@fased/fased 0.1.41 → 0.1.43

package/dist/plugin-sdk/runtime-dependency-pUwxUAJp.js

@@ -0,0 +1,2110 @@
+import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
+import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
+import { t as CONFIG_DIR } from "./utils-CYk9EKoq.js";
+import { mr as isErrno, n as loadConfig } from "./config-DKNrb8oT.js";
+import { F as isNotFoundPathError, I as isPathInside } from "./agent-scope-BbgPlhtw.js";
+import { s as resolvePinnedHostnameWithPolicy } from "./ssrf-D_4q0mKh.js";
+import { t as importOptionalRuntimeDependency } from "./optional-runtime-dependency-Bt_3Yigu.js";
+import { n as isLoopbackAddress, r as isLoopbackHost, t as rawDataToString } from "./ws-CxmRDbD9.js";
+import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-DztQeyQe.js";
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
+import fs$1 from "node:fs/promises";
+import { execFileSync, spawn } from "node:child_process";
+import { createHmac } from "node:crypto";
+import { createServer } from "node:http";
+import net from "node:net";
+import WebSocket$1, { WebSocketServer } from "ws";
+
+//#region src/browser/constants.ts
+const DEFAULT_FASED_BROWSER_ENABLED = true;
+const DEFAULT_BROWSER_EVALUATE_ENABLED = true;
+const DEFAULT_FASED_BROWSER_COLOR = "#FF4500";
+const DEFAULT_FASED_BROWSER_PROFILE_NAME = "fased";
+const DEFAULT_BROWSER_DEFAULT_PROFILE_NAME = "chrome";
+const DEFAULT_AI_SNAPSHOT_MAX_CHARS = 8e4;
+const DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS = 1e4;
+const DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH = 6;
+
+//#endregion
+//#region src/browser/extension-relay-auth.ts
+const RELAY_TOKEN_CONTEXT = "fased-extension-relay-v1";
+const DEFAULT_RELAY_PROBE_TIMEOUT_MS = 500;
+const FASED_RELAY_BROWSER = "FasedAgent/extension-relay";
+function resolveGatewayAuthToken() {
+	const envToken = process.env.FASED_GATEWAY_TOKEN?.trim();
+	if (envToken) return envToken;
+	try {
+		const configToken = loadConfig().gateway?.auth?.token?.trim();
+		if (configToken) return configToken;
+	} catch {}
+	return null;
+}
+function deriveRelayAuthToken(gatewayToken, port) {
+	return createHmac("sha256", gatewayToken).update(`${RELAY_TOKEN_CONTEXT}:${port}`).digest("hex");
+}
+function resolveRelayAcceptedTokensForPort(port) {
+	const gatewayToken = resolveGatewayAuthToken();
+	if (!gatewayToken) throw new Error("extension relay requires gateway auth token (set gateway.auth.token or FASED_GATEWAY_TOKEN)");
+	const relayToken = deriveRelayAuthToken(gatewayToken, port);
+	if (relayToken === gatewayToken) return [relayToken];
+	return [relayToken, gatewayToken];
+}
+function resolveRelayAuthTokenForPort(port) {
+	return resolveRelayAcceptedTokensForPort(port)[0];
+}
+async function probeAuthenticatedFasedAgentRelay(params) {
+	const ctrl = new AbortController();
+	const timer = setTimeout(() => ctrl.abort(), params.timeoutMs ?? DEFAULT_RELAY_PROBE_TIMEOUT_MS);
+	try {
+		const versionUrl = new URL("/json/version", `${params.baseUrl}/`).toString();
+		const res = await fetch(versionUrl, {
+			signal: ctrl.signal,
+			headers: { [params.relayAuthHeader]: params.relayAuthToken }
+		});
+		if (!res.ok) return false;
+		const body = await res.json();
+		return (typeof body?.Browser === "string" ? body.Browser.trim() : "") === FASED_RELAY_BROWSER;
+	} catch {
+		return false;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+//#endregion
+//#region src/browser/extension-relay.ts
+const RELAY_AUTH_HEADER = "x-fased-relay-token";
+const DEFAULT_EXTENSION_RECONNECT_GRACE_MS = 5e3;
+const DEFAULT_EXTENSION_COMMAND_RECONNECT_WAIT_MS = 3e3;
+function headerValue(value) {
+	if (!value) return;
+	if (Array.isArray(value)) return value[0];
+	return value;
+}
+function getHeader(req, name) {
+	return headerValue(req.headers[name.toLowerCase()]);
+}
+function getRelayAuthTokenFromRequest(req, url) {
+	const headerToken = getHeader(req, RELAY_AUTH_HEADER)?.trim();
+	if (headerToken) return headerToken;
+	const queryToken = url?.searchParams.get("token")?.trim();
+	if (queryToken) return queryToken;
+}
+function parseUrlPort(parsed) {
+	const port = parsed.port?.trim() !== "" ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : 80;
+	if (!Number.isFinite(port) || port <= 0 || port > 65535) return null;
+	return port;
+}
+function parseBaseUrl(raw) {
+	const parsed = new URL(raw.trim().replace(/\/$/, ""));
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`extension relay cdpUrl must be http(s), got ${parsed.protocol}`);
+	const host = parsed.hostname;
+	const port = parseUrlPort(parsed);
+	if (!port) throw new Error(`extension relay cdpUrl has invalid port: ${parsed.port || "(empty)"}`);
+	return {
+		host,
+		port,
+		baseUrl: parsed.toString().replace(/\/$/, "")
+	};
+}
+function text(res, status, bodyText) {
+	const body = Buffer.from(bodyText);
+	res.write(`HTTP/1.1 ${status} ${status === 200 ? "OK" : "ERR"}\r\nContent-Type: text/plain; charset=utf-8\r
+Content-Length: ${body.length}\r\nConnection: close\r
+\r
+`);
+	res.write(body);
+	res.end();
+}
+function rejectUpgrade(socket, status, bodyText) {
+	text(socket, status, bodyText);
+	try {
+		socket.destroy();
+	} catch {}
+}
+function envMsOrDefault(name, fallback) {
+	const raw = process.env[name];
+	if (!raw || raw.trim() === "") return fallback;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+	return parsed;
+}
+const relayRuntimeByPort = /* @__PURE__ */ new Map();
+const relayInitByPort = /* @__PURE__ */ new Map();
+function isAddrInUseError(err) {
+	return typeof err === "object" && err !== null && "code" in err && err.code === "EADDRINUSE";
+}
+function relayAuthTokenForUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (!isLoopbackHost(parsed.hostname)) return null;
+		const port = parseUrlPort(parsed);
+		if (!port) return null;
+		return relayRuntimeByPort.get(port)?.relayAuthToken ?? null;
+	} catch {
+		return null;
+	}
+}
+function getChromeExtensionRelayAuthHeaders(url) {
+	const token = relayAuthTokenForUrl(url);
+	if (!token) return {};
+	return { [RELAY_AUTH_HEADER]: token };
+}
+async function ensureChromeExtensionRelayServer(opts) {
+	const info = parseBaseUrl(opts.cdpUrl);
+	if (!isLoopbackHost(info.host)) throw new Error(`extension relay requires loopback cdpUrl host (got ${info.host})`);
+	const existing = relayRuntimeByPort.get(info.port);
+	if (existing) return existing.server;
+	const inFlight = relayInitByPort.get(info.port);
+	if (inFlight) return await inFlight;
+	const extensionReconnectGraceMs = envMsOrDefault("FASED_EXTENSION_RELAY_RECONNECT_GRACE_MS", DEFAULT_EXTENSION_RECONNECT_GRACE_MS);
+	const extensionCommandReconnectWaitMs = envMsOrDefault("FASED_EXTENSION_RELAY_COMMAND_RECONNECT_WAIT_MS", DEFAULT_EXTENSION_COMMAND_RECONNECT_WAIT_MS);
+	const initPromise = (async () => {
+		const relayAuthToken = resolveRelayAuthTokenForPort(info.port);
+		const relayAuthTokens = new Set(resolveRelayAcceptedTokensForPort(info.port));
+		let extensionWs = null;
+		const cdpClients = /* @__PURE__ */ new Set();
+		const connectedTargets = /* @__PURE__ */ new Map();
+		const extensionConnected = () => extensionWs?.readyState === WebSocket$1.OPEN;
+		let extensionDisconnectCleanupTimer = null;
+		const extensionReconnectWaiters = /* @__PURE__ */ new Set();
+		const flushExtensionReconnectWaiters = (connected) => {
+			if (extensionReconnectWaiters.size === 0) return;
+			const waiters = Array.from(extensionReconnectWaiters);
+			extensionReconnectWaiters.clear();
+			for (const waiter of waiters) waiter(connected);
+		};
+		const clearExtensionDisconnectCleanupTimer = () => {
+			if (!extensionDisconnectCleanupTimer) return;
+			clearTimeout(extensionDisconnectCleanupTimer);
+			extensionDisconnectCleanupTimer = null;
+		};
+		const closeCdpClientsAfterExtensionDisconnect = () => {
+			connectedTargets.clear();
+			for (const client of cdpClients) try {
+				client.close(1011, "extension disconnected");
+			} catch {}
+			cdpClients.clear();
+			flushExtensionReconnectWaiters(false);
+		};
+		const scheduleExtensionDisconnectCleanup = () => {
+			clearExtensionDisconnectCleanupTimer();
+			extensionDisconnectCleanupTimer = setTimeout(() => {
+				extensionDisconnectCleanupTimer = null;
+				if (extensionConnected()) return;
+				closeCdpClientsAfterExtensionDisconnect();
+			}, extensionReconnectGraceMs);
+		};
+		const waitForExtensionReconnect = async (timeoutMs) => {
+			if (extensionConnected()) return true;
+			return await new Promise((resolve) => {
+				let settled = false;
+				const waiter = (connected) => {
+					if (settled) return;
+					settled = true;
+					clearTimeout(timer);
+					extensionReconnectWaiters.delete(waiter);
+					resolve(connected);
+				};
+				const timer = setTimeout(() => {
+					waiter(false);
+				}, timeoutMs);
+				extensionReconnectWaiters.add(waiter);
+			});
+		};
+		const pendingExtension = /* @__PURE__ */ new Map();
+		let nextExtensionId = 1;
+		const sendToExtension = async (payload) => {
+			const ws = extensionWs;
