@melaya/runner 1.1.23 → 1.1.24

package/dist/assistantHost.py

@@ -719,6 +719,12 @@ def _build_agent():
         max_iters=(int(os.environ.get("MEL_ASSISTANT_MAX_ITERS_PHONE", "300") or "300") if phone_enabled
                    else (int(os.environ.get("MEL_ASSISTANT_MAX_ITERS_BROWSER", "300") or "300") if browser_enabled
                          else (40 if connector_services else 8))),
+        # Driving a device IS the long-horizon shape: read the screen, do one
+        # thing, read again. Without this the codex latency cap silently cut the
+        # 300 above to 3 — one click and a look — and every codex browser turn
+        # ended mid-task claiming an "iteration limit". Connector and plain
+        # chat turns keep the cap: they are not act-and-observe.
+        long_horizon=bool(phone_enabled or browser_enabled),
         reliability=True,
         bounded_memory=True,
     )

package/dist/browserAuthz.d.ts

@@ -1,5 +1,5 @@
 import type { BrowserGrant } from "./browserGrantVerify.js";
-export type AuthzDenyCode = "scheme_forbidden" | "browser_internal_page" | "host_forbidden" | "private_network" | "metadata_endpoint" | "port_forbidden" | "dns_rebind" | "origin_not_in_scope" | "effect_not_granted" | "effect_over_ceiling" | "policy_unavailable";
+export type AuthzDenyCode = "scheme_forbidden" | "browser_internal_page" | "host_forbidden" | "private_network" | "metadata_endpoint" | "port_forbidden" | "dns_rebind" | "origin_not_in_scope" | "effect_not_granted" | "effect_over_ceiling" | "policy_unavailable" | "run_cancelled";
 export type AuthzDecision = {
     allowed: true;
 } | {
@@ -59,6 +59,27 @@ export interface EnforcementHooks {
  *  init-script layer (belt-and-suspenders). Silently skips if CDP
  *  session creation fails (e.g. attached browser, same-process frame). */
 export declare function disableWebRtcViaCdp(cdpSession: unknown): Promise<void>;
+/** What an enforcement installation hands back so it can be REMOVED again.
+ *
+ *  Enforcement used to be install-only, and on an owned browser that was fine:
+ *  teardown closes the whole context, handler included. On the ATTACH and
+ *  INTERACTIVE paths it was not, because those deliberately leave the user's
+ *  browser open after the turn ends. The route handler closed over the run's
+ *  registration, `reg.cancelled` went true at teardown and stayed true, and the
+ *  handler stayed installed on a page the user was still using — so every
+ *  request on that tab, forever after, hit the cancel branch and aborted.
+ *  Chrome renders that abort as `(blocked:devtools)`, which reads like a
+ *  DevTools or anti-bot problem and is neither.
+ *
+ *  Worse, each new run added ANOTHER handler to the same page. The newest one
+ *  wins while its run is live, so the symptom only appeared once a run ended:
+ *  the tab the agent had touched was bricked, and nothing said why.
+ *
+ *  Disposal is idempotent and never throws: a page or context that has already
+ *  closed is the normal case at teardown, not an error. */
+export interface EnforcementHandle {
+    dispose: () => Promise<void>;
+}
 /** Install request-level enforcement on a BrowserContext we OWN (launch
  *  mode). Every document, subresource, XHR, redirect hop, and worker
  *  script fetch flows through here; disallowed ones are aborted.
@@ -66,7 +87,7 @@ export declare function disableWebRtcViaCdp(cdpSession: unknown): Promise<void>;
  *  WebSocket connections are intercepted via routeWebSocket (Playwright
  *  1.48+) with a page-init-script fallback for older builds.
  *  WebRTC is neutralised via an init script on every new page. */
-export declare function enforceOnContext(context: PWBrowserContext, policy: OriginPolicy, hooks: EnforcementHooks): Promise<void>;
+export declare function enforceOnContext(context: PWBrowserContext, policy: OriginPolicy, hooks: EnforcementHooks): Promise<EnforcementHandle>;
 /** Install enforcement on a SINGLE page (attach mode: we never take over
  *  routing for the user's whole externally-owned browser context, only
  *  the leased target the run operates on; navigation of the leased page
@@ -74,5 +95,5 @@ export declare function enforceOnContext(context: PWBrowserContext, policy: Orig
  *  WebSocket interception and WebRTC neutralisation are applied to this
  *  page and its popups in the same way as the owned-context path, scoped
  *  to the single leased target. */
-export declare function enforceOnPage(page: PWPage, policy: OriginPolicy, hooks: EnforcementHooks): Promise<void>;
+export declare function enforceOnPage(page: PWPage, policy: OriginPolicy, hooks: EnforcementHooks): Promise<EnforcementHandle>;
 export {};

package/dist/browserAuthz.js

@@ -399,17 +399,23 @@ export async function disableWebRtcViaCdp(cdpSession) {
         // CDP domain unavailable on this browser build — init script alone.
