browser-use 0.6.0 → 0.7.0

package/dist/controller/service.js

@@ -13,8 +13,18 @@ import { createLogger } from '../logging-config.js';
 import { sanitize_surrogates } from '../utils.js';
 import { findUnsupportedJsonSchemaKeyword, normalizeStructuredDataBySchema, } from '../tools/extraction/schema-utils.js';
 import { getClickDescription } from '../tools/utils.js';
+import { isActionTimeoutError, runActionWithTimeout, } from './action-timeout.js';
 const DEFAULT_WAIT_OFFSET = 1;
 const MAX_WAIT_SECONDS = 30;
+const chmodPrivateFile = async (filePath) => {
+    if (process.platform !== 'win32') {
+        await fsp.chmod(filePath, 0o600);
+    }
+};
+const writePrivateBinaryFile = async (filePath, data) => {
+    await fsp.writeFile(filePath, data, { mode: 0o600 });
+    await chmodPrivateFile(filePath);
+};
 const toActionEntries = (action) => {
     if (!action) {
         return [];
@@ -81,6 +91,20 @@ const dispatchBrowserEventIfAvailable = async (browser_session, event, fallback)
     }
     return fallback();
 };
+const validateBrowserPageAfterAction = async (browser_session, page, signal = null) => {
+    if (typeof browser_session?.validate_page_after_action === 'function') {
+        await browser_session.validate_page_after_action(page, signal);
+        return;
+    }
+    const assertUrlAllowed = browser_session?._assert_page_url_allowed_or_rollback;
+    if (typeof assertUrlAllowed === 'function' && page) {
+        await assertUrlAllowed.call(browser_session, page);
+    }
+    const syncCurrentTab = browser_session?._syncCurrentTabFromPage;
+    if (typeof syncCurrentTab === 'function') {
+        await syncCurrentTab.call(browser_session, page);
+    }
+};
 const runWithTimeoutAndSignal = async (operation, timeoutMs, signal, timeoutMessage = 'Operation timed out') => {
     throwIfAborted(signal);
     if (timeoutMs <= 0) {
@@ -412,11 +436,17 @@ export class Controller {
                 if (!page?.mouse?.click) {
                     throw new BrowserError('Unable to perform coordinate click on the current page.');
                 }
+                await validateBrowserPageAfterAction(browser_session, page, signal);
                 const [actualX, actualY] = convertLlmCoordinatesToViewport(params.coordinate_x, params.coordinate_y, browser_session);
-                await dispatchBrowserEventIfAvailable(browser_session, new ClickCoordinateEvent({
-                    coordinate_x: actualX,
-                    coordinate_y: actualY,
-                }), () => page.mouse.click(actualX, actualY));
+                try {
+                    await dispatchBrowserEventIfAvailable(browser_session, new ClickCoordinateEvent({
+                        coordinate_x: actualX,
+                        coordinate_y: actualY,
+                    }), () => page.mouse.click(actualX, actualY));
+                }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page, signal);
+                }
                 const coordinateMessage = `🖱️ Clicked at coordinates (${params.coordinate_x}, ${params.coordinate_y})` +
                     (await detectNewTabNote(tabsBefore));
                 return new ActionResult({
@@ -621,20 +651,39 @@ export class Controller {
                 allowedPaths.add(downloadedPath);
             }
             if (!allowedPaths.has(uploadPath)) {
-                const fsInstance = file_system ?? null;
-                const managedFile = fsInstance && typeof fsInstance.get_file === 'function'
-                    ? fsInstance.get_file(uploadPath)
-                    : null;
-                if (managedFile && fsInstance?.get_dir) {
-                    uploadPath = path.join(fsInstance.get_dir(), uploadPath);
-                }
-                else if (!isLocalBrowser) {
+                if (!isLocalBrowser) {
                     // Remote browser paths may only exist on the remote runtime.
                 }
                 else {
-                    return new ActionResult({
-                        error: `File path ${params.path} is not available. To fix: add this file path to available_file_paths when creating the Agent.`,
-                    });
+                    const fsInstance = file_system ?? null;
+                    const managedFile = fsInstance && typeof fsInstance.get_file === 'function'
+                        ? fsInstance.get_file(uploadPath)
+                        : null;
+                    if (managedFile && fsInstance?.get_dir) {
+                        const fsDir = fsInstance.get_dir();
+                        const managedFileName = String(managedFile.fullName ??
+                            managedFile.full_name ??
