opendevbrowser 0.0.17 → 0.0.19

package/extension/dist/services/url-restrictions.js

@@ -1,13 +1,9 @@
-const RESTRICTED_PROTOCOLS = new Set([
-    "chrome:",
-    "chrome-extension:",
-    "chrome-search:",
-    "chrome-untrusted:",
-    "devtools:",
-    "chrome-devtools:",
-    "edge:",
-    "brave:"
+const ALLOWED_PROTOCOLS = new Set([
+    "http:",
+    "https:"
 ]);
+const DEFAULT_SCHEME_MESSAGE = "Active tab uses a restricted URL scheme. Focus a normal http(s) tab and retry.";
+const DEFAULT_WEB_STORE_MESSAGE = "Chrome Web Store tabs cannot be debugged. Open a normal tab and retry.";
 const isWebStoreUrl = (url) => {
     if (url.hostname === "chromewebstore.google.com") {
         return true;
@@ -17,12 +13,12 @@ const isWebStoreUrl = (url) => {
     }
     return false;
 };
-export const getRestrictionMessage = (url) => {
-    if (RESTRICTED_PROTOCOLS.has(url.protocol)) {
-        return "Active tab uses a restricted URL scheme. Focus a normal http(s) tab and retry.";
+export const getRestrictionMessage = (url, options) => {
+    if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
+        return options?.restrictedSchemeMessage ?? DEFAULT_SCHEME_MESSAGE;
     }
     if (isWebStoreUrl(url)) {
-        return "Chrome Web Store tabs cannot be debugged. Open a normal tab and retry.";
+        return options?.webStoreMessage ?? DEFAULT_WEB_STORE_MESSAGE;
     }
     return null;
 };

package/extension/manifest.json

@@ -1,10 +1,11 @@
 {
   "manifest_version": 3,
   "name": "OpenDevBrowser Relay",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "description": "Optional bridge to reuse existing Chrome tabs with OpenDevBrowser.",
   "permissions": [
     "debugger",
+    "webNavigation",
     "alarms",
     "tabs",
     "storage",
@@ -14,7 +15,6 @@
   ],
   "host_permissions": [
     "http://127.0.0.1/*",
-    "http://localhost/*",
     "<all_urls>"
   ],
   "icons": {

package/extension/popup.html

@@ -85,11 +85,12 @@
       }
 
       .brand-mark {
-        width: 12px;
-        height: 12px;
-        border-radius: 4px;
-        background: linear-gradient(135deg, var(--accent) 0%, var(--accent-2) 100%);
-        box-shadow: 0 0 14px rgba(32, 213, 198, 0.55);
+        width: 22px;
+        height: 22px;
+        display: block;
+        object-fit: contain;
+        flex-shrink: 0;
+        filter: drop-shadow(0 0 10px rgba(32, 213, 198, 0.35));
       }
 
       .brand-title {
@@ -433,7 +434,7 @@
     <div class="app">
       <header class="app-header">
         <div class="brand">
-          <div class="brand-mark"></div>
+          <img class="brand-mark" src="icons/icon32.png" alt="OpenDevBrowser logo" />
           <div>
             <div class="brand-title">OpenDevBrowser</div>
             <div class="brand-subtitle">Relay Extension</div>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opendevbrowser",
-  "version": "0.0.17",
-  "description": "OpenCode plugin for browser automation via CDP with snapshot-refs-actions workflow",
+  "version": "0.0.19",
+  "description": "Browser automation runtime with snapshot-refs-actions, browser replay screencasts, public read-only desktop observation, and browser-scoped computer-use orchestration",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,7 +27,14 @@
     "playwright",
     "testing",
     "web-scraping",
-    "chrome"
+    "chrome",
+    "annotation",
+    "design-canvas",
+    "screencast",
+    "desktop-observation",
+    "browser-replay",
+    "computer-use",
+    "challenge-automation"
   ],
   "license": "MIT",
   "repository": {
@@ -38,11 +45,11 @@
     "node": ">=18"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/cli/index.ts --format esm --clean --sourcemap && tsc --emitDeclarationOnly --declaration --declarationMap -p tsconfig.json && node --input-type=module -e \"import { copyFileSync, existsSync } from 'node:fs';\nimport { resolve } from 'node:path';\nconst dist = resolve('dist');\nconst pairs = [\n  ['index.js', 'opendevbrowser.js'],\n  ['index.js.map', 'opendevbrowser.js.map'],\n  ['index.d.ts', 'opendevbrowser.d.ts'],\n  ['index.d.ts.map', 'opendevbrowser.d.ts.map'],\n];\nfor (const [src, dst] of pairs) {\n  const from = resolve(dist, src);\n  const to = resolve(dist, dst);\n  if (existsSync(from)) copyFileSync(from, to);\n}\"",
-    "dev": "tsup src/index.ts src/cli/index.ts --format esm --dts --watch",
+    "build": "tsup src/index.ts src/cli/index.ts src/skills/skill-loader.ts --format esm --clean --sourcemap && tsc --emitDeclarationOnly --declaration --declarationMap -p tsconfig.json && node scripts/postbuild-dist.mjs",
+    "dev": "tsup src/index.ts src/cli/index.ts src/skills/skill-loader.ts --format esm --dts --watch",
     "lint": "eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "test": "node --input-type=module -e \"import { mkdirSync } from 'node:fs'; mkdirSync('coverage/.tmp', { recursive: true });\" && vitest run --coverage",
+    "test": "node scripts/run-vitest-coverage.mjs",
     "test:release-gate": "node scripts/release-gate-test-groups.mjs",
     "test:release-gate:g1": "node scripts/release-gate-test-groups.mjs --group 1",
     "test:release-gate:g2": "node scripts/release-gate-test-groups.mjs --group 2",
@@ -57,10 +64,11 @@
     "prepack": "npm run version:check && npm run build && npm run extension:build"
   },
   "dependencies": {
-    "@opencode-ai/plugin": "^1.2.11",
+    "@opencode-ai/plugin": "^1.2.25",
     "@puppeteer/browsers": "^2.13.0",
     "async-mutex": "^0.5.0",
     "jsonc-parser": "^3.2.0",
+    "parse5": "^8.0.0",
     "playwright-core": "^1.58.2",
     "typescript": "^5.9.3",
     "ws": "^8.19.0",

