browser-workspace 0.4.1 → 0.4.5

package/src/browser_workspace_app/platforms/chrome-web-store/actions/_chrome_web_store.py

@@ -0,0 +1,425 @@
+"""Chrome Web Store browser mechanics.
+
+This action contains no credentials and defaults to read-only/dry-run behavior.
+"""
+
+import json
+import re
+import time
+import zipfile
+
+
+CFG = json.load(open("__CFG_PATH__", encoding="utf-8"))
+ACTION = CFG["action"]
+ITEM_ID = CFG.get("item_id", "").strip()
+PRODUCT_NAME = CFG.get("product_name", "").strip()
+EXPECTED_VERSION = CFG.get("expected_version", "").strip()
+PUBLIC_LISTING_URL = CFG.get("public_listing_url", "").strip()
+LISTING_URL = CFG.get("listing_url", "").strip()
+COMMIT = bool(CFG.get("commit", False))
+ALLOW_EXTERNAL_SUBMIT = bool(CFG.get("allow_external_submit", False))
+
+CONSOLE_URL = "https://chromewebstore.google.com/devconsole"
+ALLOWED_ACTIONS = {
+    "open-item",
+    "resolve-item",
+    "create-item",
+    "verify-draft",
+    "save-draft",
+    "upload-package",
+    "update-listing",
+    "submit-review",
+    "check-status",
+    "verify-published",
+}
+STATES = {"draft", "submitted", "pending", "rejected", "published", "unknown"}
+
+
+def fail(message):
+    print(json.dumps({"action": ACTION, "status": "unknown", "error": message}))
+    raise SystemExit(2)
+
+
+def package_version(path):
+    try:
+        with zipfile.ZipFile(path) as package:
+            manifest = json.loads(package.read("manifest.json"))
+    except (OSError, KeyError, ValueError, zipfile.BadZipFile) as exc:
+        fail(f"invalid extension package: {exc}")
+    version = str(manifest.get("version", "")).strip()
+    if not version:
+        fail("package manifest is missing version")
+    return version
+
+
+def validate_package():
+    package = CFG.get("package_path", "").strip()
+    if not package:
+        fail("package_path is required")
+    if not EXPECTED_VERSION:
+        fail("expected_version is required")
+    observed = package_version(package)
+    if observed != EXPECTED_VERSION:
+        fail(f"package version {observed} does not match expected_version {EXPECTED_VERSION}")
+    return observed
+
+
+def evidence(status, **extra):
+    if status not in STATES:
+        fail(f"invalid evidence status: {status}")
+    record = {
+        "action": ACTION,
+        "status": status,
+        "item_id": ITEM_ID or None,
+        "url": page_info().get("url"),
+        **extra,
+    }
+    print(json.dumps(record, ensure_ascii=False))
+    return record
+
+
+def text_exists(needles):
+    values = json.dumps([n.lower() for n in needles])
+    return js(
+        """(() => {
+          const text = (document.body?.innerText || '').toLowerCase();
+          return %s.some(value => text.includes(value));
+        })()""" % values
+    ) is True
+
+
+def visible_version():
+    value = js("""(() => document.body?.innerText || '')()""") or ""
+    versions = re.findall(r"\b\d+\.\d+(?:\.\d+){1,2}\b", value)
+    return EXPECTED_VERSION if EXPECTED_VERSION in versions else (versions[0] if versions else None)
+
+
+def click_text(label):
+    wanted = label.lower()
+    return js(
+        """(() => {
+          const nodes = [...document.querySelectorAll('button,[role=button],a')];
+          const node = nodes.find(el => {
+            const text = (el.innerText || el.getAttribute('aria-label') || '').trim().toLowerCase();
+            return text === %r || text.includes(%r);
+          });
+          if (!node) return false;
+          node.click();
+          return true;
+        })()""" % (wanted, wanted)
+    ) is True
+
+
+def field_by_label(keys):
+    """Find a form control by its accessible/visible label, not generated IDs."""
+    return js(
+        """(() => {
+          const keys = %s;
+          const controls = [...document.querySelectorAll('input,textarea,select,[role=combobox],[contenteditable=true]')];
+          const labelText = (node) => {
+            const ids = (node.getAttribute('aria-labelledby') || '').split(/\\s+/).filter(Boolean);
+            const labelled = ids.map(id => document.getElementById(id)?.innerText || '').join(' ');
+            const explicit = node.id ? document.querySelector(`label[for="${CSS.escape(node.id)}"]`)?.innerText || '' : '';
+            const parent = node.closest('label')?.innerText || node.parentElement?.innerText || '';
+            return [node.getAttribute('aria-label'), node.getAttribute('placeholder'), node.name, node.id,
+                    labelled, explicit, parent].filter(Boolean).join(' ').toLowerCase();
+          };