+                            path.basename(uploadPath));
+                        const candidatePath = path.join(fsDir, managedFileName);
+                        const realDir = fs.realpathSync(fsDir);
+                        const realPath = fs.existsSync(candidatePath)
+                            ? fs.realpathSync(candidatePath)
+                            : path.resolve(candidatePath);
+                        const relativePath = path.relative(realDir, realPath);
+                        if (relativePath === '..' ||
+                            relativePath.startsWith(`..${path.sep}`) ||
+                            path.isAbsolute(relativePath)) {
+                            return new ActionResult({
+                                error: `Upload of ${params.path} escapes FileSystem directory; refusing.`,
+                            });
+                        }
+                        uploadPath = candidatePath;
+                    }
+                    else {
+                        return new ActionResult({
+                            error: `File path ${params.path} is not available. To fix: add this file path to available_file_paths when creating the Agent.`,
+                        });
+                    }
                 }
             }
             if (isLocalBrowser) {
@@ -666,7 +715,14 @@ export class Controller {
                 try {
                     const page = await browser_session.get_current_page?.();
                     if (page?.evaluate) {
-                        const evaluated = await page.evaluate(() => window.scrollY || window.pageYOffset || 0);
+                        await validateBrowserPageAfterAction(browser_session, page, signal);
+                        let evaluated;
+                        try {
+                            evaluated = await page.evaluate(() => window.scrollY || window.pageYOffset || 0);
+                        }
+                        finally {
+                            await validateBrowserPageAfterAction(browser_session, page, signal);
+                        }
                         const numeric = typeof evaluated === 'number' ? evaluated : Number(evaluated);
                         if (Number.isFinite(numeric)) {
                             currentScrollY = numeric;
@@ -877,7 +933,7 @@ export class Controller {
         const extractStructuredDescription = "LLM extracts structured data from page markdown. Use when: on right page, know what to extract, haven't called before on same page+query. Can't get interactive elements. Set extract_links=True for URLs. Use start_from_char if previous extraction was truncated to extract data further down the page. When paginating across pages, pass already_collected with item identifiers (names/URLs) from prior pages to avoid duplicates.";
         this.registry.action(extractStructuredDescription, {
             param_model: ExtractStructuredDataActionSchema,
-        })(async function extract_structured_data(params, { page, page_extraction_llm, extraction_schema, file_system, signal }) {
+        })(async function extract_structured_data(params, { browser_session, page, page_extraction_llm, extraction_schema, file_system, signal, }) {
             throwIfAborted(signal);
             if (!page) {
                 throw new BrowserError('No active page available for extraction.');
@@ -886,9 +942,15 @@ export class Controller {
                 throw new BrowserError('page_extraction_llm is not configured.');
             }
             const fsInstance = file_system ?? new FileSystem(process.cwd(), false);
+            await validateBrowserPageAfterAction(browser_session, page, signal);
             const pageHtml = await runWithTimeoutAndSignal(async () => {
-                const value = await page.content?.();
-                return typeof value === 'string' ? value : '';
+                try {
+                    const value = await page.content?.();
+                    return typeof value === 'string' ? value : '';
+                }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page, signal);
+                }
             }, 10000, signal, 'Page content extraction timed out');
             if (!pageHtml) {
                 throw new BrowserError('Unable to extract page content.');
@@ -1168,72 +1230,79 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!page?.evaluate) {
                 throw new BrowserError('No active page for search_page.');
             }
-            const searchResult = (await page.evaluate(({ pattern, regex, caseSensitive, contextChars, cssScope, maxResults, }) => {
-                const sourceNode = cssScope
-                    ? document.querySelector(cssScope)
-                    : document.body;
-                if (!sourceNode) {
-                    return {
-                        error: `CSS scope not found: ${cssScope}`,
-                        matches: [],
-                        total: 0,
-                    };
-                }
-                const sourceText = sourceNode.innerText ||
-                    sourceNode.textContent ||
-                    '';
-                if (!sourceText.trim()) {
-                    return {
-                        matches: [],
-                        total: 0,
-                    };
-                }
-                const safePattern = regex
-                    ? pattern
-                    : pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                const flags = caseSensitive ? 'g' : 'gi';
-                let matcher;
-                try {
-                    matcher = new RegExp(safePattern, flags);
-                }
-                catch (error) {
-                    return {
-                        error: `Invalid regex pattern: ${String(error)}`,
-                        matches: [],
-                        total: 0,
-                    };
-                }
-                const matches = [];
-                let foundTotal = 0;
-                let m;
-                while ((m = matcher.exec(sourceText)) !== null) {
-                    foundTotal += 1;
-                    if (matches.length < Math.max(1, maxResults)) {
-                        const start = Math.max(0, m.index - Math.max(0, contextChars));
-                        const end = Math.min(sourceText.length, m.index + m[0].length + Math.max(0, contextChars));
-                        matches.push({
-                            position: m.index,
-                            match: m[0],
-                            snippet: sourceText.slice(start, end),
-                        });
+            let searchResult = null;
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                searchResult = (await page.evaluate(({ pattern, regex, caseSensitive, contextChars, cssScope, maxResults, }) => {
+                    const sourceNode = cssScope
+                        ? document.querySelector(cssScope)
+                        : document.body;
+                    if (!sourceNode) {
