@tomflow/proflow-execution-browser-extension 0.1.37 → 0.1.39

package/extension/background.ts

@@ -1,4 +1,20 @@
+import { createCarrierAttentionRegistry } from "../src/carrier-attention.js";
+import {
+	type CarrierContinuationDenial,
+	createCarrierContinuationControl,
+} from "../src/carrier-continuation-control.js";
+import type {
+	ActionPermissionFacts,
+	PermissionSemanticAction,
+} from "../src/carrier-permission.js";
+import { createCarrierPermissionAttemptRegistry } from "../src/carrier-permission-attempt.js";
+import {
+	type CarrierPermissionDecision,
+	resolveHumanCarrierPermission,
+	resolveRoutineCarrierPermission,
+} from "../src/carrier-permission-lifecycle.js";
 import { createCollaborationCarrierApplication } from "../src/collaboration-carrier.js";
+import { shouldTriggerObserverRecovery } from "../src/recovery-trigger.js";
 import {
 	createSystemObserver,
 	type SystemObserverReasonFailure,
@@ -12,7 +28,6 @@ import {
 	type TaskObserverDiagnosticAssessment,
 	type TaskObserverDiagnosticFailure,
 } from "../src/task-observer.js";
-import { shouldTriggerObserverRecovery } from "../src/recovery-trigger.js";
 
 type PageState = "IDLE" | "BUSY" | "BLOCKED" | "UNKNOWN";
 type ActivityKind =
@@ -30,6 +45,7 @@ type ContentObservation = {
 	contentInstanceId: string;
 	pageState: PageState;
 	activityKind: ActivityKind;
+	blockerFacts?: ActionPermissionFacts;
 	observedAt: string;
 };
 type RuntimeMessage = {
@@ -38,6 +54,7 @@ type RuntimeMessage = {
 		| "PROFLOW_SIDE_PANEL_SNAPSHOT"
 		| "PROFLOW_TASK_APPLICATION"
 		| "PROFLOW_APPROVAL_APPLICATION"
+		| "PROFLOW_CARRIER_ATTENTION_ACTION"
 		| "PROFLOW_PROVISIONING_RELAY_FETCH";
 	observation?: Omit<ContentObservation, "tabId" | "windowId">;
 	operation?: string;
@@ -54,21 +71,33 @@ type BridgeCommand = {
 		| "SUBMIT"
 		| "VERIFY"
 		| "SCREENSHOT"
-		| "PERFORM";
+		| "PERFORM"
+		| "CARRIER_ATTENTION_ACTION";
 	tabId?: number;
 	url?: string;
 	text?: string;
 	fingerprint?: string;
 	request?: Record<string, unknown>;
+	attentionRef?: string;
+	action?: "allowOnce" | "deny";
 };
+type ContentSnapshotRequest = { type: "PROFLOW_PAGE_SNAPSHOT_REQUEST" };
 type ContentCommand = {
 	type: "PROFLOW_PAGE_COMMAND";
 	contentInstanceId: string;
 	expectedUrl: string;
-	operation: "observe" | "input" | "click" | "submit" | "verify";
+	operation:
+		| "observe"
+		| "input"
+		| "click"
+		| "submit"
+		| "verify"
+		| "permissionAction";
 	selector?: string;
 	value?: string;
 	fingerprint?: string;
+	permissionFingerprint?: string;
+	permissionAction?: PermissionSemanticAction;
 };
 type ProvisioningOperation =
 	| "PROVISION_CUSTOM_GPT"
@@ -119,7 +148,10 @@ type ChromeRuntime = {
 		onClicked: { addListener(listener: () => void): void };
 	};
 	tabs: {
-		query(query: { url?: string; currentWindow?: boolean }): Promise<ChromeTab[]>;
+		query(query: {
+			url?: string;
+			currentWindow?: boolean;
+		}): Promise<ChromeTab[]>;
 		get(tabId: number): Promise<ChromeTab>;
