cascade-ai 0.77.0 → 0.79.0

package/dist/desktop-core.cjs

@@ -312562,7 +312562,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.77.0";
+var CASCADE_VERSION = "0.79.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -319144,15 +319144,15 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
         if (!choice.logprobs) {
           choice.logprobs = Object.assign({}, logprobs);
         } else {
-          const { content: content2, refusal: refusal2, ...rest3 } = logprobs;
+          const { content: content2, refusal: refusal3, ...rest3 } = logprobs;
           Object.assign(choice.logprobs, rest3);
           if (content2) {
             (_a5 = choice.logprobs).content ?? (_a5.content = []);
             choice.logprobs.content.push(...content2);
           }
-          if (refusal2) {
+          if (refusal3) {
             (_b = choice.logprobs).refusal ?? (_b.refusal = []);
-            choice.logprobs.refusal.push(...refusal2);
+            choice.logprobs.refusal.push(...refusal3);
           }
         }
       }
@@ -319170,10 +319170,10 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
       Object.assign(choice, other);
       if (!delta)
         continue;
-      const { content, refusal, function_call, role, tool_calls, ...rest2 } = delta;
+      const { content, refusal: refusal2, function_call, role, tool_calls, ...rest2 } = delta;
       Object.assign(choice.message, rest2);
-      if (refusal) {
-        choice.message.refusal = (choice.message.refusal || "") + refusal;
+      if (refusal2) {
+        choice.message.refusal = (choice.message.refusal || "") + refusal2;
       }
       if (role)
         choice.message.role = role;
@@ -346971,6 +346971,45 @@ var ToolsConfigSchema = external_exports.object({
   shellBlocklist: external_exports.array(external_exports.string()).default(["rm -rf", "sudo rm", "format", "mkfs"]),
   requireApprovalFor: external_exports.array(external_exports.string()).default([]),
   browserEnabled: external_exports.boolean().default(false),
+  /**
+   * Let a run ACT on the page open in the desktop's built-in browser — click,
+   * type, submit — not just read it.
+   *
+   * Distinct from `browserEnabled`, which turns on the headless Playwright
+   * tool. That one drives a throwaway browser with an empty cookie jar; this
+   * one drives the session the user is signed into, which is a different order
+   * of consequence and so gets its own switch rather than riding on that one.
+   *
+   * Off by default. Turning it on does not hand anything over silently: the
+   * tool still goes through the approval chain, and the browser panel carries a
+   * stop control for the run that is acting.
+   */
+  agentBrowserControl: external_exports.boolean().default(false),
+  /**
+   * Where a HOSTED run gets a browser, since it has none of its own.
+   *
+   * The desktop drives the Chromium the user is signed into and can watch. A
+   * server has neither, and running one inside the container is wrong twice
+   * over — page JavaScript issues requests no URL check ever sees, from inside
+   * the trust boundary, and a session costs 200-400 MB. So this points at a
+   * browser somebody else runs.
+   *
+   * Absent by default: no provider, no capability. There is nothing to turn
+   * off because nothing is registered until an endpoint is supplied.
+   */
+  remoteBrowser: external_exports.object({
+    /** `cdp` for an endpoint you run; `steel` for a Steel deployment. */
+    provider: external_exports.enum(["cdp", "steel"]).optional(),
+    /** The websocket endpoint for `cdp`, or the API base for `steel`. */
+    url: external_exports.string().optional(),
+    apiKey: external_exports.string().optional(),
+    /**
+     * Concurrent sessions. One by default and deliberately so: every session
+     * is billed, and a wave of workers each opening their own is a cost the
+     * user did not choose. Raising it is a decision, not a default.
+     */
+    maxSessions: external_exports.number().int().min(1).max(16).default(1)
+  }).optional(),
   mcpServers: external_exports.array(McpServerConfigSchema).optional(),
   mcpTrusted: external_exports.array(external_exports.string()).optional(),
   /** Web search backends — at least one should be configured for best results */
@@ -351755,6 +351794,23 @@ Now execute your subtask using this context where relevant.`
       this.setStatus("FAILED", finalOutput);
       this.peerBus?.publish(this.id, assignment.subtaskId, finalOutput, "FAILED");
       return this.buildResult("ESCALATED", finalOutput, { checksRun, passed, failed }, issues, correctionAttempts);
+    } finally {
+      this.releaseBrowserControl();
+    }
+  }
+  /**
+   * End this worker's hold on the shared browser.
+   *
+   * Duck-typed rather than imported: `browser_control` is registered only by a
+   * host that HAS a browser (the desktop), so in the CLI and hosted runs there
+   * is no such tool and this is a no-op. Importing the class to instanceof-check
+   * it would couple the worker to a tool that usually is not there.
+   */
+  releaseBrowserControl() {
+    try {
+      const tool = this.toolRegistry.getTool?.("browser_control");
+      tool?.releaseActor?.(this.id);
+    } catch {
     }
   }
   sendToPeer(toId, content) {
@@ -397857,6 +397913,127 @@ var CurrentPageTool = class extends BaseTool {
   }
 };
 
+// src/tools/browser-control.ts
+var BrowserControlTool = class extends BaseTool {
+  name = "browser_control";
+  description = "Act on the web page the user has open in the built-in browser: navigate, click an element, type into a field, press a key, or wait for something to appear. This drives the REAL browser the user is signed into and can see, so actions have real consequences \u2014 prefer read_current_page when you only need to look. CSS selectors are matched against the live page; call extract_text first if you need to find one. There is one browser: if another part of this run is using it, this call waits its turn, so a slow reply means queued, not stuck.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["navigate", "click", "fill", "press", "wait_for", "extract_text"],
+        description: "What to do."
+      },
+      url: { type: "string", description: "For navigate: the http(s) address to open." },
+      selector: {
+        type: "string",
+        description: "CSS selector for click, fill and wait_for. Optional for extract_text (defaults to the whole page)."
+      },
+      value: { type: "string", description: "For fill: the text to type." },
+      key: { type: "string", description: 'For press: a key name such as "Enter", "Tab" or "Escape".' },
+      timeoutMs: { type: "number", description: "For wait_for: how long to wait before giving up (default 10000, max 30000)." }
+    },
+    required: ["action"]
+  };
+  controller;
+  release;
+  /** One-way. See `revoke`. */
+  revoked = false;
+  constructor(controller, release) {
+    super();
+    this.controller = controller;
+    this.release = release;
+  }
+  /**
+   * A worker has finished. Ends its hold on the browser.
+   *
+   * Called from the tier's terminal path rather than by the model, because a
+   * model cannot be relied on to announce that it is done — which is why the
+   * host cannot use idle time as the boundary instead.
+   */
+  releaseActor(actorId) {
+    this.release?.(actorId);
+  }
+  /**
+   * Permanently disable this tool, whatever the registry still holds.
