@underactive/pi-topping-web-tools 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [0.2.8] - 2026-10-12
+
+### Added
+
+- Documented that the default `codemode.inlineBudget` (3000 estimated tokens) leaves `web_browser` out of the `codemode.mode: "only"` tool listing when it is loaded with `fetch_markdown`, `pdf_extract`, and the built-in `read`, `bash`, `edit`, and `write`, and the budget that fits them.
+- Documented how a codemode script inspects a saved screenshot with `tools.read` and `image()` on pi 1.0.4+, and the fallback on older hosts.
+
+### Changed
+
+- Tested against pi 1.1.0. No break: the 1.0.4 and 1.1.0 extension-facing changes are additive (`ToolLoadout.getPromptGuidelines()`, and `durationMs` and `outputPad` on the tool render context), and codemode now lists each tool's prompt guidelines with its declaration, which is why `web_browser` no longer fits the default `codemode.inlineBudget` in `only` mode.
+- Bumped the pinned `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, and `@earendil-works/pi-tui` devDependencies from 1.0.3 to 1.1.0.
+- `web_browser`: the codemode screenshot guideline now tells a script to save the screenshot with `toFile=true`, read the file with `tools.read({ path })`, and pass the resulting image block to `image()`. This needs pi 1.0.4+, where `read` returns an image block for image files. A script that calls `web_browser` still receives only text, because the tool declares no output schema.
+
+### Fixed
+
+- `fetch_markdown`, `pdf_extract`, `web_browser`: a forged `</untrusted-content>` closing tag in fetched or page text is now escaped to `<\/untrusted-content` instead of deleted. Deletion could reassemble a real closer from split text such as `</untrusted-</untrusted-contentcontent>`, so hostile text could end the fence early and be read as trusted text. The match is case-insensitive, and the fence-escape tests now assert exactly one closing tag.
+- `fetch_markdown`, `pdf_extract`, `web_browser`: an expanded result preview drops terminal control characters from its body before styling, so a page cannot emit an OSC 52 clipboard write or another escape sequence while a result is drawn. `web_browser` also replaces control characters with spaces in a page title and in a tool error message.
+- `web_browser`: the `navigate` result now puts the status line before an `<untrusted-content>` fence that holds only the page title, and the `list_tabs` result is fenced the same way, because a tab title comes from the page. Both results held page-controlled text outside a fence before.
+
+## [0.2.7] - 2026-10-05
+
+### Changed
+
+- Tested against pi 1.0.3. No break: the extension-facing declaration surface is unchanged apart from additive `registerToolRenderer`/`ToolRenderers`, pi-ai adds `samplingParamsByThinkingLevel` and renames the Azure provider (unused here), and pi-tui's Home/End default change does not reach these tools.
+- Bumped the pinned `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, and `@earendil-works/pi-tui` devDependencies from 1.0.0 to 1.0.3.
+- `web_browser`: the truncated-output file and `toFile` screenshots are written with mode `0600`, matching pi 1.0.3's user-only output files. Both were already unreadable by other users because each sits in a `0700` `mkdtemp` directory.
+
 ## [0.2.6] - 2026-10-02
 
 ### Changed

package/README.md

@@ -61,6 +61,17 @@ All three tools are `direct`-exposure and pi activates those on registration (`d
 - To hide a tool for a session, name it in `--exclude-tools` (or start with `--no-tools` and re-add what you want with `--tools`).
 - To change the startup set in your `settings.json`, use `defaultTools`. Bare names **replace** pi's defaults, so write `"+fetch_markdown"` to add a tool without dropping `read`, `bash`, `edit`, and `write`. On pi 0.99.2+, `/reload` activates tools **newly added** to `defaultTools` without a restart. The reverse does not follow: a tool **removed** from `defaultTools` stays active until you restart, and a tool you turned off during the session stays off. `--tools`, `--no-tools`, and `--no-builtin-tools` still override the setting, on reload as well.
 
