@iowarp/clio-coder 0.4.4 → 0.4.6

package/src/tools/registry.ts

@@ -9,9 +9,10 @@ import {
 	type SkillToolSurfaceViolation,
 } from "../core/skill-activation.js";
 import { type ToolName, ToolNames } from "../core/tool-names.js";
+import { containsInstructionMarkers, INSTRUCTION_SHAPED_WARNING } from "../core/untrusted-content.js";
 import type { MiddlewareContract } from "../domains/middleware/contract.js";
 import type { MiddlewareEffect, MiddlewareHookInput, MiddlewareMetadataValue } from "../domains/middleware/types.js";
-import type { ActionClass, ClassifierCall } from "../domains/safety/action-classifier.js";
+import { type ActionClass, type ClassifierCall, webFetchIsOutward } from "../domains/safety/action-classifier.js";
 import { approvalAxisId } from "../domains/safety/approval-axis.js";
 import {
 	type AutonomyExposure,
@@ -26,6 +27,7 @@ import type { SafetyContract, SafetyDecision } from "../domains/safety/contract.
 import type { DecisionPresentation } from "../domains/safety/decision-presentation.js";
 import { hashToolCall } from "../domains/safety/loop-detector.js";
 import { detectValidationCommand } from "../domains/safety/protected-artifacts.js";
+import type { ImageContent } from "../engine/types.js";
 import { askUserExposure } from "./ask-user.js";
 import { type DispatchPlanView, describeDispatchPlan } from "./dispatch-plan.js";
 import type { ToolPresentationPolicy } from "./presentation.js";
@@ -105,7 +107,7 @@ export interface ToolMetadata {
 	 */
 	promptHint?: ToolPromptHintMetadata;
 	/**
-	 * How transcript surfaces present this tool's block under `/output default`.
+	 * How transcript surfaces present this tool's block under Standard output style.
 	 * Optional: tools that declare nothing fold like every other tool.
 	 */
 	presentation?: ToolPresentationPolicy;
@@ -171,6 +173,8 @@ export type ToolResult =
 	| {
 			kind: "ok";
 			output: string;
+			/** Bounded visual evidence accompanying the mandatory text result. */
+			images?: ImageContent[];
 			details?: ToolResultDetails;
 			/** Internal registry projection consumed only by the agent-tool adapter. */
 			modelContext?: string;
@@ -214,6 +218,12 @@ export interface RegistryDeps {
 }
 