+   *
+   * Registration-time gates cannot express "this run turned out to be
+   * unattended": a host that wires the controller and only then declares the
+   * run unattended has already registered the tool, and a check that ran at
+   * registration has no second chance. Enforcing at EXECUTION time makes the
+   * guarantee independent of call order, which is the whole point of stating
+   * the invariant rather than relying on the scheduler's current sequence.
+   *
+   * One-way on purpose. A safety gate that can be re-opened by a later call is
+   * a gate that a refactor re-opens by accident.
+   */
+  revoke() {
+    this.revoked = true;
+  }
+  // Acting on a session the user is signed into is the highest-consequence
+  // thing in the tool set — higher than shell, arguably, because the blast
+  // radius is someone else's server rather than this machine.
+  isDangerous() {
+    return true;
+  }
+  async execute(input, options) {
+    if (this.revoked) {
+      return "Error: browser control is not available in this run. It requires a person watching who can stop it, and nobody is.";
+    }
+    const kind2 = input["action"];
+    if (!kind2) return "Error: action is required.";
+    if (options?.signal?.aborted) return "Error: the run was cancelled before this action ran.";
+    const missing = requiredFieldFor(kind2, input);
+    if (missing) return `Error: "${kind2}" needs ${missing}.`;
+    const action = {
+      kind: kind2,
+      ...typeof input["url"] === "string" ? { url: input["url"] } : {},
+      ...typeof input["selector"] === "string" ? { selector: input["selector"] } : {},
+      ...typeof input["value"] === "string" ? { value: input["value"] } : {},
+      ...typeof input["key"] === "string" ? { key: input["key"] } : {},
+      ...typeof input["timeoutMs"] === "number" ? { timeoutMs: Math.min(Math.max(input["timeoutMs"], 0), 3e4) } : {}
+    };
+    let outcome;
+    try {
+      outcome = await this.controller(action, {
+        // `sessionId` is the run. The host scopes both revocation and its
+        // single-owner lease on it, so passing it is not telemetry — drop it
+        // and a Stop in one run silently stops every later one.
+        sessionId: options?.sessionId ?? "",
+        actorId: options?.tierId ?? options?.sessionId ?? "",
+        ...options?.signal ? { signal: options.signal } : {}
+      });
+    } catch (err) {
+      return `Error: the browser could not perform "${kind2}" \u2014 ${err instanceof Error ? err.message : String(err)}`;
+    }
+    const where = outcome.url ? `
+Page: ${outcome.title ? `${outcome.title} \u2014 ` : ""}${outcome.url}` : "";
+    return `${outcome.ok ? "" : "Failed: "}${outcome.detail}${where}`;
+  }
+};
+function requiredFieldFor(kind2, input) {
+  const has2 = (k4) => typeof input[k4] === "string" && input[k4].length > 0;
+  const given = (k4) => typeof input[k4] === "string";
+  switch (kind2) {
+    case "navigate":
+      return has2("url") ? null : "a url";
+    case "click":
+      return has2("selector") ? null : "a selector";
+    case "fill":
+      return has2("selector") ? given("value") ? null : "a value" : "a selector";
+    case "press":
+      return has2("key") ? null : "a key";
+    case "wait_for":
+      return has2("selector") ? null : "a selector";
+    // extract_text works with or without a selector.
+    case "extract_text":
+      return null;
+    default:
+      return null;
+  }
+}
+
 // src/core/cascade.ts
 var ESCALATION_DECISION_TIMEOUT_MS = 5 * 6e4;
 function buildContextualPrompt(prompt, history = []) {
@@ -398349,6 +398526,79 @@ ${input}` }],
     if ((this.config.tools?.disabledTools ?? []).includes("read_current_page")) return;
     this.toolRegistry.register(new CurrentPageTool(provider));
   }
+  /**
+   * True when nobody is watching this run — a scheduled/cron task, which
+   * auto-approves every tool because there is no one to ask.
+   *
+   * That auto-approval is fine for ordinary tools and disqualifying for this
+   * one: `browser_control` drives the signed-in browser, and "every run asks
+   * first" is the promise the Settings copy makes. The property used to hold
+   * only because `runScheduledTask` happens not to call `setBrowserController`
+   * — a guarantee resting on an ABSENT call, which is exactly what a later
+   * refactor adds without noticing. Stated and enforced instead.
+   */
+  unattended = false;
+  /**
+   * Declare that no human is watching this run, so capabilities that depend on
+   * a person being able to see and stop them are refused outright.
+   */
+  setUnattended(on) {
+    this.unattended = on;
+    if (!on) return;
+    const tool = this.toolRegistry.getTool("browser_control");
+    tool?.revoke?.();
+  }
+  /**
+   * Wire the host's browser so a run can ACT on the open page, not just read it.
+   *
+   * Two gates before this registers anything, and both matter:
+   *
+   *   - `tools.agentBrowserControl` must be on. Unlike read_current_page, which
+   *     reaches nothing the user has not already opened themselves, this drives
+   *     the session they are signed into. That is opt-in, not a default.
+   *   - `disabledTools` still removes it, the same as every other tool.
+   *   - The run must not be UNATTENDED. See `setUnattended`.
+   *
+   * Host-supplied like the page provider: the tool exists only where there is a
+   * real browser to drive, so it never has to be refused in the CLI or a hosted
+   * run — it is simply not there.
+   */
+  setBrowserController(controller, release) {
+    this.registerBrowserControl(controller, release, this.config.tools?.agentBrowserControl === true);
+  }
+  /**
+   * Wire a REMOTE browser — one the host connects to rather than one the user
+   * is signed into.
+   *
+   * A separate entry point because the enablement is a different question, and
+   * conflating them made the hosted capability dead on arrival: this went out
+   * calling `setBrowserController`, which gates on `agentBrowserControl`, and
+   * that flag means "drive the browser I am signed into on this machine". It
+   * defaults to false and has no meaning on a server, so the hosted tool was
+   * never registered at all — the feature looked shipped and did nothing.
+   *
+   * Configuring a provider IS the opt-in here. It takes a deliberate act with
+   * an endpoint and usually a paid account, and the browser it reaches is a
+   * throwaway signed into nothing — a smaller consent than handing over the
+   * session the user is already authenticated in, and one the desktop flag
+   * cannot stand in for.
+   */
+  setRemoteBrowserController(controller, release) {
+    this.registerBrowserControl(controller, release, Boolean(this.config.tools?.remoteBrowser?.provider));
+  }
+  /**
+   * The gates every surface shares, with only enablement differing.
+   *
+   * One place, because the two callers above are exactly the sibling-writer
+   * shape that has already drifted twice in this feature: a rule added to one
+   * and not the other is silent on the surface that missed it.