+          const node = controls.find(node => keys.some(key => labelText(node).includes(key)));
+          return node?.id ? `#${CSS.escape(node.id)}` : null;
+        })()""" % json.dumps([key.lower() for key in keys])
+    )
+
+
+def require_publisher_login():
+    url = page_info().get("url", "")
+    if "accounts.google.com" in url or text_exists(["sign in", "log in"]):
+        fail("authenticated Chrome Web Store publisher login required")
+
+
+def publisher_id_from_url(url):
+    match = re.search(
+        r"https://(?:chrome\.google\.com/webstore/devconsole|chromewebstore\.google\.com/devconsole)/([^/]+)(?:/|$)",
+        url,
+    )
+    return match.group(1) if match else None
+
+
+def open_item():
+    if ACTION == "verify-published":
+        url = PUBLIC_LISTING_URL or ("https://chromewebstore.google.com/detail/" + ITEM_ID)
+    else:
+        url = LISTING_URL
+        if not url:
+            publisher_id = publisher_id_from_url(page_info().get("url", ""))
+            if not publisher_id:
+                # The canonical console URL redirects to the publisher-scoped
+                # dashboard. Resolve that scope before constructing an item
+                # route; the generic /store-item path redirects to the public
+                # store and cannot prove the requested item was opened.
+                goto_url(CONSOLE_URL)
+                wait_for_load()
+                require_publisher_login()
+                publisher_id = publisher_id_from_url(page_info().get("url", ""))
+            if not publisher_id:
+                fail("publisher-scoped developer console route not observed")
+            url = f"https://chrome.google.com/webstore/devconsole/{publisher_id}/{ITEM_ID}/edit"
+    # Browser automation can briefly expose more than one target for a
+    # requested URL. Reuse the harness-verified real tab instead of asking the
+    # browser controller to create another target; this keeps navigation stable
+    # without changing unrelated browser state.
+    if ensure_real_tab():
+        goto_url(url)
+    else:
+        # A fresh isolated browser may not have a usable page yet.
+        new_tab(url)
+    wait_for_load()
+    require_publisher_login()
+    if ITEM_ID and ITEM_ID not in page_info().get("url", ""):
+        fail("observed URL does not contain the requested item id")
+    return evidence("unknown", observed_item_id=ITEM_ID or None)
+
+
+def dashboard_candidates():
+    return js("""(() => [...document.querySelectorAll('a[href]')].map(node => ({href: node.href, text: (node.innerText || node.getAttribute('aria-label') || '').trim()})).filter(item => /\\/devconsole\\/[^/]+\\/[a-z]{32}/.test(item.href)))()""") or []
+
+
+def item_id_from_url(url):
+    match = re.search(r"/devconsole/[^/]+/([a-z]{32})/(?:edit|details)?(?:[/?#]|$)", url)
+    return match.group(1) if match else None
+
+
+def dashboard_item_version(item_id):
+    for candidate in dashboard_candidates():
+        if item_id in candidate.get("href", ""):
+            versions = re.findall(r"\b\d+\.\d+(?:\.\d+){1,2}\b", candidate.get("text", ""))
+            return versions[0] if versions else None
+    return None
+
+
+def open_dashboard():
+    goto_url(CONSOLE_URL)
+    wait_for_load()
+    require_publisher_login()
+
+
+def create_or_resolve_item():
+    global ITEM_ID
+    if ITEM_ID:
+        open_item()
+        return evidence("draft", observed_item_id=ITEM_ID, reused_item=True)
+    if not PRODUCT_NAME:
+        fail("product_name is required when item_id is not supplied")
+    open_dashboard()
+    wanted = PRODUCT_NAME.lower()
+    for candidate in dashboard_candidates():
+        if wanted in candidate.get("text", "").lower():
+            ITEM_ID = item_id_from_url(candidate.get("href", ""))
+            if ITEM_ID:
+                return evidence("draft", observed_item_id=ITEM_ID, reused_item=True, listing_url=candidate.get("href"))
+    if not COMMIT:
+        return evidence("draft", dry_run=True, would_create=True, product_name=PRODUCT_NAME)
+    create_item()
+    ITEM_ID = item_id_from_url(page_info().get("url", ""))
+    return evidence("draft", created_item=True, observed_item_id=ITEM_ID, package_version=EXPECTED_VERSION,
+                    browser_version=visible_version(), version_verification="reopen-required")
+
+
+def verify_draft():
+    validate_package()
+    open_item()
+    if not text_exists(["status: draft", "draft"]):
+        fail("draft status not observed after reopening exact item")
+    open_dashboard()
+    observed = dashboard_item_version(ITEM_ID)
