@melra/browser-runtime 0.3.0-alpha.14 → 0.3.0-alpha.16

package/dist/index.js

@@ -4,10 +4,11 @@ import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { access, mkdir, readFile, realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { outcomeUnknown } from "@melra/protocol";
 import { bounded, BrowserCallTimeoutError } from "./bounded.js";
 import { connectBrowser, } from "./browser-connection.js";
-import { assertSafeUrl, } from "@melra/policy-core";
+import { assertSafeUrl, classifyOperation, } from "@melra/policy-core";
 import { startPinningProxy } from "./pinning-proxy.js";
 import { buildSelector } from "./selector.js";
 import { waitForStableDom } from "./stable-dom.js";
@@ -16,6 +17,13 @@ import { waitForStableDom } from "./stable-dom.js";
  * dozens; the interactive ones a caller cares about are always near the front.
  */
 const MAX_FRAMES = 20;
+/**
+ * Whether a page call failed because its document went away under it, on
+ * Playwright's own wording only: that comes before anything an error quotes,
+ * and a quoted selector, the caller's, may say anything.
+ */
+const navigatedAway = (error) => error instanceof Error &&
+    /execution context was destroyed|cannot find context with specified id|unable to adopt element handle|frame (?:was|has been|got) detached|in detached frame|not attached to the dom|interrupted by another navigation/i.test(error.message.split(/["'`]/)[0] ?? "");
 /**
  * Total elements one `inspect` reports. Each frame contributes at most 250
  * (the cap inside `collectFrame`), so the main document can never consume the
@@ -111,6 +119,49 @@ export function captchaReport(frameUrls) {
 export function inputSent(error) {
     return error instanceof Error && /^\s*- performing .+ action$/m.test(withoutColour(error.message));
 }
+/** The actions that send a page input, each pinned to the document it was checked on. */
+const INPUT_ACTIONS = new Set([
+    "click",
+    "type",
+    "fill_form",
+    "select",
+    "press",
+    "upload",
+    "download",
+]);
+/** The actions that navigate the active page or send it input. */
+const DRIVING_ACTIONS = new Set([
+    "navigate",
+    "back",
+    "forward",
+    "reload",
+    ...INPUT_ACTIONS,
+]);
+/** A Playwright wait, or one of ours, that ran out. */
+const timedOut = (error) => error instanceof BrowserCallTimeoutError || (error instanceof Error && error.name === "TimeoutError");
+/**
+ * A wait that ran out at an action's deadline, named for the action's whole
+ * `timeout`: whichever call held the last of it (a re-find's slice, a check
+ * of the page, the input's own wait) is no measure of how long it waited.
+ */
+function ranOut(error, timeout) {
+    if (error instanceof Error && error.name === "TimeoutError") {
+        error.message = error.message.replace(/Timeout \d+ms exceeded/, `Timeout ${timeout}ms exceeded`);
+        return error;
+    }
+    return Object.assign(new Error(`Timeout ${timeout}ms exceeded.`), { name: "TimeoutError" });
+}
+/** Playwright's word for an element its document no longer holds. */
+const detached = (error) => error instanceof Error && error.message.includes("Element is not attached to the DOM");
+/** How long a target found again is searched for before the page is asked whether it left. */
+const REFIND_SLICE_MS = 500;
+/** What a click waits for, short of the hit-target check only the click itself makes. */
+const CLICKABLE = ["visible", "enabled", "stable"];
+/** A URL without its fragment. */
+function withoutFragment(url) {
+    const hash = url.indexOf("#");
+    return hash === -1 ? url : url.slice(0, hash);
+}
 /**
  * A URL as policy names a browser target, without query or fragment. Chrome
  * escapes two path characters Node's URL can keep raw: `|` on every Node, `^`
@@ -129,6 +180,28 @@ export function pageAddress(url) {
         return url;
     }
 }
+/**
+ * Whether this document, shadow roots included, has a secret field with
+ * something in it. Passed to `evaluate`, so it must stand alone; the secret
+ * test is the one `collectFrame` and `extract` use.
+ */
+function filledSecretField() {
+    const secret = (field) => (field instanceof HTMLInputElement && field.type === "password") ||
+        ((field instanceof HTMLInputElement || field instanceof HTMLTextAreaElement) &&
+            !["", "none"].includes(getComputedStyle(field).getPropertyValue("-webkit-text-security")));
+    const roots = [document];
+    while (roots.length > 0) {
+        for (const element of roots.pop().querySelectorAll("*")) {
+            if (element.shadowRoot !== null)
+                roots.push(element.shadowRoot);
+            // The markup counts as well as the live value: a target can match the
+            // `value` attribute, or a textarea's text, after the field was cleared.
+            if (secret(element) && (element.value !== "" || element.defaultValue !== ""))
+                return true;
+        }
+    }
+    return false;
+}
 /** Playwright's terminal colour codes, which mean nothing in a stored record. */
 function withoutColour(text) {
     return text.replace(/\u001b\[[0-9;]*m/g, "");
@@ -142,6 +215,12 @@ function withoutColour(text) {
  */
 function collectFrame(limit) {
     const text = document.body?.innerText ?? "";
+    // A field holding a secret: a password input, or one masked on screen with
+    // CSS; one that shows its text is not hiding it. Kept in here: this function
+    // runs in the page, where nothing outside it exists.
+    const secret = (element) => (element instanceof HTMLInputElement && element.type === "password") ||
+        ((element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement) &&
+            !["", "none"].includes(getComputedStyle(element).getPropertyValue("-webkit-text-security")));
     /**
      * Walk up from the element recording the position of each ancestor, and
      * stop at the first one the page has labelled. The selector string is
@@ -190,9 +269,12 @@ function collectFrame(limit) {
         attributeName: element.getAttribute("name"),
         placeholder: element.getAttribute("placeholder"),
         href: element.getAttribute("href"),
-        value: element instanceof HTMLInputElement ||
+        // Never a secret field's: in a browser someone else also types into,
+        // that is their secret, and this is a read anything may ask for.
+        value: (element instanceof HTMLInputElement ||
             element instanceof HTMLTextAreaElement ||
-            element instanceof HTMLSelectElement
+            element instanceof HTMLSelectElement) &&
+            !secret(element)
             ? element.value.slice(0, 200)
             : null,
         disabled: element instanceof HTMLInputElement ||
@@ -209,9 +291,13 @@ function collectFrame(limit) {
         elements,
     };
 }
+/**
+ * The `<meta>` name of a page only an operator may act on: `melra console`
+ * serves its approval page with it, and its CSP lets no script take it off.
+ */
+export const APPROVAL_SURFACE = "melra-approval-surface";
 export class BrowserRuntime {
     options;
-    browser;
     context;
     activePage;
     connection;
@@ -239,8 +325,66 @@ export class BrowserRuntime {
     popups = [];
     /** Pending closes of blocked popups, awaited before the action reports. */
     closing = [];
-    /** True only while `tab_new` is opening the tab the caller asked for. */
-    openingTab = false;
+    /**
+     * The `newPage` call in flight while `openPage` opens a tab MELRA asked for:
+     * the page it resolves to is that tab, not a window a site opened.
+     */
+    opening;
+    /** In a launched browser, pages handed over while `openPage`'s `newPage` is in flight, held until it settles. */
+    openingPagesQueue = undefined;
+    /**
+     * The windows this runtime owns, by CDP target id: tabs it opened, and every
+     * window one it owns or the tab it is driving opened. Decided when Chromium
+     * creates the window, from the opener it names then: Playwright's `opener()`
+     * comes later, and is null by then if the opener has closed. In a browser
+     * this runtime is attached to, the rest belong to someone else, the
+     * operator above all.
+     *
+     * ponytail: a tab a link opens with a modifier or middle click has no
+     * opener at all, so between actions it counts as the operator's whichever
+     * page clicked it, and while an action runs as the action's. A page's request for one (`Page.frameRequestedNavigation`)
+     * cannot be tied to the tab that follows: a refused request leaves nothing
+     * to match, and claiming the next opener-less tab would let a page have the
+     * operator's tabs, a console's among them, closed. Closing that gap needs a
+     * signal Chromium does not give.
+     */
+    ownTargets = new Set();
+    /**
+     * The active page's target id once this runtime has driven it, navigated it
+     * or sent it input, since it became active. Until then it may be a tab of
+     * the operator's the runtime only picked up, and what it opens is theirs.
+     */
+    drivenTarget;
+    /** Target ids already looked up; a page keeps its id across navigations. */
+    targetIds = new WeakMap();
+    /**
+     * Windows Chromium created while an action was running, with that action's
+     * number: its popups, whenever Playwright gets round to handing them over.
+     */
+    createdActing = new Map();
+    /**
+     * The page targets of this context Chromium has announced and not yet
+     * destroyed, the operator's among them, so an opener can be known for a tab
+     * rather than, say, a frame of one.
+     */
+    pageTargets = new Set();
+    /** The running action: what its page opens is the action's if it navigates the page or sends it input. */
+    action;
+    /**
+     * The target id of the page an action that navigates it or sends it input
+     * acts on, in a browser this runtime is attached to, once looked up: what
+     * it opens while the action runs is the action's, even if the runtime has
+     * not driven it yet. A read leaves it out: like between actions, what a tab
+     * the runtime only landed on opens while the runtime reads it is the
+     * operator's, though the read's own calls into the page give it activation.
+     */
+    actingTarget;
+    /** Counts actions, so a popup reported by a later one says so. */
+    actions = 0;
+    /** The page the running action acts on, once it has one. */
+    actingOn;
+    /** Whether the running action has sent its step back or forward. */
+    stepped = false;
     /**
      * Browser-level session that hears about a new window the moment Chromium
      * creates it, which is what lets an action wait for a popup it knows exists
@@ -248,10 +392,30 @@ export class BrowserRuntime {
      * not grant one; popups are then reported on Playwright's timing alone.