+### Codemode tool listing
+
+With `codemode.mode: "only"`, pi hides the direct declarations of active tools, so the model calls them from `codemode` scripts, and the `codemode` description lists each callable tool instead, with its prompt guidelines on pi 1.0.4+. Listed tools share `codemode.inlineBudget`, which defaults to 3000 estimated tokens (characters / 4); tools that do not fit are left out and are reached with `searchTools()` or `describeTool()`. On pi 1.0.4+, the seven-tool catalog `fetch_markdown`, `pdf_extract`, `web_browser`, plus built-in `read`, `bash`, `edit`, and `write` needs about 3,700 tokens as of pi 1.1.0 — `web_browser` alone is about 1,600, the largest section — so the default budget drops `web_browser` from that list. Set the budget to 4096 or more if you use `only` with these tools; real sessions that load more extensions need more.
+
+```json
+{
+  "codemode.mode": "only",
+  "codemode.inlineBudget": 4096
+}
+```
+
 ## `fetch_markdown`
 
 Complements pi's built-in search-backed `web_fetch` with a lightweight, keyless fetch path for public documentation, READMEs, and articles:
@@ -142,7 +153,7 @@ When `screenshot` returns an inline result (`toFile` omitted or `false`), `web_b
 
 `toFile=true` and `/browser-screenshot` save the original PNG to disk and put only the path and dimensions in the tool result. The file is resized only if a later `read` or `@file` attachment sends it to the model.
 
-In codemode, a tool result exposes only its text blocks, so an inline `screenshot` reaches the script as its caption with no image bytes. Call `screenshot` directly from the session, or pass `toFile=true` and read the saved path from the script.
+In codemode, a tool without an output schema, such as `web_browser`, resolves to its text blocks only, so an inline `screenshot` reaches the script as its caption with no image bytes. To let a script inspect a screenshot, take it with `toFile=true` and read the saved path: on pi 1.0.4+, `tools.read({ path })` resolves an image file to an image block, and `image()` adds that block to the script output. On pi before 1.0.4, `read` resolves an image file to only its `Read image file [...]` caption, so the pixels are not reachable from a script; on those hosts, call `screenshot` as a direct tool call instead of from a script.
 
 The resize fields are:
 
@@ -186,7 +197,7 @@ This matches pi's documented example. It leaves a default 1280×720 viewport scr
 - Every HTTP(S) document, script, image, XHR/fetch, beacon, and other routed request is checked against the live preapproved, session, and durable permissions before the request is sent. Path-scoped preapprovals remain path-scoped; session and durable grants remain exact-origin grants except that bare and `www.` host variants are treated as equivalent.
 - Redirect responses are inspected before Chromium receives them. Approved top-level redirects, including simple bare-domain ↔ `www.` redirects, are followed one gated hop at a time. During `navigate`, a redirect to an unapproved URL returns `Blocked: redirect to <origin> requires approval`; redirects triggered by later page interactions are blocked and reported in network logs. Redirected subresources are blocked rather than followed and also appear in network logs.
 - WebSocket handshakes use the same live permission check. Service workers are disabled so they cannot bypass request routing.
-- Client-side navigation and popup destinations are gated. A blocked popup is closed without becoming active, and a blocked same-tab navigation returns to the prior approved page.
+- Client-side navigation and popup destinations are gated. A blocked popup is closed without becoming active, and a blocked same-tab navigation returns to the prior approved page. Approved popups become active only after their main-frame navigation commits.
 - `data:` and `blob:` subresources are allowed because they do not create network egress, while top-level `data:`/`blob:` documents are denied. `file:` documents require approval for the target path; local-file subresources are allowed only from an approved local-file page.
 - Decision errors fail closed. Route handlers never prompt; call `navigate` on a blocked target to use the normal approval prompt. Blocks are reported by `get_network_logs` as `blocked by egress policy`.
 
