@tea-agent/loop-agent 0.43.0-next.5 → 0.43.0-next.7

package/CHANGELOG.md

@@ -4,12 +4,18 @@
 
 ### 新增
 
+- Operator Chat 浏览器面板（DSH 风格）：Console 右侧辅助栏新增「浏览器」tab——地址栏（自动补 https、仅 http/https、禁止 javascript/data/file 等危险协议与本机回环地址）、后退/前进/刷新导航栈、系统浏览器跳转；页面运行在无 same-origin、无 top-navigation 的沙箱 iframe 中（访问的页面拿不到 Console 的存储与 API），沙箱状态条支持单页面临时解锁（红色警示 + 一键恢复）；对拒绝被嵌入的站点（X-Frame-Options / frame-ancestors）给出明确解释面板与「在系统浏览器打开 / 仍要加载」出口，探测端点仅返回响应头、仅限 http(s) 非回环、8 秒硬超时。
 - Operator Chat 源代码管理（DSH 风格）：模型获得 `scm` 工具（status/diff/stage/unstage/discard/commit/log/branch/push/pull，固定参数 git 无 shell、限时限量输出）；Console 右侧辅助栏新增「源码」面板（DSH GitView 布局——分支下拉切换、已暂存/更改分组与全部暂存/取消暂存、单行提交框 Ctrl+Enter、内联分页历史带 refs 徽标与相对时间、点击文件看 diff、右键菜单放弃更改/复制路径）；模型与面板共用同一工作区级 ScmService。
 - Operator Chat 在具备 Aimax 凭据资格时，向对话进程注入 `$AIMAX_AUTH_TOKEN`（明文或 `sm4:v1:` 解密后的 ticket），供 skills 读取；文件缺失、无法解析或解密失败时不注入该变量。
 - Operator Chat 终端管理（DSH 风格）：模型获得 `terminal` 持久 PTY 工具（跨平台 shell 目录——Windows 提供 powershell/bash，macOS/Linux 提供 bash/zsh，pwsh 7 装了即用；cwd/环境变量/后台任务跨调用保留，完成标记协议 + 超时与截断保护，枚举与默认值按平台动态生成）；Console 右侧辅助栏新增「终端」面板（xterm.js 渲染，实时查看/接管模型的 shell，按平台动态展示可创建的 shell，支持发送输入、Ctrl+C、终止并关闭）；模型 shell 与用户面板共用同一会话注册表并开在工作区仓库根目录，命名区分来源。
 
 ### 改进
 
+- 修复前端契约可选字段未填写时，评审分片索引引用不存在字段、导致设计评审启动前失败的问题。分片生成跳过 undefined；读取端明确拒绝缺失字段、无效引用、重复或非法范围及未索引内容，保留合法空数组和 JSON 空值。
+
+- Operator Chat 侧栏「添加工作区」图标改为与 DSH 一致的文件夹加号，不再用纯加号。
+- Operator Chat 侧栏改为单一「新会话」；空白会话在输入框上方用芯片选择工作区和模式（工作流 / Pi），有历史后芯片收起。不再用落地页双卡或「新 Pi」按钮；换模式会复用或新建对应空白会话，不会改已有会话的模式。
+- 修复模型续跑取消后带部分文字仍被标记成功的问题；前端 Plan 的取消、认证、限流及策略失败优先于容量恢复，精确格式错误保留原修复路径。完整性检查按需求建立单次索引，减少大计划重复扫描，同时拆分纯检查与恢复策略模块。
 - 优化 Operator Chat 长会话的流式渲染：完成回合、消息行、工具卡和用户输入锚点建立稳定的 memo 边界，流式文本更新不再重复渲染整段历史或重装锚点测量监听；缓存会在历史消息或工具实际更新时正确失效；无新增折叠回合时不再提交空状态及重复写入本地存储，工具参数与结果格式化按真实输入变化缓存。
 - 对话页「过程折叠」对齐 DSH 细节：折叠后的内容仍保留在页面中，浏览器 Ctrl+F 可直接命中并自动展开；折叠行展开时不再多出底部空隙；箭头改为 16px、颜色更淡的固定图标（靠旋转而非换图标），并补齐系统「减少动态效果」偏好；汇总文案新增「N 个 subagent」，内置 Explore 子代理不再计入普通工具调用。
 - 恢复前端 Plan 实时事实分页读取、逐需求 UX 遗漏检查与已完成范围复用；超限时补齐剩余验证目标，并接通 DAG 到 SDK 的原会话续跑。局部状态修改保留其他需求的关联，沿用耐久账本、显式替换和冻结分片边界。
@@ -31,6 +37,7 @@
 