      */
     targets;
-    /** Windows Chromium has created since tracking began, by browser context. */
-    windowsCreated = new Map();
-    /** Windows Playwright has handed to the `page` handler, popup or not. */
-    windowsAdopted = 0;
+    /**
+     * The windows an action's wait is owed, by CDP target id, with their browser
+     * context: every page Chromium creates once tracking began, bar one that is
+     * the operator's in a browser this runtime is attached to. A window leaves
+     * when Playwright has handed it over and its id is looked up (`targetOf`),
+     * or when it is destroyed, which for a blocked popup is the runtime's own
+     * close. Those still owed when an action's wait ends, however it ends, or
+     * when the action fails before it waits, are given up on: kept, one whose
+     * first response never comes would hold every later action to its whole
+     * timeout (#226). One handed over later stands in for no other window
+     * (#234), and is reported by the action running then (`giveUpOwed`).
+     * `popup`: whether it has an opener, as a page's window does and the
+     * runtime's own tab does not.
+     *
+     * ponytail: a window a page opens between actions is owed to the next
+     * action, so one that never loads still holds that action up once.
+     */
+    owed = new Map();
+    /** Popups given up on in block mode, by target id, with the timer that closes them (`giveUpOwed`). */
+    lapsing = new Map();
+    /** Popups those timers closed, until their targets are destroyed. */
+    lapsedIds = new Set();
+    /** Pages handed over closed and blank while one of those was closing: those popups. */
+    lapsedPages = new WeakSet();
     /** This context's id in CDP, resolved on first use and then fixed. */
     contextId;
     /**
@@ -260,14 +424,27 @@ export class BrowserRuntime {
      */
     signal;
     callMs = 30_000;
+    /** A wait's absolute deadline, applied to every bounded call it makes. */
+    waitDeadline;
     /**
      * Set once the running action's effect call has returned. From then on the
      * page may have acted on it, so a failure is no longer evidence that nothing
      * happened — see `execute`.
      */
     dispatched = false;
+    /** Set when the route refused reserved data during the running action. */
+    refusedReserved = false;
+    /**
+     * The workspace root with its links resolved, once, as the file runtime
+     * resolves it: a root link re-pointed later does not move uploads to a
+     * different directory than file operations. An upload awaits it and fails
+     * if it did.
+     */
+    root;
     constructor(options) {
         this.options = options;
+        this.root = realpath(options.workspaceRoot);
+        this.root.catch(() => undefined);
     }
     /**
      * Bound a Playwright call that takes no timeout of its own by the running
@@ -280,26 +457,38 @@ export class BrowserRuntime {
      * instead spends the budget on something that can still answer.
      */
     call(promise, what, ms = this.callMs) {
-        return bounded(promise, ms, what, this.signal);
+        const timeout = this.waitDeadline === undefined
+            ? ms
+            : Math.min(ms, Math.max(Math.min(500, this.callMs), this.waitDeadline - Date.now()));
+        return bounded(promise, timeout, what, this.signal);
     }
     async uploadPaths(paths) {
-        const root = await realpath(this.options.workspaceRoot);
+        const root = await this.root;
+        const configured = resolve(this.options.workspaceRoot);
+        const outside = (from, to) => {
+            const rel = relative(from, to);
+            return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+        };
         const resolved = [];
         for (const input of paths) {
-            const candidate = resolve(root, input);
-            const rel = relative(root, candidate);
-            if (rel === ".." ||
-                rel.startsWith(`..${sep}`) ||
-                isAbsolute(rel)) {
+            // An absolute path spelled through the root as configured is the same
+            // path under the resolved root; both checks below still apply to it.
+            const candidate = isAbsolute(input) && !outside(configured, resolve(input))
+                ? resolve(root, relative(configured, resolve(input)))
+                : resolve(root, input);
+            if (outside(root, candidate)) {
                 throw new Error("browser_upload_outside_workspace");
             }
+            // Before anything looks the name up, so a reserved name gets the same
+            // answer whether it exists or not.
+            if ((await this.options.reserved?.(candidate)) === true)
+                throw new Error("browser_path_reserved");
             const actual = await realpath(candidate);
-            const actualRelative = relative(root, actual);
-            if (actualRelative === ".." ||
-                actualRelative.startsWith(`..${sep}`) ||
-                isAbsolute(actualRelative)) {
+            if (outside(root, actual)) {
                 throw new Error("browser_upload_outside_workspace");
             }
+            if ((await this.options.reserved?.(actual)) === true)
+                throw new Error("browser_path_reserved");
             if (!(await stat(actual)).isFile()) {
                 throw new Error("browser_upload_requires_regular_file");
             }
@@ -307,6 +496,25 @@ export class BrowserRuntime {
         }
         return resolved;
     }
+    /**
+     * `assertSafeUrl`, and a file: URL naming reserved data is refused too. Only
+     * unhinged mode lets a file: URL through the first, and the reserved data
+     * stays out of reach there as it does for the file and terminal adapters.
+     */
+    async assertAllowed(url) {
+        await assertSafeUrl(url, this.options);
+        if (this.options.reserved === undefined || !/^file:/i.test(url))
+            return;
+        let path;
+        try {
+            path = fileURLToPath(url);
+        }
+        catch {
+            throw new Error("browser_path_reserved");
+        }
+        if (await this.options.reserved(path))
+            throw new Error("browser_path_reserved");
+    }
     async ensureContext() {
         if (this.context !== undefined)
             return this.context;
@@ -369,7 +577,6 @@ export class BrowserRuntime {
             ...(proxy === undefined ? {} : { proxyServer: proxy.server }),
         });
         this.connection = connection;
-        this.browser = connection.browser;
         this.context = connection.context;
         this.routeHandler = async (route) => {
             const requestUrl = route.request().url();
@@ -380,10 +587,13 @@ export class BrowserRuntime {
                 return;
             }
             try {
-                await assertSafeUrl(requestUrl, this.options);
+                await this.assertAllowed(requestUrl);
                 await route.continue();
             }
-            catch {
+            catch (error) {
+                if (this.acting && error instanceof Error && error.message === "browser_path_reserved") {
+                    this.refusedReserved = true;
+                }
                 await route.abort("blockedbyclient");
             }
         };
@@ -461,6 +671,7 @@ export class BrowserRuntime {
         this.context.on("close", () => {
             this.context = undefined;
             this.activePage = undefined;
+            this.drivenTarget = undefined;
         });
         /**
          * Report every window the page opened itself, and by default close it.
@@ -473,28 +684,59 @@ export class BrowserRuntime {
          * this governs whether it stays.
          */
         this.context.on("page", (opened) => {
-            // Counted before the early return: every window Chromium creates raises
-            // exactly one of these, including tabs MELRA opened and windows that
-            // closed before Playwright finished with them.
-            this.windowsAdopted += 1;
-            if (opened === this.activePage || this.openingTab)
+            // One the runtime closed when its time ran out (`giveUpOwed`) is handed
+            // over closed and blank just before its target is destroyed: told apart
+            // now, while its id is still among those closing.
+            if (this.lapsedIds.size > 0 && opened.isClosed() && opened.url() === "")
+                this.lapsedPages.add(opened);
+            const attached = this.options.cdpEndpoint !== undefined && this.targets !== undefined;
+            // In a launched browser the tab `openPage` asked for and a popup handed
+            // over in the same instant look alike until `newPage` says which is the
+            // tab; `openPage` sorts them then.
+            if (!attached && this.openingPagesQueue !== undefined) {
+                this.openingPagesQueue.push(opened);
                 return;
-            // Closing a window the page opened is MELRA's judgement about what the
-            // caller should be looking at, so unhinged mode drops it. Reporting it is
-            // not a judgement — that stays on, like every other receipt.
-            const allowed = this.options.popups === "allow" || this.options.unhinged === true;
-            if (this.popups.length < MAX_POPUPS) {
-                this.popups.push({
-                    url: opened.url(),
-                    blocked: !allowed,
-                    ...(this.acting ? {} : { betweenActions: true }),
-                });
             }
-            if (allowed)
+            const opening = this.opening;
+            if (opened === this.activePage && !attached) {
+                this.release(opened);
                 return;
-            // A popup that closed on its own, or whose opener navigated away first,
-            // must not turn into the action's error.
-            this.closing.push(opened.close().catch(() => undefined));
+            }
+            const acting = this.acting;
+            // `during`: whether the window came while an action ran, which in a
+            // browser this runtime is attached to is known from when it was created.
+            const adopt = (during = acting) => this.adopt(opened, during);
+            // In a browser this runtime is attached to, a tab Chromium created
+            // between its actions is the operator's (one they opened, a console
+            // `melra console` opened) unless it is one of this runtime's
+            // (`ownTargets`): that tab is left alone and not reported. Judged by when
+            // it was created, not by when Playwright hands it over, which for a slow
+            // first response can be during the next action.
+            if (attached) {
+                this.closing.push((async () => {
+                    // The tab this runtime is opening is the page `newPage` resolves
+                    // to, and is not judged; any other window handed over in that
+                    // instant is judged like any other, by its id looked up now, while
+                    // it is still open: one that closes before `newPage` settles could
+                    // no longer be looked up, and would be taken for a popup.
+                    if (opening !== undefined) {
+                        const looked = this.targetOf(opened).catch(() => undefined);
+                        if (opened === (await opening.catch(() => undefined)))
+                            return;
+                        await looked;
+                    }
+                    const { adopt: yes, during } = await this.adoptable(opened, acting);
+                    return yes ? adopt(during) : undefined;
+                })());
+                return;
+            }
+            const closing = adopt();
+            // A blocked popup stops being owed when its close destroys it; one left
+            // open, once looked up.
+            if (closing === undefined)
+                this.release(opened);
+            else
+                this.closing.push(closing);
         });
         /**
          * Hear about new windows when Chromium creates them, not when Playwright
@@ -504,38 +746,93 @@ export class BrowserRuntime {
          * has committed, so a click whose window loaded slowly returned with no
          * `popups` field and the report — and, in block mode, the close — landed in
          * whatever ran next. Chromium creates the target synchronously inside
-         * `window.open` or the `target=_blank` click, so this count is already
-         * right when the action finishes and `awaitOpenedWindows` knows how many
-         * reports are still owed. It sees every way of opening a window, and the
-         * page cannot see or tamper with it, which an injected `window.open` hook
-         * could not promise.
-         *
-         * Registered after the `page` handler, so any miscount during setup is a
-         * window adopted but never counted — at worst one later wait ends early —
-         * rather than one counted and never adopted, which no wait could satisfy.
