cli-jaw 2.0.1 → 2.0.2

package/dist/src/prompt/templates/a1-system.md

@@ -73,7 +73,7 @@ Key rules:
 5. Your CLI's sub-agent features (Task tool, etc.) are separate from jaw employees.
 6. **⏰ Bash timeout**: always pass `timeout=600000` (10 min) when calling `cli-jaw dispatch`. Default 2-minute Bash timeout causes employee results to be lost to pendingReplay if the employee takes longer.
 7. **`$computer-use` / Computer Use routing** (full rule: anchor:desktop-control §0 + dispatch template):
-   - Your CLI is codex → self-serve via `mcp__computer_use__.*`.
+   - Your CLI is codex → self-serve via Computer Use tools (`get_app_state`, `click`, `set_value`, `press_key`, `scroll`, `drag`, `list_apps`; exposed in Codex CLI as `mcp__computer_use__.*`).
    - Not codex → dispatch to `Control` (or any codex-family employee). Forward the task **verbatim** with the `$computer-use` token preserved.
    - No codex-family employee → report `precondition failed: no codex-family employee for $computer-use`. Never fall back to CDP.
 8. **Screenshot-first in dispatch body**: every UI-task dispatch must include — *"If unsure of state, call `get_app_state` (CU) or `cli-jaw browser snapshot` (CDP) before the next action. Never chain actions through uncertainty."*
@@ -87,7 +87,7 @@ Key rules:
 
 When the user's message contains **`$computer-use`**, skip intent routing entirely:
 
-- **Codex + TCC ready** → self-serve `mcp__computer_use__.*`. First action: `get_app_state(app=...)`.
+- **Codex + TCC ready** → self-serve Computer Use tools. First action for a known app: `get_app_state(app=...)`; if the app name is unclear, call `list_apps()` first.
 - **Not codex** → use the dispatch template below. Control preferred; any codex-family employee acceptable.
 - **No codex-family employee** → report `precondition failed: no codex-family employee for $computer-use`. Never fall back to CDP.
 - `desktop-control` skill is already inlined into Control's system prompt — never paste absolute skill paths (`/Users/*/.codex/skills/...` etc.) into the task body.
@@ -104,7 +104,7 @@ cli-jaw dispatch --agent "Control" --task "$computer-use
 <user's original request, verbatim>
 
 Execution rules:
-- First action: mcp__computer_use__get_app_state(app=\"<relevant app>\").
+- First action for a known app: mcp__computer_use__get_app_state(app=\"<relevant app>\"). If the app is unclear, call mcp__computer_use__list_apps first.
 - If unsure of state (which tab, which index, did the click land), call get_app_state again BEFORE acting. Never chain actions through uncertainty.
 - Report precondition failures verbatim; never fall back to CDP."
 ```
@@ -115,7 +115,7 @@ Template rules:
 - Give Control the full end-to-end goal in one task — never split a single UI flow across dispatches.
 
 ### A. CDP path — `cli-jaw browser` (for DOM web pages)
-Workflow: snapshot → act → snapshot → verify. For debug/log inspection, use the Web UI debug console — never open a visible browser just to inspect state.
+This is the fast path for browser automation. Use it for DOM pages, local apps, Web UI verification, console/network inspection, and routine page interaction. Workflow: snapshot → act → snapshot/targeted wait → verify. For debug/log inspection, use the Web UI debug console — never open a visible browser just to inspect state.
 
 ```bash
 cli-jaw browser status                         # check first
@@ -127,16 +127,21 @@ cli-jaw browser type e5 "hello" --submit
 ```
 
 - Ref IDs **reset on navigation** → re-snapshot after navigate.
-- For Canvas / iframe / WebGL / Shadow DOM with no ref: if the target is visible in the `get_app_state` screenshot, use `click(x, y)` pointer-action directly. `cli-jaw browser vision-click` is legacy and Codex-only — do not rely on it.
+- If the current tab is already at the requested URL, do not `navigate`/`open` the same URL unless an intentional reload is needed.
+- Prefer the smallest state check that answers the next question: snapshot for ref/DOM truth, screenshot only when visual layout matters, console/network only for debugging.
+- For Canvas / iframe / WebGL / Shadow DOM with no ref: if Control/Computer Use is available and the target is visible, use `click(x, y)` pointer-action from the screenshot. `cli-jaw browser vision-click` remains a Codex-only legacy fallback for no-ref targets; use it only after the ref path and direct coordinate path are unsuitable.