     }
 }
-/** Install request-level enforcement on a BrowserContext we OWN (launch
- *  mode). Every document, subresource, XHR, redirect hop, and worker
- *  script fetch flows through here; disallowed ones are aborted.
- *  Downloads are default-denied via the page download handler.
- *  WebSocket connections are intercepted via routeWebSocket (Playwright
- *  1.48+) with a page-init-script fallback for older builds.
- *  WebRTC is neutralised via an init script on every new page. */
-export async function enforceOnContext(context, policy, hooks) {
-    await context.route("**/*", async (route) => {
+/** The one request gate, shared by the context-wide and per-page installs so
+ *  the two can never drift in what they allow. */
+function makeRouteHandler(policy, hooks, surface) {
+    return async (route) => {
         const url = route.request().url();
         if (hooks.isCancelled?.()) {
+            // REPORTED, not silent. This branch aborting quietly is exactly what
+            // made a stale handler on a live page undiagnosable: no violation, no
+            // log, just a dead tab. If this fires after teardown the dispose call
+            // was missed and the message says so.
+            hooks.onViolation({
+                url,
+                code: "run_cancelled",
+                message: "the run that installed this enforcement is cancelled or torn down; if the run is already " +
+                    "over, its EnforcementHandle was not disposed and this page is being blocked by a stale handler",
+                surface,
+            });
             await route.abort("blockedbyclient").catch(() => { });
             return;
         }
@@ -418,10 +424,21 @@ export async function enforceOnContext(context, policy, hooks) {
             await route.continue().catch(() => { });
         }
         else {
-            hooks.onViolation({ url, code: d.code, message: d.message, surface: "context_route" });
+            hooks.onViolation({ url, code: d.code, message: d.message, surface });
             await route.abort("blockedbyclient").catch(() => { });
         }
-    });
+    };
+}
+/** Install request-level enforcement on a BrowserContext we OWN (launch
+ *  mode). Every document, subresource, XHR, redirect hop, and worker
+ *  script fetch flows through here; disallowed ones are aborted.
+ *  Downloads are default-denied via the page download handler.
+ *  WebSocket connections are intercepted via routeWebSocket (Playwright
+ *  1.48+) with a page-init-script fallback for older builds.
+ *  WebRTC is neutralised via an init script on every new page. */
+export async function enforceOnContext(context, policy, hooks) {
+    const handler = makeRouteHandler(policy, hooks, "context_route");
+    await context.route("**/*", handler);
     // Inject the WebSocket + WebRTC guard script into every new document
     // BEFORE page JS runs.
     await context.addInitScript({ content: PAGE_GUARD_INIT_SCRIPT }).catch(() => { });
@@ -429,6 +446,7 @@ export async function enforceOnContext(context, policy, hooks) {
         void interceptWebSockets(page, policy, hooks);
         void guardPage(page, policy, hooks, /*closeOnDeny*/ true);
     });
+    return { dispose: () => context.unroute("**/*", handler).catch(() => { }) };
 }
 /** Install enforcement on a SINGLE page (attach mode: we never take over
  *  routing for the user's whole externally-owned browser context, only
@@ -438,21 +456,8 @@ export async function enforceOnContext(context, policy, hooks) {
  *  page and its popups in the same way as the owned-context path, scoped
  *  to the single leased target. */
 export async function enforceOnPage(page, policy, hooks) {
-    await page.route("**/*", async (route) => {
-        const url = route.request().url();
-        if (hooks.isCancelled?.()) {
-            await route.abort("blockedbyclient").catch(() => { });
-            return;
-        }
-        const d = await evaluateUrlResolved(url, policy);
-        if (d.allowed) {
-            await route.continue().catch(() => { });
-        }
-        else {
-            hooks.onViolation({ url, code: d.code, message: d.message, surface: "page_route" });
-            await route.abort("blockedbyclient").catch(() => { });
-        }
-    });
+    const handler = makeRouteHandler(policy, hooks, "page_route");
+    await page.route("**/*", handler);
     // WebSocket + WebRTC for the leased page.
     await page.addInitScript({ content: PAGE_GUARD_INIT_SCRIPT }).catch(() => { });
     await interceptWebSockets(page, policy, hooks);
@@ -462,6 +467,7 @@ export async function enforceOnPage(page, policy, hooks) {
         void interceptWebSockets(popup, policy, hooks);
         void guardPage(popup, policy, hooks, /*closeOnDeny*/ true);
     });
+    return { dispose: () => page.unroute("**/*", handler).catch(() => { }) };
 }
 /** CDP-target-creation gate: when a page/popup materializes, verify its
  *  destination; deny -> close before the agent can observe or act on it.

