no match"}`);
 	}
@@ -122,7 +169,7 @@ function buildFillScript(selector: string, value: string): string {
 	return `(()=>{
 const sel=${sel};
 function roleToSel(r){const m={button:'button,input[type=button],input[type=submit],[role=button]',link:'a[href],[role=link]',tab:'[role=tab]',textbox:'input:not([type=checkbox]):not([type=radio]):not([type=submit]):not([type=button]),textarea,[role=textbox]',spinbutton:'input[type=number],[role=spinbutton]',checkbox:'input[type=checkbox],[role=checkbox]',combobox:'select,[role=combobox]',listbox:'[role=listbox],select',option:'[role=option],option',heading:'h1,h2,h3,h4,h5,h6,[role=heading]'};return m[r]||'[role='+r+']';}
-function norm(t){return t.replace(/\\s+/g,' ').trim();}
+function norm(t){return t.replace(/\\u0421/g,'C').replace(/\\s+/g,' ').trim();}
 function findText(text,rSel){return(rSel?[...document.querySelectorAll(rSel)]:[...document.querySelectorAll('*')]).find(e=>{const n=norm(e.textContent||'');return n===norm(text)||n.includes(norm(text));});}
 function findRoleName(role,name){const cs=[...document.querySelectorAll(roleToSel(role))];const w=norm(name);return cs.find(e=>norm(e.getAttribute('aria-label')||e.getAttribute('name')||e.getAttribute('placeholder')||e.textContent||'').includes(w))||(role==='textbox'?cs.find(e=>norm((e.closest('[class*=form-group],[class*=field],.row')||{}).textContent||'').includes(w)):null);}
 let el=null;
@@ -156,27 +203,61 @@ export class ExtensionPageActions implements PageActions {
 	}
 
 	async click(selector: string, _context?: string): Promise<void> {
+		// Brief settle before the trusted click: dialogs/overlays/menus animate in,
+		// and a click landing mid-transition misses. resolveCoords already scrolled
+		// the element into view; a short pause lets the transition finish. (The
+		// deterministic driver slept between steps, which is why it clicked reliably
+		// where the back-to-back runner missed the confirm button.)
 		const { x, y } = await resolveCoords(this.#ext, selector);
+		await new Promise(r => setTimeout(r, 300));
 		await this.#ext.clickXy(x, y);
 	}
 
 	async fill(selector: string, value: string, _context?: string): Promise<void> {
-		const raw = await this.#ext.javascriptTool(buildFillScript(selector, value));
-		const result = typeof raw === "string" ? JSON.parse(raw) : raw;
+		const result = await evalJson(this.#ext, buildFillScript(selector, value));
 		if (!result?.filled) {
 			throw new Error(`fill("${selector}"): ${result?.error ?? "could not set value"}`);
 		}
 	}
 
 	async selectOption(selector: string, value: string, _context?: string): Promise<void> {
-		// Open the dropdown / listbox via a trusted click.
-		const { x, y } = await resolveCoords(this.#ext, selector);
-		await this.#ext.clickXy(x, y);
-		// Wait briefly for the dropdown to render.
+		// F5 XC vsui listboxes are <input role="listbox"> — clicking opens the
+		// panel, and typing FILTERS the options (the target option often isn't in
+		// the initial set). So: focus → type to filter → click the matching option.
+		// Bound every sub-step so a frozen/blocking dropdown can never hang the whole
+		// workflow — the option set may load async, and many selects have a sensible
+		// default, so option selection is best-effort.
+		const withTimeout = <R>(p: Promise<R>, ms: number, label: string): Promise<R> =>
+			Promise.race([
+				p,
+				new Promise<R>((_, rej) =>
+					setTimeout(() => rej(new Error(`selectOption ${label} timed out after ${ms}ms`)), ms),
+				),
+			]);
+		// Click the listbox to open it — do NOT type into it. The vsui listbox
+		// dropdowns are <input role="listbox"> but typing filter text corrupts the
+		// display ("HTTPS with Automatic Ceruat-lbr...", "BlockingMonitoring").
+		// All options appear on click; the option is clicked directly below.
+		const resolved = await withTimeout(evalJson(this.#ext, buildResolverScript(selector)), 10_000, "resolve-listbox");
+		if (!resolved?.found) throw new Error(`selectOption: selector "${selector}" not found`);
+		await withTimeout(this.#ext.clickXy(resolved.x, resolved.y), 10_000, "click-listbox");
 		await new Promise(r => setTimeout(r, 1200));
-		// Click the option whose text matches value.
-		const optCoords = await resolveCoords(this.#ext, `option:text('${value}')`);
-		await this.#ext.clickXy(optCoords.x, optCoords.y);
+		// Click the option whose text matches value (exact-first via the resolver).
+		// Best-effort: if it never renders, fall through — the default value usually
+		// already applies, and a hard failure here would block create flows.
+		try {
+			const optCoords = await withTimeout(
+				resolveCoords(this.#ext, `option:text('${value}')`),
+				10_000,
+				"resolve-option",
+			);
+			await withTimeout(this.#ext.clickXy(optCoords.x, optCoords.y), 10_000, "click-option");
+			await new Promise(r => setTimeout(r, 600));
+		} catch {
+			// Option not selectable (already default, or non-standard widget) — press
+			// Escape to dismiss any open overlay and continue.
+			await this.#ext.keyPress("Escape").catch(() => {});
+		}
 	}
 