 		create(create: { url: string; active: boolean }): Promise<ChromeTab>;
 		reload(tabId: number): Promise<void>;
@@ -129,7 +161,10 @@ type ChromeRuntime = {
 		): Promise<ChromeTab>;
 		sendMessage(
 			tabId: number,
-			message: ContentCommand | ProvisioningContentCommand,
+			message:
+				| ContentCommand
+				| ContentSnapshotRequest
+				| ProvisioningContentCommand,
 		): Promise<unknown>;
 		captureVisibleTab(
 			windowId: number,
@@ -141,28 +176,70 @@ declare const chrome: ChromeRuntime;
 
 const extensionInstanceId = `extension:${crypto.randomUUID()}`;
 const sessions = new Map<number, ContentObservation>();
+const permissionHandling = new Map<number, string>();
+const permissionAutoAttempts = createCarrierPermissionAttemptRegistry();
+const carrierAttentions = createCarrierAttentionRegistry();
+const carrierContinuationControl = createCarrierContinuationControl();
 const BROWSER_CARRIER_KEEPALIVE_KEY = "proflowBrowserSnapshot";
 const BROWSER_CARRIER_KEEPALIVE_MS = 20_000;
 const BROWSER_BRIDGE_FETCH_TIMEOUT_MS = 5_000;
+let snapshotPersistence = Promise.resolve();
+let transientPermissionAttemptsRestore: Promise<boolean> | null = null;
 
 const sleep = (milliseconds: number) =>
 	new Promise<void>((resolve) => setTimeout(resolve, milliseconds));
 
-async function persistSnapshot() {
-	await chrome.storage.session.set({
+function persistSnapshot(): Promise<void> {
+	const value = {
 		proflowBrowserSnapshot: {
 			extensionInstanceId,
 			observedAt: new Date().toISOString(),
 			sessions: [...sessions.values()],
+			permissionAutoAttempts: permissionAutoAttempts.snapshot(),
+			carrierContinuationDenials: carrierContinuationControl.snapshot(),
 			recoveryScan: "BOUNDED_ON_START",
 		},
-	});
+	};
+	// Preserve invocation order so an older empty snapshot cannot overwrite a
+	// later pre-click uncertainty record.
+	snapshotPersistence = snapshotPersistence
+		.catch(() => undefined)
+		.then(() => chrome.storage.session.set(value));
+	return snapshotPersistence;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function restoreTransientPermissionAttempts(): Promise<boolean> {
+	if (transientPermissionAttemptsRestore)
+		return transientPermissionAttemptsRestore;
+	transientPermissionAttemptsRestore = (async () => {
+		try {
+			const stored = await chrome.storage.session.get(
+				BROWSER_CARRIER_KEEPALIVE_KEY,
+			);
+			const snapshot = stored[BROWSER_CARRIER_KEEPALIVE_KEY];
+			const validSnapshot = isRecord(snapshot);
+			const attemptsLoaded = permissionAutoAttempts.load(
+				validSnapshot ? snapshot.permissionAutoAttempts : undefined,
+			);
+			const denialsLoaded = carrierContinuationControl.load(
+				validSnapshot ? snapshot.carrierContinuationDenials : undefined,
+			);
+			return attemptsLoaded && denialsLoaded;
+		} catch {
+			// A later pre-click persistence failure still prevents the click. No
+			// automatic-action fact is manufactured from unreadable session data.
