browser-workspace 0.4.0

package/platforms/chatgpt/actions/_thread_turn.py

@@ -0,0 +1,362 @@
+import json
+import os
+import re
+import time
+from urllib.parse import urlsplit
+from _readiness import wait_until_stable, submission_receipt, prompt_text_matches
+
+
+CFG = json.load(open("__CFG_PATH__", encoding="utf-8"))
+
+def _composer():
+    selector = js("""(() => {
+      const selectors = [
+        '#prompt-textarea',
+        '[contenteditable="true"][data-composer-markdown]',
+        '[contenteditable="true"][data-lexical-editor="true"]',
+        'textarea'
+      ];
+      for (const selector of selectors) {
+        const e=document.querySelector(selector);
+        if (!e || ['pending-home-input','pending-conversation-input'].includes(e.id) || e.disabled) continue;
+        const r=e.getBoundingClientRect();
+        if (r.width>0 && r.height>0) return selector;
+      }
+      const visible=[...document.querySelectorAll('[contenteditable="true"]')].filter(e => {
+        if (['pending-home-input','pending-conversation-input'].includes(e.id) || e.disabled) return false;
+        const r=e.getBoundingClientRect();
+        return r.width>0 && r.height>0;
+      });
+      return visible.length === 1 ? '[contenteditable="true"]' : null;
+    })()""")
+    if not selector:
+        raise RuntimeError("ChatGPT composer was not observed")
+    return selector
+
+def _composer_text(selector):
+    return js(f"""(() => {{
+      const e=document.querySelector({json.dumps(selector)});
+      if (!e) return '';
+      if (e.getAttribute('contenteditable') !== 'true') return e.value || '';
+      const clone=e.cloneNode(true);
+      clone.querySelectorAll('[app-mention-name]').forEach(node => node.remove());
+      return (clone.innerText || clone.textContent || '').trim();
+    }})()""") or ""
+
+def _clear_composer(selector):
+    editable=bool(js(f"""(() => {{
+      const e=document.querySelector({json.dumps(selector)});
+      return !!e && e.getAttribute('contenteditable') === 'true';
+    }})()"""))
+    if not editable:
+        fill_input(selector, "", clear_first=True)
+        return
+    ok=js(f"""(() => {{
+      const e=document.querySelector({json.dumps(selector)});
+      if (!e) return false;
+      e.focus();
+      const sel=window.getSelection();
+      const range=document.createRange();
+      range.selectNodeContents(e);
+      sel.removeAllRanges(); sel.addRange(range);
+      document.execCommand('delete', false, null);
+      sel.removeAllRanges();
+      return true;
+    }})()""")
+    if not ok:
+        raise RuntimeError("composer could not be cleared")
+
+def _attach_app(selector, target_id, app_name, timeout=10):
+    name=str(app_name or "").strip()
+    if not name:
+        return False
+    _clear_composer(selector)
+    session=cdp("Target.attachToTarget", targetId=target_id, flatten=True)["sessionId"]
+    cdp("Input.insertText", session_id=session, text="@")
+    wanted=name.lower()
+    deadline=time.time()+timeout
+    while time.time()<deadline:
+        clicked=js(f"""(() => {{
+          const wanted={json.dumps(wanted)};
+          const buttons=[...document.querySelectorAll('button,[role="option"],[role="menuitem"]')];
+          const candidate=buttons.find(e => {{
+            const text=(e.innerText||e.textContent||'').replace(/\s+/g,'').trim().toLowerCase();
+            return text===wanted || text===wanted+wanted;
+          }});
+          if(!candidate) return false;
+          candidate.click();
+          return true;
+        }})()""")
+        if clicked:
+            break
+        time.sleep(.1)
+    else:
+        raise RuntimeError(f"ChatGPT app '{name}' was not offered by the composer")
+    deadline=time.time()+timeout
+    while time.time()<deadline:
+        attached=js(f"""(() => {{
+          const e=document.querySelector({json.dumps(selector)});
+          if(!e) return false;
+          return !![...e.querySelectorAll('[app-mention-name]')].find(
+            n => (n.getAttribute('app-mention-name')||'').toLowerCase()==={json.dumps(wanted)}
+          );
+        }})()""")
+        if attached:
+            return True
+        time.sleep(.1)
+    raise RuntimeError(f"ChatGPT app '{name}' mention did not attach")
+
+def _attachment_state():
+    return js(r"""(() => {
+      const names=[...document.querySelectorAll('button[aria-label^="Remove "]')]
+        .map(b => (b.getAttribute('aria-label') || '').replace(/^Remove file\s+\d+:\s*/, '').replace(/^Remove\s+/, ''))
+        .filter(Boolean);
+      const visible=e => { const r=e.getBoundingClientRect(); return r.width>0 && r.height>0; };
+      const pendingSelector='[role="progressbar"], [aria-busy="true"], [data-state="loading"]';
+      const pending=[...document.querySelectorAll(pendingSelector)].some(visible);
+      return {names, pending};
+    })()""") or {"names": [], "pending": False}
+
+def _send_state():
+    return js(r"""(() => {
+      const b=document.querySelector('button[data-testid="send-button"],button[aria-label="Send prompt"],button[aria-label="Send"]');
+      return {present:!!b, enabled:!!b && !b.disabled && b.getAttribute('aria-disabled') !== 'true'};
+    })()""") or {"present": False, "enabled": False}
+
+def _user_turns():
+    return js("""(() => {
+      const legacy=[...document.querySelectorAll('[data-message-author-role="user"]')]
+        .map(e => ({text:(e.innerText || '').trim(), id:e.getAttribute('data-message-id') || ''}))
+        .filter(x => x.text);
+      if (legacy.length) return legacy;
+      return [...document.querySelectorAll('h4')]
+        .filter(e => (e.innerText || '').trim() === 'You said:')
+        .map((e,index) => {
+          const raw=(e.parentElement?.innerText || '').trim();
+          return {text:raw.replace(/^You said:\\s*/,'').trim(), id:`dom-user-${index}`};
+        })
+        .filter(x => x.text);
+    })()""") or []
+
+def _assistant_messages():
+    return js("""(() => {
+      const legacy=[...document.querySelectorAll('[data-message-author-role="assistant"]')]
+        .map(e => ({text:(e.innerText || '').trim(), id:e.getAttribute('data-message-id') || ''}))
+        .filter(x => x.text);
+      if (legacy.length) return legacy;
+      return [...document.querySelectorAll('h4')]
+        .filter(e => (e.innerText || '').trim() === 'ChatGPT said:')
+        .map((e,index) => {
+          const raw=(e.parentElement?.innerText || '').trim();
+          return {text:raw.replace(/^ChatGPT said:\\s*/,'').trim(), id:`dom-assistant-${index}`};
+        })
+        .filter(x => x.text);
+    })()""") or []
+
+def _is_generating():
+    return bool(js("""(() => !![...document.querySelectorAll('button')].find(b => {
+      const a=(b.getAttribute('aria-label')||'').toLowerCase();
+      const t=(b.textContent||'').trim().toLowerCase();
+      const id=(b.getAttribute('data-testid')||'').toLowerCase();
+      return a.includes('stop answering') || a.includes('stop generating') || t === 'stop' || id.includes('stop');
+    }))()"""))
+
+def _fill_prompt(prompt, timeout=30, preserve_app=False):
+    deadline=time.time()+timeout
+    last_error=None
+    while time.time()<deadline:
+        selector=_composer()
+        if prompt_text_matches(_composer_text(selector), prompt):
+            return selector
+        editable=bool(js(f"""(() => {{
+          const e=document.querySelector({json.dumps(selector)});
+          return !!e && e.getAttribute('contenteditable') === 'true';
+        }})()"""))
+        try:
+            if editable:
+                if not preserve_app:
+                    _clear_composer(selector)
+                else:
+                    ok=js(f"""(() => {{
+                      const e=document.querySelector({json.dumps(selector)});
+                      if (!e) return false;
+                      e.focus();
+                      const sel=window.getSelection();
+                      const range=document.createRange();
+                      range.selectNodeContents(e);
+                      range.collapse(false);
+                      sel.removeAllRanges(); sel.addRange(range);
+                      return true;
+                    }})()""")
+                    if not ok: raise RuntimeError("composer caret could not be placed after app mention")