 	async scrollIntoView(selector: string, _context?: string): Promise<void> {
@@ -188,28 +269,40 @@ export class ExtensionPageActions implements PageActions {
 		await this.#ext.keyPress(key);
 	}
 
-	async assertText(selector: string, expected: string, context?: string): Promise<void> {
-		await this.#ext.assertText(selector, expected, context);
+	async assertText(selector: string, expected: string, _context?: string): Promise<void> {
+		// Use javascript_tool to check text presence (avoids read_ax freeze).
+		const result = await evalJson(this.#ext, buildResolverScript(selector));
+		if (!result?.found) throw new Error(`assertText: selector "${selector}" not found`);
+		const txt = result.txt ?? "";
+		if (!txt.includes(expected)) {
+			throw new Error(`assertText: expected "${expected}" not found in "${txt}"`);
+		}
 	}
 
-	async waitFor(selector: string, context?: string, timeoutMs?: number): Promise<void> {
-		await this.#ext.waitFor(selector, context, timeoutMs);
+	async waitFor(selector: string, _context?: string, timeoutMs?: number): Promise<void> {
+		// Poll via javascript_tool (not read_ax, which freezes on heavy forms).
+		const ms = timeoutMs ?? 30_000;
+		const deadline = Date.now() + ms;
+		while (Date.now() < deadline) {
+			try {
+				await resolveCoords(this.#ext, selector);
+				return; // found
+			} catch {
+				await new Promise(r => setTimeout(r, 1000));
+			}
+		}
+		throw new Error(`waitFor "${selector}" timed out after ${ms}ms`);
 	}
 
-	async screenshot(file: string): Promise<void> {
-		const cwdReal = fs.realpathSync(process.cwd());
-		const lexical = path.resolve(file);
-		let parentReal: string;
-		try {
-			parentReal = fs.realpathSync(path.dirname(lexical));
-		} catch {
-			throw new Error(`Screenshot directory does not exist: ${path.dirname(lexical)}`);
-		}
-		const resolved = path.join(parentReal, path.basename(lexical));
-		if (!resolved.startsWith(cwdReal + path.sep) && resolved !== cwdReal) {
-			throw new Error(`Screenshot path "${file}" resolves outside the working directory`);
-		}
-		const b64 = await this.#ext.screenshot();
-		await Bun.write(resolved, Buffer.from(b64, "base64"));
+	// biome-ignore lint/suspicious/useAwait: signature is async (PageActions contract)
+	async screenshot(_file: string): Promise<void> {
+		// Intentionally a no-op for the extension provider. CDP captureScreenshot
+		// transiently FREEZES the MV3 service worker; in observable mode the runner
+		// shoots after EVERY step, so the freeze cascades into the next step's
+		// operations (each then blocking on the 30s bridge timeout) — that is what
+		// hung multi-step flows like delete. The extension provider's whole value is
+		// that the human watches the LIVE Chrome, so per-step PNG artifacts are
+		// redundant. Skipping the capture removes the freeze entirely. (CDP-provider
+		// screenshots are unaffected — this override is extension-only.)
 	}
 }