package/dist/browserBridge.js

@@ -122,9 +122,33 @@ const _lastMouse = new WeakMap();
 async function humanPause(page, min = 40, max = 140) {
     await page.waitForTimeout(_randInt(min, max));
 }
+/** The page's REAL viewport in CSS px.
+ *
+ *  page.viewportSize() returns null whenever the context was launched with
+ *  `viewport: null` — which is what a HEADED browser has to use (see the launch
+ *  sites). Falling back to a constant there would be worse than the bug it
+ *  fixes: resolveActionPoint turns 0..1 fractions into pixels with this, so a
+ *  0.5 fraction on a 2560px-wide window would resolve to 640px and every
+ *  vision-guided click would land in the wrong place, silently.
+ *
+ *  So measure the window instead. The constant survives only as the last
+ *  resort for a page that cannot evaluate at all (crashed, closed, mid-swap). */
+async function liveViewport(page) {
+    const vp = page.viewportSize();
+    if (vp && vp.width > 0 && vp.height > 0)
+        return vp;
+    try {
+        const m = (await page.evaluate("({ width: window.innerWidth, height: window.innerHeight })"));
+        const w = Number(m?.width), h = Number(m?.height);
+        if (w > 0 && h > 0)
+            return { width: w, height: h };
+    }
+    catch { /* page unavailable — fall through */ }
+    return { width: 1280, height: 800 };
+}
 // Eased, jittered pointer travel from the last known position to (tx,ty).
 async function humanMove(page, tx, ty) {
-    const vp = page.viewportSize() ?? { width: 1280, height: 800 };
+    const vp = await liveViewport(page);
     const from = _lastMouse.get(page) ?? { x: _rand(0, vp.width), y: _rand(0, vp.height) };
     const dist = Math.hypot(tx - from.x, ty - from.y);
     const steps = Math.max(6, Math.min(42, Math.round(dist / _rand(18, 34))));
@@ -224,13 +248,136 @@ const KIND_MIN_EFFECT = {
     get_text: "read", // read-only page text extraction
     wait_for_network_idle: "read", // read-only network wait
     ask_user: "read", // human takeover request; handled before any page op
+    // These three are advertised to the agent (browser_submit / browser_batch /
+    // browser_upload_file) and appear in CONSEQUENTIAL_KINDS below, but were
+    // absent HERE — and this map is the allow-list: performAct rejects any kind
+    // that is not a key with `act_kind_unknown`. So all three failed on the
+    // launch/attach transport while the extension transport implemented them,
+    // which made it look like a per-site quirk rather than a missing kind.
+    //
+    // Floors match the server's own classification (browserEffects.baseEffectOf)
+    // so the two transports gate identically:
+    submit: "publish", // committing entered data to the site
+    // A held drag moves something on the page (reorder, drop, slider): the
+    // same uncharacterised-write floor as tap/select_option.
+    drag_hold: "message",
+    upload_file: "upload",
+    // A batch's REAL class is the riskiest of its steps, and every step is
+    // re-gated individually by performAct as it runs. A "read" floor here gates
+    // the batch envelope only; it never lowers a step's own floor.
+    batch: "read",
 };
-// Consequential act kinds blocked while the user has taken over the browser.
-// Read-only kinds (get_text, get_screen_tree path, screenshot, wait,
-// wait_for_network_idle) are intentionally excluded so the agent can observe.
+/** Deterministic PRNG. Jitter must be reproducible: a drag that fails should
+ *  fail the same way twice, otherwise it cannot be debugged. */
+function dragRandom(seed) {
+    let a = seed >>> 0;
+    return () => {
+        a = (a + 0x6d2b79f5) >>> 0;
+        let t = a;
+        t = Math.imul(t ^ (t >>> 15), t | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+/** Sample the travel into `steps` points, plus the ms to dwell after each.
+ *  Returns points EXCLUDING the start (the pointer is already there) and
+ *  ending exactly on the destination. */
+function buildDragPath(from, to, steps, moveMs, shape) {
+    const curve = String(shape.curve || "linear").toLowerCase();
+    const dx = to.x - from.x;
+    const dy = to.y - from.y;
+    const dist = Math.hypot(dx, dy) || 1;
+    // Unit perpendicular to the straight line, for bow and jitter.
+    const nx = -dy / dist;
+    const ny = dx / dist;
+    // Curve presets are just defaults for the numeric knobs, so an explicit
+    // `arc` / `jitter` always wins over the preset.