+                        return {
+                            error: `CSS scope not found: ${cssScope}`,
+                            matches: [],
+                            total: 0,
+                        };
                     }
-                    if (m[0].length === 0) {
-                        matcher.lastIndex += 1;
+                    const sourceText = sourceNode.innerText ||
+                        sourceNode.textContent ||
+                        '';
+                    if (!sourceText.trim()) {
+                        return {
+                            matches: [],
+                            total: 0,
+                        };
                     }
-                }
-                return {
-                    matches,
-                    total: foundTotal,
-                    truncated: foundTotal > matches.length,
-                };
-            }, {
-                pattern: params.pattern,
-                regex: params.regex,
-                caseSensitive: params.case_sensitive,
-                contextChars: params.context_chars,
-                cssScope: params.css_scope ?? null,
-                maxResults: params.max_results,
-            }));
+                    const safePattern = regex
+                        ? pattern
+                        : pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                    const flags = caseSensitive ? 'g' : 'gi';
+                    let matcher;
+                    try {
+                        matcher = new RegExp(safePattern, flags);
+                    }
+                    catch (error) {
+                        return {
+                            error: `Invalid regex pattern: ${String(error)}`,
+                            matches: [],
+                            total: 0,
+                        };
+                    }
+                    const matches = [];
+                    let foundTotal = 0;
+                    let m;
+                    while ((m = matcher.exec(sourceText)) !== null) {
+                        foundTotal += 1;
+                        if (matches.length < Math.max(1, maxResults)) {
+                            const start = Math.max(0, m.index - Math.max(0, contextChars));
+                            const end = Math.min(sourceText.length, m.index + m[0].length + Math.max(0, contextChars));
+                            matches.push({
+                                position: m.index,
+                                match: m[0],
+                                snippet: sourceText.slice(start, end),
+                            });
+                        }
+                        if (m[0].length === 0) {
+                            matcher.lastIndex += 1;
+                        }
+                    }
+                    return {
+                        matches,
+                        total: foundTotal,
+                        truncated: foundTotal > matches.length,
+                    };
+                }, {
+                    pattern: params.pattern,
+                    regex: params.regex,
+                    caseSensitive: params.case_sensitive,
+                    contextChars: params.context_chars,
+                    cssScope: params.css_scope ?? null,
+                    maxResults: params.max_results,
+                }));
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
             if (!searchResult) {
                 return new ActionResult({ error: 'search_page returned no result' });
             }
@@ -1276,49 +1345,56 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!page?.evaluate) {
                 throw new BrowserError('No active page for find_elements.');
             }
-            const result = (await page.evaluate(({ selector, attributes, maxResults, includeText, }) => {
-                let elements;
-                try {
-                    elements = Array.from(document.querySelectorAll(selector));
-                }
-                catch (error) {
-                    return {
-                        error: `Invalid selector: ${String(error)}`,
-                        elements: [],
-                        total: 0,
-                    };
-                }
-                const selected = elements.slice(0, Math.max(1, maxResults));
-                const payload = selected.map((el, idx) => {
-                    const attrs = {};
-                    if (attributes?.length) {
-                        for (const attr of attributes) {
-                            const value = el.getAttribute(attr);
-                            if (value != null) {
-                                attrs[attr] = value;
+            let result = null;
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                result = (await page.evaluate(({ selector, attributes, maxResults, includeText, }) => {
+                    let elements;
+                    try {
+                        elements = Array.from(document.querySelectorAll(selector));
+                    }
+                    catch (error) {
+                        return {
+                            error: `Invalid selector: ${String(error)}`,
+                            elements: [],
+                            total: 0,
+                        };
+                    }
+                    const selected = elements.slice(0, Math.max(1, maxResults));
+                    const payload = selected.map((el, idx) => {
+                        const attrs = {};
+                        if (attributes?.length) {
+                            for (const attr of attributes) {
+                                const value = el.getAttribute(attr);
+                                if (value != null) {
+                                    attrs[attr] = value;
+                                }
                             }
                         }
-                    }
+                        return {
+                            index: idx + 1,
+                            tag: el.tagName.toLowerCase(),
+                            text: includeText
+                                ? (el.textContent || '').replace(/\s+/g, ' ').trim()
+                                : '',
+                            attributes: attrs,
+                        };
+                    });
                     return {
-                        index: idx + 1,
-                        tag: el.tagName.toLowerCase(),
-                        text: includeText
-                            ? (el.textContent || '').replace(/\s+/g, ' ').trim()
-                            : '',
-                        attributes: attrs,
+                        elements: payload,
+                        total: elements.length,
+                        truncated: elements.length > selected.length,
                     };
-                });
-                return {
-                    elements: payload,
-                    total: elements.length,
-                    truncated: elements.length > selected.length,
-                };