+   */
+  registerBrowserControl(controller, release, enabled) {
+    if (this.unattended) return;
+    if (!enabled) return;
+    if ((this.config.tools?.disabledTools ?? []).includes("browser_control")) return;
+    this.toolRegistry.register(new BrowserControlTool(controller, release));
+  }
   registerMediaTools(workspacePath) {
     const denied = new Set(this.config.tools?.disabledTools ?? []);
     const permitted = (name) => !denied.has(name);
@@ -398954,6 +399204,7 @@ ${prompt}` : prompt;
     this.router.setRunSignal(options.signal);
     const startMs = Date.now();
     const taskId = crypto2.randomUUID();
+    this.emit("run:started", { taskId });
     this.decisionLog = [];
     this.currentRunCompleted = [];
     this.wroteCheckpointThisRun = false;
@@ -399689,6 +399940,20 @@ function applySettingsPayload(config2, data) {
     if (data.webSearch.tavilyApiKey) next.tavilyApiKey = data.webSearch.tavilyApiKey;
     config2.tools.webSearch = next;
   }
+  if (data.remoteBrowser && typeof data.remoteBrowser === "object") {
+    const prior = config2.tools.remoteBrowser ?? {};
+    const next = { ...prior };
+    if (data.remoteBrowser.provider === "cdp" || data.remoteBrowser.provider === "steel") {
+      next.provider = data.remoteBrowser.provider;
+    }
+    if (typeof data.remoteBrowser.url === "string") next.url = data.remoteBrowser.url.trim() || void 0;
+    if (data.remoteBrowser.apiKey) next.apiKey = data.remoteBrowser.apiKey;
+    const n8 = data.remoteBrowser.maxSessions;
+    if (typeof n8 === "number" && Number.isFinite(n8)) {
+      next.maxSessions = Math.min(Math.max(Math.floor(n8), 1), 16);
+    }
+    config2.tools.remoteBrowser = next;
+  }
   if (data.advanced && typeof data.advanced === "object") {
     const a2 = data.advanced;
     const num = (v6, min, max) => {
@@ -399719,6 +399984,7 @@ function applySettingsPayload(config2, data) {
     if (["auto", "T1", "T2", "T3"].includes(a2["forceTier"])) config2.routing = { ...config2.routing ?? {}, forceTier: a2["forceTier"] };
     if (typeof a2["benchmarksLive"] === "boolean") config2.benchmarks = { ...config2.benchmarks ?? {}, live: a2["benchmarksLive"] };
     if (["isolate", "worker", "auto"].includes(a2["dynamicToolSandbox"])) config2.tools = { ...config2.tools ?? {}, dynamicToolSandbox: a2["dynamicToolSandbox"] };
+    if (typeof a2["agentBrowserControl"] === "boolean") config2.tools = { ...config2.tools ?? {}, agentBrowserControl: a2["agentBrowserControl"] };
     if (typeof a2["factsExtraction"] === "boolean") config2.knowledge = { ...config2.knowledge ?? {}, factsExtraction: a2["factsExtraction"] };
     if (typeof a2["rememberSessions"] === "boolean") config2.memory = { ...config2.memory ?? {}, rememberSessions: a2["rememberSessions"] };
     if (typeof a2["enableToolCreation"] === "boolean") config2.enableToolCreation = a2["enableToolCreation"];
@@ -399734,6 +400000,7 @@ function settingsSnapshot(config2) {
     if (p3?.type && p3?.baseUrl && p3.type !== "azure") endpoints[p3.type] = p3.baseUrl;
   }
   const ws2 = config2.tools?.webSearch ?? {};
+  const rb = config2.tools?.remoteBrowser ?? {};
   return {
     models: config2.models ?? {},
     budget: {
@@ -399763,6 +400030,15 @@ function settingsSnapshot(config2) {
       hasBraveKey: typeof ws2.braveApiKey === "string" && ws2.braveApiKey.length > 0,
       hasTavilyKey: typeof ws2.tavilyApiKey === "string" && ws2.tavilyApiKey.length > 0
     },
+    // `hasApiKey`, never the key. The panel needs to show whether one is set;
+    // sending the value back would put a live credential in every settings
+    // response, where it reaches any client that can read them.
+    remoteBrowser: {
+      provider: rb.provider,
+      url: rb.url,
+      hasApiKey: typeof rb.apiKey === "string" && rb.apiKey.length > 0,
+      maxSessions: rb.maxSessions
+    },
     advanced: {
       autonomy: config2.autonomy,
       planApproval: config2.planApproval,
@@ -399776,6 +400052,7 @@ function settingsSnapshot(config2) {
       forceTier: config2.routing?.forceTier,
       benchmarksLive: config2.benchmarks?.live,
       dynamicToolSandbox: config2.tools?.dynamicToolSandbox,
+      agentBrowserControl: config2.tools?.agentBrowserControl,
       factsExtraction: config2.knowledge?.factsExtraction,
       rememberSessions: config2.memory?.rememberSessions,
       enableToolCreation: config2.enableToolCreation,
@@ -401064,6 +401341,14 @@ var DashboardServer = class {
    * always failing.
    */
   currentPageProvider;
+  /**
+   * Supplied by the desktop shell so a run can ACT on that page — click, type,
+   * submit — not just read it. Same reasoning as the provider above: absent in
+   * the CLI, so the tool is not registered rather than present and failing.
+   * Cascade applies the `tools.agentBrowserControl` gate on top of this.
+   */
+  browserController;
+  browserActorRelease;
   activeControllers = /* @__PURE__ */ new Map();
   /**
    * Run taskIds per chat session — file snapshots are keyed by the run's
@@ -401125,6 +401410,7 @@ var DashboardServer = class {
     });
     this.socket.onConfigUpdate(async (data) => {
       const result = await commitSettings(this.config, data, (committed) => this.persistConfig(committed));
+      if (result.ok) this.settingsChangeHook?.(this.config);
       const refused = result.refused.map((r4) => ({
         type: r4.type,
         reason: r4.reason,
@@ -401148,6 +401434,7 @@ var DashboardServer = class {
       const cascade = new Cascade(cfg, this.workspacePath, this.store);
       this.activeSessions.set(sessionId, cascade);
       if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
+      if (this.browserController) cascade.setBrowserController(this.browserController, this.browserActorRelease);
       cascade.on("stream:token", (e3) => {
         this.emitToSessionClients(socketId, sessionId, "stream:token", { sessionId, tierId: e3.tierId, text: e3.text, primary: e3.primary });
       });
@@ -401171,13 +401458,16 @@ var DashboardServer = class {
         if (ev.requestId) this.clearPendingEscalation(ev.requestId);
         this.emitToSessionClients(socketId, sessionId, "escalation:timeout", { sessionId, ...e3 });
       });
+      cascade.on("run:started", (e3) => {
+        const id = e3.taskId;
+        if (id) this.recordSessionTask(sessionId, id);
+      });
       try {
         const result = await cascade.run({
           prompt: runPrompt,
           signal: abortController.signal,
           approvalCallback: this.makeApprovalCallback(sessionId)
         });
-        this.recordSessionTask(sessionId, result.taskId);
         this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
         this.captureWhy(sessionId, cascade, result);
         this.emitToSessionClients(socketId, sessionId, "session:complete", { sessionId, result });
@@ -401243,6 +401533,49 @@ var DashboardServer = class {
   setCurrentPageProvider(provider) {
     this.currentPageProvider = provider;
   }
+  /** Let runs act on that view, not just read it (desktop only). */
+  setBrowserController(controller, release) {
+    this.browserController = controller;
+    this.browserActorRelease = release;
+  }
+  /**
+   * Told whenever settings are committed through THIS server.