package/skills/AGENTS.md

@@ -1,21 +1,20 @@
 # skills/ — Agent Guidelines
 
-Bundled canonical OpenDevBrowser skill packs (8 total) plus shared compatibility dirs (`research/`, `shopping/`). Extends root `AGENTS.md`.
+Bundled OpenDevBrowser skill directories (9 canonical packs). Extends root `AGENTS.md`.
 
 ## Structure
 
 ```
 skills/
 ├── opendevbrowser-best-practices/SKILL.md
+├── opendevbrowser-design-agent/SKILL.md
 ├── opendevbrowser-continuity-ledger/SKILL.md
 ├── opendevbrowser-login-automation/SKILL.md
 ├── opendevbrowser-form-testing/SKILL.md
 ├── opendevbrowser-data-extraction/SKILL.md
 ├── opendevbrowser-research/SKILL.md
 ├── opendevbrowser-shopping/SKILL.md
-├── opendevbrowser-product-presentation-asset/SKILL.md
-├── research/      # Empty compatibility alias dir; keep non-canonical
-└── shopping/      # Empty compatibility alias dir; keep non-canonical
+└── opendevbrowser-product-presentation-asset/SKILL.md
 ```
 
 ## SKILL.md Format
@@ -44,6 +43,7 @@ Content organized by topic for filtering.
 7. `.amp/skills/` (AmpCLI project compatibility)
 8. `$AMPCLI_HOME/skills` or `$AMP_CLI_HOME/skills` or `$AMP_HOME/skills` (AmpCLI global compatibility; fallback `~/.amp/skills`)
 9. `skillPaths` config (custom)
+10. Bundled package `skills/` directory as a fallback when no installed copy is available
 
 ## Constraints
 
@@ -51,15 +51,16 @@ Content organized by topic for filtering.
 - Keep guidance short, script-first, snapshot-first
 - Examples must use `opendevbrowser_*` tool names
 - Never include secrets or page data in content
-- Keep canonical guidance in `opendevbrowser-*` packs; do not add legacy alias directories.
-- Leave `skills/research/` and `skills/shopping/` empty unless a verified migration plan explicitly repurposes them.
+- Keep canonical guidance in `opendevbrowser-*` packs; do not reintroduce legacy alias directories.
 - Match the snapshot → refs → actions flow in `docs/ARCHITECTURE.md` and tool list in `docs/CLI.md`.
+- Keep first-contact quick-start wording aligned with `src/cli/onboarding-metadata.json`, generated help, and `docs/FIRST_RUN_ONBOARDING.md`.
+- When a pack touches runtime lanes, keep the exact generated-help labels `screencast / browser replay`, `desktop observation`, and `computer use / browser-scoped computer use` aligned across packs, and never describe the helper as a desktop agent.
 - Note that extension relay requires Chrome 125+ and uses hub-only relay ownership when enabled.
 - Refer to root `AGENTS.md` for connection flag/status semantics (extensionConnected, handshake, cdpConnected, pairingRequired).
-- Keep skill operational guidance aligned with release-gate scripts in `docs/CLI.md` (`provider-live-matrix --release-gate`, `live-regression-matrix --release-gate`).
+- Keep skill operational guidance aligned with release-gate scripts in `docs/CLI.md` (`provider-direct-runs --release-gate`, `live-regression-direct --release-gate`).
 