 ### 修复
 
+- 修复点「新 Pi」后一发消息侧栏就变成「工作流」：全局会话列表和点进会话时漏了 `sessionMode`，缺省被当成工作流。
 - 修复对话页存在运行活动时，收起状态的右侧辅助栏展开按钮覆盖「运行活动 N」及数字徽标的问题；中大尺寸布局现在保留 8px 操作间距，窄屏布局不变。
 - 修复 Operator Chat 消息流的六处实际使用问题：
   - **回复被吞**：断线/重连（含每 25 秒的 SSE 事件窗口轮转）后，保留事件里已经生成的正文会在事件流恢复时重新应用到对应回合，不再被静默丢弃；仅当该回合已有更新内容时才跳过，避免重复气泡。

package/dist/build-stamp.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.43.0-next.5",
-  "gitSha": "6a8572a4f425eb430ee85547653c581987b6c0d2",
-  "builtAt": "2026-09-09T06:17:31.024Z"
+  "version": "0.43.0-next.7",
+  "gitSha": "55437ad2cc676289ad970390a991cf28f47584d2",
+  "builtAt": "2026-09-09T08:12:25.724Z"
 }

package/dist/executors/dag-pi-executor.js

@@ -1,3 +1,6 @@
+import { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts, committedFactFromPlanRecord, planFactStringList, planFactScopeIntersects } from "../workflows/dag/frontend-plan-completeness.js";
+export { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts } from "../workflows/dag/frontend-plan-completeness.js";
+import { classifyFrontendPlanRecovery } from "../workflows/dag/frontend-plan-recovery-policy.js";
 import { collectFrontendExecutionGroups, frontendExecutionSchema } from "../workflows/dag/frontend-execution-groups.js";
 import { FRONTEND_SCOPE_TARGET_BYTES, packFrontendInputUnits, parseFrontendInputBlock, projectFrontendContractPrompt, projectFrontendInputScope } from "../workflows/dag/frontend-input-projection.js";
 import { createDurableFrontendTools } from "../workflows/dag/frontend-durable-tools.js";
@@ -268,16 +271,6 @@ export function isPlannerThinkingExhausted(result, committedAnyFacts) {
         return false;
     return true;
 }
-/** Capacity recovery must not depend on whether a gateway emitted prose or
- * diagnostics. Precise provider/governance failures retain their ownership. */
-function isFrontendPlanCapacityStop(result) {
-    if (result.ok || result.timedOut)
-        return false;
-    if (result.failureCategory === OUTPUT_LIMIT_RETRY_CATEGORY)
-        return true;
-    return readWriterThinkingExhaustionEvidence(result).stopReason === "length" &&
-        (!result.failureCategory || ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory));
-}
 /**
  * The writer session burned an excessive token budget (a read-edit-test loop
  * that never converged) and still failed. Distinct from empty-output so the
@@ -3811,180 +3804,6 @@ const FRONTEND_PLAN_SEGMENTS = [
         ].join(" "),
     },
 ];
-function committedFactFromPlanRecord(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return undefined;
-    const record = value;
-    if (record.phase !== undefined && record.phase !== "committed")
-        return undefined;
-    const fact = record.fact;
-    return fact && typeof fact === "object" && !Array.isArray(fact)
-        ? fact
-        : typeof record.kind === "string"
-            ? record
-            : undefined;
-}
-function planFactStringList(value) {
-    if (!Array.isArray(value))
-        return [];
-    return value.filter((item) => typeof item === "string" && item.trim().length > 0);
-}
-function planFactScopeIntersects(fact, requirementIds) {
-    return planFactStringList(fact.scopeRequirementIds).some((id) => requirementIds.has(id));
-}
-/** Compute the authoritative coverage queue from the committed plan ledger. */
-export function collectFrontendPlanMissingFacts(input) {
-    const requirements = new Map();
-    const standaloneEvidenceGaps = new Set();
-    const verificationTargetIds = new Set();
-    const verificationTargetRequirements = new Map();
-    for (const value of input.committedFacts) {
-        const fact = committedFactFromPlanRecord(value);
-        if (!fact || fact.origin !== "plan")
-            continue;
-        if (fact.kind === "plan-requirement" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            if (typeof entry.id === "string" && entry.id.trim())