+    if observed != EXPECTED_VERSION:
+        fail(f"reopened draft version {observed or 'unknown'} does not match expected_version {EXPECTED_VERSION}")
+    return evidence("draft", observed_item_id=ITEM_ID, observed_version=observed, exact_version_verified=True, reopened=True)
+
+
+def save_draft():
+    open_item()
+    if not click_text("Save draft") and not click_text("Save"):
+        fail("save draft control not observed")
+    return evidence("draft", saved=True, observed_item_id=ITEM_ID)
+
+
+def create_item():
+    observed_version = validate_package()
+    if not COMMIT:
+        return evidence("draft", dry_run=True, would_create=True,
+                        package_path=CFG["package_path"], package_version=observed_version)
+    goto_url(CONSOLE_URL)
+    wait_for_load()
+    require_publisher_login()
+    if not publisher_id_from_url(page_info().get("url", "")):
+        fail("publisher-scoped developer console route not observed")
+    if not click_text("New item") and not click_text("Add a new item"):
+        fail("new item control not observed")
+    upload_file("input[type=file]", CFG["package_path"].strip())
+    wait_for_load()
+    require_publisher_login()
+    if text_exists(["key field is not allowed"]):
+        fail("new item upload rejected: manifest key field is not allowed")
+    if text_exists(["there was a problem uploading your file"]):
+        fail("new item upload rejected by Chrome Web Store")
+    url = page_info().get("url", "")
+    match = re.search(r"/devconsole/[^/]+/([^/]+)/edit(?:$|[?#])", url)
+    if not match:
+        fail("created item editor route not observed")
+    return evidence("draft", created_item_id=match.group(1),
+                    package_version=observed_version, browser_version=visible_version())
+
+
+def upload_package():
+    package = CFG["package_path"].strip()
+    observed_version = validate_package()
+    if not COMMIT:
+        return evidence("draft", dry_run=True, would_upload=package, package_version=observed_version)
+    if not click_text("Package") and not click_text("Upload new package"):
+        fail("package upload control not observed")
+    upload_file("input[type=file]", package)
+    time.sleep(2)
+    browser_version = visible_version()
+    if browser_version != observed_version:
+        fail(f"uploaded package version {browser_version or 'unknown'} does not match expected_version {observed_version}")
+    return evidence("draft", uploaded_package=package, package_version=observed_version,
+                    browser_version=browser_version)
+
+
+def update_listing():
+    market = CFG.get("market_package") or {}
+    required = ["title", "short_description", "long_description", "support_url"]
+    missing = [key for key in required if not str(market.get(key, "")).strip()]
+    if missing:
+        fail("market_package missing: " + ", ".join(missing))
+    if not COMMIT:
+        return evidence("draft", dry_run=True, fields=sorted(market))
+    # Chrome's editor is a dynamic form. Use labels/aria names rather than
+    # brittle generated class names; the caller still receives observed evidence.
+    mapped = {key: market[key] for key in market if market[key] not in (None, "", [], {})}
+    selectors = {
+        "short_description": ["short description", "summary"],
+        "long_description": ["long description", "description"],
+        "release_notes": ["release notes", "what's new"],
+        "reviewer_test_instructions": ["reviewer", "test instructions"],
+        "support_url": ["support url", "support website"],
+        "privacy_policy_url": ["privacy policy", "privacy url"],
+        "privacy_practices": ["privacy practices", "privacy"],
+        "data_use": ["data use", "data usage"],
+        "distribution": ["distribution", "visibility"],
+        "payment": ["payment", "paid"],
+        "permissions": ["permissions", "permission justification"],
+        "host_permissions": ["host permissions", "host permission"],
+        "host_permission_justifications": ["host permission justification", "host permissions"],
+        "title": ["title", "name"],
+    }
+    for label, value in mapped.items():
+        if label in {"screenshots", "posters", "feature_graphic", "promotional_graphic", "demo_video"}:
+            continue
+        keys = selectors.get(label, [label.replace("_", " ")])
+        node = field_by_label(keys)
+        if not node and label in {"title", "short_description"}:
+            # Chrome may expose package-owned title/summary as read-only text.