+         * `window.open` or the `target=_blank` click, so `owed` is already complete
+         * when the action finishes and `awaitOpenedWindows` knows which reports
+         * are still owed. It sees every way of opening a window, and the page
+         * cannot see or tamper with it, which an injected `window.open` hook could
+         * not promise.
          */
-        this.windowsCreated = new Map();
-        this.windowsAdopted = 0;
+        this.owed = new Map();
+        this.forgetLapsing();
         this.contextId = undefined;
-        // A session left from a context that closed under us would count into the
+        this.ownTargets = new Set();
+        this.drivenTarget = undefined;
+        this.targetIds = new WeakMap();
+        this.createdActing = new Map();
+        this.pageTargets = new Set();
+        // A session left from a context that closed under us would record into the
         // fresh map below and make every action wait for windows that never come.
         if (this.targets !== undefined) {
             await this.call(this.targets.detach(), "cdp_detach", SETUP_TIMEOUT_MS).catch(() => undefined);
         }
         try {
             const targets = await this.call(connection.browser.newBrowserCDPSession(), "cdp_session", SETUP_TIMEOUT_MS);
+            // Set once Chromium has announced the windows that were already there:
+            // those are no action's popups, and no window of theirs is the runtime's.
+            let announced = false;
             targets.on("Target.targetCreated", ({ targetInfo }) => {
                 // `browser_ui`, workers, and prerenders never become Playwright pages.
                 if (targetInfo.type !== "page" || targetInfo.subtype !== undefined)
                     return;
+                this.pageTargets.add(targetInfo.targetId);
                 const id = targetInfo.browserContextId ?? "";
-                this.windowsCreated.set(id, (this.windowsCreated.get(id) ?? 0) + 1);
+                if (announced) {
+                    const opener = targetInfo.openerId;
+                    // A window an action's popup opens, before that popup is even judged,
+                    // is the runtime's like the popup.
+                    const runtimes = (target) => this.ownTargets.has(target) ||
+                        target === this.drivenTarget ||
+                        target === this.actingTarget ||
+                        this.createdActing.has(target);
+                    // Between actions, a window is the operator's unless the runtime's
+                    // own tab opened it. While an action runs, it is that action's
+                    // popup unless it is plainly the operator's: one Chromium says an
+                    // operator's tab opened, or one with no opener that Chromium creates
+                    // blank or at one of its own pages (a client's new tab, a tab from
+                    // the toolbar), which no page can have the browser open. A page's
+                    // new tab starts out empty, and a window the browser opens for a
+                    // page (a sign-in window, say) starts at the provider's address, so
+                    // both stay the action's, and so does any page's activation: the
+                    // runtime's own calls into a page give it some. A frame's opener, or
+                    // a page's tab while the page a navigation or an input goes to is
+                    // not known yet, is the action's.
+                    const action = this.action;
+                    const theirs = this.options.cdpEndpoint !== undefined &&
+                        (this.acting
+                            ? opener === undefined
+                                ? targetInfo.url === "about:blank" || targetInfo.url.startsWith("chrome://")
+                                : !(action !== undefined && DRIVING_ACTIONS.has(action) && this.actingTarget === undefined) &&
+                                    this.pageTargets.has(opener) &&
+                                    !runtimes(opener)
+                            : opener === undefined || !runtimes(opener));
+                    // The operator's, which no action reports, so no wait is owed it.
+                    if (theirs)
+                        return;
+                    if (this.acting)
+                        this.createdActing.set(targetInfo.targetId, this.actions);
+                    else if (opener !== undefined && runtimes(opener))
+                        this.ownTargets.add(targetInfo.targetId);
+                    this.owed.set(targetInfo.targetId, { context: id, popup: opener !== undefined });
+                }
+            });
+            // Ids stay after their window closes: one that closes itself as soon as
+            // it loads is still to be judged when Playwright hands it over.
+            // ponytail: `ownTargets` keeps one id per window the runtime owned for
+            // the context's life; prune once its `page` event is handled if that
+            // ever matters.
+            targets.on("Target.targetDestroyed", ({ targetId }) => {
+                if (this.drivenTarget === targetId)
+                    this.drivenTarget = undefined;
+                this.pageTargets.delete(targetId);
+                this.owed.delete(targetId);
+                clearTimeout(this.lapsing.get(targetId));
+                this.lapsing.delete(targetId);
+                this.lapsedIds.delete(targetId);
             });
             await this.call(targets.send("Target.setDiscoverTargets", { discover: true }), "cdp:Target.setDiscoverTargets", SETUP_TIMEOUT_MS);
             // Chromium announces the windows that already exist before it replies.
-            // Playwright had them before the `page` handler did, so they are owed no
-            // event here.
-            this.windowsCreated.clear();
+            // Playwright had them before the `page` handler did, so none is owed.
+            announced = true;
             this.targets = targets;
         }
         catch {
@@ -544,14 +841,19 @@ export class BrowserRuntime {
         return this.context;
     }
     /**
-     * Hold the action's result until Playwright has handed over every window
-     * Chromium created, so the action that opened a window is the one that
-     * reports it.
+     * Hold the action's result while this context's windows are still owed
+     * (`owed`), so the action that opened a window is the one that reports it.
+     * A window stops being owed once it is handed over and looked up, or once it
+     * is destroyed: in a launched browser a blocked popup when the runtime's
+     * close lands and an allowed one when its lookup returns; in one this
+     * runtime is attached to, every window once it is looked up to be judged;
+     * and one destroyed before it is handed over, at once.
      *
      * Costs one round trip when nothing was opened. Waits only while a window is
-     * known to exist and is still unreported, bounded by the action's own
-     * timeout: the window is part of what the action did. A window still pending
-     * after that is reported by the action running when Playwright delivers it.
+     * owed, bounded by the action's own timeout: the window is part of what the
+     * action did. One still owed after that is given up on, so no later action
+     * waits for it, and is reported by the action running when Playwright
+     * delivers it, if it ever does.
      */
     async awaitOpenedWindows(timeoutMs) {
         const targets = this.targets;
@@ -559,25 +861,17 @@ export class BrowserRuntime {
         if (targets === undefined || context === undefined)
             return;
         try {
-            if (this.contextId === undefined) {
-                const page = context.pages()[0];
-                if (page === undefined)
-                    return;
-                const session = await this.call(context.newCDPSession(page), "cdp_session");
-                try {
-                    const { targetInfo } = await this.call(session.send("Target.getTargetInfo"), "cdp:Target.getTargetInfo");
-                    this.contextId = targetInfo.browserContextId ?? "";
-                }
-                finally {
-                    await this.call(session.detach(), "cdp_detach").catch(() => undefined);
-                }
-            }
+            if (!(await this.learnContextId()))
+                return;
             // Events arrive ahead of the reply on the same session, so after this
-            // every window created before now has been counted.
+            // every window created before now is in `owed`.
             await this.call(targets.send("Browser.getVersion"), "cdp:Browser.getVersion");
+            const contextId = this.contextId ?? "";
+            const owed = () => [...this.owed.values()].some((window) => window.context === contextId);
             const deadline = Date.now() + timeoutMs;
-            while (this.windowsAdopted < (this.windowsCreated.get(this.contextId) ?? 0) &&
-                Date.now() < deadline) {
+            // A cancel ends the wait at once: what is still owed is given up below,
+            // and the queue behind this action is not held to its deadline.
+            while (owed() && Date.now() < deadline && this.signal?.aborted !== true) {
                 await new Promise((done) => setTimeout(done, WINDOW_POLL_MS));
             }
         }
@@ -587,30 +881,255 @@ export class BrowserRuntime {
             // this wait only ever decides which action reports a window, so it is
             // not worth failing an action over.
         }
+        finally {
+            // However the wait ended, what is still owed is no later action's to
+            // wait for. Other contexts' windows go too: none is handed over here.
+            this.giveUpOwed(timeoutMs);
+        }
+    }
+    /**
+     * Gives up on the windows still owed (`owed`). In block mode a popup among
+     * them, which Playwright has not handed over to be closed, is closed by its
+     * id once it has had as long again to load (#240). One that loads in that
+     * time is handed over, reported with its address, and closed as any popup
+     * is; one that never does is handed over closed, with no address, and
+     * reported between actions (`adopt`). In a launched browser every window is
+     * this runtime's; in one it is attached to, only a window of this context is
+     * closed, checked when the timer fires. The context is known by then even
+     * when the action giving up failed before its wait: any page looked up
+     * tells it (`targetOf`), and an action that drives a page looks it up first.
+     *
+     * ponytail: "as long again" is the giving-up action's own `grace`
+     * (its `timeoutMs`), not a setting; a window that loads later is closed
+     * before it can be seen.
+     */
+    giveUpOwed(grace) {
+        const targets = this.targets;
+        const block = this.options.popups !== "allow" && this.options.unhinged !== true;
+        for (const [targetId, window] of this.owed) {
+            if (!block || targets === undefined || !window.popup)
+                continue;
+            const timer = setTimeout(() => {
+                this.lapsing.delete(targetId);
+                if (this.options.cdpEndpoint !== undefined && window.context !== this.contextId)
+                    return;
+                this.lapsedIds.add(targetId);
+                void targets.send("Target.closeTarget", { targetId }).catch(() => this.lapsedIds.delete(targetId));
+            }, grace);
+            // Nothing to close once the process is done with everything else.
+            timer.unref();
+            this.lapsing.set(targetId, timer);
+        }
+        this.owed.clear();
+    }
+    forgetLapsing() {
+        for (const timer of this.lapsing.values())
+            clearTimeout(timer);
+        this.lapsing.clear();
+        this.lapsedIds.clear();
+    }
+    /**
+     * This context's id in CDP, looked up once: what owed windows are kept
+     * under. False when there is no page yet to ask.
+     */
+    async learnContextId() {
+        if (this.contextId !== undefined)
+            return true;
+        // A cancelled action does not open a session it would only abandon.
+        if (this.signal?.aborted === true)
+            return false;
+        const page = this.context?.pages()[0];
+        if (page === undefined)
+            return false;
+        const opening = page.context().newCDPSession(page);
+        const session = await this.call(opening, "cdp_session").catch((error) => {
+            // One that attaches after the bound or a cancel is let go, not left on the page.