-                requirements.set(entry.id, entry);
-        }
-        if (fact.kind === "plan-verification-target" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            const id = entry.id;
-            if (typeof id === "string" && id.trim()) {
-                verificationTargetIds.add(id);
-                verificationTargetRequirements.set(id, new Set(Array.isArray(entry.requirementIds)
-                    ? entry.requirementIds.filter((value) => typeof value === "string")
-                    : []));
-            }
-        }
-        if (fact.kind === "plan-evidence-gap" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            const requirementId = entry.requirementId;
-            const description = entry.description;
-            if (typeof requirementId === "string" && requirementId.trim() && typeof description === "string" && description.trim()) {
-                standaloneEvidenceGaps.add(requirementId);
-            }
-        }
-    }
-    const missing = [];
-    for (const id of input.requirementIds) {
-        const entry = requirements.get(id);
-        if (!entry) {
-            missing.push({
-                kind: "plan-requirement",
-                id,
-                requirementIds: [id],
-                reason: `requirement ${id} has no committed plan-requirement fact`,
-            });
-            continue;
-        }
-        const targetIds = Array.isArray(entry.verificationTargetIds)
-            ? entry.verificationTargetIds.filter((value) => typeof value === "string" && value.trim().length > 0)
-            : [];
-        const gap = entry.evidenceGap && typeof entry.evidenceGap === "object"
-            ? entry.evidenceGap
-            : undefined;
-        const hasEvidenceGap = (typeof gap?.description === "string" && gap.description.trim().length > 0) ||
-            standaloneEvidenceGaps.has(id);
-        if (targetIds.length === 0 && !hasEvidenceGap) {
-            missing.push({
-                kind: "plan-verification-target",
-                requirementIds: [id],
-                reason: `requirement ${id} declares neither a verification target nor a non-empty evidenceGap`,
-            });
-            continue;
-        }
-        for (const targetId of targetIds) {
-            if (!verificationTargetIds.has(targetId) ||
-                !verificationTargetRequirements.get(targetId)?.has(id)) {
-                missing.push({
-                    kind: "plan-verification-target",
-                    id: targetId,
-                    requirementIds: [id],
-                    reason: `requirement ${id} references verification target ${targetId}, but that target is not committed`,
-                });
-            }
-        }
-    }
-    return missing;
-}
-/** Completeness checks for phases whose facts are committed incrementally. */
-export function collectFrontendPlanPhaseMissingFacts(input) {
-    const facts = input.committedFacts
-        .map(committedFactFromPlanRecord)
-        .filter((fact) => Boolean(fact && fact.origin === "plan"));
-    if (input.phase === "ux-registry") {
-        return facts.some((fact) => fact.kind === "state-registry")
-            ? []
-            : [
-                {
-                    kind: "state-registry",
-                    requirementIds: [...input.requirementIds],
-                    reason: "global UX vocabulary phase has no committed state-registry fact",
-                },
-            ];
-    }
-    if (input.phase === "ux-local") {
-        if (input.requirementIds.length > 1) {
-            return input.requirementIds.flatMap(id => collectFrontendPlanPhaseMissingFacts({
-                ...input, requirementIds: [id],
-            }));
-        }
-        const needsUx = input.requirementIds.some((id) => input.behaviorRequiredRequirementIds?.includes(id));
-        if (!needsUx)
-            return [];