 export interface ToolInvokeOptions {
+	/** Registry-owned filter bound to the active compiled safety policy. */
+	allowsObservationPath?: (path: string) => boolean;
+	/** Trusted submitting host identity for nested dispatch; never model arguments. */
+	hostRun?: import("../domains/dispatch/contract.js").DispatchPreparationOptions["hostRun"];
+	/** Trusted resolved model capability; never read from tool arguments. */
+	supportsImages?: boolean;
 	signal?: AbortSignal;
 	runId?: string;
 	sessionId?: string;
@@ -464,7 +474,12 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 			try {
 				const preparedArgs = prepareToolArgs(spec, call.args ?? {});
 				resultDisposition = resolveToolResultDisposition(spec, preparedArgs);
-				const result = await spec.run(preparedArgs, options);
+				const { allowsObservationPath: _callerPathFilter, ...callerOptions } = options ?? {};
+				const allowsObservationPath = deps.safety.policy?.allowsObservationPath;
+				const result = await spec.run(preparedArgs, {
+					...callerOptions,
+					...(allowsObservationPath ? { allowsObservationPath } : {}),
+				});
 				const digest = toolResultDigestFor(spec, result, resultDisposition, options);
 				const afterEffects = runToolHook("after_tool", spec, call, decision, options, result, digest);
 				const finalResult = shapeToolResult(spec, applyToolResultEffects(result, afterEffects), options, resultDisposition);
@@ -583,10 +598,13 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 				? (spec.describeDispatchPlan?.(call.args ?? {}) ?? describeDispatchPlan(call.args))
 				: null;
 		const planScale = dispatchPlan?.planScale === true;
-		// The exposure tier rides on the args of the gate that raised it, so the
-		// workflow author, not the classifier, decides what counts as outward.
-		// ask_user is the only tool that declares one today.
-		const exposure = call.tool === ToolNames.AskUser ? askUserExposure(call.args) : DEFAULT_AUTONOMY_EXPOSURE;
+		// Gates declare their tier; write-shaped HTTP requests send data outward.
+		const exposure =
+			call.tool === ToolNames.AskUser
+				? askUserExposure(call.args)
+				: call.tool === ToolNames.WebFetch && webFetchIsOutward(call.args)
+					? "outward"
+					: DEFAULT_AUTONOMY_EXPOSURE;
 		const disposition = mapAutonomy(level, actionClass, {
 			executeRecognized: decision.policy?.execRecognition !== "unrecognized",
 			...(planScale ? { dispatchPlanScale: true } : {}),
@@ -1030,10 +1048,8 @@ const HEADLESS_GUIDANCE_MAX_CHARS = 240;
  * model that hits an unrecognized-bash rail retries the same shape until the run
  * ends. An unrecognized execution decision carries the working form in its
  * reasons, and those reasons reach the audit record and the interactive approval
- * overlay but not the model. The first reason states the axis the denial already
- * implies, so only the reasons after it are candidates, and only the first of
- * those, bounded: this is a nudge toward the recognized spelling, not a dump of
- * the policy's reason list.
+ * overlay but not the model. Preserve one bounded recovery hint separately
+ * from the actual policy cause carried by the terminal denial below.
  */
 function headlessDenialGuidance(decision: SafetyDecision, reason: string): string | null {
 	// Interactive denials are left exactly as they were: the operator saw the
@@ -1059,9 +1075,9 @@ function headlessDenialGuidance(decision: SafetyDecision, reason: string): strin
  * it with the standing pivot instruction.
  *