+            void opening.then((late) => late.detach()).catch(() => undefined);
+            throw error;
+        });
+        try {
+            const { targetInfo } = await this.call(session.send("Target.getTargetInfo"), "cdp:Target.getTargetInfo");
+            this.contextId = targetInfo.browserContextId ?? "";
+            return true;
+        }
+        finally {
+            // Not waited for, as in `targetOf`: a detach waits on the page's main
+            // thread, which a page busy with a long script holds.
+            void session.detach().catch(() => undefined);
+        }
+    }
+    /** A window handed over is owed by no wait once its id is known (`owed`). */
+    release(page) {
+        if (this.targets !== undefined)
+            void this.targetOf(page).catch(() => undefined);
+    }
+    /**
+     * Reports a window a page opened and, in block mode, closes it. `during`:
+     * whether it came while an action ran.
+     */
+    adopt(opened, during = this.acting) {
+        // Closing a window the page opened is MELRA's judgement about what the
+        // caller should be looking at, so unhinged mode drops it. Reporting it is
+        // not a judgement — that stays on, like every other receipt.
+        const allowed = this.options.popups === "allow" || this.options.unhinged === true;
+        // One the runtime closed when its time ran out (`giveUpOwed`) came after
+        // the action that opened it returned, whatever action runs by now.
+        const lapsed = this.lapsedPages.has(opened);
+        if (this.popups.length < MAX_POPUPS) {
+            this.popups.push({
+                // Without its fragment: a console opened by the operator carries its
+                // one-time pairing code there until its first script runs.
+                url: withoutFragment(opened.url()),
+                blocked: !allowed,
+                ...(during && !lapsed ? {} : { betweenActions: true }),
+            });
+        }
+        if (allowed)
+            return;
+        // A popup that closed on its own, or whose opener navigated away first,
+        // must not turn into the action's error.
+        return opened.close().catch(() => undefined);
     }
     /**
      * Opens a page MELRA asked for, not one the site opened by itself.
      *
      * The popup handler cannot tell the two apart — both arrive as a `page`
-     * event — so this flag is the difference, and it is held across exactly the
-     * await that emits the event.
+     * event — so `opening` holds the `newPage` call that emits the event, and a
+     * browser this runtime is attached to compares the page with what it
+     * resolves to. A launched browser looks no window up as it is handed over,
+     * so the handler queues every page it is handed then (#233), and they are
+     * sorted here once `newPage` has said which one is the tab.
      */
     async openPage(context) {
-        this.openingTab = true;
+        const queued = [];
+        // Where the judgements of windows handed over from here on begin, in a
+        // browser this runtime is attached to.
+        const judged = this.closing.length;
+        this.openingPagesQueue = queued;
+        const opening = this.call(context.newPage(), "new_page");
+        this.opening = opening;
+        // Any page queued but the tab `newPage` returned is a window a page
+        // opened. One that failed may still have handed over the tab it was
+        // opening: Playwright does so just before it rejects, having closed it, so
+        // a closed page queued last is taken for that tab.
+        //
+        // ponytail: a window a page opened that is handed over last and closed
+        // itself already, during a `newPage` that fails, is taken for the tab and
+        // not reported: a closed page can no longer be looked up by id.
+        const sortQueued = (tab) => {
+            this.opening = undefined;
+            this.openingPagesQueue = undefined;
+            const last = queued.at(-1);
+            const mine = tab ?? (last?.isClosed() === true ? last : undefined);
+            return queued.flatMap((page) => {
+                const closing = page === mine ? undefined : this.adopt(page);
+                if (closing === undefined)
+                    this.release(page);
+                return closing ?? [];
+            });
+        };
+        let opened;
+        try {
+            opened = await opening;
+        }
+        catch (error) {
+            // Their closes are waited for like any other.
+            this.closing.push(...sortQueued());
+            throw error;
+        }
+        // Closed before `tab_new` lists the tabs, so the list it returns does not
+        // show a window the same result reports as closed: those queued here, and
+        // those judged meanwhile in a browser this runtime is attached to, whose
+        // judgement waits for `newPage`.
+        await this.call(Promise.all([...sortQueued(opened), ...this.closing.slice(judged)]), "close_popup");
+        if (this.options.cdpEndpoint !== undefined)
+            this.ownTargets.add(await this.targetOf(opened));
+        return opened;
+    }
+    /**
+     * A page's CDP target id. Bounded on its own, not by the action's budget or
+     * cancel: between actions those belong to an action that has finished.
+     */
+    async targetOf(page) {
+        const known = this.targetIds.get(page);
+        if (known !== undefined)
+            return known;
+        const session = await bounded(page.context().newCDPSession(page), SETUP_TIMEOUT_MS, "cdp_session");
         try {
-            return await this.call(context.newPage(), "new_page");
+            const { targetInfo } = await bounded(session.send("Target.getTargetInfo"), SETUP_TIMEOUT_MS, "cdp:Target.getTargetInfo");
+            this.targetIds.set(page, targetInfo.targetId);
+            // Handed over, since there is a page to ask: owed by no wait now.
+            this.owed.delete(targetInfo.targetId);
+            // Any page of this context also tells the context, if no action has yet.
+            this.contextId ??= targetInfo.browserContextId ?? "";
+            return targetInfo.targetId;
         }
         finally {
-            this.openingTab = false;
+            // Not waited for: a detach waits on the page's main thread, which a
+            // page busy with a long script holds for as long as it runs.
+            void session.detach().catch(() => undefined);
         }
     }
+    /**
+     * Whether to treat a new window as this runtime's, in a browser it is
+     * attached to: one created while an action ran, which then counts as the
+     * runtime's for the windows it opens, or one of `ownTargets`. `during`
+     * says whether the action reporting it is the one it came in; any other
+     * reports it as between actions. Asked twice before giving up. One that
+     * closed before it could be asked is reported, as everywhere else; that
+     * one, and one still open that cannot be asked, count by when Playwright
+     * handed it over.
+     */
+    async adoptable(page, acting) {
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                const id = await this.targetOf(page);
+                const createdIn = this.createdActing.get(id);
+                if (createdIn === undefined)
+                    return { adopt: this.ownTargets.has(id), during: false };
+                this.createdActing.delete(id);
+                this.ownTargets.add(id);
+                return { adopt: true, during: this.acting && createdIn === this.actions };
+            }
+            catch {
+                if (page.isClosed())
+                    return { adopt: true, during: acting };
+            }
+        }
+        return { adopt: acting, during: acting };
+    }
+    /**
+     * Makes `page` the one actions land on. It is not driven yet: it may be a
+     * tab of the operator's the runtime only picked up, and what it opens stays
+     * theirs until the runtime navigates it or sends it input (`drive`). The
+     * page already active stays driven if it was.
+     */
+    activate(page) {
+        if (page !== this.activePage)
+            this.drivenTarget = undefined;
+        this.activePage = page;
+    }
+    /**
+     * The runtime is navigating the active page or has sent it input, so from
+     * here what that page opens is the runtime's, until another page is made
+     * active. Not before: an action refused, or one whose target was never
+     * found, leaves an operator's tab theirs.
+     */
+    async drive(page) {
+        if (this.options.cdpEndpoint === undefined || page === undefined)
+            return;
+        const id = await this.targetOf(page);
+        if (this.activePage === page)
+            this.drivenTarget = id;
+    }
     async page() {
         const context = await this.ensureContext();
         if (this.activePage !== undefined && !this.activePage.isClosed()) {
             return this.activePage;
         }
-        this.activePage = context.pages()[0] ?? (await this.openPage(context));
-        return this.activePage;
+        const page = context.pages()[0] ?? (await this.openPage(context));
+        this.activate(page);
+        return page;
     }
     /**
      * The tab list, with the index each entry can be addressed by.
@@ -618,14 +1137,109 @@ export class BrowserRuntime {
      * Returned by every tab action rather than only by `tabs`, because opening,
      * switching, and closing all renumber the list — a caller that had to issue a
      * separate `tabs` call after each one would be acting on a stale index.
+     *
+     * Never throws: it follows the effect of every tab action but `tabs`, and a
+     * listing that failed made a tab opened or closed read as nothing done. A
+     * tab that does not answer within a second, or the action's timeout if
+     * shorter, or before a cancel, is listed with `title: null`;
+     * one closed meanwhile is left out, and the indices are the ones after it.
+     * `pages` is the list they index, for an action to report its own tab's.
      */
     async describeTabs(context) {
-        return await Promise.all(context.pages().map(async (item, index) => ({
+        const titles = new Map(await Promise.all(context
+            .pages()
+            .map(async (item) => [item, await this.call(item.title(), "title", Math.min(1_000, this.callMs)).catch(() => null)])));
+        const pages = context.pages();
+        const tabs = pages.map((item, index) => ({
             index,
             url: item.url(),
-            title: await this.call(item.title(), "title"),
+            title: titles.get(item) ?? null,
             active: item === this.activePage,
-        })));
+        }));
+        return { pages, tabs };
+    }
+    /**
+     * Whether any frame of the page holds a filled secret field, and the frames
+     * it read: a targeted read searches only those, so it never looks in a frame
+     * this did not vouch for. Every frame, not the bounded set a snapshot reads:
+     * a selector can enter any of them, including one that attached while the
+     * others were being asked, so the list is read again until it stops growing.
+     * "unknown" when some frame could not answer, which a read must not take for
+     * "clear". The whole check takes at most `ms`.
+     */
+    async secretFieldFilled(page, ms = this.callMs) {
+        const deadline = Date.now() + ms;
+        const asked = new Set();
+        const read = new Set();
+        let state = "clear";
+        for (let round = 0; round < 3; round += 1) {
+            const fresh = page.frames().filter((frame) => !asked.has(frame));
+            if (fresh.length === 0)
+                return { state, read };
+            for (const frame of fresh)
+                asked.add(frame);
+            const answers = await Promise.all(fresh.map((frame) => this.frameHoldsSecret(frame, deadline - Date.now())));
+            if (answers.includes("filled"))
+                return { state: "filled", read };
+            if (answers.includes("unknown"))
+                state = "unknown";
+            fresh.forEach((frame, index) => answers[index] === "clear" && read.add(frame));
+        }
+        return { state: page.frames().some((frame) => !asked.has(frame)) ? "unknown" : state, read };
+    }
+    /** The frames a targeted read may search, or its refusal while a secret field is filled. */
+    async clearOfSecrets(page) {
+        const secret = await this.secretFieldFilled(page);
+        if (secret.state === "filled")
+            throw new Error("browser_secret_field_filled");
+        if (secret.state === "unknown")
+            throw new Error("browser_secret_check_unavailable");
+        return secret.read;
+    }
+    /**
+     * A frame mid-navigation is asked again once its next document has loaded;
+     * a detached one holds nothing. A frame with no document yet (a lazy or
+     * still-loading iframe) that does not answer is "unread": it does not make
+     * the page unknown, and a targeted read does not search it. A cancelled task
+     * is not "unknown": it stops. Each frame is given at most `ms` in all, and
+     * one that gets its document while being asked is asked again with what is
+     * left, which is not one of its retries.