+			permissionAutoAttempts.load(undefined);
+			carrierContinuationControl.load(undefined);
+			return false;
+		}
+	})();
+	return transientPermissionAttemptsRestore;
+}
+
 function parseConfig(value: unknown): BridgeConfig | null {
 	if (!isRecord(value)) return null;
 	const endpoint = value.endpoint;
@@ -450,6 +527,8 @@ const taskObserver = createTaskObserver({
 	},
 	carrier: {
 		async requestWake(input) {
+			if (carrierContinuationControl.hasMatchingDispatchDenial(input))
+				throw new Error("CARRIER_CONTINUATION_HUMAN_DENIED");
 			return invokeObserverApplication("task.wake", input);
 		},
 	},
@@ -589,8 +668,16 @@ async function persistSystemObserverState(
 
 let observerRecoveryInFlight: Promise<void> | null = null;
 let observerRecoveryRetryCount = 0;
+let nextRecoverySuppressions: readonly CarrierContinuationDenial[] = [];
+function suppressNextObserverRecovery(
+	denials: readonly CarrierContinuationDenial[],
+): void {
+	nextRecoverySuppressions = denials;
+}
 function runObserverRecovery() {
 	if (observerRecoveryInFlight) return observerRecoveryInFlight;
+	const suppressedContinuations = nextRecoverySuppressions;
+	nextRecoverySuppressions = [];
 	observerRecoveryInFlight = (async () => {
 		let recoveryNeedsRetry = false;
 		await collaborationCarrier.recoverPending(50).catch(() => undefined);
@@ -609,6 +696,14 @@ function runObserverRecovery() {
 				)
 					continue;
 				try {
+					if (
+						suppressedContinuations.some(
+							(denial) =>
+								denial.taskId === candidate.taskId &&
+								denial.workerRef === candidate.workerRef,
+						)
+					)
+						continue;
 					const decision =
 						candidate.kind === "RECOVERY_RESUME"
 							? await taskObserver.drive(candidate.taskId, {
@@ -668,6 +763,12 @@ function runObserverRecovery() {
 				}).catch(() => {
 					recoveryNeedsRetry = true;
 				});
+				if (
+					suppressedContinuations.some(
+						(denial) => denial.taskId === candidate.taskId,
+					)
+				)
+					continue;
 				await taskObserver.drive(candidate.taskId).catch(() => {
 					recoveryNeedsRetry = true;
 				});
@@ -738,6 +839,462 @@ async function contentCommand(
 	return response.value;
 }
 
+function carrierIdentity(
+	url: string,
+): { roleRef: string; workerRef: string | null } | null {
+	try {
+		const parsed = new URL(url);
+		const segments = parsed.pathname.split("/").filter(Boolean);
+		if (
+			parsed.protocol !== "https:" ||
+			parsed.hostname !== "chatgpt.com" ||
+			segments[0] !== "g" ||
+			!segments[1]?.startsWith("g-")
+		)
+			return null;
+		return {
+			roleRef: segments[1],
+			workerRef: segments[2] === "c" && segments[3] ? segments[3] : null,
+		};
+	} catch {
+		return null;
+	}
+}
+
+function permissionAttemptKey(observed: ContentObservation): string | null {
+	return observed.blockerFacts
+		? `${observed.url}:${observed.blockerFacts.fingerprint}`
+		: null;
+}
+
+function setCarrierAttention(
+	observed: ContentObservation,
+	reason: string,
+): void {
+	const facts = observed.blockerFacts;
+	if (!facts) return;
+	const identity = carrierIdentity(observed.url);
+	carrierAttentions.derive({
+		tabId: observed.tabId,
+		contentInstanceId: observed.contentInstanceId,
+		url: observed.url,
+		permissionFingerprint: facts.fingerprint,
+		taskId: facts.taskId,
+		roleRef: identity?.roleRef ?? null,
+		workerRef: identity?.workerRef ?? null,
+		targetHost: facts.targetHost,
+		operationId: facts.operationId,
+		reason,
+		actions: facts.actions.filter(
+			(action): action is "allowOnce" | "deny" =>
+				action === "allowOnce" || action === "deny",
+		),
+		observedAt: new Date().toISOString(),
+	});
+	void publishCarrierAttentions();
+}
+
+function carrierAttentionViews() {