+                for offset in range(0, len(prompt), 256):
+                    chunk=prompt[offset:offset+256]
+                    inserted=js(f"""(() => {{
+                      const e=document.querySelector({json.dumps(selector)});
+                      if (!e) return false;
+                      e.focus();
+                      const ok=document.execCommand('insertText', false, {json.dumps(chunk)});
+                      e.dispatchEvent(new InputEvent('input', {{bubbles:true,inputType:'insertText',data:{json.dumps(chunk)}}}));
+                      return ok;
+                    }})()""")
+                    if not inserted: raise RuntimeError("composer rejected prompt chunk")
+            else:
+                if preserve_app:
+                    raise RuntimeError("ChatGPT app mention requires a contenteditable composer")
+                fill_input(selector, prompt, clear_first=True)
+            return selector
+        except RuntimeError as exc:
+            last_error=exc
+            time.sleep(.25)
+    raise RuntimeError(f"ChatGPT composer could not be filled: {last_error}")
+
+def _upload_files(paths):
+    if not paths: return []
+    selector=js("""(() => {
+      for (const s of ['#upload-files','#upload-media','input[name="upload-media"]','input[type="file"]'])
+        if (document.querySelector(s)) return s;
+      return null;
+    })()""")
+    if not selector:
+        opened=js("""(() => {
+          const b=[...document.querySelectorAll('button')].find(b => (b.getAttribute('aria-label')||'').trim()==='Add files and more');
+          if (!b) return false; b.click(); return true;
+        })()""")
+        if opened:
+            deadline=time.time()+5
+            while time.time()<deadline and not selector:
+                selector=js("""(() => {
+                  for (const s of ['#upload-files','#upload-media','input[name="upload-media"]','input[type="file"]'])
+                    if (document.querySelector(s)) return s;
+                  return null;
+                })()""")
+                if not selector: time.sleep(.1)
+    if not selector: raise RuntimeError("ChatGPT file input was not observed")
+    expected=[]
+    for path in paths:
+        if not os.path.isfile(path): raise RuntimeError(f"attachment does not exist: {path}")
+        upload_file(selector, path)
+        expected.append(os.path.basename(path))
+    wait_until_stable(
+        _attachment_state,
+        lambda state: set(expected).issubset(state["names"]) and not state["pending"],
+        timeout=120,
+        phase="attachment readiness",
+    )
+    return expected
+
+def _submit(prompt, files, target_id):
+    selector=_composer()
+    app_name=CFG.get("app")
+    app_attached=_attach_app(selector, target_id, app_name) if app_name else False
+    selector=_fill_prompt(prompt, preserve_app=app_attached)
+    attachments=_upload_files(files)
+    before_users=len(_user_turns())
+    before_assistants=len(_assistant_messages())
+    state=wait_until_stable(
+        lambda: {"selector":_composer(),"text":_composer_text(_composer()),"attachments":_attachment_state(),"send":_send_state()},
+        lambda s: prompt_text_matches(s["text"], prompt) and set(attachments).issubset(s["attachments"]["names"]) and not s["attachments"]["pending"] and s["send"]["enabled"],
+        timeout=45 if attachments else 20,
+        phase="send readiness",
+    )
+    selector=state["selector"]
+    clicked=js("""(() => {
+      const b=document.querySelector('button[data-testid="send-button"],button[aria-label="Send prompt"],button[aria-label="Send"]');
+      if (!b || b.disabled || b.getAttribute('aria-disabled') === 'true') return false;
+      b.click(); return true;
+    })()""")
+    if not clicked: raise RuntimeError("ChatGPT send button changed before click")
+    deadline=time.time()+30
+    receipt=None
+    while time.time()<deadline:
+        receipt=submission_receipt(_user_turns(), before_users, prompt, _composer_text(selector))
+        if receipt: break
+        time.sleep(.25)