+     */
+    async frameHoldsSecret(frame, ms = this.callMs) {
+        const deadline = Date.now() + ms;
+        let retries = 0;
+        while (retries < 3) {
+            if (frame.isDetached())
+                return "clear";
+            const documentless = frame.url() === "";
+            const left = deadline - Date.now();
+            if (left <= 0)
+                break;
+            try {
+                const filled = await this.call(frame.evaluate(filledSecretField), "secret_check", documentless ? Math.min(left, 250) : left);
+                return filled ? "filled" : "clear";
+            }
+            catch (error) {
+                this.signal?.throwIfAborted();
+                // Gone while being asked: whatever the error says, it holds nothing.
+                if (frame.isDetached())
+                    return "clear";
+                if (documentless) {
+                    if (frame.url() === "")
+                        return "unread";
+                    continue;
+                }
+                if (!navigatedAway(error))
+                    return "unknown";
+                retries += 1;
+                if (retries < 3) {
+                    await frame
+                        .waitForLoadState("domcontentloaded", { timeout: Math.max(1, Math.min(2_000, deadline - Date.now())) })
+                        .catch(() => undefined);
+                }
+            }
+        }
+        return frame.url() === "" ? "unread" : "unknown";
     }
     /**
      * The frames a target may live in, main frame first.
@@ -646,9 +1260,12 @@ export class BrowserRuntime {
      * Every way the caller gave us to find the element, in the order we trust
      * them. Split out from `locator` because waiting and acting need the same
      * list but disagree about what to do when nothing matches yet.
+     *
+     * `within` starts a checked read only in the frames its check read; where a
+     * match may end up is `readFirst`'s to judge.
      */
-    candidates(page, target) {
-        return this.frames(page).flatMap((frame) => {
+    candidates(page, target, within) {
+        return this.frames(page).filter((frame) => within?.has(frame) ?? true).flatMap((frame) => {
             const found = [];
             if (target.role !== undefined) {
                 found.push(frame.getByRole(target.role, {
@@ -681,6 +1298,7 @@ export class BrowserRuntime {
      * Resolution only reads the page and always runs before an action's effect,
      * so a `count` that times out here fails a click or a fill cleanly: nothing
      * was sent, and `execute` does not report it as an unknown outcome.
+     *
      */
     async locator(page, target) {
         if (target === undefined)
@@ -691,6 +1309,43 @@ export class BrowserRuntime {
         }
         throw new Error(`browser_target_not_found:${JSON.stringify(target)}`);
     }
+    /**
+     * A candidate's first match, if its own document is one a secret check
+     * read. A selector or role can lead from the frame it starts in to another,
+     * so a checked read judges the element it would use, not the route to it:
+     * a match anywhere else counts as none, and what it is makes no difference.
+     */
+    async readFirst(candidate, within) {
+        const pending = candidate.first().elementHandles();
+        const [element] = await this.call(pending, "count").catch((error) => {
+            // Released once it arrives, if it arrives after the bound or a cancel.
+            void pending.then((late) => late.forEach((handle) => void handle.dispose().catch(() => undefined)), () => undefined);
+            throw error;
+        });
+        if (element === undefined || within === undefined)
+            return element;
+        let kept = false;
+        try {
+            const frame = await this.call(element.ownerFrame(), "count");
+            kept = frame !== null && within.has(frame);
+            return kept ? element : undefined;
+        }
+        finally {
+            if (!kept)
+                await element.dispose().catch(() => undefined);
+        }
+    }
+    /** `locator` for a checked read: the element itself, from the read frames. */
+    async readTarget(page, target, within) {
+        if (target === undefined)
+            throw new Error("browser_action_requires_target");
+        for (const candidate of this.candidates(page, target, within)) {
+            const element = await this.readFirst(candidate, within);
+            if (element !== undefined)
+                return element;
+        }
+        throw new Error(`browser_target_not_found:${JSON.stringify(target)}`);
+    }
     /**
      * Wait for a target to reach a state, re-resolving it on every poll.
      *
@@ -708,33 +1363,102 @@ export class BrowserRuntime {
      */
     async waitForTarget(page, target, state, timeoutMs) {
         const negated = state === "hidden" || state === "detached";
+        const floor = Math.min(500, timeoutMs);
         const deadline = Date.now() + timeoutMs;
-        for (;;) {
-            let reached = negated;
-            for (const candidate of this.candidates(page, target)) {
-                const element = candidate.first();
-                // `isVisible`/`count` report on a missing element rather than throwing,
-                // so absence is an answer here: it satisfies `hidden` and `detached`.
-                const present = state === "attached" || state === "detached"
-                    ? (await this.call(element.count(), "count")) > 0
-                    : await this.call(element.isVisible(), "is_visible");
-                if (negated) {
-                    if (present) {
+        const previousDeadline = this.waitDeadline;
+        this.waitDeadline = deadline;
+        try {
+            for (;;) {
+                // Asked on every poll: someone can fill a secret field while this waits.
+                // A poll that finds one filled, or cannot tell, looks for nothing and
+                // waits for the next one: a login form stays filled while it signs in.
+                this.signal?.throwIfAborted();
+                const secret = await this.secretFieldFilled(page, Math.max(floor, deadline - Date.now()));
+                let reached = negated && secret.state === "clear";
+                let looked = false;
+                for (const candidate of secret.state === "clear" ? this.candidates(page, target, secret.read) : []) {
+                    // Let even a short wait look once, but do not spend a whole poll
+                    // walking the remaining frames after its deadline.
+                    if (looked && Date.now() >= deadline) {
+                        reached = false;
+                        break;
+                    }
+                    looked = true;
+                    // Absence is an answer here: it satisfies `hidden` and `detached`. A
+                    // document that went away mid-poll is not: the poll decides nothing.
+                    let present;
+                    try {
+                        const element = await this.readFirst(candidate, secret.read);
+                        try {
+                            if (element === undefined)
+                                present = false;
+                            else if (state === "attached" || state === "detached")
+                                present = true;
+                            else if (await this.call(element.isVisible(), "is_visible"))
+                                present = true;
+                            // isVisible() also answers false for an element whose document went
+                            // away, so a false counts only for one still in its document.
+                            else
+                                present = (await this.call(element.evaluate((node) => node.isConnected), "is_visible")) ? false : undefined;
+                        }
+                        finally {
+                            await element?.dispose().catch(() => undefined);
+                        }
+                    }
+                    catch (error) {
+                        if (!navigatedAway(error)) {
+                            // A search that failed outright is answered like any other: the
+                            // check after it wins over what it met. An incomplete check must
+                            // refuse the wait rather than trust the result it could not verify.
+                            const after = (await this.secretFieldFilled(page, Math.max(floor, deadline - Date.now()))).state;
+                            if (after === "filled")
+                                throw new Error("browser_secret_field_filled");
+                            if (after === "unknown")
+                                throw new Error("browser_secret_check_unavailable");
+                            if (error instanceof BrowserCallTimeoutError &&
+                                deadline - Date.now() <= WAIT_POLL_MS) {
+                                throw new Error(`browser_wait_timeout:${state}:${JSON.stringify(target)}`);
+                            }
+                            throw error;
+                        }
+                    }
+                    if (present === undefined) {
                         reached = false;
                         break;
                     }
+                    if (negated) {
+                        if (present) {
+                            reached = false;
+                            break;
+                        }
+                    }
+                    else if (present) {
+                        reached = true;
+                        break;
+                    }
                 }
-                else if (present) {
-                    reached = true;
-                    break;
+                // What a poll found, or did not, counts only if no field was filled
+                // while it looked: every poll that searched is checked again after.
+                let last = secret.state;
+                if (secret.state === "clear") {
+                    last = (await this.secretFieldFilled(page, Math.max(floor, deadline - Date.now()))).state;
+                    if (reached && last === "clear")
+                        return;
                 }
+                if (Date.now() >= deadline) {
+                    // Not the target's fault when the last poll could not look for it,
+                    // or could not vouch for what it saw.
+                    if (last === "filled")
+                        throw new Error("browser_secret_field_filled");
+                    if (last === "unknown")
+                        throw new Error("browser_secret_check_unavailable");
+                    throw new Error(`browser_wait_timeout:${state}:${JSON.stringify(target)}`);
+                }
+                await page.waitForTimeout(Math.min(WAIT_POLL_MS, Math.max(1, deadline - Date.now())));
             }
-            if (reached)
-                return;
-            if (Date.now() >= deadline) {
-                throw new Error(`browser_wait_timeout:${state}:${JSON.stringify(target)}`);
-            }
-            await page.waitForTimeout(WAIT_POLL_MS);
+        }
+        finally {
+            this.waitDeadline = previousDeadline;
         }
     }
     /**
@@ -748,22 +1472,225 @@ export class BrowserRuntime {
      * `.fill("")` is still how the field gets cleared, because it empties one
      * reliably no matter what is in it.
      */
-    async typeInto(locator, value, operation) {
-        const field = locator.first();
-        if (operation.clearFirst) {
-            await field.fill("", { timeout: operation.timeoutMs });
+    async typeInto(pin, locator, value, operation) {
+        const ready = operation.clearFirst ? ["visible", "editable"] : ["visible"];
+        await this.actOn(pin, locator, operation.timeoutMs, async (field, timeout) => {
+            if (operation.clearFirst) {
+                await field.fill("", { timeout });
+                this.dispatched = true;
+            }
+            // Found first, then counted as sent before the first key: typing is one
+            // key per round trip, so a deadline can land after some keys (an Enter
+            // among them) reached the page, and that is not "nothing happened".