 
 ### B. Computer Use path — `mcp__computer_use__.*` (macOS, codex-only)
-For desktop apps and non-DOM UI. Drives the **real mouse cursor and keyboard** — the user's pointer physically moves.
+For desktop apps and non-DOM UI. Operates native UI through accessibility, keyboard, and pointer actions. Do not promise that a visible cursor overlay will appear.
 
-**Workflow:** `get_app_state(app)` → action → `get_app_state(app)` → verify.
-- If the target is visible in the screenshot but absent from the element tree (e.g. map labels, canvas text), use `click(x, y)` pointer-action **immediately** — do not search the element tree. Use `element_index` when the target IS in the element tree.
+**Workflow:** `get_app_state(app)` before the first interaction in a turn → action → re-read state after UI/focus changes, stale warnings, or uncertainty → verify.
+- Use `list_apps()` first when the app name is unknown.
+- Prefer `element_index` actions when the target is in the accessibility tree.
+- Prefer `set_value(element_index, value)` over focus-only typing. Use `type_text(text)` only after the latest state proves focus is in the intended field.
+- If the target is visible in the screenshot but absent from the element tree (e.g. map labels, canvas text), use `click(x, y)` pointer-action directly from screenshot coordinates.
 - `stale_warning` is a signal to re-read state, not a failure.
 - Cursor overlay visibility is **best-effort** — never claim "the cursor is visible" as a fact.
-- Action classes: `state-read`, `element-action`, `value-injection`, `keyboard-action`, `pointer-action`, `pointer-action+vision`. Full examples and per-class guidance live in the `desktop-control` skill.
+- Action classes: `state-read`, `element-action`, `value-injection`, `keyboard-action`, `pointer-action`, `pointer-action+vision`, `scroll-action`, `drag-action`, `secondary-action`. Full examples and per-class guidance live in the `desktop-control` skill.
 
 ### B.1 Intent → action-class (minimal)
 | User intent | Path | Action class |
@@ -145,7 +150,7 @@ For desktop apps and non-DOM UI. Drives the **real mouse cursor and keyboard**
 | Desktop app / Chrome chrome / OS dialog | CU | element-action / value-injection |
 | Global hotkey | CU | keyboard-action |
 | User-given pixel coordinate | CU | pointer-action |
-| Canvas / iframe / Shadow DOM target | CDP+CU | pointer-action+vision |
+| Canvas / iframe / Shadow DOM target | CDP or CU fallback | pointer-action / pointer-action+vision |
 
 ### B.2 Who performs it
 - You may dispatch to `Control` at any time, regardless of your own CLI.

package/dist/src/prompt/templates/control-system.md

@@ -1,6 +1,6 @@
 ## You are `Control` — Desktop + Browser Automation Specialist
 
-You run on the Codex CLI. Computer Use MCP tools (`mcp__computer_use__.*`) are available to you in addition to the standard `cli-jaw browser` CDP tools.
+You run on the Codex CLI. Computer Use tools (`get_app_state`, `click`, `set_value`, `type_text`, `press_key`, `scroll`, `drag`, `list_apps`, `perform_secondary_action`; exposed as `mcp__computer_use__.*`) are available to you in addition to the standard fast `cli-jaw browser` CDP tools.
 
 ### 🛑 Do NOT read skill files from disk
 
@@ -9,13 +9,15 @@ The `desktop-control` skill and any referenced skills are **already inlined in t
 ### Absolute rules
 - **Pick the path before acting.** Announce in one short sentence at the start of every task: `path=cdp`, `path=computer-use`, or `path=cdp+cu` (hybrid).
 - **`$computer-use` in task text → Computer Use path, no routing analysis.** The Boss already decided. Proceed directly with `get_app_state(app)`. Never downgrade to CDP because it "looks easier."
-- **Go straight to `mcp__computer_use__.*` tool calls.** First action after announcing the path should be `mcp__computer_use__get_app_state(app=...)` — not a shell command, not a file read, not a preamble explanation longer than one sentence.
-- Before any Computer Use interaction, call `get_app_state(app)`. Re-call it after any state change and on every stale warning.
-- **🔍 Unsure? Screenshot first.** If you catch yourself guessing element indices ("342 or 357?"), guessing which tab is focused, or wondering whether a click landed — **stop and re-call `get_app_state(app)` before the next action**. Never chain actions through uncertainty.