  * A headless answer is the exception: nobody will ever approve it, so the detail
- * carries one line of recovery guidance after the denial sentence. The sentence
- * stays the detail's prefix, which the skill-eval permission-wall recognizer
- * depends on.
+ * carries the policy cause and rule, a terminal settlement statement, and any
+ * recovery guidance. The denial sentence stays the detail's prefix, which the
+ * skill-eval permission-wall recognizer depends on.
  */
 function parkAnsweredBlockedVerdict(
 	decision: SafetyDecision,
@@ -1069,12 +1085,25 @@ function parkAnsweredBlockedVerdict(
 	reason: string,
 ): Extract<RegistryVerdict, { kind: "blocked" }> {
 	const guidance = headlessDenialGuidance(decision, reason);
+	const detail = [reason];
+	if (reason.startsWith(HEADLESS_PERMISSION_DENIED_MARKER)) {
+		if (decision.policy?.ruleId) detail.push(`rule: ${decision.policy.ruleId}`);
+		const cause =
+			decision.policy?.kind === "ask"
+				? decision.policy.reasons[0]
+				: decision.kind === "allow"
+					? undefined
+					: decision.rejection.short;
+		if (cause) detail.push(cause);
+		detail.push("This call was denied; no approval is pending.");
+		if (guidance !== null) detail.push(guidance);
+	}
 	const blocked: SafetyDecision = {
 		kind: "block",
 		classification: decision.classification,
 		rejection: {
 			short: `${tool} blocked: ${decision.classification.actionClass} was not approved`,
-			detail: guidance === null ? reason : `${reason}\n${guidance}`,
+			detail: detail.join("\n"),
 			hints: [],
 		},
 		...(decision.policy !== undefined ? { policy: decision.policy } : {}),
@@ -1206,6 +1235,10 @@ function buildToolHookInput(
 	}
 	if (call.tool !== spec.name) metadata.requestedToolName = call.tool;
 	if (result !== undefined) {
+		if (hook === "after_tool" && ["web_fetch", "read", "bash", "dispatch", "monitor"].includes(spec.name))
+			metadata.untrustedInstructionMarkers = containsInstructionMarkers(
+				result.kind === "ok" ? result.output : result.kind === "error" ? result.message : "",
+			);
 		metadata.resultKind = result.kind;
 		if (result.kind === "error") metadata.errorMessage = result.message;
 		if (result.kind === "ok" && result.terminate === true) metadata.terminate = true;
@@ -1259,14 +1292,18 @@ function firstBlockToolEffect(
 function applyToolResultEffects(result: ToolResult, effects: ReadonlyArray<MiddlewareEffect>): ToolResult {
 	const annotations = annotationMessages(effects);
 	if (annotations.length === 0) return result;
-	const suffix = `\n\n${annotations.join("\n")}`;
+	const warning = `[middleware:warn] ${INSTRUCTION_SHAPED_WARNING}`;
+	const prefix = annotations.includes(warning) ? `${warning}\n\n` : "";
+	const remaining = annotations.filter((annotation) => annotation !== warning);
+	const suffix = remaining.length > 0 ? `\n\n${remaining.join("\n")}` : "";
 	if (result.kind === "ok") {
-		const annotated: ToolResult = { kind: "ok", output: `${result.output}${suffix}` };
+		const annotated: ToolResult = { kind: "ok", output: `${prefix}${result.output}${suffix}` };
 		if (result.details !== undefined) annotated.details = result.details;
 		if (result.terminate === true) annotated.terminate = true;
+		if (result.images !== undefined) annotated.images = result.images;
 		return annotated;
 	}
-	const annotated: ToolResult = { kind: "error", message: `${result.message}${suffix}` };
+	const annotated: ToolResult = { kind: "error", message: `${prefix}${result.message}${suffix}` };
 	if (result.details !== undefined) annotated.details = result.details;
 	return annotated;
 }