+    if not receipt: raise RuntimeError("ChatGPT submission verification did not observe an accepted submission")
+    return before_assistants, attachments, receipt
+
+def _result(before_assistants, timeout):
+    deadline=time.time()+timeout
+    signature=None
+    stable_since=None
+    while time.time()<deadline:
+        if _is_generating():
+            signature=None
+            stable_since=None
+            time.sleep(.5)
+            continue
+        messages=_assistant_messages()
+        if len(messages)<=before_assistants:
+            time.sleep(.5)
+            continue
+        latest=messages[-1]
+        sig=(latest.get("id"), latest.get("text"))
+        if sig!=signature:
+            signature=sig
+            stable_since=time.time()
+            time.sleep(.5)
+            continue
+        if not latest.get("text") or stable_since is None or time.time()-stable_since<3:
+            time.sleep(.5)
+            continue
+        return latest
+    raise RuntimeError("ChatGPT assistant result did not become complete before timeout")
+
+def _open_thread():
+    thread_url=CFG["thread_url"]
+    expected_path=urlsplit(thread_url).path.rstrip("/")
+    target_id=CFG.get("target_id")
+    recovered=False
+    if target_id:
+        try:
+            switch_tab(target_id)
+            current_path=urlsplit(page_info().get("url","")).path.rstrip("/")
+            if current_path!=expected_path:
+                # If the bound target still exists but was navigated elsewhere,
+                # recover it in place rather than opening another browser target.
+                goto_url(thread_url)
+                wait_for_load()
+                recovered=True
+                deadline=time.time()+30
+                while time.time()<deadline:
+                    if urlsplit(page_info().get("url","")).path.rstrip("/")==expected_path:
+                        break
+                    time.sleep(.25)
+                else:
+                    raise RuntimeError("bound Tutor target could not recover its thread")
+        except Exception:
+            target_id=None
+            recovered=True
+    if not target_id:
+        target_id=new_tab(thread_url)
+        wait_for_load()
+        deadline=time.time()+30
+        while time.time()<deadline:
+            if urlsplit(page_info().get("url","")).path.rstrip("/")==expected_path:
+                break
+            time.sleep(.25)
+        else:
+            raise RuntimeError("Existing ChatGPT thread redirect mismatch")
+    wait_until_stable(
+        lambda: {"selector": _composer()},
+        lambda state: bool(state["selector"]),
+        timeout=30,
+        phase="thread hydration",
+    )
+    return target_id, recovered
+
+target_id, recovered=_open_thread()
+before_assistants, attachments, receipt=_submit(CFG["prompt"], CFG.get("file", []), target_id)
+assistant=_result(before_assistants, CFG.get("result_timeout", 240))
+print(json.dumps({
+    "status":"completed",
+    "thread_url":page_info().get("url","").split("?",1)[0],
+    "target_id":target_id,
+    "recovered":recovered,
+    "attachments":attachments,
+    "app":CFG.get("app") or None,
+    "verified_by":receipt["verified_by"],
+    "user_message_id":receipt["turn"].get("id") or None,
+    "assistant_message_id":assistant.get("id") or None,
+    "text":assistant.get("text",""),
+}, ensure_ascii=False), flush=True)

package/platforms/chatgpt/manifest.yaml

@@ -0,0 +1,34 @@
+platform: chatgpt
+status: migrated_unverified
+last_verified: null
+actions:
+  submit-thread: "actions/_submit_thread.py"
+  temporary-submit: "actions/_temporary_submit.py"
+  thread-turn: "actions/_thread_turn.py"
+  new-turn: "actions/_new_turn.py"
+  new-thread: "actions/_new_thread.py"
+  project-setup: "actions/_project_setup.py"
+  bootstrap-start: "actions/_bootstrap_start.py"
+  mcp-app: "actions/_mcp_app.py"
+verification:
+  status: migrated_unverified
+  last_verified: null
+  evidence: "The source ChatGPT worker flow was previously live-verified, but the migrated Browser Workspace platform action has not yet been live-verified through the current generic platform runner."
