@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/agent-browser/scripts/redact-a11y-snapshot.py

@@ -0,0 +1,443 @@
+#!/usr/bin/env python3
+"""Redact credential-shaped values out of an accessibility snapshot (#7947).
+
+Reads a snapshot on stdin, writes the redacted form to stdout.
+
+WHY THIS IS NAME-BASED AND NOT STRUCTURAL
+-----------------------------------------
+Phase 0.1 measured both leaking surfaces (record:
+knowledge-base/project/specs/feat-one-shot-7946-7947-sentry-org-token-and-snapshot-redaction/phase-0-measurement.md).
+Neither `agent-browser` 0.22.3 nor the Playwright MCP serializes the input's
+`type=` into the tree -- a password box, a readonly token box and an email box
+all render as `textbox`. So a structural "is this a password input" predicate
+has nothing to read, and the accessible NAME is the only signal present.
+
+That is a real ceiling, not a shortcut. This filter is defense-in-depth on one
+enumerated sink; it is not a control that makes snapshotting a credential page
+safe. See the STATED BYPASSES below and property P5 in the plan.
+
+MEASURED BEHAVIOUR THIS FILTER IS BUILT AGAINST
+-----------------------------------------------
+  * `agent-browser` masks `type=password` itself (renders bullets) and leaks
+    the readonly `type=text` credential panel -- the "Token" class, which is
+    the one with a recorded in-repo incident.
+  * The Playwright MCP leaks both.
+  * The no-flag and `-d N` shapes emit the value TWICE: once as the `: value`
+    tail and again as a nested `StaticText` child. Redacting only the tail is
+    half a fix, so children of a redacted node are suppressed too.
+  * `--json` carries the same text inside `data.snapshot`, but `diff snapshot
+    --json` carries it under `data.diff`, so the JSON arm recognises a tree by
+    SHAPE rather than by field name.
+  * `diff snapshot` prefixes a marker column (`+- textbox ...`) and colourises
+    the line with SGR escapes, both outside the bullet every regex anchors on.
+  * A multi-line value (a textarea holding a PEM block) emits its 2nd..Nth
+    lines raw at column 0, so suppression cannot key on indent alone.
+  * Playwright's YAML serialiser wraps the WHOLE key in single quotes when the
+    accessible name contains ` #`, `: `, `{`, `}`, a backtick or a control
+    character (`- 'textbox "API Key #1" [ref=e2]': value`, `''` escaping an
+    apostrophe). Every regex below anchors on `- role`, so the quoted key is
+    unwrapped before matching and re-quoted on output -- measured against the
+    real @playwright/mcp@0.0.78 server during the #7980 review, where a field
+    labelled "API Key #1" leaked in clear.
+
+STATED BYPASSES (P5's explicit non-coverage -- do not read this filter as
+closing them):
+  * a localised or renamed accessible name ("Contrasena", "Clave", "Value");
+  * an unnamed node whose role is NOT a text-input role (an unnamed text-input
+    node carrying a value IS redacted, on the fail-safe side);
+  * a credential rendered outside a text-input role (a status region, a
+    validation message, a `<pre>` block);
+  * a value split across segmented single-character inputs;
+  * every node on a Playwright-MCP registration NOT routed through
+    `playwright-mcp-redact-proxy.py` (the sibling transport proxy, #7980), which
+    this filter can only reach if a human pipes a saved snapshot through it.
+
+FAIL-CLOSED CONTRACT (ADR-095 shape): on refusal, exit 2 with stdout EMPTY and
+a reason on stderr that never quotes the offending input.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+
+REDACTED = "<redacted>"
+
+# CONSUMER CONTRACT (#7980). `playwright-mcp-redact-proxy.py` loads this file by
+# its sibling BASENAME (`REDACTOR_BASENAME` there -- renaming this file is a proxy
+# edit too) with `importlib.util.spec_from_file_location` and binds exactly these
+# four names at startup -- ALL FOUR, so a refactor that renames one fails loud
+# at the proxy's exit 2 instead of as a per-result withhold that reads like an
+# outage. The contract is declared and tested HERE, where it is provided
+# (redact-a11y-snapshot.test.sh carries the import row); the proxy defines no
+# predicate of its own -- this module is the one predicate for both surfaces.