package/src/tools/result-shaping.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, readdirSync, rmdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { INSTRUCTION_SHAPED_WARNING } from "../core/untrusted-content.js";
 import { clioStateDir } from "../core/xdg.js";
 import type { ToolInvokeOptions, ToolResult, ToolResultDetails, ToolSpec } from "./registry.js";
 import {
@@ -24,7 +25,10 @@ const RESULT_OFFLOAD_MAX_BYTES = 10 * 1024 * 1024;
 const TAIL_NOTICE_RESERVE_BYTES = 512;
 export const TOOL_OFFLOAD_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
 
-type ToolResultShapeContext = Pick<ToolInvokeOptions, "sessionId" | "toolCallId" | "toolResultMaxBytes">;
+type ToolResultShapeContext = Pick<
+	ToolInvokeOptions,
+	"sessionId" | "toolCallId" | "toolResultMaxBytes" | "supportsImages"
+>;
 
 function mergeDetails(details: ToolResultDetails | undefined, resultSize: Record<string, unknown>): ToolResultDetails {
 	return { ...(details ?? {}), resultSize };
@@ -419,7 +423,7 @@ function withOffloadMetadata(
  * Apply legacy shaping or one declared canonical disposition. Registry calls
  * this once, after middleware annotations have produced the terminal result.
  */
-export function shapeToolResult(
+function shapeTextToolResultBody(
 	spec: ToolSpec,
 	result: ToolResult,
 	context?: ToolResultShapeContext,
@@ -519,3 +523,107 @@ export function shapeToolResult(
 		modelContext: projection.text,
 	};
 }
+
+/** Keep the harness warning visible even when the chosen projection omits the source body. */
+function shapeTextToolResult(
+	spec: ToolSpec,
+	result: ToolResult,
+	context?: ToolResultShapeContext,
+	requestedDisposition?: ToolResultDisposition,
+): ToolResult {
+	const shaped = shapeTextToolResultBody(spec, result, context, requestedDisposition);
+	const warning = `[middleware:warn] ${INSTRUCTION_SHAPED_WARNING}`;
+	if (!resultText(result).includes(warning)) return shaped;
+	const hardMaxBytes = maxBytesFor(spec, context);
+	const disposition = normalizeToolResultDisposition(spec, hardMaxBytes, requestedDisposition);
+	const preserve = (text: string, cap: number, tail: boolean): string => {
+		if (text.startsWith(warning) && byteLength(text) <= cap) return text;
+		const prefix = `${warning}\n\n`;
+		const remainder = text.split(warning).join("").trimStart();
+		const allowance = Math.max(0, cap - byteLength(prefix));
+		if (allowance === 0) return truncateUtf8(warning, cap, "");
+		const body = tail
+			? truncateTail(remainder, { maxBytes: allowance, maxLines: Number.MAX_SAFE_INTEGER }).content
+			: truncateUtf8(remainder, allowance, "");
+		return prefix + body;
+	};
+	const output = preserve(
+		resultText(shaped),
+		Math.min(hardMaxBytes, disposition?.presentation.maxBytes ?? hardMaxBytes),
+		disposition?.presentation.overflow === "tail",
+	);
+	const modelContext =
+		shaped.modelContext === undefined
+			? undefined
+			: preserve(
+					shaped.modelContext,
+					Math.min(hardMaxBytes, disposition?.context.maxBytes ?? hardMaxBytes),
+					disposition?.context.mode === "bounded" && disposition.context.excerpt === "tail",
+				);
+	const previous = existingDisposition(shaped.details);
+	const details = { ...shaped.details };
+	if (previous !== null)
+		details.resultDisposition = {
+			...previous,
+			presentation: { ...previous.presentation, content: output },
+			displayedBytes: byteLength(output),
+			contextBytes: byteLength(modelContext ?? output),
+			presentationTruncated: previous.presentationTruncated || byteLength(resultText(shaped)) > byteLength(output),
+			contextTruncated:
+				previous.contextTruncated || byteLength(shaped.modelContext ?? "") > byteLength(modelContext ?? ""),
+		};
+	const size = detailsRecord(shaped.details, "resultSize");
+	if (size !== null) details.resultSize = { ...size, shownBytes: byteLength(output) };
+	return {
+		...shaped,
+		...(shaped.kind === "ok" ? { output } : { message: output }),
+		...(modelContext === undefined ? {} : { modelContext }),
+		details,
+	};
+}
+
+/** Image bytes share the same payload cap as text, including after annotation. */
+export function shapeToolResult(
+	spec: ToolSpec,
+	result: ToolResult,
+	context?: ToolResultShapeContext,
+	requestedDisposition?: ToolResultDisposition,
+): ToolResult {
+	if (result.kind !== "ok" || !result.images?.length)
+		return shapeTextToolResult(spec, result, context, requestedDisposition);
+	const hardMaxBytes = maxBytesFor(spec, context);
+	const disposition = normalizeToolResultDisposition(spec, hardMaxBytes, requestedDisposition);
+	const maxBytes = Math.min(hardMaxBytes, disposition?.context.maxBytes ?? hardMaxBytes);
+	const images: NonNullable<typeof result.images> = [];
+	let imageBytes = 0;
+	for (const image of result.images) {
+		const bytes = byteLength(image.data);
+		if (
+			context?.supportsImages === true &&
+			disposition?.context.mode !== "metadata-only" &&
+			bytes + imageBytes < maxBytes - 512
+		) {
+			images.push(image);
+			imageBytes += bytes;
+		}
+	}
+	const omitted = result.images.length - images.length;
+	const notice =
+		omitted > 0 ? `[${omitted} image(s) omitted: model capability, context policy, or tool result byte cap.]\n` : "";
+	const remaining = Math.max(1, maxBytes - imageBytes);
+	const shaped = shapeTextToolResult(
+		spec,
+		{ ...result, output: notice + result.output, images },
+		{ ...context, toolResultMaxBytes: remaining },
+		requestedDisposition,
+	);
+	if (shaped.kind !== "ok") return shaped;
+	// Legacy truncation notices may extend beyond their text allowance; the image
+	// envelope has a strict combined cap, so bound the final projections too.
+	return {
+		...shaped,
+		images,
+		output: truncateUtf8(shaped.output, remaining, ""),
+		...(shaped.modelContext === undefined ? {} : { modelContext: truncateUtf8(shaped.modelContext, remaining, "") }),
+	};
+}

package/src/tools/tasks.ts

@@ -47,7 +47,8 @@ function waitingTrailer(tasks: ReadonlyArray<UserTask>): string[] {
 		.filter((task) => task.status === "open" || task.status === "handed")
 		.map(
 			(task) =>
-				`operator tasks waiting: ${task.id} ${JSON.stringify(task.title)} — pick up with action="pick" id="${task.id}"`,
+				`operator tasks waiting: ${task.id} ${JSON.stringify(task.title)} — durable status=${task.status}; ` +
+				`not completed; pick only if this is the intended operator task, with action="pick" id="${task.id}" before work`,
 		);
 }
 