-- Every action you perform must record its `action_class` in the transcript (state-read, element-action, value-injection, keyboard-action, pointer-action, pointer-action+vision).
+- **Go straight to Computer Use tool calls.** First action after announcing the path should be `mcp__computer_use__get_app_state(app=...)` for a known app, or `mcp__computer_use__list_apps()` if the app is unclear — not a shell command, not a file read, not a long preamble.
+- Before the first Computer Use interaction with an app in a turn, call `get_app_state(app)`. Re-call it after UI/focus changes, on stale warnings, and whenever confidence drops.
+- **Unsure? Screenshot first.** If you catch yourself guessing element indices ("342 or 357?"), guessing which tab is focused, or wondering whether a click landed — **stop and re-call `get_app_state(app)` before the next action**. Never chain actions through uncertainty.
+- Prefer `set_value(element_index, value)` for targeted input. Use `type_text(text)` only after the latest state proves focus is in the intended field.
+- Every action you perform must record its `action_class` in the transcript (state-read, element-action, value-injection, keyboard-action, pointer-action, pointer-action+vision, scroll-action, drag-action, secondary-action).
 - Never claim the visible cursor is guaranteed — cursor overlay is best-effort in the current build.
 - Never silently switch paths. If the required path is unavailable (CDP server down, Terminal lacks Automation permission, TCC not granted), stop and report exactly which precondition failed.
-- For Canvas / iframe / Shadow DOM / WebGL targets that CDP cannot ref, use `cli-jaw browser vision-click "<target description>"`. Always try a ref-based click first.
+- Use `cli-jaw browser` as the fast path for DOM/web UI work: snapshot refs, click/type by ref, inspect console/network through the Web UI path, and avoid visible browser windows for debugging.
+- For Canvas / iframe / Shadow DOM / WebGL targets that CDP cannot ref, first prefer direct Computer Use `click(x, y)` when the target is visible in the screenshot. Use `cli-jaw browser vision-click "<target description>"` only as a Codex-only legacy fallback after ref and direct coordinate paths are unsuitable.
 
 ### Transcript format
 Every UI action must be recorded in this exact format (one block per action):
@@ -40,7 +42,7 @@ result=<ok|error: ...>
 
 ### Fail fast checklist
 - Computer Use requires the jaw server be launched from a Terminal with Automation permission — if TCC prompts never appeared, stop and tell the user to run `jaw serve` from Terminal (not launchd).
-- Required app not running → state that before attempting `get_app_state`.
+- Required app not running or app name unclear → call `list_apps()` once, then either select the right app or report the precondition gap.
 
 ### Defer back to Boss
 If the task is not GUI automation (pure code edits, research, summarization), write `needs boss follow-up: not GUI automation` and return. You are a specialist, not an exclusive owner — Boss can always take it back or self-serve.

package/dist/src/prompt/templates/employee.md

@@ -14,19 +14,20 @@ Role: {{EMP_ROLE}}
 - 🔍 **Web search first**: search the web before acting on errors or unfamiliar APIs/tools. Don't guess from training data.
 
 ## Browser Control
-For web tasks, always use `cli-jaw browser` commands.
-Pattern: snapshot → act → snapshot → verify
+For web tasks, always use the fast `cli-jaw browser` path when the target is a DOM page or Web UI.
+Pattern: snapshot → act → targeted wait/snapshot → verify
 For automated browser work, start with `cli-jaw browser start --agent`.
 Do NOT open a visible test browser for debug/log inspection; use the Web UI debug console for that.
 Start: `cli-jaw browser start --agent`, Snapshot: `cli-jaw browser snapshot`
 Click: `cli-jaw browser click <ref>`, Type: `cli-jaw browser type <ref> "text"`
+Refs are scoped to the latest snapshot. Re-snapshot after navigation, reload, tab switch, menu/modal changes, or any major page mutation. Do not navigate to the same URL if the tab is already there unless an intentional reload is needed.
 
 ## `$computer-use` trigger token
 If the task text contains **`$computer-use`**, the user explicitly requested the Computer Use (macOS desktop) path:
-- Your CLI is **codex** → `desktop-control` skill is already in your system prompt (do NOT `cat`/`Read` any skill file). First action must be `mcp__computer_use__get_app_state(app=...)`. Proceed via `mcp__computer_use__.*` only.