+   *
+   * Settings reach the live config by two routes — the desktop's Electron IPC
+   * handler and this server's `config:update` socket — and both run the same
+   * `commitSettings`. The desktop mirrors `tools.agentBrowserControl` into its
+   * browser module after its own route, but had no way to learn about the
+   * other, so a socket write left the module's copy stale: an enable the module
+   * still refused, or worse a disable the module still honoured for a run
+   * already holding the tool. This is the same sibling-writer drift
+   * `settings-payload.ts` exists to prevent, one layer up.
+   */
+  settingsChangeHook;
+  onSettingsChanged(hook) {
+    this.settingsChangeHook = hook;
+  }
+  /**
+   * Told when a run ends, so a host holding run-scoped state can release it.
+   *
+   * The desktop uses this to retire a run's browser Stop control: that has to
+   * outlive each individual action (the gap between two actions is when the
+   * user most wants it) but must not outlive the run.
+   */
+  /**
+   * Fired when a run ends, carrying BOTH identifiers explicitly.
+   *
+   * They are different things and conflating them was a live bug: a chat
+   * `sessionId` can contain many runs (hence `sessionTaskIds`), while
+   * `Cascade.run()` mints a fresh random `taskId` per run — and it is the
+   * taskId that tools see as `ToolExecuteOptions.sessionId`. Passing only the
+   * chat id meant browser cleanup keyed on the task id matched nothing, so a
+   * finished run kept its Stop banner armed and held its browser lease until
+   * the deadlock ceiling.
+   */
+  runEndedHook;
+  onRunEnded(hook) {
+    this.runEndedHook = hook;
+  }
   async start() {
     const isLoopback = this.host === "127.0.0.1" || this.host === "::1" || this.host === "localhost";
     if (!isLoopback) {
@@ -401433,6 +401766,8 @@ var DashboardServer = class {
   }
   /** Record run end: the assistant reply (when there is one) and the runtime row's final status. */
   persistRunEnd(sessionId, title, latestPrompt, reply, status, result) {
+    const endedTaskId = result?.taskId ?? this.sessionTaskIds.get(sessionId)?.at(-1);
+    this.runEndedHook?.({ sessionId, ...endedTaskId ? { taskId: endedTaskId } : {} });
     try {
       if (reply && reply.trim()) {
         this.store.addMessage({ id: crypto2.randomUUID(), sessionId, role: "assistant", content: reply, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
@@ -401526,6 +401861,7 @@ var DashboardServer = class {
     const prompt = task.prompt;
     const title = this.persistRunStart(sessionId, `[${task.name}] ${prompt}`);
     const cascade = new Cascade(this.config, task.workspacePath ?? this.workspacePath, this.store);
+    cascade.setUnattended(true);
     this.activeSessions.set(sessionId, cascade);
     cascade.on("tier:status", (e3) => {
       this.socket.broadcast("tier:status", { sessionId, ...e3 });
@@ -401533,13 +401869,16 @@ var DashboardServer = class {
     cascade.on("peer:message", (e3) => {
       this.socket.emitPeerMessage(e3);
     });
+    cascade.on("run:started", (e3) => {
+      const id = e3.taskId;
+      if (id) this.recordSessionTask(sessionId, id);
+    });
     try {
       const result = await cascade.run({
         prompt,
         identityId: task.identityId,
         approvalCallback: async () => ({ approved: true, always: false })
       });
-      this.recordSessionTask(sessionId, result.taskId);
       this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
       this.captureWhy(sessionId, cascade, result);
       this.socket.broadcast("session:complete", { sessionId, result });
@@ -402172,6 +402511,7 @@ ${prompt}`;
         const cascade = new Cascade(this.config, this.workspacePath, this.store);
         this.activeSessions.set(sessionId, cascade);
         if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
+        if (this.browserController) cascade.setBrowserController(this.browserController, this.browserActorRelease);
         cascade.on("stream:token", (e3) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e3.tierId, text: e3.text, primary: e3.primary });
         });
@@ -402195,13 +402535,16 @@ ${prompt}`;
           if (ev.requestId) this.clearPendingEscalation(ev.requestId);
           this.socket.broadcastToRoom(`session:${sessionId}`, "escalation:timeout", { sessionId, ...e3 });
         });
+        cascade.on("run:started", (e3) => {
+          const id = e3.taskId;
+          if (id) this.recordSessionTask(sessionId, id);
+        });
         try {
           const result = await cascade.run({
             prompt: runPrompt,
             identityId: body.identityId,
             approvalCallback: this.makeApprovalCallback(sessionId)
           });
-          this.recordSessionTask(sessionId, result.taskId);
           this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
           this.captureWhy(sessionId, cascade, result);
           this.socket.broadcast("cost:update", {
@@ -402590,6 +402933,694 @@ async function discoverMcpTools(servers) {
   return results;
 }
 
+// src/browser/lease.ts
+var LEASE_DEADLOCK_CEILING_MS = 3e5;
+var QUEUE_WAIT_MS = 18e4;
+var MAX_QUEUED = 8;
+var ACTION_HANDOFF_MS = 2e3;
+var ACTION_HANDOFF_POLL_MS = 25;
+var BrowserLease = class {
+  actor = null;
+  session = null;
+  ceilingTimer = null;
+  waiting = [];
+  lifecycleWired = false;
+  /**
+   * The action holding the browser, if any.
+   *
+   * Needed alongside the lease for a reason the lease cannot cover: the lease
+   * is RE-ENTRANT for its holder — that is what makes a sequence a sequence —
+   * so nothing in it stops ONE actor running two actions at once. A retry
+   * racing the call it retried is exactly that shape.
+   *
+   * A symbol because it identifies the individual call: only the action that
+   * took the slot may release it.
+   */
+  action = null;
+  isRevoked;
+  onChange;
+  constructor(options = {}) {
+    this.isRevoked = options.isRevoked ?? (() => false);
+    this.onChange = options.onChange ?? (() => {
+    });
+  }
+  get holderActor() {
+    return this.actor;
+  }
+  get holderSession() {
+    return this.session;
+  }
+  get queueDepth() {
+    return this.waiting.length;
+  }
+  get actionInFlight() {
+    return this.action !== null;
+  }
+  /**
+   * Declare that this host reports worker terminal states.
+   *
+   * When it does, timers stop being ownership boundaries entirely. When it does
+   * not — an embedder that wired a controller but not the release — the
+   * fallbacks stay, because something has to break a deadlock.
+   */
+  setLifecycleReleaseWired(on) {
+    this.lifecycleWired = on;
+  }
+  /**
+   * Take the browser for this actor, waiting in line if someone else holds it.