 ## Adding Skills
 
 1. Create `skills/<skill-name>/SKILL.md`
 2. Follow frontmatter format above
-3. Update `docs/CLI.md` if adding CLI-related guidance
+3. Update `README.md`, root `AGENTS.md`, and `docs/CLI.md` when the canonical skill-pack count changes

package/skills/opendevbrowser-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: opendevbrowser-best-practices
 description: This skill should be used when the user asks to design or run OpenDevBrowser provider workflows, scraping pipelines, QA/debug automation, parity checks across modes, or resilient browser operations with codified scripts and artifacts.
-version: 2.5.0
+version: 2.6.0
 ---
 
 # OpenDevBrowser Best Practices
@@ -15,6 +15,8 @@ Use this skill when you need:
 - diagnostics for QA/debug (`console`, `network`, trace context),
 - safe write flows with explicit policy notice.
 
+For frontend, design-system, screenshot-to-code, or `/canvas` composition tasks, load `opendevbrowser-design-agent` immediately after this pack so the work is design-contract-first instead of operations-only.
+
 ## Pack Contents
 
 - `artifacts/provider-workflows.md` — canonical provider execution flows.
@@ -25,11 +27,13 @@ Use this skill when you need:
 - `artifacts/browser-agent-known-issues-matrix.md` — known browser-agent failure modes mapped to required controls.
 - `artifacts/command-channel-reference.md` — CLI/tool/`/ops`/`/canvas`/`/cdp` surface map plus cross-agent skill-sync targets.
 - `artifacts/canvas-governance-playbook.md` — `/canvas` preflight, blocker, and feedback-evaluation guidance.
+- `artifacts/skill-runtime-surface-matrix.md` — canonical skill-pack and runtime-family inventory for real-task audits.
 - `assets/templates/mode-flag-matrix.json` — mode + flag verification template.
 - `assets/templates/ops-request-envelope.json` — `/ops` request envelope template.
 - `assets/templates/cdp-forward-envelope.json` — `/cdp` relay envelope template.
 - `assets/templates/robustness-checklist.json` — shared issue-status checklist for workflow robustness audits.
 - `assets/templates/surface-audit-checklist.json` — docs/surface audit checklist template.
+- `assets/templates/skill-runtime-pack-matrix.json` — machine-readable canonical skill/runtime matrix for the audit runner.
 - `assets/templates/canvas-handshake-example.json` — canonical `/canvas` handshake example.
 - `assets/templates/canvas-generation-plan.v1.json` — required `canvas.plan.set` request skeleton.
 - `assets/templates/canvas-feedback-eval.json` — target-attributed feedback evaluation checklist.
@@ -38,7 +42,7 @@ Use this skill when you need:
 - `scripts/run-robustness-audit.sh` — validates workflow skill coverage against known issue IDs.
 - `scripts/validate-skill-assets.sh` — validates required artifacts/templates.
 