@@ -245,13 +256,13 @@ Commands:
 
 ## Security model (shared)
 
-- **Preapproved hosts**: common documentation and dev sites are allowed without prompting. The allowlist lives in `src/permissions.ts` and is shared by both tools.
+- **Preapproved hosts**: common documentation and dev sites are allowed without prompting. The allowlist lives in `src/permissions.ts` and is shared by all three tools.
 - **User confirmation**: other hosts prompt Allow once / Allow for this session / Allow for 1 day / Allow for 1 week / Allow for 30 days / Deny. For `web_browser` navigation, Allow once becomes a browser-session grant because request-level enforcement must authorize the loaded document's later requests.
 - **Tool annotations**: on pi 0.99+, `fetch_markdown` and `pdf_extract` declare `readOnlyHint` and `openWorldHint`, and `web_browser` declares `openWorldHint` with `readOnlyHint: false`, for permission extensions that confirm calls by hint. The host confirmation above applies regardless of how another extension treats the hints.
 - **URL validation**: all tools reject embedded credentials and overlong URLs. `fetch_markdown` and `pdf_extract` additionally reject loopback, private, and link-local hosts and any non-HTTP(S) scheme on a `url`. `web_browser` accepts `localhost`, private IPs, and `file://` paths so it can drive local dev servers and local HTML — each still prompts for confirmation unless session-approved or covered by a saved durable grant.
 - **Local file resolution**: `pdf_extract` resolves a `path` through `realpath` before any check, so a symlink pointing outside the working directory is treated as outside and prompts. Directories, FIFOs, and devices are rejected, and the size limit is enforced from `stat` before any bytes are read. `web_browser` `upload_file` follows the same rule: files outside the working directory prompt for confirmation (session-scoped) before they are read.
 - **Isolated browser context and routed egress**: each session uses a fresh Chromium context (no shared profile/cookies with your system browser). HTTP(S) requests, redirect targets, client navigations, popups, and WebSocket connections are checked against live `web_browser` permissions; service workers are disabled.
-- **Untrusted content boundary**: `fetch_markdown` results are wrapped in `<untrusted-content url="…">` tags, and `pdf_extract` results in `<untrusted-content source="…">`, so the model treats fetched page and document text as data, not instructions.
+- **Untrusted content boundary**: `fetch_markdown` results and `web_browser` page-derived results are wrapped in `<untrusted-content url="…">` tags, and `pdf_extract` results in `<untrusted-content source="…">`, so the model treats fetched page and document text as data, not instructions.
 - **PDF resource limits**: extraction is bounded by download size, page count, and a timeout. Because the bundled PDF.js runs on the event loop rather than a worker, the timeout bounds extraction across its await points but cannot interrupt a fully synchronous parse — the size and page caps are the primary defence.
 
 ## Limitations
@@ -263,10 +274,6 @@ Commands:
 - Playwright routing covers HTTP(S) and WebSockets, not browser transports such as WebRTC; OS-level egress sandboxing remains outside this extension's scope.
 - `pdf_extract` reads only an existing text layer; scanned documents need OCR, which is out of scope.
 
-### Popups and navigation
-
-Same-tab client navigation and popups are checked against the live `web_browser` permissions. Unapproved document requests are aborted before reaching the target; blocked popups are closed without becoming active, while a blocked same-tab navigation returns to the prior approved page. Approved popups become active only after their main-frame navigation commits.
-
 ## Development
 
 Requires Node >= 22.19 (tests run TypeScript directly via `node --test`).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@underactive/pi-topping-web-tools",
-	"version": "0.2.6",
+	"version": "0.2.8",
 	"description": "Pi extensions for the web: fetch_markdown (URL to markdown, cached, keyless), pdf_extract (PDF text extraction) and web_browser (headless Playwright automation), sharing a preapproved-host allowlist.",
 	"keywords": ["pi-package", "pi-extension"],
 	"license": "MIT",
@@ -53,9 +53,9 @@
 		"typebox": "*"
 	},
 	"devDependencies": {
-		"@earendil-works/pi-ai": "1.0.0",
-		"@earendil-works/pi-coding-agent": "1.0.0",
-		"@earendil-works/pi-tui": "1.0.0",
+		"@earendil-works/pi-ai": "1.1.0",
+		"@earendil-works/pi-coding-agent": "1.1.0",
+		"@earendil-works/pi-tui": "1.1.0",
 		"@types/node": "^24.0.0",
 		"@types/turndown": "^5.0.5",
 		"typebox": "^1.3.3",