+   *
+   * Re-entrant for the actor that already holds it: that is the sequence case —
+   * the same worker coming back for its next step must not queue behind itself.
+   */
+  async acquire(actorId, sessionId, signal) {
+    if (this.actor === null || this.actor === actorId) {
+      this.actor = actorId;
+      this.session = sessionId;
+      this.armCeiling();
+      return "granted";
+    }
+    if (this.waiting.length >= MAX_QUEUED) return "busy";
+    return this.enqueue(actorId, sessionId, signal);
+  }
+  /**
+   * One worker has finished its whole sequence, so its hold ends.
+   *
+   * THIS is the semantic release. It comes from the worker's own terminal path,
+   * so it means "this actor will never ask again" — which a timer can never
+   * mean about a worker that is merely thinking.
+   *
+   * Idempotent, and safe for an actor that never touched the browser.
+   */
+  actorEnded(actorId) {
+    if (!actorId) return;
+    for (let i4 = this.waiting.length - 1; i4 >= 0; i4--) {
+      const w2 = this.waiting[i4];
+      if (w2.actorId === actorId) w2.settle("cancelled");
+    }
+    this.releaseIfHeldBy(actorId);
+    this.onChange();
+  }
+  /**
+   * Give the browser up when about to return without using it.
+   *
+   * Two guards, both load-bearing. Never while an action is in flight, because
+   * the lease is RE-ENTRANT: the action still running may be this same actor's
+   * previous step, and taking the lease off it hands the page to a queued
+   * worker mid-sequence. And only while still the holder, because by the time a
+   * refusal path runs a Stop may already have handed the lease on.
+   */
+  releaseIfHeldBy(actorId) {
+    if (this.action) return;
+    if (this.actor === actorId) this.release();
+  }
+  /** Drop every queued waiter belonging to a run, and the lease if it holds it. */
+  dropRun(sessionId) {
+    for (let i4 = this.waiting.length - 1; i4 >= 0; i4--) {
+      const w2 = this.waiting[i4];
+      if (w2.sessionId === sessionId) w2.settle("cancelled");
+    }
+    if (this.session === sessionId) this.release();
+  }
+  /** Turn everyone away — the capability itself has gone. */
+  dropAll() {
+    for (let i4 = this.waiting.length - 1; i4 >= 0; i4--) this.waiting[i4].settle("off");
+  }
+  /** Hand the browser to the next actor in line, if any. */
+  release() {
+    this.clearCeiling();
+    this.actor = null;
+    this.session = null;
+    let next = this.waiting.shift();
+    while (next && this.isRevoked(next.sessionId)) {
+      next.settle("cancelled");
+      next = this.waiting.shift();
+    }
+    if (next) {
+      this.actor = next.actorId;
+      this.session = next.sessionId;
+      this.armCeiling();
+      next.settle("granted");
+    }
+    this.onChange();
+  }
+  /** Arm the deadlock ceiling. Not a release schedule — see the constant. */
+  armCeiling() {
+    this.clearCeiling();
+    if (this.lifecycleWired) return;
+    this.ceilingTimer = setTimeout(() => this.release(), LEASE_DEADLOCK_CEILING_MS);
+    this.ceilingTimer.unref?.();
+  }
+  clearCeiling() {
+    if (this.ceilingTimer) {
+      clearTimeout(this.ceilingTimer);
+      this.ceilingTimer = null;
+    }
+  }
+  /** Take the per-action slot, or null when one is already running. */
+  beginAction() {
+    if (this.action) return null;
+    const token = /* @__PURE__ */ Symbol("browser-action");
+    this.action = token;
+    return token;
+  }
+  /** Release the slot, but only for the action that took it. */
+  endAction(token) {
+    if (this.action !== token) return false;
+    this.action = null;
+    return true;
+  }
+  /**
+   * Wait, briefly, for an outgoing action to unwind.
+   *
+   * A release can hand the browser on while the previous holder's abort is
+   * still propagating through an awaited navigation. That is a handoff, not a
+   * conflict, so it is waited out rather than refused — but bounded, because a
+   * wedged action must not pin the queue.
+   */
+  async awaitActionSlot() {
+    for (let waited = 0; waited < ACTION_HANDOFF_MS; waited += ACTION_HANDOFF_POLL_MS) {
+      if (!this.action) return true;
+      await new Promise((r4) => setTimeout(r4, ACTION_HANDOFF_POLL_MS));
+    }
+    return this.action === null;
+  }
+  /**
+   * Queue one actor, resolving when it gets the browser or is turned away.
+   *
+   * `settle` is wrapped so it runs at most once and always takes the waiter out
+   * of the line: the timeout, an abort and a handoff all race, and settling
+   * twice would silently leave a dead entry holding a queue slot.
+   */
+  enqueue(actorId, sessionId, signal) {
+    return new Promise((resolve2) => {
+      let done = false;
+      const waiter = {
+        actorId,
+        sessionId,
+        settle: (result) => {
+          if (done) return;
+          done = true;
+          clearTimeout(timer);
+          signal?.removeEventListener("abort", giveUp);
+          const i4 = this.waiting.indexOf(waiter);
+          if (i4 >= 0) this.waiting.splice(i4, 1);
+          resolve2(result);
+        }
+      };
+      const timer = this.lifecycleWired ? void 0 : setTimeout(() => waiter.settle("busy"), QUEUE_WAIT_MS);
+      timer?.unref?.();
+      const giveUp = () => waiter.settle("cancelled");
+      signal?.addEventListener("abort", giveUp, { once: true });
+      this.waiting.push(waiter);
+    });
+  }
+};
+
+// src/browser/remote/controller.ts
+var ACTION_TIMEOUT_MS = 3e4;
+var RemoteBrowserController = class {
+  provider;
+  maxSessions;
+  /**
+   * Live-view listeners, one per run.
+   *
+   * A single callback was fine while each run had its own controller. Now the
+   * controller is shared across a deployment, so one callback would send run
+   * A's live-view URL to whichever run registered last — and that URL is a
+   * bearer capability for a browser somebody else is driving.
+   */
+  liveViewListeners = /* @__PURE__ */ new Map();
+  /** An embedder that wants every run's live view, told which run each is. */
+  onLiveViewAll;
+  runs = /* @__PURE__ */ new Map();
+  /**
+   * Runs that have a pool slot but no browser yet.
+   *
+   * Counted alongside `runs` against the cap. Without it the limit was a
+   * check-then-act across four awaits, and simultaneous first uses both won.
+   */
+  opening = /* @__PURE__ */ new Set();
+  /**
+   * A run's stop signal, created when its slot is reserved.
+   *
+   * Before this, Stop looked only in `runs` — so during the first `open()`,
+   * while the run existed only in `opening` and four awaits were in flight, it
+   * found nothing and returned. The open then completed, built a FRESH
+   * unaborted controller, and the click the user had stopped went ahead. The
+   * signal has to exist before the browser does.