+flows:
+  - disposable-worker-submit
+  - existing-thread-turn
+  - lifecycle-new-turn
+  - lifecycle-new-thread
+  - project-setup
+  - mcp-app-management
+capabilities:
+  - persistent-thread
+  - attachments
+  - submit-verification
+  - assistant-completion
+  - project-bootstrap
+  - project-instructions
+  - project-memory
+  - mcp-app-inspection
+  - mcp-tool-refresh
+  - lifecycle-control-transfer

package/platforms/chatgpt/tests/test_contract.py

@@ -0,0 +1,176 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+ACTIONS = ROOT / "actions"
+
+
+def test_platform_files_exist():
+    assert (ROOT / "manifest.yaml").is_file()
+    assert (ACTIONS / "_thread_turn.py").is_file()
+    assert (ACTIONS / "_new_turn.py").is_file()
+    assert (ACTIONS / "_new_thread.py").is_file()
+    assert (ACTIONS / "_lifecycle_common.py").is_file()
+    assert (ACTIONS / "_submit_thread.py").is_file()
+    assert (ACTIONS / "_project_setup.py").is_file()
+    assert (ACTIONS / "_bootstrap_start.py").is_file()
+    assert (ACTIONS / "_mcp_app.py").is_file()
+
+
+def test_manifest_declares_actions_and_verification():
+    text = (ROOT / "manifest.yaml").read_text()
+    assert 'thread-turn: "actions/_thread_turn.py"' in text
+    assert 'new-turn: "actions/_new_turn.py"' in text
+    assert 'new-thread: "actions/_new_thread.py"' in text
+    assert 'submit-thread: "actions/_submit_thread.py"' in text
+    assert "verification:" in text
+    assert "status: migrated_unverified" in text
+
+
+def test_action_uses_browser_helpers_without_infrastructure_import():
+    text = (ACTIONS / "_thread_turn.py").read_text()
+    assert "from browser_harness" not in text
+    assert "session_client" not in text
+    assert "workspace_set_" not in text
+    assert "switch_tab(target_id)" in text
+    assert "new_tab(thread_url)" in text
+    assert '"recovered":recovered' in text
+    assert "from _readiness import wait_until_stable, submission_receipt" in text
+
+
+def test_project_setup_supports_required_inputs():
+    text = (ACTIONS / "_project_setup.py").read_text()
+    assert "def _ensure_project" in text
+    assert "project_reused" in text
+    assert "project-only" in text
+    assert "def _send_initial" in text
+    assert '"thread_url":thread_url' in text
+
+
+def test_thread_turn_supports_app_attachment():
+    text = (ACTIONS / "_thread_turn.py").read_text()
+    assert "def _attach_app" in text
+    assert "app-mention-name" in text
+
+
+def test_thread_recovery_reuses_bound_target_before_new_target():
+    driver = (ACTIONS / "_thread_turn.py").read_text()
+    open_thread = driver.split("def _open_thread():",1)[1].split("target_id, recovered=_open_thread()",1)[0]
+    assert "goto_url(thread_url)" in open_thread
+    assert "target_id=new_tab(thread_url)" in open_thread
+    assert open_thread.index("goto_url(thread_url)") < open_thread.index("target_id=new_tab(thread_url)")
+
+
+def test_prompt_match_tolerates_block_tag_boundary_whitespace():
+    ns = {}
+    exec((ACTIONS / "_readiness.py").read_text(), ns)
+    expected = '<FAMILY_TUTOR_CONTEXT>\n{"type":"kid","data":{"message":"hello world"}}\n</FAMILY_TUTOR_CONTEXT>'
+    observed = '<FAMILY_TUTOR_CONTEXT>{"type":"kid","data":{"message":"hello world"}}</FAMILY_TUTOR_CONTEXT>'
+    assert ns["prompt_text_matches"](observed, expected)
+
+
+def test_wait_until_stable_retries_transient_read_errors():
+    ns = {}
+    exec((ACTIONS / "_readiness.py").read_text(), ns)
+    calls = {"n": 0}
+    def read_state():
