arcane-os 0.85.0 → 0.86.1

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.86.1
+
+- Include the existing public `arcane-os/ai/model-observation` export in
+  generated browser import maps. Both managed application maps and standalone
+  document maps resolve the same published browser module, including direct
+  installed-package URLs and nested documents.
+- Consumers adopt the published package and run their normal import-map
+  generation before rebuilding or serving their application. No manual map
+  edits, alternate imports or new native host build are required. The matching
+  Windows and Whisper runtime assets are unchanged from 0.86.0.
+
+## 0.86.0
+
+- Add fixed `Tab`, `Shift+Tab`, `Enter` and `Space` key operations to
+  `connectAppControl` and the public `arcane app-control key` command. Each
+  request sends an ordered press/release pair to the selected WebView's current
+  focus without desktop activation or global input. Preserve complete phase
+  outcomes, original errors and observation of a dispatched release after
+  cancellation or navigation; never replay an ambiguous action.
+- Add `resize` to the same client and CLI for a Normal window's native client
+  dimensions. Return actual previous and resulting dimensions plus the observed
+  CSS viewport; restoration is an explicit second request. Preserve window
+  state, position, profile, origin and zoom, and report minimized or maximized
+  state without changing it.
+- Include viewport, document focus and accessible open-shadow focus-path
+  observations in inspection. These are DOM/native observations, not proof of
+  an application action or completed asynchronous handler. The matching Windows
+  host asset is required for the new operations; existing consumer artifacts
+  must adopt the public package and rebuild through their owning workflow.
+
 ## 0.85.0
 
 - Add `createModelObservationService({runtime, localAI, image, decisions})`

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.85.0` SDK contract. Development applications declare
+This checkout defines the `0.86.1` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/browser-runtime/core/app-control.mjs

@@ -9,6 +9,9 @@
  * returned completely. Frame documents and unselected shadow-root contents stay
  * outside this scope. Closed shadow roots cannot be discovered or entered.
  * domRole/domName are DOM-derived hints, not an accessibility-tree computation.
+ * Document-level viewport/focus observations also describe the active open-shadow
+ * branch, independently of the selected inspection root. The native-only view
+ * operation reads that observation without collecting HTML/control roots.
  *
  * act({action,selector,shadowPath?,...}) requires one current CSS match in the
  * selected root. fill uses an exact
@@ -36,7 +39,10 @@ export function runAppControl(operation, params = {}) {
         if (operation === 'act') {
             return {ok: true, result: actOnElement()};
         }
-        fail('INVALID_ARGUMENT', 'Expected the inspect or act operation.');
+        if (operation === 'view') {
+            return {ok: true, result: readView()};
+        }
+        fail('INVALID_ARGUMENT', 'Expected the inspect, act, or view operation.');
     } catch (error) {
         return {
             ok: false,
@@ -66,6 +72,25 @@ export function runAppControl(operation, params = {}) {
         return Array.from(root.querySelectorAll(selector));
     }
 
+    // Native keys and resize need only this fixed observation, not a DOM scan.
+    function readView() {
+        const focusPath = [];
+        let element = document.activeElement;
+        while (element) {
+            focusPath.push(describeElement(element, null));
+            element = element.shadowRoot?.activeElement ?? null;
+        }
+        return {
+            viewport: {
+                width: globalThis.innerWidth,
+                height: globalThis.innerHeight,
+                devicePixelRatio: globalThis.devicePixelRatio
+            },
+            documentHasFocus: document.hasFocus(),
+            focusPath
+        };
+    }
+
     function selectedRoot() {
         const shadowPath = params.shadowPath === undefined ? [] : params.shadowPath;
         if (!Array.isArray(shadowPath)) {
@@ -156,6 +181,7 @@ export function runAppControl(operation, params = {}) {
             ...(isDocument ? {} : {shadowPath}),
             title: document.title,
             readyState: document.readyState,
+            ...readView(),
             doctype: document.doctype
                 ? new XMLSerializer().serializeToString(document.doctype)
                 : null,

package/docs/reference/README.md

@@ -70,6 +70,7 @@ alone does not make bare module names resolve in a browser.
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
+| Observe existing renderer and Core model state, progress and failures | [Existing model observation](model-observation.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
 | Select the complete SDXL Base 1.0 checkpoint for generation and whole-image editing | [SDXL Base 1.0 through Core](local-image-sdxl.md) |

package/docs/reference/cli.md

@@ -17,7 +17,10 @@ JSON to stderr and a nonzero exit. Capture writes its image to the explicit
 the general output-format parser below applies to the other commands.
 Inspection accepts either `--selector` or `--request <json-file>`; the latter
 reads the complete inspection object, including an explicit `shadowPath` through
-open shadow roots. Actions continue to use `--request` for their complete object.
+open shadow roots. Actions, fixed keys and Normal-window resizing use `--request`
+for their complete parameter object. Keys require the observed document
+generation; resize returns actual previous native client dimensions for an
+explicit restoration request.
 
 ## Command inventory
 
@@ -41,7 +44,7 @@ open shadow roots. Actions continue to use `--request` for their complete object
 | `arcane run` | Serves an existing browser release, or packages, plans, builds, and launches one paired native artifact. |
 | `arcane update-check` | Performs one explicit, read-only npm dist-tag query for the installed SDK version. |
 | `arcane targets` | Lists target ids, declared status, formats, architectures, signing profiles, methods, and pairing reason. |
-| `arcane app-control status\|inspect\|capture\|act` | Connects to an explicit running native window endpoint for document inspection, viewport capture or targeted DOM actions. |
+| `arcane app-control status\|inspect\|capture\|act\|key\|resize` | Connects to an explicit running native window endpoint for document inspection, viewport capture, targeted DOM actions, fixed keys or Normal-window client resizing. |
 | `arcane repo status\|pull\|push` | Runs one selected repository operation for the current app workspace. |
 | `arcane mail key set\|status\|delete` | Manages one server-only Resend API-key profile in `.arcane.env.json`. |
 | `arcane mail send` | Performs one explicit, idempotency-keyed Resend attempt from a complete JSON report on redirected stdin. |