+   */
+  aborts = /* @__PURE__ */ new Map();
+  /**
+   * Runs whose provider session is being released right now.
+   *
+   * `stopRun`, `endRun`, `releaseIfIdle`, and the stale-page branch of `open`
+   * all delete a run from `runs` synchronously and only THEN await
+   * `disposeRun` settling — the browser disconnect, and `provider.endSession`,
+   * which for Steel is a real HTTP `/release` call. Between that delete and
+   * the call actually finishing, the admission check in `open()` — which
+   * counts only `runs` and `opening` — saw the slot as free, so a second run
+   * could pass admission and call `createSession` before the first run's
+   * session was truly released. At `maxSessions: 1` that is two live, BILLED
+   * provider sessions at once, exactly what the pool exists to prevent.
+   * Counting this set alongside the other two closes the window.
+   *
+   * Keyed by run id, not a counter: every one of those four call sites checks
+   * the run is still IN `runs` before deleting it and starting teardown, and
+   * that delete is synchronous, so at most one teardown can ever be in flight
+   * for a given run id at a time — a second caller finds the entry already
+   * gone and never starts a competing one. The entry is removed only once its
+   * own teardown settles, so a later, genuine re-open of the same run id
+   * never collides with one still in flight.
+   */
+  closing = /* @__PURE__ */ new Set();
+  /** Runs the user has stopped, by run id — same meaning as on the desktop. */
+  revoked = /* @__PURE__ */ new Set();
+  /**
+   * One lease PER RUN, because there is one browser per run.
+   *
+   * The desktop has a single lease because it has a single browser. Here each
+   * run gets its own session, so a global lease would make run B queue behind
+   * run A for a browser it was never going to use — and with no queue timeout,
+   * queue for as long as A lasts. What limits runs against each other is the
+   * session POOL, not the lease.
+   */
+  leases = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.provider = options.provider;
+    const asked = Math.max(1, options.maxSessions ?? 1);
+    this.maxSessions = options.provider.isolatesSessions ? asked : 1;
+    this.onLiveViewAll = options.onLiveView;
+  }
+  leaseFor(runId) {
+    let lease = this.leases.get(runId);
+    if (!lease) {
+      lease = new BrowserLease({ isRevoked: (id) => this.revoked.has(id) });
+      lease.setLifecycleReleaseWired(true);
+      this.leases.set(runId, lease);
+    }
+    return lease;
+  }
+  /** The controller to hand to `Cascade.setBrowserController`. */
+  get controller() {
+    return (action, context) => this.act(action, context);
+  }
+  /** Watch one run's browser. The URL never goes to any other run's listener. */
+  onLiveViewFor(runKey, listener) {
+    this.liveViewListeners.set(runKey, listener);
+  }
+  offLiveViewFor(runKey) {
+    this.liveViewListeners.delete(runKey);
+  }
+  /**
+   * Tell a run's listener what its browser situation is.
+   *
+   * `active` is separate from the URL and both are needed: a provider with no
+   * live view is attached-but-unwatchable, and a finished run is not attached
+   * at all. Both have no URL, so a listener given only the URL cannot tell them
+   * apart — and would drop the Stop control for the first as if it were the
+   * second.
+   */
+  announceLiveView(runId, liveViewUrl, active) {
+    this.liveViewListeners.get(runId)?.({ active, ...liveViewUrl ? { liveViewUrl } : {} });
+    this.onLiveViewAll?.(runId, liveViewUrl);
+  }
+  /**
+   * Hand back a session the run turned out not to want.
+   *
+   * A browser opened for an action that is then refused would otherwise stay
+   * allocated and billed until the whole run ended, for a run that has just
+   * been stopped.
+   */
+  async releaseIfIdle(runId) {
+    const held = this.runs.get(runId);
+    if (!held) return;
+    this.runs.delete(runId);
+    this.closing.add(runId);
+    await this.teardown(runId, held);
+  }
+  /** Release every run's session. For when the deployment's config changes. */
+  async dispose() {
+    const ids = /* @__PURE__ */ new Set([...this.runs.keys(), ...this.opening]);
+    await Promise.all([...ids].map((runId) => this.endRun(runId)));
+  }
+  /** A worker finished; it will never ask for the browser again. */
+  actorEnded(actorId) {
+    for (const lease of this.leases.values()) lease.actorEnded(actorId);
+  }
+  /** The user stopped this run. Refuses further actions and clears its queue. */
+  stopRun(runId) {
+    this.revoked.add(runId);
+    this.leases.get(runId)?.dropRun(runId);
+    this.aborts.get(runId)?.abort();
+    const held = this.runs.get(runId);
+    if (!held) return;
+    this.runs.delete(runId);
+    this.closing.add(runId);
+    void this.teardown(runId, held);
+  }
+  /** A run ended: release its browser rather than pay for an idle session. */
+  async endRun(runId) {
+    this.leases.get(runId)?.dropRun(runId);
+    this.aborts.get(runId)?.abort();
+    const held = this.runs.get(runId);
+    if (!held) {
+      this.forgetRun(runId);
+      return;
+    }
+    this.runs.delete(runId);
+    this.closing.add(runId);
+    await this.teardown(runId, held);
+    this.forgetRun(runId);
+  }
+  /** Forget a finished run entirely, so nothing accumulates per run. */
+  forgetRun(runId) {
+    this.revoked.delete(runId);
+    this.leases.delete(runId);
+    this.aborts.delete(runId);
+    this.liveViewListeners.delete(runId);
+  }
+  /**
+   * Let go of one run's browser.
+   *
+   * Best-effort throughout: a run is already over by the time this runs, and a
+   * provider that is briefly unreachable must not turn that into a failure the
+   * user sees. The provider's own idle timeout collects anything left.
+   */
+  async disposeRun(runId, held) {
+    held.abort.abort();
+    this.announceLiveView(runId, void 0, false);
+    await held.ownedContext?.close().catch(() => {
+    });
+    await held.browser.close().catch(() => {
+    });
+    await this.provider.endSession(held.session.id).catch(() => {
+    });
+  }
+  /**
+   * Run `disposeRun`, with the run id counted in `closing` until it settles.
+   *
+   * The caller adds the id to `closing` itself, synchronously, in the same
+   * breath as deleting the run from `runs` — see the field comment. This just
+   * guarantees the removal happens, success or failure, so a disposal that
+   * throws cannot leave the slot counted against the pool forever.