+    const bowDefault = curve === "arc" ? 0.15 : curve === "human" ? 0.06 : 0;
+    const bow = (shape.arc ?? bowDefault) * dist;
+    const jitterAmp = (shape.jitter ?? (curve === "human" ? 0.012 : 0)) * dist;
+    const overshoot = curve === "overshoot" ? 0.1 * dist : 0;
+    const eased = curve === "ease" || curve === "human" || curve === "overshoot";
+    const rnd = dragRandom(Math.round(from.x * 7 + from.y * 13 + to.x * 17 + to.y * 23) || 1);
+    const ease = (t) => eased ? (t < 0.5 ? 2 * t * t : 1 - Math.pow(-2 * t + 2, 2) / 2) : t;
+    const wp = Array.isArray(shape.waypoints) ? shape.waypoints : [];
+    const nodes = [from, ...wp, to];
+    // Cumulative arc length so a polyline is sampled by DISTANCE, not by node:
+    // sampling per node would crawl through a short leg and rush a long one.
+    const segLen = [];
+    let total = 0;
+    for (let i = 1; i < nodes.length; i++) {
+        const a = nodes[i - 1];
+        const b = nodes[i];
+        const l = Math.hypot(b.x - a.x, b.y - a.y);
+        segLen.push(l);
+        total += l;
+    }
+    if (total <= 0)
+        total = 1;
+    const at = (u) => {
+        // u is 0..1 along the whole polyline.
+        if (nodes.length === 2) {
+            // Single segment: quadratic Bezier so `arc` actually bows it, plus an
+            // overshoot that carries past the target and returns.
+            const reach = 1 + (overshoot / dist) * Math.sin(Math.PI * u);
+            const cx = from.x + dx / 2 + nx * bow;
+            const cy = from.y + dy / 2 + ny * bow;
+            const mt = 1 - u;
+            const bxRaw = mt * mt * from.x + 2 * mt * u * cx + u * u * to.x;
+            const byRaw = mt * mt * from.y + 2 * mt * u * cy + u * u * to.y;
+            return { x: from.x + (bxRaw - from.x) * reach, y: from.y + (byRaw - from.y) * reach };
+        }
+        let d = u * total;
+        for (let i = 0; i < segLen.length; i++) {
+            const len = segLen[i];
+            if (d <= len || i === segLen.length - 1) {
+                const f = len > 0 ? Math.max(0, Math.min(1, d / len)) : 1;
+                const a = nodes[i];
+                const b = nodes[i + 1];
+                return { x: a.x + (b.x - a.x) * f, y: a.y + (b.y - a.y) * f };
+            }
+            d -= len;
+        }
+        return to;
+    };
+    const n = Math.max(2, Math.min(240, steps));
+    const perStep = Math.max(4, Math.round(moveMs / n));
+    const pauses = (Array.isArray(shape.pauses) ? shape.pauses : [])
+        .filter((p) => Array.isArray(p) && p.length === 2 && Number.isFinite(p[0]) && Number.isFinite(p[1]))
+        .map(([t, ms]) => [Math.max(0, Math.min(1, Number(t))), Math.max(0, Math.min(10_000, Number(ms)))]);
+    const out = [];
+    for (let i = 1; i <= n; i++) {
+        const raw = i / n;
+        const u = ease(raw);
+        const p = at(u);
+        // Jitter never applies to the final point: the release has to land exactly
+        // on the drop target, not near it.
+        const j = i < n && jitterAmp > 0 ? (rnd() - 0.5) * 2 * jitterAmp : 0;
+        // A pause "at t" fires on the step that first crosses t.
+        let dwell = perStep;
+        for (const [t, ms] of pauses) {
+            if ((i - 1) / n < t && raw >= t)
+                dwell += ms;
+        }
+        out.push({ x: p.x + nx * j, y: p.y + ny * j, dwellMs: dwell });
+    }
+    // Guarantee the exact destination regardless of easing rounding.
+    const last = out[out.length - 1];
+    out[out.length - 1] = { x: to.x, y: to.y, dwellMs: last.dwellMs };
+    return out;
+}
+// Mirrors shared/tools/browser.py's _BATCH_ALLOWED_KINDS / _BATCH_MAX_STEPS.
+// The tool layer validates too; this is the enforcement point, because the
+// bridge must not trust a caller that skipped it.
+const BATCH_MAX_STEPS = 10;
+const BATCH_ALLOWED_KINDS = new Set([
+    "navigate", "back", "forward", "click", "tap", "input_text", "press_key",
+    "scroll", "select_option", "submit", "wait", "wait_for_network_idle",
+    "get_text", "drag_hold",
+]);
 const CONSEQUENTIAL_KINDS = new Set([
     "navigate", "back", "forward",
-    "click", "dblclick", "hover", "tap",
+    "click", "dblclick", "hover", "tap", "drag_hold",
     "input_text", "press_key", "scroll", "select_option",
     "upload_file", "submit", "ask_user", "batch",
 ]);
@@ -328,7 +475,7 @@ export async function startBrowserBridge(opts) {
                     activePageByRunId.set(reg.spec.runId, page);
                     // Enforce policy on the leased page only (same as cdp-attach mode):
                     // we do not take over context-wide routing for the interactive session.