-## Fast Start
+## Quick Start
 
 1. Validate the skill pack:
 
@@ -67,6 +71,71 @@ npx opendevbrowser help
 ./skills/opendevbrowser-best-practices/scripts/run-robustness-audit.sh
 ```
 
+6. Pair with the dedicated design pack for frontend work:
+
+```bash
+./skills/opendevbrowser-design-agent/scripts/validate-skill-assets.sh
+./skills/opendevbrowser-design-agent/scripts/design-workflow.sh contract-first
+```
+
+## Help-Led Surface Discovery
+
+Start every surface audit with generated help so the capability map reflects the currently shipped runtime:
+
+- Browser replay: `screencast-start`, `screencast-stop`
+- Desktop observation: `desktop-status`, `desktop-windows`, `desktop-active-window`, `desktop-capture-desktop`, `desktop-capture-window`, `desktop-accessibility-snapshot`
+- Browser-scoped computer use: `--challenge-automation-mode off|browser|browser_with_helper` plus manager-owned `review`, `session-inspector`, and workflow fallback metadata
+
+Boundary rules:
+- desktop observation is public and read-only
+- the optional helper remains browser-scoped and is not a desktop agent
+- generated help, `docs/CLI.md`, and `docs/SURFACE_REFERENCE.md` must stay aligned whenever this wording changes
+
+## Validated Capability Lanes
+
+Load this section directly with:
+
+```text
+opendevbrowser_skill_load opendevbrowser-best-practices "validated capability lanes"
+```
+
+Current reliable lanes from the April 6 validation pass:
+
+1. Public-first YouTube transcript retrieval.
+
+```bash
+node scripts/youtube-transcript-live-probe.mjs --url "https://www.youtube.com/watch?v=aircAruvnKk" --youtube-mode auto --out artifacts/capability-fix/youtube-transcript-auto.json
+```
+
+Rules:
+- keep transcript runs public-first
+- browser-assisted transcript fallback is opt-in only
+- if browser fallback is enabled, use an isolated automation profile instead of a daily logged-in Google profile
+
+2. Generic topical research without shopping contamination.
+
+```bash
+npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --mode json --output-format json
+```
+
+Rules:
+- use `--source-selection auto` for general research
+- use `--source-selection shopping` or explicit `--sources ...shopping...` only when the task is deliberately commercial
+- in the current contract, `auto` and `all` both resolve to `web`, `community`, and `social`
+
+3. Deterministic shopping reruns with explicit providers.
+
+```bash
+npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --mode json --output-format json
+npx opendevbrowser shopping run --query "27 inch 4k monitor" --providers shopping/bestbuy,shopping/ebay --budget 350 --sort lowest_price --browser-mode managed --mode json --output-format json
+npx opendevbrowser shopping run --query "wireless earbuds" --providers shopping/amazon --region us --browser-mode managed --mode json --output-format json
+```
+
+Rules:
+- use explicit providers plus `--browser-mode managed` for the most reproducible reruns
+- treat `--region` as advisory unless `meta.selection.region_authoritative=true`
+- inspect `meta.primaryConstraintSummary` and `meta.offerFilterDiagnostics` before calling a no-offer run a provider outage
+
 ## Agent Sync Targets
 
 Skill-pack installation and discovery are synchronized for:
@@ -77,13 +146,15 @@ Skill-pack installation and discovery are synchronized for:
 
 Legacy compatibility aliases `claude` and `amp` are preserved in installer target metadata.
 
+Install and update refresh managed copies of these canonical packs; uninstall removes managed canonical packs and only prunes empty legacy `research` or `shopping` leftovers.
+
 ## Required Operating Rules
 
 - Prefer refs from `opendevbrowser_snapshot` over raw selectors.
 - Use one action per decision loop: snapshot -> action -> snapshot.
 - Keep a single correlation context (`requestId`, `sessionId`) across a run.
 - Run the same workflow shape across all three modes before claiming parity.
-- Default to read/research workflows. Social posting probes remain disabled unless explicitly requested via matrix opt-in (`--include-social-posts`).
+- Default to read/research workflows. Social posting probes remain disabled unless explicitly requested via direct-run opt-in (`--include-social-posts`).
 - Apply rate-limit/backoff discipline (`Retry-After` aware) whenever 429 pressure appears.
 - Re-check extension readiness on resume when a run crosses idle windows.
 
@@ -152,6 +223,14 @@ opendevbrowser_network_poll sessionId="<session-id>" max=100
 opendevbrowser_screenshot sessionId="<session-id>"
 ```
 
+Use browser replay when timing matters:
+
+```text
+opendevbrowser_screencast_start sessionId="<session-id>" outputDir="./artifacts/qa-replay"
+# run the suspect flow
+opendevbrowser_screencast_stop sessionId="<session-id>" screencastId="<screencast-id>"
+```
+
 ### Read-Only Social Validation Workflow
 
 Goal: validate authenticated read/search capability without posting.
@@ -171,6 +250,7 @@ Use the router script to avoid retyping flows:
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh qa-debug
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh social-readonly-check
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh parity-check
+./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh release-direct-gates
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh surface-audit
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh ops-channel-check
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh cdp-channel-check
@@ -178,6 +258,8 @@ Use the router script to avoid retyping flows:
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh robustness-audit
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh canvas-preflight
 ./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh canvas-feedback-eval
+./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh skill-runtime-audit
+./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh validated-capabilities
 ```
 
 ## Modes and Surface Parity
@@ -194,16 +276,40 @@ Parity gate test:
 npm run test -- tests/parity-matrix.test.ts
 ```
 
+Treat `tests/parity-matrix.test.ts` as contract coverage only. Live release proof comes from the direct-run harnesses below.
+This pack is the canonical owner of direct-run release evidence policy; other docs and skill packs should point here instead of restating the full policy.
+
 Real-world provider+mode scenario harness (soak replacement):
 
 ```bash
 npm run build
-node scripts/provider-live-matrix.mjs --use-global-env --skip-live-regression --out artifacts/provider-live-realworld.json
+node scripts/provider-direct-runs.mjs --out artifacts/provider-direct-realworld.json
+node scripts/live-regression-direct.mjs --out artifacts/live-regression-direct.json
 ```
 