+- Your CLI is **codex** → `desktop-control` skill is already in your system prompt (do NOT `cat`/`Read` any skill file). First action for a known app must be `mcp__computer_use__get_app_state(app=...)`; if the app is unclear, call `mcp__computer_use__list_apps()` first. Proceed via Computer Use only.
 - Your CLI is **not codex** → stop and report `precondition failed: not codex — $computer-use requires Computer Use MCP`. Do NOT try `cli-jaw browser` as a substitute and do NOT re-dispatch.
 
-### 🔍 Screenshot-first when uncertain (GUI tasks, any path)
+### Screenshot-first when uncertain (GUI tasks, any path)
 Whenever you are handling a GUI task (CDP **or** Computer Use) and catch yourself guessing — which element_index is correct, whether a click landed, which tab/window is focused, whether the page changed — **STOP and re-read state before the next action**:
 - Computer Use → `mcp__computer_use__get_app_state(app=...)`
 - CDP → `cli-jaw browser snapshot --interactive`

package/dist/src/prompt/templates/vision-click.md

@@ -1,3 +1,3 @@
 ### Vision Click (Active)
-- If browser snapshot shows no ref for target, use vision-click: screenshot → `codex exec -i` → `mouse-click <x> <y>`.
+- Codex-only legacy fallback. If browser snapshot shows no ref for a visible target and direct coordinate clicking is not suitable, use vision-click: screenshot → `codex exec -i` → `mouse-click <x> <y>`.
 - See vision-click skill SKILL.md for full workflow.

package/dist/src/routes/_http-error.js

@@ -0,0 +1,15 @@
+export function isHttpishError(e) {
+    return typeof e === 'object' && e !== null
+        && ('statusCode' in e || 'code' in e || 'message' in e);
+}
+export function httpStatus(e, fallback) {
+    if (isHttpishError(e) && typeof e.statusCode === 'number')
+        return e.statusCode;
+    return fallback;
+}
+export function httpCode(e) {
+    if (isHttpishError(e))
+        return e.code;
+    return undefined;
+}
+//# sourceMappingURL=_http-error.js.map

package/dist/src/routes/_http-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_http-error.js","sourceRoot":"","sources":["../../../src/routes/_http-error.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,cAAc,CAAC,CAAU;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;WACnC,CAAC,YAAY,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,QAAgB;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC;IAC/E,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,CAAU;IAC/B,IAAI,cAAc,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACrC,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/dist/src/routes/avatar.js

@@ -4,6 +4,7 @@ import { basename, extname } from 'path';
 import express from 'express';
 import { ok, fail } from '../http/response.js';
 import { saveUpload } from '../agent/spawn.js';
+import { IMAGE_MIMES } from '../../lib/mime-detect.js';
 import { settings, saveSettings, UPLOADS_DIR } from '../core/config.js';
 import { safeResolveUnder } from '../security/path-guards.js';
 import { decodeFilenameSafe } from '../security/decode.js';
@@ -13,7 +14,7 @@ function isAvatarTarget(value) {
     return AVATAR_TARGETS.has(value);
 }
 function ensureAvatarSettings() {
-    const current = settings.avatar || {};
+    const current = settings["avatar"] || {};
     const next = {
         agent: {
             imagePath: String(current.agent?.imagePath || ''),
@@ -24,7 +25,7 @@ function ensureAvatarSettings() {
             updatedAt: current.user?.updatedAt == null ? null : Number(current.user.updatedAt),
         },
     };
-    settings.avatar = next;
+    settings["avatar"] = next;
     return next;
 }
 function serializeAvatar(target) {
@@ -86,7 +87,7 @@ export function registerAvatarRoutes(app, requireAuth) {
         });
     });
     app.post('/api/avatar/:target/upload', requireAuth, express.raw({ type: ['image/*', 'application/octet-stream'], limit: '5mb' }), (req, res) => {
-        const target = parseTarget(String(req.params.target || ''));
+        const target = parseTarget(String(req.params["target"] || ''));
         if (!target)
             return fail(res, 400, 'invalid_avatar_target');
         try {
@@ -95,7 +96,7 @@ export function registerAvatarRoutes(app, requireAuth) {
             const bodyLen = Buffer.isBuffer(req.body) ? req.body.length : 0;
             console.log(`[avatar:upload] target=${target} ct=${contentType} file=${filename} bodyLen=${bodyLen}`);
             validateUpload(contentType, filename, req.body);
-            const filePath = saveUpload(req.body, filename);
+            const filePath = saveUpload(req.body, filename, { allowedMimes: IMAGE_MIMES });
             saveAvatarImage(target, filePath);
             return ok(res, serializeAvatar(target));
         }
@@ -106,7 +107,7 @@ export function registerAvatarRoutes(app, requireAuth) {
         }
     });
     app.delete('/api/avatar/:target/image', requireAuth, (req, res) => {
-        const target = parseTarget(String(req.params.target || ''));
