@inetafrica/open-claudia 3.5.18 → 3.5.20

package/core/browser-view.js

@@ -98,13 +98,15 @@ function listSessions({ dirs = socketDirs(), alive = processAlive } = {}) {
         } catch (_) { /* try the next file */ }
       }
       seen.add(name);
-      sessions.push({ name, port, page, updatedAt });
+      // dir: the socket folder, so the bot's own agent-browser calls (core/browser-teach.js) reach
+      // this session and never start a new one. Internal like the port.
+      sessions.push({ name, port, page, updatedAt, dir });
     }
   }
   return sessions.sort((a, b) => String(b.updatedAt || "").localeCompare(String(a.updatedAt || "")));
 }
 
-// Public view of a session: the stream port stays inside the bot.
+// Public view of a session: the stream port and socket folder stay inside the bot.
 function describeSessions(options) {
   return listSessions(options).map(({ name, page, updatedAt }) => ({ name, page, updatedAt }));
 }
@@ -189,6 +191,7 @@ function serveStream(res, sessionName, { fps, sessions, connect, keepaliveMs = K
 module.exports = {
   DEFAULT_FPS,
   MAX_FPS,
+  SESSION_NAME,
   clampFps,
   describeSessions,
   listSessions,

package/core/cards.js

@@ -255,7 +255,9 @@ function describeResponse(rec, payload, now = Date.now()) {
 // ---------------------------------------------------------------------------
 // Waking the conversation a card (or decision) came from
 
-function wakeOrigin(origin, prompt, label, { scheduler, delayMs = 1500 } = {}) {
+// `source` tags the job for job lists and audits: "card" for card answers,
+// "browser" for the Browser app's hand-backs and Teach-me recordings.
+function wakeOrigin(origin, prompt, label, { scheduler, delayMs = 1500, source = "card" } = {}) {
   if (!origin || !origin.channelId || !origin.provider || !origin.project || !origin.canonicalUserId) {
     throw new Error("the card's origin conversation is unknown");
   }
@@ -282,7 +284,7 @@ function wakeOrigin(origin, prompt, label, { scheduler, delayMs = 1500 } = {}) {
     },
     prompt,
     label: String(label).slice(0, 60),
-    source: "card",
+    source,
     fireAt: Date.now() + delayMs,
   });
 }

package/core/dedup-adjudicator.js

@@ -17,23 +17,32 @@ const GATE_MIN_SCORE = Number(process.env.PACK_DEDUP_GATE_SCORE || 25);
 const ADJUDICATOR_TIMEOUT_MS = Number(process.env.PACK_DEDUP_TIMEOUT_MS || 45000);
 const MAX_CANDIDATES_PER_FACT = 3;
 
+// The root must be an object: Claude Code turns the schema into a tool whose
+// input_schema the API requires to be an object. The bare array this used to
+// be got a 400 on every call from 3.2.2 to 3.5.18, so dedup failed open.
 const ADJUDICATOR_OUTPUT_SCHEMA = Object.freeze({
-  type: "array",
-  items: {
-    type: "object",
-    required: ["id", "verdict"],
-    properties: {
-      id: { type: "string" },
-      verdict: { type: "string", enum: ["store", "update", "merge", "skip"] },
-      target: { type: "string" },
-      merged: { type: "string" },
+  type: "object",
+  required: ["verdicts"],
+  properties: {
+    verdicts: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["id", "verdict"],
+        properties: {
+          id: { type: "string" },
+          verdict: { type: "string", enum: ["store", "update", "merge", "skip"] },
+          target: { type: "string" },
+          merged: { type: "string" },
+        },
+      },
     },
   },
 });
 
 const ADJUDICATOR_SYSTEM_PROMPT = [
   "You are a dedup judge for an assistant's long-term memory.",
-  "Reply with ONLY a JSON array of verdicts — no prose, no markdown fences.",
+  'Reply with ONLY a JSON object {"verdicts": [...]} — no prose, no markdown fences.',
 ].join("\n");
 
 function enabled() {
@@ -113,20 +122,29 @@ function buildAdjudicationPrompt(pairs) {
     "",
     ...blocks,
     "",
-    `Reply with ONLY a JSON array like [{"id":"f1","verdict":"store"}] covering every FACT id.`,
+    `Reply with ONLY a JSON object like {"verdicts":[{"id":"f1","verdict":"store"}]} covering every FACT id.`,
   ].join("\n");
 }
 