+__all__ = ["redact_text", "looks_like_a11y_tree", "MAX_INPUT_BYTES", "REDACTED"]
+
+# 4 MiB. A real snapshot is kilobytes; anything at this size is not a snapshot,
+# and refusing is cheaper than trying to redact it correctly.
+MAX_INPUT_BYTES = 4 * 1024 * 1024
+
+# Roles that can carry a user-editable value. A credential does not appear in a
+# `heading` or a `link`, and widening this set widens the over-redaction risk
+# that the must-PASS rows exist to catch.
+TEXT_INPUT_ROLES = frozenset(
+    {"textbox", "searchbox", "combobox", "spinbutton", "textarea"}
+)
+
+# Descendant roles that repeat a PARENT's value rather than carrying a label
+# of their own. Measured: the no-flag and `-d N` shapes emit the value twice,
+# the second time as a StaticText child. Everything else under a redacted
+# node (an `option` label, say) is a label and must survive.
+VALUE_CARRYING_CHILD_ROLES = frozenset({"StaticText"})
+
+# Credential-shaped accessible names. Word-anchored on both sides so
+# "Keyboard shortcut" does not match `key` and "Pinned items" does not match
+# `pin`. Deliberately broader than "password": the only node `agent-browser`
+# leaks is named "Token", so a password-only list would miss the single class
+# with a recorded incident here.
+CREDENTIAL_NAME_RE = re.compile(
+    r"\b(?:"
+    r"pass(?:word|wd|phrase|code)?"
+    r"|token"
+    r"|secret"
+    r"|credential"
+    r"|key"
+    r"|bearer"
+    r"|otp"
+    r"|totp"
+    r"|pin"
+    r"|2fa"
+    r"|mfa"
+    r"|two[\s_-]?factor"
+    r"|authenticator"
+    r"|seed[\s_-]?phrase"
+    r"|mnemonic"
+    r"|(?:verification|confirmation|one[\s_-]?time|backup|access|recovery"
+    r"|security|sms|authenticator|auth(?:entication)?|2fa|mfa|totp)[\s_-]?code"
+    r"|connection[\s_-]?string"
+    r"|dsn"
+    # `signature`, `session` and `cookie` are QUALIFIED, not bare. Bare, they
+    # ate `Email signature`, `Session name`, `Cookie name` and
+    # `Search sessions` -- measured. A filter that eats ordinary fields gets
+    # switched off, which costs more than the narrow miss. The bare words are
+    # still caught when they are the WHOLE name, in `_is_credential_name`.
+    r"|(?:request|webhook|hmac|jwt|api|payload)[\s_-]?signature"
+    r"|authorization"
+    r"|session[\s_-]?(?:token|id|key|secret|cookie|string)"
+    r"|cookie[\s_-]?(?:value|string|header|jar)"
+    r")e?s?\b",
+    re.IGNORECASE,
+)
+
+def _fmt_name(name: str | None) -> str:
+    """Re-emit the name exactly as it arrived, including its absence."""
+    return "" if name is None else f' "{name}"'
+
+
+# Split a camelCase hump, and an acronym that runs INTO a word (`APIKey`), but
+# never an acronym that is already a whole word. The naive
+# `(?<=[a-z0-9])(?=[A-Z])` split `2FA` into `2 FA`, which silently un-matched
+# the `2fa` alternative and leaked a field named `2FA code` -- caught only
+# because the must-REDACT row was driven with the real label.
+_CAMEL_BOUNDARY_RE = re.compile(r"(?<=[a-zA-Z0-9])(?=[A-Z][a-z])|(?<=[a-z])(?=[A-Z]+$)")
+_WORD_SEP_RE = re.compile(r"[_\-]+")
+
+# Bare words that are credential-shaped only when they are the ENTIRE accessible
+# name. Qualified forms live in CREDENTIAL_NAME_RE; see the comment there.