+        const target = parseTarget(String(req.params["target"] || ''));
         if (!target)
             return fail(res, 400, 'invalid_avatar_target');
         resetAvatarImage(target);

package/dist/src/routes/avatar.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar.js","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQ3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,SAAS,cAAc,CAAC,KAAa;IACjC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB;IACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG;QACT,KAAK,EAAE;YACH,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SACvF;QACD,IAAI,EAAE;YACF,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SACrF;KACJ,CAAC;IACF,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IACzC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,OAAO;QACH,MAAM;QACN,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,eAAe,MAAM,YAAY,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;QAC3E,SAAS,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC5B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,QAAgB,EAAE,IAAa;IACxE,qEAAqE;IACrE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,0BAA0B,EAAE,CAAC;QAClF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB,EAAE,SAAiB;IAC5D,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,GAAG;QACb,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC1C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,GAAG;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,WAA2B;IAC1E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,EAAE,CAAC,GAAG,EAAE;YACJ,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;YAC/B,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3I,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAE5D,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC;YACxG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,OAAO,WAAW,SAAS,QAAQ,YAAY,OAAO,EAAE,CAAC,CAAC;YACtG,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAChD,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,MAAM,GAAI,KAAiC,EAAE,UAAU,IAAI,GAAG,CAAC;YACrE,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,2BAA2B,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5D,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAEhE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,2DAA2D;QAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"avatar.js","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQ3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,SAAS,cAAc,CAAC,KAAa;IACjC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB;IACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG;QACT,KAAK,EAAE;YACH,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SACvF;QACD,IAAI,EAAE;YACF,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SACrF;KACJ,CAAC;IACF,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC1B,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IACzC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,OAAO;QACH,MAAM;QACN,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,eAAe,MAAM,YAAY,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;QAC3E,SAAS,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC5B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,QAAgB,EAAE,IAAa;IACxE,qEAAqE;IACrE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,0BAA0B,EAAE,CAAC;QAClF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB,EAAE,SAAiB;IAC5D,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,GAAG;QACb,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC1C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,GAAG;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,WAA2B;IAC1E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,EAAE,CAAC,GAAG,EAAE;YACJ,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;YAC/B,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3I,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAE5D,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC;YACxG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,OAAO,WAAW,SAAS,QAAQ,YAAY,OAAO,EAAE,CAAC,CAAC;YACtG,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,MAAM,GAAI,KAAiC,EAAE,UAAU,IAAI,GAAG,CAAC;YACrE,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,2BAA2B,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5D,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAEhE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,2DAA2D;QAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/routes/browser.js

@@ -1,9 +1,11 @@
 import * as browser from '../browser/index.js';
+import { cleanupPoolTabs } from '../browser/web-ai/tab-pool.js';
+import { stripUndefined } from '../core/strip-undefined.js';
 import { ok } from '../http/response.js';
 import { DEBUG_CONSOLE_ONLY_MESSAGE, normalizeBrowserStartMode } from '../browser/launch-policy.js';
 /** Port priority: req param > activePort > settings.browser.cdpPort > deriveCdpPort() */
 const cdpPort = (req) => {