-        const requirementSlice = new Set(input.requirementIds);
-        const scopedFacts = facts.filter((fact) => planFactScopeIntersects(fact, requirementSlice));
-        const hasChoice = scopedFacts.some((fact) => fact.kind === "component-choice" &&
-            Array.isArray(fact.uiComponentChoices) &&
-            fact.uiComponentChoices.length > 0);
-        const canonicalStateFlow = collectCanonicalStateFlowNames(scopedFacts);
-        const liveStateFlow = collectCanonicalStateFlowNames(facts);
-        const hasStateFlow = [...canonicalStateFlow.uiStateNames].some(name => liveStateFlow.uiStateNames.has(name)) ||
-            [...canonicalStateFlow.interactionNames].some(name => liveStateFlow.interactionNames.has(name));
-        const missing = [];
-        if (!hasChoice) {
-            missing.push({
-                kind: "component-choice",
-                requirementIds: [...input.requirementIds],
-                reason: "behaviour-required UX slice has no committed component-choice fact",
-            });
-        }
-        if (!hasStateFlow) {
-            missing.push({
-                kind: "state-flow",
-                requirementIds: [...input.requirementIds],
-                reason: "behaviour-required UX slice has no committed state-flow fact",
-            });
-        }
-        return missing;
-    }
-    const hasMockApi = facts.some((fact) => fact.kind === "mock-api");
-    const allInteractions = collectCanonicalStateFlowNames(input.committedFacts).interactionNames;
-    const liveInteractions = new Set([...collectCanonicalStateFlowNames(facts.filter(f => !planFactStringList(f.scopeRequirementIds).length || planFactScopeIntersects(f, new Set(input.requirementIds)))).interactionNames].filter(name => allInteractions.has(name)));
-    const coveredInteractions = new Set(facts
-        .filter((fact) => fact.kind === "data-flow")
-        .flatMap((fact) => planFactStringList(fact.interactions)));
-    const missing = [];
-    if (!hasMockApi) {
-        missing.push({
-            kind: "mock-api",
-            requirementIds: [...input.requirementIds],
-            reason: "global Mock/data phase has no committed mock-api fact",
-        });
-    }
-    for (const interaction of liveInteractions) {
-        if (coveredInteractions.has(interaction))
-            continue;
-        missing.push({
-            kind: "data-flow",
-            id: interaction,
-            requirementIds: [...input.requirementIds],
-            reason: `interaction ${interaction} has no committed data-flow fact`,
-        });
-    }
-    return missing;
-}
 /** Estimate calls conservatively: requirement + one VT, with a second VT
  * reserved for behaviour-required requirements. Explicit declarations win. */
 export function estimateFrontendPlanRequirementRecordCalls(fact) {
@@ -5069,13 +4888,13 @@ export async function runFrontendPlanSegmentedSessions(input) {
         // ownership; an unrelated/global fact must not prove a slice complete.
         if (input.attempt > 1 && input.committedFacts && session.id.startsWith("ux-local-") && session.requirementSlice?.length) {
             const facts = input.committedFacts();
-            const complete = session.requirementSlice.every(id => {
-                const owned = facts.filter(value => {
-                    const fact = committedFactFromPlanRecord(value);
-                    return fact && planFactStringList(fact.scopeRequirementIds).includes(id);
-                });
-                return owned.length > 0 && collectFrontendPlanPhaseMissingFacts({ phase: "ux-local", requirementIds: [id], committedFacts: facts, behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds }).length === 0;
-            });
+            const ownedIds = new Set(facts.flatMap(value => {
+                const fact = committedFactFromPlanRecord(value);
+                return fact ? planFactStringList(fact.scopeRequirementIds) : [];