+            # The caller supplied the factual value; verify other editable fields
+            # without trying to mutate package metadata through a nonexistent control.
+            continue
+        if not node:
+            fail(f"listing field not observed: {label}")
+        changed = js(
+            """(() => {
+              const node = document.querySelector(%s);
+              if (!node) return false;
+              node.focus();
+              if (node.type === 'checkbox' || node.type === 'radio') node.checked = Boolean(%s);
+              else if (node.tagName === 'SELECT') {
+                const wanted = String(%s).toLowerCase();
+                const option = [...node.options].find(item => (item.text || item.value).toLowerCase() === wanted);
+                if (!option) return false;
+                node.value = option.value;
+              } else if ('value' in node) node.value = %s;
+              else node.textContent = %s;
+              node.dispatchEvent(new Event('input', {bubbles: true}));
+              node.dispatchEvent(new Event('change', {bubbles: true}));
+              return true;
+            })()""" % (json.dumps(str(node)), json.dumps(bool(value)), json.dumps(str(value)),
+                           json.dumps(str(value)), json.dumps(str(value)))
+        )
+        if changed is not True:
+            fail(f"listing field not observed: {label}")
+    for field in ("screenshots", "posters", "feature_graphic", "promotional_graphic", "demo_video"):
+        for media in (mapped.get(field) if isinstance(mapped.get(field), list) else [mapped.get(field)]):
+            if media:
+                try:
+                    upload_file("input[type=file]", str(media))
+                except (OSError, RuntimeError) as exc:
+                    fail(f"listing media upload failed: {field}")
+    if not click_text("Save draft") and not click_text("Save"):
+        fail("save control not observed")
+    return evidence("draft", fields=sorted(mapped))
+
+
+def submit_review():
+    if not COMMIT or not ALLOW_EXTERNAL_SUBMIT:
+        return evidence("draft", blocked="explicit submit authorization required")
+    if not click_text("Submit for review"):
+        fail("submit-for-review control not observed")
+    time.sleep(2)
+    return evidence("submitted")
+
+
+def check_status():
+    if text_exists(["rejected", "needs changes"]):
+        return evidence("rejected", observed_version=visible_version())
+    if text_exists(["published", "public"]):
+        return evidence("published", observed_version=visible_version())
+    if text_exists(["submitted", "under review", "pending"]):
+        return evidence("pending", observed_version=visible_version())
+    return evidence("unknown", observed_version=visible_version())
+
+
+def verify_published():
+    url = page_info().get("url", "")
+    if not url.startswith("https://chromewebstore.google.com/detail/"):
+        return evidence("unknown", reason="public listing URL not observed")
+    if ITEM_ID and ITEM_ID not in url:
+        return evidence("unknown", reason="public URL does not match item id")
+    observed = visible_version()
+    if EXPECTED_VERSION and observed != EXPECTED_VERSION:
+        return evidence("unknown", reason="expected version not observed")
+    return evidence("published", expected_version=EXPECTED_VERSION or None, observed_version=observed)
+
+
+if ACTION not in ALLOWED_ACTIONS:
+    fail("unsupported action: " + ACTION)
+if ACTION in {"resolve-item", "create-item"}:
+    if ACTION == "create-item" and not (PRODUCT_NAME or ITEM_ID):
+        fail("product_name is required for create-item")
+    validate_package()
+    create_or_resolve_item()
+    raise SystemExit(0)
+if ACTION in {"verify-draft", "save-draft", "upload-package", "update-listing", "submit-review", "check-status", "verify-published"} and not ITEM_ID:
+    fail("item_id is required for this action")
+if ACTION == "open-item" and not (ITEM_ID or LISTING_URL):
+    fail("item_id or listing_url is required for open-item")
+if ACTION in {"create-item", "upload-package"}:
+    validate_package()
+
+if ACTION == "verify-draft":
+    verify_draft()
+    raise SystemExit(0)
+if ACTION == "save-draft":
+    save_draft()
+    raise SystemExit(0)
+if ACTION == "upload-package":
+    open_item()
+    upload_package()
+else:
+    open_item()
+if ACTION == "update-listing":
+    update_listing()
+elif ACTION == "submit-review":
+    submit_review()
+elif ACTION == "check-status":
+    check_status()
+elif ACTION == "verify-published":
+    verify_published()