+	return carrierAttentions
+		.values()
+		.map(
+			({
+				attentionRef,
+				occurrenceRef,
+				taskId,
+				roleRef,
+				workerRef,
+				targetHost,
+				operationId,
+				reason,
+				actions,
+				observedAt,
+			}) => ({
+				attentionRef,
+				occurrenceRef,
+				taskId,
+				roleRef,
+				workerRef,
+				targetHost,
+				operationId,
+				reason,
+				actions,
+				observedAt,
+			}),
+		);
+}
+
+async function publishCarrierAttentions(): Promise<void> {
+	const config = await bridgeConfig().catch(() => null);
+	if (!config) return;
+	const query = `?extensionInstanceId=${encodeURIComponent(extensionInstanceId)}`;
+	const response = await bridgeFetch(config, `/v1/carrier/attentions${query}`, {
+		method: "POST",
+		body: JSON.stringify({ carrierAttentions: carrierAttentionViews() }),
+	});
+	if (!response.ok) throw new Error("CARRIER_ATTENTION_PUBLISH_REJECTED");
+}
+
+function rawPermissionFingerprint(value: unknown): string | null {
+	if (!isRecord(value) || !isRecord(value.blockerFacts)) return null;
+	return typeof value.blockerFacts.fingerprint === "string"
+		? value.blockerFacts.fingerprint
+		: null;
+}
+
+function parsePermissionFacts(
+	value: unknown,
+): ActionPermissionFacts | undefined {
+	if (!isRecord(value) || value.kind !== "ACTION_PERMISSION") return undefined;
+	const actions = value.actions;
+	if (
+		(value.targetHost !== null && typeof value.targetHost !== "string") ||
+		typeof value.operationId !== "string" ||
+		(value.taskId !== null && typeof value.taskId !== "string") ||
+		!Array.isArray(actions) ||
+		actions.some(
+			(action) =>
+				action !== "allowAlways" && action !== "allowOnce" && action !== "deny",
+		) ||
+		typeof value.fingerprint !== "string"
+	)
+		return undefined;
+	return {
+		kind: "ACTION_PERMISSION",
+		targetHost: value.targetHost,
+		operationId: value.operationId,
+		taskId: value.taskId,
+		actions: [...actions],
+		fingerprint: value.fingerprint,
+	};
+}
+
+function parseSnapshotObservation(
+	value: unknown,
+	tab: ChromeTab,
+): ContentObservation | null {
+	if (!isRecord(value) || tab.id === undefined || tab.windowId === undefined)
+		return null;
+	const pageState = value.pageState;
+	const activityKind = value.activityKind;
+	if (
+		typeof value.url !== "string" ||
+		typeof value.contentInstanceId !== "string" ||
+		(pageState !== "IDLE" &&
+			pageState !== "BUSY" &&
+			pageState !== "BLOCKED" &&
+			pageState !== "UNKNOWN") ||
+		(activityKind !== null &&
+			activityKind !== "GENERATING" &&
+			activityKind !== "ACTION_PERMISSION" &&
+			activityKind !== "ACTION_RUNNING" &&
+			activityKind !== "WAITING_HUMAN" &&
+			activityKind !== "WAITING_PEER" &&
+			activityKind !== "RECOVERING") ||
+		typeof value.observedAt !== "string"
+	)
+		return null;
+	const blockerFacts = parsePermissionFacts(value.blockerFacts);
+	if (activityKind === "ACTION_PERMISSION" && blockerFacts === undefined)
+		return null;
+	return {
+		tabId: tab.id,
+		windowId: tab.windowId,
+		url: value.url,
+		contentInstanceId: value.contentInstanceId,
+		pageState,
+		activityKind,
+		...(blockerFacts ? { blockerFacts } : {}),
+		observedAt: value.observedAt,
+	};
+}
+
+async function waitForPermissionReleased(
+	tabId: number,
+	fingerprint: string,
+): Promise<boolean> {
+	for (let attempt = 0; attempt < 40; attempt += 1) {
+		const current = sessions.get(tabId);
+		if (current && current.blockerFacts?.fingerprint !== fingerprint)
+			return true;
+		try {
+			const value = await contentCommand(tabId, { operation: "observe" });
+			if (rawPermissionFingerprint(value) !== fingerprint) return true;
+		} catch {
+			// Navigation/content replacement is re-observed on the next bounded pass.