+// The reply is {"verdicts": [...]}; a bare array is still read.
+function verdictList(value) {
+  if (Array.isArray(value)) return value;
+  return value && typeof value === "object" && Array.isArray(value.verdicts) ? value.verdicts : null;
+}
+
 function parseVerdicts(result) {
-  if (Array.isArray(result?.json)) return result.json;
-  const match = String(result?.text || "").match(/\[[\s\S]*\]/);
-  if (!match) return null;
-  try {
-    const parsed = JSON.parse(match[0]);
-    return Array.isArray(parsed) ? parsed : null;
-  } catch (_) {
-    return null;
+  const fromJson = verdictList(result?.json);
+  if (fromJson) return fromJson;
+  const text = String(result?.text || "");
+  for (const pattern of [/\{[\s\S]*\}/, /\[[\s\S]*\]/]) {
+    const match = text.match(pattern);
+    if (!match) continue;
+    try {
+      const list = verdictList(JSON.parse(match[0]));
+      if (list) return list;
+    } catch (_) { /* try the other shape */ }
   }
+  return null;
 }
 
 // Phase 3 — turn raw verdicts into a transformed decision plus replacement
@@ -220,6 +238,11 @@ function createDedupAdjudicator(dependencies = {}) {
         });
         rawVerdicts = parseVerdicts(result) || [];
         llmUsed = true;
+        // One line per judgement, so its verdicts can be checked in the log
+        // (before 3.5.19 it logged only failures, and failed on every call).
+        const counts = {};
+        for (const v of rawVerdicts) if (v && typeof v.verdict === "string") counts[v.verdict] = (counts[v.verdict] || 0) + 1;
+        console.log(`[dedup-adjudicator] judged ${pairs.length} fact${pairs.length === 1 ? "" : "s"}: ${Object.entries(counts).map(([verdict, n]) => `${n} ${verdict}`).join(", ") || "no verdicts"}`);
       } catch (error) {
         console.warn(`[dedup-adjudicator] failed open: ${error.message}`);
         rawVerdicts = [];

package/core/recall-filter.js

@@ -7,9 +7,15 @@
 const FILTER_TIMEOUT_MS = Number(process.env.RECALL_FILTER_TIMEOUT_MS || 20000);
 const MESSAGE_CLIP_CHARS = 1500;
 const CONTEXT_CLIP_CHARS = 3500;
+// The root must be an object: Claude Code turns the schema into a tool whose
+// input_schema the API requires to be an object, so the bare array this used
+// to be got a 400 on every Claude call and the filter failed open.
 const FILTER_OUTPUT_SCHEMA = Object.freeze({
-  type: "array",
-  items: { type: "string" },
+  type: "object",
+  required: ["relevant"],
+  properties: {
+    relevant: { type: "array", items: { type: "string" } },
+  },
 });
 
 function enabled() {
@@ -18,15 +24,28 @@ function enabled() {
 
 const FILTER_SYSTEM_PROMPT = [
   "You are a relevance judge for an assistant's memory recall.",
-  "Reply with ONLY a JSON array of candidate ids — no prose, no markdown fences.",
+  'Reply with ONLY a JSON object {"relevant": [candidate ids]} — no prose, no markdown fences.',
 ].join("\n");
 
+// The reply is {"relevant": [...]}; a bare array is still read.
+function idList(value) {
+  if (Array.isArray(value)) return value;
+  return value && typeof value === "object" && Array.isArray(value.relevant) ? value.relevant : null;
+}
+
 function parseIds(result) {
-  if (Array.isArray(result?.json)) return result.json;
-  const match = String(result?.text || "").match(/\[[\s\S]*?\]/);
-  if (!match) return null;
-  const parsed = JSON.parse(match[0]);
-  return Array.isArray(parsed) ? parsed : null;
+  const fromJson = idList(result?.json);
+  if (fromJson) return fromJson;
+  const text = String(result?.text || "");
+  for (const pattern of [/\{[\s\S]*\}/, /\[[\s\S]*?\]/]) {
+    const match = text.match(pattern);
+    if (!match) continue;
+    try {
+      const ids = idList(JSON.parse(match[0]));
+      if (ids) return ids;
+    } catch (_) { /* try the other shape */ }
+  }
+  return null;
 }
 