+            await field.waitForElementState("visible", { timeout });
+            this.dispatched = true;
+            // Focused as `pressSequentially` focuses it (typing nothing does just
+            // that), then typed as it types, one key at a time, each only while the
+            // page is still the checked document: keys go wherever focus is, so a
+            // page that navigates midway would otherwise get the rest. Its address
+            // was checked before the first input; a page may rewrite its own path as
+            // it is typed into. Once the keys start, nothing here fails on the field
+            // going away.
+            await field.type("", { timeout });
+            // The value gets the whole timeout once typing starts, as
+            // `pressSequentially` gave it; a key still going then is not waited for.
+            // A new document shows up as Playwright's `framenavigated` for the main
+            // frame, which costs no round trip, so the document is asked about only
+            // then (a page rewriting its own path raises it too): asking before
+            // every key halved how fast a long value went in.
+            const deadline = Date.now() + operation.timeoutMs;
+            let navigated = false;
+            const onNavigated = (frame) => {
+                if (frame === pin.page.mainFrame())
+                    navigated = true;
+            };
+            pin.page.on("framenavigated", onNavigated);
+            try {
+                for (const character of value) {
+                    const left = deadline - Date.now();
+                    if (left <= 0)
+                        throw new BrowserCallTimeoutError("type");
+                    if (navigated) {
+                        navigated = false;
+                        if (await this.moved(pin, false, left))
+                            throw new Error("browser_page_changed");
+                    }
+                    await this.call(pin.page.keyboard.type(character, { delay: operation.delayMs }), "type", Math.max(1, deadline - Date.now()));
+                }
+            }
+            finally {
+                pin.page.off("framenavigated", onNavigated);
+            }
             this.dispatched = true;
+        }, ready);
+    }
+    /**
+     * An input action on its target's element, held to the documents it was
+     * checked on: the page's, and the one the target was first found in, which
+     * for a target inside a frame is that frame's. The input goes through the
+     * element, which a navigation takes away, so a page or frame that navigates
+     * itself while the action waits (for the element to show, say) fails the
+     * action rather than having the target found, and acted on, in the new
+     * document. The target is found again only in the document it was found
+     * in, and only before any input reached it.
+     *
+     * The element is first waited for as the action would wait (`ready`: the
+     * states named, which sends the page nothing), so the check after that is
+     * the last thing before the input, the address it named included. Once the
+     * action has sent input (an earlier field of a form, say), only its
+     * document is held: a page may rewrite its own path in answer, as it may
+     * while it is typed into. A target found again after a re-render is not
+     * waited for twice, so one re-rendered faster than that can still be hit.
+     * Whatever runs out is reported as the action's `timeout` running out
+     * (`ranOut`).
+     *
+     * ponytail: Playwright's own hit-target check and dispatch come after this,
+     * so a navigation that commits in that instant can still receive the one
+     * click or key; closing it needs input that names its document, which CDP
+     * lacks.
+     */
+    async actOn(pin, locator, timeout, act, ready = []) {
+        const deadline = Date.now() + timeout;
+        const left = () => Math.max(1, deadline - Date.now());
+        let found;
+        try {
+            for (;;) {
+                const element = found === undefined
+                    ? // Bounded by its own timeout; the call only adds the cancel.
+                        await this.handle(locator.first().elementHandle({ timeout: left() }), "count", Infinity)
+                    : await this.refind(pin, locator, found, deadline);
+                try {
+                    let moved;
+                    if (found === undefined) {
+                        found = await this.handle(element.evaluateHandle((node) => node.ownerDocument), "evaluate", left());
+                        for (const state of ready)
+                            await element.waitForElementState(state, { timeout: left() });
+                        moved = await this.moved(pin, !this.dispatched, left());
+                    }
+                    else {
+                        const same = await this.call(element.evaluate((node, first) => node.ownerDocument === first, found), "evaluate", left()).catch((error) => {
+                            // No answer is not a different document.
+                            if (timedOut(error) || this.signal?.aborted === true)
+                                throw error;
+                            return false;
+                        });
+                        if (!same) {
+                            throw new Error("browser_page_changed: the target's frame is now at another document");
+                        }
+                        // Still in the document it was found in, so the page has not
+                        // navigated either: a navigation takes its frames' documents with
+                        // it. Only the address is left, and that needs no round trip.
+                        moved = !this.dispatched && pin.address !== undefined && pageAddress(pin.page.url()) !== pin.address;
+                    }
+                    if (!moved)
+                        return await act(element, left());
+                }
+                catch (error) {
+                    // Replaced below, so what `execute` reads from it is kept here.
+                    if (inputSent(error))
+                        this.dispatched = true;
+                    // A wait that ran out is the answer; the page is not asked again.
+                    if (timedOut(error) || Date.now() >= deadline)
+                        throw error;
+                    if (!(await this.moved(pin, !this.dispatched, left()))) {
+                        // Re-rendered, or its frame reloaded, while the page stayed: found
+                        // again, as Playwright's own locator would, in the same document
+                        // or not at all, which the next pass checks before it acts. That
+                        // holds even after Playwright logged the click as performed: its
+                        // hit-target guard stops the events that did not reach the
+                        // element, which is why its locator retries this too. The page is
+                        // asked first every time, so one that navigated is refused at
+                        // once, one that leaves while the target is searched for again
+                        // within a slice, and a target first found in a document that
+                        // came in after the checks is never acted on.
+                        if (detached(error))
+                            continue;
+                        throw error;
+                    }
+                }
+                finally {
+                    await element.dispose().catch(() => undefined);
+                }
+                throw new Error(`browser_page_changed: the page is now at ${pageAddress(pin.page.url())}`);
+            }
+        }
+        catch (error) {
+            // Every bound in here is the action's deadline (typing's, which starts
+            // later, is as long), so whatever timed out ran out the action's time.
+            // Not read off the clock: a 1 ms bound can fire just before it ticks.
+            if (timedOut(error))
+                throw ranOut(error, timeout);
+            throw error;
+        }
+        finally {
+            void found?.dispose().catch(() => undefined);
+        }
+    }
+    /**
+     * The target found again after it went away, searched for in slices that
+     * each end by asking whether the page, or the document it was first found
+     * in (a frame's), has left: a page that takes the target away and then
+     * navigates to a document without it would otherwise be waited on until
+     * the timeout. A slice cut short, by a frame detaching as the page around
+     * it leaves, is asked about the same way.
+     */
+    async refind(pin, locator, found, deadline) {
+        const left = () => Math.max(1, deadline - Date.now());
+        for (;;) {
+            let failure;
+            try {
+                return await this.handle(locator.first().elementHandle({ timeout: Math.min(REFIND_SLICE_MS, left()) }), "count", Infinity);
+            }
+            catch (error) {
+                // A cancel, or a page that closed, has its own error.
+                if (this.signal?.aborted === true || pin.page.isClosed())
+                    throw error;
+                failure = error;
+            }
+            if (Date.now() >= deadline)
+                throw failure;
+            if (await this.moved(pin, !this.dispatched, left())) {
+                throw new Error(`browser_page_changed: the page is now at ${pageAddress(pin.page.url())}`);
+            }
+            const there = await this.call(found.evaluate((first) => first.defaultView?.document === first), "evaluate", left()).catch((error) => {
+                // No answer is not a different document, and a closed page has its own error.
+                if (timedOut(error) || this.signal?.aborted === true || pin.page.isClosed())
+                    throw error;
+                return false;
+            });
+            if (!there)
+                throw new Error("browser_page_changed: the target's frame has left the document it was found in");
+            if (!timedOut(failure))
+                throw failure;
         }
-        // Found first, then counted as sent before the first key: typing is one
-        // key per round trip, so a deadline can land after some keys (an Enter
-        // among them) reached the page, and that is not "nothing happened".
-        await field.waitFor({ state: "visible", timeout: operation.timeoutMs });
-        this.dispatched = true;
-        await field.pressSequentially(value, {
-            delay: operation.delayMs,
-            timeout: operation.timeoutMs,
+    }
+    /** `call` for a handle: one that arrives after the bound or a cancel is released, not left in the page. */
+    handle(pending, what, ms) {
+        return this.call(pending, what, ms).catch((error) => {
+            void pending.then((late) => late.dispose().catch(() => undefined), () => undefined);
+            throw error;
         });
-        this.dispatched = true;
+    }
+    /**
+     * Whether the page has left the document an input action was checked on,
+     * or, with `address`, the address it named. A navigation destroys the old
+     * document's context, so asking its handle fails. A call that timed out or
+     * was cancelled is no answer either way and is passed on, and a closed page
+     * has not moved anywhere: the action's own error says what happened.
+     */
+    async moved(pin, address = true, ms = this.callMs) {
+        if (pin.page.isClosed())
+            return false;
+        if (address && pin.address !== undefined && pageAddress(pin.page.url()) !== pin.address)
+            return true;
+        try {
+            return !(await this.call(pin.document.evaluate((checked) => checked === document), "evaluate", ms));
+        }
+        catch (error) {
+            if (error instanceof BrowserCallTimeoutError || this.signal?.aborted === true)
+                throw error;
+            return true;
+        }
     }
     /**
      * An attached CDP browser has no pinning proxy, and Chromium follows a
@@ -846,12 +1773,30 @@ export class BrowserRuntime {
      * page text and cut it up itself. `inspect` already accepts a target, so
      * scoping it needs no new action.
      */
-    async extract(page, operation) {
-        const locator = (await this.locator(page, operation.target)).first();
+    async extract(page, operation, within) {
+        const element = await this.readTarget(page, operation.target, within);
         const [text, html] = await Promise.all([
-            locator.innerText({ timeout: operation.timeoutMs }),
-            locator.innerHTML({ timeout: operation.timeoutMs }),
-        ]);
+            this.call(element.innerText(), "inner_text", operation.timeoutMs),
+            // From a copy with secret fields emptied: frameworks such as React
+            // mirror what is typed into the `value` attribute, which markup carries.
+            this.call(element.evaluate((node) => {
+                const element = node;
+                const secret = (field) => (field instanceof HTMLInputElement && field.type === "password") ||
+                    ((field instanceof HTMLInputElement || field instanceof HTMLTextAreaElement) &&
+                        !["", "none"].includes(getComputedStyle(field).getPropertyValue("-webkit-text-security")));
+                // The target itself too: a secret textarea's markup is its content.