-                    await enforceOnPage(page, reg.policy, hooks);
+                    reg.enforcement.push(await enforceOnPage(page, reg.policy, hooks));
                     log(`browser session attached to interactive: run=${reg.spec.runId.slice(0, 10)} session=${browserSessionId.slice(0, 16)}`);
                     // Return the interactive record directly — ensureSession callers
                     // (getLease, captureSnapshot, etc.) work against it unchanged.
@@ -358,7 +505,7 @@ export async function startBrowserBridge(opts) {
                     // only — we do not take over routing for the user's whole
                     // externally owned context (plan Section 7 ownership rule;
                     // context-wide routing is applied on owned contexts below).
-                    await enforceOnPage(page, reg.policy, hooks);
+                    reg.enforcement.push(await enforceOnPage(page, reg.policy, hooks));
                     void lease;
                     return rec;
                 }
@@ -379,7 +526,18 @@ export async function startBrowserBridge(opts) {
                 const context = await playwright.chromium.launchPersistentContext(userDataDir, {
                     executablePath: engine.executablePath,
                     headless: reg.spec.headless === true,
-                    viewport: { width: 1280, height: 800 },
+                    // HEADED: no viewport override. A fixed viewport applies a CDP
+                    // device-metrics override, which decouples the rendered page from the
+                    // OS window — the page paints into a 1280x800 box inside a window of a
+                    // different size, and every re-sync (focus change, tab switch, a CDP
+                    // session attaching or detaching, the 2-4 fps live-view capture) snaps
+                    // it between the real window size and the override. That is the
+                    // "screen flapping between full screen and a smaller container, on and
+                    // off in a loop" users reported on their own launched browser.
+                    //
+                    // Headless has no window to disagree with, and a deterministic box is
+                    // worth having there, so it keeps the fixed viewport.
+                    viewport: reg.spec.headless === true ? { width: 1280, height: 800 } : null,
                     acceptDownloads: false, // downloads default-denied (Section 10)
                     ignoreDefaultArgs: ["--enable-automation"],
                     args: [
@@ -399,7 +557,7 @@ export async function startBrowserBridge(opts) {
                     await context.addInitScript(STEALTH_SCRIPT);
                 }
                 catch { /* non-fatal */ }
-                await enforceOnContext(context, reg.policy, hooks);
+                reg.enforcement.push(await enforceOnContext(context, reg.policy, hooks));
                 const page = context.pages()[0] ?? (await context.newPage());
                 sessions.leaseTarget(rec, reg.spec.grant.target.ref, page);
                 // Register this page as the initial active tab for this run.
@@ -503,7 +661,9 @@ export async function startBrowserBridge(opts) {
                 context = await playwright.chromium.launchPersistentContext(userDataDir, {
                     executablePath: resolved.executablePath,
                     headless: false,
-                    viewport: { width: 1280, height: 800 },
+                    // Always headed and always the USER'S OWN visible window: never
+                    // override its metrics. See the note at the run-launch site.
+                    viewport: null,
                     acceptDownloads: false,
                     // Suppress the "browser is being controlled by automated test
                     // software" infobar that Chromium/Brave shows by default.
@@ -592,7 +752,7 @@ export async function startBrowserBridge(opts) {
         const frames = new Map();
         frames.set("main", page.mainFrame());
         frameMaps.set(lease, frames);
-        const viewport = page.viewportSize() ?? { width: 1280, height: 800 };
+        const viewport = await liveViewport(page);
         const collected = [];
         // Main target: covers the top document + all SAME-PROCESS iframes
         // (the flattened DOMSnapshot + AX tree include them) + shadow DOM
@@ -861,7 +1021,7 @@ export async function startBrowserBridge(opts) {
     }
     async function resolveActionPoint(reg, rec, lease, args) {
         const page = lease.page;
-        const viewport = page.viewportSize() ?? { width: 1280, height: 800 };
+        const viewport = await liveViewport(page);
         if (args.ref) {
             const binding = sessions.resolveRef(lease, args.ref);
             const frames = frameMaps.get(lease);
@@ -1118,6 +1278,64 @@ export async function startBrowserBridge(opts) {
                 "paused until they hand control back. Wait and retry, or call " +
                 "browser_get_screen_tree / browser_screenshot to observe the page.");
         }
+        // A declared, fixed step list run in ONE call (plan 0.8). Handled HERE,
+        // before getLease/runOnTarget, and not as a switch case: runOnTarget
+        // serialises through a promise chain per lease, so a nested performAct
+        // would queue behind the very operation it is running inside and deadlock.