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.83.1",
+  "sdkVersion": "0.86.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
@@ -63,10 +63,10 @@
       "entrypoints": ["arcane-os/core/app-control"],
       "primaryImport": "arcane-os/core/app-control",
       "group": "Native application control",
-      "summary": "Connects to one explicit running native window for background document inspection, viewport capture and targeted DOM actions.",
+      "summary": "Connects to one explicit running native window for background document inspection, viewport capture, targeted DOM actions, fixed keys and Normal-window client resizing.",
       "availability": "Node local IPC on Windows, Linux and macOS; the current window adapter is Windows WebView2, with other native adapters unavailable",
-      "protocol": "arcane/1 app.control.status, app.control.inspect, app.control.capture and app.control.act over the existing framed local connection. The window host selects native.launchContext.appControl.endpoint and preserves its existing Core child, origin, profile and lifetime.",
-      "normalization": "Returns endpoint, closed, status(options), inspect(parameters={},options), capture(parameters={},options), act(parameters,options), and close(). Parameters pass unchanged; per-operation options preserve Core signal/timeout behavior. Status reports actual app/window/document readiness. Inspect returns complete selected DOM HTML/text and live control state with DOM-derived role/name hints. Optional shadowPath on inspect and act is an ordered array of unique CSS host selectors through open shadow roots; selector resolves in the final root, with omitted/empty paths retaining top-level light DOM. Whole-shadow-root inspection returns complete innerHTML/textContent with null selector/state; nested shadow-host descriptors provide their full path. Frames remain descriptors and closed roots are unavailable. Capture returns mimeType image/png, complete base64 data, documentGeneration and URL for the rendered viewport. Act requires documentGeneration and one CSS selector with click, exact-string fill, exact-value select or absolute-offset scroll. The native document marker prevents queued actions crossing replacement; cancellation before dispatch prevents execution while dispatched work is observed through completion without retry or reversal. close() cancels only this connection, never the application or Core. No launch, automatic reconnect, desktop activation, global input or public arbitrary evaluator. CLI inspection accepts either --selector or a complete --request JSON object. See native-app-control.md for complete result fields, CLI and platform scope."
+      "protocol": "arcane/1 app.control.status, app.control.inspect, app.control.capture, app.control.act, app.control.key and app.control.resize over the existing framed local connection. The window host selects native.launchContext.appControl.endpoint and preserves its existing Core child, origin, profile and lifetime; assembly requires a matching published Windows host asset.",
+      "normalization": "Returns endpoint, closed, status(options), inspect(parameters={},options), capture(parameters={},options), act(parameters,options), key(parameters,options), resize(parameters,options), and close(). Parameters pass unchanged; per-operation options preserve Core signal/timeout behavior. Status reports actual app/window/document readiness. Inspect returns complete selected DOM HTML/text and live control state with DOM-derived role/name hints, plus top-level viewport CSS dimensions/devicePixelRatio, documentHasFocus and focusPath through the active open-shadow branch; focus records are observations with null selectors, separate from the selected root's activeElement. Optional shadowPath on inspect and act is an ordered array of unique CSS host selectors through open shadow roots; selector resolves in the final root, with omitted/empty paths retaining top-level light DOM. Whole-shadow-root inspection returns complete innerHTML/textContent with null selector/state; nested shadow-host descriptors provide their full path. Frames remain descriptors and closed roots are unavailable. Capture returns mimeType image/png, complete base64 data, documentGeneration and URL for the rendered viewport. Act requires documentGeneration and one CSS selector with click, exact-string fill, exact-value select or absolute-offset scroll. Key requires documentGeneration and Tab, Enter or Space; shiftKey:true is supported only for Tab. One keyboard owner keeps each press/release pair ordered at the selected WebView's current focus. An attempted press owns a matching release even after cancellation, navigation or failure; no failed or ambiguous press is replayed. Generation checks bracket native input without atomic document binding. Resize accepts positive integral native client width/height supported by WinForms and optional documentGeneration, changes only a Normal window's ClientSize, and returns immediate previous/actual native dimensions plus the later observed CSS viewport. Native and CSS snapshots are not atomic; platform constraints may change actual dimensions. Restoration is an explicit resize using the operation's previous native dimensions; unsupported window states fail before mutation. The native document marker prevents queued DOM actions crossing replacement; cancellation before dispatch prevents execution while dispatched work is observed through completion without retry or reversal, including owned key release. Partial results remain in actual errors and complete later responses remain in host diagnostics after cancellation or disconnection. Dispatch completion does not establish application handler completion or a successful business action. close() cancels only this connection, never the application or Core. No launch, automatic reconnect, desktop activation, global input or public arbitrary evaluator. CLI inspection accepts either --selector or a complete --request JSON object; act, key and resize forward their complete --request parameter objects. See native-app-control.md for complete result fields, CLI and platform scope."
     },
     {
       "id": "local-ai-execution-devices:createExecutionDeviceCatalog",

package/docs/reference/native-app-control.md

@@ -2,9 +2,9 @@
 
 `connectAppControl` from `arcane-os/core/app-control` connects to one explicitly
 selected running application window. The Windows WebView2 host provides document
-inspection, a PNG of its rendered viewport, and targeted DOM actions through its
-own local named pipe. The application keeps its existing Core child, profile,
-origin and window lifecycle. These operations do not activate the desktop window
+inspection, a PNG of its rendered viewport, targeted DOM actions, fixed keys and
+Normal-window client resizing through its own local named pipe. The application
+keeps its existing Core child, profile, origin and window lifecycle. These operations do not activate the desktop window
 or send global keyboard or pointer input.
 