-    const p = Number(req.query?.port || req.body?.port);
+    const p = Number(req.query?.["port"] || req.body?.port);
     if (Number.isInteger(p) && p > 0 && p <= 65535)
         return p;
     return browser.getActivePort();
@@ -52,7 +54,8 @@ export function registerBrowserRoutes(app, requireAuth) {
         try {
             const start = resolveBrowserStartOptions(req);
             if (start.mode === 'debug') {
-                return res.status(400).json({ error: DEBUG_CONSOLE_ONLY_MESSAGE });
+                res.status(400).json({ error: DEBUG_CONSOLE_ONLY_MESSAGE });
+                return;
             }
             await browser.launchChrome(start.port, { mode: start.mode, headless: start.headless });
             res.json(await browser.getBrowserStatus(start.port));
@@ -78,12 +81,36 @@ export function registerBrowserRoutes(app, requireAuth) {
             res.status(500).json({ error: e.message });
         }
     });
+    app.get('/api/browser/doctor', requireAuth, async (req, res) => {
+        try {
+            res.json(await browser.getBrowserDiagnostics(cdpPort(req)));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/cleanup-runtimes', requireAuth, async (req, res) => {
+        try {
+            if (req.body.close === true && req.body.force !== true) {
+                res.status(400).json({ error: 'cleanup-runtimes close requires force=true' });
+                return;
+            }
+            res.json(await browser.cleanupBrowserRuntimeOrphans({
+                close: req.body.close === true,
+                force: req.body.force === true,
+                currentRuntime: browser.getBrowserRuntimeStatus(),
+            }));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
     app.get('/api/browser/snapshot', requireAuth, async (req, res) => {
         try {
             const result = await browser.snapshot(cdpPort(req), {
-                interactive: req.query.interactive === 'true',
-                maxNodes: req.query.maxNodes || req.query['max-nodes'],
-                json: req.query.json === 'true',
+                interactive: req.query["interactive"] === 'true',
+                maxNodes: req.query["maxNodes"] || req.query['max-nodes'],
+                json: req.query["json"] === 'true',
             });
             if (Array.isArray(result))
                 res.json({ nodes: result });
@@ -140,7 +167,9 @@ export function registerBrowserRoutes(app, requireAuth) {
                 case 'drag':
                     result = await browser.drag(cdpPort(req), fromRef, toRef);
                     break;
-                default: return res.status(400).json({ error: `unknown action: ${kind}` });
+                default:
+                    res.status(400).json({ error: `unknown action: ${kind}` });
+                    return;
             }
             res.json(result);
         }
@@ -151,8 +180,10 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.post('/api/browser/vision-click', requireAuth, async (req, res) => {
         try {
             const { target, provider, doubleClick, prepareStable, region, clip, verifyBeforeClick } = req.body;
-            if (!target)
-                return res.status(400).json({ error: 'target required' });
+            if (!target) {
+                res.status(400).json({ error: 'target required' });
+                return;
+            }
             const result = await browser.visionClick(cdpPort(req), target, {
                 provider,
                 doubleClick,
@@ -169,7 +200,12 @@ export function registerBrowserRoutes(app, requireAuth) {
     });
     app.post('/api/browser/navigate', requireAuth, async (req, res) => {
         try {
-            res.json(await browser.navigate(cdpPort(req), req.body.url));
+            const opts = {};
+            if (req.body?.waitUntil)
+                opts.waitUntil = req.body.waitUntil;
+            if (Number.isFinite(req.body?.timeout))
+                opts.timeout = Number(req.body.timeout);
+            res.json(await browser.navigate(cdpPort(req), req.body.url, opts));
         }
         catch (e) {
             res.status(500).json({ error: e.message });
@@ -217,6 +253,49 @@ export function registerBrowserRoutes(app, requireAuth) {
             res.status(500).json({ error: e.message });
         }
     });
+    app.post('/api/browser/tab-new', requireAuth, async (req, res) => {
+        try {
+            res.json(await browser.createTab(cdpPort(req), String(req.body.url || 'about:blank'), {
+                activate: req.body.activate !== false,
+            }));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/tab-close', requireAuth, async (req, res) => {
+        try {
+            res.json(await browser.closeTab(cdpPort(req), String(req.body.targetId || req.body.target || '')));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/tab-cleanup', requireAuth, async (req, res) => {
+        try {
+            if (req.body.includeUntracked === true && req.body.force !== true) {