 function createRecallFilter(dependencies = {}) {
@@ -62,7 +81,7 @@ function createRecallFilter(dependencies = {}) {
       "Candidates:",
       ...lines,
       "",
-      `Reply with ONLY a JSON array of the relevant ids, e.g. ["${candidates[0].id}"]. Use [] if none are relevant.`,
+      `Reply with ONLY a JSON object of the relevant ids, e.g. {"relevant": ["${candidates[0].id}"]}. Use {"relevant": []} if none are relevant.`,
     ].join("\n");
     try {
       const result = await runUtility(prompt, {

package/core/system-prompt.js

@@ -239,6 +239,16 @@ Raw shell one-liners and heredocs are for probing and diagnosis only — never t
 ${listing}`;
 }
 
+// Kazee Chat's Browser app (core/bot-apps.js): only on a bot that offers it, so a bot without
+// Agent Space is never told to send an Open Browser button that cannot open.
+function buildBrowserAppBlock() {
+  let apps = null;
+  try { apps = require("./bot-apps").appsToRegister(process.env); } catch (_) { apps = null; }
+  if (!apps || !apps.some((app) => app.key === "browser")) return "";
+  return `
+Kazee Chat Browser app: people in a direct chat with you can watch this browser live, take it over, and teach you a task (Teach me). When you need a person in the browser (a login, a captcha, a one-time code, a judgement call), send a card in their direct chat with an Open Browser button, say what you need, then wait: you are woken in that chat when they hand it back. For example \`open-claudia card send '{"v":1,"kind":"report","title":"I need you in the browser","body":"<what you need and why>","open":{"app":"browser","label":"Open Browser"}}'\`. While someone drives, your agent-browser commands other than get, snapshot and screenshot are refused. Never ask for passwords in chat.`;
+}
+
 function buildCoreInstructionsUncached() {
   const soul = loadSoul();
   // Gate on actual TTS capability, not local Whisper: hosted pods hear and
@@ -368,7 +378,7 @@ Core workflow — open, snapshot to get element refs, then act on those refs:
 - \`agent-browser eval "<js>"\` — run JS in the page when no command fits.
 - \`agent-browser close\` — end the session when done.
 
-Notes: a background daemon persists between commands, so navigation state carries across calls in a turn. Prefer \`snapshot -i\` refs over guessing selectors. Keep output lean by acting on refs rather than dumping full HTML. This replaced the old Playwright MCP — do not look for a playwright tool.
+Notes: a background daemon persists between commands, so navigation state carries across calls in a turn. Prefer \`snapshot -i\` refs over guessing selectors. Keep output lean by acting on refs rather than dumping full HTML. This replaced the old Playwright MCP — do not look for a playwright tool.${buildBrowserAppBlock()}
 
 If you tell the user "I'll check back in N minutes" or "I'll run this every morning", you MUST schedule it with one of the commands above in the same turn. Otherwise nothing happens.
 

