browser-pilot-cli 0.3.0 → 0.4.0

package/docs/architecture/browser-pilot-platform-spec.md

@@ -181,9 +181,14 @@ Chrome Profile contexts; those are not separate BrowserInstances.
 One live regular browser context inside a BrowserInstance. Its public
 `profileContextId` is opaque and scoped to the current browser connection
 generation; the raw CDP browser-context ID is internal. A ProfileContext has a
-connection-scoped neutral label, optional verified display metadata, bounded
+connection-scoped neutral label, structured identity status and optional
+verified Profile/account metadata, bounded
 representative tabs, and current tab counts. Passive discovery never opens a
-tab to infer its display name. Reconnect invalidates every ProfileContext ID.
+tab to infer Profile or account identity. Protocol 1.3 identity is an explicit visible
+operation: it reads Chrome's reported Profile path, verifies it against the
+BrowserInstance user-data root, then maps bounded Local State metadata to
+structured Profile/account fields. Reconnect invalidates every ProfileContext
+ID and cached identity.
 
 ### BrowserWorkspace
 
@@ -304,6 +309,14 @@ certificate exists, otherwise records unsigned state. Linux records unsigned
 state. Build or release automation must fail on incomplete credentials and
 must never describe an artifact as signed when signing did not run.
 
+The supported native matrix is `darwin-arm64`, `linux-x64`, and `win32-x64`;
+Intel Mac is not supported. Each release also publishes a versioned Agent
+plugin/skill archive and checksum. A deterministic release index binds those
+assets to the npm package version, exact compatible skill/CLI version, and
+runtime protocol range. GitHub Release publication waits for successful npm
+publication so consumers cannot observe a nominal release with only one half
+of that distribution contract.
+
 ### Broker Locator and Startup
 
 The executable, not an embedding Host, resolves the per-user Broker endpoint.
@@ -350,16 +363,21 @@ compatibility Workspace and Lease, then explicitly requests the browser
 connection. Other browser commands require that connection and never trigger
 authorization implicitly.
 Existing and future eligible user tabs are available immediately. The command
-returns the existing JSON shape during migration. Failures include a stable
-machine code in addition to compatible human guidance. One-shot processes use
-a fixed daemon-internal Connection, idempotently keyed Workspace, and renewable
-Lease with a maximum five-minute TTL. Normal process exit leaves that transient
+returns the existing JSON shape during migration. Every non-TTY failure,
+including command parsing and local argument validation, includes a stable
+machine code and `retryable` flag in addition to compatible human guidance.
+One-shot processes
+derive a stable Connection identity from `BROWSER_PILOT_CLIENT_KEY` or
+`--client-key`, then use an idempotently keyed Workspace and renewable Lease
+with a maximum five-minute TTL. Independent Agents use distinct stable keys;
+the default key preserves single-Agent compatibility. Normal process exit leaves that transient
 daemon-memory state available to the next command; expiry invalidates refs and
 releases target control. No target, frame, session, Observation, ref, auth, or
 network mapping is persisted to disk. `bp disconnect` explicitly releases the
 compatibility Workspace and closes only its managed targets. It stops the
-daemon only when called by the matching executable installation and no live
-embedded Connection remains; otherwise it returns `protocol_incompatible` or
+daemon only when called by the matching executable installation and no other
+active Lease or embedded Connection remains; otherwise it returns
+`protocol_incompatible` or
 `broker_in_use` without replacing or terminating the Broker. JavaScript dialogs
 remain pending and are handled explicitly with `bp dialogs` and `bp dialog`;
 Workspace isolation prevents access to other clients' dialogs.
@@ -416,15 +434,17 @@ to ManagedTabSets.
 `browser.tabs.list` inventories eligible tabs from every Profile context exposed
 by the selected BrowserInstance. Existing targets are immediately controllable
 and carry an opaque `profileContextId`. New managed work resolves a Profile from
-an explicit context, the current active target, the Workspace selection, or a
+an explicit context, the current Lease-selected target, the Workspace selection, or a
 single available context, in that order. Multiple contexts without an anchor
 return `profile_selection_required` before creating a target. The Agent host
 asks the user which Profile to use; Browser Pilot does not add an approval UI.