+            }));
+            const complete = session.requirementSlice.every(id => ownedIds.has(id)) &&
+                collectFrontendPlanPhaseMissingFacts({ phase: "ux-local", requirementIds: session.requirementSlice,
+                    committedFacts: facts, behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds }).length === 0;
             if (complete) {
                 index += 1;
                 continue;
@@ -5278,9 +5097,10 @@ export async function runFrontendPlanSegmentedSessions(input) {
                         : isUxLocalSession
                             ? buildUxPrompt(session.requirementSlice ?? [], missing)
                             : buildPhasePrompt(globalMockDataSegment, missing, session.requirementSlice ?? allRequirementIds);
-        if (result.timedOut || /interrupt|termination-unconfirmed|budget_breach/.test(result.failureCategory))
+        const recovery = classifyFrontendPlanRecovery({ ...result, stopReason: readWriterThinkingExhaustionEvidence(result).stopReason });
+        if (recovery === "stop")
             return { ...result, ok: false };
-        if ((isFrontendPlanCapacityStop(result) || (session.atomicRecovery && result.ok)) && input.committedFacts &&
+        if ((recovery === "output" || (session.atomicRecovery && result.ok)) && input.committedFacts &&
             !(missingPhaseFacts.length === 1 && missingPhaseFacts[0].kind === "plan-requirement") &&
             (session.coverageOnly || isUxRegistrySession || isUxLocalSession || session.id.startsWith("global-mock-data"))) {
             if (missingPhaseFacts.length === 0) {
@@ -5317,7 +5137,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
             return { ...accumulated, ok: false, failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
                 stderr: `${accumulated.stderr}\nfrontend plan capacity recovery exhausted: preserve committed facts; phase=${session.id}; scope=${missingIds.join(",")}; strategy=atomic-fact; missing=${JSON.stringify(missingPhaseFacts)}`.trim() };
         }
-        const capacityExhausted = readWriterThinkingExhaustionEvidence(result).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory);
+        const capacityExhausted = recovery === "output" || recovery === "context";
         if (capacityExhausted && !result.timedOut) {
             const failure = () => mapPlannerExhaustion({ ...result, ok: false, stderr: `${result.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: ${session.id}; no smaller complete scope can finish; unchanged retries are disabled` }, committedAfter > committedBefore);
             const missingCoverageIds = input.committedFacts ? [...new Set(collectFrontendPlanMissingFacts({ requirementIds: session.coverageSlice ?? session.requirementSlice ?? allRequirementIds, committedFacts: input.committedFacts() }).flatMap(f => f.requirementIds))] : [...(session.coverageSlice ?? session.requirementSlice ?? allRequirementIds)];
@@ -5423,7 +5243,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : undefined;
         const zeroProgressBurn = coverageSlice !== undefined &&
             coverageSlice.length > 1 &&
-            (readWriterThinkingExhaustionEvidence(result).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory) || (committedAfter === committedBefore && !(result.assistantText ?? "").trim() && !result.stderr.trim())) &&
+            (capacityExhausted || (["empty-output", "unknown"].includes(result.failureCategory) && committedAfter === committedBefore && !(result.assistantText ?? "").trim() && !result.stderr.trim())) &&
             !result.timedOut;
         if (zeroProgressBurn && coverageSlice) {
             const missingIds = input.committedFacts ? new Set(collectFrontendPlanMissingFacts({ requirementIds: coverageSlice, committedFacts: input.committedFacts() }).flatMap(f => f.requirementIds)) : undefined;