+WHOLE_NAME_CREDENTIALS = frozenset({"session", "cookie", "signature"})
+
+
+def _normalise_name(name: str) -> str:
+    """Split camelCase and `_`/`-` runs so one word list matches every casing.
+
+    Two measured failures, in order of severity:
+
+    * `_` is a `\\w` character, so `\\btoken\\b` never fired inside
+      `SENTRY_AUTH_TOKEN` -- and `API_KEY`, `DB_PASSWORD` and every other
+      env-var-style label passed through IN CLEAR. That casing is the standard
+      shape of a secrets editor (Doppler, Vercel, Supabase), i.e. exactly the
+      credential-panel class this filter exists for. Splitting separators first
+      is what fixes it; the alternatives' own `[\\s_-]?` groups still match
+      afterwards, because a space satisfies `\\s`.
+    * The previous lookbehind form rejected `apiKey` and every English plural
+      (`API Keys`, `Tokens`, `Secrets`), which are the literal labels on the
+      Cloudflare and Sentry token pages.
+    """
+    return _CAMEL_BOUNDARY_RE.sub(" ", _WORD_SEP_RE.sub(" ", name))
+
+# `- <role> "<name>" [attrs]: <value>` with the value and the attribute bracket
+# both optional. Anchored on the list-dash so prose lines are never rewritten.
+NODE_RE = re.compile(
+    r"^(?P<indent>\s*)(?P<bullet>[-+])\s+(?P<role>[A-Za-z][A-Za-z0-9_]*)"
+    r'(?:\s+"(?P<name>(?:[^"\\]|\\.)*)")?'
+    r"(?P<attrs>(?:\s+\[[^\]]*\])*)"
+    r"(?P<sep>:\s*)(?P<value>.*)$"
+)
+
+# A bare quoted child, e.g. `  - StaticText "the value"`.
+QUOTED_CHILD_RE = re.compile(
+    r"^(?P<indent>\s*)(?P<bullet>[-+])\s+(?P<role>[A-Za-z][A-Za-z0-9_]*)"
+    r'\s+"(?P<text>(?:[^"\\]|\\.)*)"(?P<rest>.*)$'
+)
+
+INDENT_RE = re.compile(r"^(\s*)")
+
+# A YAML single-quoted KEY, e.g. `- 'textbox "Token: prod" [ref=e3]': value`.
+QUOTED_KEY_RE = re.compile(
+    r"^(?P<indent>\s*)(?P<bullet>[-+])\s+'(?P<key>(?:[^']|'')*)'(?P<tail>(?::.*)?)$"
+)
+
+
+def _unquote_key(line: str) -> tuple[str, str | None]:
+    """Return (line to MATCH against, the raw quoted key or None).
+
+    The matched form carries the unescaped key so NODE_RE / QUOTED_CHILD_RE and
+    the name predicate see the name Playwright rendered; the raw key is kept so
+    a redacted line is re-emitted with the quoting it arrived with.
+    """
+    quoted = QUOTED_KEY_RE.match(line)
+    if not quoted:
+        return line, None
+    key = quoted.group("key")
+    unescaped = key.replace("''", "'")
+    return f"{quoted.group('indent')}{quoted.group('bullet')} {unescaped}{quoted.group('tail')}", key
+
+
+def _render_redacted_node(node: "re.Match[str]", quoted_key: str | None) -> str:
+    """Render a credential node with its VALUE replaced, keeping name and quoting."""
+    if quoted_key is not None:
+        return f"{node.group('indent')}{node.group('bullet')} '{quoted_key}'{node.group('sep')}{REDACTED}"
+    return (
+        f"{node.group('indent')}{node.group('bullet')} {node.group('role')}"
+        f"{_fmt_name(node.group('name'))}{node.group('attrs') or ''}"
+        f"{node.group('sep')}{REDACTED}"
+    )
+
+# Any tree bullet, used to tell a NODE line from a value CONTINUATION line.