+		}
+		await sleep(250);
+	}
+	return false;
+}
+
+async function handleActionPermission(
+	observed: ContentObservation,
+): Promise<void> {
+	const facts = observed.blockerFacts;
+	const key = permissionAttemptKey(observed);
+	if (
+		observed.pageState !== "BLOCKED" ||
+		observed.activityKind !== "ACTION_PERMISSION" ||
+		!facts ||
+		!key
+	)
+		return;
+	if (permissionHandling.get(observed.tabId) === key) return;
+	const existing = carrierAttentions.current(observed.tabId);
+	if (
+		existing?.contentInstanceId === observed.contentInstanceId &&
+		existing.permissionFingerprint === facts.fingerprint
+	)
+		return;
+	permissionHandling.set(observed.tabId, key);
+	try {
+		const identity = carrierIdentity(observed.url);
+		const humanDenied = () =>
+			carrierContinuationControl.hasMatchingPermissionDenial({
+				tabId: observed.tabId,
+				contentInstanceId: observed.contentInstanceId,
+				url: observed.url,
+				permissionFingerprint: facts.fingerprint,
+				taskId: facts.taskId,
+				roleRef: identity?.roleRef ?? null,
+				workerRef: identity?.workerRef ?? null,
+			});
+		if (humanDenied()) {
+			setCarrierAttention(observed, "HUMAN_DENIED");
+			return;
+		}
+		if (!(await restoreTransientPermissionAttempts())) {
+			setCarrierAttention(observed, "PERMISSION_ATTEMPT_STATE_UNAVAILABLE");
+			return;
+		}
+		if (!identity || !facts.taskId) {
+			setCarrierAttention(observed, "PERMISSION_CONTEXT_INCOMPLETE");
+			return;
+		}
+		const result = await resolveRoutineCarrierPermission({
+			facts,
+			autoAlreadyAttempted: permissionAutoAttempts.has(observed.tabId, key),
+			humanDenied,
+			port: {
+				async classify(): Promise<CarrierPermissionDecision> {
+					const value = await invokeObserverApplication(
+						"browser.permission.classify",
+						{
+							taskId: facts.taskId as string,
+							roleRef: identity.roleRef,
+							...(identity.workerRef ? { workerRef: identity.workerRef } : {}),
+							conversationLocator: observed.url,
+							targetHost: facts.targetHost,
+							operationId: facts.operationId,
+						},
+					);
+					if (
+						!isRecord(value) ||
+						(value.decision !== "AUTO_ALLOW" &&
+							value.decision !== "DEFER" &&
+							value.decision !== "HUMAN_REQUIRED") ||
+						typeof value.reason !== "string"
+					)
+						return {
+							decision: "HUMAN_REQUIRED",
+							reason: "PERMISSION_CLASSIFICATION_INVALID",
+						};
+					return {
+						decision: value.decision,
+						reason: value.reason,
+					};
+				},
+				revalidate() {
+					const current = observationFor(observed.tabId);
+					return (
+						current.contentInstanceId === observed.contentInstanceId &&
+						current.url === observed.url &&
+						current.blockerFacts?.fingerprint === facts.fingerprint
+					);
+				},
+				waitBeforeReclassify: () => sleep(250),
+				async act(action) {
+					permissionAutoAttempts.begin(observed.tabId, key);
+					// Persist uncertainty before the click. If the MV3 worker restarts
+					// before readback, the same effect is never replayed blindly.