 The Node client uses the SDK's existing `arcane/1` framing and local pipe/socket
@@ -77,29 +77,45 @@ connection or other business result.
 | `inspect(parameters={}, options?)` | Optional `shadowPath` selects an open shadow root. Optional CSS `selector` selects zero or more elements within the selected root; omission selects the whole root. Optional `documentGeneration` selects the expected document. Returns complete HTML/text, live control state and DOM-derived role/name hints. |
 | `capture(parameters={}, options?)` | Returns `{mimeType:'image/png', data, documentGeneration, url}`. `data` contains the complete base64 PNG. Optional `documentGeneration` selects the expected document. |
 | `act(parameters, options?)` | Requires `documentGeneration`, one unambiguous CSS `selector` within the root selected by optional `shadowPath`, and the action fields below. |
+| `key(parameters, options?)` | Requires `documentGeneration` and `key:'Tab'`, `'Enter'`, or `'Space'`. Optional `shiftKey:true` is supported only for Tab. Sends one ordered press/release pair to the selected WebView's current focus. |
+| `resize(parameters, options?)` | Requires positive integral native client `width` and `height` supported by WinForms. Optional `documentGeneration` selects the expected document. Resizes only a Normal window and returns immediate previous/actual client dimensions plus the subsequently observed CSS viewport. |
 | `close()` | Closes this caller's connection and cancels its pending requests. It never closes the app or Core. Returns the connection's completion promise. |
 | `closed` | Connection lifetime promise; actual transport failures remain observable. |
 | `endpoint` | The caller-selected local endpoint. |
 
 Each operation's separate `options` uses the existing Core client request
 contract, including `signal` and `timeoutMs`. Connection cancellation closes only
-that connection. Cancellation before UI dispatch prevents execution. Once a
-script or capture has been dispatched, cancellation cannot reverse its effects;
-the host still observes its completion. A disconnected caller's completed result
-is retained in the host diagnostics instead of being represented as delivered.
+that connection. Cancellation before UI dispatch prevents execution; keys also
+check cancellation after waiting for the keyboard owner and immediately before
+the press. Once a script, capture, key press or resize has been dispatched,
+cancellation cannot reverse its effects. The host observes its actual completion,
+including the owned key release. The caller receives its ordinary abort result;
+the complete later response is retained in host diagnostics for a cancelled
+request or closed connection instead of being represented as delivered.
 
 ## Document operations
 
 Inspection defaults to the top-level light DOM. Its result contains `scope`, `title`,
 `readyState`, `doctype`, `roots`, `controls`, `frames`, `shadowHosts`,
-`activeElement`, `scrollingElement`, `selection`, `documentGeneration`, and
-`url`. Each root retains its complete `html` and `text`; controls retain their
+`activeElement`, `scrollingElement`, `selection`, `viewport`, `documentHasFocus`,
+`focusPath`, `documentGeneration`, and `url`. Each root retains its complete
+`html` and `text`; controls retain their
 attributes and current form, selection, disabled, scrolling and related state.
 Generated CSS selectors are useful for the inspected document; a later DOM edit
 can change their meaning. Application-authored stable selectors are preferable
 when available. Component replacement or mutation can make a selector stale
 without changing the native document generation.
 
+`viewport` contains the top-level document's `innerWidth` and `innerHeight` as
+CSS-pixel `width`/`height`, plus its current `devicePixelRatio`.
+`documentHasFocus` records `document.hasFocus()`. `focusPath` describes the
+top-level active element followed by each active element in accessible open
+shadow roots along that focus branch. These records retain complete attributes,
+DOM-derived names and control state, with `selector:null`; they are observations,
+not selector targets. Reading a focused body or host's name can traverse its
+complete text subtree. The path stops at a frame element or closed shadow host;
+it does not enter frame documents or closed roots.
+
 ### Open shadow roots
 
 `inspect` and `act` accept `shadowPath`, an ordered array of CSS host selectors.
@@ -134,7 +150,10 @@ inspection; pair selectors from its result with that same path for actions.
 `activeElement` comes from the selected root. `scrollingElement` is `null` for a
 shadow-root scope because the root has no document scrolling element; scroll
 actions still target elements. `selection.text`, `title`, `readyState`, `doctype`
-and native URL/generation remain document-level information. Role/name label
+and native URL/generation remain document-level information. The added
+`viewport`, `documentHasFocus` and `focusPath` also always describe the top-level
+document: the focus path can enter open roots outside the selected inspection
+root. The selected root's `activeElement` remains separate. Role/name label
 references resolve within the element's own tree. Inspection follows the DOM
 tree, not the composed rendering tree: slot-assigned light-DOM nodes remain in
 their own containing DOM tree and are not duplicated inside the selected shadow
@@ -155,9 +174,10 @@ actual target state after dispatch, including disconnection by the action.
 
 Role/name hints are derived from DOM attributes and labels, not a native
 accessibility-tree computation. Frame documents and unselected shadow-root
-contents are outside the selected scope. Frame elements and open-shadow hosts
-are described; closed shadow roots cannot be discovered. Capture is the current rendered
-viewport, not an offscreen full-document rendering. Covered and minimized-window
+contents are outside the selected HTML/control scope; the document-level focus
+path separately describes its active open-shadow branch. Frame elements and
+open-shadow hosts are described; closed shadow roots cannot be discovered.
+Capture is the current rendered viewport, not an offscreen full-document rendering. Covered and minimized-window
 capture behavior requires execution evidence in the selected environment.
 
 | Action | Parameters and immediate behavior |
@@ -174,11 +194,101 @@ rewritten by the SDK.
 
 The host publishes a new generation when an actual replacement document becomes
 ready. A creation-time document marker is also checked inside the executing
-script so a queued action cannot run against a successor page. During navigation,
+script so a queued DOM action cannot run against a successor page. During navigation,
 operations report that the document is not ready. A change during completion
 reports the actual result with that failure; actions are never retried. These
 markers are transient document lifecycle state and are not written to saved data.
 