+   */
+  async teardown(runId, held) {
+    try {
+      await this.disposeRun(runId, held);
+    } finally {
+      this.closing.delete(runId);
+    }
+  }
+  async act(action, context) {
+    const runId = context.sessionId;
+    if (!runId) {
+      return { ok: false, detail: "This browser action arrived without a run identity, so it was not run." };
+    }
+    const actor = context.actorId || runId;
+    if (this.revoked.has(runId)) {
+      return { ok: false, detail: "The user stopped browser control for this run." };
+    }
+    if (context.signal?.aborted) {
+      return { ok: false, detail: "The run was cancelled." };
+    }
+    const planned = this.runs.get(runId)?.generation ?? 0;
+    const lease_ = this.leaseFor(runId);
+    const lease = await lease_.acquire(actor, runId, context.signal);
+    if (lease !== "granted") {
+      return { ok: false, detail: refusal(lease) };
+    }
+    if (this.revoked.has(runId)) {
+      lease_.releaseIfHeldBy(actor);
+      return { ok: false, detail: "The user stopped browser control for this run." };
+    }
+    if (context.signal?.aborted) {
+      lease_.releaseIfHeldBy(actor);
+      return { ok: false, detail: "The run was cancelled." };
+    }
+    if (!await lease_.awaitActionSlot()) {
+      lease_.releaseIfHeldBy(actor);
+      return { ok: false, detail: "Another browser action is still finishing. Try again." };
+    }
+    const token = lease_.beginAction();
+    if (!token) {
+      return { ok: false, detail: "Another browser action is already running. Wait for it to finish." };
+    }
+    try {
+      const held = await this.open(runId, context.signal);
+      if (this.revoked.has(runId)) {
+        await this.releaseIfIdle(runId);
+        return { ok: false, detail: "The user stopped browser control for this run." };
+      }
+      if (context.signal?.aborted || held.abort.signal.aborted) {
+        await this.releaseIfIdle(runId);
+        return { ok: false, detail: "The run was cancelled." };
+      }
+      return await this.perform(held, action, planned);
+    } catch (err) {
+      return { ok: false, detail: err instanceof Error ? err.message : String(err) };
+    } finally {
+      lease_.endAction(token);
+      if (context.signal?.aborted || this.revoked.has(runId)) lease_.releaseIfHeldBy(actor);
+    }
+  }
+  /**
+   * The run's browser, opened on first use.
+   *
+   * The ONE place the session cap is enforced. An earlier version also checked
+   * it before taking the lease, on the reasoning that a run which cannot get a
+   * session would otherwise queue forever — true when every run shared one
+   * lease, and false once each run got its own, because a second run no longer
+   * queues behind the first at all. Its own revert-check proved it dead: taking
+   * it out changed no test. Two copies of a cap invite them to disagree.
+   */
+  async open(runId, signal) {
+    const existing = this.runs.get(runId);
+    if (existing && !existing.page.isClosed()) return existing;
+    if (existing) {
+      this.runs.delete(runId);
+      this.closing.add(runId);
+      await this.teardown(runId, existing);
+    }
+    if (this.runs.size + this.opening.size + this.closing.size >= this.maxSessions) {
+      throw new Error(
+        `All ${this.maxSessions} browser session${this.maxSessions === 1 ? "" : "s"} are in use by other runs. Try again when one finishes, or raise the session limit in settings.`
+      );
+    }
+    this.opening.add(runId);
+    if (!this.aborts.has(runId)) this.aborts.set(runId, new AbortController());
+    try {
+      return await this.openReserved(runId, signal);
+    } finally {
+      this.opening.delete(runId);
+    }
+  }
+  /** The part that may fail, with the pool slot already reserved. */
+  async openReserved(runId, signal) {
+    const playwright = await loadPlaywright();
+    const abort = this.aborts.get(runId)?.signal;
+    const creationSignal = signal && abort ? AbortSignal.any([signal, abort]) : signal ?? abort;
+    const session = await this.provider.createSession(creationSignal);
+    this.announceLiveView(runId, session.liveViewUrl, true);
+    let browser2;
+    let owned;
+    try {
+      browser2 = await playwright.chromium.connectOverCDP(session.cdpUrl);
+      owned = this.provider.isolatesSessions ? void 0 : await browser2.newContext();
+      const context = owned ?? browser2.contexts()[0] ?? await browser2.newContext();
+      const page2 = owned ? await owned.newPage() : context.pages()[0] ?? await context.newPage();
+      const abort2 = this.aborts.get(runId);
+      if (!abort2) throw new Error("The run ended while its browser was still opening.");
+      const held = { session, browser: browser2, page: page2, generation: 0, abort: abort2, ...owned ? { ownedContext: owned } : {} };
+      page2.on("framenavigated", ((frame) => {
+        if (frame !== page2.mainFrame()) return;
+        held.generation += 1;
+      }));
+      this.runs.set(runId, held);
+      return held;
+    } catch (err) {
+      this.announceLiveView(runId, void 0, false);
+      await owned?.close().catch(() => {
+      });
+      await browser2?.close().catch(() => {
+      });
+      await this.provider.endSession(session.id).catch(() => {
+      });
+      throw err;
+    }
+  }
+  async perform(held, action, planned) {
+    const { page: page2 } = held;
+    const stoppable = async (work) => {
+      if (held.abort.signal.aborted) throw new Error("The user stopped browser control for this run.");
+      let onAbort;
+      try {
+        return await Promise.race([
+          work,
+          new Promise((_4, reject) => {
+            onAbort = () => {
+              void page2.close().catch(() => {
+              });
+              reject(new Error("The user stopped browser control for this run."));
+            };
+            held.abort.signal.addEventListener("abort", onAbort, { once: true });
+          })
+        ]);
+      } finally {
+        held.abort.signal.removeEventListener("abort", onAbort);
+      }
+    };
+    const timeout = Math.min(action.timeoutMs ?? 1e4, ACTION_TIMEOUT_MS);
+    const where = async () => ({
+      url: page2.url(),
+      title: await page2.title().catch(() => "")
+    });
+    if (action.kind !== "navigate" && held.generation !== planned) {
+      return {
+        ok: false,
+        detail: "The page changed while this action was waiting for the browser, so it was not run. Look at the page again before retrying.",
+        ...await where()
+      };
+    }
+    switch (action.kind) {
+      case "navigate": {
+        const target = action.url ?? "";
+        if (!/^https?:\/\//i.test(target)) {
+          return { ok: false, detail: "Only http and https addresses can be opened." };
+        }
+        await stoppable(page2.goto(target, { timeout: ACTION_TIMEOUT_MS, waitUntil: "domcontentloaded" }));
+        return { ok: true, detail: `Opened ${target}`, ...await where() };
+      }
+      case "click":
+        await stoppable(page2.click(action.selector, { timeout }));
+        return { ok: true, detail: `Clicked ${action.selector}`, ...await where() };
+      case "fill":
+        await stoppable(page2.fill(action.selector, action.value ?? "", { timeout }));
+        return { ok: true, detail: `Filled ${action.selector}`, ...await where() };
+      case "press": {
+        if (action.selector) await stoppable(page2.press(action.selector, action.key, { timeout }));
+        else await stoppable(page2.keyboard.press(action.key));
+        return { ok: true, detail: `Pressed ${action.key}`, ...await where() };
+      }
+      case "wait_for":
+        await stoppable(page2.waitForSelector(action.selector, { timeout }));
+        return { ok: true, detail: `${action.selector} appeared`, ...await where() };
+      case "extract_text": {
+        const text = await stoppable(page2.innerText(action.selector ?? "body", { timeout }));
+        return { ok: true, detail: text.slice(0, 2e5), ...await where() };
+      }
+      default:
+        return { ok: false, detail: `Unsupported action: ${String(action.kind)}` };
+    }
+  }
+};
+function refusal(result) {
+  if (result === "off") return "Browser control was turned off while this action waited for the browser.";
+  if (result === "cancelled") return "The run was cancelled while waiting for the browser.";
+  return "The browser is in use by another part of this run and did not come free in time. Try again, or do something else first.";
+}
+async function loadPlaywright() {
+  try {
+    return await import('playwright');
+  } catch {
+    throw new Error("Playwright is not installed. Run: npm install playwright (no browser download is needed \u2014 this connects to a remote browser).");
+  }
+}
+
+// src/browser/remote/generic-cdp.ts
+var GenericCdpProvider = class {
+  name = "CDP endpoint";
+  // The endpoint is a single browser. There is no session to allocate, so two
+  // runs against it share a page — see the seam.