+        //
+        // Every step goes back through performAct, so each one is re-gated on its
+        // own: effect ceiling, takeover pause, publish approval, origin policy.
+        // The batch envelope's floor is "read"; a step never gets a cheaper gate
+        // for being inside one.
+        if (kind === "batch") {
+            const rawSteps = Array.isArray(args.steps) ? args.steps : [];
+            if (!rawSteps.length) {
+                throw new BridgeError("act_args_invalid", "batch needs a non-empty steps list");
+            }
+            if (rawSteps.length > BATCH_MAX_STEPS) {
+                throw new BridgeError("act_args_invalid", `batch takes at most ${BATCH_MAX_STEPS} steps; split the flow into several batches`);
+            }
+            const done = [];
+            for (let i = 0; i < rawSteps.length; i++) {
+                const raw = rawSteps[i];
+                if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+                    throw new BridgeError("act_args_invalid", `batch step ${i} is not an object`);
+                }
+                const step = raw;
+                const stepKind = String(step.kind || "");
+                if (!BATCH_ALLOWED_KINDS.has(stepKind)) {
+                    throw new BridgeError("act_args_invalid", `batch step ${i} kind '${stepKind}' is not allowed in a batch. Allowed: ` +
+                        `${[...BATCH_ALLOWED_KINDS].sort().join(", ")}. upload_file, run, ask_user and batch ` +
+                        "must be called on their own.");
+                }
+                try {
+                    // Inherit the batch's HITL mode so a step is gated exactly as it
+                    // would be standalone.
+                    const result = await performAct(reg, {
+                        ...step,
+                        ...(args.hitl_mode
+                            ? { hitl_mode: args.hitl_mode }
+                            : {}),
+                    });
+                    done.push({ step: i, kind: stepKind, ok: true, result });
+                }
+                catch (e) {
+                    // ABORT on the first failure and say where it stopped. Continuing
+                    // would run the rest of a flow whose precondition just failed — the
+                    // remaining steps were declared for a page that no longer exists.
+                    const err = e;
+                    throw new BridgeError(err?.code || "unknown_outcome", `batch stopped at step ${i} (${stepKind}): ${err?.message || String(e)}. ` +
+                        `${done.length} of ${rawSteps.length} steps completed; the page is left wherever that ` +
+                        "step landed. Re-read it before retrying, and do not re-run the whole batch blindly.");
+                }
+                const settle = Number(step.settle_ms ?? 0);
+                if (settle > 0) {
+                    const { lease: l } = await getLease(reg);
+                    await l.page.waitForTimeout(Math.min(5_000, settle));
+                }
+            }
+            return { batch: true, steps_run: done.length, steps: done };
+        }
         const { rec, lease } = await getLease(reg);
         return sessions.runOnTarget(lease, async () => {
             if (reg.cancelled)
@@ -1129,7 +1347,45 @@ export async function startBrowserBridge(opts) {
                     const d = await evaluateUrlResolved(url, reg.policy);
                     if (!d.allowed)
                         throw new BridgeError(d.code, d.message);
-                    await page.goto(url, { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
+                    // Clearing the target URL is not the same as the navigation
+                    // succeeding. The route handler gates every REDIRECT HOP and every
+                    // subresource too, and a site whose apex redirects to www, or whose
+                    // document pulls its own CDN, fails on a hop this pre-check never
+                    // saw. Playwright surfaces that as a bare net::ERR_BLOCKED_BY_CLIENT
+                    // and Chrome paints it (blocked:devtools) — which reads as an
+                    // anti-bot block and sends everyone hunting in the wrong place.
+                    //
+                    // The reason was already recorded, in reg.violations, and then never
+                    // read by anything. Attach whatever this navigation produced so the
+                    // error names the origin to add instead of leaving a dead tab.
+                    const mark = reg.violations.length;
+                    try {
+                        await page.goto(url, { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
+                    }
+                    catch (navErr) {
+                        const blocked = reg.violations.slice(mark);
+                        if (!blocked.length)
+                            throw navErr;
+                        const seen = new Map();
+                        for (const v of blocked) {
+                            let origin = v.url;
+                            try {
+                                origin = new URL(v.url).origin;
+                            }
+                            catch { /* keep raw */ }
+                            if (!seen.has(origin))
+                                seen.set(origin, v.code);
+                        }
+                        const detail = [...seen].slice(0, 8).map(([o, c]) => o + " (" + c + ")").join(", ");
+                        const first = blocked[0].code;
+                        throw new BridgeError(first === "run_cancelled" ? "run_cancelled" : "blocked_origin", "navigation to " + url + " was blocked by the origin policy, not by the site. " +
+                            "Blocked during this navigation: " + detail + ". " +
+                            (first === "run_cancelled"
+                                ? "The run that owns this page is already torn down, so its enforcement should " +
+                                    "have been removed; this is a stale handler, not a policy decision."