package/src/browser_workspace_app/platforms/chrome-web-store/flows/check-status.md

@@ -0,0 +1,7 @@
+# Check status
+
+Status: `working` — platform action implemented; live account verification pending.
+
+Open the explicitly selected item and read the visible package/review status.
+Return the observed status and version, including any warning or rejection
+message. This flow is read-only.

package/src/browser_workspace_app/platforms/chrome-web-store/flows/open-item.md

@@ -0,0 +1,10 @@
+# Open item
+
+Status: `working` — platform action implemented; live account verification pending.
+
+Preconditions: an authenticated Chrome Web Store publisher session and an
+explicit item identifier or listing URL.
+
+Use Browser Workspace to open the publisher console, navigate to the selected
+item, and verify that the item title and identifier match the request. Do not
+change listing state.

package/src/browser_workspace_app/platforms/chrome-web-store/flows/submit-review.md

@@ -0,0 +1,10 @@
+# Submit review
+
+Status: `working` — platform action implemented; live account verification pending.
+
+Preconditions: the requested package and listing changes are complete, and the
+caller explicitly authorizes submission.
+
+Review the platform's final summary, confirm the selected item and version,
+submit once with `Browser Workspace`, and verify the resulting review/pending
+state. Never submit merely because a draft is valid.

package/src/browser_workspace_app/platforms/chrome-web-store/flows/update-listing.md

@@ -0,0 +1,18 @@
+# Update listing
+
+Status: `working` — platform action implemented; live account verification pending.
+
+Preconditions: an explicit item and exact listing fields to change.
+
+Open the item, edit only the approved Market Package fields with
+`Browser Workspace`, and verify the saved values in the publisher console.
+Supported field groups are:
+
+- title, short/long description, release notes, public/support URLs, and
+  reviewer test instructions;
+- screenshots, promotional/feature graphics (posters), and demo/preview video;
+- privacy practices, data-use declarations, distribution/payment designation;
+- permissions and host-permission justifications.
+
+Listing metadata changes are external side effects and must not be inferred
+from navigation success.

package/src/browser_workspace_app/platforms/chrome-web-store/flows/upload-package.md