+## Fixed keys
+
+```js
+const page = await app.inspect();
+const moved = await app.key({documentGeneration: page.documentGeneration, key: 'Tab'});
+console.log(moved.previous.focusPath, moved.actual.focusPath);
+await app.key({documentGeneration: moved.documentGeneration, key: 'Tab', shiftKey: true});
+await app.key({documentGeneration: moved.documentGeneration, key: 'Enter'});
+```
+
+Keys use the selected WebView's current focus. No selector, shadow path, frame
+selection, focus assignment or desktop activation is performed. Tab and
+Shift+Tab use a fixed Tab `rawKeyDown`/`keyUp` pair, with the Shift modifier on
+both events for Shift+Tab. Enter and Space use `keyDown` with their corresponding
+text, followed by `keyUp`, preserving browser default actions and application
+`preventDefault` handling. Shift+Tab does not send a separate Shift key pair.
+The API exposes these fixed keys, not an arbitrary protocol method or script.
+
+The result contains `key`, `shiftKey`, `previous` and `actual` document views,
+`press`, `release`, `documentGeneration` and `url`. Each view contains the same
+`viewport`, `documentHasFocus` and `focusPath` described above. Each key phase
+records its fixed `parameters`, `attempted`, `completed`, and the complete
+protocol `response` when returned. Dispatch completion describes the native
+command, not application handler completion or a successful business action.
+Inspect the resulting page to establish the application outcome.
+
+Accepted key pairs share one keyboard owner so another key request cannot
+interleave between press and release. Other independent control operations keep
+their existing scheduling. The host awaits each native phase in order. Once
+the press is attempted, the host observes that task and attempts the matching
+release on the same WebView even after cancellation, navigation or press
+failure. Release can itself activate Space. A failed or ambiguous press is
+never replayed.
+
+Generation checks occur before dispatch and after completion; the native input
+command has no atomic document binding. Navigation or focus changes can occur
+between the checks and phases, and Tab intentionally changes focus before its
+release. A detected document change is reported with the actual attempted and
+completed phases. Dispatch, release or later observation failures retain the
+complete partial result at `error.data.find(entry => entry.key === 'result').value`
+under `ARCANE_APP_CONTROL_FAILED`. Original exceptions remain in `cause`; if
+both native phases fail, both errors are also retained in the aggregate and
+their respective phase records. An unavailable `actual` view is omitted rather
+than inferred.
+
+## Resize and restore a Normal window
+
+```js
+const resized = await app.resize({width: 1200, height: 800});
+try {
+    console.log(resized.previous, resized.actual, resized.viewport);
+    console.log(await app.inspect({selector: '#pm-content'}));
+} finally {
+    await app.resize({width: resized.previous.width, height: resized.previous.height});
+}
+```
+
+`width` and `height` select the native WinForms client dimensions, in the same
+units returned by `status().window`. They are not CSS viewport dimensions.
+The host changes only `ClientSize`; it does not assign window state, position,
+restore bounds, activation or WebView zoom, and it preserves the profile and
+origin. Read `viewport` for the resulting CSS dimensions instead of assuming a
+particular DPI or zoom conversion.
+
+Immediately before the UI-thread mutation, the host checks the actual
+`WindowState` and records `previous:{title,state,width,height}`. It records
+`actual` in the same shape immediately after the native setter, then observes
+the CSS `viewport` asynchronously. The result also contains `requested`,
+`resizeAttempted`, `resizeCompleted`, `documentGeneration` and `url`.
+Platform constraints may make actual dimensions differ from requested ones.
+Other input or concurrent resize requests can change the window between the
+native snapshot and the document observation; these records are not an atomic
+native/CSS snapshot. Completion does not establish that asynchronous application
+resize handlers have settled.
+
+Maximized or minimized windows return `ARCANE_APP_CONTROL_FAILED` before any
+size mutation, with `reason:'unsupported-window-state'`,
+`supportedWindowState:'Normal'` and the complete current `window` in the error's
+`data` entries. The host never automatically restores, maximizes or minimizes a
+window to satisfy this request. Invalid dimensions return `INVALID_ARGUMENT`.
+The same state rule applies to explicit restoration.
+
+Restore using the actual `previous.width` and `previous.height` from the
+operation being reversed, never a historical status snapshot or CSS viewport
+dimensions. Restoration is an explicit second request; cancellation does not
+resize the window back. If a dispatched resize or its later observation fails,
+the complete partial `result` remains in the error's `data`, including the
+recorded previous dimensions, actual dimensions and attempted/completed flags.
+Use that actual record when deciding whether and how to restore.
+
 ## CLI
 
 ```powershell
@@ -187,14 +297,20 @@ arcane app-control inspect --endpoint '\\.\pipe\arcane-pm-control' --selector '#
 arcane app-control inspect --endpoint '\\.\pipe\arcane-pm-control' --request '.arcane\inspection.json'
 arcane app-control capture --endpoint '\\.\pipe\arcane-pm-control' --output '.arcane\view.png'
 arcane app-control act --endpoint '\\.\pipe\arcane-pm-control' --request '.arcane\action.json'
+arcane app-control key --endpoint '\\.\pipe\arcane-pm-control' --request '.arcane\key.json'
+arcane app-control resize --endpoint '\\.\pipe\arcane-pm-control' --request '.arcane\resize.json'
 ```
 
-The action file is the complete action parameter object, including the actual
+The action or key file is the complete parameter object, including the actual
 `documentGeneration` returned by the preceding status or inspection. Inspection
 also accepts `--request` for a complete parameter object, such as
 `{"shadowPath":["#appearance-panel","theme-switcher"]}` or the same object with
 `selector` and `documentGeneration`. Inspection's `--request` and `--selector`
-options are mutually exclusive. The CLI reads the selected file completely.
+options are mutually exclusive. A key file can contain
+`{"documentGeneration":3,"key":"Tab","shiftKey":true}`, using the observed
+generation. A resize file contains native dimensions such as
+`{"width":1200,"height":800}`. Each requires `--request`; the CLI reads the
+selected file completely and forwards the parsed parameter object unchanged.
 Paths are relative to the current directory. Capture
 writes the PNG to the explicitly selected file and prints its metadata. The other
 operations print complete JSON. `app-control --help` describes this command's