package/core/tool-guard.js

@@ -659,6 +659,340 @@ function hookFailure(toolName, reason) {
   };
 }
 
+// ── Browser app: the bot pauses while a person drives (bot apps v1, C7) ────
+// While someone drives the bot's browser from Kazee Chat, the driver lock file
+// (core/browser-lock.js) is live, and the bot's own agent-browser commands
+// would fight their clicks. So an agent-browser call at a command position is
+// refused, except the read-only ones: get, snapshot, screenshot, session list.
+// A command position is the start of a command: the start of the line, or
+// after ; & | && || ( $( a backtick or a newline, behind env assignments
+// (FOO=1), shell words (if, then, do, !, {) and wrappers (npx, sudo, env,
+// timeout, nice, xargs...). What a shell runs from a string is read the same
+// way: bash/sh -c '...', eval, a heredoc or here-string fed to a shell, and
+// $(...) or backticks, inside double quotes too. Any other string is data, so
+// `echo "agent-browser click"`, `grep agent-browser`, a commit message or a
+// heredoc written to a file never match. An expired lock never blocks, and any
+// error here allows: this is a pause for a person's sake, not a security gate.
+const AGENT_BROWSER_READ_ONLY = new Set(["get", "snapshot", "screenshot"]);
+const AGENT_BROWSER_VALUE_FLAGS = new Set([
+  "--session", "--restore-save", "--restore-check-url", "--restore-check-text", "--restore-check-fn",
+  "--namespace", "--session-name", "--profile", "--state", "--headers", "--executable-path", "--extension",
+  "--init-script", "--enable", "--args", "--user-agent", "--proxy", "--proxy-bypass", "--ca-cert",
+  "--hide-scrollbars", "-p", "--provider", "--device", "--threshold", "--screenshot-dir", "--screenshot-quality",
+  "--screenshot-format", "--cdp", "--color-scheme", "--download-path", "--max-output", "--allowed-domains",
+  "--action-policy", "--confirm-actions", "--engine", "--input-mode", "--idle-timeout", "--model", "--config",
+  "--port", "--allowed-origins",
+]);
+// agent-browser, agent-browser.js, agent-browser@latest, agent-browser-linux-x64...
+const AGENT_BROWSER_BIN = /^agent-browser(?:$|[.@-])/;
+const SHELL_WORDS = new Set(["!", "{", "if", "then", "else", "elif", "do", "while", "until"]);
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "mksh", "fish"]);
+// Wrappers that run the command after them, with their options that take a value.
+const COMMAND_WRAPPERS = new Map([
+  ["sudo", ["-u", "-g", "-C", "-h", "-p", "-r", "-t", "-U", "-D", "-R", "-T", "--user", "--group", "--host", "--prompt", "--role", "--type", "--other-user", "--chdir", "--chroot", "--command-timeout", "--close-from"]],
+  ["doas", ["-u", "-C"]],
+  ["env", ["-u", "-C", "-S", "--unset", "--chdir", "--split-string"]],
+  ["command", []], ["builtin", []], ["exec", ["-a"]], ["nohup", []], ["setsid", []],
+  ["time", ["-f", "-o", "--format", "--output"]],
+  ["nice", ["-n", "--adjustment"]],
+  ["timeout", ["-s", "-k", "--signal", "--kill-after"]],
+  ["stdbuf", ["-i", "-o", "-e", "--input", "--output", "--error"]],
+  ["xargs", ["-I", "-n", "-L", "-P", "-d", "-E", "-s", "-a", "--max-args", "--max-lines", "--max-procs", "--delimiter", "--eof", "--max-chars", "--arg-file"]],
+  ["npx", ["-p", "--package", "-c", "--call"]],
+  ["pnpx", ["-p", "--package"]],
+  ["bunx", ["-p", "--package"]],
+]);
+// Wrapper options whose value is itself a command line: npx -c, env -S.
+const WRAPPER_SCRIPT_OPTIONS = new Set(["-c", "--call", "-S", "--split-string"]);
+const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+
+const baseName = (word) => String(word).split("/").pop();
+
+// Where $( ... ) that opens at `start` (just after "$(") closes: the index of
+// its ")", or the end of the text. Nested parentheses and quotes are skipped.
+function substitutionEnd(s, start) {
+  let depth = 1;
+  let i = start;
+  while (i < s.length) {
+    const c = s[i];
+    if (c === "\\") { i += 2; continue; }
+    if (c === "'") { const end = s.indexOf("'", i + 1); i = end < 0 ? s.length : end + 1; continue; }