@@ -0,0 +1,11 @@
+# Upload package
+
+Status: `working` — platform action implemented; live account verification pending.
+
+Preconditions: an explicit item, a locally available extension package, and
+confirmation that uploading it is intended.
+
+Open the item with `open-item`, use the platform's package upload control via
+`Browser Workspace`, and verify the displayed package/version against the
+approved release candidate before leaving the draft state. Uploading changes
+external state; do not submit for review here.

package/src/browser_workspace_app/platforms/chrome-web-store/flows/verify-published.md

@@ -0,0 +1,9 @@
+# Verify published
+
+Status: `working` — platform action implemented; live account verification pending.
+
+After the publisher console reports publication, open the public listing with
+`Browser Workspace` and verify the expected item identity, exact version, and
+visible listing fields. Treat the public page as the source of observed
+publication; do not infer it from a successful submit action. A submitted or
+pending review is not published evidence.

package/src/browser_workspace_app/platforms/chrome-web-store/manifest.yaml

@@ -0,0 +1,33 @@
+platform: chrome-web-store
+status: partially_verified
+last_verified: 2026-09-26
+actions:
+  chrome-web-store: "actions/_chrome_web_store.py"
+verification:
+  status: partially_verified
+  last_verified: 2026-09-26
+  evidence: "Live verification covers new-item draft creation/reopen plus Teammate and Family Tutor existing-item draft reopen/save regressions. Submit/review/publication lifecycle remains implemented but not live-verified."
+url_patterns:
+  - "https://chromewebstore.google.com/devconsole/*"
+  - "https://chrome.google.com/webstore/developer/dashboard*"
+authentication:
+  required: true
+  notes: "Use an already authenticated publisher browser context; never store credentials or browser state."
+side_effects:
+  - "upload-package changes a draft/package upload"
+  - "update-listing edits listing metadata"
+  - "submit-review sends a listing for review"
+provenance:
+  source: "Neo platform skeleton"
+  migrated_code: false
+flows:
+  resolve-item: {status: verified, evidence: "Live runs resolved and reopened the intended Browser Workspace, Teammate, and Family Tutor developer items."}
+  create-item: {status: verified, evidence: "Browser Workspace was created as a new developer item from a store-compatible package, then reopened at exact version 0.2.3."}
+  verify-draft: {status: verified, evidence: "Draft/version was verified after reopen; Teammate and Family Tutor existing-item drafts were also reopened successfully."}
+  save-draft: {status: verified, evidence: "Draft save/reopen was exercised on Browser Workspace plus existing-item regressions for Teammate and Family Tutor."}
+  open-item: {status: verified, evidence: "Publisher-scoped item navigation was exercised across the three real extension items."}
+  upload-package: {status: verified, evidence: "Initial package upload was exercised during real new-item creation."}
+  update-listing: {status: implemented_unverified, evidence: "Action maps approved Market Package fields, but complete live listing-field coverage has not been verified as a release gate."}
+  submit-review: {status: implemented_unverified, evidence: "Action requires commit plus explicit external-submit authorization; no real review submission has been performed by this verification."}
+  check-status: {status: implemented_unverified, evidence: "Read-only review/listing-state classification is implemented; post-submission external review states have not been live-verified."}
+  verify-published: {status: implemented_unverified, evidence: "Public exact-version verification is implemented; no authorized published listing lifecycle has been exercised by this verification."}

package/src/browser_workspace_app/platforms/chrome-web-store/tests/test_contract.py