+                                : "Add those origins to the grant, or grant all sites, then retry. A scope for an " +
+                                    "apex domain does NOT cover its www host or its CDN hosts."));
+                    }
                     return { navigated: page.url() };
                 }
                 case "back": {
@@ -1314,6 +1570,107 @@ export async function startBrowserBridge(opts) {
                     await page.waitForTimeout(ms);
                     return { waited: ms };
                 }
+                case "submit": {
+                    // Submit the form owning `ref`, or the one owning the focused field.
+                    // requestSubmit() is deliberate: unlike form.submit() it fires the
+                    // submit event and runs validation, so a site's own handler still
+                    // sees the submission. submit() is only the fallback for the few
+                    // forms that predate it.
+                    const ref = args.ref ? String(args.ref) : "";
+                    await enforcePublishGate(reg, page, kind, "", ref || "focused form", args.hitl_mode);
+                    const FIND_AND_SUBMIT = "function(){ var el = this; var f = el && el.closest ? el.closest('form') : null; " +
+                        "if (!f) return false; if (typeof f.requestSubmit === 'function') f.requestSubmit(); " +
+                        "else f.submit(); return true; }";
+                    const cdp = await getCdp(rec, page);
+                    let submitted = false;
+                    if (ref) {
+                        const binding = sessions.resolveRef(lease, ref);
+                        const resolved = await cdp.send("DOM.resolveNode", { backendNodeId: binding.backendNodeId });
+                        const r = await cdp.send("Runtime.callFunctionOn", {
+                            objectId: resolved.object.objectId,
+                            functionDeclaration: FIND_AND_SUBMIT,
+                            returnByValue: true,
+                        });
+                        submitted = r.result?.value === true;
+                    }
+                    else {
+                        // Evaluated as a string through CDP rather than page.evaluate so
+                        // this file needs no DOM lib in its tsconfig.
+                        const r = await cdp.send("Runtime.evaluate", {
+                            returnByValue: true,
+                            expression: "(function(){ var el = document.activeElement; var f = el && el.closest ? el.closest('form') : null; " +
+                                "if (!f) return false; if (typeof f.requestSubmit === 'function') f.requestSubmit(); " +
+                                "else f.submit(); return true; })()",
+                        });
+                        submitted = r.result?.value === true;
+                    }
+                    if (!submitted) {
+                        throw new BridgeError("act_args_invalid", ref
+                            ? `no <form> ancestor for ref '${ref}'. Many sites submit with a button and no form element: ` +
+                                "click the submit control, or focus the field and press Enter with browser_press_key."
+                            : "nothing is focused, or the focused element is not inside a <form>. Click the field first, " +
+                                "or pass the field's @eN ref.");
+                    }
+                    return { submitted: true, via: ref || "focused" };
+                }
+                case "drag_hold": {
+                    // Press-and-HOLD, then move, then release — one continuous gesture.
+                    // A plain click-drag starts moving immediately, which sites read as a
+                    // scroll/selection instead of a grab; the hold is what makes a
+                    // drag-and-drop surface (a kanban card, a reorderable row, a slider
+                    // handle, a canvas object) actually pick the item up.
+                    const from = await resolveActionPoint(reg, rec, lease, {
+                        ...(args.ref ? { ref: args.ref } : {}),
+                        x: args.x1 ?? args.x, y: args.y1 ?? args.y,
+                    });
+                    const to = await resolveActionPoint(reg, rec, lease, {
+                        ...(args.ref2 ? { ref: args.ref2 } : {}),
+                        x: args.x2, y: args.y2,
+                    });
+                    const holdMs = Math.min(5_000, Math.max(0, Number(args.hold_ms ?? 600)));
+                    const moveMs = Math.min(10_000, Math.max(50, Number(args.move_ms ?? 500)));
+                    const settleMs = Math.min(5_000, Math.max(0, Number(args.settle_ms ?? 80)));
+                    const shape = {
+                        ...(args.curve ? { curve: String(args.curve) } : {}),
+                        ...(Number.isFinite(args.arc) ? { arc: Number(args.arc) } : {}),
+                        ...(Number.isFinite(args.jitter) ? { jitter: Number(args.jitter) } : {}),
+                        ...(Array.isArray(args.waypoints) ? { waypoints: args.waypoints } : {}),
+                        ...(Array.isArray(args.pauses) ? { pauses: args.pauses } : {}),
+                    };
+                    const name = await readAccessibleNameAtPoint(page, from.x, from.y);
+                    await enforcePublishGate(reg, page, kind, name, String(args.ref ?? `${Math.round(from.x)},${Math.round(from.y)}`), args.hitl_mode);
+                    await page.mouse.move(from.x, from.y);
+                    await page.mouse.down();
+                    // THE LONG PRESS. Button down, pointer still, nothing dispatched:
+                    // this interval is what the page uses to decide the item is picked
+                    // up, and it is the whole difference from a plain drag.