 
 `browser.profiles.list` is passive and returns bounded, connection-scoped
-summaries. `browser.profiles.select` updates only the owning Workspace. A Chrome
+summaries. Protocol 1.3 `browser.profiles.identify` explicitly creates and
+cleans temporary visible identity targets when account-aware identity is
+needed. `browser.profiles.select` updates only the owning Workspace. A Chrome
 reconnect invalidates old ProfileContext IDs and requires relisting and
-reselection. Selection clears only the Lease's logical active-target anchor; it
+reselection. Selection clears only the Lease's logical selected-target anchor; it
 does not release control, activate a tab, or change Chrome focus. The exact
 creation and compatibility algorithm is frozen in `docs/plans/profile-context-routing.md`.
 
@@ -485,6 +505,11 @@ creation. Protocol 1.0/1.1 clients retain existing-target control and automatic
 single-context behavior, but an ambiguous multi-context open fails rather than
 silently selecting a Profile.
 
+Protocol 1.3 adds explicit verified Profile/account identity. Browser candidate
+results use `userDataRoot`, Profile results use structured identity status and
+fields, and tab inventory uses `selected` for the Lease-local target instead of
+the ambiguous `active`. Protocol 1.2 retains its legacy field vocabulary.
+
 ### Tool Contract
 
 `tools/list` is the canonical machine-readable manifest. Every tool declares:
@@ -579,8 +604,10 @@ Artifacts. Raw CDP is never listed. `eval` requires `developer.eval`.
   opaque target ID. The Broker retires its target session and scoped state
   before a different Lease can acquire control with that Lease's own opaque ID.
   No handoff call accepts a foreign Lease or target ID.
-- **BR-7:** The Pilot window visibly identifies the controlling client without
-  injecting mutable content into the page DOM.
+- **BR-7:** Browser Pilot returns controlling-client identity in scoped
+  protocol results and events so a Host may present it in Host-owned UI. With no
+  extension, Browser Pilot does not claim it can modify Chrome's browser chrome,
+  and it never injects status borders, labels, or controls into page DOM.
 - **BR-21:** Exposing the CLI or bridge to an Agent is the product-level
   browser-control authorization boundary. Chrome's own remote-debugging
   authorization is requested only by explicit `bp connect`/`browser.connect`.
@@ -599,7 +626,9 @@ Artifacts. Raw CDP is never listed. `eval` requires `developer.eval`.
   chain rooted in the same ManagedTabSet.
 - **BR-26:** `tabs.list` returns eligible current and future tabs, tagging each
   with origin and ManagedTabSet membership. Browser Pilot internal targets,
-  DevTools, and unsupported browser-internal targets remain excluded.
+  DevTools, extension-owned pages, and unsupported browser-internal targets
+  remain excluded. Excluded extension pages do not create or represent a
+  ProfileContext.
 - **BR-27:** Bulk cleanup and `close --all` default to the ManagedTabSet. No
   bulk operation closes user tabs outside it. Each user tab requires an
   explicit target-specific close command.
@@ -607,9 +636,11 @@ Artifacts. Raw CDP is never listed. `eval` requires `developer.eval`.
   not only `Target.getBrowserContexts`. Public ProfileContext IDs never expose
   raw CDP identifiers and are invalid after browser reconnect.
 - **BR-30:** Profile listing is passive. It cannot create, attach, activate, or
-  navigate a target solely to infer a Profile name. Unverified names are
-  omitted instead of guessed.
-- **BR-31:** New-target Profile routing follows explicit context, active target,
+  navigate a target solely to infer a Profile name. Identity requires the
+  explicit protocol 1.3 operation, exact Profile-path verification, bounded
+  metadata reads, and verified cleanup. Unverified names are omitted instead
+  of guessed.
+- **BR-31:** New-target Profile routing follows explicit context, selected target,
   Workspace selection, then single available context. Multiple unanchored
   contexts fail with `profile_selection_required` before browser dispatch.
 - **BR-32:** Every ManagedTabSet is bound to at most one ProfileContext. Managed
@@ -917,7 +948,7 @@ fields, never on message text.
   `BROWSER_PILOT_HOME`; Browser Pilot never creates a hidden version namespace.
 - Broker shutdown is compare-and-stop: it requires the current Broker process
   identity and matching executable installation identity, and refuses while
-  any embedded Connection remains live.
+  any embedded Connection or active Lease remains live.
 - Additive tool and field changes use capability negotiation and schema
   evolution. Breaking semantics require a protocol-major change.
 - Unknown response fields are ignored; unknown request fields are rejected only
@@ -945,7 +976,7 @@ fields, never on message text.
 - **FR-3 Multi-client isolation:** Concurrent clients have isolated control and
   transient state.
   - **AC-3:** Two clients can operate separate Pilot windows concurrently, and
-    refs, active targets, frames, auth, rules, and close operations cannot cross
+    refs, selected targets, frames, auth, rules, and close operations cannot cross
     Workspace boundaries.