package/dist/executors/pi-sdk-executor.js

@@ -978,6 +978,7 @@ async function executeSingleSdkAttemptInternal(options) {
         ? collected.parsedEvents
         : (fallbackParsed?.parsedEvents ?? 0);
     const tokensUsed = aggregateSdkTokenUsage(usageSamples);
+    const cancelled = stopReason === "aborted";
     const outputLimitExhausted = Boolean(options.outputLimitRecovery && stopReason === "length" && !committedTerminalObserved && !timedOut && !stderr);
     const failureCategory = !terminationConfirmed ? "termination-unconfirmed" : stopReason === "aborted" ? "cancelled" : outputLimitExhausted ? "output-limit" : providerBudgetFailure ? (providerBudgetFailure.includes("REQUEST_ABORTED") ? "interrupted" : providerBudgetFailure.startsWith("FRONTEND_CONTEXT_ESTIMATE_EXCEEDED") ? "context-budget-exhausted" : "budget_breach") : terminationConfirmed
         ? classifyPiFailure({
@@ -994,13 +995,14 @@ async function executeSingleSdkAttemptInternal(options) {
         backend: "sdk",
         command: ["pi-sdk", ...piSdkArgs],
         durationMs,
-        exitCode: timedOut || stderr || outputLimitExhausted ? 1 : 0,
+        exitCode: timedOut || stderr || outputLimitExhausted || cancelled ? 1 : 0,
         failureCategory,
         modelDisplay,
         ok: terminationConfirmed &&
             !timedOut &&
             !stderr &&
             !outputLimitExhausted &&
+            !cancelled &&
             assistantText.length > 0 &&
             !collected.outputTooLarge,
         parsedEvents,

package/dist/worker/console/chat/browser-policy.js

@@ -0,0 +1,143 @@
+/**
+ * Pure URL policy for the Operator Chat browser panel: normalize user input
+ * into an http(s) URL and refuse destinations that would be dangerous to
+ * embed in the panel iframe. Dependency-free so it is unit-testable.
+ *
+ * The iframe sandbox (opaque origin — no allow-same-origin, no top
+ * navigation) is the primary security boundary; this module is the
+ * address-bar gate on top of it: only http/https may be navigated, and
+ * loopback addresses are refused so a browsed page cannot probe local
+ * services by user action. The Console's OWN origin is explicitly allowed —
+ * the sandbox still renders it in an opaque origin with no same-origin
+ * privileges, exactly like any other site.
+ */
+/**
+ * Extract the `frame-ancestors` source list of a Content-Security-Policy
+ * header, or undefined when the directive is absent (or empty).
+ */
+export function extractFrameAncestors(csp) {
+    if (csp === null)
+        return undefined;
+    for (const directive of csp.split(";")) {
+        const parts = directive.trim().split(/\s+/);
+        if (parts[0] === "frame-ancestors") {
+            const sources = parts.slice(1).filter((source) => source !== "");
+            return sources.length === 0 ? undefined : sources;
+        }
+    }
+    return undefined;
+}
+/**
+ * Decide whether a site can render inside the panel iframe. The signals are
+ * exactly the ones the browser enforces when it refuses an iframe load:
+ * X-Frame-Options DENY/SAMEORIGIN, or a frame-ancestors directive that does
+ * not allow `*` ('self' means the SITE's own origin — never ours, so it also
+ * blocks the panel). A site we could not reach yields 'unknown' and the
+ * plain iframe stays.
+ */
+export function embeddabilityOf(probe) {
+    if (probe.reachable !== true)
+        return "unknown";
+    const xfo = probe.xFrameOptions?.trim().toUpperCase();