package/src/fetch-markdown.ts

@@ -513,7 +513,7 @@ To complete your request, I need to fetch content from the redirected URL. Pleas
 
 		const offset = Math.max(0, Math.floor(params.offset ?? 0));
 		const slice = sliceContent(response.content, offset);
-		const sanitizedText = slice.text.replaceAll("</untrusted-content", "");
+		const sanitizedText = slice.text.replaceAll(/<\/(untrusted-content)/gi, "<\\/$1");
 		const safeUrl = params.url.replaceAll('"', "%22");
 		const wrappedText = `<untrusted-content url="${safeUrl}">\n${sanitizedText}\n</untrusted-content>`;
 

package/src/pdf-extract.ts

@@ -3,13 +3,13 @@
 import { defineTool, formatSize, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { LRUCache } from "lru-cache";
-import { basename, isAbsolute, relative, resolve } from "node:path";
+import { basename, resolve } from "node:path";
 import { readFile, realpath, stat } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { Type } from "typebox";
 import { extractText, getDocumentProxy } from "unpdf";
 import { combineSignals } from "./abort-utils.ts";
-import { isPreapprovedHost, permissionKey } from "./permissions.ts";
+import { isInsideCwd, isPreapprovedHost, permissionKey } from "./permissions.ts";
 import { requestHostPermission } from "./permission-prompt.ts";
 import { BoundedPreview, clipField, resultText } from "./render-preview.ts";
 import { getWithPermittedRedirects, isPermittedRedirect, sliceContent, validateURL } from "./fetch-markdown.ts";
@@ -110,11 +110,6 @@ export function parsePageRange(spec: string, totalPages: number): number[] {
 	return [...selected].sort((a, b) => a - b);
 }
 
-export function isInsideCwd(resolvedPath: string): boolean {
-	const rel = relative(process.cwd(), resolvedPath);
-	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
-
 type LocalPdfTarget = {
 	path: string;
 	mtimeMs: number;
@@ -369,7 +364,7 @@ Usage notes:
 
 		const offset = Math.max(0, Math.floor(params.offset ?? 0));
 		const slice = sliceContent(body, offset);
-		const sanitizedText = slice.text.replaceAll(/<\/untrusted-content/gi, "");
+		const sanitizedText = slice.text.replaceAll(/<\/(untrusted-content)/gi, "<\\/$1");
 		const safeSource = source.replaceAll('"', "%22");
 
 		return {

package/src/permissions.ts

@@ -6,6 +6,8 @@
  * hostname/path-prefix (matches the prefix and its descendants).
  */
 
+import { isAbsolute, relative } from "node:path";
+
 export const PREAPPROVED_HOSTS = new Set([
 	"platform.claude.com",
 	"code.claude.com",
@@ -115,6 +117,11 @@ const { HOSTNAME_ONLY, PATH_PREFIXES } = (() => {
 	return { HOSTNAME_ONLY: hosts, PATH_PREFIXES: paths };
 })();
 
+export function isInsideCwd(resolvedPath: string): boolean {
+	const rel = relative(process.cwd(), resolvedPath);
+	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+
 export function permissionKey(url: string): string {
 	try {
 		const parsed = new URL(url);

package/src/render-preview.ts

@@ -70,9 +70,10 @@ export class BoundedPreview implements Component {
 		const { theme } = options;
 		this.header = options.header;
 		this.cut = options.body.length > MAX_PREVIEW_CHARS;
-		// Slice the raw text before styling so the cap never cuts an escape sequence. Every logical
+		// Slice the text before styling so the cap never cuts an escape sequence. Every logical
 		// line takes at least one row, so one line past the cap is enough for the skip to register.
 		this.body = options.body
+			.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "")
 			.slice(0, MAX_PREVIEW_CHARS)
 			.split("\n", MAX_VISUAL_PREVIEW_LINES + 1)
 			.map((line) => theme.fg("dim", line))