+			if (!ws || ws.readyState !== WebSocket$1.OPEN) throw new Error("Chrome extension not connected");
+			ws.send(JSON.stringify(payload));
+			return await new Promise((resolve, reject) => {
+				const timer = setTimeout(() => {
+					pendingExtension.delete(payload.id);
+					reject(/* @__PURE__ */ new Error(`extension request timeout: ${payload.params.method}`));
+				}, 3e4);
+				pendingExtension.set(payload.id, {
+					resolve,
+					reject,
+					timer
+				});
+			});
+		};
+		const broadcastToCdpClients = (evt) => {
+			const msg = JSON.stringify(evt);
+			for (const ws of cdpClients) {
+				if (ws.readyState !== WebSocket$1.OPEN) continue;
+				ws.send(msg);
+			}
+		};
+		const sendResponseToCdp = (ws, res) => {
+			if (ws.readyState !== WebSocket$1.OPEN) return;
+			ws.send(JSON.stringify(res));
+		};
+		const ensureTargetEventsForClient = (ws, mode) => {
+			for (const target of connectedTargets.values()) if (mode === "autoAttach") ws.send(JSON.stringify({
+				method: "Target.attachedToTarget",
+				params: {
+					sessionId: target.sessionId,
+					targetInfo: {
+						...target.targetInfo,
+						attached: true
+					},
+					waitingForDebugger: false
+				}
+			}));
+			else ws.send(JSON.stringify({
+				method: "Target.targetCreated",
+				params: { targetInfo: {
+					...target.targetInfo,
+					attached: true
+				} }
+			}));
+		};
+		const routeCdpCommand = async (cmd) => {
+			switch (cmd.method) {
+				case "Browser.getVersion": return {
+					protocolVersion: "1.3",
+					product: "Chrome/FasedAgent-Extension-Relay",
+					revision: "0",
+					userAgent: "FasedAgent-Extension-Relay",
+					jsVersion: "V8"
+				};
+				case "Browser.setDownloadBehavior": return {};
+				case "Target.setAutoAttach":
+				case "Target.setDiscoverTargets": return {};
+				case "Target.getTargets": return { targetInfos: Array.from(connectedTargets.values()).map((t) => ({
+					...t.targetInfo,
+					attached: true
+				})) };
+				case "Target.getTargetInfo": {
+					const params = cmd.params ?? {};
+					const targetId = typeof params.targetId === "string" ? params.targetId : void 0;
+					if (targetId) {
+						for (const t of connectedTargets.values()) if (t.targetId === targetId) return { targetInfo: t.targetInfo };
+					}
+					if (cmd.sessionId && connectedTargets.has(cmd.sessionId)) {
+						const t = connectedTargets.get(cmd.sessionId);
+						if (t) return { targetInfo: t.targetInfo };
+					}
+					return { targetInfo: Array.from(connectedTargets.values())[0]?.targetInfo };
+				}
+				case "Target.attachToTarget": {
+					const params = cmd.params ?? {};
+					const targetId = typeof params.targetId === "string" ? params.targetId : void 0;
+					if (!targetId) throw new Error("targetId required");
+					for (const t of connectedTargets.values()) if (t.targetId === targetId) return { sessionId: t.sessionId };
+					throw new Error("target not found");
+				}
+				default: return await sendToExtension({
+					id: nextExtensionId++,
+					method: "forwardCDPCommand",
+					params: {
+						method: cmd.method,
+						sessionId: cmd.sessionId,
+						params: cmd.params
+					}
+				});
+			}
+		};
+		const server = createServer((req, res) => {
+			const url = new URL(req.url ?? "/", info.baseUrl);
+			const path = url.pathname;
+			const origin = getHeader(req, "origin");
+			const isChromeExtensionOrigin = typeof origin === "string" && origin.startsWith("chrome-extension://");
+			if (isChromeExtensionOrigin && origin) {
+				res.setHeader("Access-Control-Allow-Origin", origin);
+				res.setHeader("Vary", "Origin");
+			}
+			if (req.method === "OPTIONS") {
+				if (origin && !isChromeExtensionOrigin) {
+					res.writeHead(403);
+					res.end("Forbidden");
+					return;
+				}
+				const requestedHeaders = (getHeader(req, "access-control-request-headers") ?? "").split(",").map((header) => header.trim().toLowerCase()).filter((header) => header.length > 0);
+				const allowedHeaders = new Set([
+					"content-type",
+					RELAY_AUTH_HEADER,
+					...requestedHeaders
+				]);
+				res.writeHead(204, {
+					"Access-Control-Allow-Origin": origin ?? "*",
+					"Access-Control-Allow-Methods": "GET, PUT, POST, OPTIONS",
+					"Access-Control-Allow-Headers": Array.from(allowedHeaders).join(", "),
+					"Access-Control-Max-Age": "86400",
+					Vary: "Origin, Access-Control-Request-Headers"
+				});
+				res.end();
+				return;
+			}
+			if (path.startsWith("/json")) {
+				const token = getRelayAuthTokenFromRequest(req, url);
+				if (!token || !relayAuthTokens.has(token)) {
+					res.writeHead(401);
+					res.end("Unauthorized");
+					return;
+				}
+			}
+			if (req.method === "HEAD" && path === "/") {
+				res.writeHead(200);
+				res.end();
+				return;
+			}
+			if (path === "/") {
+				res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+				res.end("OK");
+				return;
+			}
+			if (path === "/extension/status") {
+				res.writeHead(200, { "Content-Type": "application/json" });
+				res.end(JSON.stringify({ connected: extensionConnected() }));
+				return;
+			}
+			const cdpWsUrl = `${`ws://${req.headers.host?.trim() || `${info.host}:${info.port}`}`}/cdp`;
+			if ((path === "/json/version" || path === "/json/version/") && (req.method === "GET" || req.method === "PUT")) {
+				const payload = {
+					Browser: "FasedAgent/extension-relay",
+					"Protocol-Version": "1.3"
+				};
+				if (extensionConnected()) payload.webSocketDebuggerUrl = cdpWsUrl;
+				res.writeHead(200, { "Content-Type": "application/json" });
+				res.end(JSON.stringify(payload));
+				return;
+			}
+			if (new Set([
+				"/json",
+				"/json/",
+				"/json/list",
+				"/json/list/"
+			]).has(path) && (req.method === "GET" || req.method === "PUT")) {
+				const list = Array.from(connectedTargets.values()).map((t) => ({
+					id: t.targetId,
+					type: t.targetInfo.type ?? "page",
+					title: t.targetInfo.title ?? "",
+					description: t.targetInfo.title ?? "",
+					url: t.targetInfo.url ?? "",
+					webSocketDebuggerUrl: cdpWsUrl,
+					devtoolsFrontendUrl: `/devtools/inspector.html?ws=${cdpWsUrl.replace("ws://", "")}`
+				}));
+				res.writeHead(200, { "Content-Type": "application/json" });
+				res.end(JSON.stringify(list));
+				return;
+			}
+			const handleTargetActionRoute = (match, cdpMethod) => {
+				if (!match || req.method !== "GET" && req.method !== "PUT") return false;
+				let targetId = "";
+				try {
+					targetId = decodeURIComponent(match[1] ?? "").trim();
+				} catch {
+					res.writeHead(400);
+					res.end("invalid targetId encoding");
+					return true;
+				}
+				if (!targetId) {
+					res.writeHead(400);
+					res.end("targetId required");
+					return true;
+				}
+				(async () => {
+					try {
+						await sendToExtension({
+							id: nextExtensionId++,
+							method: "forwardCDPCommand",
+							params: {
+								method: cdpMethod,
+								params: { targetId }
+							}
+						});
+					} catch {}
+				})();
+				res.writeHead(200);
+				res.end("OK");
+				return true;
+			};
+			if (handleTargetActionRoute(path.match(/^\/json\/activate\/(.+)$/), "Target.activateTarget")) return;
+			if (handleTargetActionRoute(path.match(/^\/json\/close\/(.+)$/), "Target.closeTarget")) return;
+			res.writeHead(404);
+			res.end("not found");
+		});
+		const wssExtension = new WebSocketServer({ noServer: true });
+		const wssCdp = new WebSocketServer({ noServer: true });
+		server.on("upgrade", (req, socket, head) => {
+			const url = new URL(req.url ?? "/", info.baseUrl);
+			const pathname = url.pathname;
+			const remote = req.socket.remoteAddress;
+			if (!isLoopbackAddress(remote)) {
+				rejectUpgrade(socket, 403, "Forbidden");
+				return;
+			}
+			const origin = headerValue(req.headers.origin);
+			if (origin && !origin.startsWith("chrome-extension://")) {
+				rejectUpgrade(socket, 403, "Forbidden: invalid origin");
+				return;
+			}
+			if (pathname === "/extension") {
+				const token = getRelayAuthTokenFromRequest(req, url);
+				if (!token || !relayAuthTokens.has(token)) {
+					rejectUpgrade(socket, 401, "Unauthorized");
+					return;
+				}
+				if (extensionWs && extensionWs.readyState !== WebSocket$1.OPEN) {
+					try {
+						extensionWs.terminate();
+					} catch {}
+					extensionWs = null;
+				}
+				if (extensionConnected()) {
+					rejectUpgrade(socket, 409, "Extension already connected");
+					return;
+				}
+				wssExtension.handleUpgrade(req, socket, head, (ws) => {
+					wssExtension.emit("connection", ws, req);
+				});
+				return;
+			}
+			if (pathname === "/cdp") {
+				const token = getRelayAuthTokenFromRequest(req, url);
+				if (!token || !relayAuthTokens.has(token)) {
+					rejectUpgrade(socket, 401, "Unauthorized");
+					return;
+				}
+				if (!extensionConnected()) {
+					rejectUpgrade(socket, 503, "Extension not connected");
+					return;
+				}
+				wssCdp.handleUpgrade(req, socket, head, (ws) => {
+					wssCdp.emit("connection", ws, req);
+				});
+				return;
+			}
+			rejectUpgrade(socket, 404, "Not Found");
+		});
+		wssExtension.on("connection", (ws) => {