+    if (xfo === "DENY" || xfo === "SAMEORIGIN")
+        return "blocked";
+    if (probe.frameAncestors !== undefined &&
+        !probe.frameAncestors.some((source) => source === "*")) {
+        return "blocked";
+    }
+    return "embeddable";
+}
+/** A loopback hostname (localhost, IPv6 ::1, 127.0.0.0/8, 0.0.0.0). */
+export function isLoopbackHostname(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost" || host === "::1" || host === "0.0.0.0")
+        return true;
+    const parts = host.split(".");
+    return (parts.length === 4 &&
+        parts[0] === "127" &&
+        parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255));
+}
+/**
+ * Schemes that must never reach the iframe even without `//` (javascript:,
+ * data:, file:, ...). Host:port lookalikes (example.com:8080) are NOT here —
+ * they parse as hosts below.
+ */
+const FORBIDDEN_SCHEMES = new Set([
+    "javascript",
+    "data",
+    "file",
+    "about",
+    "vbscript",
+    "blob",
+    "mailto",
+    "tel",
+    "ftp",
+    "ftps",
+    "ws",
+    "wss",
+    "sftp",
+    "ssh",
+    "chrome",
+    "chrome-extension",
+    "moz-extension",
+    "edge",
+    "opera",
+    "resource",
+    "view-source",
+]);
+/**
+ * Normalize one address-bar input against the navigation policy.
+ * @param input raw user text.
+ * @param selfOrigin the Console's own origin (window.location.origin). The
+ * Console itself may be browsed in the panel (the sandbox keeps it opaque),
+ * so it is let through BEFORE the loopback check — its host is normally
+ * loopback.
+ */
+export function normalizeBrowserUrl(input, selfOrigin) {
+    const trimmed = input.trim();
+    if (trimmed === "")
+        return { kind: "invalid" };
+    // Distinguish an explicit scheme from a bare host:port. "example.com:8080"
+    // would match a naive scheme regex (dots are legal in schemes), so a
+    // scheme prefix is only honored when it is http(s) or a known-forbidden
+    // scheme; anything else is treated as a host and gets https://.
+    const schemeMatch = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(trimmed);
+    let withScheme;
+    if (schemeMatch === null) {
+        withScheme = `https://${trimmed}`;
+    }
+    else {
+        const scheme = schemeMatch[1]?.toLowerCase() ?? "";
+        if (scheme === "http" || scheme === "https")
+            withScheme = trimmed;
+        else if (FORBIDDEN_SCHEMES.has(scheme))
+            return { kind: "blocked", reason: "scheme" };
+        else
+            withScheme = `https://${trimmed}`;
+    }
+    let url;
+    try {
+        url = new URL(withScheme);
+    }
+    catch {
+        return { kind: "invalid" };
+    }
+    // Protocol backstop: any URL that still parses to a non-http(s) scheme
+    // (ftp://, ws:// — which carry `//` and skip the list) is refused here.
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return { kind: "blocked", reason: "scheme" };
+    }
+    // The Console's own origin is allowed (browsed in an opaque origin like
+    // any other site); checked before the loopback gate because its host is
+    // normally loopback.
+    try {
+        if (url.origin === new URL(selfOrigin).origin)
+            return { kind: "ok", url: url.href };
+    }
+    catch {
+        // Unparsable selfOrigin (never in practice): fall through to the gate.
+    }
+    if (isLoopbackHostname(url.hostname))
+        return { kind: "blocked", reason: "loopback" };
+    return { kind: "ok", url: url.href };
+}