+                res.status(400).json({ error: 'tab-cleanup includeUntracked requires force=true' });
+                return;
+            }
+            const leaseResult = await cleanupPoolTabs(cdpPort(req));
+            const idleResult = await browser.cleanupIdleTabs(cdpPort(req), stripUndefined({
+                idleTimeoutMs: req.body.idleAfter ? browser.parseTabDuration(String(req.body.idleAfter)) : undefined,
+                maxTabs: req.body.maxTabs ? Number(req.body.maxTabs) : undefined,
+                includeUntracked: req.body.includeUntracked === true,
+                provider: req.body.provider ? String(req.body.provider) : undefined,
+                keepProviderTabs: req.body.keepProviderTabs ? Number(req.body.keepProviderTabs) : undefined,
+            }));
+            res.json({
+                ...idleResult,
+                closed: idleResult.closed + (leaseResult.closed || 0),
+                leaseClosed: leaseResult.closed || 0,
+                leaseClosedTabs: leaseResult.closedTabs || [],
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
     app.post('/api/browser/evaluate', requireAuth, async (req, res) => {
         try {
             res.json(await browser.evaluate(cdpPort(req), req.body.expression));
@@ -227,7 +306,7 @@ export function registerBrowserRoutes(app, requireAuth) {
     });
     app.get('/api/browser/text', requireAuth, async (req, res) => {
         try {
-            res.json(await browser.getPageText(cdpPort(req), req.query.format));
+            res.json(await browser.getPageText(cdpPort(req), req.query["format"]));
         }
         catch (e) {
             res.status(500).json({ error: e.message });
@@ -300,8 +379,8 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.get('/api/browser/web-ai/status', requireAuth, async (req, res) => {
         try {
             res.json(await browser.webAi.status(cdpPort(req), {
-                vendor: String(req.query.vendor || 'chatgpt'),
-                ...(req.query.probe ? { probe: String(req.query.probe) } : {}),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
+                ...(req.query["probe"] ? { probe: String(req.query["probe"]) } : {}),
             }));
         }
         catch (e) {
@@ -319,10 +398,14 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.get('/api/browser/web-ai/poll', requireAuth, async (req, res) => {
         try {
             res.json(await browser.webAi.poll(cdpPort(req), {
-                vendor: String(req.query.vendor || 'chatgpt'),
-                timeout: String(req.query.timeout || '600'),
-                ...(req.query.session ? { session: String(req.query.session) } : {}),
-                ...(req.query.allowCopyMarkdownFallback === 'true' ? { allowCopyMarkdownFallback: true } : {}),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
+                timeout: String(req.query["timeout"] || '600'),
+                ...(req.query["session"] ? { session: String(req.query["session"]) } : {}),
+                ...(req.query["allowCopyMarkdownFallback"] === 'true' ? { allowCopyMarkdownFallback: true } : {}),
+                ...(req.query["requireSourceAudit"] === 'true' ? { requireSourceAudit: true } : {}),
+                ...(req.query["sourceAuditRatio"] ? { sourceAuditRatio: String(req.query["sourceAuditRatio"]) } : {}),
+                ...(req.query["sourceAuditScope"] ? { sourceAuditScope: String(req.query["sourceAuditScope"]) } : {}),
+                ...(req.query["sourceAuditDate"] ? { sourceAuditDate: String(req.query["sourceAuditDate"]) } : {}),
             }));
         }
         catch (e) {
@@ -332,13 +415,17 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.get('/api/browser/web-ai/watch', requireAuth, async (req, res) => {
         try {
             res.json(await browser.webAi.watch(cdpPort(req), {
-                vendor: String(req.query.vendor || 'chatgpt'),
-                timeout: String(req.query.timeout || '600'),
-                ...(req.query.session ? { session: String(req.query.session) } : {}),
-                ...(req.query.url ? { url: String(req.query.url) } : {}),
-                ...(req.query.notify !== undefined ? { notify: String(req.query.notify) !== 'false' } : {}),
-                ...(req.query.pollIntervalSeconds ? { pollIntervalSeconds: String(req.query.pollIntervalSeconds) } : {}),
-                ...(req.query.allowCopyMarkdownFallback === 'true' ? { allowCopyMarkdownFallback: true } : {}),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
+                timeout: String(req.query["timeout"] || '600'),
+                ...(req.query["session"] ? { session: String(req.query["session"]) } : {}),
+                ...(req.query["url"] ? { url: String(req.query["url"]) } : {}),
+                ...(req.query["notify"] !== undefined ? { notify: String(req.query["notify"]) !== 'false' } : {}),
+                ...(req.query["pollIntervalSeconds"] ? { pollIntervalSeconds: String(req.query["pollIntervalSeconds"]) } : {}),