+			extensionWs = ws;
+			clearExtensionDisconnectCleanupTimer();
+			flushExtensionReconnectWaiters(true);
+			const ping = setInterval(() => {
+				if (ws.readyState !== WebSocket$1.OPEN) return;
+				ws.send(JSON.stringify({ method: "ping" }));
+			}, 5e3);
+			ws.on("message", (data) => {
+				if (extensionWs !== ws) return;
+				let parsed = null;
+				try {
+					parsed = JSON.parse(rawDataToString(data));
+				} catch {
+					return;
+				}
+				if (parsed && typeof parsed === "object" && "id" in parsed && typeof parsed.id === "number") {
+					const pending = pendingExtension.get(parsed.id);
+					if (!pending) return;
+					pendingExtension.delete(parsed.id);
+					clearTimeout(pending.timer);
+					if ("error" in parsed && typeof parsed.error === "string" && parsed.error.trim()) pending.reject(new Error(parsed.error));
+					else pending.resolve(parsed.result);
+					return;
+				}
+				if (parsed && typeof parsed === "object" && "method" in parsed) {
+					if (parsed.method === "pong") return;
+					if (parsed.method !== "forwardCDPEvent") return;
+					const evt = parsed;
+					const method = evt.params?.method;
+					const params = evt.params?.params;
+					const sessionId = evt.params?.sessionId;
+					if (!method || typeof method !== "string") return;
+					if (method === "Target.attachedToTarget") {
+						const attached = params ?? {};
+						if ((attached?.targetInfo?.type ?? "page") !== "page") return;
+						if (attached?.sessionId && attached?.targetInfo?.targetId) {
+							const prev = connectedTargets.get(attached.sessionId);
+							const nextTargetId = attached.targetInfo.targetId;
+							const prevTargetId = prev?.targetId;
+							const changedTarget = Boolean(prev && prevTargetId && prevTargetId !== nextTargetId);
+							connectedTargets.set(attached.sessionId, {
+								sessionId: attached.sessionId,
+								targetId: nextTargetId,
+								targetInfo: attached.targetInfo
+							});
+							if (changedTarget && prevTargetId) broadcastToCdpClients({
+								method: "Target.detachedFromTarget",
+								params: {
+									sessionId: attached.sessionId,
+									targetId: prevTargetId
+								},
+								sessionId: attached.sessionId
+							});
+							if (!prev || changedTarget) broadcastToCdpClients({
+								method,
+								params,
+								sessionId
+							});
+							return;
+						}
+					}
+					if (method === "Target.detachedFromTarget") {
+						const detached = params ?? {};
+						if (detached?.sessionId) connectedTargets.delete(detached.sessionId);
+						broadcastToCdpClients({
+							method,
+							params,
+							sessionId
+						});
+						return;
+					}
+					if (method === "Target.targetInfoChanged") {
+						const targetInfo = (params ?? {})?.targetInfo;
+						const targetId = targetInfo?.targetId;
+						if (targetId && (targetInfo?.type ?? "page") === "page") for (const [sid, target] of connectedTargets) {
+							if (target.targetId !== targetId) continue;
+							connectedTargets.set(sid, {
+								...target,
+								targetInfo: {
+									...target.targetInfo,
+									...targetInfo
+								}
+							});
+						}
+					}
+					broadcastToCdpClients({
+						method,
+						params,
+						sessionId
+					});
+				}
+			});
+			ws.on("close", () => {
+				clearInterval(ping);
+				if (extensionWs !== ws) return;
+				extensionWs = null;
+				for (const [, pending] of pendingExtension) {
+					clearTimeout(pending.timer);
+					pending.reject(/* @__PURE__ */ new Error("extension disconnected"));
+				}
+				pendingExtension.clear();
+				scheduleExtensionDisconnectCleanup();
+			});
+		});
+		wssCdp.on("connection", (ws) => {
+			cdpClients.add(ws);
+			ws.on("message", async (data) => {
+				let cmd = null;
+				try {
+					cmd = JSON.parse(rawDataToString(data));
+				} catch {
+					return;
+				}
+				if (!cmd || typeof cmd !== "object") return;
+				if (typeof cmd.id !== "number" || typeof cmd.method !== "string") return;
+				if (!extensionConnected()) {
+					if (!await waitForExtensionReconnect(extensionCommandReconnectWaitMs) || !extensionConnected()) {
+						sendResponseToCdp(ws, {
+							id: cmd.id,
+							sessionId: cmd.sessionId,
+							error: { message: "Extension not connected" }
+						});
+						return;
+					}
+				}
+				try {
+					const result = await routeCdpCommand(cmd);
+					if (cmd.method === "Target.setAutoAttach" && !cmd.sessionId) ensureTargetEventsForClient(ws, "autoAttach");
+					if (cmd.method === "Target.setDiscoverTargets") {
+						if ((cmd.params ?? {}).discover === true) ensureTargetEventsForClient(ws, "discover");
+					}
+					if (cmd.method === "Target.attachToTarget") {
+						const params = cmd.params ?? {};
+						const targetId = typeof params.targetId === "string" ? params.targetId : void 0;
+						if (targetId) {
+							const target = Array.from(connectedTargets.values()).find((t) => t.targetId === targetId);
+							if (target) ws.send(JSON.stringify({
+								method: "Target.attachedToTarget",
+								params: {
+									sessionId: target.sessionId,
+									targetInfo: {
+										...target.targetInfo,
+										attached: true
+									},
+									waitingForDebugger: false
+								}
+							}));
+						}
+					}
+					sendResponseToCdp(ws, {
+						id: cmd.id,
+						sessionId: cmd.sessionId,
+						result
+					});
+				} catch (err) {
+					sendResponseToCdp(ws, {
+						id: cmd.id,
+						sessionId: cmd.sessionId,
+						error: { message: err instanceof Error ? err.message : String(err) }
+					});
+				}
+			});
+			ws.on("close", () => {
+				cdpClients.delete(ws);
+			});
+		});
+		try {
+			await new Promise((resolve, reject) => {
+				server.listen(info.port, info.host, () => resolve());
+				server.once("error", reject);
+			});
+		} catch (err) {
+			if (isAddrInUseError(err) && await probeAuthenticatedFasedAgentRelay({
+				baseUrl: info.baseUrl,
+				relayAuthHeader: RELAY_AUTH_HEADER,
+				relayAuthToken
+			})) {
+				const existingRelay = {
+					host: info.host,
+					port: info.port,
+					baseUrl: info.baseUrl,
+					cdpWsUrl: `ws://${info.host}:${info.port}/cdp`,
+					extensionConnected: () => false,
+					stop: async () => {
+						relayRuntimeByPort.delete(info.port);
+					}
+				};
+				relayRuntimeByPort.set(info.port, {
+					server: existingRelay,
+					relayAuthToken
+				});
+				return existingRelay;
+			}
+			throw err;
+		}
+		const port = server.address()?.port ?? info.port;
+		const host = info.host;
+		const relay = {
+			host,
+			port,
+			baseUrl: `${new URL(info.baseUrl).protocol}//${host}:${port}`,
+			cdpWsUrl: `ws://${host}:${port}/cdp`,
+			extensionConnected,
+			stop: async () => {
+				relayRuntimeByPort.delete(port);
+				clearExtensionDisconnectCleanupTimer();
+				flushExtensionReconnectWaiters(false);
+				for (const [, pending] of pendingExtension) {
+					clearTimeout(pending.timer);
+					pending.reject(/* @__PURE__ */ new Error("server stopping"));
+				}
+				pendingExtension.clear();
+				try {
+					extensionWs?.close(1001, "server stopping");
+				} catch {}
+				for (const ws of cdpClients) try {
+					ws.close(1001, "server stopping");
+				} catch {}
+				await new Promise((resolve) => {
+					server.close(() => resolve());
+				});
+				wssExtension.close();
+				wssCdp.close();
+			}
+		};
+		relayRuntimeByPort.set(port, {
+			server: relay,
+			relayAuthToken
+		});
+		return relay;
+	})();
+	relayInitByPort.set(info.port, initPromise);
+	try {
+		return await initPromise;
+	} finally {
+		relayInitByPort.delete(info.port);
+	}
+}
+async function stopChromeExtensionRelayServer(opts) {
+	const info = parseBaseUrl(opts.cdpUrl);
+	const existing = relayRuntimeByPort.get(info.port);
+	if (!existing) return false;
+	await existing.server.stop();
+	return true;
+}
+
+//#endregion
+//#region src/browser/cdp.helpers.ts
+function getHeadersWithAuth(url, headers = {}) {
+	const mergedHeaders = {
+		...getChromeExtensionRelayAuthHeaders(url),
+		...headers
+	};
+	try {
+		const parsed = new URL(url);
+		if (Object.keys(mergedHeaders).some((key) => key.toLowerCase() === "authorization")) return mergedHeaders;
+		if (parsed.username || parsed.password) {
+			const auth = Buffer.from(`${parsed.username}:${parsed.password}`).toString("base64");
+			return {
+				...mergedHeaders,
+				Authorization: `Basic ${auth}`
+			};
+		}
+	} catch {}
+	return mergedHeaders;
+}
+function appendCdpPath(cdpUrl, path) {
+	const url = new URL(cdpUrl);
+	url.pathname = `${url.pathname.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
+	return url.toString();
+}
+function createCdpSender(ws) {
+	let nextId = 1;
+	const pending = /* @__PURE__ */ new Map();
+	const send = (method, params, sessionId) => {
+		const id = nextId++;
+		const msg = {
+			id,
+			method,
+			params,
+			sessionId
+		};
+		ws.send(JSON.stringify(msg));
+		return new Promise((resolve, reject) => {
+			pending.set(id, {
+				resolve,
+				reject
+			});
+		});
+	};
+	const closeWithError = (err) => {