 - **FR-4 User-browser control:** An Agent can list and control all eligible
   current and future tabs in the selected BrowserInstance, including tabs the

package/docs/integration/stdio-bridge.md

@@ -17,6 +17,11 @@ Resolve an exact Browser Pilot executable version from one of these locations:
 2. A project-local npm dependency.
 3. A compatible global installation selected explicitly by the host.
 
+For release bundles, verify the versioned release index first. It binds the npm
+package, Agent plugin/skill compatible CLI range and tested version, protocol
+range, supported native assets, and adjacent SHA-256 files. Native releases support `darwin-arm64`,
+`linux-x64`, and `win32-x64`; Intel Mac is not supported.
+
 Launch it directly, without a shell:
 
 ```text
@@ -105,13 +110,13 @@ exception because a browser dialog can pause the command that caused it.
 `initialize` must be the first successful request on a bridge Connection:
 
 ```json
-{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"client":{"id":"com.example.agent","name":"Example Agent","version":"2.0.0","instanceId":"install:01J..."},"protocol":{"min":{"major":1,"minor":1},"max":{"major":1,"minor":2}},"requestedCapabilities":["browser.control","workspace.manage","observation.read","action.input","artifact.read","event.read"],"launchMode":"embedded","limits":{"maxMessageBytes":1048576,"maxResultBytes":4194304}}}
+{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"client":{"id":"com.example.agent","name":"Example Agent","version":"2.0.0","instanceId":"install:01J..."},"protocol":{"min":{"major":1,"minor":1},"max":{"major":1,"minor":3}},"requestedCapabilities":["browser.control","workspace.manage","observation.read","action.input","artifact.read","event.read"],"launchMode":"embedded","limits":{"maxMessageBytes":1048576,"maxResultBytes":4194304}}}
 ```
 
 The response returns the selected protocol, supported and granted
 capabilities, executable and service versions, a process-stable Broker
 identity, a Connection ID, browser candidates, and negotiated limits. Each
-candidate has a stable `id`, product/channel/profile identity, aggregate
+candidate has a stable `id`, product/channel and `userDataRoot`, aggregate
 `state`, separate `processState`, `remoteDebuggingState`, and
 `authorizationState`, plus structured `remediation` when action is needed.
 Initialization succeeds when no candidate is ready, so a host can present setup
@@ -133,6 +138,13 @@ tab inventory and new-target operations. Protocol 1.0/1.1 clients retain their
 existing tools; the Broker hides 1.2-only operations and rejects a manually
 constructed Profile call with `protocol_incompatible`.
 
+Protocol 1.3 adds the explicit `browser.profiles.identify` mutation and
+structured Profile identity fields. Browser discovery returns `userDataRoot`
+instead of the legacy candidate field `profile`, and tab inventory returns
+`selected` instead of `active`. `selected` means the target selected by this
+Lease; it does not describe Chrome foreground focus. Protocol 1.2 clients keep
+the old field vocabulary and do not see the identity tool.
+
 The initialize request and response use the service's fixed bootstrap limits.
 The bridge switches limits only after the successful response has been written,
 and waits for that switch before parsing a pipelined next line. Oversized
@@ -259,25 +271,36 @@ show another Chrome Allow dialog per Profile. `browser.tabs.list` returns every
 eligible managed and user-opened tab across those contexts, each with an opaque
 `profileContextId`. Existing tabs can be selected and controlled immediately;
 Profile selection is routing for new managed targets, not a permission grant.
+Browser-internal and extension-owned pages are excluded from ordinary tab and
+Profile representative inventory.
 
-Protocol 1.2 hosts should use this flow when creating independent work:
+Protocol 1.2+ hosts should use this flow when creating independent work:
 
 1. Call `browser.profiles.list`. It is passive and returns neutral labels,
    bounded representative tabs, counts, and the Workspace selection.
-2. If there is one Profile, `browser.open` can infer it. If there are several
+2. On protocol 1.3, if account-aware identity is needed, call
+   `browser.profiles.identify`. It briefly creates visible `chrome://version`
+   targets, verifies each reported path as an immediate child of the connected
+   `userDataRoot`, reads bounded Chrome Local State metadata, closes every
+   temporary target, and caches the result for one connection generation.
+   `refresh: true` explicitly re-probes.
+3. If there is one Profile, `browser.open` can infer it. If there are several
    and no current target or Workspace selection, ask the user which Profile to
    use.