+                const live = [element, ...element.querySelectorAll("input, textarea")];
+                const copy = element.cloneNode(true);
+                const copies = [copy, ...copy.querySelectorAll("input, textarea")];
+                live.forEach((field, index) => {
+                    if (!secret(field))
+                        return;
+                    copies[index].removeAttribute("value");
+                    copies[index].textContent = "";
+                });
+                return copy.innerHTML;
+            }), "evaluate", operation.timeoutMs),
+        ]).finally(() => element.dispose().catch(() => undefined));
         return {
             url: page.url(),
             title: await this.call(page.title(), "title"),
@@ -897,9 +1842,31 @@ export class BrowserRuntime {
         this.signal = signal;
         this.callMs = operation.timeoutMs;
         this.dispatched = false;
+        this.refusedReserved = false;
+        this.actingOn = undefined;
+        this.actingTarget = undefined;
+        this.action = operation.action;
+        this.stepped = false;
+        // Chromium reports a window's creation on the browser-level session,
+        // ahead of any later reply there; one round trip before the action
+        // starts takes every window created until now as created between
+        // actions, however late that report would otherwise be handled.
+        if (this.options.cdpEndpoint !== undefined && this.targets !== undefined) {
+            await bounded(this.targets.send("Browser.getVersion"), operation.timeoutMs, "cdp:Browser.getVersion", signal).catch(() => undefined);
+        }
+        // The round trip above swallows a cancel, and nothing has run yet. (The
+        // check at the top narrowed `aborted`, which an await can change.)
+        if (signal?.aborted === true)
+            throw new Error("task_cancelled");
+        this.actions += 1;
         this.acting = true;
         try {
             const ran = await this.run(operation);
+            // An input action that went through, or a step back or forward that
+            // moved, drove its page; windows it opened meanwhile are the action's
+            // anyway (`createdActing`). Navigations mark it before they are sent.
+            if (DRIVING_ACTIONS.has(operation.action) && ran.moved !== false)
+                await this.drive(this.actingOn).catch(() => undefined);
             await this.awaitOpenedWindows(operation.timeoutMs);
             // A blocked popup is closed from an event handler, which has no way to
             // join the action that provoked it. Waiting here is what stops the next
@@ -927,40 +1894,130 @@ export class BrowserRuntime {
             // including a timeout resolving the target, is an ordinary failure:
             // nothing was sent, and for a read the controller may simply retry.
             // The message is stored on the task record and shown in the console.
+            // An action that failed before its wait gives up on what it opened here.
+            this.giveUpOwed(operation.timeoutMs);
             if (error instanceof Error)
                 error.message = withoutColour(error.message);
-            if (!this.dispatched && !inputSent(error))
+            const sent = this.dispatched || inputSent(error);
+            // So did one that failed after its input went out, or a step back or
+            // forward that may have moved before it ran out of time. A `close`
+            // drives nothing, whatever page it leaves active.
+            if (DRIVING_ACTIONS.has(operation.action) && (sent || this.stepped)) {
+                await this.drive(this.actingOn).catch(() => undefined);
+            }
+            if (!sent)
                 throw error;
             throw outcomeUnknown(error instanceof Error ? error.message : String(error));
         }
         finally {
             this.acting = false;
+            this.actingTarget = undefined;
+            this.action = undefined;
         }
     }
     async run(operation) {
+        // Before a browser is started, so a refused upload never starts one.
+        const files = operation.action === "upload" && operation.filePaths !== undefined ? await this.uploadPaths(operation.filePaths) : [];
         const page = await this.page();
+        this.actingOn = page;
+        // What it opens while this action navigates it or sends it input is the
+        // action's, which in a browser this runtime is attached to is judged by
+        // target id (`Target.targetCreated`).
+        if (DRIVING_ACTIONS.has(operation.action) && this.options.cdpEndpoint !== undefined && this.targets !== undefined) {
+            this.actingTarget = await this.targetOf(page).catch(() => undefined);
+        }
+        // Taken before the checks below, so an input action that passes them
+        // reaches the document they read or nothing (`actOn`).
+        const pin = INPUT_ACTIONS.has(operation.action)
+            ? {
+                page,
+                document: await this.handle(page.evaluateHandle(() => document), "evaluate"),
+                address: operation.url === undefined ? undefined : pageAddress(operation.url),
+            }
+            : undefined;
+        try {
+            return await this.act(operation, page, pin, files);
+        }
+        finally {
+            void pin?.document.dispose().catch(() => undefined);
+        }
+    }
+    async act(operation, page, pin, files) {
         // Anywhere but on the way to it, a url names the page the action acts on:
         // the active page, or for `close` and `tab_switch` the tab they name.
         // Policy shows it to the approver as the target and matches grants against
         // it, so the action is refused, before anything is sent, when that page is
-        // elsewhere. Compared as policy shows it, without query or fragment.
-        //
-        // ponytail: checked when the action starts. A page that navigates itself
-        // while the action waits for its target can still receive it; pinning
-        // each action to the checked document would close that.
+        // elsewhere. Compared as policy shows it, without query or fragment. An
+        // input action stays on the page checked here: one that navigates itself
+        // while the action waits is refused with `browser_page_changed`.
+        const acted = (operation.action === "close" || operation.action === "tab_switch") && operation.tabIndex !== undefined
+            ? (await this.ensureContext()).pages()[operation.tabIndex]
+            : page;
         if (operation.url !== undefined && operation.action !== "navigate" && operation.action !== "tab_new") {
-            const acted = (operation.action === "close" || operation.action === "tab_switch") && operation.tabIndex !== undefined
-                ? (await this.ensureContext()).pages()[operation.tabIndex]
-                : page;
             const at = acted === undefined ? "no such tab" : pageAddress(acted.url());
             if (at !== pageAddress(operation.url))
                 throw new Error(`browser_page_not_at_url: the page is at ${at}`);
         }
+        // An approval console open in a browser this runtime is attached to is a
+        // read away (`tabs`), and an action without a url acts on whatever page is
+        // active. So no input reaches one, whatever approved the action and in
+        // every mode: an approval there is the operator's act alone. Nor do the two
+        // reads that can put its Approve under the operator's pointer: raising its
+        // tab (`tab_switch`) and scrolling it. Reads that move its URL still work,
+        // and the console unpairs when they do.
+        // The console holds its buttons back for a second after it is raised, but
+        // in a browser this runtime is attached to, Playwright's focus emulation
+        // makes every page report itself visible and focused, so the console never
+        // sees being raised. Whatever of ours could raise it is refused instead.
+        // An input action is then held to the document checked here, as above.
+        if ((operation.action === "tab_switch" ||
+            operation.action === "scroll" ||
+            (operation.action !== "close" && classifyOperation(operation).effect !== "read")) &&
+            acted !== undefined &&
+            (await this.call(acted.locator(`meta[name="${APPROVAL_SURFACE}"]`).count(), "count")) > 0) {
+            throw new Error("browser_refuses_approval_surface");
+        }
+        // Closing a tab lets the browser raise a neighbour, which can be a
+        // console, and switching to a tab raises its split-view partner with it,
+        // which CDP does not say. So in a browser this runtime is attached to,
+        // where an operator can have one open, `close` and `tab_switch` are
+        // refused while any other page here carries the marker, whatever the tab
+        // acted on carries itself: any page can carry it. A marked tab of the agent's can be navigated away first. A browser
+        // this runtime launched has no operator's console in it. A page that does
+        // not answer within a second could be a console too busy to, so it holds
+        // the others open the same way, under its own reason naming its tab; it
+        // can be closed itself unless another tab also does not answer. One closed
+        // meanwhile holds nothing. Attached over CDP, every page of the browser is
+        // in this one context.
+        if ((operation.action === "close" || operation.action === "tab_switch") && this.options.cdpEndpoint !== undefined) {
+            if (operation.tabIndex !== undefined && acted === undefined)
+                throw new Error("browser_tab_not_found");
+            const pages = (await this.ensureContext()).pages();
+            const marks = await Promise.all(pages.map((other) => other === acted
+                ? 0
+                : bounded(other.locator(`meta[name="${APPROVAL_SURFACE}"]`).count(), 1_000, "count").catch(() => other.isClosed() ? 0 : -1)));
+            if (marks.some((count) => count > 0))
+                throw new Error("browser_refuses_approval_surface");
+            const silent = marks.flatMap((count, index) => (count < 0 ? [index] : []));
+            if (silent.length > 0) {
+                throw new Error(`browser_approval_surface_check_unavailable: tab ${silent.join(", ")} did not answer`);
+            }
+        }
+        // A targeted read says whether its target exists, and whether a target
+        // exists can be made to depend on a secret field's content, however the
+        // target is written. So while any frame holds a filled secret field a read
+        // may look at the whole page but not aim at part of it: the refusal
+        // depends on the page, never on the target. Asked again once the read has
+        // looked, since a field can be filled while it does. `wait` asks on every
+        // poll instead, within its own deadline.
+        const targetedRead = ["inspect", "scroll", "screenshot"].includes(operation.action) && operation.target !== undefined;
+        const within = targetedRead ? await this.clearOfSecrets(page) : undefined;
         switch (operation.action) {
             case "navigate": {
                 if (operation.url === undefined)
                     throw new Error("browser_navigate_requires_url");
-                await assertSafeUrl(operation.url, this.options);
+                await this.assertAllowed(operation.url);
+                await this.drive(page);
                 const response = await page.goto(operation.url, {
                     waitUntil: "domcontentloaded",
                     timeout: operation.timeoutMs,
@@ -973,6 +2030,7 @@ export class BrowserRuntime {
             case "back":
             case "forward": {
                 const before = page.url();
+                this.stepped = true;
                 const moved = operation.action === "back"
                     ? await page.goBack({
                         waitUntil: "domcontentloaded",
@@ -999,6 +2057,7 @@ export class BrowserRuntime {
                 // meaning of reload and matches `navigate`, whose target URL may have any
                 // server-side effect; the domain allowlist, not the read/mutate split, is
                 // what bounds what a navigation may reach.