+		for (const [, p] of pending) p.reject(err);
+		pending.clear();
+		try {
+			ws.close();
+		} catch {}
+	};
+	ws.on("error", (err) => {
+		closeWithError(err instanceof Error ? err : new Error(String(err)));
+	});
+	ws.on("message", (data) => {
+		try {
+			const parsed = JSON.parse(rawDataToString(data));
+			if (typeof parsed.id !== "number") return;
+			const p = pending.get(parsed.id);
+			if (!p) return;
+			pending.delete(parsed.id);
+			if (parsed.error?.message) {
+				p.reject(new Error(parsed.error.message));
+				return;
+			}
+			p.resolve(parsed.result);
+		} catch {}
+	});
+	ws.on("close", () => {
+		closeWithError(/* @__PURE__ */ new Error("CDP socket closed"));
+	});
+	return {
+		send,
+		closeWithError
+	};
+}
+async function fetchJson(url, timeoutMs = 1500, init) {
+	return await (await fetchChecked(url, timeoutMs, init)).json();
+}
+async function fetchChecked(url, timeoutMs = 1500, init) {
+	const ctrl = new AbortController();
+	const t = setTimeout(ctrl.abort.bind(ctrl), timeoutMs);
+	try {
+		const headers = getHeadersWithAuth(url, init?.headers || {});
+		const res = await fetch(url, {
+			...init,
+			headers,
+			signal: ctrl.signal
+		});
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		return res;
+	} finally {
+		clearTimeout(t);
+	}
+}
+async function fetchOk(url, timeoutMs = 1500, init) {
+	await fetchChecked(url, timeoutMs, init);
+}
+async function withCdpSocket(wsUrl, fn, opts) {
+	const headers = getHeadersWithAuth(wsUrl, opts?.headers ?? {});
+	const ws = new WebSocket$1(wsUrl, {
+		handshakeTimeout: typeof opts?.handshakeTimeoutMs === "number" && Number.isFinite(opts.handshakeTimeoutMs) ? Math.max(1, Math.floor(opts.handshakeTimeoutMs)) : 5e3,
+		...Object.keys(headers).length ? { headers } : {}
+	});
+	const { send, closeWithError } = createCdpSender(ws);
+	const openPromise = new Promise((resolve, reject) => {
+		ws.once("open", () => resolve());
+		ws.once("error", (err) => reject(err));
+		ws.once("close", () => reject(/* @__PURE__ */ new Error("CDP socket closed")));
+	});
+	try {
+		await openPromise;
+	} catch (err) {
+		closeWithError(err instanceof Error ? err : new Error(String(err)));
+		throw err;
+	}
+	try {
+		return await fn(send);
+	} catch (err) {
+		closeWithError(err instanceof Error ? err : new Error(String(err)));
+		throw err;
+	} finally {
+		try {
+			ws.close();
+		} catch {}
+	}
+}
+
+//#endregion
+//#region src/browser/navigation-guard.ts
+const NETWORK_NAVIGATION_PROTOCOLS = new Set(["http:", "https:"]);
+const SAFE_NON_NETWORK_URLS = new Set(["about:blank"]);
+function isAllowedNonNetworkNavigationUrl(parsed) {
+	return SAFE_NON_NETWORK_URLS.has(parsed.href);
+}
+var InvalidBrowserNavigationUrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidBrowserNavigationUrlError";
+	}
+};
+function withBrowserNavigationPolicy(ssrfPolicy) {
+	return ssrfPolicy ? { ssrfPolicy } : {};
+}
+async function assertBrowserNavigationAllowed(opts) {
+	const rawUrl = String(opts.url ?? "").trim();
+	if (!rawUrl) throw new InvalidBrowserNavigationUrlError("url is required");
+	let parsed;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new InvalidBrowserNavigationUrlError(`Invalid URL: ${rawUrl}`);
+	}
+	if (!NETWORK_NAVIGATION_PROTOCOLS.has(parsed.protocol)) {
+		if (isAllowedNonNetworkNavigationUrl(parsed)) return;
+		throw new InvalidBrowserNavigationUrlError(`Navigation blocked: unsupported protocol "${parsed.protocol}"`);
+	}
+	await resolvePinnedHostnameWithPolicy(parsed.hostname, {
+		lookupFn: opts.lookupFn,
+		policy: opts.ssrfPolicy
+	});
+}
+/**
+* Best-effort post-navigation guard for final page URLs.
+* Only validates network URLs (http/https) and about:blank to avoid false
+* positives on browser-internal error pages (e.g. chrome-error://).
+*/
+async function assertBrowserNavigationResultAllowed(opts) {
+	const rawUrl = String(opts.url ?? "").trim();
+	if (!rawUrl) return;
+	let parsed;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		return;
+	}
+	if (NETWORK_NAVIGATION_PROTOCOLS.has(parsed.protocol) || isAllowedNonNetworkNavigationUrl(parsed)) await assertBrowserNavigationAllowed(opts);
+}
+
+//#endregion
+//#region src/browser/cdp.ts
+function normalizeCdpWsUrl(wsUrl, cdpUrl) {
+	const ws = new URL(wsUrl);
+	const cdp = new URL(cdpUrl);
+	if (isLoopbackHost(ws.hostname) && !isLoopbackHost(cdp.hostname)) {
+		ws.hostname = cdp.hostname;
+		const cdpPort = cdp.port || (cdp.protocol === "https:" ? "443" : "80");
+		if (cdpPort) ws.port = cdpPort;
+		ws.protocol = cdp.protocol === "https:" ? "wss:" : "ws:";
+	}
+	if (cdp.protocol === "https:" && ws.protocol === "ws:") ws.protocol = "wss:";
+	if (!ws.username && !ws.password && (cdp.username || cdp.password)) {
+		ws.username = cdp.username;
+		ws.password = cdp.password;
+	}
+	for (const [key, value] of cdp.searchParams.entries()) if (!ws.searchParams.has(key)) ws.searchParams.append(key, value);
+	return ws.toString();
+}
+async function captureScreenshot(opts) {
+	return await withCdpSocket(opts.wsUrl, async (send) => {
+		await send("Page.enable");
+		let clip;
+		if (opts.fullPage) {
+			const metrics = await send("Page.getLayoutMetrics");
+			const size = metrics?.cssContentSize ?? metrics?.contentSize;
+			const width = Number(size?.width ?? 0);
+			const height = Number(size?.height ?? 0);
+			if (width > 0 && height > 0) clip = {
+				x: 0,
+				y: 0,
+				width,
+				height,
+				scale: 1
+			};
+		}
+		const format = opts.format ?? "png";
+		const quality = format === "jpeg" ? Math.max(0, Math.min(100, Math.round(opts.quality ?? 85))) : void 0;
+		const base64 = (await send("Page.captureScreenshot", {
+			format,
+			...quality !== void 0 ? { quality } : {},
+			fromSurface: true,
+			captureBeyondViewport: true,
+			...clip ? { clip } : {}
+		}))?.data;
+		if (!base64) throw new Error("Screenshot failed: missing data");
+		return Buffer.from(base64, "base64");
+	});
+}
+async function createTargetViaCdp(opts) {
+	await assertBrowserNavigationAllowed({
+		url: opts.url,
+		...withBrowserNavigationPolicy(opts.ssrfPolicy)
+	});
+	const version = await fetchJson(appendCdpPath(opts.cdpUrl, "/json/version"), 1500);
+	const wsUrlRaw = String(version?.webSocketDebuggerUrl ?? "").trim();
+	const wsUrl = wsUrlRaw ? normalizeCdpWsUrl(wsUrlRaw, opts.cdpUrl) : "";
+	if (!wsUrl) throw new Error("CDP /json/version missing webSocketDebuggerUrl");
+	return await withCdpSocket(wsUrl, async (send) => {
+		const created = await send("Target.createTarget", { url: opts.url });
+		const targetId = String(created?.targetId ?? "").trim();
+		if (!targetId) throw new Error("CDP Target.createTarget returned no targetId");
+		return { targetId };
+	});
+}
+function axValue(v) {
+	if (!v || typeof v !== "object") return "";
+	const value = v.value;
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+function formatAriaSnapshot(nodes, limit) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const n of nodes) if (n.nodeId) byId.set(n.nodeId, n);
+	const referenced = /* @__PURE__ */ new Set();
+	for (const n of nodes) for (const c of n.childIds ?? []) referenced.add(c);
+	const root = nodes.find((n) => n.nodeId && !referenced.has(n.nodeId)) ?? nodes[0];
+	if (!root?.nodeId) return [];
+	const out = [];
+	const stack = [{
+		id: root.nodeId,
+		depth: 0
+	}];
+	while (stack.length && out.length < limit) {
+		const popped = stack.pop();
+		if (!popped) break;
+		const { id, depth } = popped;
+		const n = byId.get(id);
+		if (!n) continue;
+		const role = axValue(n.role);
+		const name = axValue(n.name);
+		const value = axValue(n.value);
+		const description = axValue(n.description);
+		const ref = `ax${out.length + 1}`;
+		out.push({
+			ref,
+			role: role || "unknown",
+			name: name || "",
+			...value ? { value } : {},
+			...description ? { description } : {},
+			...typeof n.backendDOMNodeId === "number" ? { backendDOMNodeId: n.backendDOMNodeId } : {},
+			depth
+		});
+		const children = (n.childIds ?? []).filter((c) => byId.has(c));
+		for (let i = children.length - 1; i >= 0; i--) {
+			const child = children[i];
+			if (child) stack.push({
+				id: child,
+				depth: depth + 1
+			});
+		}
+	}
+	return out;
+}
+async function snapshotAria(opts) {
+	const limit = Math.max(1, Math.min(2e3, Math.floor(opts.limit ?? 500)));
+	return await withCdpSocket(opts.wsUrl, async (send) => {
+		await send("Accessibility.enable").catch(() => {});
+		const res = await send("Accessibility.getFullAXTree");
+		return { nodes: formatAriaSnapshot(Array.isArray(res?.nodes) ? res.nodes : [], limit) };
+	});
+}
+
+//#endregion
+//#region src/infra/ports-lsof.ts
+const LSOF_CANDIDATES = process.platform === "darwin" ? ["/usr/sbin/lsof", "/usr/bin/lsof"] : ["/usr/bin/lsof", "/usr/sbin/lsof"];
+function resolveLsofCommandSync() {
+	for (const candidate of LSOF_CANDIDATES) try {
+		fs.accessSync(candidate, fs.constants.X_OK);
+		return candidate;
+	} catch {}
+	return "lsof";
+}
+
+//#endregion
+//#region src/infra/ports-probe.ts
+async function tryListenOnPort(params) {
+	const listenOptions = { port: params.port };