package/src/web-browser/browser-manager.ts

@@ -866,7 +866,7 @@ export class BrowserManager {
 		const snippet = await this.pageSnippet(page);
 		const frameNote = frame ? ` within frame "${frame}"` : "";
 		const safeUrl = page.url().replaceAll('"', "%22");
-		return `No element matches selector "${selector}"${frameNote}. ${diagnostics}\nPage snippet:\n<untrusted-content url="${safeUrl}">\n${snippet.replaceAll("</untrusted-content", "")}\n</untrusted-content>`;
+		return `No element matches selector "${selector}"${frameNote}. ${diagnostics}\nPage snippet:\n<untrusted-content url="${safeUrl}">\n${snippet.replaceAll(/<\/(untrusted-content)/gi, "<\\/$1")}\n</untrusted-content>`;
 	}
 
 	private async ensureLaunched(): Promise<void> {

package/src/web-browser/index.ts

@@ -9,7 +9,6 @@ import {
 	DEFAULT_MAX_LINES,
 	formatSize,
 	truncateHead,
-	withFileMutationQueue,
 } from "@earendil-works/pi-coding-agent";
 import { StringEnum } from "@earendil-works/pi-ai";
 import { Text } from "@earendil-works/pi-tui";
@@ -25,7 +24,6 @@ import {
 	type NavigateResult,
 	type NetworkEntry,
 	type ScreenshotResult,
-	type SetCookieParam,
 	type TabInfo,
 } from "./browser-manager.ts";
 import { buildOriginChecker } from "./egress-policy.ts";
@@ -33,8 +31,7 @@ import { checkUrlPermission, upgradeHttpToHttps, validateURL } from "./permissio
 import { requestHostPermission } from "../permission-prompt.ts";
 import { BoundedPreview, clipField, resultText } from "../render-preview.ts";
 import { listGrants } from "../permission-store.ts";
-import { permissionKey } from "../permissions.ts";
-import { isInsideCwd } from "../pdf-extract.ts";
+import { isInsideCwd, permissionKey } from "../permissions.ts";
 import { suppressNotifications } from "../env.ts";
 import { publishBrowserState, registerBrowserFeeds } from "./feeds.ts";
 
@@ -135,9 +132,11 @@ function formatTabs(tabs: TabInfo[]): string {
 		.join("\n");
 }
 
+const sanitizeTitle = (title: string) => clipField(title.replace(/[\u0000-\u001f\u007f]/g, " "));
+
 function wrapUntrustedContent(url: string, text: string): string {
 	const safeUrl = url.replaceAll('"', "%22");
-	const safeText = text.replaceAll(/<\/untrusted-content/gi, "");
+	const safeText = text.replaceAll(/<\/(untrusted-content)/gi, "<\\/$1");
 	return `<untrusted-content url="${safeUrl}">\n${safeText}\n</untrusted-content>`;
 }
 
@@ -157,6 +156,13 @@ async function resolveLocalFilePath(input: string): Promise<string> {
 	}
 }
 
+async function writeTempFile(name: string, data: string | Buffer): Promise<string> {
+	const tempDir = await mkdtemp(join(tmpdir(), "pi-web-browser-"));
+	const tempFile = join(tempDir, name);
+	await writeFile(tempFile, data, { mode: 0o600 });
+	return tempFile;
+}
+
 async function truncateTextResult(
 	text: string,
 	details: WebBrowserDetails,
@@ -170,12 +176,7 @@ async function truncateTextResult(
 	const outDetails = { ...details, bytes: truncation.totalBytes };
 
 	if (truncation.truncated) {
-		const tempDir = await mkdtemp(join(tmpdir(), "pi-web-browser-"));
-		const tempFile = join(tempDir, "output.txt");
-		await withFileMutationQueue(tempFile, async () => {
-			await writeFile(tempFile, text, "utf-8");
-		});
-
+		const tempFile = await writeTempFile("output.txt", text);
 		outDetails.fullOutputPath = tempFile;
 
 		const truncatedLines = truncation.totalLines - truncation.outputLines;
@@ -190,16 +191,6 @@ async function truncateTextResult(
 	return { text: resultText, details: outDetails };
 }
 