-            }, {
-                selector: params.selector,
-                attributes: params.attributes ?? null,
-                maxResults: params.max_results,
-                includeText: params.include_text,
-            }));
+                }, {
+                    selector: params.selector,
+                    attributes: params.attributes ?? null,
+                    maxResults: params.max_results,
+                    includeText: params.include_text,
+                }));
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
             if (!result) {
                 return new ActionResult({ error: 'find_elements returned no result' });
             }
@@ -1367,42 +1443,44 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!page || !page.evaluate) {
                 throw new BrowserError('Unable to access current page for scrolling.');
             }
-            // Helper function to get window height with retries
-            const getWindowHeight = async (retries = 3) => {
-                for (let i = 0; i < retries; i++) {
-                    throwIfAborted(signal);
-                    try {
-                        const height = await page.evaluate(() => window.innerHeight);
-                        return height || 0;
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                // Helper function to get window height with retries
+                const getWindowHeight = async (retries = 3) => {
+                    for (let i = 0; i < retries; i++) {
+                        throwIfAborted(signal);
+                        try {
+                            const height = await page.evaluate(() => window.innerHeight);
+                            return height || 0;
+                        }
+                        catch (error) {
+                            if (i === retries - 1) {
+                                throw new Error(`Scroll failed due to an error: ${error}`, {
+                                    cause: error,
+                                });
+                            }
+                            await waitWithSignal(1000, signal);
+                        }
                     }
-                    catch (error) {
-                        if (i === retries - 1) {
-                            throw new Error(`Scroll failed due to an error: ${error}`, {
-                                cause: error,
+                    return 0;
+                };
+                const windowHeight = await getWindowHeight();
+                const pagesScrolled = params.pages ?? params.num_pages ?? 1;
+                const scrollAmount = Math.floor(windowHeight * pagesScrolled);
+                const dy = params.down ? scrollAmount : -scrollAmount;
+                const direction = params.down ? 'down' : 'up';
+                let scrollTarget = 'the page';
+                // Element-specific scrolling if index is provided
+                if (params.index !== undefined && params.index !== null) {
+                    try {
+                        const elementNode = await browser_session.get_dom_element_by_index(params.index, { signal });
+                        if (!elementNode) {
+                            return new ActionResult({
+                                error: `Element index ${params.index} not found in browser state`,
                             });
                         }
-                        await waitWithSignal(1000, signal);
-                    }
-                }
-                return 0;
-            };
-            const windowHeight = await getWindowHeight();
-            const pagesScrolled = params.pages ?? params.num_pages ?? 1;
-            const scrollAmount = Math.floor(windowHeight * pagesScrolled);
-            const dy = params.down ? scrollAmount : -scrollAmount;
-            const direction = params.down ? 'down' : 'up';
-            let scrollTarget = 'the page';
-            // Element-specific scrolling if index is provided
-            if (params.index !== undefined && params.index !== null) {
-                try {
-                    const elementNode = await browser_session.get_dom_element_by_index(params.index, { signal });
-                    if (!elementNode) {
-                        return new ActionResult({
-                            error: `Element index ${params.index} not found in browser state`,
-                        });
-                    }
-                    // Try direct container scrolling (no events that might close dropdowns)
-                    const containerScrollJs = `
+                        // Try direct container scrolling (no events that might close dropdowns)
+                        const containerScrollJs = `
 						(params) => {
 							const { dy, elementXPath } = params;
 
@@ -1482,70 +1560,74 @@ You will be given a query and the markdown of a webpage that has been filtered t
 							}
 						}
 						`;
-                    const scrollParams = { dy, elementXPath: elementNode.xpath };
-                    const result = (await page.evaluate(containerScrollJs, scrollParams));
-                    if (result.success) {
-                        if (result.containerType === 'element') {
-                            let containerInfo = result.containerTag;
-                            if (result.containerId) {
-                                containerInfo += `#${result.containerId}`;
+                        const scrollParams = { dy, elementXPath: elementNode.xpath };
+                        const result = (await page.evaluate(containerScrollJs, scrollParams));
+                        if (result.success) {
+                            if (result.containerType === 'element') {
+                                let containerInfo = result.containerTag;
+                                if (result.containerId) {
+                                    containerInfo += `#${result.containerId}`;
+                                }
+                                else if (result.containerClass) {
+                                    containerInfo += `.${result.containerClass.split(' ')[0]}`;
+                                }
+                                scrollTarget = `element ${params.index}'s scroll container (${containerInfo})`;
+                                // Don't do additional page scrolling since we successfully scrolled the container
                             }
-                            else if (result.containerClass) {
-                                containerInfo += `.${result.containerClass.split(' ')[0]}`;
+                            else {
+                                scrollTarget = `the page (fallback from element ${params.index})`;
                             }
-                            scrollTarget = `element ${params.index}'s scroll container (${containerInfo})`;
-                            // Don't do additional page scrolling since we successfully scrolled the container
                         }
                         else {