+	if (params.host) listenOptions.host = params.host;
+	if (typeof params.exclusive === "boolean") listenOptions.exclusive = params.exclusive;
+	await new Promise((resolve, reject) => {
+		const tester = net.createServer().once("error", (err) => reject(err)).once("listening", () => {
+			tester.close(() => resolve());
+		}).listen(listenOptions);
+	});
+}
+
+//#endregion
+//#region src/infra/ports.ts
+var PortInUseError = class extends Error {
+	constructor(port, details) {
+		super(`Port ${port} is already in use.`);
+		this.name = "PortInUseError";
+		this.port = port;
+		this.details = details;
+	}
+};
+async function ensurePortAvailable(port) {
+	try {
+		await tryListenOnPort({ port });
+	} catch (err) {
+		if (isErrno(err) && err.code === "EADDRINUSE") throw new PortInUseError(port);
+		throw err;
+	}
+}
+
+//#endregion
+//#region src/browser/chrome.executables.ts
+const CHROMIUM_BUNDLE_IDS = new Set([
+	"com.google.Chrome",
+	"com.google.Chrome.beta",
+	"com.google.Chrome.canary",
+	"com.google.Chrome.dev",
+	"com.brave.Browser",
+	"com.brave.Browser.beta",
+	"com.brave.Browser.nightly",
+	"com.microsoft.Edge",
+	"com.microsoft.EdgeBeta",
+	"com.microsoft.EdgeDev",
+	"com.microsoft.EdgeCanary",
+	"org.chromium.Chromium",
+	"com.vivaldi.Vivaldi",
+	"com.operasoftware.Opera",
+	"com.operasoftware.OperaGX",
+	"com.yandex.desktop.yandex-browser",
+	"company.thebrowser.Browser"
+]);
+const CHROMIUM_DESKTOP_IDS = new Set([
+	"google-chrome.desktop",
+	"google-chrome-beta.desktop",
+	"google-chrome-unstable.desktop",
+	"brave-browser.desktop",
+	"microsoft-edge.desktop",
+	"microsoft-edge-beta.desktop",
+	"microsoft-edge-dev.desktop",
+	"microsoft-edge-canary.desktop",
+	"chromium.desktop",
+	"chromium-browser.desktop",
+	"vivaldi.desktop",
+	"vivaldi-stable.desktop",
+	"opera.desktop",
+	"opera-gx.desktop",
+	"yandex-browser.desktop",
+	"org.chromium.Chromium.desktop"
+]);
+const CHROMIUM_EXE_NAMES = new Set([
+	"chrome.exe",
+	"msedge.exe",
+	"brave.exe",
+	"brave-browser.exe",
+	"chromium.exe",
+	"vivaldi.exe",
+	"opera.exe",
+	"launcher.exe",
+	"yandex.exe",
+	"yandexbrowser.exe",
+	"google chrome",
+	"google chrome canary",
+	"brave browser",
+	"microsoft edge",
+	"chromium",
+	"chrome",
+	"brave",
+	"msedge",
+	"brave-browser",
+	"google-chrome",
+	"google-chrome-stable",
+	"google-chrome-beta",
+	"google-chrome-unstable",
+	"microsoft-edge",
+	"microsoft-edge-beta",
+	"microsoft-edge-dev",
+	"microsoft-edge-canary",
+	"chromium-browser",
+	"vivaldi",
+	"vivaldi-stable",
+	"opera",
+	"opera-stable",
+	"opera-gx",
+	"yandex-browser"
+]);
+function exists$1(filePath) {
+	try {
+		return fs.existsSync(filePath);
+	} catch {
+		return false;
+	}
+}
+function execText(command, args, timeoutMs = 1200, maxBuffer = 1024 * 1024) {
+	try {
+		const output = execFileSync(command, args, {
+			timeout: timeoutMs,
+			encoding: "utf8",
+			maxBuffer
+		});
+		return String(output ?? "").trim() || null;
+	} catch {
+		return null;
+	}
+}
+function inferKindFromIdentifier(identifier) {
+	const id = identifier.toLowerCase();
+	if (id.includes("brave")) return "brave";
+	if (id.includes("edge")) return "edge";
+	if (id.includes("chromium")) return "chromium";
+	if (id.includes("canary")) return "canary";
+	if (id.includes("opera") || id.includes("vivaldi") || id.includes("yandex") || id.includes("thebrowser")) return "chromium";
+	return "chrome";
+}
+function inferKindFromExecutableName(name) {
+	const lower = name.toLowerCase();
+	if (lower.includes("brave")) return "brave";
+	if (lower.includes("edge") || lower.includes("msedge")) return "edge";
+	if (lower.includes("chromium")) return "chromium";
+	if (lower.includes("canary") || lower.includes("sxs")) return "canary";
+	if (lower.includes("opera") || lower.includes("vivaldi") || lower.includes("yandex")) return "chromium";
+	return "chrome";
+}
+function detectDefaultChromiumExecutable(platform) {
+	if (platform === "darwin") return detectDefaultChromiumExecutableMac();
+	if (platform === "linux") return detectDefaultChromiumExecutableLinux();
+	if (platform === "win32") return detectDefaultChromiumExecutableWindows();
+	return null;
+}
+function detectDefaultChromiumExecutableMac() {
+	const bundleId = detectDefaultBrowserBundleIdMac();
+	if (!bundleId || !CHROMIUM_BUNDLE_IDS.has(bundleId)) return null;
+	const appPathRaw = execText("/usr/bin/osascript", ["-e", `POSIX path of (path to application id "${bundleId}")`]);
+	if (!appPathRaw) return null;
+	const appPath = appPathRaw.trim().replace(/\/$/, "");
+	const exeName = execText("/usr/bin/defaults", [
+		"read",
+		path.join(appPath, "Contents", "Info"),
+		"CFBundleExecutable"
+	]);
+	if (!exeName) return null;
+	const exePath = path.join(appPath, "Contents", "MacOS", exeName.trim());
+	if (!exists$1(exePath)) return null;
+	return {
+		kind: inferKindFromIdentifier(bundleId),
+		path: exePath
+	};
+}
+function detectDefaultBrowserBundleIdMac() {
+	const plistPath = path.join(os.homedir(), "Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist");
+	if (!exists$1(plistPath)) return null;
+	const handlersRaw = execText("/usr/bin/plutil", [
+		"-extract",
+		"LSHandlers",
+		"json",
+		"-o",
+		"-",
+		"--",
+		plistPath
+	], 2e3, 5 * 1024 * 1024);
+	if (!handlersRaw) return null;
+	let handlers;
+	try {
+		handlers = JSON.parse(handlersRaw);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(handlers)) return null;
+	const resolveScheme = (scheme) => {
+		let candidate = null;
+		for (const entry of handlers) {
+			if (!entry || typeof entry !== "object") continue;
+			const record = entry;
+			if (record.LSHandlerURLScheme !== scheme) continue;
+			const role = typeof record.LSHandlerRoleAll === "string" && record.LSHandlerRoleAll || typeof record.LSHandlerRoleViewer === "string" && record.LSHandlerRoleViewer || null;
+			if (role) candidate = role;
+		}
+		return candidate;
+	};
+	return resolveScheme("http") ?? resolveScheme("https");
+}
+function detectDefaultChromiumExecutableLinux() {
+	const desktopId = execText("xdg-settings", ["get", "default-web-browser"]) || execText("xdg-mime", [
+		"query",
+		"default",
+		"x-scheme-handler/http"
+	]);
+	if (!desktopId) return null;
+	const trimmed = desktopId.trim();
+	if (!CHROMIUM_DESKTOP_IDS.has(trimmed)) return null;
+	const desktopPath = findDesktopFilePath(trimmed);
+	if (!desktopPath) return null;
+	const execLine = readDesktopExecLine(desktopPath);
+	if (!execLine) return null;
+	const command = extractExecutableFromExecLine(execLine);
+	if (!command) return null;
+	const resolved = resolveLinuxExecutablePath(command);
+	if (!resolved) return null;
+	const exeName = path.posix.basename(resolved).toLowerCase();
+	if (!CHROMIUM_EXE_NAMES.has(exeName)) return null;
+	return {
+		kind: inferKindFromExecutableName(exeName),
+		path: resolved
+	};
+}
+function detectDefaultChromiumExecutableWindows() {
+	const progId = readWindowsProgId();
+	const command = (progId ? readWindowsCommandForProgId(progId) : null) || readWindowsCommandForProgId("http");
+	if (!command) return null;
+	const exePath = extractWindowsExecutablePath(expandWindowsEnvVars(command));
+	if (!exePath) return null;
+	if (!exists$1(exePath)) return null;
+	const exeName = path.win32.basename(exePath).toLowerCase();
+	if (!CHROMIUM_EXE_NAMES.has(exeName)) return null;
+	return {
+		kind: inferKindFromExecutableName(exeName),
+		path: exePath
+	};
+}
+function findDesktopFilePath(desktopId) {
+	const candidates = [
+		path.join(os.homedir(), ".local", "share", "applications", desktopId),
+		path.join("/usr/local/share/applications", desktopId),
+		path.join("/usr/share/applications", desktopId),
+		path.join("/var/lib/snapd/desktop/applications", desktopId)
+	];
+	for (const candidate of candidates) if (exists$1(candidate)) return candidate;
+	return null;
+}
+function readDesktopExecLine(desktopPath) {
+	try {
+		const lines = fs.readFileSync(desktopPath, "utf8").split(/\r?\n/);
+		for (const line of lines) if (line.startsWith("Exec=")) return line.slice(5).trim();
+	} catch {}
+	return null;
+}
+function extractExecutableFromExecLine(execLine) {
+	const tokens = splitExecLine(execLine);
+	for (const token of tokens) {
+		if (!token) continue;
+		if (token === "env") continue;
+		if (token.includes("=") && !token.startsWith("/") && !token.includes("\\")) continue;
+		return token.replace(/^["']|["']$/g, "");
+	}
+	return null;
+}
+function splitExecLine(line) {
+	const tokens = [];
+	let current = "";
+	let inQuotes = false;
+	let quoteChar = "";
+	for (let i = 0; i < line.length; i += 1) {
+		const ch = line[i];
+		if ((ch === "\"" || ch === "'") && (!inQuotes || ch === quoteChar)) {
+			if (inQuotes) {
+				inQuotes = false;
+				quoteChar = "";
+			} else {
+				inQuotes = true;
+				quoteChar = ch;
+			}
+			continue;
+		}
+		if (!inQuotes && /\s/.test(ch)) {
+			if (current) {
+				tokens.push(current);
+				current = "";
+			}
+			continue;
+		}
+		current += ch;
+	}
+	if (current) tokens.push(current);
+	return tokens;
+}