package/docs/reference/sdk-api.md

@@ -9076,7 +9076,7 @@ connectAppControl({endpoint,signal,onError}={})
 ```
 
 Connects once to the explicit running native window and resolves
-`{endpoint,closed,status,inspect,capture,act,close}`. The Windows host selects its
+`{endpoint,closed,status,inspect,capture,act,key,resize,close}`. The Windows host selects its
 own listener through `native.launchContext.appControl.endpoint` and preserves the
 existing Core child, origin, profile and application lifetime. The client uses
 portable Node local IPC; other native host adapters do not yet implement these
@@ -9088,14 +9088,49 @@ and no automatic reconnect or action retry occurs.
 and live control state. Inspection and actions accept optional `shadowPath`, an
 ordered array of unique CSS host selectors through open shadow roots; their
 `selector` resolves inside the final root. Omission retains top-level light DOM.
-Closed roots remain unavailable. `capture(parameters={},options)` returns a full base64 PNG
+Closed roots remain unavailable. Inspection also returns top-level `viewport`
+CSS-pixel width/height and `devicePixelRatio`, `documentHasFocus`, and `focusPath`
+through the active open-shadow branch. These focus records have null selectors
+and remain separate from the selected root's `activeElement`; frames and closed
+roots end the path. `capture(parameters={},options)` returns a full base64 PNG
 of the rendered viewport. `act(parameters,options)` requires a returned
 `documentGeneration`, one CSS selector, and `click`, `fill`, `select` or `scroll`
-fields. Options preserve the Core client signal/timeout contract. `close()`
-cancels this connection's requests and returns `closed`, without closing the app.
-Document changes and actual errors remain observable; a dispatched action is
-not reversed by later cancellation. Full parameter/result, CLI and platform
-contracts are in [native application control](native-app-control.md).
+fields.
+
+`key(parameters,options)` requires the observed `documentGeneration` and
+`key:'Tab'`, `'Enter'` or `'Space'`; `shiftKey:true` is supported only for Tab.
+It sends a fixed ordered press/release pair to the selected WebView's current
+focus, without selecting an element or activating the desktop window. Accepted
+pairs share one keyboard owner. Once a press is attempted, its matching release
+is attempted on the same WebView even after cancellation, navigation or failure;
+a failed or ambiguous press is never replayed. Results retain previous/actual
+document views and complete attempted/completed phase records. Generation checks
+bracket native input rather than atomically binding it to a document, so focus
+or navigation can change between phases.
+
+`resize(parameters,options)` accepts positive integral native client `width`
+and `height` supported by WinForms, plus optional `documentGeneration`. It changes
+only `ClientSize` while the actual window is `Normal`; maximized or minimized
+windows fail before size mutation. Results retain immediate `previous`/`actual`
+native dimensions, requested dimensions, attempted/completed flags and a later
+observed CSS `viewport`. Platform constraints can change actual dimensions;
+native and CSS observations are not an atomic snapshot. Restore explicitly with
+the same operation's `previous.width` and `previous.height`, not CSS dimensions
+or a historical status snapshot. Cancellation does not restore the window.
+
+Options preserve the Core client signal/timeout contract. Cancellation before
+dispatch prevents execution; dispatched work and owned key release remain
+observed through completion. Actual errors retain complete partial results;
+responses completed after cancellation or disconnection remain in host
+diagnostics. `close()` cancels this connection's requests and returns `closed`,
+without closing the app. Document changes and actual errors remain observable.
+Dispatch completion does not establish application handler completion or a
+successful business action; inspect the resulting built application to establish
+that outcome. Assembly requires a matching published Windows host asset.
+
+The CLI provides `app-control key` and `app-control resize`, each forwarding the
+complete parsed `--request` object. Full parameter/result, error, cancellation,
+CLI and platform contracts are in [native application control](native-app-control.md).
 
 ## runSharedCoreHost()
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.85.0",
+  "version": "0.86.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/cli/app-control.mjs

@@ -8,6 +8,8 @@ const HELP_TEXT=`Usage:
   arcane app-control inspect --endpoint <pipe-or-socket> [--selector <css-selector> | --request <json-file>]
   arcane app-control capture --endpoint <pipe-or-socket> --output <png-file>
   arcane app-control act --endpoint <pipe-or-socket> --request <json-file>
+  arcane app-control key --endpoint <pipe-or-socket> --request <json-file>
+  arcane app-control resize --endpoint <pipe-or-socket> --request <json-file>
 
 Connects to the selected running native window. Results are complete JSON.
 Capture writes the PNG to --output and prints its metadata. Request and output
@@ -16,6 +18,9 @@ an application or change its profile. --output selects the capture filename;
 the other Arcane commands retain their existing output-format option.
 Inspect --request reads the complete parameter object, including shadowPath and
 optional documentGeneration. It cannot be combined with --selector.
+Key --request selects Tab (optionally shiftKey:true), Enter, or Space and the
+observed documentGeneration. Resize --request supplies native client width and
+height for a Normal window; its result includes the previous dimensions.
 `;
 
 function usage(message) {
@@ -29,9 +34,11 @@ function parseArguments(argv) {
         status: ['endpoint'],
         inspect: ['endpoint', 'selector', 'request'],
         capture: ['endpoint', 'output'],
-        act: ['endpoint', 'request']
+        act: ['endpoint', 'request'],
+        key: ['endpoint', 'request'],
+        resize: ['endpoint', 'request']
     }[action];
-    if (!Array.isArray(allowed)) usage('Expected app-control status, inspect, capture, or act.');
+    if (!Array.isArray(allowed)) usage('Expected app-control status, inspect, capture, act, key, or resize.');
     const values = {};
     for (let index = 1; index < argv.length; index += 1) {
         const argument = argv[index];
@@ -48,7 +55,9 @@ function parseArguments(argv) {
     }
     if (!values.endpoint) usage('App control requires --endpoint <pipe-or-socket>.');
     if (action === 'capture' && !values.output) usage('App-control capture requires --output <png-file>.');
-    if (action === 'act' && !values.request) usage('App-control act requires --request <json-file>.');
+    if (['act', 'key', 'resize'].includes(action) && !values.request) {
+        usage(`App-control ${action} requires --request <json-file>.`);
+    }
     if (action === 'inspect' && values.request !== undefined && values.selector !== undefined) {