+    if (c === '"') {
+      let j = i + 1;
+      while (j < s.length && s[j] !== '"') j += s[j] === "\\" ? 2 : 1;
+      i = j + 1;
+      continue;
+    }
+    if (c === "(") depth += 1;
+    else if (c === ")") { depth -= 1; if (depth === 0) return i; }
+    i += 1;
+  }
+  return s.length;
+}
+
+// The commands of a shell command line, the way a shell splits them: each is
+// { words, input } with quotes removed, redirection targets and comments left
+// out, and `input` the heredoc bodies and here-strings it reads. `nested` holds
+// the text of every $(...) and backtick, which the shell also runs.
+function shellCommands(command) {
+  const s = String(command || "");
+  const commands = [];
+  const nested = [];
+  let words = [];
+  let input = [];
+  let word = null;
+  let target = false; // the next word is a redirection's file or descriptor
+  let hereString = false; // the next word is a here-string (<<<)
+  let heredocs = []; // heredocs whose bodies start after the next newline
+  const endWord = () => {
+    if (word === null) return;
+    if (target) target = false;
+    else if (hereString) { hereString = false; input.push(word); }
+    else words.push(word);
+    word = null;
+  };
+  const endCommand = () => {
+    endWord();
+    if (words.length) commands.push({ words, input });
+    words = [];
+    input = [];
+    target = false;
+    hereString = false;
+  };
+  const backtick = (i) => {
+    let j = i + 1;
+    while (j < s.length && s[j] !== "`") j += s[j] === "\\" ? 2 : 1;
+    nested.push(s.slice(i + 1, Math.min(j, s.length)));
+    return j + 1;
+  };
+  let i = 0;
+  while (i < s.length) {
+    const c = s[i];
+    if (c === "\\") {
+      if (s[i + 1] === "\n") { i += 2; continue; } // a line continuation
+      if (i + 1 < s.length) word = (word || "") + s[i + 1];
+      i += 2;
+      continue;
+    }
+    if (c === "#" && word === null) { // a comment, to the end of the line
+      while (i < s.length && s[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "'") {
+      const end = s.indexOf("'", i + 1) < 0 ? s.length : s.indexOf("'", i + 1);
+      word = (word || "") + s.slice(i + 1, end);
+      i = end + 1;
+      continue;
+    }
+    if (c === '"') {
+      let j = i + 1;
+      let text = "";
+      while (j < s.length && s[j] !== '"') {
+        if (s[j] === "\\" && j + 1 < s.length) {
+          if (s[j + 1] !== "\n") text += /[$`"\\]/.test(s[j + 1]) ? s[j + 1] : s[j] + s[j + 1];
+          j += 2;
+          continue;
+        }
+        if (s[j] === "$" && s[j + 1] === "(") {
+          const end = substitutionEnd(s, j + 2);
+          nested.push(s.slice(j + 2, end));
+          text += s.slice(j, end + 1);
+          j = end + 1;
+          continue;
+        }
+        if (s[j] === "`") {
+          const after = backtick(j);
+          text += s.slice(j, after);
+          j = after;
+          continue;
+        }
+        text += s[j];
+        j += 1;
+      }
+      word = (word || "") + text;
+      i = j + 1;
+      continue;
+    }
+    if (c === "`") {
+      const after = backtick(i);
+      word = (word || "") + s.slice(i, after);
+      i = after;
+      continue;
+    }
+    if (c === "$" && s[i + 1] === "(") {
+      const end = substitutionEnd(s, i + 2);
+      nested.push(s.slice(i + 2, end));
+      word = (word || "") + s.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (c === "<" && s.startsWith("<<<", i)) { endWord(); hereString = true; i += 3; continue; }
+    if (c === "<" && s[i + 1] === "<") { // a heredoc: its body follows the next newline
+      endWord();
+      i += 2;
+      const strip = s[i] === "-";
+      if (strip) i += 1;
+      while (s[i] === " " || s[i] === "\t") i += 1;
+      let delim = "";
+      while (i < s.length && !/[\s;&|<>()]/.test(s[i])) {
+        if (s[i] === "'" || s[i] === '"') {
+          const q = s[i];
+          const end = s.indexOf(q, i + 1) < 0 ? s.length : s.indexOf(q, i + 1);
+          delim += s.slice(i + 1, end);