+					await persistSnapshot();
+					await contentCommand(observed.tabId, {
+						operation: "permissionAction",
+						permissionFingerprint: facts.fingerprint,
+						permissionAction: action,
+					});
+				},
+				released: () =>
+					waitForPermissionReleased(observed.tabId, facts.fingerprint),
+			},
+		});
+		if (result.status === "RELEASED") {
+			permissionAutoAttempts.release(observed.tabId, key);
+			carrierAttentions.removeTab(observed.tabId);
+			void publishCarrierAttentions();
+			await persistSnapshot();
+			return;
+		}
+		if (result.status === "HUMAN_REQUIRED")
+			setCarrierAttention(observed, result.reason);
+	} catch {
+		setCarrierAttention(observed, "AUTO_ALLOW_FAILED");
+	} finally {
+		if (permissionHandling.get(observed.tabId) === key)
+			permissionHandling.delete(observed.tabId);
+	}
+}
+
+type CarrierBlockerHandler = (observed: ContentObservation) => Promise<void>;
+
+// The application lines consume normalized reality only. New blocker cases
+// register a strategy here instead of branching Workflow/Collaboration/Observer.
+const carrierBlockerStrategies: ReadonlyMap<string, CarrierBlockerHandler> =
+	new Map([["ACTION_PERMISSION", handleActionPermission]]);
+
+function handleCarrierBlocker(observed: ContentObservation): void {
+	if (observed.pageState !== "BLOCKED" || observed.activityKind === null)
+		return;
+	const strategy = carrierBlockerStrategies.get(observed.activityKind);
+	if (strategy) void strategy(observed);
+}
+
+function processContentObservation(
+	observed: ContentObservation,
+	triggerRecovery: boolean,
+): void {
+	const previous = sessions.get(observed.tabId);
+	sessions.set(observed.tabId, observed);
+	permissionAutoAttempts.observe(
+		observed.tabId,
+		permissionAttemptKey(observed),
+	);
+	const attention = carrierAttentions.current(observed.tabId);
+	if (
+		attention &&
+		(observed.contentInstanceId !== attention.contentInstanceId ||
+			observed.url !== attention.url ||
+			observed.blockerFacts?.fingerprint !== attention.permissionFingerprint)
+	) {
+		carrierAttentions.removeTab(observed.tabId);
+		void publishCarrierAttentions();
+	}
+	handleCarrierBlocker(observed);
+	const shouldRecover =
+		triggerRecovery && shouldTriggerObserverRecovery(previous, observed);
+	const suppressed =
+		shouldRecover &&
+		carrierContinuationControl.suppressRecovery(previous, observed);
+	void persistSnapshot();
+	if (shouldRecover && !suppressed) void runObserverRecovery();
+}
+
+async function rebuildCarrierAttentionsFromTabs(): Promise<
+	CarrierContinuationDenial[]
+> {
+	const consumedDenials: CarrierContinuationDenial[] = [];
+	const tabs = await chrome.tabs.query({ url: "https://chatgpt.com/g/*" });
+	for (const tab of tabs) {
+		if (tab.id === undefined || tab.windowId === undefined) continue;
+		try {
+			const response = await chrome.tabs.sendMessage(tab.id, {
+				type: "PROFLOW_PAGE_SNAPSHOT_REQUEST",
+			});
+			if (!isRecord(response) || response.ok !== true) continue;
+			const observed = parseSnapshotObservation(response.value, tab);
+			if (observed) {
+				processContentObservation(observed, false);
+				const consumed = carrierContinuationControl.consumeRecovery(
+					undefined,
+					observed,
+				);
+				if (consumed) consumedDenials.push(consumed);
+			}
+		} catch {
+			// A tab without a live content receiver is not reconstructed from guesses.