@@ -60,13 +61,30 @@ function renderTaskBoardText(board: TaskBoardSnapshot, userTasks: ReadonlyArray<
 		if (task.status === "blocked" && task.reason) line += ` — blocked: ${task.reason}`;
 		if (task.status === "cancelled" && task.reason) line += ` — dropped: ${task.reason}`;
 		lines.push(line);
-		const outputs = userTasks.find((item) => item.id === task.userTaskId)?.acceptance?.expectedOutputs;
+		const operatorTask = userTasks.find((item) => item.id === task.userTaskId);
+		if (task.userTaskId) {
+			lines.push(
+				`  operator task ${task.userTaskId}: durable status=${operatorTask?.status ?? "unavailable"}; ` +
+					`session=${operatorTask?.handedSessionId ?? "unlinked"}; board task=${operatorTask?.boardTaskId ?? "unlinked"}`,
+			);
+		}
+		const outputs = operatorTask?.acceptance?.expectedOutputs;
 		if (outputs?.length) lines.push(`  expected outputs: ${outputs.join(", ")}`);
-		for (const item of task.requiredValidationEvidence ?? [])
-			lines.push(`  acceptance: ${item.command} (${item.status}; ${item.notes})`);
+		for (const item of task.requiredValidationEvidence ?? []) {
+			if (item.status === "required") {
+				lines.push(
+					`  acceptance requirement: ${item.command} (${item.notes}; declaration only; execution status is in verification receipts)`,
+				);
+			} else {
+				lines.push(`  acceptance: ${item.command} (${item.status}; ${item.notes})`);
+			}
+		}
 	}
 	if (counts.open > 0 && counts.active === 0) {
-		lines.push(`next: start a task with action="start" before working it`);
+		lines.push(
+			`next: start only an authorized task with action="start" before working it; ` +
+				`block proposed implementation with a note naming the pending operator decision, or drop it, and wait`,
+		);
 	}
 	lines.push(...waitingTrailer(userTasks));
 	return lines.join("\n");
@@ -145,7 +163,12 @@ export function createTasksTool(deps: TasksToolDeps): ToolSpec {
 			"pick moves one operator task uN onto the board; start marks one task active (the current focus); " +
 			"done completes a task (started or still pending) and requires note as the " +
 			"evidence the work actually finished; block parks it with a required reason; drop cancels it; list shows the board. " +
-			"Work that did not happen is blocked or dropped, never done.",
+			"For an operator handoff, pick the intended uN before work and use its returned linked tN; CLI hand alone does not pick it. " +
+			"Never pick unrelated inbox tasks. Before claiming operator completion, list and confirm the linked board row is completed " +
+			"and the durable operator status is done with the same session/board link; report those IDs and actual states. " +
+			"Work that did not happen is blocked or dropped, never done. A self-created plan is not operator authorization. " +
+			"For proposal-only work, block deferred implementation with note naming the pending operator decision, or drop it; " +
+			"wait for an explicit operator go-ahead before start or implementation. A skill-install choice does not grant that go-ahead.",
 		parameters: Type.Object({
 			action: StringEnum(TASKS_ACTIONS, { description: "Board action." }),
 			title: Type.Optional(Type.String({ description: "Board title (plan)." })),
@@ -192,7 +215,10 @@ export function createTasksTool(deps: TasksToolDeps): ToolSpec {
 			if (typedAction === "list") {
 				const board = deps.board.snapshot();
 				if (!board) {
-					const output = ['no task board yet; declare one with action="plan"', ...waitingTrailer(userTasks)].join("\n");
+					const output = [
+						'no task board yet; for an operator handoff, pick the intended uN before work; otherwise declare one with action="plan"',
+						...waitingTrailer(userTasks),
+					].join("\n");
 					return {
 						kind: "ok",
 						output,