package/dist/worker/console/chat/browser-routes.js

@@ -0,0 +1,148 @@
+/**
+ * HTTP routes for the Operator Chat browser panel: one read-only probe
+ * endpoint the panel uses to explain an iframe refusal (X-Frame-Options /
+ * CSP frame-ancestors are exactly the signals the browser enforces when it
+ * refuses to embed a site). The probe is display-only (headers back to the
+ * caller), restricted to http(s) non-loopback URLs, with a hard timeout.
+ */
+import { embeddabilityOf, extractFrameAncestors, isLoopbackHostname, } from "./browser-policy.js";
+function workspaceIdOf(req) {
+    try {
+        return new URL(req.url ?? "/", "http://localhost").searchParams.get("workspaceId") ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+    });
+    res.end(JSON.stringify(body));
+}
+/** Route dispatcher; returns true when the request was handled. */
+export async function handleBrowserRequest(req, res, deps, pathname) {
+    if (!pathname.startsWith("/api/operator/v1/chat/browser"))
+        return false;
+    const method = (req.method ?? "GET").toUpperCase();
+    const rest = pathname.slice("/api/operator/v1/chat/browser".length);
+    const parts = rest.split("/").filter(Boolean);
+    const sub = parts[0] ?? "";
+    try {
+        if (method === "GET" && sub === "probe" && parts.length === 1) {
+            // Fail-closed: the probe needs a workspaceId like every chat API.
+            if (deps.requireWorkspace) {
+                const ws = deps.requireWorkspace(req);
+                if (!ws.ok) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: { code: "WORKSPACE_REQUIRED", message: "workspaceId is required" },
+                    });
+                    return true;
+                }
+            }
+            else if (!workspaceIdOf(req)) {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: { code: "WORKSPACE_REQUIRED", message: "workspaceId is required" },
+                });
+                return true;
+            }
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const raw = url.searchParams.get("url") ?? "";
+            let parsed;
+            try {
+                parsed = new URL(raw);
+            }
+            catch {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: { code: "INVALID_URL", message: "invalid url" },
+                });
+                return true;
+            }
+            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: { code: "BAD_SCHEME", message: "only http/https urls can be probed" },
+                });
+                return true;
+            }
+            // Mirror the address-bar policy: loopback stays unreachable from
+            // the panel, so probing it would leak nothing the panel could use.
+            if (isLoopbackHostname(parsed.hostname)) {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: { code: "LOOPBACK_REFUSED", message: "local addresses are not probed" },
+                });
+                return true;
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 8000);
+            try {
+                let response = await fetch(parsed, {
+                    method: "HEAD",
+                    redirect: "follow",
+                    signal: controller.signal,
+                });
+                // Some servers answer HEAD with 405/501; retry once as GET
+                // (the body is discarded — only the headers matter).
+                if (response.status === 405 || response.status === 501) {
+                    response = await fetch(parsed, {
+                        method: "GET",
+                        redirect: "follow",
+                        signal: controller.signal,
+                    });
+                }
+                const csp = response.headers.get("content-security-policy");
+                const frameAncestors = extractFrameAncestors(csp);
+                const xFrameOptions = response.headers.get("x-frame-options");
+                const probe = {
+                    reachable: true,
+                    url: response.url,
+                    status: response.status,
+                    ...(xFrameOptions !== null ? { xFrameOptions } : {}),
+                    ...(frameAncestors !== undefined ? { frameAncestors } : {}),
+                };
+                sendJson(res, 200, {
+                    ok: true,
+                    data: { probe, verdict: embeddabilityOf(probe) },
+                });
+                return true;
+            }
+            catch {
+                // DNS / TLS / connection / timeout: nothing to judge — the
+                // client keeps the plain iframe.
+                sendJson(res, 200, {
+                    ok: true,
+                    data: { probe: { reachable: false }, verdict: "unknown" },
+                });
+                return true;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        sendJson(res, 404, {
+            ok: false,
+            error: { code: "NOT_FOUND", message: `unknown browser route: ${method} ${pathname}` },
+        });
+        return true;
+    }
+    catch (error) {
+        if (!res.headersSent) {
+            sendJson(res, 500, {
+                ok: false,
+                error: {
+                    code: "BROWSER_INTERNAL",
+                    message: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+        else {
+            res.end();
+        }
+        return true;
+    }
+}

package/dist/worker/console/chat/routes.js

@@ -48,6 +48,7 @@ import { SddDataAlignmentError, } from "./sdd-data-alignment.js";
 import { TerminalSessionRegistry } from "./terminal-sessions.js";
 import { handleTerminalRequest } from "./terminal-routes.js";
 import { handleScmRequest } from "./scm-routes.js";
+import { handleBrowserRequest } from "./browser-routes.js";
 function projectBrowserChatSession(record) {
     const { telemetrySessionId, ...projected } = record;
     void telemetrySessionId;
@@ -4267,6 +4268,10 @@ async function dispatchChatRequest(req, res, deps, pathname, workspaceScope) {
             return true;
         }
     }
+    // Browser probe API (read-only; explains iframe refusals to the panel).
+    if (await handleBrowserRequest(req, res, {}, pathname)) {
+        return true;
+    }
     if (!pathname.startsWith("/api/operator/v1/chat/") &&
         !pathname.startsWith("/api/operator/v1/pi/"))
         return false;