 Surface inventory source of truth:
-- `docs/SURFACE_REFERENCE.md` (56 CLI commands, 49 tools, 38 `/ops` commands, 26 `/canvas` commands, `/cdp` envelope contracts; mirrored by `npx opendevbrowser --help` and `npx opendevbrowser help`)
+- `docs/SURFACE_REFERENCE.md` (72 CLI commands, 65 tools, 59 `/ops` commands, 35 `/canvas` commands, `/cdp` envelope contracts; mirrored by `npx opendevbrowser --help` and `npx opendevbrowser help`)
 - `artifacts/command-channel-reference.md` (skill-pack operational digest)
+- `artifacts/skill-runtime-surface-matrix.md` and `assets/templates/skill-runtime-pack-matrix.json` (canonical pack/runtime audit inventory)
+
+Direct-run release note:
+- `scripts/live-regression-direct.mjs` is the preferred release harness for `/canvas`, annotate, and CLI smoke. It uses temporary managed profiles for managed probes, waits for `/ops` drain before the legacy `/cdp` step, and keeps manual annotation timeouts as explicit `skipped` boundaries in `--release-gate` mode.
+- `scripts/provider-direct-runs.mjs --use-global-env --include-high-friction --include-auth-gated` is the preferred provider release harness. Treat `provider-live-matrix` and `live-regression-matrix` as debug-only helpers, not refreshed release evidence.
+
+## Skill Runtime Audit and Realignment
+
+This pack is the canonical owner of repo-local skill runtime audit policy and skill-pack runtime realignment.
+
+Use these assets when the task is to inventory or validate the full OpenDevBrowser skill/runtime surface:
+- `artifacts/skill-runtime-surface-matrix.md`
+- `assets/templates/skill-runtime-pack-matrix.json`
+- `scripts/skill-runtime-audit.mjs`
+
+Audit runtime rule:
+- `scripts/skill-runtime-audit.mjs` keeps smoke mode isolated and reproducible with temp harnesses, but full mode must reuse the current configured daemon and environment for `provider-direct` and `live-regression` so extension state, cookies, and auth-backed scenarios are exercised for real when available.
+
+Realignment rule:
+- when a pack drifts behind current runtime behavior, update the skill to match the repo reality and strengthen the workflow guidance instead of making the pack merely stop failing validation.
 
 ## Canvas Governance Handshake
 
@@ -233,20 +339,21 @@ Recommended command order:
    - `validationTargets`
 4. Only after the plan is accepted, call `canvas.document.patch`.
 5. Use `canvas.preview.render`, `canvas.tab.open`, `canvas.overlay.mount`, and `canvas.overlay.select` when a browser-backed live view is required.
-6. Use `canvas.feedback.poll` between mutation rounds and `canvas.document.save` or `canvas.document.export` to persist artifacts.
+6. Use `canvas.feedback.poll` for snapshot audits between mutation rounds, and use `canvas.feedback.subscribe` -> `canvas.feedback.next` -> `canvas.feedback.unsubscribe` when a live pull-stream is needed.
+7. Use `canvas.document.save` or `canvas.document.export` to persist artifacts.
 
 Code-sync surface:
 - `canvas.session.attach` joins an existing canvas session as an `observer` or reclaims the write lease with `attachMode=lease_reclaim`.
 - `canvas.code.bind`, `canvas.code.unbind`, `canvas.code.pull`, `canvas.code.push`, `canvas.code.status`, and `canvas.code.resolve` manage TSX-first document bindings when a canvas file is round-tripped to repo code.
 
 Current `/canvas` parity notes:
-- All 26 public `canvas.*` commands are agent-callable through `opendevbrowser_canvas` and `opendevbrowser canvas --command ...`.
+- All 35 public `canvas.*` commands are agent-callable through `opendevbrowser_canvas` and `opendevbrowser canvas --command ...`.
 - `canvas.feedback.subscribe` live streaming is public through the CLI only: use `--output-format stream-json` for the built-in polling bridge.
-- Tool-driven agents can achieve the same behavior by calling `canvas.feedback.subscribe` once and then looping on `canvas.feedback.poll` with the returned cursor.
+- Tool-driven agents can achieve the same public streaming behavior by calling `canvas.feedback.subscribe`, then repeating `canvas.feedback.next`, and finally `canvas.feedback.unsubscribe`.
 - `canvas.tab.sync` and `canvas.overlay.sync` are internal extension runtime helpers, not public commands.
 - `canvas_html` is still the default preview/export contract. `bound_app_runtime` is opt-in and only valid when runtime preflight and app-side instrumentation succeed.
 - Component and icon libraries currently render semantically, not package-faithfully. Treat `shadcn`, `tailwindcss`, `tabler`, `microsoft-fluent-ui-system-icons`, `3dicons`, and `@lobehub/fluent-emoji-3d` as metadata and constrained render lanes, not as general library import/export parity.
-- Annotation remains a separate surface today, but popup and canvas both ship per-item and combined `Copy` / `Send` actions. The remaining gap is that `Send` persists payloads for later `annotate --stored` retrieval instead of proactively injecting them into the active agent chat.
+- Annotation remains a separate surface today, but popup and canvas both ship per-item and combined `Copy` / `Send` actions. `Send` now delivers directly into the active agent chat when scope is safe and degrades to stored-only `annotate --stored` retrieval when scope is missing, ambiguous, or relay enqueue fails.
 