+BULLET_RE = re.compile(r"^\s*[-+]\s")
+
+# `agent-browser diff snapshot` colourises its output, and SGR escapes sit
+# OUTSIDE the bullet, so every regex below fails on a coloured line. Measured:
+# 8 sentinel survivals straight through the redactor.
+ANSI_SGR_RE = re.compile(r"\x1b\[[0-9;]*m")
+
+# A unified-diff marker column. The real CLI emits `+- textbox ...` and
+# `+  - textbox ...`; the suite previously pinned `+ textbox ...`, a shape the
+# CLI never produces, so the rule was verified against a fixture and not
+# against the surface.
+#
+# The lookahead is load-bearing: an ordinary tree line already STARTS with `-`,
+# so a bare `^[+-]` would eat the tree's own bullet. Requiring a SECOND bullet
+# after optional spaces distinguishes a marker column from a bullet.
+DIFF_MARKER_RE = re.compile(r"^(?P<mark>[+-])(?=\s*[-+]\s)")
+
+
+def _is_credential_name(name: str | None) -> bool:
+    """True when the accessible name marks this node as credential-bearing.
+
+    An UNNAMED node (`name is None`) is not decidable by a name predicate, and
+    an unlabeled readonly box is the commonest shape of a generated-credential
+    panel. It is handled at the call site as its own case rather than folded in
+    here, so the two decisions stay legible.
+    """
+    if name is None:
+        return False
+    normalised = _normalise_name(name)
+    # A field labelled exactly `Session` / `Cookie` / `Signature` IS the
+    # credential; the same word inside a longer label (`Session name`,
+    # `Email signature`) is ordinary content. Qualifying them in the pattern
+    # loses the first case, so it is recovered here rather than by widening the
+    # pattern back to the form that ate four benign fields.
+    if normalised.strip().lower() in WHOLE_NAME_CREDENTIALS:
+        return True
+    return bool(CREDENTIAL_NAME_RE.search(normalised))
+
+
+def redact_text(text: str) -> str:
+    """Redact credential-shaped node values in the indented-text shape."""
+    out: list[str] = []
+    # Indent of the node currently being suppressed, or None. Children deeper
+    # than this inherit the redaction; a line at or above it ends suppression.
+    suppress_indent: int | None = None
+
+    for raw_line in text.split("\n"):
+        line = ANSI_SGR_RE.sub("", raw_line)
+        marker = ""
+        mark = DIFF_MARKER_RE.match(line)
+        if mark:
+            marker = mark.group("mark")
+            line = line[mark.end():]
+
+        def emit(rendered: str, _marker: str = marker) -> None:
+            out.append(_marker + rendered)
+
+        indent = len(INDENT_RE.match(line).group(1))
+
+        if suppress_indent is not None and line.strip():
+            if BULLET_RE.match(line):
+                if indent <= suppress_indent:
+                    suppress_indent = None
+            else:
+                # A CONTINUATION line of a multi-line value. A textarea holding
+                # a PEM block or an SSH key emits its 2nd..Nth lines raw, at
+                # column 0 -- so the old `indent <= suppress_indent` test ended
+                # suppression on the second line and printed the rest of the key
+                # in clear, along with every StaticText duplicate below it.
+                # Measured on the real CLI, on all four output shapes.
+                #
+                # It is not a node, so it must not end suppression; it carries
+                # the tail of the secret, so it must not be emitted. The node
+                # line above already rendered `<redacted>` in its place.
+                continue
+
+        match_line, quoted_key = _unquote_key(line)
+        node = NODE_RE.match(match_line)
+        # An UNNAMED text-input node carrying a value is redacted on the
+        # fail-safe side. We cannot decide it by name -- there is no name -- and
+        # an unlabeled readonly box is the commonest shape of a
+        # generated-credential panel. Playwright derives an accessible name from
+        # a label, placeholder or aria-label, so a genuinely unnamed input with
+        # a value is rare; losing its value costs an agent little, and keeping
+        # it is the class with a recorded in-repo incident.