         usage('App-control inspect accepts --selector or --request, not both.');
     }
@@ -83,6 +92,8 @@ export async function runAppControlCli(argv, {cwd = process.cwd(), stdout = proc
         if (selection.action === 'status') result = await connection.status({signal});
         else if (selection.action === 'inspect') result = await connection.inspect(parameters, {signal});
         else if (selection.action === 'act') result = await connection.act(parameters, {signal});
+        else if (selection.action === 'key') result = await connection.key(parameters, {signal});
+        else if (selection.action === 'resize') result = await connection.resize(parameters, {signal});
         else {
             result = await connection.capture(parameters, {signal});
             const output = path.resolve(cwd, selection.output);

package/src/core/app-control.mjs

@@ -18,6 +18,8 @@ export async function connectAppControl({endpoint, signal, onError = reportAppCo
         inspect(parameters = {}, options) { return client.invoke('app.control.inspect', parameters, options); },
         capture(parameters = {}, options) { return client.invoke('app.control.capture', parameters, options); },
         act(parameters, options) { return client.invoke('app.control.act', parameters, options); },
+        key(parameters, options) { return client.invoke('app.control.key', parameters, options); },
+        resize(parameters, options) { return client.invoke('app.control.resize', parameters, options); },
         close() { return connection.close(); }
     };
 }

package/src/core/hosts/windows/ArcaneAppControl.cs

@@ -453,7 +453,8 @@ namespace Arcane.Core.Hosts.Windows
                         {
                             cancellation.Token.ThrowIfCancellationRequested();
                             if (method != "app.control.status" && method != "app.control.inspect"
-                                && method != "app.control.capture" && method != "app.control.act")
+                                && method != "app.control.capture" && method != "app.control.act"
+                                && method != "app.control.key" && method != "app.control.resize")
                                 throw new NotSupportedException("The app does not expose " + method + ".");
                             Dictionary<string, object> arguments = parameters as Dictionary<string, object>;
                             if (arguments == null)

package/src/core/hosts/windows/ArcaneWindowControl.cs

@@ -1,8 +1,10 @@
 using System;
 using System.Collections.Generic;
+using System.Drawing;
 using System.IO;
 using System.Threading;
 using System.Threading.Tasks;
+using System.Windows.Forms;
 using Microsoft.Web.WebView2.Core;
 
 namespace Arcane.Core.Hosts.Windows
@@ -13,6 +15,7 @@ namespace Arcane.Core.Hosts.Windows
     {
         private const string AppControlDocumentKey = "Symbol.for('arcane-os.app-control.document')";
         private readonly HashSet<Task> appControlDocumentTasks = new HashSet<Task>();
+        private readonly SemaphoreSlim appControlKeyOwner = new SemaphoreSlim(1, 1);
         private ArcaneAppControl appControl;
         private Task appControlClosing;
         private string appControlScript;
@@ -59,6 +62,7 @@ namespace Arcane.Core.Hosts.Windows
             Task documents = Task.WhenAll(appControlDocumentTasks);
             try { await documents; }
             catch (Exception error) { ReportTaskFailure(documents, error); }
+            appControlKeyOwner.Dispose();
         }
 
         private void AppControlNavigationStarting(object sender, CoreWebView2NavigationStartingEventArgs args)
@@ -135,10 +139,17 @@ namespace Arcane.Core.Hosts.Windows
                 { "platform", "windows" }, { "host", "webview2" },
                 { "url", webView.Source == null ? null : webView.Source.AbsoluteUri },
                 { "documentGeneration", appControlGeneration }, { "ready", AppControlDocumentReady() },
-                { "window", new Dictionary<string, object>
-                    { { "title", Text }, { "state", WindowState.ToString() },
-                      { "width", ClientSize.Width }, { "height", ClientSize.Height } } },
-                { "operations", new string[] { "status", "inspect", "capture", "act" } }
+                { "window", AppControlWindow() },
+                { "operations", new string[] { "status", "inspect", "capture", "act", "key", "resize" } }
+            };
+        }
+
+        private Dictionary<string, object> AppControlWindow()
+        {
+            return new Dictionary<string, object>
+            {
+                { "title", Text }, { "state", WindowState.ToString() },
+                { "width", ClientSize.Width }, { "height", ClientSize.Height }
             };
         }
 
@@ -147,14 +158,16 @@ namespace Arcane.Core.Hosts.Windows
         {
             cancellation.ThrowIfCancellationRequested();
             if (method == "app.control.status") return AppControlStatus();
-            if (method != "app.control.inspect" && method != "app.control.capture" && method != "app.control.act")
+            if (method != "app.control.inspect" && method != "app.control.capture" && method != "app.control.act"
+                && method != "app.control.key" && method != "app.control.resize")
                 throw new ArgumentException("Unknown app-control method: " + method);
+            if (method == "app.control.resize") RequireAppControlNormalWindow();
             if (!AppControlDocumentReady()) throw new InvalidOperationException("The app document is not ready for control.");
             long selectedGeneration = appControlGeneration;
             string selectedDocument = appControlDocument;
             string selectedUrl = webView.Source == null ? null : webView.Source.AbsoluteUri;
             object expected;
-            if (method == "app.control.act" && !parameters.ContainsKey("documentGeneration"))
+            if ((method == "app.control.act" || method == "app.control.key") && !parameters.ContainsKey("documentGeneration"))
                 throw new ArgumentException("An action requires the documentGeneration returned by status or inspect.");
             if (parameters.TryGetValue("documentGeneration", out expected)
                 && (!(expected is int || expected is long || expected is decimal || expected is double)
@@ -173,34 +186,14 @@ namespace Arcane.Core.Hosts.Windows
                     };
                 }
             }
+            else if (method == "app.control.key")
+                result = await AppControlKeyAsync(parameters, cancellation, selectedGeneration, selectedDocument);
+            else if (method == "app.control.resize")
+                result = await AppControlResizeAsync(parameters, selectedGeneration, selectedDocument);
             else
             {
                 string operation = method == "app.control.inspect" ? "inspect" : "act";
-                // The creation marker is checked inside the executing document.