 Tailwind usage rule:
 - When `allowedLibraries.styling` includes `tailwindcss`, use it for layout, spacing, responsive, and state styling over canonical tokens/theme variables.
@@ -257,6 +364,7 @@ Failure handling:
 - `plan_required`: immediately call `canvas.plan.set`.
 - `revision_conflict`: reload with `canvas.document.load` and replay the patch batch against the latest revision.
 - `unsupported_target` or `restricted_url`: move the preview to a normal http(s) tab or fall back to managed mode.
+- If a freshly rebuilt unpacked extension still shows old `/canvas` or popup behavior, reload the extension in Chrome before trusting the live result; stale MV3 runtime state can preserve old service-worker logic after `npm run extension:build`.
 
 Operational references:
 - `artifacts/canvas-governance-playbook.md`
@@ -268,6 +376,7 @@ Operational references:
 ## Diagnostics and Traceability
 
 Current diagnostics tools:
+- `opendevbrowser_session_inspector` (session-first summary with relay health, target state, trace proof, and next-action guidance)
 - `opendevbrowser_console_poll`
 - `opendevbrowser_network_poll`
 - `opendevbrowser_debug_trace_snapshot` (combined page + console + network + exception channels)

package/skills/opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md

@@ -27,6 +27,7 @@ This matrix defines the minimum robustness controls for OpenDevBrowser workflow
 - `opendevbrowser-shopping`: `ISSUE-06`, `ISSUE-09`, `ISSUE-10`, `ISSUE-11`, `ISSUE-12`
 - `opendevbrowser-product-presentation-asset`: `ISSUE-10`, `ISSUE-11`, `ISSUE-12`
 - `opendevbrowser-research`: `ISSUE-06`, `ISSUE-09`, `ISSUE-10`, `ISSUE-12`
+- `opendevbrowser-design-agent`: `ISSUE-01`, `ISSUE-07`, `ISSUE-08`, `ISSUE-12`
 
 ## Source Notes
 

package/skills/opendevbrowser-best-practices/artifacts/command-channel-reference.md

@@ -6,14 +6,15 @@ Compact operational map of the current OpenDevBrowser surfaces, with the `/canva
 
 ## Current coverage snapshot
 
-- CLI commands: `56`
-- Plugin tools: `49`
-- `/ops` command names: `38`
-- `/canvas` command names: `26`
+- CLI commands: `72`
+- Plugin tools: `65`
+- `/ops` command names: `59`
+- `/canvas` command names: `35`
 - Legacy `/cdp` relay: generic CDP forwarding (method-level)
 
 Canonical exhaustive reference: `docs/SURFACE_REFERENCE.md`.
 CLI help mirror: `npx opendevbrowser --help` and `npx opendevbrowser help` (identical inventories).
+Help-led highlights: browser replay (`screencast-start`, `screencast-stop`), public desktop observation (`desktop-*`), and browser-scoped computer use (`--challenge-automation-mode off|browser|browser_with_helper`); the helper is not a desktop agent.
 
 ## Agent skill-sync coverage
 
@@ -29,16 +30,21 @@ Legacy aliases `claude` and `amp` remain present in installer target metadata fo
 