+        unnamed_input = (
+            node is not None
+            and node.group("name") is None
+            and node.group("role") in TEXT_INPUT_ROLES
+            and node.group("value").strip() != ""
+        )
+        if node and node.group("role") in TEXT_INPUT_ROLES and (
+            unnamed_input or _is_credential_name(node.group("name"))
+        ):
+            emit(_render_redacted_node(node, quoted_key))
+            suppress_indent = indent
+            continue
+
+        if suppress_indent is not None and indent > suppress_indent:
+            # A descendant of a redacted node. Two distinct cases, and the
+            # earlier revision got both wrong because QUOTED_CHILD_RE strictly
+            # SUBSUMES NODE_RE -- it matched first, so a nested credential node
+            # had its NAME redacted and its VALUE preserved. That is the exact
+            # inversion of the point: it destroyed the signal and kept the
+            # secret.
+            inner = NODE_RE.match(match_line)
+            if inner:
+                # A node with its own `: value` tail -- redact the VALUE, keep
+                # the name, exactly as for the parent.
+                emit(_render_redacted_node(inner, quoted_key))
+                continue
+            child = QUOTED_CHILD_RE.match(match_line)
+            if child and child.group("role") in VALUE_CARRYING_CHILD_ROLES:
+                # The measured `-d N` / no-flag duplicate: the value repeated as
+                # a StaticText child. Redact it.
+                emit(
+                    f"{child.group('indent')}{child.group('bullet')} {child.group('role')} "
+                    f"\"{REDACTED}\"{child.group('rest')}"
+                )
+                continue
+            # Anything else under a redacted node is a LABEL, not a value --
+            # `option "id"`, `option "email"` under a combobox named
+            # "Primary key". Redacting those destroys the agent's ability to
+            # pick the right option while protecting nothing, so they pass
+            # through untouched.
+
+        emit(line)
+
+    return "\n".join(out)
+
+
+def looks_like_a11y_tree(value: str) -> bool:
+    """True when a JSON string value carries an accessibility tree.
+
+    Keying on the field NAME was the defect: `snapshot --json` puts the tree
+    under `data.snapshot`, but `diff snapshot --json` puts it under `data.diff`,
+    so the envelope parsed cleanly, matched no key, and every value was emitted
+    verbatim at exit 0 -- on a command the interceptor ALLOWS, because the
+    redactor is in the pipe. A key allowlist is a standing bet that the CLI
+    never adds a fourth key; recognising the SHAPE does not take that bet.
+    """
+    for raw in value.split("\n"):
+        line = ANSI_SGR_RE.sub("", raw)
+        mark = DIFF_MARKER_RE.match(line)
+        if mark:
+            line = line[mark.end():]
+        line, _quoted = _unquote_key(line)
+        if NODE_RE.match(line) or QUOTED_CHILD_RE.match(line):
+            return True
+    return False
+
+
+def _redact_json_in_place(node: object) -> object:
+    """Redact any string field carrying an a11y tree, at any depth."""
+    if isinstance(node, dict):
+        return {
+            k: (redact_text(v)
+                if isinstance(v, str) and (k == "snapshot" or looks_like_a11y_tree(v))
+                else _redact_json_in_place(v))
+            for k, v in node.items()
+        }
+    if isinstance(node, list):
+        return [_redact_json_in_place(v) for v in node]
+    return node
+
+
+def die(reason: str) -> None:
+    """Fail closed. Never quote the input -- that would re-open the leak."""
+    sys.stderr.write(f"redact-a11y-snapshot: refusing to emit: {reason}\n")
+    sys.exit(2)
+
+
+def main() -> None:
+    raw = sys.stdin.buffer.read(MAX_INPUT_BYTES + 1)
+    if len(raw) > MAX_INPUT_BYTES:
+        die(f"input exceeds {MAX_INPUT_BYTES} bytes")
+
+    try:
+        text = raw.decode("utf-8")
+    except UnicodeDecodeError:
+        die("input is not valid UTF-8")
+
+    if not text:
+        return
+
+    # Locate a JSON payload even when something is printed AHEAD of it.