-                            scrollTarget = `the page (fallback from element ${params.index})`;
+                            // Container scroll failed, need page-level scrolling
+                            scrollLogger.debug(`Container scroll failed for element ${params.index}: ${result.reason || 'Unknown'}`);
+                            scrollTarget = `the page (no container found for element ${params.index})`;
+                            // This will trigger page-level scrolling below
                         }
                     }
-                    else {
-                        // Container scroll failed, need page-level scrolling
-                        scrollLogger.debug(`Container scroll failed for element ${params.index}: ${result.reason || 'Unknown'}`);
-                        scrollTarget = `the page (no container found for element ${params.index})`;
-                        // This will trigger page-level scrolling below
+                    catch (error) {
+                        scrollLogger.debug(`Element-specific scrolling failed for index ${params.index}: ${error}`);
+                        scrollTarget = `the page (fallback from element ${params.index})`;
+                        // Fall through to page-level scrolling
                     }
                 }
-                catch (error) {
-                    scrollLogger.debug(`Element-specific scrolling failed for index ${params.index}: ${error}`);
-                    scrollTarget = `the page (fallback from element ${params.index})`;
-                    // Fall through to page-level scrolling
+                // Page-level scrolling (default or fallback)
+                if (scrollTarget === 'the page' ||
+                    scrollTarget.includes('fallback') ||
+                    scrollTarget.includes('no container found') ||
+                    scrollTarget.includes('mouse wheel failed')) {
+                    scrollLogger.debug(`🔄 Performing page-level scrolling. Reason: ${scrollTarget}`);
+                    try {
+                        await dispatchBrowserEventIfAvailable(browser_session, new ScrollEvent({
+                            direction,
+                            amount: Math.abs(dy),
+                        }), () => browser_session._scrollContainer(dy));
+                    }
+                    catch (error) {
+                        // Hard fallback: always works on root scroller
+                        await page.evaluate((y) => window.scrollBy(0, y), dy);
+                        scrollLogger.debug('Smart scroll failed; used window.scrollBy fallback', error);
+                    }
                 }
-            }
-            // Page-level scrolling (default or fallback)
-            if (scrollTarget === 'the page' ||
-                scrollTarget.includes('fallback') ||
-                scrollTarget.includes('no container found') ||
-                scrollTarget.includes('mouse wheel failed')) {
-                scrollLogger.debug(`🔄 Performing page-level scrolling. Reason: ${scrollTarget}`);
-                try {
-                    await dispatchBrowserEventIfAvailable(browser_session, new ScrollEvent({
-                        direction,
-                        amount: Math.abs(dy),
-                    }), () => browser_session._scrollContainer(dy));
+                // Create descriptive message
+                let longTermMemory;
+                if (pagesScrolled === 1.0) {
+                    longTermMemory = `Scrolled ${direction} ${scrollTarget} by one page`;
                 }
-                catch (error) {
-                    // Hard fallback: always works on root scroller
-                    await page.evaluate((y) => window.scrollBy(0, y), dy);
-                    scrollLogger.debug('Smart scroll failed; used window.scrollBy fallback', error);
+                else {
+                    longTermMemory = `Scrolled ${direction} ${scrollTarget} by ${pagesScrolled} pages`;
                 }
+                const msg = `🔍 ${longTermMemory}`;
+                scrollLogger.info(msg);
+                return new ActionResult({
+                    extracted_content: msg,
+                    include_in_memory: true,
+                    long_term_memory: longTermMemory,
+                });
             }
-            // Create descriptive message
-            let longTermMemory;
-            if (pagesScrolled === 1.0) {
-                longTermMemory = `Scrolled ${direction} ${scrollTarget} by one page`;
-            }
-            else {
-                longTermMemory = `Scrolled ${direction} ${scrollTarget} by ${pagesScrolled} pages`;
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
             }
-            const msg = `🔍 ${longTermMemory}`;
-            scrollLogger.info(msg);
-            return new ActionResult({
-                extracted_content: msg,
-                include_in_memory: true,
-                long_term_memory: longTermMemory,
-            });
         };
         // Register scroll action with multiple names for LLM compatibility
         // Different LLMs may use different names: scroll, scroll_page, scroll_down
@@ -1601,20 +1683,27 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 if (!page?.evaluate) {
                     throw new BrowserError('Unable to access page for scrolling.');
                 }
-                const success = await page.evaluate(({ text }) => {
-                    const iterator = document.createNodeIterator(document.body, NodeFilter.SHOW_ELEMENT);
-                    let node;
-                    while ((node = iterator.nextNode())) {
-                        const el = node;
-                        if (!el || !el.textContent)
-                            continue;
-                        if (el.textContent.toLowerCase().includes(text.toLowerCase())) {
-                            el.scrollIntoView({ behavior: 'smooth', block: 'center' });
-                            return true;
+                await validateBrowserPageAfterAction(browser_session, page);
+                let success = false;
+                try {
+                    success = await page.evaluate(({ text }) => {
+                        const iterator = document.createNodeIterator(document.body, NodeFilter.SHOW_ELEMENT);
+                        let node;
+                        while ((node = iterator.nextNode())) {
+                            const el = node;
+                            if (!el || !el.textContent)
+                                continue;
+                            if (el.textContent.toLowerCase().includes(text.toLowerCase())) {
+                                el.scrollIntoView({ behavior: 'smooth', block: 'center' });
+                                return true;
+                            }
                         }
-                    }
-                    return false;
-                }, { text: params.text });
+                        return false;
+                    }, { text: params.text });