-3. Call `browser.profiles.select` with the returned opaque ID, or pass that ID
+4. Call `browser.profiles.select` with the returned opaque ID, or pass that ID
    directly as `browser.open.arguments.profileContextId`.
-4. Treat IDs as scoped to the current browser connection generation. After
-   reconnect, relist Profiles, tabs, frames, and Observations.
-
-Profile names are included only when Browser Pilot has verified them without a
-visible discovery tab; otherwise hosts present the neutral label and
-representative page titles/URLs. Never expose or persist raw CDP context IDs.
-New-target routing uses an explicit call argument, the Lease's logical active
+5. Treat IDs and verified identity as scoped to the current browser connection
+   generation. After reconnect, relist Profiles, tabs, frames, and Observations.
+
+Profile results use `identityStatus: unidentified | verified | unavailable`.
+Only verified results may include `profileName`, `accountName`, `accountEmail`,
+and `profileDirectory`; unavailable results include a stable
+`identityErrorCode` rather than a guessed account. Current codes are
+`profile_path_unavailable`, `profile_path_unverified`,
+`local_state_unavailable`, and `profile_metadata_missing`. Never expose or persist raw
+CDP context IDs. New-target routing uses an explicit call argument, the Lease's logical selected
 target, the Workspace selection, or the only available context, in that order.
-`browser.profiles.select` clears only the logical active-target anchor so its
+`browser.profiles.select` clears only the logical selected-target anchor so its
 selection applies to the next new managed target; it does not release control,
 activate a user tab, or change Chrome focus.
 
@@ -598,7 +621,8 @@ The stdio `shutdown` method exits only that bridge and disconnects its Broker
 Connection. The human `bp disconnect` command separately releases the one-shot
 compatibility Workspace and requests daemon shutdown. The daemon accepts that
 request only when the Broker process identity and executable installation
-identity still match and `embeddedConnections` is zero. Otherwise it returns
+identity still match, `embeddedConnections` is zero, and no other active Lease
+remains. Otherwise it returns
 `protocol_incompatible` or retryable `broker_in_use`; it never evicts an Agent
 product to complete an upgrade.
 
@@ -626,9 +650,9 @@ pattern into their own integration and continue treating this document plus the
 runtime manifest as authoritative.
 
 The shared example launches an absolute executable path without a shell,
-negotiates protocol 1.1 through 1.2, discovers tools at runtime, and maps a host work scope
+negotiates protocol 1.1 through 1.3, discovers tools at runtime, and maps a host work scope
 to a Workspace plus its active invocation to a renewable Lease. It never stores
-an active tab, frame, Observation, ref, credential, rule, Artifact, or event
+a selected tab, frame, Observation, ref, credential, rule, Artifact, or event
 cursor on disk. Host tool-call IDs become Command and idempotency identities;
 transport loss after dispatch of a mutating operation is returned as
 non-retryable `unknown_outcome`.

package/docs/plans/profile-context-routing.md

@@ -1,7 +1,7 @@
 # Profile Context Routing Plan
 
 Status: **Complete**
-Target: Browser Pilot `v0.3.0`, protocol `1.2`
+Target: Browser Pilot `v0.4.0`, protocol `1.3`
 Source of truth: `docs/architecture/browser-pilot-platform-spec.md`
 
 ## Goal
@@ -53,7 +53,8 @@ It has:
 - an internal raw CDP browser-context ID, never exposed;
 - the owning BrowserInstance and connection generation;
 - a connection-scoped neutral label;
-- an optional verified display name and Profile directory;
+- connection-generation-scoped identity status plus optional verified Profile
+  name, account name/email, and Profile directory;
 - current total and eligible tab counts;
 - one or more bounded representative targets for routing and user recognition.
 
@@ -99,10 +100,31 @@ Protocol 1.2 adds:
 Profile summaries and representative eligible tabs. It never opens, navigates,
 attaches to, or focuses a target merely to discover a display name.
 
+## Protocol 1.3
+
+Protocol 1.3 adds `browser.profiles.identify` as an explicit, mutating identity
+operation. For each requested unidentified Profile it creates a temporary
+visible `chrome://version` target in that exact context, reads `#profile_path`,
+verifies that path as an immediate child of the connected browser's
+`userDataRoot`, reads bounded metadata from Chrome `Local State`, then detaches
+and proves the temporary target was closed. Failure to prove cleanup returns
+`unknown_outcome`; Browser Pilot never silently leaves an identity page behind.