+    #
+    # This is the shape the guard itself prescribes: `agent-browser snapshot -i
+    # --json 2>&1 | python3 <this>`. The `2>&1` merges any agent-browser
+    # diagnostic in front of the JSON, so a `startswith` test is False, the
+    # input falls to the line-based path, NODE_RE never matches a single-line
+    # JSON blob, and the credential passes through verbatim at exit 0.
+    # Measured, and it is the highest-severity shape because our own
+    # instructions steer every agent onto it.
+    brace = min(
+        (i for i in (text.find("{"), text.find("[")) if i != -1),
+        default=-1,
+    )
+    if brace != -1:
+        try:
+            parsed = json.loads(text[brace:])
+        except json.JSONDecodeError as exc:
+            # Fail closed on anything that PRESENTS as a JSON document: some
+            # line, after stripping, begins with `{` or `[`.
+            #
+            # The earlier form keyed on the literal `"snapshot"` being present,
+            # so an envelope truncated BEFORE that key -- or one with a typo'd
+            # key -- matched neither clause, fell through to the line-based
+            # path, and was emitted verbatim at exit 0. A partial envelope is
+            # exactly what a killed `agent-browser` produces, so that was the
+            # likely shape, not an exotic one.
+            #
+            # A stray brace INSIDE an a11y node value does not begin a line, so
+            # ordinary text is unaffected and does not take the run down.
+            if any(ln.lstrip().startswith(("{", "[")) for ln in text.splitlines()):
+                die(f"input looks like JSON but does not parse ({exc.msg})")
+        else:
+            prefix = redact_text(text[:brace])
+            sys.stdout.write(prefix + json.dumps(_redact_json_in_place(parsed)))
+            return
+
+    sys.stdout.write(redact_text(text))
+
+
+if __name__ == "__main__":
+    main()

package/skills/agent-browser/test/fixtures/capture-playwright-mcp-fixtures.py

@@ -0,0 +1,217 @@
+#!/usr/bin/env python3
+"""Capture Playwright-MCP stdio fixtures from the surface (#7980, Phase 0.2).
+
+    python3 capture-playwright-mcp-fixtures.py <output-dir> -- <server argv...>
+
+Serves a synthesized form on 127.0.0.1 (no real credential, no real origin),
+drives the given MCP server over its own stdin/stdout with hand-written
+JSON-RPC, and writes ONE JSON file per captured message into <output-dir>:
+
+    initialize.json            tools-list.json          roots-list-request.json
+    navigate.json              snapshot.json            snapshot-filename.json
+    snapshot-meta-json.json    snapshot-meta-raw.json   find.json
+    evaluate.json              screenshot.json          close.json
+    raw-stdout.bin             framing.json             page.html
+
+The page puts the sentinel `ZZQP-SENTINEL-7980` ONLY in credential-named inputs
+(password, Token) and `ZZQP-BENIGN-7980` in Notes, so a redaction assertion can
+count both halves. Every `@playwright/mcp` bump re-runs this driver so the suite
+tests captures from the pinned surface, never from the author (ADR-213 round 3).
+
+Framing assertion (row 12): every server stdout message is one `\n`-terminated
+line that parses as a JSON object, no embedded newline, no `Content-Length`.
+
+stdlib only. Exit 0 on a complete capture, 1 on a framing violation, 2 on usage.