+          i = end + 1;
+        } else {
+          if (s[i] !== "\\") delim += s[i];
+          i += 1;
+        }
+      }
+      if (delim) heredocs.push({ delim, strip, input });
+      continue;
+    }
+    if (c === "<" || c === ">") { // a redirection: the word after it is a file, not an argument
+      if (word !== null && /^\d+$/.test(word)) word = null; // the descriptor of 2>, 1>&...
+      endWord();
+      i += /[>&|]/.test(s[i + 1] || "") ? 2 : 1;
+      target = true;
+      continue;
+    }
+    if (c === "\n" || c === "\r") {
+      endCommand();
+      i += 1;
+      if (c === "\n" && heredocs.length) {
+        for (const doc of heredocs) {
+          const body = [];
+          while (i < s.length) {
+            const eol = s.indexOf("\n", i) < 0 ? s.length : s.indexOf("\n", i);
+            let line = s.slice(i, eol);
+            if (doc.strip) line = line.replace(/^\t+/, "");
+            i = eol + 1;
+            if (line === doc.delim) break;
+            body.push(line);
+          }
+          doc.input.push(body.join("\n"));
+        }
+        heredocs = [];
+      }
+      continue;
+    }
+    if (/[;&|()]/.test(c)) { endCommand(); i += 1; continue; }
+    if (/\s/.test(c)) { endWord(); i += 1; continue; }
+    word = (word || "") + c;
+    i += 1;
+  }
+  endCommand();
+  return { commands, nested };
+}
+
+// The index of the command's own name, behind env assignments, shell words and
+// wrappers with their options (-1 when there is none). A wrapper option whose
+// value is a command line (npx -c, env -S) is added to `scripts`.
+function commandWordIndex(words, scripts) {
+  let k = 0;
+  for (let guard = 0; guard < 16 && k < words.length; guard += 1) {
+    const w = words[k];
+    if (ENV_ASSIGNMENT.test(w) || SHELL_WORDS.has(w)) { k += 1; continue; }
+    const name = baseName(w);
+    const valueOptions = COMMAND_WRAPPERS.get(name);
+    if (!valueOptions) return k;
+    k += 1;
+    let positional = name === "timeout" ? 1 : 0; // timeout DURATION command
+    while (k < words.length) {
+      const arg = words[k];
+      if (arg === "--") { k += 1; break; }
+      if (name === "env" && ENV_ASSIGNMENT.test(arg)) { k += 1; continue; }
+      if (arg.length > 1 && arg.startsWith("-")) {
+        if (valueOptions.includes(arg)) {
+          if (WRAPPER_SCRIPT_OPTIONS.has(arg) && words[k + 1] !== undefined) scripts.push(words[k + 1]);
+          k += 2;
+        } else {
+          k += 1;
+        }
+        continue;
+      }
+      if (positional > 0) { positional -= 1; k += 1; continue; }
+      break;
+    }
+  }
+  return k < words.length ? k : -1;
+}
+
+// agent-browser's subcommand and the word after it (sub is null when there is
+// none, e.g. --help or --version).
+function agentBrowserCall(words, at) {
+  let j = at + 1;
+  while (j < words.length) {
+    const arg = words[j];
+    if (arg === "--") { j += 1; continue; }
+    if (arg.startsWith("-")) {
+      if (!arg.includes("=") && AGENT_BROWSER_VALUE_FLAGS.has(arg)) j += 2;
+      else j += /^(true|false)$/.test(words[j + 1] || "") ? 2 : 1; // boolean flags take an optional true/false
+      continue;
+    }
+    return { sub: arg, sub2: words[j + 1] === undefined ? null : words[j + 1] };
+  }
+  return { sub: null, sub2: null };
+}
+
+// Every agent-browser invocation in a command: [{ sub, sub2 }].
+function agentBrowserInvocations(command, depth = 0) {
+  const calls = [];
+  if (depth > 4) return calls;
+  const { commands, nested } = shellCommands(command);
+  const scripts = [...nested];
+  for (const { words, input } of commands) {
+    const at = commandWordIndex(words, scripts);
+    if (at < 0) continue;
+    const name = baseName(words[at]);
+    if (AGENT_BROWSER_BIN.test(name)) {
+      calls.push(agentBrowserCall(words, at));
+    } else if (name === "eval") {
+      scripts.push(words.slice(at + 1).join(" "));
+    } else if (SHELLS.has(name)) {
+      // sh -c '<script>' [name args], else the script a shell reads from its heredoc/here-string.