 - Install/runtime: `install`, `update`, `uninstall`, `help`, `version`, `serve`, `daemon`, `native`, `run`, `artifacts`
 - Session/connection/workflow: `launch`, `connect`, `disconnect`, `status`, `cookie-import`, `cookie-list`, `research`, `shopping`, `product-video`
-- Navigation/interaction: `goto`, `wait`, `snapshot`, `click`, `hover`, `press`, `check`, `uncheck`, `type`, `select`, `scroll`, `scroll-into-view`
+- Navigation/interaction: `goto`, `wait`, `snapshot`, `click`, `hover`, `press`, `check`, `uncheck`, `type`, `select`, `scroll`, `scroll-into-view`, `upload`
+- Pointer controls: `pointer-move`, `pointer-down`, `pointer-up`, `pointer-drag`
 - Targets/pages/DOM: `targets-list`, `target-use`, `target-new`, `target-close`, `page`, `pages`, `page-close`, `dom-html`, `dom-text`, `dom-attr`, `dom-value`, `dom-visible`, `dom-enabled`, `dom-checked`
+- Temporal capture: `screenshot`, `screencast-start`, `screencast-stop`
+- Desktop observation: `desktop-status`, `desktop-windows`, `desktop-active-window`, `desktop-capture-desktop`, `desktop-capture-window`, `desktop-accessibility-snapshot`
+- Browser-scoped computer-use control: `--challenge-automation-mode` on workflow and macro execute lanes, surfaced through manager-owned review, session-inspector, and fallback metadata rather than a standalone command family
 - Design canvas: `canvas`
-- Export/diagnostics/power: `clone-page`, `clone-component`, `perf`, `screenshot`, `console-poll`, `network-poll`, `debug-trace-snapshot`, `macro-resolve`, `annotate`, `rpc`
+- Export/diagnostics/power: `clone-page`, `clone-component`, `perf`, `dialog`, `console-poll`, `network-poll`, `debug-trace-snapshot`, `session-inspector`, `macro-resolve`, `annotate`, `rpc`
 
 ## Tool surface categories
 
-- Runtime parity tools map to the CLI runtime categories, including `opendevbrowser_canvas`.
+- Runtime parity tools map to the CLI runtime categories, including `opendevbrowser_canvas` and `opendevbrowser_session_inspector`.
+- Additional parity tools cover temporal browser capture (`opendevbrowser_screencast_start`, `opendevbrowser_screencast_stop`) and sibling desktop observation (`opendevbrowser_desktop_status`, `opendevbrowser_desktop_windows`, `opendevbrowser_desktop_active_window`, `opendevbrowser_desktop_capture_desktop`, `opendevbrowser_desktop_capture_window`, `opendevbrowser_desktop_accessibility_snapshot`).
 - Tool-only: `opendevbrowser_prompting_guide`, `opendevbrowser_skill_list`, `opendevbrowser_skill_load`.
-- CLI-only: `rpc`.
+- CLI-only: `install`, `update`, `uninstall`, `help`, `version`, `serve`, `daemon`, `native`, `artifacts`, `rpc`.
 
 ## Relay channels
 
@@ -51,7 +57,10 @@ Namespace groups:
 - `page.*`
 - `nav.*`
 - `interact.*`
+- `pointer.*`
 - `dom.*`
+- `canvas.overlay.*`
+- `canvas.applyRuntimePreviewBridge`
 - `export.*`
 - `devtools.*`
 
@@ -70,9 +79,10 @@ Concurrency policy:
 
 Core command families:
 - Session and governance: `canvas.session.open`, `canvas.session.attach`, `canvas.session.status`, `canvas.session.close`, `canvas.capabilities.get`, `canvas.plan.set`, `canvas.plan.get`
-- Document: `canvas.document.load`, `canvas.document.patch`, `canvas.document.save`, `canvas.document.export`
+- Document: `canvas.document.load`, `canvas.document.import`, `canvas.document.patch`, `canvas.document.save`, `canvas.document.export`
+- History, inventory, and starters: `canvas.history.undo`, `canvas.history.redo`, `canvas.inventory.list`, `canvas.inventory.insert`, `canvas.starter.list`, `canvas.starter.apply`
 - Live targets and overlay: `canvas.tab.open`, `canvas.tab.close`, `canvas.overlay.mount`, `canvas.overlay.unmount`, `canvas.overlay.select`
-- Preview and feedback: `canvas.preview.render`, `canvas.preview.refresh`, `canvas.feedback.poll`, `canvas.feedback.subscribe`
+- Preview and feedback: `canvas.preview.render`, `canvas.preview.refresh`, `canvas.feedback.poll`, `canvas.feedback.subscribe`, `canvas.feedback.next`, `canvas.feedback.unsubscribe`
 - Code sync: `canvas.code.bind`, `canvas.code.unbind`, `canvas.code.pull`, `canvas.code.push`, `canvas.code.status`, `canvas.code.resolve`
 