+		}
+	}
+	await persistSnapshot();
+	await publishCarrierAttentions().catch(() => undefined);
+	return [
+		...consumedDenials,
+		...carrierContinuationControl
+			.snapshot()
+			.filter(
+				(denial) =>
+					!consumedDenials.some(
+						(consumed) => consumed.attentionRef === denial.attentionRef,
+					),
+			),
+	];
+}
+
+async function decideCarrierAttention(
+	attentionRef: string,
+	action: "allowOnce" | "deny",
+): Promise<{
+	attentionRef: string;
+	action: "allowOnce" | "deny";
+	status: "APPLIED";
+}> {
+	const attention = carrierAttentions.find(attentionRef);
+	if (!attention?.actions.includes(action))
+		throw new Error("CARRIER_ATTENTION_ACTION_DENIED");
+	await resolveHumanCarrierPermission({
+		action,
+		revalidate() {
+			const current = observationFor(attention.tabId);
+			return (
+				current.contentInstanceId === attention.contentInstanceId &&
+				current.url === attention.url &&
+				current.blockerFacts?.fingerprint === attention.permissionFingerprint
+			);
+		},
+		async act(semanticAction) {
+			if (semanticAction === "deny") {
+				carrierContinuationControl.beginDenied({
+					attentionRef: attention.attentionRef,
+					tabId: attention.tabId,
+					taskId: attention.taskId,
+					roleRef: attention.roleRef,
+					workerRef: attention.workerRef,
+					url: attention.url,
+					contentInstanceId: attention.contentInstanceId,
+					permissionFingerprint: attention.permissionFingerprint,
+				});
+				await persistSnapshot();
+			}
+			try {
+				await contentCommand(attention.tabId, {
+					operation: "permissionAction",
+					permissionFingerprint: attention.permissionFingerprint,
+					permissionAction: semanticAction,
+				});
+			} catch (error) {
+				if (semanticAction === "deny") {
+					carrierContinuationControl.cancelDenied(attention.attentionRef);
+					await persistSnapshot();
+				}
+				throw error;
+			}
+		},
+		released: () =>
+			waitForPermissionReleased(
+				attention.tabId,
+				attention.permissionFingerprint,
+			),
+	});
+	permissionAutoAttempts.release(
+		attention.tabId,
+		`${attention.url}:${attention.permissionFingerprint}`,
+	);
+	carrierAttentions.delete(attention.attentionRef);
+	void publishCarrierAttentions();
+	await persistSnapshot();
+	return { attentionRef, action, status: "APPLIED" };
+}
+
 async function waitForSubmittedMessage(
 	tabId: number,
 	fingerprint: string,
@@ -771,6 +1328,14 @@ function text(value: unknown, name: string): string {
 }
 
 async function executeCommand(command: BridgeCommand): Promise<unknown> {
+	if (command.type === "CARRIER_ATTENTION_ACTION") {
+		if (command.action !== "allowOnce" && command.action !== "deny")
+			throw new Error("ATTENTION_ACTION_INVALID");
+		return decideCarrierAttention(
+			text(command.attentionRef, "ATTENTION_REF"),
+			command.action,
+		);
+	}
 	if (command.type === "LIST_TABS") {
 		const tabs = await chrome.tabs.query({ url: "https://chatgpt.com/g/*" });
 		return tabs
@@ -1008,6 +1573,7 @@ async function runBridgeLoop() {
 				}),
 			});
 			if (!hello.ok) throw new Error("BRIDGE_HELLO_REJECTED");
+			await publishCarrierAttentions();
 			// Hello only establishes a session. The first inner-loop action must be
 			// a real command poll so Runtime readiness cannot be granted by hello alone.