+                ...(req.query["allowCopyMarkdownFallback"] === 'true' ? { allowCopyMarkdownFallback: true } : {}),
+                ...(req.query["requireSourceAudit"] === 'true' ? { requireSourceAudit: true } : {}),
+                ...(req.query["sourceAuditRatio"] ? { sourceAuditRatio: String(req.query["sourceAuditRatio"]) } : {}),
+                ...(req.query["sourceAuditScope"] ? { sourceAuditScope: String(req.query["sourceAuditScope"]) } : {}),
+                ...(req.query["sourceAuditDate"] ? { sourceAuditDate: String(req.query["sourceAuditDate"]) } : {}),
             }));
         }
         catch (e) {
@@ -356,8 +443,8 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.get('/api/browser/web-ai/sessions', requireAuth, async (req, res) => {
         try {
             res.json(await browser.webAi.sessions({
-                ...(req.query.vendor ? { vendor: String(req.query.vendor) } : {}),
-                ...(req.query.status ? { status: String(req.query.status) } : {}),
+                ...(req.query["vendor"] ? { vendor: String(req.query["vendor"]) } : {}),
+                ...(req.query["status"] ? { status: String(req.query["status"]) } : {}),
             }));
         }
         catch (e) {
@@ -380,12 +467,12 @@ export function registerBrowserRoutes(app, requireAuth) {
         try {
             res.json({
                 ok: true,
-                vendor: String(req.query.vendor || 'chatgpt'),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
                 status: 'ready',
                 notifications: browser.webAi.listNotifications({
-                    ...(req.query.vendor ? { vendor: String(req.query.vendor) } : {}),
-                    ...(req.query.status ? { status: String(req.query.status) } : {}),
-                    ...(req.query.session ? { sessionId: String(req.query.session) } : {}),
+                    ...(req.query["vendor"] ? { vendor: String(req.query["vendor"]) } : {}),
+                    ...(req.query["status"] ? { status: String(req.query["status"]) } : {}),
+                    ...(req.query["session"] ? { sessionId: String(req.query["session"]) } : {}),
                 }),
                 warnings: [],
             });
@@ -398,12 +485,12 @@ export function registerBrowserRoutes(app, requireAuth) {
         try {
             res.json({
                 ok: true,
-                vendor: String(req.query.vendor || 'chatgpt'),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
                 status: 'ready',
                 capabilities: browser.webAi.listCapabilitySchemas({
-                    ...(req.query.vendor ? { vendor: String(req.query.vendor) } : {}),
-                    ...(req.query.family ? { family: String(req.query.family) } : {}),
-                    ...(req.query.frontendStatus ? { frontendStatus: String(req.query.frontendStatus) } : {}),
+                    ...(req.query["vendor"] ? { vendor: String(req.query["vendor"]) } : {}),
+                    ...(req.query["family"] ? { family: String(req.query["family"]) } : {}),
+                    ...(req.query["frontendStatus"] ? { frontendStatus: String(req.query["frontendStatus"]) } : {}),
                 }),
                 warnings: [],
             });
@@ -431,8 +518,8 @@ export function registerBrowserRoutes(app, requireAuth) {
     app.get('/api/browser/web-ai/diagnose', requireAuth, async (req, res) => {
         try {
             res.json(await browser.webAi.diagnose(cdpPort(req), {
-                vendor: String(req.query.vendor || 'chatgpt'),
-                stage: String(req.query.stage || 'unknown'),
+                vendor: String(req.query["vendor"] || 'chatgpt'),
+                stage: String(req.query["stage"] || 'unknown'),
             }));
         }
         catch (e) {
@@ -444,17 +531,17 @@ function toWebAiHttpError(e) {
     if (isWebAiErrorLike(e)) {
         const json = e.toJSON?.();
         if (json && typeof json === 'object') {
-            return {
+            return stripUndefined({
                 ok: false,
-                error: String(json.message ?? ''),
-                stage: String(json.stage ?? 'unknown'),
-                errorCode: json.errorCode,
-                retryHint: json.retryHint,
-                vendor: json.vendor,
-                mutationAllowed: json.mutationAllowed,
-                selectorsTried: json.selectorsTried,
-                evidence: json.evidence,
-            };
+                error: String(json["message"] ?? ''),
+                stage: String(json["stage"] ?? 'unknown'),
+                errorCode: json["errorCode"],
+                retryHint: json["retryHint"],
+                vendor: json["vendor"],
+                mutationAllowed: json["mutationAllowed"],
+                selectorsTried: json["selectorsTried"],
+                evidence: json["evidence"],
+            });
         }
     }
     const err = e;