+
+Results use `identityStatus: unidentified | verified | unavailable` plus
+optional `profileName`, `accountName`, `accountEmail`, `profileDirectory`, and a
+stable `identityErrorCode`. Identity is cached only for the current browser
+connection generation. `refresh: true` explicitly re-probes. No directory
+ordering, tab title, or raw context ID is treated as account identity.
+
+Protocol 1.3 also renames browser candidate `profile` to `userDataRoot` and tab
+inventory `active` to `selected`. The latter is the Lease's logical target, not
+Chrome foreground focus. Protocol 1.2 clients retain their legacy fields.
+
 `browser.profiles.select` accepts only a public `profileContextId`. Human CLI
-selectors such as index, neutral label, or verified display name are resolved
+selectors such as one-based index, neutral label, or verified Profile/account
+name or email are resolved
 client-side from a fresh list. The machine protocol never accepts an ambiguous
-free-form selector. Selecting a Profile clears the Lease's logical active-target
+free-form selector. Selecting a Profile clears the Lease's logical selected-target
 anchor without releasing control or changing Chrome focus, so the next new
 managed target uses that explicit Workspace selection.
 
@@ -112,7 +134,7 @@ When `browser.open` needs a new target, resolve exactly one Profile context in
 this order:
 
 1. an explicit, current-generation `profileContextId`;
-2. the current Lease's active target context;
+2. the current Lease's selected target context;
 3. the Workspace's current, valid selection;
 4. the only currently available Profile context;
 5. otherwise fail with `profile_selection_required` before browser dispatch.
@@ -161,13 +183,13 @@ candidate targets were closed.
 - Protocol 1.0/1.1 clients continue to list and control existing tabs.
 - In a single available context, their existing `browser.open` behavior remains
   automatic.
-- In multiple contexts, an active target remains an unambiguous anchor.
+- In multiple contexts, a selected target remains an unambiguous anchor.
 - With multiple contexts and no anchor, older clients receive a structured
   failure and Browser Pilot never silently chooses the first context.
 - New Profile fields on existing results are additive; raw CDP IDs remain
   private.
-- The current CLI negotiates protocol 1.2, while the Broker continues to accept
-  1.0 and 1.1.
+- The current CLI negotiates protocol 1.3, while the Broker continues to accept
+  1.0 through 1.2.
 
 ## Delivery
 
@@ -186,13 +208,16 @@ candidate targets were closed.
 - [x] All eligible user tabs across live Profile contexts appear in one inventory.
 - [x] Existing user tabs can be controlled without selecting a Profile first.
 - [x] No multi-context open silently selects a first Profile.
-- [x] Explicit, active-target, Workspace, and single-context resolution follow the
+- [x] Explicit, selected-target, Workspace, and single-context resolution follow the
   specified order.
 - [x] Every managed target and popup matches its ManagedTabSet Profile context.
 - [x] Two Workspaces may select different contexts and create targets concurrently
   without cross-routing.
 - [x] Reconnect invalidates old Profile IDs, target mappings, frames, and refs.
 - [x] Passive listing creates no target and never focuses or navigates a user tab.
+- [x] Explicit identity verifies Profile paths, returns structured account-aware
+  fields, cleans temporary targets, caches only within one connection
+  generation, and never guesses unavailable metadata.
 - [x] Janitor EOF/SIGKILL cleanup closes fallback-created managed windows but never
   user tabs.
 - [x] Protocol 1.1 clients retain existing-tab control and cannot open ambiguously.

package/docs/plans/universal-agent-integration.md

@@ -93,9 +93,11 @@ Pilot. Tenon and OpenClaw are reference consumers only.
 - [x] **A2.3** Replace global target/frame/session state with Workspace and
   Lease state; provide a compatibility Workspace for one-shot CLI calls.
   - Covers: FR-1, FR-3, AC-1, AC-3.
-  - Complete: the CLI uses a fixed daemon-internal one-shot Connection plus
-    idempotently keyed compatibility Workspace and renewable five-minute Lease.
-    Every CLI command calls canonical tools; active targets, frames, sessions,
+  - Complete: the CLI derives a stable one-shot Connection identity from
+    `BROWSER_PILOT_CLIENT_KEY`/`--client-key`, plus an idempotently keyed
+    compatibility Workspace and renewable five-minute Lease. The default key
+    preserves single-Agent compatibility; distinct stable keys isolate Agents.
+    Every CLI command calls canonical tools; selected targets, frames, sessions,
     Observations, refs, auth, rules, and request identity remain only in daemon
     memory. No `state.json` or `refs.json` compatibility mapping remains.