 Extension runtime subset:
@@ -148,11 +158,14 @@ Feedback contract markers:
 Current operational constraints:
 - `canvas.feedback.subscribe` returns the initial payload on every public surface. For ongoing events:
   - CLI: use `opendevbrowser canvas --command canvas.feedback.subscribe --output-format stream-json`
-  - tool/daemon loops: reuse the returned cursor with repeated `canvas.feedback.poll`
+  - tool/daemon loops: call `canvas.feedback.next` repeatedly, then `canvas.feedback.unsubscribe` when complete
+- Extension design-tab history clicks emit the internal `canvas_history_requested` event; the actual mutation still runs through public `canvas.history.undo` or `canvas.history.redo`, with `plan_required`, `history_empty`, or `history_invalidated` remaining the operator-facing outcomes.
 - `canvas.tab.sync` and `canvas.overlay.sync` are internal extension runtime helpers only.
 - `canvas_html` remains the default preview/export contract; `bound_app_runtime` is valid only when the binding explicitly opts in and runtime preflight succeeds.
 - Library metadata is preserved, but rendered output is still semantic rather than package-faithful.
-- Popup and canvas both ship per-item and combined annotation `Copy` / `Send` actions. Today, `Send` stores the payload for later `annotate --stored` retrieval rather than proactively delivering it into the active agent chat.
+- Popup and canvas both ship per-item and combined annotation `Copy` / `Send` actions. `Send` dispatches `annotation:sendPayload`, posts `/annotation` `store_agent_payload`, and resolves through the shared `AgentInbox` when scope is safe; it degrades to stored-only `annotate --stored` retrieval when scope or relay conditions fail.
+- `/ops` pointer commands (`pointer.move`, `pointer.down`, `pointer.up`, `pointer.drag`) are part of the public default relay inventory and should be included in surface audits when low-level gesture coverage matters.
+- `/ops` preview/runtime bridge coverage includes `canvas.applyRuntimePreviewBridge` alongside overlay commands because extension runtime preview parity depends on both.
 
 Operational rule:
 - Read `canvas.session.open` or `canvas.capabilities.get` before mutation.
@@ -172,6 +185,7 @@ Operational rule:
 - Extension default: `launch` or relay-normalized `connect`
 - Extension legacy: `launch --extension-legacy` or `connect --extension-legacy`
 - Direct CDP: `connect --ws-endpoint ...` or `connect --host ... --cdp-port ...`
+- Direct release harnesses (`live-regression-direct`, `provider-direct-runs`) are the shipping evidence path; broad matrix wrappers are debug-only and should not replace fresh direct-run artifacts.
 
 Required readiness/status checks:
 - `extensionConnected`

package/skills/opendevbrowser-best-practices/artifacts/parity-gates.md

@@ -12,7 +12,8 @@ Define hard pass/fail gates so CLI, tool, and runtime surfaces stay aligned.
 | Navigation + refs loop | managed, extension, cdpConnect | CLI + tools + runtime | `goto/wait/snapshot` parity |
 | Interaction | managed, extension, cdpConnect | CLI + tools + runtime | click/type/select/scroll/press/check/uncheck parity |
 | Targets + pages | managed, extension, cdpConnect | CLI + tools + runtime | target/page command parity |
-| DOM + diagnostics + export | managed, extension, cdpConnect | CLI + tools + runtime | dom/perf/screenshot/console/network/clone parity |
+| DOM + diagnostics + export | managed, extension, cdpConnect | CLI + tools + runtime | dom/perf/screenshot/screencast/browser replay/console/network/clone parity |
+| Desktop observation | local desktop runtime | CLI + tools + daemon | desktop status/window/capture/accessibility parity |
 | Relay channels | extension (default) + extension-legacy | `/ops` + `/cdp` | `/ops` namespace coverage + `/cdp` envelope compatibility |
 
 ## Surface Rules
@@ -30,7 +31,13 @@ npm run test -- tests/tools.test.ts tests/daemon-command.test.ts
 npm run test -- tests/providers-performance-gate.test.ts
 ```
 
+## Contract gates vs live release proof
+
+- `tests/parity-matrix.test.ts` is contract coverage for CLI/tool/runtime surface parity.
+- `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/vX.Y.Z/provider-direct-runs.json` and `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/vX.Y.Z/live-regression-direct.json` are the live release-proof lane.
+- Treat grouped contract checks and direct-run release proof as complementary, not interchangeable.
+
 ## Release Requirement
 
 Ship only when parity tests pass and docs (`README.md`, `docs/CLI.md`, `docs/ARCHITECTURE.md`, `docs/SURFACE_REFERENCE.md`) reflect the same surface map.
-Use `docs/RELEASE_PARITY_CHECKLIST.md` as the release gate source of truth.
+Use `docs/RELEASE_RUNBOOK.md` and the current version-scoped release evidence ledger as the release gate source of truth.

package/skills/opendevbrowser-best-practices/artifacts/provider-workflows.md

@@ -82,6 +82,12 @@ Expected output:
 - `workerStats[]` with `{ sessionId, processed, failures }`
 - `frontierStats` and checkpoint state
 
+## Release evidence lane
+
+- Use `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/vX.Y.Z/provider-direct-runs.json` for provider live release proof.
+- Use `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/vX.Y.Z/live-regression-direct.json` for cross-surface live release proof.
+- Treat parity matrix tests as contract coverage, not live release proof.
+
 ## Failure Policy
 
 - stale refs: re-snapshot and retry once