+                await this.drive(page);
                 const response = await page.reload({
                     waitUntil: "domcontentloaded",
                     timeout: operation.timeoutMs,
@@ -1008,10 +2067,18 @@ export class BrowserRuntime {
                     ...(await this.settledSnapshot(page, operation)),
                 };
             }
-            case "inspect":
-                return operation.target === undefined
-                    ? await this.snapshot(page, operation.maxChars)
-                    : await this.extract(page, operation);
+            case "inspect": {
+                if (operation.target === undefined)
+                    return await this.snapshot(page, operation.maxChars);
+                // Whatever the read found, or failed to find, a field filled while it
+                // looked voids it: the refusal in `finally` replaces either.
+                try {
+                    return await this.extract(page, operation, within);
+                }
+                finally {
+                    await this.clearOfSecrets(page);
+                }
+            }
             /**
              * Block until the page reaches a state, instead of guessing a sleep.
              *
@@ -1045,9 +2112,7 @@ export class BrowserRuntime {
                 };
             }
             case "click": {
-                await (await this.locator(page, operation.target)).first().click({
-                    timeout: operation.timeoutMs,
-                });
+                await this.actOn(pin, await this.locator(page, operation.target), operation.timeoutMs, (element, timeout) => element.click({ timeout }), CLICKABLE);
                 // Set after the click returns, not before: Playwright's own timeout
                 // mostly fires while it waits for the element to become clickable,
                 // and reporting that as "may have clicked" would park every covered
@@ -1062,7 +2127,7 @@ export class BrowserRuntime {
             case "type": {
                 if (operation.value === undefined)
                     throw new Error("browser_type_requires_value");
-                await this.typeInto(await this.locator(page, operation.target), operation.value, operation);
+                await this.typeInto(pin, await this.locator(page, operation.target), operation.value, operation);
                 return {
                     typed: true,
                     ...(await this.settledSnapshot(page, operation)),
@@ -1082,13 +2147,11 @@ export class BrowserRuntime {
                     throw new Error("browser_fill_form_requires_fields");
                 }
                 for (const field of operation.fields) {
-                    await this.typeInto(await this.locator(page, field.target), field.value, operation);
+                    await this.typeInto(pin, await this.locator(page, field.target), field.value, operation);
                 }
                 const submitted = operation.target !== undefined;
                 if (submitted) {
-                    await (await this.locator(page, operation.target)).first().click({
-                        timeout: operation.timeoutMs,
-                    });
+                    await this.actOn(pin, await this.locator(page, operation.target), operation.timeoutMs, (element, timeout) => element.click({ timeout }), CLICKABLE);
                     this.dispatched = true;
                 }
                 return {
@@ -1100,9 +2163,8 @@ export class BrowserRuntime {
             case "select": {
                 if (operation.values === undefined)
                     throw new Error("browser_select_requires_values");
-                const selected = await (await this.locator(page, operation.target))
-                    .first()
-                    .selectOption(operation.values, { timeout: operation.timeoutMs });
+                const values = operation.values;
+                const selected = await this.actOn(pin, await this.locator(page, operation.target), operation.timeoutMs, (element, timeout) => element.selectOption(values, { timeout }), ["visible", "enabled"]);
                 this.dispatched = true;
                 return {
                     selected,
@@ -1112,10 +2174,11 @@ export class BrowserRuntime {
             case "press": {
                 if (operation.key === undefined)
                     throw new Error("browser_press_requires_key");
+                const key = operation.key;
                 const locator = operation.target === undefined
                     ? page.locator("body")
                     : await this.locator(page, operation.target);
-                await locator.first().press(operation.key, { timeout: operation.timeoutMs });
+                await this.actOn(pin, locator, operation.timeoutMs, (element, timeout) => element.press(key, { timeout }));
                 this.dispatched = true;
                 return {
                     pressed: operation.key,
@@ -1125,9 +2188,16 @@ export class BrowserRuntime {
             case "scroll": {
                 const direction = operation.direction ?? "down";
                 if (direction === "into_view") {
-                    await (await this.locator(page, operation.target)).first().scrollIntoViewIfNeeded({
-                        timeout: operation.timeoutMs,
-                    });
+                    // As for inspect: the check after the read wins over its outcome.
+                    try {
+                        const element = await this.readTarget(page, operation.target, within);
+                        await element
+                            .scrollIntoViewIfNeeded({ timeout: operation.timeoutMs })
+                            .finally(() => element.dispose().catch(() => undefined));
+                    }
+                    finally {
+                        await this.clearOfSecrets(page);
+                    }
                 }
                 else {
                     // A fixed ±600 was too small for a long article and too large for a
@@ -1171,10 +2241,7 @@ export class BrowserRuntime {
                 if (operation.filePaths === undefined) {
                     throw new Error("browser_upload_requires_file_paths");
                 }
-                const files = await this.uploadPaths(operation.filePaths);
-                await (await this.locator(page, operation.target)).first().setInputFiles(files, {
-                    timeout: operation.timeoutMs,
-                });
+                await this.actOn(pin, await this.locator(page, operation.target), operation.timeoutMs, (element, timeout) => element.setInputFiles(files, { timeout }));
                 this.dispatched = true;
                 return {
                     uploaded: files.length,
@@ -1189,11 +2256,13 @@ export class BrowserRuntime {
                 // download wait, and its own timeout would surface as an unhandled
                 // rejection long after this action failed.
                 downloadPromise.catch(() => undefined);
-                await (await this.locator(page, operation.target)).first().click({
-                    timeout: operation.timeoutMs,
-                });
+                await this.actOn(pin, await this.locator(page, operation.target), operation.timeoutMs, (element, timeout) => element.click({ timeout }), CLICKABLE);
                 this.dispatched = true;
-                const download = await downloadPromise;
+                // The click went out, so this stays an unknown outcome, but one that
+                // names the refusal when the route turned the file away.
+                const download = await downloadPromise.catch((error) => {
+                    throw this.refusedReserved ? new Error("browser_path_reserved") : error;
+                });
                 const suggested = download.suggestedFilename().replaceAll(/[^A-Za-z0-9._-]/g, "_");
                 const path = join(this.options.artifactDirectory, `${randomUUID()}-${suggested || "download"}`);
                 // Bounded by the task budget only. Saving waits for the whole file to
@@ -1216,52 +2285,63 @@ export class BrowserRuntime {
             }
             case "tabs": {
                 const context = await this.ensureContext();
-                return { tabs: await this.describeTabs(context) };
+                return { tabs: (await this.describeTabs(context)).tabs };
             }
             case "tab_new": {
                 const context = await this.ensureContext();
+                // Checked before the tab opens, and the tab closed again when its page
+                // fails to load: `tab_new` is a read, so it is retried, and every run
+                // that failed with its tab open left one more tab.
+                if (operation.url !== undefined)
+                    await this.assertAllowed(operation.url);
+                const previous = this.activePage;
                 const opened = await this.openPage(context);
-                this.activePage = opened;
+                this.activate(opened);
                 if (operation.url !== undefined) {
-                    await assertSafeUrl(operation.url, this.options);
-                    await opened.goto(operation.url, {
-                        waitUntil: "domcontentloaded",
-                        timeout: operation.timeoutMs,
-                    });
+                    try {
+                        await opened.goto(operation.url, {
+                            waitUntil: "domcontentloaded",
+                            timeout: operation.timeoutMs,
+                        });
+                    }
+                    catch (error) {
+                        await this.call(opened.close(), "close").catch(() => undefined);
+                        this.activate(previous?.isClosed() === false ? previous : context.pages().at(-1));
+                        throw error;
+                    }
                 }
-                return {
-                    opened: true,
-                    index: context.pages().indexOf(opened),
-                    tabs: await this.describeTabs(context),
-                };
+                const { pages, tabs } = await this.describeTabs(context);
+                const index = pages.indexOf(opened);
+                // Its own tab closed during the listing: there is no tab to report.
+                if (index === -1)
+                    throw new Error("browser_tab_not_found");
+                return { opened: true, index, tabs };
             }
             case "tab_switch": {
                 const context = await this.ensureContext();
                 if (operation.tabIndex === undefined) {
                     throw new Error("browser_tab_switch_requires_tab_index");
                 }
-                const target = context.pages()[operation.tabIndex];
-                if (target === undefined)
+                // The page checked above, not whichever holds its index by now.
+                const target = acted;
+                if (target === undefined || target.isClosed())
                     throw new Error("browser_tab_not_found");
                 // Bring the tab to the front so a screenshot of it is what the user
                 // would actually see; a background page still renders, but modal and
                 // focus behaviour differ.
                 await this.call(target.bringToFront(), "bring_to_front");
-                this.activePage = target;
-                return {
-                    switched: true,
-                    index: operation.tabIndex,
-                    url: target.url(),
-                    tabs: await this.describeTabs(context),
-                };
+                this.activate(target);
+                const { pages, tabs } = await this.describeTabs(context);
+                const index = pages.indexOf(target);
+                if (index === -1)
+                    throw new Error("browser_tab_not_found");
+                return { switched: true, index, url: target.url(), tabs };
             }
             case "close": {
                 const context = await this.ensureContext();
-                const pages = context.pages();
-                const target = operation.tabIndex === undefined
-                    ? page
-                    : pages[operation.tabIndex];
-                if (target === undefined)
+                // The page checked above, not whichever holds its index by now.
+                const target = acted;
+                if (target === undefined || target.isClosed())
                     throw new Error("browser_tab_not_found");
                 const url = target.url();
                 // Set before the close, unlike the other mutations: this call is the
@@ -1269,8 +2349,8 @@ export class BrowserRuntime {
                 // bound running out cannot say whether the tab went away.
                 this.dispatched = true;
                 await this.call(target.close(), "close");
-                this.activePage = context.pages().at(-1);
-                return { closed: true, url, tabs: await this.describeTabs(context) };
+                this.activate(context.pages().at(-1));
+                return { closed: true, url, tabs: (await this.describeTabs(context)).tabs };
             }
         }
     }
@@ -1281,6 +2361,7 @@ export class BrowserRuntime {
         if (this.targets !== undefined)
             await quietly(this.targets.detach(), "cdp_detach");
         this.targets = undefined;
+        this.forgetLapsing();
         if (connection !== undefined &&
             !connection.ownsContext &&
             this.routeHandler !== undefined) {
@@ -1297,7 +2378,6 @@ export class BrowserRuntime {
         this.proxy = undefined;
         this.activePage = undefined;
         this.context = undefined;
-        this.browser = undefined;
         this.connection = undefined;
         this.routeHandler = undefined;
     }