 - [x] **A2.4** Serialize commands through a per-target actor and implement
@@ -272,7 +274,8 @@ Pilot. Tenon and OpenClaw are reference consumers only.
     version semantics. Health and schema-2 locator metadata expose the current
     service, executable installation identity, protocol range, and bounded live
     client counts. Protected compare-and-stop shutdown rejects mismatched
-    executables and returns `broker_in_use` while embedded Connections remain.
+    executables and returns `broker_in_use` while embedded Connections or any
+    active Lease remains.
     Owner-only version history retains only current/previous executable metadata
     and no transient browser state. `BROWSER_PILOT_HOME` provides explicit
     cross-platform isolation; incompatibility never triggers hidden replacement
@@ -290,7 +293,11 @@ Pilot. Tenon and OpenClaw are reference consumers only.
     platform archives; macOS Developer ID/notarization and Windows Authenticode
     hooks activate only with complete credentials, while unsigned/ad-hoc state
     remains explicit. Release CI uses fixed official Node 22.17.0 native runners
-    and verifies every artifact before publishing it.
+    and verifies every artifact before publishing it. The supported native
+    matrix is Apple Silicon macOS, x64 Linux, and x64 Windows; Intel Mac is not
+    supported. A versioned release index binds these assets to the npm package,
+    exact Agent plugin/skill version, protocol range, and checksums, and GitHub
+    Release publication waits for npm publication.
 
 ### A7. Agent-neutral integration kit
 
@@ -318,6 +325,12 @@ Pilot. Tenon and OpenClaw are reference consumers only.
 - [x] **A7.4** Update the Agent skill to teach direct one-shot use and embedded
   stdio use without assuming a particular Agent runtime.
   - Covers: FR-1, AC-1.
+  - Complete: the main skill is a bounded operating guide with progressive
+    command/stdio references, version-range CLI compatibility checking, stable
+    one-shot error recovery, explicit user-tab/Profile/tab-group boundaries,
+    local capture semantics, and generated Codex UI metadata. Release
+    verification and a machine-readable skill compatibility manifest prevent
+    silent CLI/skill version drift.
 
 ## Cross-Workstream Dependencies
 

package/docs/plans/v0.3.0-stabilization.md

@@ -1,7 +1,7 @@
 # Browser Pilot v0.3.0 Stabilization Plan
 
-Status: **In progress**
-Candidate baseline: `v0.3.0-rc.6`; release target: `v0.3.0`, protocol `1.2`
+Status: **Complete**
+Released baseline: `v0.3.0`, protocol `1.2`
 
 ## Goal
 
@@ -48,7 +48,11 @@ products depend on. No Agent-specific behavior enters Browser Pilot.
   Chrome Profiles: public GitHub reading, search, precise scrolling, screenshot
   annotation, PDF export, a disposable form with verified input and submission,
   and managed-only cleanup. User tabs and exported files were preserved.
-- [ ] Tag `v0.3.0`, publish npm `latest`, and verify upgrade/rollback metadata.
+- [x] Tag `v0.3.0`, publish a non-prerelease GitHub Release and npm
+  `latest=0.3.0`, and retain `next=0.3.0-rc.6` plus the local RC.6 standalone
+  as rollback paths. The installed stable executable connected through one
+  authorization request and repeated managed open/cleanup with
+  `closed: 1, remaining: 6`; all six user tabs remained available.
 
 ## Stable decision
 
@@ -64,4 +68,6 @@ RC.4 through RC.6 then closed the remaining real-browser gaps in passive
 connection status, text-targeted scroll verification, restrictive-CSP screenshot
 annotation, and asynchronous managed-target closure. The published RC.6
 standalone now satisfies every pre-stable source, distribution, Host, and live
-Chrome gate above. Stable publication remains a separate explicit release step.
+Chrome gate above. The identical stable runtime passed the complete source and
+distribution gates, published successfully on all three platforms, and passed
+the installed user-Chrome smoke check.

package/docs/releases/v0.2.0.md

@@ -0,0 +1,53 @@
+# Browser Pilot 0.2.0
+
+Browser Pilot 0.2.0 turns the original one-shot CLI into an Agent-neutral
+browser control platform while preserving direct `bp` commands and the user's
+real Chrome profile. It requires no browser extension.
+
+## Highlights
+
+- Adds a versioned `bridge --stdio` protocol for products embedding the
+  official executable, with runtime tool discovery and no required SDK or MCP
+  dependency.