+      let script = null;
+      for (let j = at + 1; j < words.length; j += 1) {
+        const w = words[j];
+        if (/^-[A-Za-z]*c[A-Za-z]*$/.test(w)) {
+          script = words.slice(j + 1).find((x) => !x.startsWith("-"));
+          break;
+        }
+        if (w === "-o" || w === "+o" || w === "-O" || w === "+O") { j += 1; continue; }
+        if (!w.startsWith("-") && !w.startsWith("+")) break; // a script file
+      }
+      if (script != null) scripts.push(script);
+      else scripts.push(...input);
+    }
+  }
+  for (const script of scripts) calls.push(...agentBrowserInvocations(script, depth + 1));
+  return calls;
+}
+
+function readOnlyBrowserCall(call) {
+  if (!call.sub) return true; // no subcommand: usage or version
+  if (AGENT_BROWSER_READ_ONLY.has(call.sub)) return true;
+  return call.sub === "session" && call.sub2 === "list";
+}
+
+// null, or { subcommand, message } when a live driver lock refuses this command.
+function browserDriverDenial(command, now = Date.now()) {
+  try {
+    const cmd = String(command || "");
+    if (!cmd.includes("agent-browser")) return null;
+    const lock = require("./browser-lock").liveLock(now);
+    if (!lock) return null;
+    const blocked = agentBrowserInvocations(cmd).find((call) => !readOnlyBrowserCall(call));
+    if (!blocked) return null;
+    const name = String(lock.name || "").replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 60) || "Someone";
+    return {
+      subcommand: String(blocked.sub || "").slice(0, 40),
+      message: `${name} is driving the browser right now. Wait for them to hand it back; you will be woken in their chat when they do.`,
+    };
+  } catch (e) {
+    return null;
+  }
+}
+
 // Claude sends the shell command as a string; accept an argv array too.
 function shellCommandOf(input) {
   if (!input || typeof input !== "object") return null;
@@ -727,6 +1061,14 @@ function runHook(payload) {
       logGuardEvent({ kind: "deny", rule: "external-secret-read", pattern: secretDenial.rule, command: String(command).slice(0, 300) });
       return { exit: 2, stderr: secretDenial.message };
     }
+    // A person is driving the browser (Browser app): ahead of the tooling-mode
+    // switch, so relaxed mode cannot drive over them either. Only the
+    // subcommand is logged: the bot's own fill/type commands can carry text.
+    const driving = browserDriverDenial(command);
+    if (driving) {
+      logGuardEvent({ kind: "deny", rule: "browser-driver", subcommand: driving.subcommand });
+      return { exit: 2, stderr: driving.message };
+    }
     // Relaxed tooling mode: the gate observes but never blocks. The event is
     // still logged (as relaxed-pass, not deny) so the dream KPI can report
     // what WOULD have been denied — visibility survives the mode switch.
@@ -761,4 +1103,5 @@ module.exports = {
   externalFileMutationDenial, externalControlPlaneDenial, guardedSpeakerFromEnv,
   protectedReadRoots, isProtectedReadPath, isProtectedSearchRoot, secretReadRule,
   matchRawOp, noteRawOp, readGuardEvents,
+  agentBrowserInvocations, browserDriverDenial,
 };

package/core/utility-agent.js

@@ -123,6 +123,13 @@ function validateSchema(value, schema, location = "$", depth = 0) {
 
 function prepareSchemaFile(schema) {
   if (!schema) return null;
+  // Claude Code turns the schema into a tool whose input_schema the API
+  // requires to be an object, and OpenAI strict mode wants an object root too.
+  // Any other root is refused on every call, which a fail-open caller shows
+  // only as a warning (the dedup adjudicator's array root, 3.2.2 to 3.5.18).
+  if (typeof schema !== "object" || Array.isArray(schema) || schema.type !== "object") {
+    throw new UtilityAgentError("INVALID_UTILITY_SCHEMA", 'outputSchema must have top-level type "object"');
+  }
   let serialized;
   try { serialized = JSON.stringify(schema); }
   catch (_) { throw new UtilityAgentError("INVALID_UTILITY_SCHEMA", "outputSchema must be JSON-serializable"); }