+"""
+from __future__ import annotations
+
+import contextlib
+import http.server
+import json
+import os
+import selectors
+import subprocess
+import sys
+import threading
+import time
+
+PAGE_HTML = """<!doctype html>
+<html><head><meta charset="utf-8"><title>probe 7980</title></head>
+<body>
+<form>
+  <label>Enter your password <input type="password" value="ZZQP-SENTINEL-7980"></label>
+  <label>Token <input type="text" readonly value="ZZQP-SENTINEL-7980"></label>
+  <label>Email address <input type="email" value="probe-user@example.invalid"></label>
+  <label>Notes <textarea>ZZQP-BENIGN-7980</textarea></label>
+  <button type="button">Go</button>
+</form>
+</body></html>
+"""
+
+
+class _Quiet(http.server.SimpleHTTPRequestHandler):
+    def log_message(self, *_args):  # noqa: D401 - silence the server
+        pass
+
+    def do_GET(self):  # noqa: N802 - http.server API
+        body = PAGE_HTML.encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+def serve_page():
+    srv = http.server.ThreadingHTTPServer(("127.0.0.1", 0), _Quiet)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    return srv, f"http://127.0.0.1:{srv.server_address[1]}/page.html"
+
+
+class Driver:
+    def __init__(self, argv, out):
+        self.out = out
+        self.child = subprocess.Popen(
+            argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=sys.stderr, bufsize=0
+        )
+        self.sel = selectors.DefaultSelector()
+        self.sel.register(self.child.stdout, selectors.EVENT_READ)
+        self.buf = bytearray()
+        self.raw = bytearray()
+        self.next_id = 1
+        self.violations = []
+
+    def send(self, obj):
+        line = json.dumps(obj, separators=(",", ":")).encode() + b"\n"
+        self.child.stdin.write(line)
+        self.child.stdin.flush()
+
+    def request(self, method, params=None):
+        rid = self.next_id
+        self.next_id += 1
+        msg = {"jsonrpc": "2.0", "id": rid, "method": method}
+        if params is not None:
+            msg["params"] = params
+        self.send(msg)
+        return rid
+
+    def read_line(self, timeout=60.0):
+        deadline = time.monotonic() + timeout
+        while b"\n" not in self.buf:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise TimeoutError("no line from server within timeout")
+            if not self.sel.select(timeout=remaining):
+                continue
+            chunk = os.read(self.child.stdout.fileno(), 65536)
+            if not chunk:
+                raise EOFError("server closed stdout")
+            self.buf += chunk
+            self.raw += chunk
+        line, _, rest = bytes(self.buf).partition(b"\n")
+        self.buf = bytearray(rest)
+        return line
+
+    def wait_response(self, rid, name):
+        """Read until the response for `rid` arrives; capture server requests on the way."""
+        while True:
+            line = self.read_line()
+            if line.startswith(b"Content-Length"):
+                self.violations.append("Content-Length header on stdout")
+            try:
+                obj = json.loads(line.decode("utf-8", errors="replace"))
+            except json.JSONDecodeError:
+                self.violations.append(f"non-JSON stdout line ({len(line)} bytes)")
+                continue
+            if not isinstance(obj, dict):
+                self.violations.append("stdout line is not a JSON object")
+                continue
+            if "method" in obj and "id" in obj:
+                # server -> client request (roots/list); answer it and record it.