@@ -0,0 +1,83 @@
+import importlib.util
+import json
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+MANIFEST = ROOT / "manifest.yaml"
+ACTION = ROOT / "actions" / "_chrome_web_store.py"
+
+
+def test_action_has_explicit_action_and_side_effect_guards():
+    source = ACTION.read_text(encoding="utf-8")
+    assert '"submit-review"' in source
+    assert "COMMIT" in source
+    assert "ALLOW_EXTERNAL_SUBMIT" in source
+    assert '"published"' in source
+    assert "page_info" in source
+    assert "package_version" in source
+    assert "allow_external_submit" in source
+    assert "screenshots" in source
+    assert "reviewer_test_instructions" in source
+    assert '"resolve-item"' in source
+    assert '"verify-draft"' in source
+    assert '"save-draft"' in source
+    assert "product_name" in source
+
+
+def test_manifest_covers_release_lifecycle_without_overstating_evidence():
+    text = MANIFEST.read_text(encoding="utf-8")
+    for flow in ("resolve-item", "create-item", "verify-draft", "save-draft", "open-item", "upload-package", "update-listing", "submit-review", "check-status", "verify-published"):
+        assert flow in text
+    assert "status: partially_verified" in text
+    assert "submit-review: {status: implemented_unverified" in text
+    assert "check-status: {status: implemented_unverified" in text
+    assert "verify-published: {status: implemented_unverified" in text
+    assert "no real review submission has been performed" in text
+
+
+def test_action_requires_exact_package_version_before_upload():
+    source = ACTION.read_text(encoding="utf-8")
+    assert "manifest.json" in source
+    assert "does not match expected_version" in source
+
+
+def test_action_reuses_harness_real_tab_for_stable_navigation():
+    source = ACTION.read_text(encoding="utf-8")
+    assert "ensure_real_tab()" in source
+    assert "goto_url(url)" in source
+
+
+def test_action_uses_accessible_labels_and_draft_save_control():
+    source = ACTION.read_text(encoding="utf-8")
+    assert "aria-labelledby" in source
+    assert "label[for=" in source
+    assert "Save draft" in source
+
+
+def test_action_derives_publisher_scoped_item_route():
+    source = ACTION.read_text(encoding="utf-8")
+    assert "publisher_id_from_url" in source
+    assert 'f"https://chrome.google.com/webstore/devconsole/{publisher_id}/{ITEM_ID}/edit"' in source
+
+
+def test_action_bootstraps_publisher_scope_before_item_navigation():
+    source = ACTION.read_text(encoding="utf-8")
+    assert 'goto_url(CONSOLE_URL)' in source
+    assert 'publisher-scoped developer console route not observed' in source
+    assert 'CONSOLE_URL + f"/store-item/{ITEM_ID}"' not in source
+
+
+def test_action_supports_dry_run_new_item_creation():
+    source = ACTION.read_text(encoding="utf-8")
+    assert '"create-item"' in source
+    assert 'would_create=True' in source
+    assert 'created item editor route not observed' in source
+    assert 'manifest key field is not allowed' in source
+
+
+def test_action_reuses_observed_item_before_creating():
+    source = ACTION.read_text(encoding="utf-8")
+    assert "dashboard_candidates" in source
+    assert "reused_item=True" in source
+    assert "exact_version_verified=True" in source

package/src/browser_workspace_app/platforms/microsoft-teams/README.md

@@ -0,0 +1,32 @@
+---
+name: microsoft-teams-platform
+description: Microsoft Teams browser mechanics and verified meeting flows.
+---
+
+# Microsoft Teams
+
+This platform defines site behavior only. Execution lifecycle and isolation are external to platform code.
+
+## Canonical instant-meeting path
+
+For automated meeting E2E, use exactly:
+
+`left sidebar Calendar -> Meet now -> Start meeting (when shown) -> pre-join -> Join now -> in-call`
+
+Do not substitute a Join button from an existing chat or calendar event when the caller asks to create an instant meeting.
+
+## Actions
+
+Canonical action source: `actions/_meeting.py`.
+
+Supported config actions:
+
+- `start-instant-meeting`: open Teams, follow the canonical path, and verify in-call state.
+- `status`: report whether the active Teams page is in pre-join or in-call.
+- `leave`: leave the active meeting when one is in progress.
+
+If Teams reports that the account is already in another call and the requested instant meeting cannot reach pre-join, fail with evidence rather than manipulating unrelated tabs.
+
+## Verification
+
+See `manifest.yaml`. The instant-meeting path, in-call detection, and exit were live-verified on 2026-10-01.