+function resolveLinuxExecutablePath(command) {
+	const cleaned = command.trim().replace(/%[a-zA-Z]/g, "");
+	if (!cleaned) return null;
+	if (cleaned.startsWith("/")) return cleaned;
+	const resolved = execText("which", [cleaned], 800);
+	return resolved ? resolved.trim() : null;
+}
+function readWindowsProgId() {
+	const output = execText("reg", [
+		"query",
+		"HKCU\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
+		"/v",
+		"ProgId"
+	]);
+	if (!output) return null;
+	return output.match(/ProgId\s+REG_\w+\s+(.+)$/im)?.[1]?.trim() || null;
+}
+function readWindowsCommandForProgId(progId) {
+	const output = execText("reg", [
+		"query",
+		progId === "http" ? "HKCR\\http\\shell\\open\\command" : `HKCR\\${progId}\\shell\\open\\command`,
+		"/ve"
+	]);
+	if (!output) return null;
+	return output.match(/REG_\w+\s+(.+)$/im)?.[1]?.trim() || null;
+}
+function expandWindowsEnvVars(value) {
+	return value.replace(/%([^%]+)%/g, (_match, name) => {
+		const key = String(name ?? "").trim();
+		return key ? process.env[key] ?? `%${key}%` : _match;
+	});
+}
+function extractWindowsExecutablePath(command) {
+	const quoted = command.match(/"([^"]+\\.exe)"/i);
+	if (quoted?.[1]) return quoted[1];
+	const unquoted = command.match(/([^\\s]+\\.exe)/i);
+	if (unquoted?.[1]) return unquoted[1];
+	return null;
+}
+function findFirstExecutable(candidates) {
+	for (const candidate of candidates) if (exists$1(candidate.path)) return candidate;
+	return null;
+}
+function findChromeExecutableMac() {
+	return findFirstExecutable([
+		{
+			kind: "chrome",
+			path: "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+		},
+		{
+			kind: "chrome",
+			path: path.join(os.homedir(), "Applications/Google Chrome.app/Contents/MacOS/Google Chrome")
+		},
+		{
+			kind: "brave",
+			path: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"
+		},
+		{
+			kind: "brave",
+			path: path.join(os.homedir(), "Applications/Brave Browser.app/Contents/MacOS/Brave Browser")
+		},
+		{
+			kind: "edge",
+			path: "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
+		},
+		{
+			kind: "edge",
+			path: path.join(os.homedir(), "Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge")
+		},
+		{
+			kind: "chromium",
+			path: "/Applications/Chromium.app/Contents/MacOS/Chromium"
+		},
+		{
+			kind: "chromium",
+			path: path.join(os.homedir(), "Applications/Chromium.app/Contents/MacOS/Chromium")
+		},
+		{
+			kind: "canary",
+			path: "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary"
+		},
+		{
+			kind: "canary",
+			path: path.join(os.homedir(), "Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary")
+		}
+	]);
+}
+function findChromeExecutableLinux() {
+	return findFirstExecutable([
+		{
+			kind: "chrome",
+			path: "/usr/bin/google-chrome"
+		},
+		{
+			kind: "chrome",
+			path: "/usr/bin/google-chrome-stable"
+		},
+		{
+			kind: "chrome",
+			path: "/usr/bin/chrome"
+		},
+		{
+			kind: "brave",
+			path: "/usr/bin/brave-browser"
+		},
+		{
+			kind: "brave",
+			path: "/usr/bin/brave-browser-stable"
+		},
+		{
+			kind: "brave",
+			path: "/usr/bin/brave"
+		},
+		{
+			kind: "brave",
+			path: "/snap/bin/brave"
+		},
+		{
+			kind: "edge",
+			path: "/usr/bin/microsoft-edge"
+		},
+		{
+			kind: "edge",
+			path: "/usr/bin/microsoft-edge-stable"
+		},
+		{
+			kind: "chromium",
+			path: "/usr/bin/chromium"
+		},
+		{
+			kind: "chromium",
+			path: "/usr/bin/chromium-browser"
+		},
+		{
+			kind: "chromium",
+			path: "/snap/bin/chromium"
+		}
+	]);
+}
+function findChromeExecutableWindows() {
+	const localAppData = process.env.LOCALAPPDATA ?? "";
+	const programFiles = process.env.ProgramFiles ?? "C:\\Program Files";
+	const programFilesX86 = process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)";
+	const joinWin = path.win32.join;
+	const candidates = [];
+	if (localAppData) {
+		candidates.push({
+			kind: "chrome",
+			path: joinWin(localAppData, "Google", "Chrome", "Application", "chrome.exe")
+		});
+		candidates.push({
+			kind: "brave",
+			path: joinWin(localAppData, "BraveSoftware", "Brave-Browser", "Application", "brave.exe")
+		});
+		candidates.push({
+			kind: "edge",
+			path: joinWin(localAppData, "Microsoft", "Edge", "Application", "msedge.exe")
+		});
+		candidates.push({
+			kind: "chromium",
+			path: joinWin(localAppData, "Chromium", "Application", "chrome.exe")
+		});
+		candidates.push({
+			kind: "canary",
+			path: joinWin(localAppData, "Google", "Chrome SxS", "Application", "chrome.exe")
+		});
+	}
+	candidates.push({
+		kind: "chrome",
+		path: joinWin(programFiles, "Google", "Chrome", "Application", "chrome.exe")
+	});
+	candidates.push({
+		kind: "chrome",
+		path: joinWin(programFilesX86, "Google", "Chrome", "Application", "chrome.exe")
+	});
+	candidates.push({
+		kind: "brave",
+		path: joinWin(programFiles, "BraveSoftware", "Brave-Browser", "Application", "brave.exe")
+	});
+	candidates.push({
+		kind: "brave",
+		path: joinWin(programFilesX86, "BraveSoftware", "Brave-Browser", "Application", "brave.exe")
+	});
+	candidates.push({
+		kind: "edge",
+		path: joinWin(programFiles, "Microsoft", "Edge", "Application", "msedge.exe")
+	});
+	candidates.push({
+		kind: "edge",
+		path: joinWin(programFilesX86, "Microsoft", "Edge", "Application", "msedge.exe")
+	});
+	return findFirstExecutable(candidates);
+}
+function resolveBrowserExecutableForPlatform(resolved, platform) {
+	if (resolved.executablePath) {
+		if (!exists$1(resolved.executablePath)) throw new Error(`browser.executablePath not found: ${resolved.executablePath}`);
+		return {
+			kind: "custom",
+			path: resolved.executablePath
+		};
+	}
+	const detected = detectDefaultChromiumExecutable(platform);
+	if (detected) return detected;
+	if (platform === "darwin") return findChromeExecutableMac();
+	if (platform === "linux") return findChromeExecutableLinux();
+	if (platform === "win32") return findChromeExecutableWindows();
+	return null;
+}
+
+//#endregion
+//#region src/browser/chrome.profile-decoration.ts
+function decoratedMarkerPath(userDataDir) {
+	return path.join(userDataDir, ".fased-profile-decorated");
+}
+function safeReadJson(filePath) {
+	try {
+		if (!fs.existsSync(filePath)) return null;
+		const raw = fs.readFileSync(filePath, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+function safeWriteJson(filePath, data) {
+	fs.mkdirSync(path.dirname(filePath), { recursive: true });
+	fs.writeFileSync(filePath, JSON.stringify(data, null, 2));
+}
+function setDeep(obj, keys, value) {
+	let node = obj;
+	for (const key of keys.slice(0, -1)) {
+		const next = node[key];
+		if (typeof next !== "object" || next === null || Array.isArray(next)) node[key] = {};
+		node = node[key];
+	}
+	node[keys[keys.length - 1] ?? ""] = value;
+}
+function parseHexRgbToSignedArgbInt(hex) {
+	const cleaned = hex.trim().replace(/^#/, "");
+	if (!/^[0-9a-fA-F]{6}$/.test(cleaned)) return null;
+	const argbUnsigned = 255 << 24 | Number.parseInt(cleaned, 16);
+	return argbUnsigned > 2147483647 ? argbUnsigned - 4294967296 : argbUnsigned;
+}
+function isProfileDecorated(userDataDir, desiredName, desiredColorHex) {
+	const desiredColorInt = parseHexRgbToSignedArgbInt(desiredColorHex);
+	const localStatePath = path.join(userDataDir, "Local State");
+	const preferencesPath = path.join(userDataDir, "Default", "Preferences");
+	const profile = safeReadJson(localStatePath)?.profile;
+	const infoCache = typeof profile === "object" && profile !== null && !Array.isArray(profile) ? profile.info_cache : null;
+	const info = typeof infoCache === "object" && infoCache !== null && !Array.isArray(infoCache) && typeof infoCache.Default === "object" && infoCache.Default !== null && !Array.isArray(infoCache.Default) ? infoCache.Default : null;
+	const prefs = safeReadJson(preferencesPath);
+	const browserTheme = (() => {
+		const browser = prefs?.browser;
+		const theme = typeof browser === "object" && browser !== null && !Array.isArray(browser) ? browser.theme : null;
+		return typeof theme === "object" && theme !== null && !Array.isArray(theme) ? theme : null;
+	})();
+	const autogeneratedTheme = (() => {
+		const autogenerated = prefs?.autogenerated;
+		const theme = typeof autogenerated === "object" && autogenerated !== null && !Array.isArray(autogenerated) ? autogenerated.theme : null;
+		return typeof theme === "object" && theme !== null && !Array.isArray(theme) ? theme : null;
+	})();
+	const nameOk = typeof info?.name === "string" ? info.name === desiredName : true;
+	if (desiredColorInt == null) return nameOk;
+	const localSeedOk = typeof info?.profile_color_seed === "number" ? info.profile_color_seed === desiredColorInt : false;
+	const prefOk = typeof browserTheme?.user_color2 === "number" && browserTheme.user_color2 === desiredColorInt || typeof autogeneratedTheme?.color === "number" && autogeneratedTheme.color === desiredColorInt;
+	return nameOk && localSeedOk && prefOk;
+}
+/**
+* Best-effort profile decoration (name + fased-orange). Chrome preference keys
+* vary by version; we keep this conservative and idempotent.