package/src/tools/verify/frontend.ts

@@ -3,10 +3,12 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { Script } from "node:vm";
+import { prepareBoundedImage } from "../../core/file-references.js";
 import { combineSafeOutput, runCommandVector } from "../../core/safe-exec.js";
+import type { ImageContent } from "../../engine/types.js";
 import { escapeRegExp } from "../ignore-policy.js";
 import { resolveReadPath } from "../path-utils.js";
-import type { ToolResult, ToolResultDetails } from "../registry.js";
+import type { ToolInvokeOptions, ToolResult, ToolResultDetails } from "../registry.js";
 import { maxOutputArg, timeoutArg } from "../safe-exec.js";
 import { truncateUtf8 } from "../truncate-utf8.js";
 import { BROWSER_MODES } from "./surface.js";
@@ -25,6 +27,9 @@ interface FrontendCheck {
 }
 
 interface ValidationOptions {
+	supportsImages?: boolean;
+	imageMaxBytes?: number;
+	images?: ImageContent[];
 	timeoutMs: number;
 	maxOutputBytes: number;
 	signal?: AbortSignal;
@@ -84,7 +89,7 @@ const JAVASCRIPT_TYPES = new Set([
  */
 export async function runFrontendCheck(
 	args: Record<string, unknown>,
-	options?: { signal?: AbortSignal },
+	options?: ToolInvokeOptions,
 ): Promise<ToolResult> {
 	const pathArg = typeof args.path === "string" ? args.path.trim() : "";
 	if (pathArg.length === 0) return { kind: "error", message: "verify: check=frontend requires a path argument" };
@@ -106,6 +111,9 @@ export async function runFrontendCheck(
 	const validateOptions: ValidationOptions = {
 		timeoutMs: timeoutArg(args),
 		maxOutputBytes: maxOutputArg(args),
+		supportsImages: options?.supportsImages === true,
+		imageMaxBytes: Math.min(maxOutputArg(args), options?.toolResultMaxBytes ?? 50_000) - 4096,
+		images: [],
 	};
 	if (options?.signal !== undefined) validateOptions.signal = options.signal;
 
@@ -131,7 +139,7 @@ export async function runFrontendCheck(
 			details,
 		};
 	}
-	return { kind: "ok", output, details };
+	return { kind: "ok", output, details, ...(validateOptions.images?.length ? { images: validateOptions.images } : {}) };
 }
 