+        calls["n"] += 1
+        if calls["n"] < 3:
+            raise RuntimeError("not hydrated")
+        return {"ready": True}
+    result = ns["wait_until_stable"](
+        read_state,
+        lambda state: state.get("ready") is True,
+        timeout=0.2,
+        interval=0.001,
+        stable_samples=1,
+        phase="test",
+    )
+    assert result == {"ready": True}
+    assert calls["n"] == 3
+
+
+def test_submit_thread_is_submission_only():
+    text=(ACTIONS/"_submit_thread.py").read_text()
+    assert 'project_id' in text and 'thread_id' in text
+    assert '?prompt=' in text
+    assert 'submission_receipt' in text
+    assert 'response_complete' not in text
+    assert "app_name" in text and "attach_app_and_restore_prompt" in text
+
+
+def test_manifest_declares_mcp_app_action():
+    text = (ROOT / "manifest.yaml").read_text()
+    assert 'mcp-app: "actions/_mcp_app.py"' in text
+    assert "mcp-app-management" in text
+    assert "mcp-tool-refresh" in text
+
+
+def test_mcp_app_action_uses_semantic_selectors_and_safe_operations():
+    text = (ACTIONS / "_mcp_app.py").read_text()
+    assert 'Open profile menu' not in text  # direct settings route avoids profile-menu fragility
+    assert 'https://chatgpt.com/settings/plugins-settings' in text
+    assert "APP_NAME" in text
+    assert "text.startsWith(name+" in text
+    assert "body.includes('Disconnect')" in text
+    assert "body.includes('Permissions')" in text
+    assert "texts.includes('Refresh tools')" in text
+    assert 'operation must be status, open, or refresh-tools' in text
+    assert 'Delete app' not in text
+    assert 'Uninstall' in text  # observed only; never clicked
+
+
+def test_mcp_app_readme_captures_snapshot_first_setup_flow():
+    text = (ROOT / "README.md").read_text()
+    assert "Configure a custom MCP app" in text
+    assert "snapshot(interactive_only=False)" in text
+    assert "Permissions" in text and "Disconnect" in text and "Refresh tools" in text
+    assert "never commit credentials" in text
+
+
+def test_lifecycle_actions_use_stable_ids_and_do_not_wait_for_new_answer():
+    turn=(ACTIONS/"_new_turn.py").read_text()
+    thread=(ACTIONS/"_new_thread.py").read_text()
+    common=(ACTIONS/"_lifecycle_common.py").read_text()
+    assert "project_id" in turn and "thread_id" in turn
+    assert "wait_for_idle" in turn and "submit(message)" in turn
+    assert "project_id" in thread and "source_thread_id" in thread
+    assert "local-chatgpt" in thread and "thread_id" in thread
+    assert "assistant" not in turn.lower().split("print(json.dumps",1)[-1]
+    assert "assistant" not in thread.lower().split("print(json.dumps",1)[-1]
+    assert "session start" not in turn and "session stop" not in turn
+    assert "session start" not in thread and "session stop" not in thread
+    assert "submission_receipt" in common
+
+
+def test_new_thread_supports_projectless_and_temporary_modes():
+    thread=(ACTIONS/"_new_thread.py").read_text()
+    assert 'temporary=bool(CFG.get("temporary", False))' in thread
+    assert 'temporary=true cannot be combined with project_id' in thread
+    assert 'https://chatgpt.com/?temporary-chat=true' in thread
+    assert 'start_url="https://chatgpt.com/"' in thread
+    assert 'Temporary Chat mode was not activated' in thread
+    assert '"temporary":True' in thread
+    assert '"thread_id":None' in thread
+
+
+def test_lifecycle_actions_bind_session_helpers_into_imported_module():