+*/
+function decorateFasedAgentProfile(userDataDir, opts) {
+	const desiredName = opts?.name ?? DEFAULT_FASED_BROWSER_PROFILE_NAME;
+	const desiredColor = (opts?.color ?? DEFAULT_FASED_BROWSER_COLOR).toUpperCase();
+	const desiredColorInt = parseHexRgbToSignedArgbInt(desiredColor);
+	const localStatePath = path.join(userDataDir, "Local State");
+	const preferencesPath = path.join(userDataDir, "Default", "Preferences");
+	const localState = safeReadJson(localStatePath) ?? {};
+	setDeep(localState, [
+		"profile",
+		"info_cache",
+		"Default",
+		"name"
+	], desiredName);
+	setDeep(localState, [
+		"profile",
+		"info_cache",
+		"Default",
+		"shortcut_name"
+	], desiredName);
+	setDeep(localState, [
+		"profile",
+		"info_cache",
+		"Default",
+		"user_name"
+	], desiredName);
+	setDeep(localState, [
+		"profile",
+		"info_cache",
+		"Default",
+		"profile_color"
+	], desiredColor);
+	setDeep(localState, [
+		"profile",
+		"info_cache",
+		"Default",
+		"user_color"
+	], desiredColor);
+	if (desiredColorInt != null) {
+		setDeep(localState, [
+			"profile",
+			"info_cache",
+			"Default",
+			"profile_color_seed"
+		], desiredColorInt);
+		setDeep(localState, [
+			"profile",
+			"info_cache",
+			"Default",
+			"profile_highlight_color"
+		], desiredColorInt);
+		setDeep(localState, [
+			"profile",
+			"info_cache",
+			"Default",
+			"default_avatar_fill_color"
+		], desiredColorInt);
+		setDeep(localState, [
+			"profile",
+			"info_cache",
+			"Default",
+			"default_avatar_stroke_color"
+		], desiredColorInt);
+	}
+	safeWriteJson(localStatePath, localState);
+	const prefs = safeReadJson(preferencesPath) ?? {};
+	setDeep(prefs, ["profile", "name"], desiredName);
+	setDeep(prefs, ["profile", "profile_color"], desiredColor);
+	setDeep(prefs, ["profile", "user_color"], desiredColor);
+	if (desiredColorInt != null) {
+		setDeep(prefs, [
+			"autogenerated",
+			"theme",
+			"color"
+		], desiredColorInt);
+		setDeep(prefs, [
+			"browser",
+			"theme",
+			"user_color2"
+		], desiredColorInt);
+	}
+	safeWriteJson(preferencesPath, prefs);
+	try {
+		fs.writeFileSync(decoratedMarkerPath(userDataDir), `${Date.now()}\n`, "utf-8");
+	} catch {}
+}
+function ensureProfileCleanExit(userDataDir) {
+	const preferencesPath = path.join(userDataDir, "Default", "Preferences");
+	const prefs = safeReadJson(preferencesPath) ?? {};
+	setDeep(prefs, ["exit_type"], "Normal");
+	setDeep(prefs, ["exited_cleanly"], true);
+	safeWriteJson(preferencesPath, prefs);
+}
+
+//#endregion
+//#region src/browser/chrome.ts
+const log = createSubsystemLogger("browser").child("chrome");
+function exists(filePath) {
+	try {
+		return fs.existsSync(filePath);
+	} catch {
+		return false;
+	}
+}
+function resolveBrowserExecutable(resolved) {
+	return resolveBrowserExecutableForPlatform(resolved, process.platform);
+}
+function resolveFasedAgentUserDataDir(profileName = DEFAULT_FASED_BROWSER_PROFILE_NAME) {
+	return path.join(CONFIG_DIR, "browser", profileName, "user-data");
+}
+function cdpUrlForPort(cdpPort) {
+	return `http://127.0.0.1:${cdpPort}`;
+}
+async function isChromeReachable(cdpUrl, timeoutMs = 500) {
+	const version = await fetchChromeVersion(cdpUrl, timeoutMs);
+	return Boolean(version);
+}
+async function fetchChromeVersion(cdpUrl, timeoutMs = 500) {
+	const ctrl = new AbortController();
+	const t = setTimeout(ctrl.abort.bind(ctrl), timeoutMs);
+	try {
+		const versionUrl = appendCdpPath(cdpUrl, "/json/version");
+		const res = await fetch(versionUrl, {
+			signal: ctrl.signal,
+			headers: getHeadersWithAuth(versionUrl)
+		});
+		if (!res.ok) return null;
+		const data = await res.json();
+		if (!data || typeof data !== "object") return null;
+		return data;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(t);
+	}
+}
+async function getChromeWebSocketUrl(cdpUrl, timeoutMs = 500) {
+	const version = await fetchChromeVersion(cdpUrl, timeoutMs);
+	const wsUrl = String(version?.webSocketDebuggerUrl ?? "").trim();
+	if (!wsUrl) return null;
+	return normalizeCdpWsUrl(wsUrl, cdpUrl);
+}
+async function canOpenWebSocket(wsUrl, timeoutMs = 800) {
+	return await new Promise((resolve) => {
+		const headers = getHeadersWithAuth(wsUrl);
+		const ws = new WebSocket$1(wsUrl, {
+			handshakeTimeout: timeoutMs,
+			...Object.keys(headers).length ? { headers } : {}
+		});
+		const timer = setTimeout(() => {
+			try {
+				ws.terminate();
+			} catch {}
+			resolve(false);
+		}, Math.max(50, timeoutMs + 25));
+		ws.once("open", () => {
+			clearTimeout(timer);
+			try {
+				ws.close();
+			} catch {}
+			resolve(true);
+		});
+		ws.once("error", () => {
+			clearTimeout(timer);
+			resolve(false);
+		});
+	});
+}
+async function isChromeCdpReady(cdpUrl, timeoutMs = 500, handshakeTimeoutMs = 800) {
+	const wsUrl = await getChromeWebSocketUrl(cdpUrl, timeoutMs);
+	if (!wsUrl) return false;
+	return await canOpenWebSocket(wsUrl, handshakeTimeoutMs);
+}
+async function launchFasedAgentChrome(resolved, profile) {
+	if (!profile.cdpIsLoopback) throw new Error(`Profile "${profile.name}" is remote; cannot launch local Chrome.`);
+	await ensurePortAvailable(profile.cdpPort);
+	const exe = resolveBrowserExecutable(resolved);
+	if (!exe) throw new Error("No supported browser found (Chrome/Brave/Edge/Chromium on macOS, Linux, or Windows).");
+	const userDataDir = resolveFasedAgentUserDataDir(profile.name);
+	fs.mkdirSync(userDataDir, { recursive: true });
+	const needsDecorate = !isProfileDecorated(userDataDir, profile.name, (profile.color ?? DEFAULT_FASED_BROWSER_COLOR).toUpperCase());
+	const spawnOnce = () => {
+		const args = [
+			`--remote-debugging-port=${profile.cdpPort}`,
+			`--user-data-dir=${userDataDir}`,
+			"--no-first-run",
+			"--no-default-browser-check",
+			"--disable-sync",
+			"--disable-background-networking",
+			"--disable-component-update",
+			"--disable-features=Translate,MediaRouter",
+			"--disable-session-crashed-bubble",
+			"--hide-crash-restore-bubble",
+			"--password-store=basic"
+		];
+		if (resolved.headless) {
+			args.push("--headless=new");
+			args.push("--disable-gpu");
+		}
+		if (resolved.noSandbox) {
+			args.push("--no-sandbox");
+			args.push("--disable-setuid-sandbox");
+		}
+		if (process.platform === "linux") args.push("--disable-dev-shm-usage");
+		args.push("--disable-blink-features=AutomationControlled");
+		if (resolved.extraArgs.length > 0) args.push(...resolved.extraArgs);
+		args.push("about:blank");
+		return spawn(exe.path, args, {
+			stdio: "pipe",
+			env: {
+				...process.env,
+				HOME: os.homedir()
+			}
+		});
+	};
+	const startedAt = Date.now();
+	const localStatePath = path.join(userDataDir, "Local State");
+	const preferencesPath = path.join(userDataDir, "Default", "Preferences");
+	if (!exists(localStatePath) || !exists(preferencesPath)) {
+		const bootstrap = spawnOnce();
+		const deadline = Date.now() + 1e4;
+		while (Date.now() < deadline) {
+			if (exists(localStatePath) && exists(preferencesPath)) break;
+			await new Promise((r) => setTimeout(r, 100));
+		}
+		try {
+			bootstrap.kill("SIGTERM");
+		} catch {}
+		const exitDeadline = Date.now() + 5e3;
+		while (Date.now() < exitDeadline) {
+			if (bootstrap.exitCode != null) break;
+			await new Promise((r) => setTimeout(r, 50));
+		}
+	}
+	if (needsDecorate) try {
+		decorateFasedAgentProfile(userDataDir, {
+			name: profile.name,
+			color: profile.color
+		});
+		log.info(`browser profile decorated (${profile.color})`);
+	} catch (err) {
+		log.warn(`fased browser profile decoration failed: ${String(err)}`);
+	}
+	try {
+		ensureProfileCleanExit(userDataDir);
+	} catch (err) {
+		log.warn(`fased browser clean-exit prefs failed: ${String(err)}`);
+	}
+	const proc = spawnOnce();
+	const readyDeadline = Date.now() + 15e3;
+	while (Date.now() < readyDeadline) {
+		if (await isChromeReachable(profile.cdpUrl, 500)) break;
+		await new Promise((r) => setTimeout(r, 200));
+	}
+	if (!await isChromeReachable(profile.cdpUrl, 500)) {
+		try {
+			proc.kill("SIGKILL");
+		} catch {}
+		throw new Error(`Failed to start Chrome CDP on port ${profile.cdpPort} for profile "${profile.name}".`);
+	}
+	const pid = proc.pid ?? -1;
+	log.info(`fased browser started (${exe.kind}) profile "${profile.name}" on 127.0.0.1:${profile.cdpPort} (pid ${pid})`);
+	return {
+		pid,
+		exe,
+		userDataDir,
+		cdpPort: profile.cdpPort,