-async function saveScreenshotToTempFile(shot: ScreenshotResult): Promise<string> {
-	const tempDir = await mkdtemp(join(tmpdir(), "pi-web-browser-"));
-	const tempFile = join(tempDir, "screenshot.png");
-	const buf = Buffer.from(shot.data, "base64");
-	await withFileMutationQueue(tempFile, async () => {
-		await writeFile(tempFile, buf);
-	});
-	return tempFile;
-}
-
 function browserStatus(ctx: ExtensionContext, text: string, tone: "success" | "muted"): string {
 	return ctx.ui.theme.fg(tone, `browser: ${text}`);
 }
@@ -293,7 +284,7 @@ export default function (pi: ExtensionAPI) {
 				"Web Browser:",
 				`  Status: ${info.isOpen ? "open" : "closed"}`,
 				`  URL: ${info.url ? clipField(info.url) : "(none)"}`,
-				`  Title: ${info.title ? clipField(info.title.replace(/[\u0000-\u001f\u007f]/g, " ")) : "(none)"}`,
+				`  Title: ${info.title ? sanitizeTitle(info.title) : "(none)"}`,
 				`  Tabs open: ${info.tabCount}`,
 				`  Console messages: ${info.consoleCount}`,
 				`  Network issues: ${info.networkCount}`,
@@ -325,7 +316,7 @@ export default function (pi: ExtensionAPI) {
 			}
 
 			const shot = await browser.screenshot({ fullPage: true });
-			const tempFile = await saveScreenshotToTempFile(shot);
+			const tempFile = await writeTempFile("screenshot.png", Buffer.from(shot.data, "base64"));
 			const dims = `${shot.width}×${shot.height}`;
 			ctx.ui.notify(`Screenshot saved to: ${tempFile}\nDimensions: ${dims} (full page)`, "info");
 		},
@@ -343,7 +334,7 @@ export default function (pi: ExtensionAPI) {
 			"Use get_content only when DOM structure or attributes are needed; it returns raw HTML.",
 			"On SPA sites, use wait_for after navigate (selector/state or networkidle) before click/type.",
 			"Use screenshot for visual verification (requires a vision-capable model); use toFile=true to save PNG to disk instead of base64.",
-			"Image content is not visible to a codemode script: a script receives only a tool result's text blocks, so a screenshot taken from one returns its caption without the pixels. Call screenshot directly, or with toFile=true to get a file path the script can read.",
+			"Image content is not visible to a codemode script for tools without an output schema, such as web_browser. For a screenshot, call web_browser with action screenshot and toFile=true; its result starts with 'Screenshot saved to: <path>'. On pi 1.0.4+, pass that path to tools.read({ path }), then pass its image block to image(); on earlier hosts, call screenshot directly instead of from a script.",
 			"Use get_console_logs when JavaScript errors or console output may explain page behavior.",
 			"Use get_network_logs when failed, egress-blocked, or 4xx/5xx requests may explain page behavior. Navigate directly to a blocked origin to request approval.",
 			"Use set_cookies to inject cookies for authenticated flows after manual login.",
@@ -475,7 +466,7 @@ export default function (pi: ExtensionAPI) {
 		annotations: { readOnlyHint: false, openWorldHint: true },
 
 		async execute(_toolCallId, params, signal, onUpdate, ctx) {
-			const action = params.action as WebBrowserAction;
+			const action = params.action;
 			const timeout = params.timeout;
 
 			onUpdate?.({ content: [{ type: "text", text: `${action}…` }], details: { action } });
@@ -513,13 +504,14 @@ export default function (pi: ExtensionAPI) {
 						const result: NavigateResult = await mgr.navigate(upgraded, { timeout, signal });
 						syncBrowserOpen(ctx, result.url);
 