+                    await page.waitForTimeout(holdMs);
+                    const path = buildDragPath(from, to, Math.round(moveMs / 25), moveMs, shape);
+                    for (const p of path) {
+                        await page.mouse.move(p.x, p.y);
+                        await page.waitForTimeout(p.dwellMs);
+                    }
+                    // Rest on the target before releasing: dragover-driven drop zones
+                    // need a frame or two at rest, and a release mid-motion misses them.
+                    await page.waitForTimeout(settleMs);
+                    await page.mouse.up();
+                    return {
+                        from: { x: Math.round(from.x), y: Math.round(from.y) },
+                        to: { x: Math.round(to.x), y: Math.round(to.y) },
+                        hold_ms: holdMs, move_ms: moveMs, settle_ms: settleMs,
+                        curve: shape.curve ?? "linear", points: path.length,
+                    };
+                }
+                case "upload_file": {
+                    // Honest refusal, not act_kind_unknown. The tool is advertised and
+                    // the schema validates the handle shape, but NOTHING anywhere
+                    // resolves an approved handle back to bytes — not this bridge, not
+                    // the server, not the extension. Saying "unknown kind" sent the model
+                    // hunting for a different spelling of a tool that cannot work yet.
+                    throw new BridgeError("effect_not_granted", "File upload is not available on this transport: an approved file handle cannot be resolved to " +
+                        "a file yet, on any transport. Ask the USER to attach the file themselves with " +
+                        "browser_ask_user, then continue once they confirm.");
+                }
                 default:
                     throw new BridgeError("act_kind_unknown", `unhandled kind '${kind}'`);
             }
@@ -1771,7 +2128,7 @@ export async function startBrowserBridge(opts) {
                         return fail(503, "source_unavailable", "session context is not available");
                     const newPage = await ctxOpen.newPage();
                     // Enforce policy on the new page (same as enforceOnPage for attach mode).
-                    await enforceOnPage(newPage, reg.policy, {
+                    reg.enforcement.push(await enforceOnPage(newPage, reg.policy, {
                         onViolation: (v) => {
                             reg.violations.push({ url: v.url.slice(0, 300), code: v.code, surface: v.surface, at: Date.now() });
                             if (reg.violations.length > 200)
@@ -1779,7 +2136,7 @@ export async function startBrowserBridge(opts) {
                             log(`[authz] DENY ${v.code} (${v.surface}) ${v.url.slice(0, 120)}`);
                         },
                         isCancelled: () => reg.cancelled,
-                    });
+                    }));
                     const newTabRef = getTabRef(newPage);
                     // Navigate to the URL. The origin check above already cleared it.
                     await newPage.goto(tabUrl, { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
@@ -1952,6 +2309,7 @@ export async function startBrowserBridge(opts) {
             policy: buildOriginPolicy(spec.grant.originScopes),
             cancelled: false,
             violations: [],
+            enforcement: [],
             sessionInit: null,
             traces: [],
             externalAttach: false,
@@ -1966,6 +2324,23 @@ export async function startBrowserBridge(opts) {
         if (!reg)
             return;
         reg.cancelled = true; // cancels in-flight ops at their gates
+        // Remove this run's request enforcement from every page/context it
+        // installed on, BEFORE anything else.
+        //
+        // On the owned-launch path the context is about to close and this is a
+        // no-op. On the attach and interactive paths it is the whole point: those
+        // deliberately leave the user's browser open, and the handler we installed
+        // closes over THIS registration. With reg.cancelled now permanently true,
+        // an undisposed handler aborts every request on that page for as long as
+        // the user keeps it open, which Chrome shows as (blocked:devtools) and
+        // which looks like an anti-bot block rather than our own dead handler.
+        // Each new run stacked another one, so the tab only died once a run ended.
+        //
+        // Awaited, not fire-and-forget: a page that unroutes after the next run
+        // has already installed its handler would tear down the LIVE one.
+        for (const e of reg.enforcement.splice(0)) {
+            await e.dispose().catch(() => { });
+        }
         byRunId.delete(runId);
         byToken.delete(reg.token);
         activePageByRunId.delete(runId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.23",
+  "version": "1.1.24",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,