+                }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page);
+                }
                 if (!success) {
                     throw new BrowserError(`Text '${params.text}' not found on page`);
                 }
@@ -1754,7 +1843,7 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 }
                 fileName = FileSystem.sanitize_filename(fileName);
                 const filePath = path.join(fsInstance.get_dir(), fileName);
-                await fsp.writeFile(filePath, Buffer.from(screenshotB64, 'base64'));
+                await writePrivateBinaryFile(filePath, Buffer.from(screenshotB64, 'base64'));
                 const msg = `📸 Saved screenshot to ${filePath}`;
                 return new ActionResult({
                     extracted_content: msg,
@@ -1784,20 +1873,28 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!page) {
                 throw new BrowserError('No active page available for save_as_pdf.');
             }
+            await validateBrowserPageAfterAction(browser_session, page, signal);
             const paperKey = String(params.paper_format ?? 'Letter').toLowerCase();
             const paperSize = paperSizes[paperKey] ?? paperSizes.letter;
             const cdpSession = await browser_session.get_or_create_cdp_session?.(page);
             if (!cdpSession?.send) {
                 throw new BrowserError('CDP session unavailable for save_as_pdf.');
             }
-            const result = await cdpSession.send('Page.printToPDF', {
-                printBackground: params.print_background,
-                landscape: params.landscape,
-                scale: params.scale,
-                paperWidth: paperSize.width,
-                paperHeight: paperSize.height,
-                preferCSSPageSize: true,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            let result = null;
+            try {
+                result = await cdpSession.send('Page.printToPDF', {
+                    printBackground: params.print_background,
+                    landscape: params.landscape,
+                    scale: params.scale,
+                    paperWidth: paperSize.width,
+                    paperHeight: paperSize.height,
+                    preferCSSPageSize: true,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
             const pdfData = result && typeof result.data === 'string' ? result.data : null;
             if (!pdfData) {
                 throw new BrowserError('CDP Page.printToPDF returned no data.');
@@ -1805,6 +1902,7 @@ You will be given a query and the markdown of a webpage that has been filtered t
             const fsInstance = file_system ?? new FileSystem(process.cwd(), false);
             let fileName = params.file_name?.trim();
             if (!fileName) {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
                 try {
                     const titlePromise = typeof page.title === 'function'
                         ? page.title()
@@ -1824,13 +1922,17 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 catch {
                     fileName = 'page';
                 }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page, signal);
+                }
             }
             if (!fileName.toLowerCase().endsWith('.pdf')) {
                 fileName = `${fileName}.pdf`;
             }
             fileName = FileSystem.sanitize_filename(fileName);
             const filePath = await resolveUniqueOutputPath(fsInstance.get_dir(), fileName);
-            await fsp.writeFile(filePath, Buffer.from(pdfData, 'base64'));
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            await writePrivateBinaryFile(filePath, Buffer.from(pdfData, 'base64'));
             const fileSize = (await fsp.stat(filePath)).size;
             const baseName = path.basename(filePath);
             const msg = `Saved page as PDF: ${baseName} (${fileSize.toLocaleString()} bytes)`;
@@ -1849,32 +1951,39 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new BrowserError('No active page available for evaluate.');
             }
             const validatedCode = validateAndFixJavaScript(params.code);
-            const payload = (await page.evaluate(async ({ code }) => {
-                try {
-                    const raw = await Promise.resolve((0, eval)(code));
-                    let serializedResult;
-                    if (raw === undefined) {
-                        serializedResult = null;
-                    }
-                    else {
-                        try {
-                            serializedResult = JSON.parse(JSON.stringify(raw));
+            let payload = null;
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                payload = (await page.evaluate(async ({ code }) => {
+                    try {
+                        const raw = await Promise.resolve((0, eval)(code));
+                        let serializedResult;
+                        if (raw === undefined) {
+                            serializedResult = null;
                         }
-                        catch {
-                            serializedResult = String(raw);
+                        else {
+                            try {
+                                serializedResult = JSON.parse(JSON.stringify(raw));
+                            }
+                            catch {
+                                serializedResult = String(raw);
+                            }
                         }
+                        return { ok: true, result: serializedResult };
                     }
-                    return { ok: true, result: serializedResult };
-                }
-                catch (error) {
-                    return {
-                        ok: false,
-                        error: error instanceof Error
-                            ? error.message
-                            : String(error ?? 'Unknown evaluate error'),
-                    };
-                }
-            }, { code: validatedCode }));
+                    catch (error) {
+                        return {
+                            ok: false,
+                            error: error instanceof Error
+                                ? error.message
+                                : String(error ?? 'Unknown evaluate error'),
+                        };
+                    }
+                }, { code: validatedCode }));
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
             if (!payload) {
                 return new ActionResult({ error: 'evaluate returned no result' });
             }
@@ -1929,6 +2038,7 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 if (!keyboard) {
                     throw new BrowserError('Keyboard input is not available on the current page.');
                 }
+                await validateBrowserPageAfterAction(browser_session, page);
                 try {
                     await keyboard.press(params.keys);
                 }
@@ -1943,6 +2053,9 @@ You will be given a query and the markdown of a webpage that has been filtered t