+		startedAt,
+		proc
+	};
+}
+async function stopFasedAgentChrome(running, timeoutMs = 2500) {
+	const proc = running.proc;
+	if (proc.killed) return;
+	try {
+		proc.kill("SIGTERM");
+	} catch {}
+	const start = Date.now();
+	while (Date.now() - start < timeoutMs) {
+		if (!proc.exitCode && proc.killed) break;
+		if (!await isChromeReachable(cdpUrlForPort(running.cdpPort), 200)) return;
+		await new Promise((r) => setTimeout(r, 100));
+	}
+	try {
+		proc.kill("SIGKILL");
+	} catch {}
+}
+
+//#endregion
+//#region src/browser/form-fields.ts
+const DEFAULT_FILL_FIELD_TYPE = "text";
+function normalizeBrowserFormFieldRef(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function normalizeBrowserFormFieldType(value) {
+	return (typeof value === "string" ? value.trim() : "") || DEFAULT_FILL_FIELD_TYPE;
+}
+function normalizeBrowserFormFieldValue(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? value : void 0;
+}
+function normalizeBrowserFormField(record) {
+	const ref = normalizeBrowserFormFieldRef(record.ref);
+	if (!ref) return null;
+	const type = normalizeBrowserFormFieldType(record.type);
+	const value = normalizeBrowserFormFieldValue(record.value);
+	return value === void 0 ? {
+		ref,
+		type
+	} : {
+		ref,
+		type,
+		value
+	};
+}
+
+//#endregion
+//#region src/browser/paths.ts
+const DEFAULT_BROWSER_TMP_DIR = resolvePreferredFasedAgentTmpDir();
+const DEFAULT_TRACE_DIR = DEFAULT_BROWSER_TMP_DIR;
+const DEFAULT_DOWNLOAD_DIR = path.join(DEFAULT_BROWSER_TMP_DIR, "downloads");
+const DEFAULT_UPLOAD_DIR = path.join(DEFAULT_BROWSER_TMP_DIR, "uploads");
+function invalidPath(scopeLabel) {
+	return {
+		ok: false,
+		error: `Invalid path: must stay within ${scopeLabel}`
+	};
+}
+async function resolveRealPathIfExists(targetPath) {
+	try {
+		return await fs$1.realpath(targetPath);
+	} catch {
+		return;
+	}
+}
+async function resolveTrustedRootRealPath(rootDir) {
+	try {
+		const rootLstat = await fs$1.lstat(rootDir);
+		if (!rootLstat.isDirectory() || rootLstat.isSymbolicLink()) return;
+		return await fs$1.realpath(rootDir);
+	} catch {
+		return;
+	}
+}
+async function validateCanonicalPathWithinRoot(params) {
+	try {
+		const candidateLstat = await fs$1.lstat(params.candidatePath);
+		if (candidateLstat.isSymbolicLink()) return "invalid";
+		if (params.expect === "directory" && !candidateLstat.isDirectory()) return "invalid";
+		if (params.expect === "file" && !candidateLstat.isFile()) return "invalid";
+		const candidateRealPath = await fs$1.realpath(params.candidatePath);
+		return isPathInside(params.rootRealPath, candidateRealPath) ? "ok" : "invalid";
+	} catch (err) {
+		return isNotFoundPathError(err) ? "not-found" : "invalid";
+	}
+}
+function resolvePathWithinRoot(params) {
+	const root = path.resolve(params.rootDir);
+	const raw = params.requestedPath.trim();
+	if (!raw) {
+		if (!params.defaultFileName) return {
+			ok: false,
+			error: "path is required"
+		};
+		return {
+			ok: true,
+			path: path.join(root, params.defaultFileName)
+		};
+	}
+	const resolved = path.resolve(root, raw);
+	const rel = path.relative(root, resolved);
+	if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) return {
+		ok: false,
+		error: `Invalid path: must stay within ${params.scopeLabel}`
+	};
+	return {
+		ok: true,
+		path: resolved
+	};
+}
+async function resolveWritablePathWithinRoot(params) {
+	const lexical = resolvePathWithinRoot(params);
+	if (!lexical.ok) return lexical;
+	const rootRealPath = await resolveTrustedRootRealPath(path.resolve(params.rootDir));
+	if (!rootRealPath) return invalidPath(params.scopeLabel);
+	const requestedPath = lexical.path;
+	if (await validateCanonicalPathWithinRoot({
+		rootRealPath,
+		candidatePath: path.dirname(requestedPath),
+		expect: "directory"
+	}) !== "ok") return invalidPath(params.scopeLabel);
+	if (await validateCanonicalPathWithinRoot({
+		rootRealPath,
+		candidatePath: requestedPath,
+		expect: "file"
+	}) === "invalid") return invalidPath(params.scopeLabel);
+	return lexical;
+}
+async function resolveExistingPathsWithinRoot(params) {
+	return await resolveCheckedPathsWithinRoot({
+		...params,
+		allowMissingFallback: true
+	});
+}
+async function resolveStrictExistingPathsWithinRoot(params) {
+	return await resolveCheckedPathsWithinRoot({
+		...params,
+		allowMissingFallback: false
+	});
+}
+async function resolveCheckedPathsWithinRoot(params) {
+	const rootDir = path.resolve(params.rootDir);
+	const rootRealPath = await resolveRealPathIfExists(rootDir);
+	const isInRoot = (relativePath) => Boolean(relativePath) && !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+	const resolveExistingRelativePath = async (requestedPath) => {
+		const raw = requestedPath.trim();
+		const lexicalPathResult = resolvePathWithinRoot({
+			rootDir,
+			requestedPath,
+			scopeLabel: params.scopeLabel
+		});
+		if (lexicalPathResult.ok) return {
+			ok: true,
+			relativePath: path.relative(rootDir, lexicalPathResult.path),
+			fallbackPath: lexicalPathResult.path
+		};
+		if (!rootRealPath || !raw || !path.isAbsolute(raw)) return lexicalPathResult;
+		try {
+			const resolvedExistingPath = await fs$1.realpath(raw);
+			const relativePath = path.relative(rootRealPath, resolvedExistingPath);
+			if (!isInRoot(relativePath)) return lexicalPathResult;
+			return {
+				ok: true,
+				relativePath,
+				fallbackPath: resolvedExistingPath
+			};
+		} catch {
+			return lexicalPathResult;
+		}
+	};
+	const resolvedPaths = [];
+	for (const raw of params.requestedPaths) {
+		const pathResult = await resolveExistingRelativePath(raw);
+		if (!pathResult.ok) return {
+			ok: false,
+			error: pathResult.error
+		};
+		let opened;
+		try {
+			opened = await openFileWithinRoot({
+				rootDir,
+				relativePath: pathResult.relativePath
+			});
+			resolvedPaths.push(opened.realPath);
+		} catch (err) {
+			if (params.allowMissingFallback && err instanceof SafeOpenError && err.code === "not-found") {
+				resolvedPaths.push(pathResult.fallbackPath);
+				continue;
+			}
+			return {
+				ok: false,
+				error: `Invalid path: must stay within ${params.scopeLabel} and be a regular non-symlink file`
+			};
+		} finally {
+			await opened?.handle.close().catch(() => {});
+		}
+	}
+	return {
+		ok: true,
+		paths: resolvedPaths
+	};
+}
+
+//#endregion
+//#region src/browser/runtime-dependency.ts
+async function loadPlaywrightCore() {
+	return await importOptionalRuntimeDependency({
+		componentId: "browser-runtime",
+		packageName: "@fased/browser-runtime",
+		dependency: "playwright-core"
+	});
+}
+async function loadReadability() {
+	return await importOptionalRuntimeDependency({
+		componentId: "browser-runtime",
+		packageName: "@fased/browser-runtime",
+		dependency: "@mozilla/readability"
+	});
+}
+async function loadLinkedom() {
+	return await importOptionalRuntimeDependency({
+		componentId: "browser-runtime",
+		packageName: "@fased/browser-runtime",
+		dependency: "linkedom"
+	});
+}
+
+//#endregion
+export { fetchJson as A, DEFAULT_BROWSER_EVALUATE_ENABLED as B, normalizeCdpWsUrl as C, assertBrowserNavigationResultAllowed as D, assertBrowserNavigationAllowed as E, stopChromeExtensionRelayServer as F, DEFAULT_FASED_BROWSER_ENABLED as H, DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH as I, DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS as L, getHeadersWithAuth as M, withCdpSocket as N, withBrowserNavigationPolicy as O, ensureChromeExtensionRelayServer as P, DEFAULT_AI_SNAPSHOT_MAX_CHARS as R, formatAriaSnapshot as S, InvalidBrowserNavigationUrlError as T, DEFAULT_FASED_BROWSER_PROFILE_NAME as U, DEFAULT_FASED_BROWSER_COLOR as V, stopFasedAgentChrome as _, DEFAULT_TRACE_DIR as a, captureScreenshot as b, resolveStrictExistingPathsWithinRoot as c, normalizeBrowserFormField as d, getChromeWebSocketUrl as f, resolveFasedAgentUserDataDir as g, launchFasedAgentChrome as h, DEFAULT_DOWNLOAD_DIR as i, fetchOk as j, appendCdpPath as k, resolveWritablePathWithinRoot as l, isChromeReachable as m, loadPlaywrightCore as n, DEFAULT_UPLOAD_DIR as o, isChromeCdpReady as p, loadReadability as r, resolveExistingPathsWithinRoot as s, loadLinkedom as t, DEFAULT_FILL_FIELD_TYPE as u, resolveBrowserExecutableForPlatform as v, snapshotAria as w, createTargetViaCdp as x, resolveLsofCommandSync as y, DEFAULT_BROWSER_DEFAULT_PROFILE_NAME as z };