 			let lastHeartbeatAt = Date.now();
@@ -1236,16 +1802,12 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 		sender.tab?.id !== undefined &&
 		sender.tab.windowId !== undefined
 	) {
-		const previous = sessions.get(sender.tab.id);
 		const observed: ContentObservation = {
 			...message.observation,
 			tabId: sender.tab.id,
 			windowId: sender.tab.windowId,
 		};
-		sessions.set(sender.tab.id, observed);
-		void persistSnapshot();
-		if (shouldTriggerObserverRecovery(previous, observed))
-			void runObserverRecovery();
+		processContentObservation(observed, true);
 		sendResponse({ accepted: true, extensionInstanceId });
 		return;
 	}
@@ -1259,6 +1821,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 				extensionInstanceId,
 				observedAt: new Date().toISOString(),
 				sessions: [...sessions.values()],
+				carrierAttentions: carrierAttentionViews(),
 				taskApplicationConfigured: application !== null,
 				approvalApplicationConfigured: approval !== null,
 				systemObserver: observerState
@@ -1276,6 +1839,33 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 		);
 		return true;
 	}
+	if (message.type === "PROFLOW_CARRIER_ATTENTION_ACTION") {
+		if (!message.input) {
+			sendResponse({ ok: false, error: "CARRIER_ATTENTION_MESSAGE_INVALID" });
+			return;
+		}
+		const attentionRef = message.input.attentionRef;
+		const action = message.input.action;
+		if (
+			typeof attentionRef !== "string" ||
+			(action !== "allowOnce" && action !== "deny")
+		) {
+			sendResponse({ ok: false, error: "CARRIER_ATTENTION_MESSAGE_INVALID" });
+			return;
+		}
+		void decideCarrierAttention(attentionRef, action).then(
+			(value) => sendResponse({ ok: true, value }),
+			(error: unknown) =>
+				sendResponse({
+					ok: false,
+					error:
+						error instanceof Error
+							? error.message
+							: "CARRIER_ATTENTION_ACTION_FAILED",
+				}),
+		);
+		return true;
+	}
 	if (message.type === "PROFLOW_APPROVAL_APPLICATION") {
 		if (typeof message.operation !== "string" || !message.input) {
 			sendResponse({
@@ -1352,9 +1942,15 @@ async function openTaskPage(): Promise<void> {
 				body.url.startsWith(`${bridge.endpoint}/tasks/bootstrap/`)
 			) {
 				const webUrl = `${bridge.endpoint}/tasks`;
-				const [existing] = await chrome.tabs.query({ url: webUrl, currentWindow: true });
+				const [existing] = await chrome.tabs.query({
+					url: webUrl,
+					currentWindow: true,
+				});
 				if (existing?.id !== undefined) {
-					await chrome.tabs.update(existing.id, { url: body.url, active: true });
+					await chrome.tabs.update(existing.id, {
+						url: body.url,
+						active: true,
+					});
 				} else {
 					await chrome.tabs.create({ url: body.url, active: true });
 				}
@@ -1377,10 +1973,13 @@ async function openTaskPage(): Promise<void> {
 }
 
 async function startBackgroundRuntime(): Promise<void> {
+	await restoreTransientPermissionAttempts();
 	await bootstrapManagedRuntimeConfig();
 	await persistSnapshot();
 	void runBridgeLoop();
 	void runProvisioningBridgeLoop();
+	const suppressedContinuations = await rebuildCarrierAttentionsFromTabs();
+	suppressNextObserverRecovery(suppressedContinuations);
 	void runObserverRecovery();
 }
 
@@ -1388,17 +1987,23 @@ chrome.action.onClicked.addListener(() => {
 	void openTaskPage();
 });
 chrome.runtime.onInstalled.addListener(() => {
-	void bootstrapManagedRuntimeConfig().then(async () => {
+	void restoreTransientPermissionAttempts().then(async () => {
+		await bootstrapManagedRuntimeConfig();
 		await persistSnapshot();
 		void runBridgeLoop();
+		const suppressedContinuations = await rebuildCarrierAttentionsFromTabs();
+		suppressNextObserverRecovery(suppressedContinuations);
 		void runObserverRecovery();
 	});
 });
 chrome.runtime.onStartup.addListener(() => {
 	sessions.clear();
-	void bootstrapManagedRuntimeConfig().then(async () => {
+	void restoreTransientPermissionAttempts().then(async () => {
+		await bootstrapManagedRuntimeConfig();
 		await persistSnapshot();
 		void runBridgeLoop();
+		const suppressedContinuations = await rebuildCarrierAttentionsFromTabs();
+		suppressNextObserverRecovery(suppressedContinuations);
 		void runObserverRecovery();
 	});
 });