                         throw error;
                     }
                 }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page);
+                }
                 return null;
             });
             const msg = `⌨️  Sent keys: ${params.keys}`;
@@ -1996,31 +2109,38 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!domElement.xpath) {
                 throw new BrowserError('DOM element does not include an XPath selector.');
             }
-            const payload = await page.evaluate(({ xpath }) => {
-                const element = document.evaluate(xpath, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;
-                if (!element)
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            let payload = null;
+            try {
+                payload = await page.evaluate(({ xpath }) => {
+                    const element = document.evaluate(xpath, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;
+                    if (!element)
+                        return null;
+                    if (element.tagName?.toLowerCase() === 'select') {
+                        const options = Array.from(element.options).map((opt, index) => ({
+                            text: opt.textContent?.trim() ?? '',
+                            value: (opt.value ?? '').trim(),
+                            index,
+                        }));
+                        return { type: 'select', options };
+                    }
+                    const ariaRoles = new Set(['menu', 'listbox', 'combobox']);
+                    const role = element.getAttribute('role');
+                    if (role && ariaRoles.has(role)) {
+                        const nodes = element.querySelectorAll('[role="menuitem"],[role="option"]');
+                        const options = Array.from(nodes).map((node, index) => ({
+                            text: node.textContent?.trim() ?? '',
+                            value: node.textContent?.trim() ?? '',
+                            index,
+                        }));
+                        return { type: 'aria', options };
+                    }
                     return null;
-                if (element.tagName?.toLowerCase() === 'select') {
-                    const options = Array.from(element.options).map((opt, index) => ({
-                        text: opt.textContent?.trim() ?? '',
-                        value: (opt.value ?? '').trim(),
-                        index,
-                    }));
-                    return { type: 'select', options };
-                }
-                const ariaRoles = new Set(['menu', 'listbox', 'combobox']);
-                const role = element.getAttribute('role');
-                if (role && ariaRoles.has(role)) {
-                    const nodes = element.querySelectorAll('[role="menuitem"],[role="option"]');
-                    const options = Array.from(nodes).map((node, index) => ({
-                        text: node.textContent?.trim() ?? '',
-                        value: node.textContent?.trim() ?? '',
-                        index,
-                    }));
-                    return { type: 'aria', options };
-                }
-                return null;
-            }, { xpath: domElement.xpath });
+                }, { xpath: domElement.xpath });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
             if (!payload || !payload.options?.length) {
                 throw new BrowserError('No options found for the specified dropdown.');
             }
@@ -2080,6 +2200,7 @@ You will be given a query and the markdown of a webpage that has been filtered t
             if (!page) {
                 throw new BrowserError('No active page for selection.');
             }
+            await validateBrowserPageAfterAction(browser_session, page, signal);
             for (const frame of page.frames ?? []) {
                 try {
                     const typeInfo = await frame.evaluate((xpath) => {
@@ -2209,6 +2330,9 @@ You will be given a query and the markdown of a webpage that has been filtered t
                     }
                     continue;
                 }
+                finally {
+                    await validateBrowserPageAfterAction(browser_session, page, signal);
+                }
             }
             throw new BrowserError(`Could not select option '${params.text}' for index ${params.index}`);
         });
@@ -2228,17 +2352,23 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await page?.keyboard?.press('Enter');
-            await page?.keyboard?.press('Escape');
-            await page?.keyboard?.press('ControlOrMeta+A');
-            await page?.keyboard?.press('ControlOrMeta+C');
-            const content = await page?.evaluate?.(() => navigator.clipboard.readText());
-            return new ActionResult({
-                extracted_content: content ?? '',
-                include_in_memory: true,
-                long_term_memory: 'Retrieved sheet contents',
-                include_extracted_content_only_once: true,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await page?.keyboard?.press('Enter');
+                await page?.keyboard?.press('Escape');
+                await page?.keyboard?.press('ControlOrMeta+A');
+                await page?.keyboard?.press('ControlOrMeta+C');
+                const content = await page?.evaluate?.(() => navigator.clipboard.readText());
+                return new ActionResult({
+                    extracted_content: content ?? '',
+                    include_in_memory: true,
+                    long_term_memory: 'Retrieved sheet contents',
+                    include_extracted_content_only_once: true,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
         this.registry.action('Google Sheets: Get the contents of a cell or range of cells', {
             domains: ['https://docs.google.com'],
@@ -2248,16 +2378,22 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await gotoSheetsRange(page, params.cell_or_range, signal);
-            await page?.keyboard?.press('ControlOrMeta+C');
-            await waitWithSignal(100, signal);
-            const content = await page?.evaluate?.(() => navigator.clipboard.readText());
-            return new ActionResult({
-                extracted_content: content ?? '',
-                include_in_memory: true,
-                long_term_memory: `Retrieved contents from ${params.cell_or_range}`,
-                include_extracted_content_only_once: true,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await gotoSheetsRange(page, params.cell_or_range, signal);
+                await page?.keyboard?.press('ControlOrMeta+C');
+                await waitWithSignal(100, signal);
+                const content = await page?.evaluate?.(() => navigator.clipboard.readText());
+                return new ActionResult({
+                    extracted_content: content ?? '',
+                    include_in_memory: true,
+                    long_term_memory: `Retrieved contents from ${params.cell_or_range}`,