-                // Native generation checks alone cannot stop a queued script
-                // from reaching a successor document during navigation.
-                string script = "(function(expected,operation,parameters){"
-                    + "if(globalThis[" + AppControlDocumentKey + "]!==expected)"
-                    + "return {ok:false,error:{code:'APP_CONTROL_DOCUMENT_REPLACED',message:'The selected app document has been replaced.'}};"
-                    + "return (" + options.AppControlSource + ")(operation,parameters);})("
-                    + ArcaneHost.Serializer().Serialize(selectedDocument) + ","
-                    + ArcaneHost.Serializer().Serialize(operation) + ","
-                    + ArcaneHost.Serializer().Serialize(parameters) + ")";
-                string json = await webView.CoreWebView2.ExecuteScriptAsync(script);
-                Dictionary<string, object> envelope = ArcaneHost.Serializer().DeserializeObject(json) as Dictionary<string, object>;
-                object ok;
-                if (envelope == null || !envelope.TryGetValue("ok", out ok) || !(ok is bool))
-                    throw new InvalidDataException("The document returned no app-control result.");
-                if (!(bool)ok)
-                {
-                    object detail;
-                    envelope.TryGetValue("error", out detail);
-                    IOException error = new IOException("The document app-control operation failed.");
-                    error.Data["documentError"] = detail;
-                    throw error;
-                }
-                if (!envelope.TryGetValue("result", out result))
-                    throw new InvalidDataException("The document omitted the app-control result.");
+                result = await ReadAppControlDocumentAsync(operation, parameters, selectedDocument);
             }
             // Completion is observed after dispatch even if a caller cancelled.
             // A document change is reported with the actual returned result; it
@@ -220,6 +213,198 @@ namespace Arcane.Core.Hosts.Windows
             return record;
         }
 
+        private async Task<Dictionary<string, object>> ReadAppControlDocumentAsync(string operation,
+            Dictionary<string, object> parameters, string selectedDocument)
+        {
+            // The creation marker is checked inside the executing document.
+            // Native generation checks alone cannot stop a queued script
+            // from reaching a successor document during navigation.
+            string script = "(function(expected,operation,parameters){"
+                + "if(globalThis[" + AppControlDocumentKey + "]!==expected)"
+                + "return {ok:false,error:{code:'APP_CONTROL_DOCUMENT_REPLACED',message:'The selected app document has been replaced.'}};"
+                + "return (" + options.AppControlSource + ")(operation,parameters);})("
+                + ArcaneHost.Serializer().Serialize(selectedDocument) + ","
+                + ArcaneHost.Serializer().Serialize(operation) + ","
+                + ArcaneHost.Serializer().Serialize(parameters) + ")";
+            string json = await webView.CoreWebView2.ExecuteScriptAsync(script);
+            Dictionary<string, object> envelope = ArcaneHost.Serializer().DeserializeObject(json) as Dictionary<string, object>;
+            object ok;
+            if (envelope == null || !envelope.TryGetValue("ok", out ok) || !(ok is bool))
+                throw new InvalidDataException("The document returned no app-control result.");
+            if (!(bool)ok)
+            {
+                object detail;
+                envelope.TryGetValue("error", out detail);
+                IOException error = new IOException("The document app-control operation failed.");
+                error.Data["documentError"] = detail;
+                throw error;
+            }
+            object result;
+            if (!envelope.TryGetValue("result", out result))
+                throw new InvalidDataException("The document omitted the app-control result.");
+            Dictionary<string, object> record = result as Dictionary<string, object>;
+            if (record == null) throw new InvalidDataException("The app-control result must be an object.");
+            return record;
+        }
+
+        private async Task<object> AppControlKeyAsync(Dictionary<string, object> parameters,
+            CancellationToken cancellation, long selectedGeneration, string selectedDocument)
+        {
+            object value;
+            string key = parameters.TryGetValue("key", out value) ? value as string : null;
+            if (key != "Tab" && key != "Enter" && key != "Space")
+                throw new ArgumentException("key must be Tab, Enter, or Space.");
+            bool shiftKey = false;
+            if (parameters.TryGetValue("shiftKey", out value))
+            {
+                if (!(value is bool)) throw new ArgumentException("shiftKey must be a boolean.");
+                shiftKey = (bool)value;
+            }
+            if (shiftKey && key != "Tab") throw new ArgumentException("shiftKey is supported only with Tab.");
+            Dictionary<string, object> down = new Dictionary<string, object>
+            {
+                { "type", key == "Tab" ? "rawKeyDown" : "keyDown" },
+                { "key", key == "Space" ? " " : key }, { "code", key },
+                { "windowsVirtualKeyCode", key == "Tab" ? 9 : key == "Enter" ? 13 : 32 },
+                { "modifiers", shiftKey ? 8 : 0 }
+            };
+            Dictionary<string, object> up = new Dictionary<string, object>(down);
+            up["type"] = "keyUp";
+            if (key != "Tab")
+            {
+                down["text"] = key == "Enter" ? "\r" : " ";
+                down["unmodifiedText"] = down["text"];
+            }
+            Dictionary<string, object> press = new Dictionary<string, object>
+                { { "parameters", down }, { "attempted", false }, { "completed", false } };
+            Dictionary<string, object> release = new Dictionary<string, object>
+                { { "parameters", up }, { "attempted", false }, { "completed", false } };
+            Dictionary<string, object> result = new Dictionary<string, object>
+            {
+                { "key", key }, { "shiftKey", shiftKey }, { "press", press }, { "release", release },
+                { "documentGeneration", selectedGeneration },
+                { "url", webView.Source == null ? null : webView.Source.AbsoluteUri }
+            };
+            // Only keyboard pairs share this owner: an awaited down must not
+            // allow another accepted key to interleave before its owned up.
+            await appControlKeyOwner.WaitAsync(cancellation);
+            try
+            {
+                cancellation.ThrowIfCancellationRequested();
+                RequireAppControlDocument(selectedGeneration, selectedDocument);
+                result["previous"] = await ReadAppControlDocumentAsync("view", new Dictionary<string, object>(), selectedDocument);