+- Adds a shared per-user Broker with isolated Workspaces, Leases, targets,
+  refs, network rules, auth state, events, and Artifacts for concurrent Agents.
+- Lists and controls eligible user-opened tabs alongside Browser Pilot managed
+  tabs. Bulk cleanup and session release close only managed tabs.
+- Makes Chrome discovery passive. Only an explicit `bp connect` or
+  `browser.connect` may request browser authorization, and concurrent requests
+  share one in-flight connection attempt without timer-driven retries.
+- Replaces file-backed refs with ephemeral Observation-scoped identity across
+  browser generations, targets, frames, CDP sessions, loaders, and documents.
+- Fuses accessibility, DOM, and layout information; supports Shadow DOM,
+  same-process frames, and OOPIFs with bounded output and typed stale-ref
+  failures.
+- Adds verified click, input, keyboard, upload, scroll, and dropdown behavior,
+  including obstruction checks, controlled-input readback, and composite-action
+  cancellation when page state changes.
+- Adds bounded read, search, DOM metadata, page geometry, annotated screenshot,
+  PDF, download Artifact, dialog, network interception, cookie, and HTTP auth
+  support.
+- Adds typed browser events, disconnect/reconnect state, command idempotency,
+  deadlines, cancellation, unknown outcomes, event cursors, and protected
+  Artifact delivery.
+- Adds npm, local project, and self-contained macOS, Linux, and Windows launch
+  modes plus a language-neutral stdio conformance suite and reference Tenon and
+  OpenClaw adapters.
+
+## Upgrade Notes
+
+- Chrome remote debugging must be enabled at
+  `chrome://inspect/#remote-debugging`.
+- Browser authorization is explicit. Run `bp connect` once when Browser Pilot
+  reports that it is disconnected; ordinary discovery and bridge startup do
+  not prompt.
+- Direct CLI behavior remains supported. Embedded products should launch the
+  pinned executable with `bridge --stdio` and depend only on the documented
+  protocol.
+- Refs are intentionally transient. Obtain a fresh snapshot after navigation,
+  frame changes, reconnects, or `stale_ref` responses.
+
+See the [platform specification](https://github.com/relixiaobo/browser-pilot/blob/v0.2.0/docs/architecture/browser-pilot-platform-spec.md),
+[stdio integration contract](https://github.com/relixiaobo/browser-pilot/blob/v0.2.0/docs/integration/stdio-bridge.md),
+and [conformance suite](https://github.com/relixiaobo/browser-pilot/blob/v0.2.0/docs/integration/stdio-conformance.md)
+for the stable public contracts.

package/docs/releases/v0.2.1.md

@@ -0,0 +1,13 @@
+# Browser Pilot 0.2.1
+
+This packaging-only patch adds the canonical GitHub repository metadata
+required for npm Trusted Publishing provenance verification. Browser runtime,
+protocol, CLI, and Agent integration behavior are unchanged from 0.2.0.
+
+This is the first 0.2 stable version published through the package's GitHub
+Actions OIDC Trusted Publisher. The npm package requires no long-lived publish
+token, and its provenance identifies
+`https://github.com/relixiaobo/browser-pilot` as the source repository.
+
+See the [Browser Pilot 0.2.0 release](https://github.com/relixiaobo/browser-pilot/releases/tag/v0.2.0)
+for the complete feature and upgrade notes.

package/docs/releases/v0.2.2.md

@@ -0,0 +1,18 @@
+# Browser Pilot 0.2.2
+
+This patch fixes executable ownership validation when a CLI command encounters
+a compatible Broker started by another Browser Pilot installation.
+
+The CLI now checks the Broker's executable version and identity before it
+initializes its one-shot connection. A mismatched installation returns the
+structured `protocol_incompatible` error without creating or changing Broker
+session state. The executable that owns the Broker can therefore still shut it
+down cleanly, which makes in-place upgrades deterministic and avoids a failed
+command leaving the old Broker unusable.
+
+Health responses from older compatible Brokers that do not expose executable
+metadata remain supported. Current Brokers continue to enforce exact ownership
+for protected shutdown.
+
+Browser authorization, tab ownership, public protocol, and Agent integration
+behavior are otherwise unchanged from 0.2.1.

package/docs/releases/v0.4.0.md

@@ -0,0 +1,62 @@
+# Browser Pilot 0.4.0
+
+Browser Pilot 0.4.0 introduces protocol 1.3 while preserving protocol 1.0-1.2
+compatibility and the extension-free browser control model.