+                    include_extracted_content_only_once: true,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
         this.registry.action('Google Sheets: Update the content of a cell or range of cells', {
             domains: ['https://docs.google.com'],
@@ -2267,16 +2403,22 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await gotoSheetsRange(page, params.cell_or_range, signal);
-            await page?.evaluate?.((value) => {
-                const clipboardData = new DataTransfer();
-                clipboardData.setData('text/plain', value);
-                document.activeElement?.dispatchEvent(new ClipboardEvent('paste', { clipboardData }));
-            }, params.value);
-            return new ActionResult({
-                extracted_content: `Updated cells: ${params.cell_or_range} = ${params.value}`,
-                long_term_memory: `Updated cells ${params.cell_or_range} with ${params.value}`,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await gotoSheetsRange(page, params.cell_or_range, signal);
+                await page?.evaluate?.((value) => {
+                    const clipboardData = new DataTransfer();
+                    clipboardData.setData('text/plain', value);
+                    document.activeElement?.dispatchEvent(new ClipboardEvent('paste', { clipboardData }));
+                }, params.value);
+                return new ActionResult({
+                    extracted_content: `Updated cells: ${params.cell_or_range} = ${params.value}`,
+                    long_term_memory: `Updated cells ${params.cell_or_range} with ${params.value}`,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
         this.registry.action('Google Sheets: Clear whatever cells are currently selected', {
             domains: ['https://docs.google.com'],
@@ -2286,12 +2428,18 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await gotoSheetsRange(page, params.cell_or_range, signal);
-            await page?.keyboard?.press('Backspace');
-            return new ActionResult({
-                extracted_content: `Cleared cells: ${params.cell_or_range}`,
-                long_term_memory: `Cleared cells ${params.cell_or_range}`,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await gotoSheetsRange(page, params.cell_or_range, signal);
+                await page?.keyboard?.press('Backspace');
+                return new ActionResult({
+                    extracted_content: `Cleared cells: ${params.cell_or_range}`,
+                    long_term_memory: `Cleared cells ${params.cell_or_range}`,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
         this.registry.action('Google Sheets: Select a specific cell or range of cells', {
             domains: ['https://docs.google.com'],
@@ -2301,11 +2449,17 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await gotoSheetsRange(page, params.cell_or_range, signal);
-            return new ActionResult({
-                extracted_content: `Selected cells: ${params.cell_or_range}`,
-                long_term_memory: `Selected cells ${params.cell_or_range}`,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await gotoSheetsRange(page, params.cell_or_range, signal);
+                return new ActionResult({
+                    extracted_content: `Selected cells: ${params.cell_or_range}`,
+                    long_term_memory: `Selected cells ${params.cell_or_range}`,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
         this.registry.action('Google Sheets: Fallback method to type text into the currently selected cell', {
             domains: ['https://docs.google.com'],
@@ -2315,13 +2469,19 @@ You will be given a query and the markdown of a webpage that has been filtered t
                 throw new Error('Browser session missing');
             throwIfAborted(signal);
             const page = await browser_session.get_current_page();
-            await page?.keyboard?.type(params.text, { delay: 100 });
-            await page?.keyboard?.press('Enter');
-            await page?.keyboard?.press('ArrowUp');
-            return new ActionResult({
-                extracted_content: `Inputted text ${params.text}`,
-                long_term_memory: `Inputted text '${params.text}' into cell`,
-            });
+            await validateBrowserPageAfterAction(browser_session, page, signal);
+            try {
+                await page?.keyboard?.type(params.text, { delay: 100 });
+                await page?.keyboard?.press('Enter');
+                await page?.keyboard?.press('ArrowUp');
+                return new ActionResult({
+                    extracted_content: `Inputted text ${params.text}`,
+                    long_term_memory: `Inputted text '${params.text}' into cell`,
+                });
+            }
+            finally {
+                await validateBrowserPageAfterAction(browser_session, page, signal);
+            }
         });
     }
     async gotoSheetsRange(page, cell_or_range, signal = null) {
@@ -2428,19 +2588,19 @@ You will be given a query and the markdown of a webpage that has been filtered t
     action(description, options = {}) {
         return this.registry.action(description, options);
     }
-    async act(action, { browser_session, page_extraction_llm = null, sensitive_data = null, available_file_paths = null, file_system = null, context = null, signal = null, }) {
+    async act(action, { browser_session, page_extraction_llm = null, sensitive_data = null, available_file_paths = null, file_system = null, context = null, signal = null, action_timeout = null, }) {
         const entries = toActionEntries(action);
         for (const [actionName, params] of entries) {
             try {
-                const result = await this.registry.execute_action(actionName, params, {
+                const result = await runActionWithTimeout(actionName, action_timeout, signal, (actionSignal) => this.registry.execute_action(actionName, params, {
                     browser_session,
                     page_extraction_llm,
                     sensitive_data,
                     available_file_paths,
                     file_system,
                     context,
-                    signal,
-                });
+                    signal: actionSignal,
+                }));
                 if (typeof result === 'string') {
                     return new ActionResult({ extracted_content: result });
                 }
@@ -2471,6 +2631,11 @@ You will be given a query and the markdown of a webpage that has been filtered t
                     }
                     throw error;
                 }
+                if (isActionTimeoutError(error)) {
+                    return new ActionResult({
+                        error: error.message,
+                    });
+                }
                 const message = String(error?.message ?? error ?? '');
                 if (error instanceof Error &&
                     message === `Error executing action ${actionName} due to timeout.`) {