+                cancellation.ThrowIfCancellationRequested();
+                RequireAppControlDocument(selectedGeneration, selectedDocument);
+                CoreWebView2 browser = webView.CoreWebView2;
+                string downJson = ArcaneHost.Serializer().Serialize(down);
+                string upJson = ArcaneHost.Serializer().Serialize(up);
+                Exception pressError = null;
+                Exception releaseError = null;
+                press["attempted"] = true;
+                try
+                {
+                    press["response"] = await browser.CallDevToolsProtocolMethodAsync("Input.dispatchKeyEvent", downJson);
+                    press["completed"] = true;
+                }
+                catch (Exception error) { pressError = error; }
+                // C# 5 cannot await in finally. This unconditional phase follows
+                // the observed down task, including failure/cancellation/navigation.
+                // Release can itself activate Space; it cannot undo the press.
+                release["attempted"] = true;
+                try
+                {
+                    release["response"] = await browser.CallDevToolsProtocolMethodAsync("Input.dispatchKeyEvent", upJson);
+                    release["completed"] = true;
+                }
+                catch (Exception error) { releaseError = error; }
+                try
+                {
+                    if (pressError != null) press["error"] = ArcaneHost.ErrorRecord(pressError, "ARCANE_APP_CONTROL_FAILED");
+                    if (releaseError != null) release["error"] = ArcaneHost.ErrorRecord(releaseError, "ARCANE_APP_CONTROL_FAILED");
+                    if (pressError != null && releaseError != null)
+                        throw new AggregateException("The key press and release failed.", pressError, releaseError);
+                    if (pressError != null) throw new IOException("The key press failed.", pressError);
+                    if (releaseError != null) throw new IOException("The key release failed.", releaseError);
+                    RequireAppControlDocument(selectedGeneration, selectedDocument);
+                    result["actual"] = await ReadAppControlDocumentAsync("view", new Dictionary<string, object>(), selectedDocument);
+                    return result;
+                }
+                catch (Exception error)
+                {
+                    throw AppControlOutcomeError("The app key operation did not complete normally.", error, result);
+                }
+            }
+            finally { appControlKeyOwner.Release(); }
+        }
+
+        private void RequireAppControlDocument(long selectedGeneration, string selectedDocument)
+        {
+            if (!AppControlDocumentReady() || appControlGeneration != selectedGeneration || appControlDocument != selectedDocument)
+                throw new InvalidOperationException("The selected app document has been replaced or is no longer ready.");
+        }
+
+        private void RequireAppControlNormalWindow()
+        {
+            if (WindowState == FormWindowState.Normal) return;
+            InvalidOperationException error = new InvalidOperationException("App-control resize requires a Normal window.");
+            error.Data["reason"] = "unsupported-window-state";
+            error.Data["supportedWindowState"] = "Normal";
+            error.Data["window"] = AppControlWindow();
+            throw error;
+        }
+
+        private static int AppControlDimension(Dictionary<string, object> parameters, string name)
+        {
+            object value;
+            if (!parameters.TryGetValue(name, out value)
+                || !(value is int || value is long || value is decimal || value is double))
+                throw new ArgumentException(name + " must be a positive integral native client dimension.");
+            double dimension = Convert.ToDouble(value);
+            if (Double.IsNaN(dimension) || dimension < 1 || dimension > Int32.MaxValue || dimension != Math.Truncate(dimension)
+                || (value is decimal && (decimal)value != Decimal.Truncate((decimal)value)))
+                throw new ArgumentException(name + " must be a positive integral native client dimension.");
+            return (int)dimension;
+        }
+
+        private async Task<object> AppControlResizeAsync(Dictionary<string, object> parameters,
+            long selectedGeneration, string selectedDocument)
+        {
+            int width = AppControlDimension(parameters, "width");
+            int height = AppControlDimension(parameters, "height");
+            // This check and immediate previous snapshot run in the same UI turn
+            // as the setter. Never normalize a maximized/minimized window.
+            RequireAppControlNormalWindow();
+            Dictionary<string, object> result = new Dictionary<string, object>
+            {
+                { "requested", new Dictionary<string, object> { { "width", width }, { "height", height } } },
+                { "previous", AppControlWindow() }, { "resizeAttempted", false }, { "resizeCompleted", false },
+                { "documentGeneration", selectedGeneration },
+                { "url", webView.Source == null ? null : webView.Source.AbsoluteUri }
+            };
+            try
+            {
+                result["resizeAttempted"] = true;
+                ClientSize = new Size(width, height);
+                result["resizeCompleted"] = true;
+                result["actual"] = AppControlWindow();
+                Dictionary<string, object> view = await ReadAppControlDocumentAsync("view", new Dictionary<string, object>(), selectedDocument);
+                result["viewport"] = view["viewport"];
+                return result;
+            }
+            catch (Exception error)
+            {
+                if (!result.ContainsKey("actual")) result["actual"] = AppControlWindow();
+                throw AppControlOutcomeError("The app resize operation did not complete normally.", error, result);
+            }
+        }
+
+        private static IOException AppControlOutcomeError(string message, Exception cause, Dictionary<string, object> result)
+        {
+            IOException error = new IOException(message, cause);
+            error.Data["result"] = result;
+            return error;
+        }
+
         private sealed class AppControlRequest
         {
             private readonly ArcaneHostForm window;

package/src/import-map.mjs

@@ -53,6 +53,7 @@ const SDK_BROWSER_SELF_IMPORTS=new Map([
     ['arcane-os/ai/core-onnx','sdk/ai/core-onnx.mjs'],
     ['arcane-os/ai/core-image','sdk/ai/core-image.mjs'],
     ['arcane-os/ai/core-model-assets','sdk/ai/core-model-assets.mjs'],
+    ['arcane-os/ai/model-observation','sdk/ai/model-observation.mjs'],
     ['arcane-os/ai/browser-decisions','sdk/ai/browser-decisions.mjs'],
     ['arcane-os/ai/tool-text-stream','sdk/ai/tool-text-stream.mjs'],
     ['arcane-os/ai/twin-cloud','sdk/ai/twin-cloud.mjs'],