 async function validateArtifact(
@@ -550,38 +558,67 @@ async function validateBrowserLoad(
 		});
 		return;
 	}
-	const result = await runCommandVector(
-		browser,
-		[
-			"--headless=new",
-			"--disable-gpu",
-			"--no-sandbox",
-			"--disable-dev-shm-usage",
-			"--dump-dom",
-			pathToFileURL(artifactPath).href,
-		],
-		{
-			timeoutMs: options.timeoutMs,
-			maxOutputBytes: options.maxOutputBytes,
-			...(options.signal !== undefined ? { signal: options.signal } : {}),
-		},
-	);
-	if (result.exitCode === 0 && !result.timedOut && !result.aborted && !result.outputCapped) {
+	// A DOM dump duplicates the complete artifact on stdout. Large, otherwise
+	// valid pages then trip the diagnostic output cap. A private screenshot
+	// proves that the browser rendered without charging page bytes to that cap.
+	// Vision-capable routes retain bounded pixels before the scratch cleanup.
+	const dir = mkdtempSync(path.join(tmpdir(), "clio-coder-browser-check-"));
+	const screenshot = path.join(dir, "loaded.png");
+	try {
+		const result = await runCommandVector(
+			browser,
+			[
+				"--headless=new",
+				"--disable-gpu",
+				"--no-sandbox",
+				"--disable-dev-shm-usage",
+				`--user-data-dir=${path.join(dir, "profile")}`,
+				`--screenshot=${screenshot}`,
+				pathToFileURL(artifactPath).href,
+			],
+			{
+				timeoutMs: options.timeoutMs,
+				maxOutputBytes: options.maxOutputBytes,
+				...(options.signal !== undefined ? { signal: options.signal } : {}),
+			},
+		);
+		let failure: string;
+		if (result.aborted) failure = "headless browser aborted";
+		else if (result.timedOut) failure = `headless browser timed out after ${options.timeoutMs}ms`;
+		else if (result.outputCapped) failure = `headless browser output exceeded ${options.maxOutputBytes} bytes`;
+		else if (result.exitCode !== 0) {
+			failure = `headless browser exited with ${result.exitCode ?? result.signal ?? "unknown"}`;
+		} else if (!existsSync(screenshot) || !statSync(screenshot).isFile() || statSync(screenshot).size === 0) {
+			failure = "headless browser exited without a rendered screenshot";
+		} else {
+			if (options.supportsImages) {
+				const image = await prepareBoundedImage(readFileSync(screenshot), options.imageMaxBytes ?? 0);
+				if (image) options.images?.push(image);
+				else
+					checks.push({
+						name: "browser image",
+						status: "warn",
+						message: "Screenshot omitted: could not encode within the tool result byte cap.",
+					});
+			}
+			checks.push({
+				name: "browser load",
+				status: "pass",
+				message: `loaded and rendered with ${path.basename(browser)}`,
+				path: artifactPath,
+			});
+			return;
+		}
+		const output = truncateUtf8(combineSafeOutput(result).trim(), 800, " [truncated]");
 		checks.push({
 			name: "browser load",
-			status: "pass",
-			message: `loaded with ${path.basename(browser)}`,
+			status: "fail",
+			message: `${failure}${output ? `: ${output}` : ""}`,
 			path: artifactPath,
 		});
-		return;
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
 	}
-	const output = truncateUtf8(combineSafeOutput(result).trim(), 800, " [truncated]");
-	checks.push({
-		name: "browser load",
-		status: "fail",
-		message: `headless browser exited with ${result.exitCode ?? result.signal ?? "unknown"}${output ? `: ${output}` : ""}`,
-		path: artifactPath,
-	});
 }
 
 function parseAttributes(source: string): Record<string, string> {

package/src/tools/verify/numeric.ts

@@ -133,15 +133,15 @@ export function parseNumericPayload(text: string, label: string): NumericPayload
 	const keys = Object.keys(record);
 	if (keys.length > NUMERIC_PAYLOAD_CAPS.keys)
 		return new Error(`${label} exceeds the ${NUMERIC_PAYLOAD_CAPS.keys}-key cap`);
-	const payload: NumericPayload = {};
+	const entries: Array<[string, number | number[]]> = [];
 	let elements = 0;
 	for (const key of keys) {
 		const value = record[key];
 		if (typeof value === "number") {
-			payload[key] = value;
+			entries.push([key, value]);
 			elements += 1;
 		} else if (Array.isArray(value) && value.every((entry) => typeof entry === "number")) {
-			payload[key] = [...(value as number[])];
+			entries.push([key, [...(value as number[])]]);
 			elements += value.length;
 		} else {
 			return new Error(`${label}.${key} must be a number or an array of numbers`);
@@ -150,13 +150,18 @@ export function parseNumericPayload(text: string, label: string): NumericPayload
 			return new Error(`${label} exceeds the ${NUMERIC_PAYLOAD_CAPS.elements}-element cap`);
 		}
 	}
-	return payload;
+	return Object.fromEntries(entries);
 }
 
 function deviation(actual: number, expected: number, index?: number): NumericDeviation {
 	const finite = Number.isFinite(actual) && Number.isFinite(expected);
 	const absolute = finite ? Math.abs(actual - expected) : Number.POSITIVE_INFINITY;
-	const relative = !finite ? null : expected === 0 ? (absolute === 0 ? 0 : null) : absolute / Math.abs(expected);
+	let relative = !finite ? null : expected === 0 ? (absolute === 0 ? 0 : null) : absolute / Math.abs(expected);
+	if (finite && !Number.isFinite(absolute)) {
+		// Finite subtraction overflows only across signs, where division first
+		// is safe. Keep subtraction first for nearby values to preserve precision.
+		relative = Math.abs(actual / expected - 1);
+	}
 	return {
 		...(index !== undefined ? { index } : {}),
 		actual,