+    for name in ("_new_turn.py", "_new_thread.py"):
+        text=(ACTIONS/name).read_text()
+        assert "import _lifecycle_common as lifecycle_common" in text
+        assert "lifecycle_common.js = js" in text
+        assert "lifecycle_common.fill_input = fill_input" in text
+
+
+def test_temporary_new_thread_finishes_without_system_exit():
+    thread=(ACTIONS/"_new_thread.py").read_text()
+    assert "SystemExit" not in thread
+    assert "if temporary:" in thread
+    assert "else:" in thread
+
+
+def test_new_turn_project_id_is_optional():
+    turn=(ACTIONS/"_new_turn.py").read_text()
+    assert 'project_id=str(CFG.get("project_id") or "").strip() or None' in turn
+    assert 'if not thread_id: raise RuntimeError("thread_id is required")' in turn
+    assert 'https://chatgpt.com/c/{quote(thread_id' in turn
+    assert 'https://chatgpt.com/g/{quote(project_id' in turn

package/platforms/chrome-web-store/README.md

@@ -0,0 +1,49 @@
+---
+name: chrome-web-store-platform
+description: "Chrome Web Store platform flows for Browser Workspace platform bundle."
+---
+
+# Chrome Web Store
+
+Use the parent Browser Workspace skill contract first.
+These assets document the verified platform contract and use the
+platform action as the reusable interaction boundary. Live actions still
+require explicit authorization and report observed evidence instead of
+inferring success.
+
+Use only the publisher account and listing explicitly selected by the caller.
+Publishing and listing updates have external side effects and require an
+explicit user request.
+
+## Runner
+
+Invoke `actions/_chrome_web_store.py` through `Browser Workspace` with
+an approved JSON configuration. The supported actions are:
+
+`resolve-item`, `create-item`, `open-item`, `upload-package`, `update-listing`, `verify-draft`, `save-draft`, `submit-review`,
+`check-status`, and `verify-published`.
+
+The runner is dry-run by default. `upload-package`, `update-listing`, and
+`submit-review` require `commit: true`; `submit-review` additionally requires
+the caller to explicitly opt in with `allow_external_submit: true`. This keeps
+Release Agent responsible for authorization while this skill owns browser
+mechanics. Every action emits a JSON evidence record containing the observed
+URL, item id, action, and status (`draft`, `submitted`, `pending`, `rejected`,
+`published`, or `unknown`).
+
+`create-item` supports the no-existing-item path: it validates the explicit
+package, opens the publisher-scoped dashboard, creates the item only with
+`commit: true`, and returns the observed editor item id. `resolve-item` reuses a
+matching product item and dry-runs creation when none exists. `verify-draft`
+reopens the exact item and proves the dashboard version; `save-draft` is the
+reusable no-field-change regression action. Passing a prior item id always
+reopens/reuses it, so retries do not create duplicates.
+
+The input `market_package` is product-owned content supplied by Market Agent;
+this skill validates presence and maps supplied values to store fields but does
+not invent copy or media. It accepts title, short/long description, release
+notes, reviewer test instructions, support/privacy URLs, privacy/data-use
+declarations, distribution/payment designation, permissions and host
+justifications, screenshots, posters/feature graphics, and demo video.
+`package_path` and `expected_version` are required for package upload; the ZIP's
+`manifest.json` version must match before browser interaction begins.