+                self.save("roots-list-request" if obj["method"] == "roots/list" else f"server-request-{obj['method'].replace('/', '-')}", obj)
+                self.send({"jsonrpc": "2.0", "id": obj["id"], "result": {"roots": []}})
+                continue
+            if "method" in obj:
+                self.save(f"notification-{obj['method'].replace('/', '-')}", obj)
+                continue
+            if obj.get("id") == rid:
+                self.save(name, obj)
+                return obj
+            self.save(f"unexpected-{obj.get('id')}", obj)
+
+    def save(self, name, obj):
+        path = os.path.join(self.out, f"{name}.json")
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(obj, fh, indent=2, ensure_ascii=False)
+            fh.write("\n")
+
+    def call(self, name, tool, arguments=None):
+        rid = self.request("tools/call", {"name": tool, "arguments": arguments or {}})
+        return self.wait_response(rid, name)
+
+    def finish(self):
+        with contextlib.suppress(OSError):
+            self.child.stdin.close()
+        try:
+            self.child.wait(timeout=30)
+        except subprocess.TimeoutExpired:
+            self.child.kill()
+        with open(os.path.join(self.out, "raw-stdout.bin"), "wb") as fh:
+            fh.write(bytes(self.raw))
+        lines = bytes(self.raw).split(b"\n")
+        trailing = lines[-1]
+        if trailing:
+            self.violations.append("stdout did not end with a newline")
+        framing = {
+            "messages": len(lines) - 1,
+            "content_length_header": any(l.startswith(b"Content-Length") for l in lines),
+            "every_line_is_json_object": all(
+                isinstance(json.loads(l.decode("utf-8", errors="replace")), dict) for l in lines[:-1]
+            ),
+            "violations": self.violations,
+        }
+        self.save("framing", framing)
+        return framing
+
+
+def main(argv):
+    if "--" not in argv or argv.index("--") != 1 or len(argv) < 3:
+        sys.stderr.write(__doc__)
+        return 2
+    out = argv[0]
+    server_argv = argv[2:]
+    os.makedirs(out, exist_ok=True)
+    with open(os.path.join(out, "page.html"), "w", encoding="utf-8") as fh:
+        fh.write(PAGE_HTML)
+    srv, url = serve_page()
+    try:
+        d = Driver(server_argv, out)
+        rid = d.request(
+            "initialize",
+            {
+                "protocolVersion": "2025-06-18",
+                "capabilities": {"roots": {"listChanged": True}},
+                "clientInfo": {"name": "capture-playwright-mcp-fixtures", "version": "7980"},
+            },
+        )
+        d.wait_response(rid, "initialize")
+        d.send({"jsonrpc": "2.0", "method": "notifications/initialized"})
+        d.wait_response(d.request("tools/list"), "tools-list")
+        d.call("navigate", "browser_navigate", {"url": url})
+        d.call("snapshot", "browser_snapshot")
+        d.call("snapshot-filename", "browser_snapshot", {"filename": "explicit-snap.yml"})
+        d.call("snapshot-meta-json", "browser_snapshot", {"_meta": {"json": True}})
+        d.call("snapshot-meta-raw", "browser_snapshot", {"_meta": {"raw": True}})
+        d.call("find", "browser_find", {"text": "Token"})
+        d.call("evaluate", "browser_evaluate", {"function": "() => ({a: 1, b: [1,2]})"})
+        d.call("screenshot", "browser_take_screenshot", {"type": "png"})
+        d.call("close", "browser_close")
+        framing = d.finish()
+    finally:
+        srv.shutdown()
+    print(json.dumps(framing))
+    return 1 if framing["violations"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/skills/agent-browser/test/fixtures/fake-passthrough-proxy.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Known-NEGATIVE relay for the proxy suite (#7980, QG5): spawn the server,
+pump bytes both ways, rewrite nothing. Every redaction/withhold/refuse row must
+be RED against this file and every must-PASS row GREEN; it is the pre-fix
+artefact, never shipped."""
+import os, selectors, subprocess, sys  # noqa: E401
+
+child = subprocess.Popen(sys.argv[sys.argv.index("--") + 1:], stdin=subprocess.PIPE, stdout=subprocess.PIPE, bufsize=0, start_new_session=True)
+sys.stderr.write(f"fake-passthrough-proxy: child pgid {os.getpgid(child.pid)}\n"); sys.stderr.flush()
+sel = selectors.DefaultSelector()
+sel.register(sys.stdin.buffer, selectors.EVENT_READ, "in")
+sel.register(child.stdout, selectors.EVENT_READ, "out")
+while sel.get_map():
+    for key, _ in sel.select():
+        data = os.read(key.fileobj.fileno(), 65536)
+        if key.data == "in":
+            if not data:
+                sel.unregister(key.fileobj); child.stdin.close(); continue
+            child.stdin.write(data); child.stdin.flush()
+        else:
+            if not data:
+                sel.unregister(key.fileobj); continue
+            sys.stdout.buffer.write(data); sys.stdout.buffer.flush()
+sys.exit(child.wait())