+
+## Profile identity
+
+- `browser.profiles.list` remains passive and returns neutral, connection-scoped
+  Profile contexts without opening or attaching to identity pages.
+- New `browser.profiles.identify` explicitly creates temporary visible
+  `chrome://version` targets, verifies the reported Profile path against the
+  connected browser `userDataRoot`, reads bounded Chrome Local State metadata,
+  and proves cleanup before returning.
+- Results distinguish `unidentified`, `verified`, and `unavailable`, with
+  structured Profile/account fields and stable failure codes. Identity is
+  cached only for one browser connection generation.
+- `bp profiles --identify [--refresh]` exposes the same behavior. Profile and
+  tab selectors are one-based and may use a uniquely verified Profile name,
+  account name, or email address.
+
+## Agent isolation and vocabulary
+
+- Direct one-shot CLI Agents can set a stable `BROWSER_PILOT_CLIENT_KEY` or
+  `--client-key`; different keys receive distinct Principal, Connection,
+  Workspace, and Lease state while repeated calls with one key reuse it.
+- `bp disconnect` releases only its CLI namespace and cannot stop a Broker that
+  still has another active Lease or embedded Connection.
+- Protocol 1.3 browser discovery uses `userDataRoot` instead of the ambiguous
+  legacy candidate field `profile`.
+- Protocol 1.3 tab inventory uses `selected` for the Lease-local target instead
+  of `active`, which could be mistaken for Chrome foreground focus.
+
+## Page and target isolation
+
+- Browser Pilot no longer injects a controller overlay or other status UI into
+  page DOM. Embedding Hosts may present returned controller identity in
+  Host-owned UI.
+- Chrome and Edge extension pages are excluded from ordinary tab inventory and
+  Profile context evidence.
+- Existing eligible user tabs remain fully controllable; managed-only cleanup
+  still leaves user tabs open.
+
+## Embedding
+
+- The Tenon/OpenClaw-neutral reference adapter negotiates protocol 1.3 and
+  discovers the identity operation through the canonical runtime manifest.
+- One-shot CLI, embedded stdio, local Artifact export, native image results,
+  and protocol 1.0-1.2 compatibility remain supported without a Native SDK,
+  MCP server, or browser extension.
+
+## CLI and distribution contract
+
+- Every non-TTY one-shot failure now includes stable `code` and `retryable`
+  fields. Commander/parser and local input errors use `invalid_argument`, while
+  Broker errors preserve their protocol code and structured remediation.
+- The versioned Agent plugin/skill records CLI `0.4.0` as its tested/minimum
+  version and accepts backward-compatible updates within the declared range. It
+  includes Codex UI metadata plus a machine-readable compatibility manifest.
+- GitHub releases publish the plugin archive and checksum alongside a release
+  index that verifies the npm version, protocol range, and every native asset.
+- Native targets are Apple Silicon macOS, x64 Linux, and x64 Windows. Intel Mac
+  is not supported and no `darwin-x64` asset is published.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-pilot-cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "CLI tool to control your browser via Chrome DevTools Protocol",
   "repository": "https://github.com/relixiaobo/browser-pilot",
   "type": "module",
@@ -14,6 +14,11 @@
     "build:standalone:js": "tsup --config tsup.standalone.config.ts",
     "build:standalone": "npm run build:standalone:js && node scripts/build-standalone.mjs",
     "package:standalone": "node scripts/package-standalone.mjs",
+    "package:agent-plugin": "node scripts/package-agent-plugin.mjs",
+    "package:release-index": "node scripts/build-release-index.mjs",
+    "release:sync-version": "node scripts/sync-release-version.mjs",
+    "release:check-version": "node scripts/sync-release-version.mjs --check",
+    "version": "node scripts/sync-release-version.mjs",
     "verify:standalone": "node scripts/verify-standalone.mjs",
     "dev": "tsup --watch",
     "start": "node dist/cli.js",
@@ -44,13 +49,7 @@
     "docs/plans/profile-context-routing.md",
     "docs/plans/v0.3.0-stabilization.md",
     "docs/plans/universal-agent-integration.md",
-    "docs/releases/v0.3.0-rc.1.md",
-    "docs/releases/v0.3.0-rc.2.md",
-    "docs/releases/v0.3.0-rc.3.md",
-    "docs/releases/v0.3.0-rc.4.md",
-    "docs/releases/v0.3.0-rc.5.md",
-    "docs/releases/v0.3.0-rc.6.md",
-    "docs/releases/v0.3.0.md",
+    "docs/releases/",
     "README.md",
     "LICENSE"
   ],