+  isolatesSessions = false;
+  endpoint;
+  constructor(endpoint) {
+    this.endpoint = endpoint;
+  }
+  /**
+   * There is no session to create — the endpoint is the session.
+   *
+   * `id` is a constant rather than a generated one because there is nothing to
+   * look up later: `endSession` has nothing to call. Inventing a unique id
+   * would imply a lifecycle this provider does not have.
+   */
+  async createSession() {
+    return { id: "cdp", cdpUrl: this.endpoint };
+  }
+  /**
+   * Deliberately nothing.
+   *
+   * The endpoint belongs to whoever runs it and outlives any single run, so
+   * "ending" it is not ours to do — closing it would take the browser away from
+   * every other user of a shared endpoint. The driver still closes its own
+   * connection and its pages; this is only about the browser's lifetime.
+   */
+  async endSession() {
+  }
+};
+function isCdpEndpoint(url2) {
+  try {
+    const u2 = new URL(url2);
+    return u2.protocol === "ws:" || u2.protocol === "wss:";
+  } catch {
+    return false;
+  }
+}
+
+// src/browser/remote/steel.ts
+var DEFAULT_BASE = "https://api.steel.dev";
+var CREATE_TIMEOUT_MS = 6e4;
+var SteelProvider = class {
+  name = "Steel";
+  // POST /v1/sessions allocates a browser per call, so concurrent runs are
+  // genuinely separate.
+  isolatesSessions = true;
+  base;
+  apiKey;
+  constructor(opts = {}) {
+    let base = opts.url || DEFAULT_BASE;
+    while (base.endsWith("/")) base = base.slice(0, -1);
+    this.base = base;
+    this.apiKey = opts.apiKey;
+  }
+  async createSession(signal) {
+    const details = await this.call("POST", "/v1/sessions", signal, {});
+    if (!details.id || !details.websocketUrl) {
+      throw new Error("Steel returned a session with no id or websocket URL.");
+    }
+    return {
+      id: details.id,
+      cdpUrl: details.websocketUrl,
+      ...details.debugUrl ? { liveViewUrl: details.debugUrl } : {}
+    };
+  }
+  async endSession(id) {
+    try {
+      await this.call("POST", `/v1/sessions/${encodeURIComponent(id)}/release`, void 0, {});
+    } catch {
+    }
+  }
+  async call(method, path32, signal, body) {
+    const timeout = AbortSignal.timeout(CREATE_TIMEOUT_MS);
+    const composed = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    const res = await fetch(`${this.base}${path32}`, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        // Sent only when configured — the self-hosted API takes no key, and an
+        // empty header is worse than none.
+        ...this.apiKey ? { "steel-api-key": this.apiKey } : {}
+      },
+      body: JSON.stringify(body),
+      signal: composed
+    });
+    if (!res.ok) {
+      const detail = await res.text().then((t4) => t4.slice(0, 300)).catch(() => "");
+      throw new Error(`Steel ${method} ${path32} failed: ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
+    }
+    return await res.json();
+  }
+};
+
 // src/retrieval/chunk.ts
 var DEFAULTS2 = { targetChars: 2e3, overlapChars: 200, minChars: 80 };
 function splitLongBlock(block, max) {
@@ -403673,6 +404704,8 @@ object-assign/index.js:
 exports.AZURE_BASE_MODELS = AZURE_BASE_MODELS;
 exports.AZURE_BASE_URL_TEMPLATE = AZURE_BASE_URL_TEMPLATE;
 exports.AuditLogger = AuditLogger;
+exports.BrowserControlTool = BrowserControlTool;
+exports.BrowserLease = BrowserLease;
 exports.CASCADE_AUDIT_FILE = CASCADE_AUDIT_FILE;
 exports.CASCADE_CONFIG_DIR = CASCADE_CONFIG_DIR;
 exports.CASCADE_CONFIG_FILE = CASCADE_CONFIG_FILE;
@@ -403713,6 +404746,7 @@ exports.GLOBAL_DB_FILE = GLOBAL_DB_FILE;
 exports.GLOBAL_KEYSTORE_FILE = GLOBAL_KEYSTORE_FILE;
 exports.GLOBAL_RUNTIME_DB_FILE = GLOBAL_RUNTIME_DB_FILE;
 exports.GenerateDocumentTool = GenerateDocumentTool;
+exports.GenericCdpProvider = GenericCdpProvider;
 exports.GraphRetriever = GraphRetriever;
 exports.GraphSearchTool = GraphSearchTool;
 exports.HooksRunner = HooksRunner;
@@ -403729,9 +404763,11 @@ exports.OLLAMA_BASE_URL = OLLAMA_BASE_URL;
 exports.OpenAICompatibleEmbedder = OpenAICompatibleEmbedder;
 exports.PROVIDER_DISPLAY_NAMES = PROVIDER_DISPLAY_NAMES;
 exports.RESUME_SCHEMA_VERSION = RESUME_SCHEMA_VERSION;
+exports.RemoteBrowserController = RemoteBrowserController;
 exports.ResumeStore = ResumeStore;
 exports.Retriever = Retriever;
 exports.SqliteVectorStore = SqliteVectorStore;
+exports.SteelProvider = SteelProvider;
 exports.T1Administrator = T1Administrator;
 exports.T1_MODEL_PRIORITY = T1_MODEL_PRIORITY;
 exports.T2Manager = T2Manager;
@@ -403796,6 +404832,7 @@ exports.hashContent = hashContent;
 exports.heuristicCodeChunker = heuristicCodeChunker;
 exports.inferAzureBaseModel = inferAzureBaseModel;
 exports.inlineRuns = inlineRuns;
+exports.isCdpEndpoint = isCdpEndpoint;
 exports.isDocumentFormat = isDocumentFormat;
 exports.isMcpToolName = isMcpToolName;
 exports.matchImageLine = matchImageLine;