-						const text = `Navigated to ${result.url}\nTitle: ${result.title}${result.statusCode ? `\nStatus: ${result.statusCode}` : ""}`;
+						const title = sanitizeTitle(result.title);
+						const text = `Navigated to ${result.url}${result.statusCode ? `\nStatus: ${result.statusCode}` : ""}\n${wrapUntrustedContent(result.url, `Title: ${title}`)}`;
 						return {
 							content: [{ type: "text", text }],
 							details: {
 								action,
 								url: result.url,
-								title: result.title,
+								title,
 								// A same-document navigation has no response; omit the key rather than storing undefined.
 								...(result.statusCode !== undefined ? { statusCode: result.statusCode } : {}),
 								bytes: Buffer.byteLength(text),
@@ -541,14 +533,14 @@ export default function (pi: ExtensionAPI) {
 						const dimsNote = `${dims}${shot.fullPage ? " (full page)" : ""}`;
 
 						if (params.toFile) {
-							const tempFile = await saveScreenshotToTempFile(shot);
+							const tempFile = await writeTempFile("screenshot.png", Buffer.from(shot.data, "base64"));
 							const text = `Screenshot saved to: ${tempFile}\nDimensions: ${dimsNote}`;
 							return {
 								content: [{ type: "text", text }],
 								details: {
 									action,
 									url: info.url,
-									title: info.title,
+									title: sanitizeTitle(info.title),
 									screenshotDims: dims,
 									fullOutputPath: tempFile,
 								} satisfies WebBrowserDetails,
@@ -570,7 +562,7 @@ export default function (pi: ExtensionAPI) {
 							details: {
 								action,
 								url: info.url,
-								title: info.title,
+								title: sanitizeTitle(info.title),
 								screenshotDims: dims,
 							} satisfies WebBrowserDetails,
 						};
@@ -603,7 +595,7 @@ export default function (pi: ExtensionAPI) {
 						const msg = await mgr.fill(params.selector, params.text, {
 							timeout,
 							signal,
-							mode: params.mode as "fill" | "press" | undefined,
+							mode: params.mode,
 							frame: params.frame,
 						});
 						return {
@@ -734,7 +726,7 @@ export default function (pi: ExtensionAPI) {
 						}
 						const msg = await mgr.waitFor({
 							selector: params.selector,
-							state: params.state as "visible" | "hidden" | "attached" | "detached" | undefined,
+							state: params.state,
 							networkidle: params.networkidle,
 							timeout,
 							signal,
@@ -829,7 +821,7 @@ export default function (pi: ExtensionAPI) {
 								};
 							}
 						}
-						await mgr.setCookies(params.cookies as SetCookieParam[], { signal });
+						await mgr.setCookies(params.cookies, { signal });
 						const text = `Set ${params.cookies.length} cookie(s).`;
 						return {
 							content: [{ type: "text", text }],
@@ -936,7 +928,7 @@ export default function (pi: ExtensionAPI) {
 					}
 
 					case "set_dialog_behavior": {
-						const dialogAction = (params.dialogAction as "accept" | "dismiss" | undefined) ?? "dismiss";
+						const dialogAction = params.dialogAction ?? "dismiss";
 						mgr.setDialogBehavior(dialogAction, params.promptText);
 						const text = `Dialogs will be ${dialogAction}ed${params.promptText ? ` (prompt text: "${params.promptText}")` : ""}.`;
 						return {
@@ -962,8 +954,9 @@ export default function (pi: ExtensionAPI) {
 					case "list_tabs": {
 						const tabs = await mgr.listTabs();
 						const text = formatTabs(tabs);
+						const info = await mgr.getPageInfoAsync();
 						return {
-							content: [{ type: "text", text }],
+							content: [{ type: "text", text: wrapUntrustedContent(info.url, text) }],
 							details: {
 								action,
 								tabCount: tabs.length,
@@ -1044,7 +1037,7 @@ export default function (pi: ExtensionAPI) {
 			}
 
 			if (details.error) {
-				return new Text(theme.fg("error", clipField(details.error)), 0, 0);
+				return new Text(theme.fg("error", clipField(details.error.replace(/[\u0000-\u001f\u007f]/g, " "))), 0, 0);
 			}
 
 			const imageBlock = result.content.find((c) => c.type === "image");
@@ -1069,7 +1062,7 @@ export default function (pi: ExtensionAPI) {
 						"success",
 						`Navigated — ${
 							details.title
-								? clipField(details.title.replace(/[\u0000-\u001f\u007f]/g, " "))
+								? sanitizeTitle(details.title)
 								: clipField(details.url ?? "ok")
 						}`,
 					);